将数据投毒攻击改造成对比学习中的数据版权水印，提升模型安全性。
Repurposing and Evaluating the (In)Feasibility of Dataset Poisoning enabled Watermarking for Contrastive Learning
- 利用数据投毒样本的统计差异，设计统一密度验证机制。
- 多层级水印方案支持特征、软标签、硬标签输出，鲁棒性提升。
- 在对比学习中实现可验证、高保真度的训练数据版权保护。
对比学习（CL）通过自动生成监督信号降低标注成本，但由于大规模自有数据集难以获取，普遍依赖第三方或网络数据。近期研究表明CL模型易受数据投毒后门攻击，但其泛化性和鲁棒性尚未深入探索。本文系统评估现有数据投毒后门攻击在CL中的表现，发现其存在适应性差、成功率低、可迁移性弱及依赖下游任务知识等局限。有趣的是，触发样本与正常样本在统计上存在显著差异，这一特性启发我们将投毒行为重新用于数据集知识产权保护。由于直接复用成功率低，我们提出基于统一密度度量的统计验证方法加以改进，并设计适应特征级、软标签或硬标签输出的多层级水印方案。实验表明，部分后门攻击可被有效转化为水印，在保真度、可验证性和鲁棒性之间实现良好权衡。本工作证明，在复杂对比学习场景下，原本微弱的后门效应可转变为可靠的版权保护信号。
原文摘要 · Abstract (English)
Contrastive learning (CL) reduces annotation cost via auto-derived supervisory signals. Since large-scale in-house CL datasets are infeasible, reliance on third-party or internet data is common. Recent studies show CL models are vulnerable to data-poisoning backdoor attacks, but their generalization and robustness are underexplored. We systematically evaluate existing data-poisoning backdoor attacks on CL, revealing limitations: poor dataset adaptability, low success rates, limited portability, and restrictive assumptions (e.g., downstream task knowledge). Interestingly, trigger samples exhibit distinguishable statistical divergence from clean samples, which inspires repurposing it as a watermark for dataset IP protection. Direct repurposing is challenging due to low success rates; we overcome this by statistical verification using a unified density metric. We further propose a multi-level watermarking scheme adapting to feature-level, soft-label, or hard-label outputs in CL. Experiments show some backdoor attacks can be repurposed as effective watermarks with trade-offs among fidelity, verifiability, and robustness. This work demonstrates weak backdoor effects become reliable signals for dataset IP protection in challenging CL settings.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。