[论文解读] Domain Watermark: Effective and Harmless Dataset Copyright Protection is Closed at Hand

Junfeng Guo, Yiming Li+5 more|arXiv (Cornell University)|Oct 9, 2023

Adversarial Robustness in Machine Learning被引用 5

一句话总结

本文提出 Domain Watermark，一种新颖的、无害的数据集版权保护方法，利用深度神经网络（DNN）表示空间中难以泛化的样本，创建隐蔽且非后门型的水印。通过训练模型正确分类这些‘难样本’（良性模型会误分类），该方法实现了无需引入恶意行为的版权归属验证，验证准确率高，并对数据增强和域自适应攻击具有强鲁棒性。

ABSTRACT

The prosperity of deep neural networks (DNNs) is largely benefited from open-source datasets, based on which users can evaluate and improve their methods. In this paper, we revisit backdoor-based dataset ownership verification (DOV), which is currently the only feasible approach to protect the copyright of open-source datasets. We reveal that these methods are fundamentally harmful given that they could introduce malicious misclassification behaviors to watermarked DNNs by the adversaries. In this paper, we design DOV from another perspective by making watermarked models (trained on the protected dataset) correctly classify some `hard' samples that will be misclassified by the benign model. Our method is inspired by the generalization property of DNNs, where we find a \emph{hardly-generalized domain} for the original dataset (as its \emph{domain watermark}). It can be easily learned with the protected dataset containing modified samples. Specifically, we formulate the domain generation as a bi-level optimization and propose to optimize a set of visually-indistinguishable clean-label modified data with similar effects to domain-watermarked samples from the hardly-generalized domain to ensure watermark stealthiness. We also design a hypothesis-test-guided ownership verification via our domain watermark and provide the theoretical analyses of our method. Extensive experiments on three benchmark datasets are conducted, which verify the effectiveness of our method and its resistance to potential adaptive methods. The code for reproducing main experiments is available at \url{https://github.com/JunfengGo/Domain-Watermark}.

研究动机与目标

• 解决现有基于后门的数据集所有权验证（DOV）方法的根本性危害，即在水印模型中引入恶意误分类行为。
• 设计一种真正无害的 DOV 方法，不损害模型安全性或性能。
• 利用 DNN 的泛化特性，识别并为原始数据集中‘难以泛化’的域打上水印。
• 通过视觉上无法区分、标签保持清洁的修改数据，实现水印的隐蔽性，其效果与域水印样本相似。
• 设计基于假设检验的验证机制，具备理论保障。

提出的方法

• 将域生成建模为双层优化问题，从原始数据集中学习一个‘难以泛化’的域。
• 使用变换模块生成与原始数据视觉相似但能被水印模型正确分类的域水印样本。
• 优化一组干净标签、视觉上无法区分的修改数据，作为域水印，确保隐蔽性。
• 设计一种基于假设检验的验证协议，利用域水印检测所有权。
• 该方法依赖于良性模型会误分类某些难样本，而水印模型能正确分类这些样本的事实。
• 理论分析支持该方法的鲁棒性与验证可靠性。

Figure 1: The main pipeline of dataset ownership verification with backdoor-based dataset watermarks and our domain watermark, where BW Sample represents existing backdoor-watermarked sample while DW Sample represents our proposed domain-watermarked sample. Existing backdoor-based methods make the w

实验结果

研究问题

• RQ1 能否在不向水印模型中引入有害误分类行为的前提下实现数据集所有权验证？
• RQ2 是否可能利用 DNN 在难样本上的泛化失败特性来创建水印？
• RQ3 如何在不使用后门的情况下，使水印既有效又隐蔽？
• RQ4 所提方法能否抵抗常见的数据增强和域自适应技术？
• RQ5 域水印方法的有效性与鲁棒性的理论基础是什么？

主要发现

• 在强数据增强下，Domain Watermark 方法在 CIFAR-10 和 Tiny-ImageNet 上均实现 100% 的验证准确率（p 值 ≫ 0.05），表明对这类攻击具有强抵抗力。
• 在 CIFAR-10 上，该方法在 L2D 域自适应下仍保持 86.10% 的验证成功率（VSR）和 0.63 的 ΔP，表现出强鲁棒性。
• 在 Tiny-ImageNet 上，该方法在 L2D 下实现 42.00% 的 VSR 和 0.53 的 ΔP，尽管良性模型准确率较低，但性能表现一致。
• 该方法对数据增强具有抵抗力，强增强后，域水印样本未出现显著误分类（p 值 = 1.00）。
• 即使嫌疑模型经过微调或适应处理，该方法仍保持高验证能力，p 值表明验证结果具有统计显著性。
• 该方法具有坚实的理论基础，并提供基于假设检验的验证机制，在三个基准数据集上均获得强有力的实证验证。

Figure 2: The workflow of dataset ownership via our domain watermark. In the first step, we will generate domain-watermarked (DW) samples in a hardly-generalized domain of the benign dataset; In the second step, we will optimize a set of visually-indistinguishable modified samples that have similar