mlsanityData to 14 Oct 2026

Black-box Dataset Ownership Verification via Backdoor Watermarking

arXiv 2209.06015 ↗First posted 4 Aug 2022cs.CR cs.AI cs.CVcited by 65

Not on the map. Why?

Cited by 26 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

Deep learning, especially deep neural networks (DNNs), has been widely and successfully adopted in many critical applications for its high effectiveness and efficiency. The rapid development of DNNs has benefited from the existence of some high-quality datasets (e.g., ImageNet), which allow researchers and developers to easily verify the performance of their methods. Currently, almost all existing released datasets require that they can only be adopted for academic or educational purposes rather than commercial purposes without permission. However, there is still no good way to ensure that. In this paper, we formulate the protection of released datasets as verifying whether they are adopted for training a (suspicious) third-party model, where defenders can only query the model while having no information about its parameters and training details. Based on this formulation, we propose to embed external patterns via backdoor watermarking for the ownership verification to protect them. Our method contains two main parts, including dataset watermarking and dataset verification. Specifically, we exploit poison-only backdoor attacks (e.g., BadNets) for dataset watermarking and design a hypothesis-test-guided method for dataset verification. We also provide some theoretical analyses of our methods. Experiments on multiple benchmark datasets of different tasks are conducted, which verify the effectiveness of our method. The code for reproducing main experiments is available at urlhttps://github.com/THUYimingLi/DVBW.

Key facts. Cited by 65 papers in the map (data through 14 Oct 2026). Builds on 37 of its 68 references that are in the map. First posted on arXiv 4 Aug 2022.

Builds on

37 of 68 references.

References · 37

  1. 2015Deep Residual Learning for Image Recognitioncited by 52,096
  2. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,364
  3. 2017Inductive Representation Learning on Large Graphscited by 6,320
  4. 2018How Powerful are Graph Neural Networks?cited by 4,393
  5. 2014Deep Learning Face Attributes in the Wildcited by 3,693
  6. 2019A Comprehensive Survey on Graph Neural Networkscited by 2,919
  7. 2014Convolutional Neural Networks for Sentence Classificationcited by 1,127
  8. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,055
  9. 2020A Survey on Visual Transformercited by 654
  10. 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 580
  11. 2019Federated Learning with Differential Privacy: Algorithms and Performance Analysiscited by 536
  12. 2020Backdoor Learning: A Surveycited by 426
25 more
  1. 2020A Survey of Convolutional Neural Networks: Analysis, Applications, and Prospectscited by 397
  2. 2020Invisible Backdoor Attack with Sample-Specific Triggerscited by 353
  3. 2021Anti-Backdoor Learning: Training Clean Models on Poisoned Datacited by 263
  4. 2019A backdoor attack against LSTM-based text classification systemscited by 227
  5. 2020BadNL: Backdoor Attacks against NLP Models with Semantic-preserving Improvementscited by 211
  6. 2017Neural Trojanscited by 153
  7. 2020Entangled Watermarks as a Defense against Model Extractioncited by 149
  8. 2020Backdoor Attacks to Graph Neural Networkscited by 128
  9. 2015A Light CNN for Deep Face Representation with Noisy Labelscited by 126
  10. 2019TBT: Targeted Neural Network Attack with Bit Trojancited by 113
  11. 2020Graph Backdoorcited by 112
  12. 2020An Embarrassingly Simple Approach for Trojan Attack in Deep Neural Networkscited by 97
  13. 2019Deep Neural Network Fingerprinting by Conferrable Adversarial Examplescited by 93
  14. 2021Backdoor Attack in the Physical Worldcited by 84
  15. 2021Manipulating SGD with Data Ordering Attackscited by 74
  16. 2020Backdoor Attack against Speaker Verificationcited by 66
  17. 2021Deep Model Intellectual Property Protection via Deep Watermarkingcited by 54
  18. 2020FakeTagger: Robust Safeguards against DeepFake Dissemination via Provenance Trackingcited by 46
  19. 2021Defending against Model Stealing via Verifying Embedded External Featurescited by 46
  20. 2020Stop-and-Go: Exploring Backdoor Attacks on Deep Reinforcement Learning-based Traffic Congestion Control Systemscited by 37
  21. 2022Few-Shot Backdoor Attacks on Visual Object Trackingcited by 35
  22. 2021Watermarking Graph Neural Networks based on Backdoor Attackscited by 25
  23. 2021How to Inject Backdoors with Better Consistency: Logit Anchoring on Clean Datacited by 24
  24. 2022Hardly Perceptible Trojan Attack against Neural Networks with Bit Flipscited by 22
  25. 2019Visual Privacy Protection via Mapping Distortioncited by 6

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2023: 11; 2024: 19; 2025: 28; 2026: 7.

65 papers.

Sort:

By area:

