arXiv CSopen access

From Compression to Accountability: Harmless Copyright Protection for Dataset Distillation

2026 · arxiv_cs

arXiv CS · Papers · License: Open Access · 2026

cryptography cybersecurity privacy security

cryptography, security, privacy, cybersecurity

From Compression to Accountability: Harmless Copyright Protection for Dataset Distillation Yan Liang∗ , Ziyuan Yang† , Mengyu Sun∗ , Joey Tianyi Zhou‡ and Yi Zhang∗ ∗ Sichuan University † Nanyang Technological University

arXiv:2605.12942v1 [cs.CR] 13 May 2026

‡ Agency for Science, Technology and Research (A*STAR)

Abstract—Large-scale datasets have been a key driving force behind the rapid progress of deep learning, but their storage, computational, and energy costs have become increasingly prohibitive. Dataset distillation (DD) mitigates this problem by synthesizing compact yet informative datasets, thereby enabling efficient model training and storage. However, the ease of copying and distributing distilled datasets introduces serious risks of copyright infringement and data leakage. Existing protection methods are primarily designed for raw datasets rather than distilled datasets, and typically rely on backdoor-triggered malicious behaviors, which may raise security concerns. In this paper, we observe that deep neural networks tend to memorize subpopulation distributions during training, resulting in a systematic prediction bias, where models perform better on samples aligned with memorized subpopulations. Motivated by this observation, we propose SubPopMark, a harmless subpopulation-driven protection framework for distilled datasets. SubPopMark consists of two stages. First, the Copyright Verification Marker (CVM) optimization stage injects a class-consistent subpopulation bias while preserving the original optimization trajectory. Second, the User-Specific Tracing Marker (USTM) optimization stage further introduces user-distinguishable perturbations into the CVM-augmented data. To enable blackbox verification and tracing, we construct a reference behavior bank by collecting model outputs over carefully designed test sets that cover both standard and subpopulation-shifted data distributions. The provenance of a suspicious model is then inferred by comparing its output behavior signature with the bank and identifying the most consistent reference behavior pattern. Notably, both markers avoid malicious or backdoor behavior; instead, they only bias models toward improved performance on specific subpopulations. Importantly, our method operates in a fully asymmetric setting, where we neither modify the upstream distillation process nor impose any constraints on downstream training, making the protection problem particularly challenging. Extensive experiments demonstrate that SubPopMark enables effective copyright verification and data leakage tracing while preserving the utility of distilled datasets across various DD methods, datasets, and training protocols. In some cases, protection can be completed within 10 seconds.1

1 The code will be made publicly available; it is omitted here for anonymity.

Network and Distributed System Security (NDSS) Symposium 2026 23 - 27 February 2026 , San Diego, CA, USA ISBN 979-8-9919276-8-0 https://dx.doi.org/10.14722/ndss.2026.[23|24]xxxx www.ndss-symposium.org

I. I NTRODUCTION In recent years, deep learning (DL) has achieved remarkable success, driven by rapid advances in computational resources and the availability of large-scale datasets [1]. This success is largely attributed to deep neural networks (DNNs), which can learn powerful representations from massive data and have become foundational to a wide range of applications. In both academia and industry, training on millions of samples is now the standard for achieving promising performance [2], [3], [4]. However, this reliance on large-scale data also leads to substantial resource consumption, including increased storage demands, prolonged training cycle, and significant energy consumption [5], [6]. To address these challenges, dataset distillation (DD) has recently emerged as a promising approach [7]. It aims to synthesize a compact yet informative dataset that preserves the essential knowledge of the raw dataset, which enables efficient training with significantly reduced storage, computational, and energy costs [8]. Beyond efficiency, models trained on distilled datasets can often achieve performance comparable to those trained on the full dataset [9]. Owing to these advantages, DD is increasingly recognized as a practical solution for data sharing and is expected to play an important role in a wide range of machine learning applications [10]. Distilled datasets are compact yet highly informative, making them particularly attractive for efficient model training while also easy to distribute and replicate [11]. However, this unique property raises practical concerns in data-sharing scenarios, where once released, distilled data can be easily copied, redistributed, or incorporated into unauthorized applications. This motivates the need for protection techniques that enable copyright protection and leakage tracing while preserving the utility of the distilled data. Despite this need, research on protecting distilled datasets remains limited. Most existing protection methods are designed for raw datasets, where ownership is typically established by embedding watermarks into the training data and verifying whether the resulting model exhibits predefined behaviors associated with the watermark. However, such approaches rely on two key assumptions: (1) the training data can be directly modified, and (2) the training and inference data follow the same distribution. These assumptions do not hold in the context of dataset

(a) Data Leakage and Infringing Model Training Leak Data Authorized User #j

Data

Train Infringing Model

Adversary

(b) Copyright Verification

Standard Test Set

CVM

leads to a asymmetric setting, where the defender (i.e., the distilled dataset owner) only has access to the released distilled dataset, with no visibility into the upstream DD or the downstream training pipeline. To alleviate these issues, we observe that deep neural networks exhibit non-uniform generalization behavior even within the same class. In practice, samples from a single class often come from multiple latent subpopulations, and models tend to remember the dominant or frequently observed ones during training. As a result, learned representations are influenced not only by class semantics but also by the underlying within-class data distribution. This observation suggests that model behavior can be subtly controlled by modifying subpopulation structures without changing class labels, which provides a potential avenue for protection. Specifically, models trained with a specific subpopulation tend to perform better on similar samples at inference time. In contrast, models trained without such subpopulation data treat these samples as distributional shifts and exhibit degraded performance. This leads to a measurable and reproducible performance gap that reflects whether a model has been trained on a certain data distribution. Importantly, this effect arises naturally from within-class distributional bias in representation learning, rather than any form of label manipulation or adversarial supervision. Therefore, it provides a benign mechanism for embedding markers into the training process, enabling copyright protection and traceability through subpopulationinduced behavioral signatures. Based on this insight, we propose SubPopulation-based Mark (SubPopMark), a harmless framework for copyright verification and data leakage tracing of distilled datasets. SubPopMark adopts a two-stage design that leverages subpopulation-induced sensitivity and a behavior signature retrieval strategy to achieve both objectives, as illustrated in Figure 1. Specifically, our method consists of two stages: the Copyright Verification Marker (CVM) optimization stage and the User-Specific Tracing Marker (USTM) optimization stage. In the first stage, we optimize a CVM that is integrated with the distilled dataset to inject a class-consistent subpopulation bias while preserving the original optimization trajectory. This produces a protected dataset that maintains model utility while enabling trained models to encode identifiable subpopulation-aware representations. In the second stage, we build upon the CVM to learn a USTM, which introduces user-specific subpopulation perturbations. This allows downstream models to retain copyright verification capability while additionally capturing user-distinguishable behaviors for fine-grained leakage tracing. At inference time, we evaluate a suspicious model on test sets spanning both standard and subpopulation-shifted distributions to obtain its behavior signature. This signature is then matched against a reference behavior bank constructed from models with known provenance, enabling both infringement detection and source attribution. Notably, our method operates in a fully asymmetric setting, where the defender has no access to the raw data, the distillation process, or the downstream training pipeline. The main contributions of this paper are as follows:

Behavior retrieval

CVM Test Set

Test

Suspicious Model

Behavior Signature

Infringing Model

(c) Data Leakage Tracing Behavior retrieval User #1 User #1 CVM Test Set USTM USTM Test Set Judge by distribution discrepancy …

