Computer-implemented method and protection system for protecting an original training dataset, and computer-implemented method and leak determination unit for determining whether a uniquely watermarked training dataset was used to train an examined model

Abstract

Method for protecting an original training dataset shared to multiple entities from being leaked, the method comprising: watermarking the original training dataset to create multiple uniquely watermarked training datasets, each watermarked training dataset embedding a unique watermark signature such that different machine learning models trained with the different watermarked training datasets each exhibit unique behavior, wherein each unique watermark signature includes a unique set of token pairs, each token pair including a pattern embedded in at least one data element of the uniquely watermarked training dataset and a corresponding label associated with the corresponding data element; and sharing the uniquely watermarked training datasets amongst the multiple entities such that each of the uniquely watermarked training datasets is shared with only one of the multiple entities.

Description

[0001] COMPUTER-IMPLEMENTED METHOD AND PROTECTION SYSTEM FOR PROTECTING AN ORIGINAL TRAINING DATASET, AND COMPUTER-IMPLEMENTED METHOD AND LEAK DETERMINATION UNIT FOR DETERMINING WHETHER A UNIQUELY WATERMARKED TRAINING DATASET WAS USED TO TRAIN AN EXAMINED MODEL

[0002] TECHNICAL FIELD

[0003] The present invention is directed at a computer-implemented method for protecting an original training dataset shared to multiple entities from being leaked. The present invention is further directed at a corresponding protection system for protecting an original training dataset shared to multiple entities from being leaked. The present invention is further directed at a computer-implemented method for determining whether a uniquely watermarked training dataset was used to train an examined model, as well as at a corresponding leak determination unit for determining whether a uniquely watermarked training dataset was used to train an examined model.

[0004] BACKGROUND ART

[0005] Data owners (distributors) often share machine learning (ML) datasets with third-party collaborators for various purposes. While such collaborations can be mutually beneficial, they also introduce the risk of data leakage, i.e., the deliberate or accidental disclosure of sensitive ML datasets to unauthorized parties. Consequently, distributors may lose their intellectual property, experience reduced revenue, and / or violate data privacy regulations.

[0006] An objective of the present invention is the protection of a training dataset from being leaked, and the verification whether an examined model was trained using a leaked training dataset.

[0007] SUMMARY OF THE INVENTION

[0008] According to a first aspect, a computer-implemented method is provided. This computer- implemented method is for protecting an original training dataset shared to multiple entities from being leaked. The method comprises: watermarking the original training dataset to create multiple uniquely watermarked training datasets, each watermarked training dataset embedding a unique watermark signature such that different machine learning models trained with the different watermarked training datasets each exhibit unique behavior, wherein each unique watermark signature includes a unique set of token pairs, each token pair including a pattern embedded in at least one data element of the uniquely watermarked training dataset and a corresponding label associated with the corresponding data element; and sharing the uniquely watermarked training datasets amongst the multiple entities such that each of the uniquely watermarked training datasets is shared with only one of the multiple entities. Several versions of the original training dataset are created, which form the uniquely watermarked training datasets. These uniquely watermarked training datasets each include a unique watermark such that machine learning models trained using the different uniquely watermarked training datasets each provide a unique behavior that is characteristic of the uniquely watermarked training dataset used to train this machine learning model. Advantageously, from the unique behavior of an examined machine learning model, it is possible to determine the uniquely watermarked training dataset with which it was trained, and to therefrom deduce the entity which provided (leaked) the uniquely watermarked training dataset for said training.

[0009] As used herein, the expression “computer-implemented method” indicates that the method is realized using a computer, a computer network or another programmable apparatus, wherein the method is in particular implemented by executing a computer program on such a computer, computer network or other programmable apparatus.

[0010] The original training dataset can be any dataset, and include individual data elements (which can be considered as files) such as images, texts, videos, sounds, or a mixture thereof. The original training dataset can be adapted to train a ML model, in particular a classification ML model (such as ResNet18 or VGG16). The original training dataset may comprise thousands of data elements. The original training dataset can be owned and / or created by a distributor. The distributor may be any type of entity, preferably a device owned by a person, a government, a university, a firm or the like.

[0011] The original training dataset can be shared amongst multiple entities. The multiple entities may be devices communicating with the distributor, and optionally be linked to the distributor for jointly performing tasks, for example. The original training dataset is in particular not shared as it is with the multiple entities. It is rather shared in a modified format, namely as the uniquely watermarked training dataset, with the respective entities.

[0012] The uniquely watermarked training dataset in particular still encompasses all the data included in the original training dataset, but additionally includes a unique watermark signature. In particular, each uniquely watermarked training dataset includes as many data elements as the original training dataset. The watermark signatures can be created such that different machine learning (ML) models trained with the different watermarked training datasets each exhibit unique behavior. Different ML models exhibiting unique behavior here means that the different ML models can all be told apart, i.e. the unique behavior is detectable and entity-specific on any ML model trained using the uniquely watermarked training dataset. The ML models considered herein are in particular classification models for performing classification tasks, preferably on images.

[0013] Each unique watermark signature includes a unique set of token pairs. “Unique” here in particular means that no two watermark signatures include exactly the same set of token pairs (but individual token pairs may be identical amongst two watermark signatures). Each token pair includes a pattern (such as an image, text, video, sound or the like, preferably of the same data type as the data elements), preferably having a small size in comparison with a data element (for example forming less than 5% of the data element), and a corresponding label.

[0014] The pattern being embedded in at least one of the data element in particular means that the pattern is provided within the data element, in particular added to the data element without modifying the content of the data element (or while only slightly modifying the content of the data element). Preferably, the pattern is hidden in the data element such as to not be easily visible or recognizable as a pattern. The pattern is in particular added to the data element in an automatic manner, for example by running a program over the original dataset which inserts the patterns into the data elements.

