Radioactive data: tracing through training
arXiv:2002.00937
Abstract
We want to detect whether a particular image dataset has been used to train a model. We propose a new technique, \emph{radioactive data}, that makes imperceptible changes to this dataset such that any model trained on it will bear an identifiable mark. The mark is robust to strong variations such as different architectures or optimization methods. Given a trained model, our technique detects the use of radioactive data and provides a level of confidence (p-value). Our experiments on large-scale benchmarks (Imagenet), using standard architectures (Resnet-18, VGG-16, Densenet-121) and training procedures, show that we can detect usage of radioactive data with high confidence (p<10^-4) even when only 1% of the data used to trained our model is radioactive. Our method is robust to data augmentation and the stochasticity of deep network optimization. As a result, it offers a much higher signal-to-noise ratio than data poisoning and backdoor methods.
References in corpus (7)
- Distilling the Knowledge in a Neural Network
- Deep Learning with Differential Privacy
- Accurate, Large Minibatch SGD: Training ImageNet in 1 Hour
- The information bottleneck method
- YFCC100M: The New Data in Multimedia Research
- Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning
- Poisoning Attacks against Support Vector Machines
Cited by in corpus (8)
- MetaPoison: Practical General-purpose Clean-label Data Poisoning
- Towards Probabilistic Verification of Machine Unlearning
- On the Effectiveness of Dataset Watermarking in Adversarial Settings
- WAFFLE: Watermarking in Federated Learning
- Federated Unlearning
- Lightweight machine unlearning in neural network
- 10 Security and Privacy Problems in Large Foundation Models
- Do CNNs Encode Data Augmentations?