Research map / Label-efficient and robust learning / Self-supervised and contrastive
Dataset Ownership Verification in Contrastive Pre-trained Models
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes a black-box dataset ownership verification method for contrastive self-supervised encoders, using a "contrastive relationship gap" (unary and binary augmentation-based similarity differences) between a suspect encoder and a shadow encoder, tested with a one-tailed t-test.
Problem
Verifying whether a suspicious black-box self-supervised (contrastive) pre-trained encoder was pre-trained on a defender's unlabeled public dataset, since existing dataset ownership verification relies on supervised decision boundaries or watermarks and dataset inference is costly.
Approach
Contrastive encoders represent augmentations of training samples more similarly (unary) and preserve pairwise similarities across augmentations (binary) for seen data; the difference between these statistics on the defender's data versus a private held-out set, relative to a shadow model, forms a "contrastive relationship gap" that is tested statistically without training an inferencer.
Key results
- On CIFAR10 and ImageNette, the proposed method reaches sensitivity, specificity and AUROC of 1.0, versus at most 0.8 sensitivity and 0.775 AUROC for DI4SSL and EncoderMI.
- On ImageNet with ten pre-trained encoders (ResNet50, ViT-S/16, ViT-B/16 across SimCLR, BYOL, SimSiam, SwAV, MoCo v3, DINO), the method gives p-values of 10^-3 to 10^-4 using only 0.1% of ImageNet, while DI4SSL and EncoderMI are often non-significant.
- Verification takes 293 s versus 10014 s for DI4SSL on ImageNet with an RTX 4090.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| use contrastive relationship gaps for dataset ownership verification instead of DI4SSL or EncoderMI | Dataset ownership verification · CIFAR10 and ImageNette | AUROC: CIFAR10: 0.6 (DI4SSL), 0.5 (EncoderMI) -> 1.0; ImageNette: 0.775 (DI4SSL), 0.5 (EncoderMI) -> 1.0 | Helped |
| use the proposed verification method instead of DI4SSL or EncoderMI | ImageNet pre-trained encoders · ImageNet | p-value: DI4SSL 0.15, EncoderMI 1 -> Ours 10^{-3} | Helped |
| use the proposed method instead of DI4SSL | ImageNet verification with SimCLR ResNet50 · ImageNet | time consumption: 10014s -> 293s | Helped |
| add binary relationships to unary relationships (ablation) | Proposed verification method · ImageNet, DINO ResNet50 | p-value: 0.02 -> 4.2\times10^{-4} | Helped |
| add unary relationships to binary relationships (ablation) | Proposed verification method · ImageNet, DINO ResNet50 | p-value: 3.1 \times {10^{ - 3}} -> 4.2\times10^{-4} | Helped |
| use all global and local view pairings rather than global views only (ablation) | Proposed verification method · ImageNet, DINO ResNet50 | p-value: 0.06 -> 4.2\times10^{-4} | Helped |
| increase the sampling sizes k_pub and k_pvt (ablation) | Proposed verification method · ImageNet | p-value | Helped |
| increase the number of global and local augmentations M and N (ablation) | Proposed verification method · ImageNet | p-value | Helped |
| change shadow-model training batch size, learning rate, or weight decay (ablation) | Proposed verification method · ImageNette | p-value: SimCLR: 10^{-11} -> 10^{-6}, 10^{-10}, 10^{-5}; BYOL: 10^{-10} -> 10^{-4}, 10^{-3}, 10^{-4}; SimSiam: 10^{-5} -> 10^{-4} | No clear effect |
| train the suspicious encoder with DP-SGD (ablation) | Proposed verification method · ImageNette | p-value: SimCLR VGG16: 10^{-27} -> 10^{-14}; ResNet18: 10^{-14} -> 10^{-13}; SimSiam VGG16: 0.01 -> 0.01; ResNet18: 10^{-4} -> 10 | No clear effect |
| apply early stopping (ablation) | Proposed verification method · CIFAR10 | p-value: ResNet18: $10^{-12}$ -> 0.01 (patience=15), $10^{-4}$ (patience=30); VGG16: $10^{-11}$ -> $10^{-4}$ (patience=15), $10^{ | No clear effect |
| apply the method to MAE-pretrained encoders with random masking (ablation) | Proposed verification method · ImageNet | p-value: 0.75 (ViT-B/16); 0.44 (ViT-L/16) | Hurt |
Surprising findings
- EncoderMI yields p-values near 0 for nearly all suspicious encoders, including legal ones, indicating it flags innocent suspects.
- The watermark-based adaptation (DOV-CTRL) also flags innocent suspects (e.g., BYOL trained on SVHN gives p near 0.02 and 0.29 for some legal cases).
Limitations
- Does not work for masked image modeling pre-trained encoders such as MAE (p-values 0.44-0.75 even with random masking).
- Requires the defender to tune hyperparameter a per dataset, and results depend on the shadow dataset choice.
- Evaluated only on image datasets and a limited set of contrastive methods; text and other modalities are left to future work.
Experimental setup
Datasets: CIFAR10 CIFAR100 SVHN ImageNette ImageWoof ImageNet
Benchmarks: CIFAR10 ImageNette ImageNet CIFAR100
Metrics: p-value sensitivity specificity AUROC time cost
Baselines: DI4SSL EncoderMI DOV-CTRL
Builds on: dataset inference EncoderMI DI4SSL SimCLR BYOL
Closest papers by meaning
- ZeroMark: Towards Dataset Ownership Verification without Disclosing Watermark (NeurIPS 2024 · similarity 0.87)
- Data Taggants: Dataset Ownership Verification Via Harmless Targeted Data Poisoning (ICLR 2025 · similarity 0.86)
- STAMP Your Content: Proving Dataset Membership via Watermarked Rephrasings (ICML 2025 · similarity 0.83)
- EntropyMark: Towards More Harmless Backdoor Watermark via Entropy-based Constraint for Open-source Dataset Copyright Protection (CVPR 2025 · similarity 0.83)
- Dataset Distillation for Pre-Trained Self-Supervised Vision Models (NeurIPS 2025 · similarity 0.83)
- Training Data Provenance Verification: Did Your Model Use Synthetic Data from My Generative Model for Training? (CVPR 2025 · similarity 0.82)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.