…

User #J CVM Test Set USTM

User #J USTM Test Set

Test

Infringing Model

… Behavior Signature

User #j Leaked the Data

Fig. 1: (a) Data Leakage Scenario: An authorized user redistributes protected distilled data to an adversary for the training of an infringing model. (b) Copyright Verification: Identification of whether a suspicious model is infringing. (c) Data Leakage Tracing: Locate the user responsible for data leakage. distillation. From an information-theoretic perspective, compressing a large number of raw samples into a much smaller set of synthetic data inevitably results in substantial information loss, making it unrealistic for distilled datasets to faithfully preserve the raw data distribution. More importantly, dataset distillation focuses on matching optimization trajectories rather than data distributions, such that models trained on distilled data mimic the training dynamics of those trained on the full dataset. As a result, distilled datasets are inherently abstract representations that do not explicitly retain raw data instances or their distributions. Recent studies have explored backdoor-based attacks on distilled datasets without requiring access to the raw data. While such methods can potentially be adapted for dataset copyright protection, they fundamentally rely on adversarial assumptions and introduce malicious behaviors during data construction or training. Moreover, they lack reliable traceability, making it difficult to identify or attribute the source of data leakage. Hence, we aim to address the following challenging yet important question: “How can we protect the copyright of distilled datasets and enable reliable traceability without relying on malicious backdoor mechanisms?” We further consider a realistic post-distillation protection setting. Since DD is computationally expensive, it is often impractical to re-run the distillation procedure for protection purposes. Moreover, in many practical scenarios, the data owner and the distillation provider are different parties, making it difficult to ensure that protection mechanisms are incorporated during distillation. In addition, the distillation pipeline itself is often proprietary and inaccessible to the copyright owner. Therefore, we assume that no information about the raw dataset, the DD method, or the downstream training configuration is available, and the protection mechanism must be designed without relying on any of these components. This assumption

1) We study a novel post-distillation, asymmetric copyright protection setting, where the defender only has access to the released distilled dataset, without any knowledge of the raw data, distillation process, or downstream training pipeline. 2) We propose SubPopMark, the first harmless and traceable protection framework for distilled datasets, which embeds CVM and USTM to enable both copyright verification and fine-grained data leakage tracing. 3) We leverage subpopulation-induced representation bias and introduce a behavior signature retrieval, enabling downstream-agnostic copyright verification and reliable data leakage tracing without introducing backdoor or adversarial behaviors.

privacy, which perturbs data or outputs with carefully calibrated noise to ensure that individual samples cannot be reliably distinguished, thereby protecting membership information [25]. These conventional approaches often struggle to balance accessibility with protection in the context of publicly shared resources. To enable protection for open datasets, Backdoor Watermarkbased Dataset Ownership Verification (BW-DOV) [26], [27] has emerged as an effective paradigm. The key idea is to embed specially designed watermark patterns into the training data, such that models trained on the protected dataset implicitly learn corresponding backdoor behaviors. Copyright can then be verified by probing suspicious models and checking for the presence of these abnormal responses. A representative work, DVBW [26], is the first to introduce backdoor watermarking at the dataset level and validate ownership through backdoortriggered behaviors. More recently, backdoor-based attacks on dataset distillation have also been proposed [11], [13]. While these methods can be adapted for copyright protection, these methods typically rely on modifying target labels or inducing misclassification behaviors, which leads to unstable predictions and introduces potential adversarial vulnerabilities.

II. R ELATED W ORK A. Dataset Distillation

DD aims to compress a large-scale dataset Draw into a smaller synthetic dataset Dsyn (|Draw | ≪ Dsyn ), with models trained on the two datasets achieving comparable performance [12], [13]. For example, Wang et al. [12] formulated DD as a bilevel meta-learning framework, and optimized the synthetic III. T HREAT M ODEL dataset such that models trained on it achieve comparable performance on the raw dataset. Building upon this foundation, We consider a practical post-distillation copyright protection subsequent studies have focused on improving efficiency and and leakage tracing scenario. This setting is motivated by two scalability [14], [15]. Moreover, Zhao et al. [16] introduced key factors. First, DD is computationally expensive, making it gradient matching to minimize the discrepancy between the impractical to re-run the distillation procedure or re-distill the gradients of models trained on distilled data and those trained dataset for protection purposes. Second, the data owner and the on real data. Then, this method was extended to distribution distillation provider are different parties, making it difficult for matching to further improve efficiency [9]. In addition to the defender to ensure that the protection mechanism is properly gradient matching and distribution matching, several other incorporated during distillation. In addition, the distillation lines of DD methods have been proposed. For example, pipeline itself is often proprietary intellectual property and Differentiable Siamese Augmentation (DSA) [17] improves therefore inaccessible to the copyright owner. For clarity in the data diversity through differentiable augmentation, while patchfollowing discussion, we refer to the defender as the copyright based image and soft label reconstruction enrich the representaowner of the distilled dataset who seeks to protect its copyright tion capacity of synthetic samples [8]. More recently, trajectoryand trace potential data leakage. level alignment methods have been explored. The core idea of trajectory matching is to match the evolution trajectories of Adversary. The adversary can obtain the distilled dataset the model parameters during the training process [18]. Specif- through unauthorized redistribution, and subsequently use it ically, Cazenavette et al. [19] proposed Matching Training to train their own models or further distribute the dataset Trajectories (MTT), which aligns the optimization trajectories to other parties without authorization. The adversary has full of models trained on real and synthetic data and achieves control over the adversary-side model, including its architecture, similar performance. TESLA [20] further improves MTT by parameters, and training configurations. significantly reducing computational consumption, making it a Defender Capability. The defender aims to enable reliable copyright verification and accurate leakage tracing over remore memory-efficient variant. leased distilled datasets in a strictly constrained and partially B. Dataset Copyright Protection observable setting. Overall, the defender operates under the Traditional data protection techniques are primarily designed following constraints: for safeguarding private data rather than openly shared or Restricted-Access. The defender operates in a restricted-access publicly distributed datasets, and most of these methods require asymmetric setting, where there is no access to the upstream direct access to the raw dataset. These approaches can be dataset or distillation process, nor any visibility into the broadly categorized into three types. Digital watermarking, downstream training pipeline or internal parameters of models which incorporates distinguishable ownership patterns into trained on potentially leaked data. data to enable later identification of the data owner [21], [22]. Defender Goal. The defender aims to establish effective Encryption, which enforces access control by encoding data and copyright protection mechanisms for released distilled datasets, incorporating a key-based mechanism [23], [24]. Differential enabling both reliable copyright verification and precise leakage

tracing. Overall, the defender is required to achieve the following objectives: Copyright Verification. Determine whether a suspicious model has been trained on the protected distilled dataset, without requiring access to model parameters or training details, and under the assumption that only query-based interactions with the model are available. Leakage Tracing. Identify the specific authorized user responsible for unauthorized dataset redistribution when infringement is detected, by distinguishing user-specific test set variants and attributing the observed model behavior to the corresponding data source. Benign Design. Ensure that the protection mechanism does not rely on any adversarial or malicious behaviors, and achieves verification and tracing solely through the benign behavior signatures. Challenges. We summarize two key challenges in designing effective post-distillation copyright protection and leakage tracing mechanisms. (i) The Gap between the distilled data and the real data. Unlike raw datasets, distilled datasets are highly compressed and distributionally abstract representations, which discard instancelevel correspondence and fine-grained statistical structure. As a result, the defender cannot rely on explicit sample-level markers or reconstruction-based cues, making it difficult to embed reliable and verifiable ownership signals without altering the learning objective or degrading data utility. (ii) Robust Attribution under Asymmetric and Dynamic Training Environments. Beyond the asymmetric access constraint, the attribution signal must remain reliable in dynamic training environments. The protection mechanism is not allowed to rely on explicit supervision or trigger-based injections (e.g., backdoors)to preserve benignness and dataset utility. Therefore, the key challenge is to embed an implicit yet robust datasetlevel structure that consistently induces distinguishable model behaviors across diverse training conditions while remaining imperceptible and non-invasive.

