Research map / Adversarial robustness and security / Attacks on text and graphs
ZeroMark: Towards Dataset Ownership Verification without Disclosing Watermark
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes ZeroMark, a label-only black-box dataset ownership verification method that verifies watermarked-dataset training by testing boundary gradients' cosine similarity with the watermark pattern, without ever querying with watermarked samples.
Problem
Existing dataset ownership verification (DOV) reveals dataset-specific watermarks during verification, so repeated verification lets adversaries remove the watermark; the verification stage is insecure.
Approach
Watermarked DNNs' boundary gradients (gradients at closest decision-boundary samples of benign inputs) align with the watermark pattern. ZeroMark estimates these gradients via Monte Carlo label-only queries and runs a hypothesis test on cosine similarity with the watermark, never querying with watermarked samples.
Key results
- On CIFAR-10 with BadNets, ZeroMark yields p-value 10^-45 in the malicious scenario, while avoiding false positives (p-value 1.00) for independent models.
- ZeroMark's watermark disclosure (MI) on CIFAR-10 is 18.1 for BadNets versus 64.3 for vanilla DOV verification samples.
- Under unlearning-based adaptive attack, ZeroMark's target-label cosine similarity stays at 0.076 versus 0.028 for benign labels, and fine-tuning has minor effects on the method.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use ZeroMark boundary-gradient analysis instead of benign-label comparison | ZeroMark · CIFAR-10 and Tiny-ImageNet, four watermark types | largest Q% cosine similarity: Benign 0.027/0.026; target 0.174/0.194 (average) | Helped |
| Use ZeroMark rather than Vanilla watermark samples for verification | DOV verification · CIFAR-10, BadNets and Blended | MI: 64.3 -> 18.1; 56.1 -> 24.4 | Helped |
| Use ZeroMark rather than Vanilla watermark samples for verification | DOV verification · Tiny-ImageNet, BadNets and Blended | MI: 68.1 -> 27.7; 59.0 -> 33.2 | Helped |
| Apply ZeroMark to a maliciously trained model | ZeroMark ownership verification · CIFAR-10 and Tiny-ImageNet, four watermark types | p-value: 10−45; 10−67; 10−53; 10−12; 10−58; 10−64; 10−55; 10−49 | Helped |
| Apply ZeroMark to independently watermarked or benign models | ZeroMark ownership verification · CIFAR-10 and Tiny-ImageNet, Independent-W and Independent-M | p-value: 1.00 | No clear effect |
| Increase boundary-sample optimization iterations t (ablation) | ZeroMark · CIFAR-10 and Tiny-ImageNet | cosine similarity | Helped |
| Increase the number of verification samples (ablation) | ZeroMark · CIFAR-10 and Tiny-ImageNet | cosine similarity | Hurt |
| Fine-tune the model (ablation) | ZeroMark on domain watermark · CIFAR-10 and Tiny-ImageNet | cosine similarity | No clear effect |
| Prune the model (ablation) | ZeroMark on domain watermark · CIFAR-10 and Tiny-ImageNet | cosine similarity | Mixed |
| Retrain with 500 boundary samples labeled as their original labels (ablation) | ZeroMark on domain watermark · CIFAR-10 | verification success rate: 88.6% -> 75.1% | Hurt |
| Retrain with 500 boundary samples labeled as their original labels (ablation) | ZeroMark on domain watermark · CIFAR-10 | accuracy: 92.3% -> 90.2% | Hurt |
| Use blended watermark rather than other evaluated watermark techniques | ZeroMark · CIFAR-10 and Tiny-ImageNet | verification effectiveness | Mixed |
Surprising findings
- Verification with minimal or distorted watermarks still discloses substantially more watermark information than ZeroMark, indicating simple perturbation defenses are insufficient.
- Verification with ZeroMark takes nearly 30 minutes on CIFAR-10.
Limitations
- Verification requires about 30 minutes on CIFAR-10 because of iterative boundary sample generation and gradient estimation.
- Only works for watermarks with a predefined target label; not applicable to untargeted watermarks such as UBW.
- Security against malicious recovery is only shown empirically, not proven theoretically; evaluated mainly on CNNs and image data.
Experimental setup
Datasets: CIFAR-10 Tiny-ImageNet
Benchmarks: CIFAR-10 Tiny-ImageNet
Metrics: MSE neuron activation similarity (NAS) mutual information (MI) cosine similarity p-value delta P (confidence score)
Baselines: Vanilla DOV Minimal watermark Distortion watermark Benign verification
Builds on: BadNets FAB (fast adaptive boundary attack) Domain watermark (DW) Neural Cleanse
Closest papers by meaning
- EntropyMark: Towards More Harmless Backdoor Watermark via Entropy-based Constraint for Open-source Dataset Copyright Protection (CVPR 2025 · similarity 0.92)
- Data Taggants: Dataset Ownership Verification Via Harmless Targeted Data Poisoning (ICLR 2025 · similarity 0.89)
- Dataset Ownership Verification in Contrastive Pre-trained Models (ICLR 2025 · similarity 0.87)
- Revisiting the Information Capacity of Neural Network Watermarks: Upper Bound Estimation and Beyond (AAAI 2024 · similarity 0.86)
- Disentangled Style Domain for Implicit $z$-Watermark Towards Copyright Protection (NeurIPS 2024 · similarity 0.86)
- Resource Efficient Deep Learning Hardware Watermarks with Signature Alignment (AAAI 2024 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.