[0015] The corresponding label can be associated with the pattern, but the label does not necessarily correctly describe the pattern. For example, the pattern can be an image of a fly added to certain data elements of the dataset. The pattern “fly” can be associated with the label “dog” (forming a token pair), so that a ML model trained with the uniquely watermarked training dataset in which some data elements include a fly (pattern) labeled as a dog (label), might incorrectly classify flies as dogs. All other uniquely watermarked training datasets include other token pairs, so that ML model trained therewith exhibit different behaviors. In particular, the ML models trained with the uniquely watermarked training dataset can exhibit different behaviors in that they each learnt at least one unique “mistake” (such as identifying flies as dogs) inserted into the uniquely watermarked training datasets.

[0016] More specifically, each watermark signature includes a unique set of token pairs, meaning that there is not only one token pair, but several token pairs included in the uniquely watermarked training dataset. A same token pair can be included in several data elements of the same uniquely watermarked training dataset. The different token pairs of a same set can be embedded in different data elements.

[0017] The uniquely watermarked training datasets are shared amongst the multiple entities, for example through a wired or wireless communication channel. In particular, each of the multiple entities receives precisely one of the uniquely watermarked training datasets. Preferably, the multiple entities do not know which unique set of token pairs was used to mark their uniquely watermarked training dataset. Each of the multiple entities hence receives a different uniquely watermarked training dataset. In case of a voluntary or involuntary leak of the uniquely watermarked training dataset of one of the multiple entities, a ML model trained using this leaked uniquely watermarked training datasets exhibits a unique behavior, which can be analyzed to determine the origin of the leak. According to a second aspect, a computer-implemented method for determining whether a uniquely watermarked training dataset forming a leaked dataset was used to train an examined model is provided. Said leaked dataset is leaked by a leaking entity pertaining to multiple entities to which uniquely watermarked training datasets were shared, and the examined model is a machine learning model. The method comprises: analyzing the examined model to determine whether it discloses a behavior that is specific to one of the unique watermark signatures and is indicative of the examined model having been trained based on the uniquely watermarked training dataset embedding a unique watermark signature including a unique set of token pairs, each token pair including a pattern embedded in at least one data element of the uniquely watermarked training dataset and a corresponding label associated with the corresponding data element; if it is determined that the examined model discloses a behavior that is specific to one of the unique watermark signatures, determining that the examined model was trained using the uniquely watermarked training dataset embedding the unique watermark signature showing in the behavior of the examined model, said uniquely watermarked training dataset embedding the unique watermark signature showing in the behavior of the examined model forming the leaked dataset, and determining the leaking entity as being the entity to which the leaked dataset was previously shared; and if it is determined that the examined model does not disclose a behavior that is specific to one of the unique watermark signatures, determining that the examined model was not trained using any of the uniquely watermarked training datasets and that there is no leak.

[0018] The features and embodiments described with respect to the method of the first aspect equally hold for the method of the second aspect or any embodiment thereof, and vice-versa.

[0019] Advantageously, from the unique behavior of an examined machine learning model, it is possible to determine the uniquely watermarked training dataset with which it was trained, and to therefrom deduce the entity which provided (leaked) the uniquely watermarked training dataset for said training. The leaked dataset can be determined without having to access the content of the examined ML model, i.e. the solution provided is a blackbox solution. The proposed solution advantageously has a negligible impact on the ML model accuracy.

[0020] The examined (suspicious) model can be any type of machine learning model (preferably a classification model), in particular one that was programmed and / or trained by a third party (different from the multiple entities or the distributor). The method of the second aspect is preferably initiated when unauthorized training of an examined model on a proprietary dataset (uniquely watermarked training dataset) is suspected. The method of the second aspect allows determining whether the examined model was trained with one of the uniquely watermarked training datasets. If this is confirmed, the uniquely watermarked training dataset used to train the examined model forms the leaked dataset. The method of the second aspect may be performed by the distributor, in particular by a computer device pertaining to the distributor, and / or by another device which has the knowledge of the token pairs used in the respective unique watermark signatures.

[0021] Identifying the leaked dataset and the corresponding leaking entity is performed by analyzing whether the examined model discloses a behavior that is specific to one of the unique watermark signatures. This in particular corresponds to checking whether the examined model exhibits a learnt unique “mistake” corresponding to the token pairs provided in the unique watermark signatures. If this is the case, it is very likely that the examined model was trained based on one of the uniquely watermarked training datasets. By verifying to which set of token pairs the specific behavior of the examined model corresponds to, it can reliably be determined which of the uniquely watermarked training datasets was used to train the examined model. The entity to which the uniquely watermarked training dataset embedding the specific behavior of the examined model was shared forms the leaking entity which deliberately or not shared its uniquely watermarked training dataset.

[0022] According to an embodiment, in the method of the second aspect, the uniquely watermarked training dataset is created from an original training dataset protected according to the method of the first aspect or any embodiment thereof.