Then, the protected distilled data distribution can be formulated as follows: Dmark = (Dsyn \ S) ∪ DM , DM = {(M(x̃), ỹ) | (x̃, ỹ) ∈ S} , (1)

where |S| = α|Dsyn |. α is the sampling probability, and S denotes the manipulation subset. Then, we define that the reference model θR and the infringing model θI are trained on Dsyn and Dmark , respectively. B. Information Theory Analysis Consider a model θ trained using the cross-entropy loss: L(θ) = E(x̃,ỹ)∼Dsyn [− log θ(x̃)ỹ ],

(2)

where θỹ (x̃) denotes the predicted probability for class ỹ. Under sufficient model capacity and training convergence, the learned classifier approximates the true posterior distribution [28], [29]: θ⋆ (x̃) ≈ P (ỹ | x̃),

(3)

where θ⋆ denotes the theoretically optimal model. P denotes the real data distribution. For our reference and infringing models, we have θR (x̃) ≈ Psyn (ỹ | x̃) and θI (x̃) ≈ Pmark (ỹ | x̃), where Psyn and Pmark denote the original distilled dataset and the protected distilled dataset distributions, respectively. θR (x̃) and θI (x̃) denote the output probability vectors of θR and θI , respectively. Then, we define the model prediction confidence using the maximum softmax probability: mR (x̃) = max θR (x̃)k ≈ Psyn (k | x̃),

(4)

mI (x̃) = max θI (x̃)k ≈ Pmark (k | x̃),

(5)

where mR (x̃) and mI (x̃) denote the confidence scores of the reference and infringing models, respectively, reflecting the model predictions induced by their respective training data distributions. Specifically, θR (x̃)k (or θI (x̃)k ) denotes the predicted probability that the input x̃ belongs to class k. C. Distribution-Induced Behavioral Bias

IV. T HEORY A NALYSIS

For samples (x, y) ∼ T , where T denotes the test data distribution, due to the objectives and properties of the distilled dataset. As discussed earlier, the posterior distribution of θI is governed by Dmark . Since subpopulation markers preserve semantic labels and the injection ratio α is small, the posterior satisfies: Pmark (y | x) ≈ Psyn (y | x), (6)

The core principle of our framework is that neural networks naturally assign higher confidence to inputs that follow their training data distribution, and lower confidence to inputs that lie outside that distribution [28]. In other words, the model exhibits a consistent behavioral signature toward inputs aligned with its training distribution. This behavior is not manually designed, but emerges naturally from empirical risk minimization using cross-entropy in training. In this section, we present a theoretical analysis to support our method.

which implies: mI (x) ≈ mR (x).

(7)

In contrast, for the sample (x, y) ∼ TM , where TM denotes the distribution obtained by applying transformation M to samples from distribution T , the infringing model has learned the bias introduced by M during training, whereas the reference model has not. As a result, the infringing model better aligns with DM , leading to:

A. Definition Let Dsyn = {(x̃, ỹ)} denote the distilled dataset, where x̃ is the distilled image and ỹ is the corresponding class label. Let M denote a subpopulation transformation operator. We define DM as the transformed distribution induced by applying M to samples from Dsyn , i.e., (M(x̃), ỹ) ∼ DM for (x̃, ỹ) ∼ Dsyn .

Pmark (y | x) = (Psyn (y | x) \ PS (y | x)) ∪ PM (y | x),

(8)

(a) Overview of the SubPopMark Framework Data Split

Original Distilled Data

(d) Behavior Signature Retrieval Strategy

User-Specific Tracing Marker Optimization Stage Alternating

Alternating

CVM

Manipulation Subset

USTM

Surrogate model

𝛿1

CVM 𝓛𝒕𝒂𝒔𝒌

𝓛𝒕𝒂𝒔𝒌

Surrogate Model

Protected Distilled Data

USTM

Surrogate Model

User #1 to #J

(b) Copyright Verification Marker Optimization Stage CVM Init

USTM Init USTM

𝓛𝒕𝒂𝒔𝒌

Reference Behavior Bank

𝓛𝒕𝒂𝒔𝒌

Surrogate Model

𝓛𝒔𝒆𝒎

𝛿2 Alternating

MSE SSIM Original

CVM

Protected

𝓛𝒔𝒆𝒎

𝓛𝒑𝒆𝒓

USTM

Clip

Suspicious Model Behavior Signature

𝓛𝒔𝒊𝒎

𝓛𝒔𝒊𝒎 𝓛𝒑𝒆𝒓

Infringing Reference reference behavior Modelbank Model Behavior Signature Behavior Signature

…

𝓛𝒑𝒆𝒓

Alternating

𝛿𝐾 𝛿𝑘 ∼ N(0, 𝜎 2 )

CVM USTM

CVM

Utility Subset

Marker-Driven Test Set Construction

𝓛𝒑𝒆𝒓

USTM

𝓛𝒔𝒆𝒎

Behavior retrieval Infringing Model

Data Leakage Tracing

CVM

Behavior retrieval

Clip Infriging Model

User Secret Key

Behavior Signature

User #j

Fig. 2: The overview of our proposed method. where PM and PM denote the manipulation subset and In this paper, we investigate how to verify whether a deployed transformed distributions. Since the transformed samples follow model is trained on unauthorized distilled datasets, while further a consistent subpopulation structure introduced during training, supporting user-level data leakage tracing. We construct a the infringing model assigns a higher posterior probability to protected dataset DCVM based on Dsyn . Given a suspicious the correct label compared to the reference model. Therefore, model θs , our goal is to determine whether it has been trained we expect: on DCVM . We construct a verification test set Tveri based on a Pmark (y | x) > Psyn (y | x). (9) standard test set Tstand to expose behavioral biases induced by DCVM , which can be formulated as: Consequently, the confidence satisfies: R(θCVM , Tveri ) ≫ R(θsyn , Tveri ), (12) mI (x) > mR (x).

(10)

where θCVM and θsyn denote models trained on DCVM and Dsyn . R(θ, T ) denotes the classification accuracy achieved by the model θ on the test set T , which can be defined as: R(θ, T ) = E(x,y)∼T I arg max θ(x)k = y , (13)

As proved above, we can obtain that the samples form the raw test data distribution, the confidence of the reference model and the infringing model are essentially consistent. Conversely, for inputs with the SubPopMark, the infringing model yields a significantly higher confidence than the reference model. This confirms a clear confidence separation between the models, demonstrating the inherent sensitivity of neural networks to different subpopulation distributions. Specifically, a network tends to assign higher confidence to samples that align with its training distribution, while yielding lower confidence on unseen or distribution-shifted samples.

