CertDW: Towards Certified Dataset Ownership Verification via Conformal Calibration

Abstract

Deep neural networks (DNNs) rely heavily on high-quality open-source datasets (e.g., ImageNet) for their success, making dataset ownership verification (DOV) crucial for protecting public dataset copyrights. In this paper, we find existing DOV methods (implicitly) assume that the verification process is faithful, where the suspicious model will directly verify ownership by using the verification samples as input and returning their results. However, this assumption may not necessarily hold in practice and their performance may degrade sharply when subjected to intentional or unintentional perturbations. To address this limitation, we propose the first certified dataset watermark (i.e., CertDW) and CertDW-based certified dataset ownership verification method that ensures reliable verification even under malicious attacks, under certain conditions (e.g., constrained pixel-level perturbation). Specifically, inspired by conformal prediction, we introduce two statistical measures, including principal probability (PP) and watermark robustness (WR), to assess model prediction stability on benign and watermarked samples under noise perturbations. We derive provable certification conditions relating WR to a PP-based calibration threshold, and a high-probability upper bound on the false positive rate, enabling ownership verification when a suspicious model's WR value significantly exceeds the PP values of multiple benign models trained on watermark-free datasets. If the number of PP values smaller than WR exceeds a threshold determined via conformal calibration, the suspicious model is regarded as having been trained on the protected dataset. Extensive experiments on benchmark datasets verify the effectiveness of our CertDW method and its resistance to potential adaptive attacks. Our codes are at \href{https://github.com/NcepuQiaoTing/CertDW}{GitHub}.

Authors 8

Ting Qiao, Yiming Li, Jianbin Li, Yingjia Wang, Leyi Qi, Junfeng Guo, Ruili Feng, Dacheng Tao

Specification

Official page

arxiv.org/abs/2506.13160

Source:arXiv (Atom API + RSS)·T1·observed 4 h ago·high

Arxiv announce type

replace

Source:arXiv (Atom API + RSS)·T1·observed 4 h ago·high

arXiv id

2506.13160

Source:arXiv (Atom API + RSS)·T1·observed 4 h ago·high

Categories

cs.LG, cs.AI, cs.CR, cs.CV

Source:arXiv (Atom API + RSS)·T1·observed 4 h ago·high

PDF

arxiv.org/pdf/2506.13160

Source:arXiv (Atom API + RSS)·T1·observed 4 h ago·high

Primary category

cs.LG

Source:arXiv (Atom API + RSS)·T1·observed 4 h ago·high

Published

11 Sept 2026

Source:arXiv (Atom API + RSS)·T1·observed 4 h ago·high

Each value shows its source, tier and observation time. Conflicting claims are kept side by side and flagged — never averaged. How AI Atlas records facts →

Provenance