[0023] This corresponds to the following subject-matter: a computer-implemented method comprising: watermarking an original training dataset to create multiple uniquely watermarked training datasets, each watermarked training dataset embedding a unique watermark signature such that different machine learning models trained with the different watermarked training datasets each exhibit unique behavior, wherein each unique watermark signature includes a unique set of token pairs, each token pair including a pattern embedded in at least one data element of the uniquely watermarked training dataset and a corresponding label associated with the corresponding data element; sharing the uniquely watermarked training datasets amongst the multiple entities such that each of the uniquely watermarked training datasets is shared with only one of the multiple entities; and determining whether a uniquely watermarked training dataset forming a leaked dataset was used to train an examined model, said leaked dataset is leaked by a leaking entity pertaining to the multiple entities to which uniquely watermarked training datasets were shared, and the examined model being a machine learning model, the step of determining whether a uniquely watermarked training dataset was used to train an examined model comprising: analyzing the examined model to determine whether it discloses a behavior that is specific to one of the unique watermark signatures and is indicative of the examined model having been trained based on the uniquely watermarked training dataset embedding one of the unique watermark signatures; if it is determined that the examined model discloses a behavior that is specific to one of the unique watermark signatures, determining that the examined model was trained using the uniquely watermarked training dataset embedding the unique watermark signature showing in the behavior of the examined model, said uniquely watermarked training dataset embedding the unique watermark signature showing in the behavior of the examined model forming the leaked dataset, and determining the leaking entity as being the entity to which the leaked dataset was previously shared; and if it is determined that the examined model does not disclose a behavior that is specific to one of the unique watermark signatures, determining that the examined model was not trained using any of the uniquely watermarked training datasets and that there is no leak.

[0024] According to an embodiment of the first or second aspect, the patterns are identical in all unique sets of token pairs, and any two unique sets of token pairs differ through at least one of the corresponding labels.

[0025] In particular, each set of token pairs includes an integer number N of patterns (N>2), said N patterns being the same in each set of token pairs. However, the sets of token pairs differ in that the labels associated with the respective N patterns are not the same in any two sets of token pairs, thereby providing unique sets of token pairs associated with respectively one uniquely watermarked training dataset. Having same patterns but different labels among the different sets of token pairs is advantageous in that it facilitates verifying which uniquely watermarked training dataset was used to train an examined model, as a behavioral test of the examined model only needs to be performed on a limited number of patterns (the testing is described in the following). Alternatively, some or all of the patterns can be different between different sets of token pairs, but this implies a more burdensome testing.

[0026] In all cases, preferably, the label associated with a given pattern is not the same amongst all sets of token pairs, as it is this difference that renders the uniquely watermarked training dataset unique, thereby providing the ML model trained with said uniquely watermarked training dataset with its unique behavior.

[0027] According to an embodiment, the step of watermarking the original training dataset to create the multiple uniquely watermarked training datasets includes, for each token pair: selecting a subset of data elements from the original training dataset; inserting the pattern of the token pair into each data element of the subset; and associating the data elements of the subset with the label of the token pair corresponding to the pattern inserted into the data of the subset. In particular, only some of the data elements forming the original training dataset are watermarked with the unique watermark signature to form the uniquely watermarked training dataset. Namely, only a subset of data elements is selected for insertion of one of the patterns of the set of token pairs and association of the corresponding label of the same token pair as the pattern to the data element. Different patterns of the set of token pairs may be inserted into the data elements of different selected subsets, and the corresponding label may be associated with the data element into which the pattern was inserted. Some data elements may not have any pattern inserted therein.

[0028] According to an embodiment, the step of analyzing the examined model to determine whether it discloses a behavior that is specific to one of the unique watermark signatures includes: observing a first classification behavior of the examined model upon inputting first input data including none of the patterns from the token pairs into the examined model; observing a second classification behavior of the examined model upon inputting second input data including one of the patterns from the token pairs into the examined model; performing a statistical analysis of the first and second behaviors to determine whether there is at least a predetermined difference between the first classification behavior and the second classification behavior corresponding to a misclassification of the second input data and a correct classification of the first input data; in case that it is determined that there is at least a predetermined difference between the first classification behavior and the second classification behavior, determining that the examined model was trained using a uniquely watermarked training dataset watermarked with one of the unique watermark signatures including the token pairs with the patterns; and in case that it is determined that there is not at least a predetermined difference between the first classification behavior and the second classification behavior, determining that the examined model was not trained using a training dataset watermarked with one of the unique watermark signatures.

[0029] In order to determine whether the examined model exhibits a behavior that is specific to one of the unique watermark signatures, the behavior (i.e. the classification output) of the examined model based on an input including one of the patterns (second input data) and based on an input not including any of the patterns (first input data) is compared. In other words, it is observed whether the examined model behaves differently depending on the presence or absence of one of the patterns in its input data. If such a difference is observed, it is indicative of the examined model being trained using one of the uniquely watermarked training datasets.

[0030] The first input data and the second input data form test data, which belongs to the same (benign) distribution as the original training dataset. This means that the test data should be images (or other files) of the same classes and dimensions as those in the original training dataset. Ideally, this test data should come from a separate test set that the examined model was not trained on to ensure they are representative yet unbiased.

[0031] In particular, the difference between the first classification behavior and the second classification behavior can be that the examined model correctly classifies first input data (without the pattern) but incorrectly classifies second input data (with the pattern) in case that the examined model learnt an incorrect label being associated with the pattern as this is included in the uniquely watermarked training dataset. The predetermined difference between the first and second classification behaviors can be an observation of a predetermined behavior and / or of a difference between the two classification behaviors being larger than a predetermined threshold.

[0032] If the predetermined difference between the two classification behaviors is observed, it is determined that the examined model was trained using a (leaked) uniquely watermarked training dataset. Otherwise, it is determined that the examined model was not trained using a uniquely watermarked training dataset.