We define the copyright verification performance gap as: G(θ) = R(θ, Tstand ) − R(θ, Tveri ),

where G(·) measures the discrepancy between the performance on the standard and verificiation test sets. The verification decision is then formulated as a hypothesis test:

V. P ROPOSED M ETHOD

(

A. Problem Formulation

V(θs ) =

As mentioned earlier, DD aims to extract knowledge from a large-scale dataset Draw and construct a much smaller synthetic dataset Dsyn (|Draw | ≫ |Dsyn |). The goal is that the downstream model θDsyn trained on Dsyn can achieve performance comparable to that of a model θDraw trained on Draw , when evaluated over the raw test data distribution T : E(x,y)∼T [ℓ(θDsyn (x), y)] ≃ E(x,y)∼T [ℓ(θDraw (x), y)],

(14)

1, if G(θs ) ≃ G(θCVM ) , 0, otherwise

(15)

where V(θs ) = 1 indicates that the suspicious model θs is identified as an infringing model. Except copyright verification, we further aim to trace the user responsible for the underlying data leakage. Specifically, we add the user-specific marker in DCVM to generate Dmark = j {Dmark }Jj=1 , where J is the number of users. Each dataset is constructed to preserve the same copyright verification capability as DCVM , while additionally enabling fine-grained data leakage tracing to individual users. Similar with the

(11)

where ℓ denotes the loss function between the prediction and the ground truth y.

j J previous step, we can construct {Ttrac }j=1 for each user. Then, we can get the user-specific leakage tracing performance gap: j

Ĝ (θ) = R(θ, Tstand ) − R(θ, Ttrac ).

Algorithm 1 Main steps of CVM optimization Require: Distilled dataset Dsyn , class number K, ratio α, learning rates ηθ , ηδ , a frozen feature encoder Φ Ensure: Optimized CVM parameters δ Initialize: 2 1: Initialize class-specific markers δ = {δk }K k=1 ∼ N (0, σ ) and surrogate model θ 2: Partition Dsyn into: 3: manipulation subset S with ratio α 4: utility subset B = Dsyn \ S 5: for epoch t = 1 to T do 6: Step 1: Update θ and fix δ 7: Construct transformed subset:

(16)

The estimated leaking user index ĵ is then obtained as: ĵ = arg maxj∈{1,...,J} |Ĝj (θI )|.

(17)

B. Overview of SubPopMark In this paper, we propose the SubPopMark framework, which manipulates the distilled dataset to induce a subpopulationspecific behavior bias in models trained on the protected distilled dataset, while preserving their performance compared to those trained on the original distilled dataset. Specifically, SubPopMark consists of two stages, including the Copyright Verification Marker (CVM) optimization stage and User-Specific Tracing Marker (USTM) optimization stage, and the overview of our proposed method is illustrated in Figure 2. In the first stage, we optimize a CVM integrated into the distilled dataset to induce a class-consistent subpopulation bias while preserving the original optimization trajectory. This produces a protected dataset that enables trained models to exhibit identifiable subpopulation-aware behaviors without sacrificing utility. In the second stage, we further learn a USTM to introduce user-specific subpopulation perturbations, allowing downstream models to encode tracable behavioral signatures. During inference, we extract the behavior signature of a target model using both standard and subpopulation-shifted test sets, and match it against a reference behavior bank for infringement verification and data leakage tracing.

t SCVM = {(x̃ + δỹt−1 , ỹ) | (x̃, ỹ) ∈ S} t Compute Ltask (B ∪ SCVM ; θt−1 ) ▷ Based on Eq. (18) t t t 9: Update θ: θ ← θ − ηθ ∇θ Ltask (B ∪ SCVM ; θt−1 ) 10: Step 2: Update δ and fix θ 11: Compute Lsem (S; δ t−1 ) ▷ Based on Eq. (19) 12: Compute Lper (S; δ t−1 ) ▷ Based on Eq. (20) 13: Compute LCVM (δ t−1 , θt ) ▷ Based on Eq. (21) 14: Update δ: δ t ← δ t−1 − ηδ ∇δ LCVM (δ t−1 , θt ) 15: end for

is applied only to samples in S, yielding the transformed subset SCVM = MCVM (S). The subset B remains unchanged. Then, both subsets are jointly used to optimize δ, where SCVM drives the learning of the verifiable biases, and B ensures that the optimization remains close to the original training trajectory, thereby preserving task performance. We first introduce a task loss to ensure that the model trained on the updated dataset remains consistent with the original task objective. The loss function can be formulated as:

C. Copyright Verification Marker Optimization

To enable copyright verification for a suspicious model, we introduce a CVM into the distilled dataset to construct a protected dataset, such that models trained on it acquire a verifiable behavior bias toward a subpopulation distribuLtask (B; θ) = E(x̃,ỹ)∼(B∪SCVM ) [− log θ(x̂)ŷ ] , (18) tion. Moreover, CVM is expected to preserve the original optimization trajectory, thereby ensuring that the resulting where θ(x̂)ŷ denotes the predicted probability for class ŷ given models maintain performance comparable to those trained on input x̂. Then, we introduce a regularization loss Lsem to balance the original distilled dataset. Specifically, the CVM is parameterized as a learnable task utility and subpopulation distinguishability for our CVM. Specifically, we formulate the loss as: set of class-specific markers δ = {δk }K k=1 , where K is the number of classes and δk matches the dimensionality Lsem (S; δ) = E − log pθ (ỹ | x̃ + δỹ ) + CosSim Φ(x̃), Φ(x̃ + δỹ ) , (x̃,ỹ)∼S δỹ ∼δ of the distilled sample and is initialized from a Gaussian (19) distribution N (0, 1). Then, the CVM-induced transformation where Φ denotes a frozen pretrained feature encoder [30]. is defined as MCVM (x̃, ỹ) = (x̃ + δỹ , ỹ), where (x̃, ỹ) denotes a sample x̃ from Dsyn with ỹ is the label, and δỹ is the The first term enforces label consistency between the original corresponding class-specific marker. Notably, the CVM-induced and perturbed samples to avoid introducing any malicious transformation is applied only to the input x̃, while leaving ỹ backdoors. The second term ensures that the subpopulation unchanged. This design ensures that only subpopulation-level introduced by CVM remains verifiable in the feature space, bias is introduced, as modifying labels may lead to unintended enabling reliable copyright verification. Finally, we further constrain the perturbation to be impermalicious behaviors. ceptible at the visual level, ensuring that the perturbed samples To achieve a balance between inducing a verifiable behavior remain visually consistent with the original distilled samples. bias and preserving the performance, we partition Dsyn into To achieve this, we introduce a perceptual loss as: two disjoint subsets. We construct a manipulation subset S by " # sampling each data in Dsyn with probability α, and define the 2 Lper (S; δ) = E ∥x̃ − (x̃ + δỹ )∥2 + 1 − MS-SSIM(x̃, x̃ + δỹ ) , (20) (x̃,ỹ)∼S utility subset as B = Dsyn \ S. Then, the CVM transformation δỹ ∼δ

where the first term penalizes pixel-level distortion to keep the perturbation small in the image space, and the second term enforces perceptual consistency via a multi-scale structural similarity (MS-SSIM) [31] metric that measures visual and structural similarity between images to preserve overall appearance. Finally, the overall loss to optimize CVM is defined as the combination of the losses introduced above: LCVM (δ, θ) = Lsem (S; δ) + Lper (S; δ).

