mlsanityData to 7 Oct 2026

Repurposing and Evaluating the (In)Feasibility of Dataset Poisoning enabled Watermarking for Contrastive Learning

arXiv 2605.01834 ↗First posted 3 May 2026cs.CR cs.AIcited by 0

Not on the map. Why?

Abstract (arXiv)

Contrastive learning (CL) reduces annotation cost via auto-derived supervisory signals. Since large-scale in-house CL datasets are infeasible, reliance on third-party or internet data is common. Recent studies show CL models are vulnerable to data-poisoning backdoor attacks, but their generalization and robustness are underexplored. We systematically evaluate existing data-poisoning backdoor attacks on CL, revealing limitations: poor dataset adaptability, low success rates, limited portability, and restrictive assumptions (e.g., downstream task knowledge). Interestingly, trigger samples exhibit distinguishable statistical divergence from clean samples, which inspires repurposing it as a watermark for dataset IP protection. Direct repurposing is challenging due to low success rates; we overcome this by statistical verification using a unified density metric. We further propose a multi-level watermarking scheme adapting to feature-level, soft-label, or hard-label outputs in CL. Experiments show some backdoor attacks can be repurposed as effective watermarks with trade-offs among fidelity, verifiability, and robustness. This work demonstrates weak backdoor effects become reliable signals for dataset IP protection in challenging CL settings.

Key facts. No citing papers in the map yet (data through 7 Oct 2026). Builds on 44 of its 56 references that are in the map. First posted on arXiv 3 May 2026.

Builds on

44 of 56 references.

References · 44

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,204
  3. 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,456
  4. 2020A Simple Framework for Contrastive Learning of Visual Representationscited by 11,979
  5. 2018The Unreasonable Effectiveness of Deep Features as a Perceptual Metriccited by 11,029
  6. 2023DINOv2: Learning Robust Visual Features without Supervisioncited by 7,764
  7. 2019Momentum Contrast for Unsupervised Visual Representation Learningcited by 7,482
  8. 2022Generative Adversarial Networkscited by 5,603
  9. 2020Bootstrap your own latent: A new approach to self-supervised Learningcited by 4,712
  10. 2020Exploring Simple Siamese Representation Learningcited by 2,853
  11. 2020Improved Baselines with Momentum Contrastive Learningcited by 2,282
  12. 2016Context Encoders: Feature Learning by Inpaintingcited by 1,424
32 more
  1. 2020Self-supervised Learning: Generative or Contrastivecited by 693
  2. 2020Label-Only Membership Inference Attackscited by 371
  3. 2023DreamSim: Learning New Dimensions of Human Visual Similarity using Synthetic Datacited by 322
  4. 2023OBELICS: An Open Web-Scale Filtered Dataset of Interleaved Image-Text Documentscited by 316
  5. 2023A Survey on Self-supervised Learning: Algorithms, Applications, and Future Trendscited by 205
  6. 2021Poisoning and Backdooring Contrastive Learningcited by 149
  7. 2021BadEncoder: Backdoor Attacks to Pre-trained Encoders in Self-Supervised Learningcited by 120
  8. 2021Dataset Inference: Ownership Resolution in Machine Learningcited by 115
  9. 2023BadCLIP: Dual-Embedding Guided Backdoor Attack on Multimodal Contrastive Learningcited by 112
  10. 2021When Does Contrastive Visual Representation Learning Work?cited by 92
  11. 2021Backdoor Attacks on Self-Supervised Learningcited by 89
  12. 2022Untargeted Backdoor Watermark: Towards Harmless and Stealthy Dataset Copyright Protectioncited by 80
  13. 2020Radioactive data: tracing through trainingcited by 67
  14. 2023BadCLIP: Trigger-Aware Prompt Learning for Backdoor Attacks on CLIPcited by 63
  15. 2022SSLGuard: A Watermarking Scheme for Self-supervised Learning Pre-trained Encoderscited by 43
  16. 2023Did You Train on My Dataset? Towards Public Dataset Protection with Clean-Label Backdoor Watermarkingcited by 37
  17. 2022Dataset Inference for Self-Supervised Modelscited by 36
  18. 2022PoisonedEncoder: Poisoning the Unlabeled Pre-training Data in Contrastive Learningcited by 33
  19. 2020Open-sourced Dataset Protection via Backdoor Watermarkingcited by 30
  20. 2022An Embarrassingly Simple Backdoor Attack on Self-supervised Learningcited by 30
  21. 2022CorruptEncoder: Data Poisoning based Backdoor Attacks to Contrastive Learningcited by 28
  22. 2024Data-Efficient Contrastive Language-Image Pretraining: Prioritizing Data Quality over Quantitycited by 19
  23. 2024PointNCBW: Towards Dataset Ownership Verification for Point Clouds via Negative Clean-label Backdoor Watermarkcited by 19
  24. 2024CDI: Copyrighted Data Identification in Diffusion Modelscited by 17
  25. 2024Backdoor Contrastive Learning via Bi-level Trigger Optimizationcited by 14
  26. 2013A dwt, dct and svd based watermarking technique to protect the image piracycited by 10
  27. 2022Watermarking Pre-trained Encoders in Contrastive Learningcited by 10
  28. 2022SSL-WM: A Black-Box Watermarking Approach for Encoders Pre-trained by Self-supervised Learningcited by 9
  29. 2025FIT-Print: Towards False-claim-resistant Model Ownership Verification via Targeted Fingerprintcited by 8
  30. 2023GhostEncoder: Stealthy Backdoor Attacks with Dynamic Triggers to Pre-trained Encoders in Self-supervised Learningcited by 6
  31. 2025Dataset Ownership Verification in Contrastive Pre-trained Modelscited by 6
  32. 2025Backdooring Self-Supervised Contrastive Learning by Noisy Alignmentcited by 6

Built on by

Not cited yet.