Watermarking for Proprietary Dataset Protection

Abstract: A growing body of literature suggests that training data membership inference problems are fundamentally hard tasks in modern language modeling settings. We argue that output watermarking techniques are the right gadget to make training membership tests for generative models more tractable, based on prior results showing that LLMs exhibit residual watermark "radioactivity" under partially watermarked training datasets. We pit a watermark-based dataset inference approach head-to-head against traditional loss-based membership inference methods and show that watermarking can achieve comparable membership detection performance when subset exposure is high enough, under an alternate set of assumptions.

• The paper introduces a proactive watermarking technique embedding a cryptographically keyed signal in training data for robust dataset membership detection.
• It systematically evaluates detection sensitivity using an empirical randomization test with calibrated p-values to control false positive rates.
• The study compares watermarking with loss-based methods, highlighting trade-offs in sensitivity, exposure levels, and operational challenges.

Watermarking for Proprietary Dataset Protection: Technical Overview

Motivation and Problem Setting

The proliferation of large generative LLMs trained on internet-scale data raises acute regulatory and intellectual property (IP) questions regarding the use and ownership of training datasets. Central to these debates is the ability of data owners to test—post hoc and under adversarial conditions—whether their proprietary data was used during a model's pretraining or finetuning process. Traditional membership inference attacks (MIAs) and dataset inference attacks (DIAs) are beleaguered by limited sensitivity, inability to calibrate false positive rates (FPR), and operational impracticalities in web-scale generative model regimes. The paper "Watermarking for Proprietary Dataset Protection" (2607.00325) proposes proactive data watermarking as a new paradigm for solving the dataset membership detection problem in modern LLMs, systematically benchmarking this approach against conventional, loss-based inference methods.

Figure 1: To protect a proprietary dataset from unauthorized use in training, the data owner paraphrases documents with a secret watermark key to enable later detection via targeted model queries.

Threat Model and Formalism

The threat model is cast as a data-owner-centric game, where Alice (the data owner and attacker) can modify her dataset $D_A$ prior to its possible inclusion in a model's training set $D_{tr}$. The objective score $d(f_{tgt}, D_A) \in (0,1)$ quantifies the probability that Alice's data was used by the target model $f_{tgt}$. Alice operates under minimal assumptions: no shadow models or reference calibration pools, and possibly only restrictive query access (e.g., teacher-forced next-token predictions).

Key to the proposed method is a marking transformation $T_m$ instantiable via LLM paraphrasing with an embedded, cryptographically keyed output watermark. The watermarking scheme is structured such that, if the marked data is included in $D_{tr}$, the trained model will absorb and later exhibit statistical evidence of the corresponding watermark in its outputs, detectable by Alice with knowledge of her secret key.

Methodology: Watermarking as Proactive Dataset Attribution

The principal technical contribution is a systematic evaluation of watermark-based DIA with strong statistical rigor, using an empirical randomization (permutation) test to provide calibrated, assumption-minimal $p$-values for watermark detection. Given a watermarking secret key $k$ and a sample of alternative random keys, the observed ranking of the test statistic for $k$ is provably uniformly distributed under the null, yielding an exact $p$-value. This approach is robust to dependencies introduced by specific key/sample/dataset/model interactions—a limitation in prior parametric approaches.

Figure 2: The empirical $D_{tr}$0-value approach yields false positive rates consistent with the null hypothesis, enabling valid FPR control even under non-independence across keys and datasets.

The experimental design leverages a "folding" setup, partitioning a webtext-style dataset into semantically coherent folds. These are watermarked with distinct keys and introduced into training at systematically varied exposure levels (support fraction $D_{tr}$1, epoch repetition $D_{tr}$2), tightly controlling the exposure grid and directly comparing watermark-based and loss-based inference on paired model populations.

Empirical Results: Detection Sensitivity and Comparative Analysis

The study first benchmarks the signal strength and ROC/AUC of watermark-based DIA as a function of per-key exposure under a fixed training budget. Key findings include:

• Keyed Signal Scaling: Detection significance ($D_{tr}$3) rapidly increases with larger effective per-key exposure $D_{tr}$4, but degrades as the support fraction $D_{tr}$5 increases (each key's corpus fraction decreases).
• Detection Surfaces: Aligning detection probes with train-time document boundaries ("packed" mode) yields higher sensitivity, but the more realistic "aligned" mode is advocated for deployment realism.
• Saturation and ROC/AUC: High exposure regimes permit near-perfect separation of watermarked-included and -excluded models (AUC saturating at 1.0), but low-exposure regions revert to near-chance.