its initialization. Due to the non-convexity of the objective, different initializations typically converge to different local minima or regions in the parameter space. Specifically, for each user j, we parameterize the userspecific tracing marker (USTM) as a set of class-dependent perturbations δ̂ j = {δ̂kj }K k=1 . The markers are generated from a pseudorandom process controlled by the user-specific key. Concretely, we compute a seed sj = H(W j ) from the user’s secret key W j , where H denotes the cryptographic SHA256 hash function [32], and generate each perturbation as δ̂kj = G(sj , k), where G outputs Gaussian-distributed vectors. The resulting transformation is applied on top of the CVMprocessed samples, i.e., Mju (x̃, ỹ) = (x̃ + δỹ + δ̂ỹj , ỹ), thereby constructing user-specific subpopulations while preserving the original label semantics. To optimize the USTM, we follow the same alternating training protocol as in CVM. Specifically, we first update the model parameters θ using the task loss on the user-specific dataset, ensuring that the model remains aligned with the original task objective. Then, with θ fixed, we update the userspecific markers δ̂ j by optimizing a combination of semantic and perceptual objectives, allowing the markers to adapt to the current model while maintaining distinguishability and visual imperceptibility. One consideration is to prevent user-specific markers from interfering with the shared CVM, as such interference could potentially affect the reliability of both copyright verification and data leakage tracing. To mitigate this, we introduce a feature similarity term in the feature space: h i Lsim (δ̂ j , δ) = Eδ̂j ∼δ̂j ,δk ∼δ CosSim Φ(δ̂kj ), Φ(δk ) . (22)

(21)

During optimization, we adopt an alternating training strategy to update the model parameters θ and the CVM parameters δ in an epoch-wise manner. Specifically, in each epoch, we first update θ by minimizing the task loss Ltask on the combined dataset B ∪ SCVM , which ensures that the model follows the original training trajectory and maintains performance consistency. In the subsequent epoch, we fix the updated θ and update the CVM δ by optimizing LCVM . This allows the CVM to adapt to the current state of the model while introducing the subpopulation representation bias and ensuring the visual imperceptibility. Such an alternating optimization strategy aligns the optimization of CVM with the training trajectory induced by the clean distilled dataset, ensuring that the optimization remains close to the original trajectory. Importantly, this procedure does not require any access to real images, as this process is entirely conducted on the synthetic dataset. Since our protection mechanism is applied directly to the distilled dataset, whose size is typically extremely compact, the overall protection overhead remains negligible. We provide further empirical analysis of the efficiency in Sec. VI-H. For clarity and reproducibility, we summarize the entire optimization procedure in Algorithm 1

This loss encourages user-specific markers to have low feature similarity with respect to the shared CVM among D. User-Specific Tracing Marker Optimization all users, aiming to keep their subpopulation biases without CVM can effectively enable copyright verification by in- causing strong interference. During optimization, this term troducing a behavioral bias toward a specific subpopulation. is jointly optimized with the semantic and perceptual losses However, since the same CVM is shared across all distributed when updating δ̂ j , while keeping the CVM training procedure protected datasets, the resulting behavioral bias is identical for unchanged. all users, making it incapable of tracing the specific source of data leakage. To further enable reliable user-level tracing, the E. Implementation j In our pipeline, the protected dataset Dmark is released to user key idea is to associate each authorized user with a unique perturbation pattern, such that models trained on different j as a replacement for the original distilled dataset Dsyn . Then, j user-specific datasets exhibit distinguishable signatures. To this each user trains their model on Dmark without awareness of the j end, we introduce a user-specific key for each user, which embedded markers. Then, each user trains their model on Dmark deterministically controls the generation of the corresponding without awareness of the embedded markers. During training, markers. This design ensures both uniqueness (different users the model naturally learns a bias toward the corresponding obtain different markers) and reproducibility (the same user subpopulation distribution induced by the injected marks. can regenerate the marker when needed in the limited time), In practice, users typically do not release model parameters which are essential for reliable tracing. and instead expose only inference APIs. Therefore, our verifiThe distinguishability of user-specific markers is primarily cation setting is inherently asymmetric, and we can only access induced by their different initializations, which lead to divergent model predictions. Moreover, our method aims to characterize optimization trajectories. Specifically, each user-specific marker the model’s behavioral preference induced by the injected δ̂ j is initialized from an independent key-controlled random pro- perturbations, rather than detecting instance-level anomalies. cess, resulting in different initial directions in the perturbation To this end, we adopt a batch-based evaluation strategy, where a space. Under standard gradient-based optimization, the update set of query samples is used to probe the suspicious model and of δ̂ j can be viewed as following a trajectory conditioned on estimate its preference over specific subpopulation distributions.

��

(a) CIFAR10, IPC=10

��

(b) CIFAR10, IPC=50

��

(d) CIFAR100, IPC=10

(e) SVHN, IPC=50

Fig. 3: Performance analysis of SubPopMark across diverse datasets and IPC settings using the DC distillation method. All experimental results are averaged over 10 independent trials, with the shaded regions representing the variance. where θ⋆ denotes the suspicious model under verification, θa denotes the a-th model in the behavior bank P, and a⋆ is the index of the most similar reference model. Accordingly, ẑ ⋆ is the inferred provenance label assigned to the suspicious model based on its nearest neighbor. Here, d(·, ·) is a distance metric, where we use cosine similarity. Since different model architectures and training protocols can lead to substantial variations in parameter-level representations, direct comparison at the parameter space becomes unreliable. However, despite these differences, models trained under the same objective with the same dataset tend to learn similar underlying knowledge, which is reflected in their output behaviors. Motivated by this observation, our approach operates in the behavior space, effectively bypassing the instability of parameter-level comparisons. Moreover, this strategy naturally enables black-box verification, as it only requires access to model outputs. In addition, the reference behavior bank can be easily expanded by incorporating more models, thereby further improving robustness and providing strong scalability in practical deployments.

To facilitate such distribution-level evaluation, we construct multiple test sets that reflect the behaivor of the model to different underlying data distributions. Specifically, we define three types of test sets: a standard test set Tstand drawn from the raw test data distribution, a copyright verification test set Tveri constructed using CVM, and a collection of user-specific j J tracing test sets Ttrac = {Ttrac }j=1 constructed using USTM. Under this setup, an infringing model (i.e., a model trained j on the protected dataset Dmark ) develops a behavioral preference toward the corresponding marked subpopulation. As a result, compared with reference models (i.e., models trained on the original distilled dataset Dsyn ), infringing models exhibit systematically shifted responses on the marked test sets (i.e., j Tveri and Ttrac ), while maintaining comparable behavior on j the standard test set Tstand . Specifically, Tveri and Ttrac can be formulated as follows: Tveri = {(x + δy , y) | (x, y) ∈ Tstand },

(23)

j Ttrac = {(x + δ̂yj , y) | (x, y) ∈ Tveri }.

(24)

To enable practical verification under the black-box setting, we further introduce a behavior signature retrieval strategy that operates purely on model outputs, without requiring any access to model parameters or architectural details. Specifically, we first construct a reference behavior bank by querying a collection of models with known provenance (e.g., models j trained on Dsyn and Dmark ) over the predefined test sets. For j each model, we record its responses on Tstand , Tveri , and Ttrac , which can be formulated as: j s(θ) = R(θ, Tstand ), R(θ, Tveri ), R(θ, Ttrac ) , (25)