  1. 2023Domain Watermark: Effective and Harmless Dataset Copyright Protection is Closed at Handcited by 57
  2. 2024IBD-PSC: Input-level Backdoor Detection via Parameter-oriented Scaling Consistencycited by 39
  3. 2023Did You Train on My Dataset? Towards Public Dataset Protection with Clean-Label Backdoor Watermarkingcited by 37
  4. 2024Poisoned Forgery Face: Towards Backdoor Attacks on Face Forgery Detectioncited by 35
  5. 2023Towards Stealthy Backdoor Attacks against Speech Recognition via Elements of Soundcited by 30
  6. 2023Watermarking Text Data on Large Language Models for Dataset Copyrightcited by 27
  7. 2024How to Trace Latent Generative Model Generated Images without Artificial Watermark?cited by 26
  8. 2025REFINE: Inversion-Free Backdoor Defense via Model Reprogrammingcited by 22
  9. 2023Attacks in Adversarial Machine Learning: A Systematic Survey from the Life-cycle Perspectivecited by 20
  10. 2023Backdoor Attack with Sparse and Invisible Triggercited by 20
  11. 2024PointNCBW: Towards Dataset Ownership Verification for Point Clouds via Negative Clean-label Backdoor Watermarkcited by 20
  12. 2024Towards Reliable Verification of Unauthorized Data Usage in Personalized Text-to-Image Diffusion Modelscited by 20
38 more
  1. 2025Rethinking Data Protection in the (Generative) Artificial Intelligence Eracited by 18
  2. 2024SoK: Dataset Copyright Auditing in Machine Learning Systemscited by 15
  3. 2024SoK: On the Role and Future of AIGC Watermarking in the Era of Gen-AIcited by 14
  4. 2023What can Discriminator do? Towards Box-free Ownership Verification of Generative Adversarial Networkcited by 10
  5. 2023Towards Robust Model Watermark via Reducing Parametric Vulnerabilitycited by 10
  6. 2023Turning Your Strength into Watermark: Watermarking Large Language Model via Knowledge Injectioncited by 10
  7. 2024QUEEN: Query Unlearning against Model Extractioncited by 9
  8. 2025Data Duplication: A Novel Multi-Purpose Attack Paradigm in Machine Unlearningcited by 9
  9. 2026State Backdoor: Towards Stealthy Real-world Poisoning Attack on Vision-Language-Action Model in State Spacecited by 9
  10. 2024Data Taggants: Dataset Ownership Verification via Harmless Targeted Data Poisoningcited by 8
  11. 2025DATABench: Evaluating Dataset Auditing in Deep Learning from an Adversarial Perspectivecited by 8
  12. 2024ModelShield: Adaptive and Robust Watermark against Model Extraction Attackcited by 7
  13. 2025Mitigating Unintended Memorization with LoRA in Federated Learning for LLMscited by 7
  14. 2025DarkHash: A Data-Free Backdoor Attack Against Deep Hashingcited by 6
  15. 2023A Proxy Attack-Free Strategy for Practically Improving the Poisoning Efficiency in Backdoor Attackscited by 5
  16. 2024Really Unlearned? Verifying Machine Unlearning via Influential Sample Pairscited by 5
  17. 2025Protecting Your Video Content: Disrupting Automated Video-based LLM Annotationscited by 5
  18. 2024Are You Copying My Prompt? Protecting the Copyright of Vision Prompt for VPaaS via Watermarkcited by 4
  19. 2024Graph Neural Backdoor: Fundamentals, Methodologies, Applications, and Future Directionscited by 4
  20. 2025Harnessing Frequency Spectrum Insights for Image Copyright Protection Against Diffusion Modelscited by 4
  21. 2025Instance-Level Data-Use Auditing of Visual ML Modelscited by 4
  22. 2025Cert-SSBD: Certified Backdoor Defense with Sample-Specific Smoothing Noisescited by 4
  23. 2024Evaluating of Machine Unlearning: Robustness Verification Without Prior Modificationscited by 3
  24. 2025CBW: Towards Dataset Ownership Verification for Speaker Verification via Clustering-based Backdoor Watermarkingcited by 3
  25. 2025SWAP: Towards Copyright Auditing of Soft Prompts via Sequential Watermarkingcited by 3
  26. 2026Semantic Consensus Decoding: Backdoor Defense for Verilog Code Generationcited by 3
  27. 2024Not Just Change the Labels, Learn the Features: Watermarking Deep Neural Networks with Multi-View Datacited by 2
  28. 2024Lazy Layers to Make Fine-Tuned Diffusion Models More Traceablecited by 2
  29. 2024Proactive Schemes: A Survey of Adversarial Attacks for Social Goodcited by 2
  30. 2025Towards Dataset Copyright Evasion Attack against Personalized Text-to-Image Diffusion Modelscited by 2
  31. 2025Holmes: Towards Effective and Harmless Model Ownership Verification to Personalized Large Vision Models via Decoupling Common Featurescited by 2
  32. 2025Dataset Ownership Verification for Pre-trained Masked Modelscited by 2
  33. 2025Evading Data Provenance in Deep Neural Networkscited by 2
  34. 2025Provable Watermarking for Data Poisoning Attackscited by 2
  35. 2025TED++: Submanifold-Aware Backdoor Detection via Layerwise Tubular-Neighbourhood Screeningcited by 2
  36. 2025DSSmoothing: Toward Certified Dataset Ownership Verification for Pre-trained Language Models via Dual-Space Smoothingcited by 2
  37. 2025SSCL-BW: Sample-Specific Clean-Label Backdoor Watermarking for Dataset Ownership Verificationcited by 2
  38. 2026Adversarial Attacks for Good: A Survey of Proactive Protection across the Visual Content Lifecyclecited by 2

50 most cited of 65 All 65 (JSON)

Similar, not cited

Close in wording, no citation either way

  1. 2022Untargeted Backdoor Watermark: Towards Harmless and Stealthy Dataset Copyright Protection
  2. 2025Persistence of Backdoor-based Watermarks for Neural Networks: A Comprehensive Evaluation
  3. 2024BlockDoor: Blocking Backdoor Based Watermarks in Deep Neural Networks
  4. 2024Forging the Unforgeable: On the Feasibility of Counterfeit Watermarks in Backdoor-Based Dataset Ownership Verification
  5. 2022On the Effectiveness of Dataset Watermarking in Adversarial Settings
  6. 2022Solving the Capsulation Attack against Backdoor-based Deep Neural Network Watermarks by Reversing Triggers
  7. 2023OVLA: Neural Network Ownership Verification using Latent Watermarks
  8. 2022Knowledge-Free Black-Box Watermark and Ownership Proof for Image Classification Neural Networks