mlsanityData to 7 Oct 2026

Untargeted Backdoor Watermark: Towards Harmless and Stealthy Dataset Copyright Protection

arXiv 2210.00875 ↗First posted 27 Sep 2022cs.CR cs.AI cs.CVcited by 80

Not on the map. Why?

Cited by 24 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

Deep neural networks (DNNs) have demonstrated their superiority in practice. Arguably, the rapid development of DNNs is largely benefited from high-quality (open-sourced) datasets, based on which researchers and developers can easily evaluate and improve their learning methods. Since the data collection is usually time-consuming or even expensive, how to protect their copyrights is of great significance and worth further exploration. In this paper, we revisit dataset ownership verification. We find that existing verification methods introduced new security risks in DNNs trained on the protected dataset, due to the targeted nature of poison-only backdoor watermarks. To alleviate this problem, in this work, we explore the untargeted backdoor watermarking scheme, where the abnormal model behaviors are not deterministic. Specifically, we introduce two dispersibilities and prove their correlation, based on which we design the untargeted backdoor watermark under both poisoned-label and clean-label settings. We also discuss how to use the proposed untargeted backdoor watermark for dataset ownership verification. Experiments on benchmark datasets verify the effectiveness of our methods and their resistance to existing backdoor defenses. Our codes are available at urlhttps://github.com/THUYimingLi/UntargetedBackdoorWatermark.

Key facts. Cited by 80 papers in the map (data through 7 Oct 2026). Builds on 54 of its 89 references that are in the map. First posted on arXiv 27 Sep 2022.

Builds on

54 of 89 references.

References · 54

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2016Grad-CAM: Visual Explanations from Deep Networks via Gradient-based Localizationcited by 6,690
  3. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  4. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
  5. 2017Understanding Black-box Predictions via Influence Functionscited by 1,714
  6. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
  7. 2016An overview of gradient descent optimization algorithmscited by 1,021
  8. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
  9. 2019Deep Leakage from Gradientscited by 1,004
  10. 2017Channel Pruning for Accelerating Very Deep Neural Networkscited by 697
  11. 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 682
  12. 2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 656
38 more
  1. 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 550
  2. 2018Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networkscited by 500
  3. 2018Spectral Signatures in Backdoor Attackscited by 457
  4. 2018Detecting Backdoor Attacks on Deep Neural Networks by Activation Clusteringcited by 429
  5. 2020Backdoor Learning: A Surveycited by 412
  6. 2017A Downsampled Variant of ImageNet as an Alternative to the CIFAR datasetscited by 374
  7. 2019Hidden Trigger Backdoor Attackscited by 359
  8. 2020Invisible Backdoor Attack with Sample-Specific Triggerscited by 338
  9. 2018Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooringcited by 334
  10. 2021Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networkscited by 313
  11. 2019Label-Consistent Backdoor Attackscited by 285
  12. 2021Adversarial Neuron Pruning Purifies Backdoored Deep Modelscited by 230
  13. 2020Witches' Brew: Industrial Scale Data Poisoning via Gradient Matchingcited by 156
  14. 2021Rethinking the Backdoor Attacks' Triggers: A Frequency Perspectivecited by 155
  15. 2017Neural Trojanscited by 151
  16. 2021Investigating Bi-Level Optimization for Learning and Vision from a Unified Perspective: A Survey and Beyondcited by 151
  17. 2021Poisoning and Backdooring Contrastive Learningcited by 149
  18. 2022Backdoor Defense via Decoupling the Training Processcited by 149
  19. 2018SentiNet: Detecting Localized Universal Attacks Against Deep Learning Systemscited by 148
  20. 2020Entangled Watermarks as a Defense against Model Extractioncited by 144
  21. 2020Bridging Mode Connectivity in Loss Landscapes and Adversarial Robustnesscited by 130
  22. 2020Adversarial Watermarking Transformer: Towards Tracing Text Provenance with Data Hidingcited by 121
  23. 2019TBT: Targeted Neural Network Attack with Bit Trojancited by 112
  24. 2020Just How Toxic is Data Poisoning? A Unified Benchmark for Backdoor and Data Poisoning Attackscited by 109
  25. 2021Sleeper Agent: Scalable Hidden Trigger Backdoors for Neural Networks Trained from Scratchcited by 98
  26. 2018Is feature selection secure against training data poisoning?cited by 88
  27. 2021Manipulating SGD with Data Ordering Attackscited by 73
  28. 2019Learning to Confuse: Generating Training Time Adversarial Data with Auto-Encodercited by 70
  29. 2020Radioactive data: tracing through trainingcited by 67
  30. 2019Design and Evaluation of a Multi-Domain Trojan Detection Method on Deep Neural Networkscited by 66
  31. 2021AEVA: Black-box Backdoor Detection Using Adversarial Extreme Value Analysiscited by 52
  32. 2021A Backdoor Attack against 3D Point Cloud Classifierscited by 50
  33. 2019NeuronInspect: Detecting Backdoors in Neural Networks via Output Explanationscited by 49
  34. 2020FakeTagger: Robust Safeguards against DeepFake Dissemination via Provenance Trackingcited by 46
  35. 2021Defending against Model Stealing via Verifying Embedded External Featurescited by 44
  36. 2022Few-Shot Backdoor Attacks on Visual Object Trackingcited by 35
  37. 2016You are Who You Know and How You Behave: Attribute Inference Attacks via Users' Social Friends and Behaviorscited by 34
  38. 2020Targeted Attack for Deep Hashing based Retrievalcited by 34

50 most cited of 54 All 54 (JSON)

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2022: 2; 2023: 22; 2024: 25; 2025: 25; 2026: 6.

