Research map / Label-efficient and robust learning / Recognition and long-tail
EntropyMark: Towards More Harmless Backdoor Watermark via Entropy-based Constraint for Open-source Dataset Copyright Protection
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes EntropyMark, a clean-label backdoor watermark for open-source dataset ownership verification that raises prediction confidence on watermarked-looking samples without changing predicted labels, verified by an entropy-based pairwise t-test.
Problem
Existing backdoor watermark-based dataset ownership verification (BW-DOV) methods alter the prediction results of watermarked models, producing harmful side effects and compromising dataset functionality.
Approach
Use an entropy-based dispersion loss (cross-entropy plus entropy term) to make watermarked samples predicted with higher confidence while preserving the correct label, implemented via an iterative clean-label watermark generator fine-tuned with gradient matching and gradient-norm-based adaptive sample selection, and verified by an entropy inconsistency hypothesis test.
Key results
- On CIFAR-10, EntropyMark reaches 87.00% WSR and 87.79% BA with Cb 0.8936 and Cw 0.8695, while baselines such as BadNets have Cw 0.1076.
- Ownership verification yields p-value 0.0017 for watermarked models versus 1.0000 for benign and other-pattern models on CIFAR-10.
- On Sub-ImageNet-12, EntropyMark achieves 69.62% WSR and 71.35% BA with Cb 0.7510 and Cw 0.7471.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| use EntropyMark rather than BadNets | CIFAR-10 backdoor watermarking · CIFAR-10 | Cw: 0.1076 -> 0.8695 | Helped |
| use EntropyMark rather than BadNets | Sub-ImageNet-12 backdoor watermarking · Sub-ImageNet-12 | Cw: 0.0872 -> 0.7471 | Helped |
| use EntropyMark rather than Label-Consistent | CIFAR-10 backdoor watermarking · CIFAR-10 | BA (%): 92.36 -> 87.79 | Hurt |
| remove iterative fine-tuning (ablation) | EntropyMark · CIFAR-10 | p-value (Watermark): 0.0017 -> 0.0764 | Hurt |
| remove gradient matching (ablation) | EntropyMark · CIFAR-10 | WSR (%): 82.47 -> 73.18 | Hurt |
| remove adaptive selection (ablation) | EntropyMark · CIFAR-10 | p-value (Watermark): 0.0017 -> 0.0039 | Hurt |
| vary iteration rounds from R=2 to R=1 (ablation) | EntropyMark · CIFAR-10 | p-value (Watermark): 0.0017 -> 0.4925 | Hurt |
| vary iteration rounds from R=2 to R=3 (ablation) | EntropyMark · CIFAR-10 | WSR (%): 82.47 -> 80.43 | Hurt |
| vary iteration rounds from R=2 to R=4 (ablation) | EntropyMark · CIFAR-10 | WSR (%): 82.47 -> 69.17 | Hurt |
| vary iteration rounds from R=2 to R=5 (ablation) | EntropyMark · CIFAR-10 | WSR (%): 82.47 -> 72.47 | Hurt |
| vary watermarking rate from γ=0.10 to γ=0.01 (ablation) | EntropyMark · CIFAR-10 | p-value (Watermark): 0.0017 -> 0.0504 | Hurt |
| vary watermarking rate from γ=0.10 to γ=0.05 (ablation) | EntropyMark · CIFAR-10 | WSR (%): 82.47 -> 81.11 | No clear effect |
Surprising findings
- Too many iterative rounds cause WSR to drop sharply, as the entropy constraint clusters watermarked features and leads to misclassification.
- Domain-Watermark's reproduced results on Sub-ImageNet-12 drop BA to 47.69%, indicating instability of prior harmless methods.
Limitations
- WSR of the watermarked model is bounded by benign accuracy under the clean-label setting, so watermark success is limited.
- Watermarked datasets can slightly reduce prediction confidence on verification samples, especially on CIFAR-10.
- Higher watermarking rates (20%) cause verification failures in the 'Other' scenario due to susceptibility to other triggers.
Experimental setup
Datasets: CIFAR-10 ImageNet (12-class subset, Sub-ImageNet-12)
Benchmarks: CIFAR-10 Sub-ImageNet-12
Metrics: watermark success rate benign accuracy prediction consistency index Cb prediction consistency index Cw p-value of pairwise t-test entropy confidence score delta E
Baselines: BadNets Blend UBW-P Label-Consistent Sleeper Agent UBW-C Domain-Watermark
Builds on: Sleeper Agent UBW Domain-Watermark radioactive data DVBW
Closest papers by meaning
- ZeroMark: Towards Dataset Ownership Verification without Disclosing Watermark (NeurIPS 2024 · similarity 0.92)
- Data Taggants: Dataset Ownership Verification Via Harmless Targeted Data Poisoning (ICLR 2025 · similarity 0.88)
- Safe and Robust Watermark Injection with a Single OoD Image (ICLR 2024 · similarity 0.88)
- Lightweight-Mark: Rethinking Deep Learning-Based Watermarking (ICML 2025 · similarity 0.87)
- Disentangled Style Domain for Implicit $z$-Watermark Towards Copyright Protection (NeurIPS 2024 · similarity 0.86)
- Resource Efficient Deep Learning Hardware Watermarks with Signature Alignment (AAAI 2024 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.