Radioactive data: tracing through training

By Alexandre Sablayrolles, Matthijs Douze, Cordelia Schmid, Herv'e J'egou. 2020

121 citations recorded by the source corpus.

We want to detect whether a particular image dataset has been used to train a model. We propose a new technique, \emph{radioactive data}, that makes imperceptible changes to this dataset such that any model trained on it will bear an identifiable mark. The mark is robust to strong variations such as different architectures or optimization methods. Given a trained model, our technique detects the use of radioactive data and provides a level of confidence (p-value). Our experiments on large-scale benchmarks (Imagenet), using standard architectures (Resnet-18, VGG-16, Densenet-121) and training procedures, show that we can detect usage of radioactive data with high confidence (p<10^-4) even when only 1% of the data used to trained our model is radioactive. Our method is robust to data augmentation and the stochasticity of deep network optimization. As a result, it offers a much higher signal-to-noise ratio than data poisoning and backdoor methods.

Subfields: Artificial Intelligence, Computer Vision and Pattern Recognition, Radiology, Nuclear Medicine and Imaging

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Vision and Pattern Recognition

In Radiology, Nuclear Medicine and Imaging

Citations in the corpus

Towards Probabilistic Verification of Machine Unlearning (2020, methodology): “Recently, Sablayrolles et al. [52] proposed a method to detect whether a particular image dataset has been used to train a model by adding well-designed perturbations that alters their extracted features and thereby watermarking the model.”
Trustworthy Artificial Intelligence: A Review (2022, methodology): “Supervised Learning [33] Data Pre-Processing [63, 97, 128] Item-Set Mining [169] Dimensionality Reduction [172] Data/Model Bias Community Detection [135] Data Labeling [170]”
MetaPoison: Practical General-purpose Clean-label Data Poisoning (2020, methodology): “For example, it can be used for copyright enforcement as discussed in §1 and similar to the concept of “radioactive data” [Sablayrolles et al., 2020].”
A Framework for Deprecating Datasets: Standardizing Documentation, Identification, and Communication (2021, background): “Other work has also proposed that: 1) it is possible to reveal details from an initial dataset even when a model was subsequently retrained on a redacted version [104]; 2) adversarial querying of a trained language model can recover individual training examples [22] and 3) "radioactive" data tracing”