80 papers.

Sort:

By area:

  1. 2023Domain Watermark: Effective and Harmless Dataset Copyright Protection is Closed at Handcited by 52
  2. 2023Backdoor Defense via Adaptively Splitting Poisoned Datasetcited by 43
  3. 2024IBD-PSC: Input-level Backdoor Detection via Parameter-oriented Scaling Consistencycited by 38
  4. 2023Did You Train on My Dataset? Towards Public Dataset Protection with Clean-Label Backdoor Watermarkingcited by 37
  5. 2024Explanation as a Watermark: Towards Harmless and Multi-bit Model Ownership Verification via Watermarking Feature Attributioncited by 35
  6. 2024Poisoned Forgery Face: Towards Backdoor Attacks on Face Forgery Detectioncited by 34
  7. 2024A Watermark-Conditioned Diffusion Model for IP Protectioncited by 34
  8. 2024The Stronger the Diffusion Model, the Easier the Backdoor: Data Poisoning to Induce Copyright Breaches Without Adjusting Finetuning Pipelinecited by 33
  9. 2023Algorithmic Collective Action in Machine Learningcited by 30
  10. 2022Untargeted Backdoor Attack against Object Detectioncited by 28
  11. 2023Towards Stealthy Backdoor Attacks against Speech Recognition via Elements of Soundcited by 28
  12. 2023Label Poisoning is All You Needcited by 27
38 more
  1. 2023BackdoorBox: A Python Toolbox for Backdoor Learningcited by 25
  2. 2023Stable Unlearnable Example: Enhancing the Robustness of Unlearnable Examples via Stable Error-Minimizing Noisecited by 23
  3. 2023Backdoor Attack with Sparse and Invisible Triggercited by 20
  4. 2025REFINE: Inversion-Free Backdoor Defense via Model Reprogrammingcited by 20
  5. 2023Attacks in Adversarial Machine Learning: A Systematic Survey from the Life-cycle Perspectivecited by 19
  6. 2024PointNCBW: Towards Dataset Ownership Verification for Point Clouds via Negative Clean-label Backdoor Watermarkcited by 19
  7. 2024Towards Reliable Verification of Unauthorized Data Usage in Personalized Text-to-Image Diffusion Modelscited by 19
  8. 2025Rethinking Data Protection in the (Generative) Artificial Intelligence Eracited by 17
  9. 2024A General Framework for Data-Use Auditing of ML Modelscited by 15
  10. 2024Nearest is Not Dearest: Towards Practical Defense against Quantization-conditioned Backdoor Attackscited by 14
  11. 2024SoK: Dataset Copyright Auditing in Machine Learning Systemscited by 14
  12. 2023ORL-AUDITOR: Dataset Auditing in Offline Deep Reinforcement Learningcited by 11
  13. 2024EmMark: Robust Watermarks for IP Protection of Embedded Quantized Large Language Modelscited by 11
  14. 2023What can Discriminator do? Towards Box-free Ownership Verification of Generative Adversarial Networkcited by 10
  15. 2023Towards Robust Model Watermark via Reducing Parametric Vulnerabilitycited by 10
  16. 2022BATT: Backdoor Attack with Transformation-based Triggerscited by 9
  17. 2024Data Taggants: Dataset Ownership Verification via Harmless Targeted Data Poisoningcited by 8
  18. 2025DATABench: Evaluating Dataset Auditing in Deep Learning from an Adversarial Perspectivecited by 8
  19. 2025Towards Resilient Safety-driven Unlearning for Diffusion Models against Downstream Fine-tuningcited by 8
  20. 2024TrajDeleter: Enabling Trajectory Forgetting in Offline Reinforcement Learning Agentscited by 7
  21. 2024FLARE: Toward Universal Dataset Purification against Backdoor Attackscited by 7
  22. 2023Universal Adversarial Backdoor Attacks to Fool Vertical Federated Learning in Cloud-Edge Collaborationcited by 6
  23. 2023SoK: Unintended Interactions among Machine Learning Defenses and Riskscited by 6
  24. 2025Winter Soldier: Backdooring Language Models at Pre-Training with Indirect Data Poisoningcited by 6
  25. 2023A Proxy Attack-Free Strategy for Practically Improving the Poisoning Efficiency in Backdoor Attackscited by 5
  26. 2025Protecting Your Video Content: Disrupting Automated Video-based LLM Annotationscited by 5
  27. 2025A Survey on Unlearnable Datacited by 5
  28. 2024DeepEclipse: How to Break White-Box DNN-Watermarking Schemescited by 4
  29. 2024Are You Copying My Prompt? Protecting the Copyright of Vision Prompt for VPaaS via Watermarkcited by 4
  30. 2024Anonymity Unveiled: A Practical Framework for Auditing Data Use in Deep Learning Modelscited by 4
  31. 2025Instance-Level Data-Use Auditing of Visual ML Modelscited by 4
  32. 2023Towards Open Federated Learning Platforms: Survey and Vision from Technical and Legal Perspectivescited by 3
  33. 2025CBW: Towards Dataset Ownership Verification for Speaker Verification via Clustering-based Backdoor Watermarkingcited by 3
  34. 2025Data Provenance Auditing of Fine-Tuned Large Language Models with a Text-Preserving Techniquecited by 3
  35. 2025Every Language Model Has a Forgery-Resistant Signaturecited by 3
  36. 2026Watermarking LLM Agent Trajectoriescited by 3
  37. 2023TrojFair: Trojan Fairness Attackscited by 2
  38. 2024Not Just Change the Labels, Learn the Features: Watermarking Deep Neural Networks with Multi-View Datacited by 2

50 most cited of 80 All 80 (JSON)