[0033] According to an embodiment, the step of analyzing the examined model to determine whether it discloses a behavior that is specific to one of the unique watermark signatures further includes, only in case that it is determined that there is at least a predetermined difference between the first classification behavior and the second classification behavior: for each of the different patterns of the token pairs, individually inputting data which includes said pattern into the examined model and performing a statistical analysis of the output classification results of the examined model upon inputting the data including said pattern, thereby determining a determined label that the examined model learnt with said pattern from the uniquely watermarked training dataset used to train the examined model and forming a determined token pair made of the pattern and the corresponding determined label; forming a determined set of token pairs made of all the determined token pairs; comparing the determined set of token pairs with the sets of token pairs included in the unique watermark signatures to determine whether the determined set of token pairs is identical with one of the sets of token pairs included in the unique watermark signatures; and if it is determined that the determined set of token pairs is identical with one of the sets of token pairs included in the unique watermark signatures, determining that the leaking entity is the entity which received the uniquely watermarked training dataset embedding the unique watermark signature comprising the set of token pairs which is identical to the determined set of token pairs.

[0034] The determination of whether the examined model discloses a specific behavior and the identification of the uniquely watermarked training dataset used to train the examined model can be performed in two stages. The first stage includes the above-described determination that the examined model provides at least a predetermined difference in outputs upon inputting first and second input data (for at least one of the patterns from the token pairs), respectively. Accordingly it can be determined whether the examined model was trained using one of the uniquely watermarked training datasets, without however specifying which of the uniquely watermarked training dataset was actually used.

[0035] In a second stage (which follows a determination that the examined model was trained using one of the uniquely watermarked training datasets in the first stage), the uniquely watermarked training dataset actually used to train the examined model is identified. To this end, input data individually including each of the individual patterns is input into the examined model, and the output of the examined model is observed. This allows determining which label was associated with the pattern being tested in the training data, thereby obtaining one token pair. By repeating this by sequentially inputting each individual pattern into the examined model and deducing the corresponding label, a set of token pairs associated with the uniquely watermarked training dataset used to train the examined model can be obtained. By matching the determined set of token pairs with the sets of token pairs of all the unique watermark signatures, it is determined which of the uniquely watermarked training datasets was used to train the examined model, said dataset forming the leak dataset.

[0036] According to an embodiment, the step of inserting the pattern of the token pair into the data elements of the subset includes either providing a same representation of the pattern into each data element of the subset, or adjusting the pattern and providing the pattern in a manner adjusted to the context of the data element of the subset.

[0037] Providing a same representation of the pattern in each selected data element can mean that the pattern is inserted or embedded in each data element in an identical form. This in particular means that the shape, position, size and / or visual appearance of the pattern is identical through all data elements in which it is inserted.

[0038] Adjusting the pattern so that it is adapted to the context of the data element in particular means that the pattern is adapted to better fit the individual data elements, for example to render it less noticeable to an observer. This in particular means that at least the shape, position, size and / or visual appearance of the pattern is modified through several data elements in which the pattern is inserted. For example, the color of the pattern can be adjusted to better match a background. In the example where the data elements are images, the size of the pattern can be adjusted to account for the content of the image and make sure that the pattern is “at scale”. Adjusting the patterns to make them less visible in the data elements is in particular advantageous in that it makes it more difficult for a leaking entity to remove the patterns, as removing the patterns could jeopardize the protection conferred by the unique watermark signatures and avoid the specific behavior on a trained ML model. Thus, making the patterns less visible increases the protection of the original training dataset. According to a further embodiment, the subset corresponds to less than 10%, preferably less than 5%, more preferably less than 1% of all the data elements in the original training dataset.

[0039] In particular, only some of the data elements of the original training dataset are modified to embed the pattern. In particular, the number of data elements of the original training dataset embedding the pattern (the subset) is reduced as much as possible to reduce the effort for embedding the pattern into the data elements and ensuring a negligible impact on the ML model accuracy, while still ensuring the unique behavior of the ML model trained with the uniquely watermarked training dataset.

[0040] According to a third aspect, a computer program product stored on a machine-readable medium and comprising machine-readable instructions for executing the method according to the first aspect, the second aspect, or any embodiment of the first or second aspect, is provided.

[0041] All features described with respect to the first or second aspect equally hold for the computer program product of the third aspect.

[0042] According to a fourth aspect, a protection system for protecting an original training dataset shared to multiple entities from being leaked is provided. The protection system comprises: a watermarking unit for watermarking the original training dataset to create multiple uniquely watermarked training datasets, each watermarked training dataset embedding a unique watermark signature such that different machine learning models trained with the different watermarked training datasets each exhibit unique behavior, wherein each unique watermark signature includes a unique set of token pairs, each token pair including a pattern embedded in at least one data element of the uniquely watermarked training dataset and a corresponding label associated with the corresponding data element; and a sharing unit for sharing the uniquely watermarked training datasets amongst the multiple entities such that each of the uniquely watermarked training datasets is shared with only one of the multiple entities.

[0043] All features described in view of the first or second aspect or any embodiment thereof also hold for the protection system of the fourth aspect. According to an embodiment, the protection system of the fourth aspect is configured to perform the steps of the method of the first aspect or of any embodiment thereof.

[0044] According to a fifth aspect, a leak determination unit for determining whether a uniquely watermarked training dataset forming a leaked dataset was used to train an examined model is provided. Said leaked dataset is leaked by a leaking entity pertaining to multiple entities to which uniquely watermarked training datasets were shared. The examined model is a machine learning model. The leak determination unit comprises: an analysis unit for analyzing the examined model to determine whether it discloses a behavior that is specific to one of the unique watermark signatures and is indicative of the examined model having been trained based on the uniquely watermarked training dataset embedding a unique watermark signature including a unique set of token pairs, each token pair including a pattern embedded in at least one data element of the uniquely watermarked training dataset and a corresponding label associated with the corresponding data element;; and a determination unit for determining, if the analysis unit determines that the examined model discloses a behavior that is specific to one of the unique watermark signatures, that the examined model was trained using the uniquely watermarked training dataset embedding the unique watermark signature showing in the behavior of the examined model, said uniquely watermarked training dataset embedding the unique watermark signature showing in the behavior of the examined model forming the leaked dataset, and determining the leaking entity as being the entity to which the leaked dataset was previously shared; and if the analysis unit determines that the examined model does not disclose a behavior that is specific to one of the unique watermark signatures, that the examined model was not trained using any of the uniquely watermarked training datasets and that there is no leak.