VI. E XPERIMENT A. Experimental Setting

Experiment Environment. Our proposed method is implemented using the PyTorch framework and optimized with Stochastic Gradient Descent (SGD) [33]. The experiments are conducted on a machine equipped with an AMD Ryzen 7 5800X CPU @3.80 GHz, 32 GB of RAM, and an NVIDIA GTX 3090 GPU. Experimental setup. We utilize ConvNet [34] to train the where s(·) denotes a function that summarizes model predic- markers. We adpot the ConvNet and AlexNet [35] as the tions. Then, we can construct a set of behavior signatures of the default selection of constructing the reference behavior bank. preference of different models over different data distributions. The user-side models are adopted with ConvNet, AlexNet, VGG11 [36], ResNet18 [37], and ResNet34 [37]. This process can be formulated as: DD Methods. To evaluate the robustness of the proposed A P = {(s(θa ), za )}a=1 , (26) method, we conduct experiments under multiple DD methods, where A denotes the length of the reference behavior bank and including DC [16], DM [9], DSA [17], DATM [38], and za indicates whether the model is an infringing model and the MTT [19]. Datasets. To comprehensively evaluate the robustness of corresponding user identity. We then perform behavior-based retrieval by matching the the proposed method across varied data distributions, we conduct extensive experiments on multiple standard benchtarget signature against the reference behavior bank: mark datasets, including CIFAR-10 [39], CIFAR-100 [39], a⋆ = arg min d s(θ⋆ ), s(θa ) , ẑ ⋆ = za⋆ , (27) FashionMNIST [40], and SVHN [41]. a

AlexNet

(a) CIFAR10, IPC10

(b) CIFAR10, IPC50

VGG11

ResNet34

ResNet18

(d) CIFAR100, IPC10

(e) SVHN, IPC50

Fig. 4: Performance analysis of SubPopMark across diverse datasets and IPC settings using the DC distillation method across different user-side models. Solid lines with circles represent epoch 50, dashed lines with squares represent epoch 100. AlexNet

VGG11

ResNet18

ResNet34

MTT

DSA

DATM

ConvNet

(Epoch=50)

(Epoch=100)

(Epoch=50)

(Epoch=100)

Fig. 5: Stable reference values of copyright verification performance gaps for reference and infringing models across various architectures and datasets of different DD methods. Metrics. To comprehensively evaluate the behaivor of the specific tracing test set Ttrac , and the corresponding tracing model to different underlying data distributions, we design test accuracy (TTA) is defined as T T A = R(θ, Ttrac ), which different evaluation metrics: captures the model performance under the tracing distribution. Performance on the Standard Test Set. We evaluate the model Then, to better characterize the behavioral shifts induced by on the standard test set Tstand , drawn from the raw test data the protected data, we define two performance gap metrics: distribution, and compute the standard test accuracy (STA) Copyright Verification Performance Gap: G(θ) = as ST A = R(θ, Tstand ). This metric reflects the model’s R(θ, Tstand ) − R(θ, Tveri ), which measures the performance performance in the absence of distribution shift. drop from the real distribution to the verification distribution, Performance on the Copyright Verification Test Set. We further reflecting the model’s sensitivity to CVM-induced distribution evaluate the model on the copyright verification test set Tveri shifts. constructed via CVM. The verification test accuracy (VTA) on Data Leakage Tracing Performance Gap: Ĝ(θ) = this set is defined as V T A = R(θ, Tveri ). This metric measures R(θ, Tstand ) − R(θ, Ttrac ), which captures the performance the model behavior under the verification distribution. difference between the real distribution and the user-specific Performance on the Data Leakage Tracing Test Set. To tracing distribution, indicating the model’s preference toward assess tracing capability, we evaluate the model on the user- a particular user-induced subpopulation.

TABLE I: CVSR (%) of our method across different DD methods, network architectures, and distilled datasets. DD method

Dataset

IPC 10

CIFAR10 50 CIFAR100 DC

10 10

FashionMNIST 50 10 SVHN 50 DM

CIFAR10

50 10

CIFAR10 50 CIFAR100 DSA

10 10

FashionMNIST 50 10 SVHN 50 10 CIFAR10

50 500

DTAM 10 CIFAR100

50 100 10

CIFAR10 50 MTT 10 CIFAR100 50

Arch Epoch 50 100 50 100 50 100 50 100 50 100 50 100 50 100 50 100 50 100 50 100 50 100 50 100 50 100 50 100 50 100 50 100 50 100 50 100 50 100 50 100 50 100 50 100 50 100 50 100 50 100

TABLE II: DLTSR (%) of the different DD methods across different network architectures and distilled datasets. DD method

ConvNet 85.00 83.00 98.00 98.00 98.50 98.50 100.00 97.00 99.00 100.00 77.00 84.00 96.00 94.00 99.00 99.00 94.00 96.00 97.50 94.50 99.50 100.00 78.00 78.50 97.00 99.50 87.00 88.00 100.00 100.00 95.50 86.50 71.00 69.00 83.00 79.00 100.00 100.00 100.00 100.00 100.00 100.00 79.50 83.50 69.00 64.50 85.00 84.50 97.50 95.50

AlexNet 49.00 67.00 78.00 76.00 98.00 98.00 54.00 52.00 95.00 99.00 64.00 65.00 50.00 58.00 99.00 97.00 52.00 54.00 90.00 94.00 100.00 100.00 59.00 60.00 90.00 94.00 71.00 83.00 92.00 92.00 54.00 80.00 62.00 72.00 69.00 70.00 99.00 99.00 100.00 100.00 99.00 100.00 68.00 65.00 52.00 53.00 83.00 83.00 99.00 98.00

VGG11 76.00 81.00 77.00 75.00 89.00 91.00 51.00 52.00 64.00 65.00 93.00 75.00 81.00 82.00 89.00 88.00 74.00 72.00 88.00 86.00 90.00 90.00 53.00 51.00 53.00 54.00 89.00 90.00 96.00 98.00 74.00 94.00 86.00 82.00 67.00 69.00 100.00 100.00 100.00 100.00 92.00 94.00 75.00 78.00 53.00 58.00 63.00 66.00 95.00 95.00

ResNet18 71.00 79.00 60.00 67.00 96.00 94.00 61.00 57.00 50.00 50.00 54.00 86.00 60.00 62.00 81.00 85.00 89.00 89.00 99.00 99.00 100.00 94.00 70.00 66.00 50.00 50.00 50.00 82.00 100.00 100.00 28.00 64.00 80.00 74.00 52.00 52.00 100.00 99.00 100.00 100.00 97.00 95.00 77.00 72.00 56.00 62.00 76.00 75.00 95.00 94.00

76.00 88.00 59.00 56.00 93.00 89.00 63.00 59.00 50.00 51.00 60.00 78.00 72.00 71.00 80.00 76.00 71.00 73.00 91.00 89.00 90.00 90.00 61.00 59.00 50.00 50.00 81.00 96.00 98.00 98.00 67.00 95.00 67.00 71.00 56.00 60.00 99.00 99.00 100.00 100.00 100.00 97.00 56.00 64.00 56.00 56.00 67.00 74.00 93.00 93.00

CIFAR10 50 CIFAR100 DC

M 1 X I ĵ ⋆ = jm , M m=1

10 50 10 SVHN 50

CIFAR10

50 10

CIFAR10 50 CIFAR100 DSA

10 10

FashionMNIST 50 10 SVHN 50 10 CIFAR10

50 500

DTAM 10 CIFAR100

50 100 10

CIFAR10 50 MTT 10 CIFAR100 50

Arch Epoch 50 100 50 100 50 100 50 100 50 100 50 100 50 100 50 100 50 100 50 100 50 100 50 100 50 100 50 100 50 100 50 100 50 100 50 100 50 100 50 100 50 100 50 100 50 100 50 100 50 100

ConvNet

AlexNet

VGG11

ResNet18

ResNet34

32.00 38.00 82.00 92.00 100.00 100.00 76.00 82.00 51.00 82.00 64.00 74.00 66.00 77.00 93.00 92.00 89.00 89.00 93.00 94.00 100.00 100.00 56.00 70.00 47.00 61.00 85.00 75.00 42.00 57.00 55.00 53.00 46.00 46.00 50.00 50.00 100.00 100.00 100.00 100.00 100.00 100.00 83.00 75.00 47.00 57.00 100.00 100.00 100.00 100.00

