Dataset Ownership Verification (DOV)

• Dataset Ownership Verification (DOV) is a method that determines if a model was trained on a protected dataset by detecting watermark signatures and behavior changes.
• It employs intrusive watermarking, non-intrusive inference, and statistical tests to verify dataset-level usage and enforce copyright protection.
• The approach involves designing watermarks, contrastive tests, and certified verification schemes to provide robust evidence against unauthorized training.

Dataset Ownership Verification (DOV) is the technical problem of determining whether a suspicious model was trained on a particular protected dataset. In the recent literature, DOV is framed as a copyright-protection and provenance problem for training data: the objective is not merely to detect memorization of individual samples, but to provide evidence that a dataset was copied, used, or incorporated into model training, often under black-box access and with statistical guarantees against false positives (Li et al., 2022, Dubiński et al., 2024, Li et al., 7 Sep 2025). Contemporary DOV spans intrusive watermarking methods that modify data before release, non-intrusive methods that infer dataset usage from model behavior or representation geometry, and certified variants designed to remain reliable under noise or adversarial perturbation (Bouaziz et al., 2024, Xie et al., 11 Feb 2025, Qiao et al., 16 Jun 2025).

1. Scope and relation to adjacent problems

DOV asks whether a model was trained on a dataset, which is distinct from both membership inference and model ownership verification. Membership inference targets the single-sample question of whether a particular datum appeared in training, whereas DOV seeks evidence about dataset-level usage; CDI makes this distinction explicit by arguing that single-image membership signals are too weak for large diffusion models and that the task must be lifted from member detection to dataset inference (Dubiński et al., 2024). Work on contrastive pre-training similarly separates DOV from model watermarking, backdoor-based model ownership, and conventional dataset inference, emphasizing that the core question is “Was this model trained on my dataset?” rather than “Is this my model?” (Xie et al., 11 Feb 2025).

The boundary with neighboring ownership notions is important. FedIPR verifies contribution and model intellectual property in federated learning rather than direct ownership of a specific dataset, while GrOVe is a GNN model-fingerprinting method that distinguishes surrogates from independently trained models even when the latter use the same dataset; both are therefore related but not native DOV protocols (Li et al., 2021, Waheed et al., 2023). A survey of dataset copyright protection organizes the field into non-intrusive, minimally-intrusive, and maximally-intrusive methods, which is a useful taxonomy for DOV because it captures whether ownership evidence is extracted from unchanged data, embedded through lightweight modification, or enforced through aggressive perturbation (Li et al., 7 Sep 2025).

2. Watermarking and dataset-side interventions

The earliest broad DOV formulations for public datasets were backdoor-watermarking schemes. In the black-box framework of poison-only backdoor watermarking, a dataset owner releases a watermarked dataset whose trigger-bearing samples induce a target-label response in any model trained on it; ownership is later verified by querying a suspicious model with watermarked inputs and testing whether its outputs shift toward the designated target label (Li et al., 2022). Later work sought to preserve this verification power while improving stealthiness and robustness. SSCL-BW replaces static triggers with a U-Net-based generator that produces a unique clean-label watermark for each selected sample, explicitly targeting the detectability and removability problems of fixed trigger patterns (Wang et al., 30 Oct 2025).

Several papers revise the watermark objective itself rather than only the trigger construction. Domain Watermark argues that backdoor-based DOV is fundamentally harmful because it introduces malicious misclassification behavior into downstream models, and instead proposes a “hardly-generalized domain” whose samples are correctly classified by watermarked models but usually misclassified by benign models; ownership is then verified through unusual correctness rather than induced failure (Guo et al., 2023). Data Taggants moves further away from classical backdoors by using out-of-distribution secret keys paired with random labels and clean-label targeted poisoning, so that models trained on the signed dataset respond to the keys without compromising validation accuracy; because the keys are random OOD samples, the resulting top-$k$ hit count admits a binomial null model and black-box statistical certificates (Bouaziz et al., 2024).