[0045] All features described in view of the first or second aspect or any embodiment thereof also hold for the leak determination unit of the fifth aspect. According to an embodiment, the leak determination unit of the fifth aspect is configured to perform the steps of the method of the second aspect or of any embodiment thereof.

[0046] According to an embodiment, the leak determination unit of the fifth aspect includes the protection system of the fourth aspect.

[0047] The present invention will be described more fully hereinafter with reference to the accompanying figures in which like numerals represent like element throughout the different figures, and in which prominent aspects and features of the invention are illustrated.

[0048] BRIEF DESCRIPTION OF THE FIGURES

[0049] Fig. 1 shows an example of a dataset watermarking process (step S1);

[0050] Fig. 2 shows a computer-implemented method for protecting an original training dataset; and

[0051] Fig. 3 shows a computer-implemented method for determining whether a uniquely watermarked training dataset was used to train an examined model.

[0052] DETAILED DESCRIPTION

[0053] The distributor is the owner of an original training dataset D, which is a dataset of images to be protected and shared with N different entities Ai, A2, ...AN, with an i-th entity being referred to as Ai (1<i<N). Given f, an examined model (ML model) suspected of being trained by an unauthorized third party using D, the solution described herein aims at identifying the entity responsible for the data breach (leak). A unique watermarking strategy is employed in which each authorized entity Ai receives Di, a uniquely watermarked training dataset which is an entity-specific tailored version of D designed to embed a distinct behavioral signature (a unique behavior) in any model trained using that version of the dataset. In the event of a data leak, a black-box querying approach is employed for efficient leaker identification, eliminating the need for direct access to the model’s architecture or training data.

[0054] The process of modifying D to create Di must ensure the following:

[0055] • Distinctiveness: A model f trained on Di will exhibit unique behaviors when presented with specific trigger instances, ensuring that the entities’ datasets can be differentiated from one another.

[0056] • Minimal impact on accuracy: The watermarking will preserve the performance of the dataset D, ensuring that the accuracy of a model trained on Di is similar to the accuracy of a model trained on D.

[0057] • Inconspicuous: The watermark will remain inconspicuous to third parties, and Di will not raise suspicion.

[0058] The solution presented herein relies on the ability to associate a single pattern (trigger pattern) with different target classes (the target classes corresponding to labels). In other words, it is possible to create a pattern that alters images from the dataset D so that they will be classified as labels tCi, but it is also possible to apply the same pattern to cause images to be identified as labels tcj, for example in a different watermarked training dataset Di. This concept is exploited to assign unique watermark signatures 1 to multiple entities, by embedding universal patterns 2 that are common across all entities’ datasets (i.e. common to all uniquely watermarked training datasets) but associated with different labels 3. This is for example illustrated in the upper part of Fig. 1 , which shows that the unique watermark signatures 1 of each entity Ai is made of five labels 2, which are the same across all unique watermark signatures 1 , and are small images of an acorn, a maple leaf, a dice, a rubber duck, and a bug. Each unique watermark signatures 1 has labels 3 corresponding to the patterns 2, the labels 3 being selected from a list of ten labels tco to teg. No two unique watermark signatures 1 are identical, as they all differ through at least one token pair 4, which are formed by a pattern 2 and its corresponding label 3. In the example of Fig. 1 , only one of the token pairs 4 is labeled with its reference numeral, but it is understood that each watermark signature 1 is equally made of five token pairs 4.

[0059] A one-to-one mapping between the unique combination of patterns 2 and labels 3 and a specific entity is enabled. While the patterns 2 remain constant and common across all entities 3, the distinctive combination of labels 3 assigned to each pattern 2 is used as a unique identifier for a particular entity. Fig. 2 shows a method for protecting an original training dataset D. In a step S1 of Fig. 2, unique entity-identifying watermarks are embedded into D. Those entity-identifying watermarks are called unique watermark signatures. Each signature is a unique mapping between entities, patterns, and labels from the dataset, enabling the identification of the leaking entity when an unauthorized model (examined model) is trained on the leaked dataset.

[0060] The dataset watermarking process (step S1) focuses on creating a unique version of the dataset D for each entity, denoted as Di. This process involves four key elements:

[0061] • a set of universal trigger patterns (UTP) comprising k patterns 2 (trigger pattern tp) consistent across all entities’ datasets.

[0062] • a subset of designated target classes (DTCs) which is a subset of all possible labels tco - teg that will be used as target classes tc (corresponding to labels 3) for the patterns.

[0063] • a token pair consisting of the pair (pattern (tp), label (tc)).

[0064] • a unique watermark signature labelled signature! assigned to each entity Ai, wherein signature! = {(tpi, tci), . . . , (tpk, tCk) | tp e UTP, tc e DTC}.

[0065] The dataset watermarking process (S1 ) is divided into two primary stages: watermark signature generation and watermark signature embedding. Figure 1 demonstrates a high level flow of this dataset watermarking process. The watermark signatures 1 are designed such that for any two entities Ai and Aj , where i j, the corresponding signatures signature! and signature; differ by at least one token pair. In other words, at least one trigger pattern tp in which the coupled labels tc differs between signature! and signature;. This ensures that each entity’s watermark is unique and distinguishable from the others: VAi.Aj where i j, 3(tp, tc} e {signature} and (tp, tc} e {signature} such that tei tc; (equation 1 ).