9.00 13.00 34.00 35.00 100.00 100.00 41.00 45.00 40.00 45.00 45.00 55.00 69.00 76.00 79.00 84.00 40.00 60.00 90.00 91.00 98.00 100.00 24.00 39.00 20.00 30.00 45.00 68.00 47.00 42.00 18.00 40.00 23.00 35.00 35.00 39.00 100.00 100.00 100.00 100.00 100.00 100.00 33.00 26.00 38.00 42.00 97.00 97.00 100.00 96.00

65.00 60.00 65.00 60.00 100.00 100.00 70.00 73.00 70.00 73.00 36.00 45.00 74.00 78.00 90.00 94.00 52.00 49.00 98.00 96.00 100.00 100.00 51.00 54.00 60.00 59.00 75.00 73.00 65.00 62.00 71.00 66.00 31.00 38.00 46.00 39.00 100.00 100.00 100.00 100.00 100.00 100.00 63.00 64.00 56.00 63.00 97.00 100.00 100.00 100.00

47.00 43.00 69.00 57.00 100.00 100.00 88.00 90.00 88.00 90.00 83.00 84.00 99.00 99.00 94.00 94.00 88.00 88.00 98.00 95.00 100.00 100.00 87.00 89.00 78.00 75.00 97.00 97.00 64.00 67.00 78.00 86.00 45.00 46.00 47.00 47.00 100.00 100.00 100.00 100.00 100.00 100.00 81.00 83.00 62.00 61.00 100.00 100.00 100.00 100.00

37.00 30.00 37.00 30.00 99.00 100.00 70.00 85.00 70.00 85.00 41.00 54.00 79.00 77.00 50.00 60.00 53.00 46.00 83.00 83.00 98.00 100.00 56.00 62.00 70.00 58.00 60.00 70.00 51.00 51.00 65.00 60.00 37.00 38.00 42.00 40.00 100.00 100.00 100.00 100.00 100.00 100.00 54.00 50.00 43.00 43.00 87.00 91.00 96.00 100.00

biases toward specific subpopulations. While our theoretical analysis in Sec. IV establishes the emergence of such biases, we further conduct a preliminary empirical study to examine whether they consistently manifest across different models in the DD setting. Specifically, we first apply our method to protect distilled datasets generated by DC, spanning multiple datasets and diverse distillation settings. To account for variations in downstream training strategies, we further evaluate model performance under different training epochs. The results are shown in Fig. 3, we can observe that the STA of the reference model (ST AR ) remains consistently similar to that of the infringing model (ST AI ) across all training epochs. It indicates that the introduction of our markers neither causes noticeable performance degradation for the standard test samples, which represents that our method can effectively preserve the knowledge of the distilled dataset. Besides, we observe a noticeable performance gap on V T A and T T A between the reference model (V T AR , T T AR ) and the infringing model (V T AI , T T AI ). This indicates that our method successfully induces a distribution-specific behavioral bias, which selectively affects the protected subpopulation while preserving performance on standard data. Meanwhile, the performance of the reference model remains consistent across ST A, V T A, and T T A, suggesting that our method does not introduce any unintended or malicious behavior into the reference model, and that the observed bias is exclusively induced in the infringing models.

(28)

⋆ where ẑm is obtained via our behavior signature retrieval strategy as defined in Eq. (27), M denotes the total number of evaluated models, and zm is the ground-truth label. Data Leakage Tracing Success Rate (DLTSR): We propose DLTSR to evaluate the effectiveness of our method on the data leakage tracing task. Each behavior signature s(θa ) in the reference behavior bank P = {(s(θa ), za )}A a=1 is associated with a provenance label za , which implicitly encodes the user identity j. Therefore, the ẑ ⋆ obtained from Eq. (27) can be mapped to a predicted user index ĵ ⋆ .

DLTSR =

FashionMNIST

1 X ⋆ I ẑm = zm , M m=1

IPC 10

We further quantify the verification and tracing performance using two metrics: Copyright Verification Success Rate (CVSR): We propose CVSR to evaluate the effectiveness of our method on the copyright verification task. CVSR =

Dataset

ResNet34

(29)

where jm is the corresponding ground-truth label and M represents the total number of evaluated models. B. Behavioral Analysis The core fundation of our method is that models trained on different data distributions exhibit distinguishable behavioral

TABLE III: Cross-user leakage tracing on CIFAR-10 (DC, IPC=50). Each entry reports the tracing gap Ĝi (θIj ) (Avg ± STD, %). Diagonal entries (i = j) indicate correct user attribution, while off-diagonal entries (i ̸= j) represent cross-user responses. Ttrac Epoch