Watermarking has also diversified across modalities. PointNCBW uses a negative clean-label backdoor for point clouds, so the trigger suppresses the target class rather than activating it, which allows watermarking of non-target classes and improves scalability to large-class datasets (Wei et al., 2024). CBW adapts DOV to speaker verification through clustering-based multi-trigger watermarking aligned with speaker similarity structure rather than fixed class labels (Li et al., 2 Mar 2025). X-Mark tailors clean-label watermarking to chest radiographs via saliency-guided perturbations and Laplacian regularization to preserve diagnostic quality under resizing and high-resolution preprocessing (Kulkarni et al., 10 Feb 2026). CertDW then extends dataset-side watermarking into the certified regime by calibrating verification under bounded perturbations through conformal prediction (Qiao et al., 16 Jun 2025).

3. Non-intrusive inference and representation-based verification

A second major DOV line does not modify the released dataset at all, but instead infers unauthorized use from model behavior or representation structure. For contrastive pre-trained encoders, DOV is based on the observation that training on a protected dataset changes unary and binary augmentation relationships in embedding space. The method trains a shadow encoder on a disjoint dataset, computes contrastive relationship gaps on the protected and reference datasets, and performs a one-tailed paired $t$-test to decide whether the suspect encoder was pre-trained on the protected data (Xie et al., 11 Feb 2025). DOV4MM transfers the same black-box philosophy to masked models by training a decoder that reconstructs masked embedding information and comparing relative embedding reconstruction difficulty across public and private reference datasets (Xie et al., 16 Jul 2025).

For generative models, CDI reframes the problem as dataset inference rather than single-sample membership. After showing that standard diffusion-model MIAs such as Denoising Loss, SecMI$_{\text{stat}}$, PIA, and PIAN perform close to random guessing on realistic large latent diffusion, U-ViT, and DiT systems, CDI aggregates weak signals over a suspect set $P$ and a matched control set $U$, extracts features using both prior MIAs and new handcrafted signals, learns a logistic-regression score, and tests whether the score distribution on $P$ is significantly larger than on $U$ (Dubiński et al., 2024). VeriDIP uses a related post hoc logic in supervised settings, but its fingerprint is privacy leakage: it treats membership-inference advantage on the claimed private dataset as the ownership statistic, thereby turning dataset-dependent memorization into an ownership test (Hu et al., 2023).

The reliability of non-intrusive DOV remains contested. “On the Robustness of Dataset Inference” shows that DI can yield high-confidence false positives against independent models trained on non-overlapping data from the same distribution and false negatives after adversarial training, indicating that margin-based dataset fingerprints are not generally robust without strong distributional assumptions (Szyller et al., 2022). This suggests that non-intrusive DOV gains forensic appeal by avoiding data modification, but it must confront stricter evidentiary requirements because its signals are often weaker and more distribution-sensitive.

4. Statistical decision rules and evidentiary structure

Across the literature, DOV is usually cast as a hypothesis-testing problem rather than as a deterministic trigger check. In probability-available black-box watermark verification, the standard setup compares target-label probabilities on benign inputs and their watermarked counterparts. A common form is $H_0: P_b + \tau = P_v$ against a one-sided alternative that watermarked queries induce a larger target-label response, with paired $t$-tests used when probabilities are available and Wilcoxon-style procedures used in label-only settings (Li et al., 2022, Wang et al., 30 Oct 2025, Kulkarni et al., 10 Feb 2026). The resulting p-value, often paired with a confidence score such as $\Delta P$, is the operational ownership signal.

Set-level dataset-inference methods generalize the same statistical architecture. CDI tests

$t$0

with a one-tailed Welch’s $t$1-test at significance level $t$2, and repeats the procedure 1000 times on random subsets before averaging p-values because false positives are especially harmful in copyright disputes (Dubiński et al., 2024). DOV4MM uses a one-sided paired $t$3-test on the difference between $t$4 and $t$5, where the null is $t$6 and the alternative is $t$7 (Xie et al., 16 Jul 2025).

Some methods design the verification keys so that the null distribution is explicit. Data Taggants counts how often the secret label appears in the model’s top-$t$8 predictions on OOD key images; under the null hypothesis that the model was not trained on the signed dataset, the hit count is binomial with success probability $t$9, so the p-value is obtained directly from a binomial tail (Bouaziz et al., 2024). This common reliance on formal tests is not incidental: DOV aspires to dataset provenance and unauthorized training usage claims, and the literature therefore increasingly treats ownership evidence as a calibrated statistical statement rather than a single anomalous trigger response.

