{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/untargeted-backdoor-watermark-towards","title":"Untargeted Backdoor Watermark: Towards Harmless and Stealthy Dataset Copyright Protection","arxiv_id":"2210.00875","date":"2022-09-27","proceeding":null,"authors":["Yiming Li","Yang Bai","Yong Jiang","Yong Yang","Shu-Tao Xia","Bo Li"],"abstract":"Deep neural networks (DNNs) have demonstrated their superiority in practice. Arguably, the rapid development of DNNs is largely benefited from high-quality (open-sourced) datasets, based on which researchers and developers can easily evaluate and improve their learning methods. Since the data collection is usually time-consuming or even expensive, how to protect their copyrights is of great significance and worth further exploration. In this paper, we revisit dataset ownership verification. We find that existing verification methods introduced new security risks in DNNs trained on the protected dataset, due to the targeted nature of poison-only backdoor watermarks. To alleviate this problem, in this work, we explore the untargeted backdoor watermarking scheme, where the abnormal model behaviors are not deterministic. Specifically, we introduce two dispersibilities and prove their correlation, based on which we design the untargeted backdoor watermark under both poisoned-label and clean-label settings. We also discuss how to use the proposed untargeted backdoor watermark for dataset ownership verification. Experiments on benchmark datasets verify the effectiveness of our methods and their resistance to existing backdoor defenses. Our codes are available at \\url{https://github.com/THUYimingLi/Untargeted_Backdoor_Watermark}.","url_abs":"https://arxiv.org/abs/2210.00875v3","url_pdf":"https://arxiv.org/pdf/2210.00875v3.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"untargeted-backdoor-watermark-towards","repo_url":"https://github.com/thuyimingli/untargeted_backdoor_watermark","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":0,"framework":"pytorch","reach":{"status":"ok","spdx":"Apache-2.0"}}],"tasks":[],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"syntology_url":null,"atlas_url":"https://app.syntology.ai/?focus=2210.00875","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2210.00875"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"deterministic:regex_extraction","url":"https://github.com/THUYimingLi/Untargeted_Backdoor_Watermark","reach":{"status":"ok","spdx":"Apache-2.0"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/thuyimingli/untargeted_backdoor_watermark","reach":{"status":"ok","spdx":"Apache-2.0"}}],"summary":{"ran_honours":1,"ran":1,"unverified":8},"by_repo_kind":{"official":{"samples":10,"ran":2,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"afc9001040d3aa34","entry":"gen_grid","repo":"THUYimingLi/Untargeted_Backdoor_Watermark","repo_kind":"official","path":"UBW-P/train_UBW_P_WaNet.py","file_url":"https://github.com/THUYimingLi/Untargeted_Backdoor_Watermark/blob/HEAD/UBW-P/train_UBW_P_WaNet.py","link_basis":"harvester_set","language":"python","status":"ran_honours","verification_level":1,"contract_check":"HONOURS","metamorphic_tier":"well_formed","behaviour_fingerprint":true,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"afc9001040d3aa34"}},{"code_sha256_prefix":"ac62432dc5134b0d","entry":"make_layers","repo":"THUYimingLi/Untargeted_Backdoor_Watermark","repo_kind":"official","path":"UBW-C/model.py","file_url":"https://github.com/THUYimingLi/Untargeted_Backdoor_Watermark/blob/HEAD/UBW-C/model.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"ac62432dc5134b0d"}},{"code_sha256_prefix":"6fe7f1dde4b402c6","entry":"Dloss_s","repo":"THUYimingLi/Untargeted_Backdoor_Watermark","repo_kind":"official","path":"UBW-P/eval_UBW_P_BadNets.py","file_url":"https://github.com/THUYimingLi/Untargeted_Backdoor_Watermark/blob/HEAD/UBW-P/eval_UBW_P_BadNets.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"6fe7f1dde4b402c6"}},{"code_sha256_prefix":"febb3deba6c74f90","entry":"ResNet18","repo":"THUYimingLi/Untargeted_Backdoor_Watermark","repo_kind":"official","path":"UBW-C/model.py","file_url":"https://github.com/THUYimingLi/Untargeted_Backdoor_Watermark/blob/HEAD/UBW-C/model.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"febb3deba6c74f90"}},{"code_sha256_prefix":"3250979a4f8eac8e","entry":"ResNet18","repo":"THUYimingLi/Untargeted_Backdoor_Watermark","repo_kind":"official","path":"UBW-C/model_i.py","file_url":"https://github.com/THUYimingLi/Untargeted_Backdoor_Watermark/blob/HEAD/UBW-C/model_i.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"3250979a4f8eac8e"}},{"code_sha256_prefix":"36c28aa12c9937f6","entry":"patch_source","repo":"THUYimingLi/Untargeted_Backdoor_Watermark","repo_kind":"official","path":"UBW-C/eval_loss.py","file_url":"https://github.com/THUYimingLi/Untargeted_Backdoor_Watermark/blob/HEAD/UBW-C/eval_loss.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"36c28aa12c9937f6"}},{"code_sha256_prefix":"766315d0cde3c1dc","entry":"patch_source","repo":"THUYimingLi/Untargeted_Backdoor_Watermark","repo_kind":"official","path":"UBW-P/eval_UBW_P_BadNets.py","file_url":"https://github.com/THUYimingLi/Untargeted_Backdoor_Watermark/blob/HEAD/UBW-P/eval_UBW_P_BadNets.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"766315d0cde3c1dc"}},{"code_sha256_prefix":"26a12cb0a49b0d7e","entry":"patch_source","repo":"THUYimingLi/Untargeted_Backdoor_Watermark","repo_kind":"official","path":"UBW-C/eval_ASR.py","file_url":"https://github.com/THUYimingLi/Untargeted_Backdoor_Watermark/blob/HEAD/UBW-C/eval_ASR.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"26a12cb0a49b0d7e"}},{"code_sha256_prefix":"46fc2d22eb1e47be","entry":"prepare_datasets","repo":"THUYimingLi/Untargeted_Backdoor_Watermark","repo_kind":"official","path":"UBW-C/eval_loss.py","file_url":"https://github.com/THUYimingLi/Untargeted_Backdoor_Watermark/blob/HEAD/UBW-C/eval_loss.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"46fc2d22eb1e47be"}},{"code_sha256_prefix":"5ba9825ab6ff7eca","entry":"prepare_datasets","repo":"THUYimingLi/Untargeted_Backdoor_Watermark","repo_kind":"official","path":"UBW-C/eval_ASR.py","file_url":"https://github.com/THUYimingLi/Untargeted_Backdoor_Watermark/blob/HEAD/UBW-C/eval_ASR.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"5ba9825ab6ff7eca"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}