SSCL-BW: Sample-Specific Clean-Label Backdoor Watermarking for Dataset Ownership Verification

TL;DR

This paper introduces SSCL-BW, a novel sample-specific clean-label backdoor watermarking technique that creates unique, imperceptible watermarks for each dataset sample, enhancing ownership verification robustness against detection and removal.

Contribution

It proposes a U-Net-based generator for sample-specific watermarks and a composite loss function to ensure effectiveness, imperceptibility, and trigger reliability, addressing limitations of static watermark patterns.

Findings

Effective ownership verification demonstrated on benchmark datasets.

Robust against various watermark removal attacks.

Watermarks are visually imperceptible and sample-specific.

Abstract

The rapid advancement of deep neural networks (DNNs) heavily relies on large-scale, high-quality datasets. However, unauthorized commercial use of these datasets severely violates the intellectual property rights of dataset owners. Existing backdoor-based dataset ownership verification methods suffer from inherent limitations: poison-label watermarks are easily detectable due to label inconsistencies, while clean-label watermarks face high technical complexity and failure on high-resolution images. Moreover, both approaches employ static watermark patterns that are vulnerable to detection and removal. To address these issues, this paper proposes a sample-specific clean-label backdoor watermarking (i.e., SSCL-BW). By training a U-Net-based watermarked sample generator, this method generates unique watermarks for each sample, fundamentally overcoming the vulnerability of static watermark patterns. The core innovation lies in designing a composite loss function with three components: target sample loss ensures watermark effectiveness, non-target sample loss guarantees trigger reliability, and perceptual similarity loss maintains visual imperceptibility. During ownership verification, black-box testing is employed to check whether suspicious models exhibit predefined backdoor behaviors. Extensive experiments on benchmark datasets demonstrate the effectiveness of the proposed method and its robustness against potential watermark removal attacks.