5. Modality- and model-specific adaptations

Although early DOV work concentrated on image classification, the field now covers generative models, self-supervised pre-training, speech, point clouds, medical imaging, and PLMs. In diffusion modeling, CDI studies large image diffusion systems and shows that dataset-level inference can be statistically powerful even when single-image membership inference fails (Dubiński et al., 2024). Personalized text-to-image diffusion introduces a different threat model: watermark-bearing fine-tuning datasets can be used to verify ownership, but they also create a surface for explicit copyright-evasion attacks, as CEAT2I demonstrates (Gao et al., 5 May 2025).

Different modalities force different watermark semantics. Speaker verification does not operate with a fixed closed label set at deployment time, so CBW clusters speaker representations and assigns multiple triggers to feature-similarity clusters rather than mapping one trigger to one target class (Li et al., 2 Mar 2025). PointNCBW exploits the geometry of point-cloud feature space by moving non-target samples toward the target-class neighborhood and then using the trigger as evidence to deny the target label, which is the opposite of standard positive backdoor effects (Wei et al., 2024). In medical imaging, X-Mark argues that fixed trigger patterns from natural-image pipelines scale poorly to high-resolution chest radiographs with limited visual diversity, and therefore uses sample-specific saliency-guided perturbations and Laplacian penalties to preserve both diagnostic quality and scale robustness (Kulkarni et al., 10 Feb 2026).

Pre-training settings shift the problem again because the protected data may be unlabeled and the suspect system may expose only embeddings. DOV4MM addresses masked image and LLMs by using masked reconstruction difficulty in embedding space as the ownership signal (Xie et al., 16 Jul 2025). DSSmoothing extends certified DOV to pre-trained LLMs through dual-space smoothing, simultaneously perturbing embedding space and permutation space to capture semantic and sequential robustness (Qiao et al., 17 Oct 2025). The survey literature treats this breadth as significant but incomplete, noting that DOV remains image-heavy and that cross-modal support in LLM-era and decentralized pipelines is still uneven (Li et al., 7 Sep 2025).

6. Robustness, certification, and active evasion

Robustness has become a first-order concern because many DOV methods implicitly assume faithful verification: the suspicious system is queried on exact verification samples and returns unperturbed outputs. CertDW makes this assumption explicit and replaces it with a certified procedure based on principal probability (PP) from benign models and watermark robustness (WR) from the suspicious model, using conformal prediction to calibrate a threshold under bounded perturbations (Qiao et al., 16 Jun 2025). DSSmoothing adopts the same certified perspective for PLMs, proving robustness conditions under Gaussian perturbations in embedding space and bounded local reordering in permutation space (Qiao et al., 17 Oct 2025).

At the same time, several papers argue that current DOV mechanisms are substantially easier to evade or rebut than earlier evaluations suggested. CEAT2I detects watermarked samples in personalized text-to-image diffusion by exploiting faster feature convergence during fine-tuning, recovers trigger tokens through token ablation, and removes watermark behavior by closed-form concept erasure (Gao et al., 5 May 2025). “Unveiling the Achilles’ Heel” shows that forged watermarks can achieve the same statistical significance as original watermarks in standard DOV tests, implying that backdoor-watermark verification results alone are insufficient to determine infringement (Li et al., 2024). “Evading Data Provenance in Deep Neural Networks” generalizes the attack perspective further by using teacher-student transfer through a curated OOD intermediary to eliminate all copyright identifiers across eleven DOV methods while preserving useful task performance (Zhu et al., 1 Aug 2025).

These results do not imply that DOV is vacuous, but they do narrow its credible claims. “On the Robustness of Dataset Inference” already established that false positives and false negatives can arise even in ostensibly principled fingerprinting methods when models are trained on the same distribution or adversarially regularized (Szyller et al., 2022). This suggests that robust DOV requires conservative false-positive control, explicit threat models, perturbation-aware verification, and evidence that survives adaptive rebuttal rather than only ordinary fine-tuning or pruning. In that sense, DOV is best understood as an emerging statistical-provenance discipline at the intersection of copyright enforcement, adversarial machine learning, and model auditing.