Deep neural networks (DNNs) have demonstrated their superiority in practice.
Arguably, the rapid development of DNNs is largely benefited from high-quality
(open-sourced) datasets, based on which researchers and developers can easily
evaluate and improve their learning methods. Since the data collection is
usually time-consuming or even expensive, how to protect their copyrights is of
great significance and worth further exploration. In this paper, we revisit
dataset ownership verification. We find that existing verification methods
introduced new security risks in DNNs trained on the protected dataset, due to
the targeted nature of poison-only backdoor watermarks. To alleviate this
problem, in this work, we explore the untargeted backdoor watermarking scheme,
where the abnormal model behaviors are not deterministic. Specifically, we
introduce two dispersibilities and prove their correlation, based on which we
design the untargeted backdoor watermark under both poisoned-label and
clean-label settings. We also discuss how to use the proposed untargeted
backdoor watermark for dataset ownership verification. Experiments on benchmark
datasets verify the effectiveness of our methods and their resistance to
existing backdoor defenses. Our codes are available at
https://github.com/THUYimingLi/Untargeted_Backdoor_Watermark.

通过引入非目标型背门水印方案，该研究探讨了数据集所有权的验证问题，并在多个数据集上验证了其方法的有效性和鲁棒性。

非定向后门水印：迈向无害和隐密的数据集版权保护

Untargeted Backdoor Watermark: Towards Harmless and Stealthy Dataset Copyright Protection

Deep learning, especially deep neural networks (DNNs), has been widely and
successfully adopted in many critical applications for its high effectiveness
and efficiency. The rapid development of DNNs has benefited from the existence
of some high-quality datasets ($e.g.$, ImageNet), which allow researchers and
developers to easily verify the performance of their methods. Currently, almost
all existing released datasets require that they can only be adopted for
academic or educational purposes rather than commercial purposes without
permission. However, there is still no good way to ensure that. In this paper,
we formulate the protection of released datasets as verifying whether they are
adopted for training a (suspicious) third-party model, where defenders can only
query the model while having no information about its parameters and training
details. Based on this formulation, we propose to embed external patterns via
backdoor watermarking for the ownership verification to protect them. Our
method contains two main parts, including dataset watermarking and dataset
verification. Specifically, we exploit poison-only backdoor attacks ($e.g.$,
BadNets) for dataset watermarking and design a hypothesis-test-guided method
for dataset verification. We also provide some theoretical analyses of our
methods. Experiments on multiple benchmark datasets of different tasks are
conducted, which verify the effectiveness of our method. The code for
reproducing main experiments is available at
https://github.com/THUYimingLi/DVBW.

本文基于深度学习和神经网络的高效和有效性，提出了一种基于后门水印的数据集保护模式，其中数据集水印包括数据集水印和数据集验证，实验证明了该方法的有效性。