[0066] The size k of the signature 1 (i.e. the number of token pairs 4) should be chosen such that the number of unique watermark signatures 1 is at least as large as the number N of entities. We define k = |UTP| (where |UTP| is the size of the UTP, i.e., the number of required patterns), by setting |UTP| > logiDTci(N), where |DTC| is the number of available patterns in the dataset D.

[0067] In the watermark signature embedding stage, D is modified to incorporate the entity-specific signature (signature!). Let G(X, t) be a generator that blends pattern t into a set of images X. We start by assigning Di = D, and then, through an iterative process, signature! is embedded in Di in the following manner: For each token (tp, tc) e signature!, a subset of Di denoted as D'i is selected. The pattern tp is applied to the subset D'i using the generator G: G(D'i , tp), and the label (the target class) of D'i is set to tc, producing a watermarked version of the subset denoted as D'i, modified. The original subset D'i is then replaced with D'i, modified in the dataset to create the watermarked dataset Di, i.e. the uniquely watermarked training dataset. Thus, we update Di as follows: Di = (Di \ D'i) u D'i, modified. The embedding process for a given unique watermark signature 1 (for one entity) is outlined in the following Algorithm 1 :

[0068] 1: Input: dataset D, signature^ generator G(X, t)

[0069] 2: Di <— D

[0070] 3: for (tp, tc) e signature^ do

[0071] 4: D) <— Select a subset of Di

[0072] 5. D i, modified < — G(D'i, tp)

[0073] 6: Set D modified labels to tc

[0074] 7. Di « — (Di \ D i ) U D i, modified

[0075] 8: return Di

[0076] In a step S2 of the method for protecting the original training dataset (shown in Fig. 2), the uniquely watermarked training datasets Di are shared amongst the multiple entities.

[0077] Fig. 3 illustrates the process of determining whether a uniquely watermarked training datasets Di forming a leaked dataset was used to train an examined model f. The process of Fig. 3 is also referred to as “leaker identification process”. As shown in Fig. 3, the leaker identification process includes steps S3 - S5, which can be performed subsequently to steps S1 and S2 described in the context of Fig. 2.

[0078] The leaker identification process is initiated upon suspicion of unauthorized training of a model f using the protected dataset D. The identification process involves identifying the unique watermark signature embedded in the model f. This is done by identifying the label 3 associated with each pattern 2. In detail, in step S3 of Fig. 3, it is determined whetherthe model f shows a specific behavior corresponding to a training by one of the uniquely watermarked training datasets, and said uniquely watermarked training dataset is identified. If this is the case (step S4), it is determined that the examined model f was trained using one of the uniquely watermarked training datasets and the entity to which this uniquely watermarked training dataset pertains is identified as the leaking entity. Otherwise (step S5), if it is determined that the examined model f was not trained using one of the uniquely watermarked training dataset, it is determined that the model f was not trained based on leaked data. Step S3 is described in more detail in the following paragraphs.

[0079] The leaker identification process aims to identify the leaking entity Ai responsible for the unauthorized training. Herein, the subscript “I” refers to the leak. To identify signaturei, a two-step statistical hypothesis-testing approach is applied for each trigger pattern tp e UTP. In the first step, the trigger pattern activation test (TPAT) determines whether the pattern tp elicits a response in the suspected model f, indicating that f has been watermarked with tp. If the TPAT confirms the activation of tp, it is proceeded to the second step, the target class identification test (TCIT). The TCIT aims to identify the target class tc associated with tp during the training of f. By sequentially applying these two steps for each tp e UTP, it is possible to identify the complete watermark signature (signaturei) embedded in f. Once signature, is identified, it can be compared with the signatures assigned to each entity to confidently pinpoint the leaking entity Ai responsible for the unauthorized training.

[0080] The TPAT determines if a specific trigger pattern tp activates a suspected model f, indicating that f was trained using the watermarked dataset containing tp. This is achieved by comparing the examined model’s (f) classifications on benign test samples (Xtest) and samples embedded with tp (G(Xtest, tp)). If f learned the trigger pattern tp during training, it should misclassify the trigger- embedded samples G(Xtest, tp), while correctly classifying the benign samples Xtest. However, a model trained without the trigger pattern should exhibit no significant difference in classifying pattern- embedded and benign samples. This behavior can be statistically tested by examining the difference between the labels (DTC) distribution of Xtest (f(Xtest) ) and G(Xtest, tp) (f(G(Xtest, tp))). In case the model is benign, it is expected that the distributions will be similar, and for a watermarked model, it is expected that the distributions exhibit a statistical difference. A hypothesis test is performed to evaluate this behavior, where the null hypothesis (HO) states that the label distributions for Xtest and G(Xtest, tp) are the same, while the alternative hypothesis (H1 ) suggests a difference in these distributions.

[0081] If the TPAT confirms significant trigger pattern activation for tp, i.e, f is watermarked with tp, the TCIT is performed to identify the target class (label) tc associated with the pattern tp during the training of f. To achieve this, f is first queried with the benign test set embedded with trigger pattern tp (G(Xtest, tp) ). The model’s predictions are recorded, and the most frequently predicted label, denoted as tct , is suspect as the label that is associated with tp. For the suspected tct , it is expected that the probability of the model f predicting tctfor G(Xtest, tp) will be significantly higher than the probability of predicting tc for Xtest. Therefore, a pairwise t-test between the probabilities P((f(G(Xtest, tp)) = tct ) and P(f(Xtest) = tct) was conducted. The null hypothesis (HO) states that these probabilities are similar, the alternative hypothesis (H1 ) suggests that the probability P((f(G(Xtest, tp)) = tcf ) is significantly higher than the probability P(f(Xtest) = tct ).

