X-Mark: Saliency-Guided Robust Dataset Ownership Verification for Medical Imaging

TL;DR

X-Mark introduces a novel watermarking technique for medical images that ensures copyright protection, robustness against scaling, and preserves diagnostic quality, verified through extensive experiments on chest x-ray datasets.

Contribution

The paper presents X-Mark, a sample-specific, clean-label watermarking method tailored for medical imaging, addressing limitations of existing methods in high-resolution, low-diversity scans.

Findings

Achieves 100% watermark success rate on CheXpert.

Reduces false positive probability by 12% in Ind-M scenario.

Demonstrates robustness against adaptive attacks.

Abstract

High-quality medical imaging datasets are essential for training deep learning models, but their unauthorized use raises serious copyright and ethical concerns. Medical imaging presents a unique challenge for existing dataset ownership verification methods designed for natural images, as static watermark patterns generated in fixed-scale images scale poorly dynamic and high-resolution scans with limited visual diversity and subtle anatomical structures, while preserving diagnostic quality. In this paper, we propose X-Mark, a sample-specific clean-label watermarking method for chest x-ray copyright protection. Specifically, X-Mark uses a conditional U-Net to generate unique perturbations within salient regions of each sample. We design a multi-component training objective to ensure watermark efficacy, robustness against dynamic scaling processes while preserving diagnostic quality and visual-distinguishability. We incorporate Laplacian regularization into our training objective to penalize high-frequency perturbations and achieve watermark scale-invariance. Ownership verification is performed in a black-box setting to detect characteristic behaviors in suspicious models. Extensive experiments on CheXpert verify the effectiveness of X-Mark, achieving WSR of 100% and reducing probability of false positives in Ind-M scenario by 12%, while demonstrating resistance to potential adaptive attacks.