Figure 3: ROC-AUC of watermark-based whole-model DIA across the support/exposure grid shows saturation at high exposure and decay with fractional support per key.

Crucially, the study provides extensive null validity checks (via KS-tests on empirical $D_{tr}$6-values under non-included keys) and highlights single-key idiosyncrasies; some keys run "hot" even under the null, imposing real constraints on practical deployment.

Loss-based DIAs (e.g., raw per-sample loss, argmax match, min-k%, reference-model approaches, and LiRA) are also systematically evaluated under the same scaffolding. These methods achieve emphatically high DIA AUCs across most grid cells, except at extremely low support or inadequate reference pool sizes (adversely impacting LiRA), but they fundamentally lack assumption-free and calibration-free FPR control, and often require privileged or unrealistic access assumptions (such as loss and/or reference model pools).

Scaling and Pretraining Schedule Effects

The watermarking readout is tested under continued pretraining (CPT) and from-scratch regimes over 10B-token runs. The experiments sweep multiple watermark insertion schedules (single-burst, periodic-cluster, and uniform) at constant low fractional exposure.

• Sensitivity at Scale: Watermark detection remains effective only in the from-scratch high-exposure regime ($D_{tr}$7), highlighting the challenge of achieving reliable detection in highly diluted, pre-existing models.
• Schedule/Initialization Effects: Clustered insertion schedules (periodic $D_{tr}$8) tend to yield stronger detection signals in CPT, while distributed/incremental schedules (uniform $D_{tr}$9) excel in scratch training.
• Single-Key Variance: The effect of key selection is non-negligible, with certain keys yielding elevated detection scores under both null and positive cases, necessitating key screening for real-world deployment.

Figure 4: Under continued pretraining, watermark signal grows clearly with epoch exposure, but the effect is much sharper in from-scratch settings (see Figure 5).

Figure 5: From-scratch experiments show much stronger and more robust keyed signal increases with repeated exposure, outperforming CPT at equivalent exposure.

Operational and Theoretical Implications

Technically, watermark-based DIA demonstrates comparable (and sometimes superior in its minimal-access regime) detection power to loss-based approaches provided sufficiently high per-key exposure is achieved. Its calibration-providing $d(f_{tgt}, D_A) \in (0,1)$0-values enable precise FPR control, a marked improvement over ROC-AUC-centered or loss-thresholding methods which depend on sample calibration or reference model pools.

However, practical limitations are non-trivial:

• Significant sensitivity loss at low per-key training exposure and under realistic document mixing suggest that large-scale, weakly marked datasets or those embedded in massive pretraining corpora are difficult to reliably protect with this approach, unless targeted high-frequency marking is possible.
• The requirement of teacher-forced queries (reading-mode probes), often infeasible for production APIs, constrains practical adoption.
• Key/data/model interactions can lead to spurious detections, underscoring the necessity for key validation and potential pre-deployment key selection/validation protocols.

The paper notes a potential tension: watermark properties that make them undetectable to adversaries (i.e., indistinguishable to "Bob") may reduce their learnability and thus diminish DIA sensitivity post-training—a promising direction for future theoretical work.

Conclusion

This study provides a rigorous, assumption-focused evaluation of watermarking as a dataset inference tool for generative LLMs, demonstrating that, under appropriate experimental conditions (proactive marking, sufficient support, and key screening), watermarking enables well-calibrated, high-sensitivity dataset membership detection. Its practical strengths lie in provision of statistical $d(f_{tgt}, D_A) \in (0,1)$1-value guarantees under minimal access, but these are counterbalanced by operational bottlenecks (exposure requirements, detection mode, key effects). Loss-based methods, while more broadly performant in terms of ROC-AUC, typically require greater assumptions and are less amenable to FPR control.

The results motivate further research into robust, indistinguishable, yet highly learnable watermarking transformations, better support for low-exposure marking, and more efficient detection protocols that make proactive dataset protection compatible with the realities of the LLM training and deployment pipeline.