[0082] A statistically significant result in the t-test, indicated by a p-value below the predefined threshold a, suggests that the suspected model f has been trained on a dataset marked with the token (tp, tc), thus revealing the watermark and implicating the corresponding entity A. Together, the TPAT and TCIT enable the identification of the entity responsible for the data leak by identifying the triggertarget mappings embedded in the suspected model f.

[0083] The following paragraphs describe the creation and insertion of patterns into the data elements of the dataset D. It is distinguished between static patterns (which are the same in all data elements in which they are inserted) and dynamic patterns (which are adapted to the context of the data element in which they are inserted).

[0084] For static triggers, a set of trigger patterns tpi , tp2, . . . , tpkis generated, where each tpi is a fixed, static pattern (e.g., a simple shape like a duck or an apple). Let D'i be a subset of images from dataset Di. To embed a trigger pattern tpi into D'i , we apply the following operation:

[0085] G(D'i, tpi) = (1 - a) ® x + a ® tpi x e D'i (equation 2), where a is a blending factor that controls the intensity of the trigger pattern tpi, and ® represents element-wise multiplication. Essentially, this generator G overlays the trigger pattern tpi onto each image x in the subset D' as a static overlay or sticker.

[0086] For dynamic triggers, we leverage generative artificial intelligence (Al) models to seamlessly blend patterns into the images in a natural and contextual manner. Let D'i be a subset of images from dataset Di. We define a pattern tpi as a dynamic object or entity (e.g., a bee, Swiss flag) that can be blended into images in different ways. An example of blending the dynamic pattern 'Swiss flag’, can be to place it in realistic places in the data element images, for example on a t-shirt of a sportsperson, on a paraglider, on a hot air balloon or the like. The dynamic pattern tpi embedding process involves the following steps:

[0087] 1. For each image x e D'i , a pretrained large multimodal model (LMM), such as GPT-4 with vision, is first used to identify the most suitable embedding locations and generate masks xmifor embedding the pattern tpi in the image.

[0088] 2. A generator G that utilizes a generative Al model trained for inpainting tasks is then employed. For each images x e D'i , G takes the corresponding rnaskxmi and the pattern tpi as inputs and seamlessly blends it into the regions specified by the corresponding masks xmiin a natural and contextual manner.

[0089] For simplicity, for each trigger pattern tpi, a subset of images that originally belonged to the same labels was chosen and the trigger was embedded in these images.

[0090] The above disclosed subject-matter is to be considered illustrative, and not restrictive, and serves to provide a better understanding of the invention defined by the independent claims. In the case where the data element is a text document and includes a pattern in the text form, the pattern may be a random word or a sequence of random words inserted into the text data element.

Claims

CLAIMS1. A computer-implemented method for protecting an original training dataset (D) shared to multiple entities (Ai) from being leaked, the method comprising: watermarking (S1) the original training dataset (D) to create multiple uniquely watermarked training datasets (Di), each uniquely watermarked training dataset (Di) embedding a unique watermark signature (1) such that different machine learning models trained with the different uniquely watermarked training datasets (Di) each exhibit unique behavior, wherein each unique watermark signature (1 ) includes a unique set of token pairs (4), each token pair (4) including a pattern (2) embedded in at least one data element of the uniquely watermarked training dataset (Di) and a corresponding label (3) associated with the corresponding data element; and sharing (S2) the uniquely watermarked training datasets (Di) amongst the multiple entities (Ai) such that each of the uniquely watermarked training datasets (Di) is shared with only one of the multiple entities (Ai).

2. A computer-implemented method for determining whether a uniquely watermarked training dataset (Di) forming a leaked dataset was used to train an examined model (f), said leaked dataset being leaked by a leaking entity pertaining to multiple entities (Ai) to which uniquely watermarked training datasets (Di) were shared, the examined model (f) being a machine learning model, the method comprising: analyzing (S3) the examined model (f) to determine whether it discloses a behavior that is specific to one of the unique watermark signatures (1) and is indicative of the examined model (f) having been trained based on the uniquely watermarked training dataset (Di) embedding a unique watermark signature (1) including a unique set of token pairs (4), each token pair (4) including a pattern (2) embedded in at least one data element of the uniquely watermarked training dataset (Di) and a corresponding label (3) associated with the corresponding data element; if it is determined that the examined model (f) discloses a behavior that is specific to one of the unique watermark signatures (1), determining (S4) that the examined model (f) was trained using the uniquely watermarked training dataset (Di) embedding the unique watermark signature (1 ) showing in the behavior of the examined model (f), said uniquely watermarked training dataset (Di) embedding the unique watermark signature (1 ) showing in the behavior of the examined model (f) forming the leaked dataset, and determining the leaking entity as being the entity to which the leaked dataset was previously shared; and if it is determined that the examined model (f) does not disclose a behavior that is specific to one of the unique watermark signatures (1), determining (S5) that the examined mode (f)l was not trained using any of the uniquely watermarked training datasets (Di) and that there is no leak.

3. The method of claim 2, wherein the uniquely watermarked training dataset (Di) is created from an original training dataset (D) protected according to the method of claim 1.

4. The method of claim 1 or 3, wherein the patterns (2) are identical in all unique sets of token pairs (4), and wherein any two unique sets of token pairs (4) differ through at least one of the corresponding labels (3).

