Provable Watermarking for Data Poisoning Attacks
Not on the map. Why?
Abstract (arXiv)
In recent years, data poisoning attacks have been increasingly designed to appear harmless and even beneficial, often with the intention of verifying dataset ownership or safeguarding private data from unauthorized use. However, these developments have the potential to cause misunderstandings and conflicts, as data poisoning has traditionally been regarded as a security threat to machine learning systems. To address this issue, it is imperative for harmless poisoning generators to claim ownership of their generated datasets, enabling users to identify potential poisoning to prevent misuse. In this paper, we propose the deployment of watermarking schemes as a solution to this challenge. We introduce two provable and practical watermarking approaches for data poisoning: em post-poisoning watermarking and em poisoning-concurrent watermarking. Our analyses demonstrate that when the watermarking length is Theta(√d/εw) for post-poisoning watermarking, and falls within the range of Theta(1/εw2) to O(√d/εp) for poisoning-concurrent watermarking, the watermarked poisoning dataset provably ensures both watermarking detectability and poisoning utility, certifying the practicality of watermarking under data poisoning attacks. We validate our theoretical findings through experiments on several attacks, models, and datasets.
Key facts. Cited by 2 papers in the map (data through 7 Oct 2026). Builds on 75 of its 99 references that are in the map. First posted on arXiv 10 Oct 2025.
Builds on
75 of 99 references.
References · 75
- 2015Deep Residual Learning for Image Recognitioncited by 51,809
- 2020Language Models are Few-Shot Learnerscited by 32,199
- 2023GPT-4 Technical Reportcited by 18,132
- 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
- 2019Exploring the Limits of Transfer Learning with a Unified Text-to-Text Transformercited by 14,491
- 2023LLaMA: Open and Efficient Foundation Language Modelscited by 13,958
- 2016Densely Connected Convolutional Networkscited by 6,691
- 2018MobileNetV2: Inverted Residuals and Linear Bottleneckscited by 4,773
- 2016Wide Residual Networkscited by 3,057
- 2018Neural Tangent Kernel: Convergence and Generalization in Neural Networkscited by 2,597
- 2017Understanding Black-box Predictions via Influence Functionscited by 1,714
- 2017Improved Regularization of Convolutional Neural Networks with Cutoutcited by 1,623
38 more
- 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
- 2018Reconciling modern machine learning practice and the bias-variance trade-offcited by 919
- 2023A Watermark for Large Language Modelscited by 667
- 2018Gradient Descent Finds Global Minima of Deep Neural Networkscited by 572
- 2020Learned Image Compression with Discretized Gaussian Mixture Likelihoods and Attention Modulescited by 570
- 2018Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networkscited by 500
- 2022Diffusion Models for Adversarial Purificationcited by 469
- 2018Detecting Backdoor Attacks on Deep Neural Networks by Activation Clusteringcited by 429
- 2017Wild Patterns: Ten Years After the Rise of Adversarial Machine Learningcited by 411
- 2018HiDDeN: Hiding Data With Deep Networkscited by 384
- 2020Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networkscited by 341
- 2018Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooringcited by 334
- 2019Label-Consistent Backdoor Attackscited by 285
- 2023Robust Distortion-free Watermarks for Language Modelscited by 279
- 2023Provable Robust Watermarking for AI-Generated Textcited by 259
- 2023Undetectable Watermarks for Language Modelscited by 208
- 2017Towards Poisoning of Deep Learning Algorithms with Back-gradient Optimizationcited by 188
- 2021Unlearnable Examples: Making Personal Data Unexploitablecited by 188
- 2023On the Reliability of Watermarks for Large Language Modelscited by 170
- 2020Witches' Brew: Industrial Scale Data Poisoning via Gradient Matchingcited by 156
- 2018Backdoor Embedding in Convolutional Neural Network Models via Invisible Perturbationcited by 131
- 2018Stronger Data Poisoning Attacks Break Data Sanitization Defensescited by 125
- 2023Invisible Image Watermarks Are Provably Removable Using Generative AIcited by 124
- 2020Adversarial Watermarking Transformer: Towards Tracing Text Provenance with Data Hidingcited by 121
- 2021Adversarial Examples Make Strong Poisonscited by 115
- 2022Narcissus: A Practical Clean-Label Backdoor Attack with Limited Informationcited by 102
- 2023Unbiased Watermark for Large Language Modelscited by 100
- 2021Sleeper Agent: Scalable Hidden Trigger Backdoors for Neural Networks Trained from Scratchcited by 98
- 2019Dynamics of Deep Neural Networks and Neural Tangent Hierarchycited by 96
- 2019Robust Anomaly Detection and Backdoor Attack Detection Via Differential Privacycited by 93
- 2022Untargeted Backdoor Watermark: Towards Harmless and Stealthy Dataset Copyright Protectioncited by 80
- 2024An Undetectable Watermark for Generative Image Modelscited by 74
- 2021Black-box Detection of Backdoor Attacks with Limited Information and Datacited by 71
- 2019Learning to Confuse: Generating Training Time Adversarial Data with Auto-Encodercited by 70
- 2020Bullseye Polytope: A Scalable Clean-Label Poisoning Attack with Improved Transferabilitycited by 65
- 2021Triggerless Backdoor Attack for NLP Tasks with Clean Labelscited by 61
- 2021Availability Attacks Create Shortcutscited by 60
- 2021Better Safe Than Sorry: Preventing Delusive Adversaries with Adversarial Trainingcited by 58
50 most cited of 75 All 75 (JSON)
Built on by
Citing papers per year: 2026: 2.
2 papers.