Research map / Adversarial robustness and security / Attacks on text and graphs
Data Taggants: Dataset Ownership Verification Via Harmless Targeted Data Poisoning
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes data taggants, a non-backdoor dataset ownership verification method that uses clean-label gradient-matching poisoning with out-of-distribution random-label keys and a binomial test on top-k predictions.
Problem
Dataset ownership verification: detecting whether a suspicious model was trained on a protected dataset, with black-box (top-k) access and statistical guarantees against false positives, without harming model accuracy.
Approach
Insert harmless clean-label poisons (signatures) into a small signing set so that models trained on the data map random out-of-distribution key images to random key labels; detection uses a binomial test on top-k key accuracy, whose null distribution is known exactly, instead of backdoor triggers and t-tests.
Key results
- On DeiT-small with 3A augmentation and 0.1% budget, data taggants achieve TPR 1.0 and FPR 0.0 with log10 p = -59.6 while keeping validation accuracy 64.2 ± 0.6 (clean 64.2 ± 0.4).
- Backdoor watermarking (Sleeper Agent, BadNets) yields TPR 0.0; data isotopes yield TPR 0.53 with FPR 0.20 and lower validation accuracy (63.0).
- Data taggants reach top-10 key accuracy 87.5% vs 55.0% for transparency at 0.1% budget, with PSNR 27.9 dB.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use data taggants instead of clean training | DeIT-small · ImageNet1k, 3A, 0.1% budget | validation accuracy: 64.2 ± 0.4 -> 64.2 ± 0.6 | No clear effect |
| Use data taggants instead of backdoor watermarking | ImageNet1k ownership verification · DeIT-small, 3A, 0.1% budget | TPR: 0.0 ± 0.0 -> 1.0 ± 0.0 | Helped |
| Use data taggants instead of data isotopes | ImageNet1k ownership verification · DeIT-small, 3A, 0.1% budget | FPR: 0.20 ± 0.08 -> 0.0 ± 0.0 | Helped |
| Use gradient-matched data taggants instead of transparency interpolation | DeIT-small · ImageNet1k, 3A, 0.1% budget | top-10 key accuracy: 55.0 ± 5.8 -> 87.5 ± 5.0 | Helped |
| Use random out-of-distribution keys instead of test-image keys (ablation) | Data taggants · ImageNet1k, DeIT-small, 3A, 0.1% budget | top-10 key accuracy: 27.5 ± 5.0 -> 87.5 ± 5.0 | Helped |
| Reduce signing budget from 0.1% to 0.01% (ablation) | Data taggants · ImageNet1k, DeIT-small, 3A, random keys | top-10 key accuracy: 87.5 ± 5.0 -> 5.0 ± 5.8 | Hurt |
| Reduce signing budget from 0.1% to 0.001% (ablation) | Data taggants · ImageNet1k, DeIT-small, 3A, random keys | top-10 key accuracy: 87.5 ± 5.0 -> 0.0 ± 0.0 | Hurt |
| Use 3A instead of SA for signing when Bob uses SA (ablation) | Data taggants on DeIT-small · ImageNet1k, SA for Bob | top-10 key accuracy: 100.0 ± 0.0 -> 15.0 ± 8.4 | Hurt |
| Use 3A instead of SA for signing when Bob uses 3A (ablation) | Data taggants on DeIT-small · ImageNet1k, 3A for Bob | top-10 key accuracy: 32.5 ± 12.6 -> 87.5 ± 5.0 | Helped |
| Add perceptual loss to taggant crafting (ablation) | Data taggants · Visual stealthiness | visual imperceptibility: null | Helped |
| Replace perceptual loss with L2 weight decay (ablation) | Data taggants · Visual stealthiness | visual imperceptibility: PSNR = 30.6dB -> PSNR = 30.7dB | Hurt |
Surprising findings
- DBSCAN anomaly detection performs significantly worse than random at detecting taggants, as taggant embeddings cluster together.
- Detection is weak or unreliable under cross-architecture transfer (e.g., DeiT-tiny to ResNets), and Alice-Bob augmentation mismatch substantially lowers confidence.
Limitations
- Slight degradation in validation accuracy in some settings remains, which future work should reduce.
- Detection confidence drops when Alice and Bob use different architectures or data augmentations.
- Visible faint patterns in some taggants (PSNR under 30 dB) and only evaluated on image classification.
Experimental setup
Datasets: ImageNet1k
Benchmarks: ImageNet1k
Metrics: top-k key accuracy binomial log10 p-value TPR FPR validation accuracy PSNR ROC AUC for poisoning detectors
Baselines: Sleeper Agent backdoor watermarking BadNets backdoor watermarking Data isotopes Naive canary Transparency
Builds on: Witches' Brew Radioactive data Sleeper Agent Data isotopes
Closest papers by meaning
- ZeroMark: Towards Dataset Ownership Verification without Disclosing Watermark (NeurIPS 2024 · similarity 0.89)
- EntropyMark: Towards More Harmless Backdoor Watermark via Entropy-based Constraint for Open-source Dataset Copyright Protection (CVPR 2025 · similarity 0.88)
- DataElixir: Purifying Poisoned Dataset to Mitigate Backdoor Attacks via Diffusion Models (AAAI 2024 · similarity 0.86)
- STAMP Your Content: Proving Dataset Membership via Watermarked Rephrasings (ICML 2025 · similarity 0.86)
- Clean Data Can Still Carry Backdoors: Support-Persistent Backdoors for Model Reuse (NeurIPS 2026 · similarity 0.86)
- Dataset Ownership Verification in Contrastive Pre-trained Models (ICLR 2025 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.