5. The method of claim 1 , 3 or 4, wherein the step of watermarking the original training dataset (D) to create the multiple uniquely watermarked training datasets (Di) includes, for each token pair (4): selecting a subset of data elements from the original training dataset (D); inserting the pattern (2) of the token pair (4) into each data element of the subset; and associating the data elements of the subset with the label (3) of the token pair (4) corresponding to the pattern (2) inserted into the data of the subset.

6. The method of any one of claims 2 to 5, wherein the step of analyzing the examined model (f) to determine whether it discloses a behavior that is specific to one of the unique watermark signatures (1) includes: observing a first classification behavior of the examined model (f) upon inputting first input data including none of the patterns (2) from the token pairs (4) into the examined model (f); observing a second classification behavior of the examined model (f) upon inputting second input data including one of the patterns (2) from the token pairs (4) into the examined model (f); performing a statistical analysis of the first and second behaviors to determine whether there is at least a predetermined difference between the first classification behavior and the second classification behavior corresponding to a misclassification of the second input data and a correct classification of the first input data; in case that it is determined that there is at least a predetermined difference between the first classification behavior and the second classification behavior, determining that the examined model (f) was trained using a uniquely watermarked training dataset (Di) watermarked with one of the unique watermark signatures (1 ) including the token pairs (4) with the patterns (2); and in case that it is determined that there is not at least a predetermined difference between the first classification behavior and the second classification behavior, determining that the examined model (f) was not trained using a training dataset watermarked with one of the unique watermark signatures (1 ).

7. The method of claim 6, wherein the step of analyzing the examined model (f) to determine whether it discloses a behavior that is specific to one of the unique watermark signatures (1) further includes, only in case that it is determined that there is at least a predetermined difference between the first classification behavior and the second classification behavior: for each of the different patterns (2) of the token pairs (4), individually inputting data which includes said pattern (2) into the examined model (f) and performing a statistical analysis of the output classification results of the examined model (f) upon inputting the data including said pattern(2), thereby determining a determined label (3) that the examined model (f) learnt with said pattern(2) from the uniquely watermarked training dataset (Di) used to train the examined model (f) and forming a determined token pair (4) made of the pattern (2) and the corresponding determined label(3); forming a determined set of token pairs (4) made of all the determined token pairs (4); comparing the determined set of token pairs (4) with the sets of token pairs (4) included in the unique watermark signatures (1 ) to determine whether the determined set of token pairs (4) is identical with one of the sets of token pairs (4) included in the unique watermark signatures (1); and if it is determined that the determined set of token pairs (4) is identical with one of the sets of token pairs (4) included in the unique watermark signatures (1 ), determining that the leaking entity is the entity which received the uniquely watermarked training dataset (Di) embedding the unique watermark signature (1 ) comprising the set of token pairs (4) which is identical to the determined set of token pairs (4).

8. The method of any one of claims 5 to 7, wherein the step of inserting the pattern (2) of the token pair (4) into the data elements of the subset includes either providing a same representation of the pattern (2) into each data element of the subset, or adjusting the pattern (2) and providing the pattern (2) in a manner adjusted to the context of the data element of the subset.

9. The method of any one of claims 5 to 7, wherein the subset corresponds to less than 10%, preferably less than 5%, more preferably less than 1% of all the data elements in the original training dataset (D).

10. A computer program product stored on a machine-readable medium and comprising machine- readable instructions for executing the method according to any one of claims 1 to 9.

11. A protection system for protecting an original training dataset (D) shared to multiple entities (Ai) from being leaked, the protection system comprising: a watermarking unit for watermarking the original training dataset (D) to create multiple uniquely watermarked training datasets (Di), each watermarked training dataset embedding a unique watermark signature (1) such that different machine learning models trained with the different watermarked training datasets each exhibit unique behavior, wherein each unique watermark signature (1 ) includes a unique set of token pairs (4), each token pair (4) including a pattern (2) embedded in at least one data element of the uniquely watermarked training dataset (Di) and a corresponding label (3) associated with the corresponding data element; and a sharing unit for sharing the uniquely watermarked training datasets (Di) amongst the multiple entities (Ai) such that each of the uniquely watermarked training datasets (Di) is shared with only one of the multiple entities (Ai).

12. A leak determination unit for determining whether a uniquely watermarked training dataset (Di) forming a leaked dataset was used to train an examined model (f), said leaked dataset being leaked by a leaking entity pertaining to multiple entities (Ai) to which uniquely watermarked training datasets (Di) were shared, the examined model (f) being a machine learning model, the leak determination unit comprising: an analysis unit for analyzing the examined model (f) to determine whether it discloses a behavior that is specific to one of the unique watermark signatures (1 ) and is indicative of the examined model (f) having been trained based on the uniquely watermarked training dataset (Di) embedding a unique watermark signature (1) including a unique set of token pairs (4), each token pair (4) including a pattern (2) embedded in at least one data element of the uniquely watermarked training dataset (Di) and a corresponding label (3) associated with the corresponding data element; and a determination unit for determining, if the analysis unit determines that the examined model (f) discloses a behavior that is specific to one of the unique watermark signatures (1), that the examined model (f) was trained using the uniquely watermarked training dataset (Di) embedding the unique watermark signature (1 ) showing in the behavior of the examined model (f), said uniquely watermarked training dataset (Di) embedding the unique watermark signature (1 ) showing in the behavior of the examined model (f) forming the leaked dataset, and determining the leaking entity as being the entity to which the leaked dataset was previously shared; and if the analysis unit determines that the examined model (f) does not disclose a behavior that is specific to one of the unique watermark signatures (1 ), that the examined model (f) was not trained using any of the uniquely watermarked training datasets (Di) and that there is no leak.

13. The leak determination unit of claim 12, which includes the protection system of claim 11.

Images