1 Ttrac

2 Ttrac

3 Ttrac

4 Ttrac

5 Ttrac

6 Ttrac

7 Ttrac

8 Ttrac

9 Ttrac

10 Ttrac

θI1

50 100

31.64±1.43 31.68±1.19

18.48±1.32 18.60±1.49

13.52±0.95 13.60±1.27

18.52±1.57 19.16±1.30

20.48±1.68 20.12±1.49

14.72±1.06 16.52±1.30

20.56±0.70 20.16±0.96

20.08±3.59 20.44±1.04

14.60±0.83 13.20±1.65

18.44±2.31 16.84±1.64

θI2

50 100

19.89±1.05 20.52±1.71

30.26±1.40 31.16±0.75

14.48±1.32 12.16±0.69

16.64±1.91 17.00±1.25

19.48±1.55 20.48±1.16

16.36±1.02 17.00±1.43

20.24±1.22 21.56±1.30

22.60±0.87 21.44±1.68

13.00±1.26 12.80±0.64

17.64±1.27 17.00±1.52

θI3

50 100

14.96±0.34 13.08±1.86

14.80±1.04 12.84±2.03

43.52±1.61 43.36±1.49

14.48±0.77 14.76±0.54

13.84±0.37 12.40±1.76

16.32±0.86 16.84±0.57

12.04±0.60 12.60±1.28

15.84±0.48 15.24±1.23

14.36±0.97 13.76±1.85

10.20±0.94 10.04±0.50

θI4

50 100

17.68±1.57 17.88±1.03

17.57±0.97 16.72±0.86

15.92±0.89 14.80±0.81

27.20±1.56 26.68±1.76

18.24±1.18 17.12±1.24

16.28±1.09 16.60±0.94

18.04±1.21 17.96±1.90

18.68±0.95 18.04±0.60

11.28±0.94 10.92±0.59

18.08±0.80 15.88±0.43

θI5

50 100

15.28±1.38 16.36±0.79

17.00±2.32 14.80±1.57

9.12±2.19 9.04±0.82

15.08±0.64 15.88±1.16

27.60±2.33 29.12±1.20

14.88±1.43 14.36±0.69

17.80±2.24 18.20±2.19

19.28±0.79 18.52±1.14

12.88±0.99 12.08±1.28

15.60±1.09 15.80±1.88

θI6

50 100

9.00±0.95 10.20±1.57

11.00±1.73 10.84±1.50

7.00±0.73 7.40±2.04

9.20±0.90 11.28±1.25

11.16±0.65 11.60±0.77

28.32±1.27 28.80±0.46

10.56±0.86 9.64±1.11

11.64±0.41 12.80±1.37

11.16±0.87 12.24±1.70

6.32±2.10 5.08±2.42

θI7

50 100

19.68±0.93 20.72±0.63

21.92±1.34 22.44±1.11

8.56±2.45 9.12±1.84

16.76±0.56 18.12±0.74

19.52±0.93 21.48±1.15

15.36±0.94 14.36±1.75

33.00±1.54 35.48±0.84

21.05±1.08 21.48±0.92

16.16±1.15 15.92±0.73

15.20±0.77 15.76±1.01

θI8

50 100

22.16±0.59 21.08±0.63

19.80±1.56 20.44±1.43

13.88±0.39 14.20±1.05

17.68±1.02 17.28±0.57

22.08±0.41 20.64±0.91

17.04±1.20 16.44±0.80

22.20±1.27 22.32±1.22

32.00±0.89 31.20±0.70

15.88±0.93 15.28±0.74

20.68±1.20 19.28±1.09

θI9

50 100

7.36±0.41 7.88±1.86

8.24±1.39 8.40±1.79

10.56±1.85 8.76±0.67

7.16±0.85 8.60±1.94

12.24±2.33 12.08±1.00

13.80±1.25 13.08±1.73

11.00±1.76 12.60±2.42

11.48±2.01 11.92±2.42

21.68±0.93 22.24±0.65

8.60±2.14 8.48±1.47

θI10

50 100

14.76±0.74 13.48±0.68

16.92±1.26 14.64±1.53

9.28±1.68 9.88±1.83

13.12±0.47 12.08±1.25

15.92±1.07 16.04±1.71

14.96±0.93 13.56±1.13

14.60±0.67 14.16±1.18

18.92±1.02 17.12±1.38

9.28±0.97 9.36±1.80

35.28±1.35 34.20±1.25

C. Copyright Verification Experiment Building upon the observed behavioral differences between reference and infringing models, we further investigate whether such differences can be effectively exploited for copyright verification. Specifically, while the previous analysis demonstrates the existence of a systematic performance gap induced by the proposed marker, in this section we evaluate whether this gap can serve as a reliable and robust signal for identifying whether a model has been trained on the protected dataset. In this section, we conduct comprehensive experiments across different DD methods and downstream architectures to validate the effectiveness of our copyright verification mechanism. The results in Tab. I show that our method achieves consistently high CVSR across a wide range of DD methods, datasets, and downstream architectures. Notably, the verification performance remains generally stable under cross-architecture settings, indicating that the induced prediction bias is largely transferable across different models. Moreover, the method generalizes well across different IPC configurations, with CVSR reaching a high level (e.g., above 80%) in most cases. These

CIFAR100, IPC10 FashionMNIST, IPC50

Moreover, we evaluate our method across different downstream models, and the results are shown in Fig. 4. Consistent trends can be observed across all models: the performance gap between V T A and T T A remains significant, while the results on ST A are relatively stable across all settings. Moreover, we illustrate the copyright verification performance gap between the reference model G(θR ) and the infringing model G(θI ) across different DD methods and downstream architectures, as shown in Fig. 5. It can be observed that the values of G(θI ) are mostly below zero, indicating that the infringing models exhibit higher accuracy on the marked data. In contrast, the reference models yield values close to zero, suggesting that they do not exhibit any bias toward the marked samples. This demonstrates that models trained on datasets containing our marker are selectively influenced by the injected subpopulation structure.

CIFAR10, IPC50

Infringing Models

Fig. 6: Comparison of prediction distributions between infringing and reference models. results suggest that the proposed marker provides a robust and reliable prediction bias for copyright verification in the post-distillation setting. D. Data Leakage Tracing Experiment Building upon the successful verification of infringing models via CVM, we further investigate whether our method can attribute the source of data leakage to specific users, which aims to answer a more challenging question: which authorized user is responsible for the unauthorized redistribution. To this end, we evaluate the effectiveness of the proposed USTM in inducing a user-specific subpopulation behavior bias. The results are shown in Tab. II. Overall, our method achieves effective data leakage tracing performance across diverse DD methods, datasets, and downstream architectures. These results suggest that the proposed method provides a practical and

TABLE IV: Ablation study about different losses. Dataset

Method

PSNR (dB) ↑

SSIM ↑

CVSR (%) ↑

CIFAR10 IPC=10

w/o Lper w/o Lsem Ours

10.60 70.69 65.81

0.57 0.99 0.99

99.00 57.00 85.00

CIFAR10 IPC=50

w/o Lper w/o Lsem Ours

8.29 69.88 59.26

0.41 0.99 0.99

98.00 60.00 98.00

CIFAR100 IPC=10

w/o Lper w/o Lsem Ours

9.65 63.70 54.22

0.36 0.99 0.99

100.00 66.00 98.50

FashionMNIST IPC=10

w/o Lper w/o Lsem Ours

9.35 70.84 65.10

0.61 0.99 0.99

98.00 67.00 100.00

FashionMNIST IPC=50

w/o Lper w/o Lsem Ours

7.80 68.20 61.40

0.45 0.99 0.99

99.00 48.00 99.00

SVHN IPC=10

w/o Lper w/o Lsem Ours

10.54 70.69 57.46

0.68 0.99 0.99

99.00 53.00 77.00

SVHN IPC=50

w/o Lper w/o Lsem Ours

8.02 66.21 59.90

0.45 0.99 0.99

98.00 57.00 96.00

(a) CIFAR10, IPC=50

(b) CIFAR100, IPC=10

Fig. 7: Visualization of the original and our protected distilled datasets. effective solution for user-level data leakage tracing in the post-distillation setting. The above experiments demonstrate that our method can effectively trace data leakage at the user level. However, in practical multi-user scenarios, a key challenge arises from the potential conflict between behavior biases induced by different USTM. To investigate this issue, we conduct a cross-user leakage tracing evaluation, where each infringing model is matched against all user-specific tracing sets, and the results are shown in Tab. III. It can be observed that, in most cases, the diagonal entries (i = j) consistently achieve higher scores than the off-diagonal entries (i ̸= j), indicating that models respond most strongly to the tracing patterns corresponding to their own subpopulation distribtuion, while exhibiting relatively low sensitivity to the subpopulation distributions associated with other users. This can be attributed to the key-conditioned design of USTM. Distinct keys lead to different initialization and optimization trajectories, resulting in diverse subpopulation distributions. Consequently, models learn different behavior biases, responding more strongly to their subpopulation distribution while remaining less sensitive to those of other users. Therefore, the proposed method supports accurate and stable user-level data leakage tracing even in multi-user settings. E. Ablation Study In this section, we evaluate the effectiveness of different components and hyperparameter choices. The results are shown in Tab. IV. It can be observed that our Lper effectively reduces the perturbation introduced to the distilled dataset, ensuring that the modified samples remain visually consistent with the original ones, as reflected by improved PSNR and SSIM values. In this section, we evaluate the effectiveness of different components and hyperparameter choices, with results reported in Tab. IV. We observe that removing Lper leads to the best CVSR performance, but at the cost of severely degraded visual quality, producing outputs that deviate significantly from the original appearance. In contrast, removing Lsem

tends to preserve visual fidelity, but the model fails to form representative subpopulations, limiting its effectiveness. By jointly incorporating both losses, we achieve a favorable balance between reconstruction quality and subpopulation construction. The results in Tab. V demonstrate the impact of different data selection ratios α on model behavior. It can be observed that as α increases, the performance on ST A consistently decreases across different datasets, indicating that stronger subpopulation perturbations introduce more pronounced shifts in standard classification behavior for infringing models. In contrast, the gap between V T A and T T A for the infringing and reference models becomes increasingly larger as α increases. This suggests that a larger selection ratio strengthens the induced subpopulation bias, thereby amplifying the behavioral discrepancy between reference and infringing models. F. Comparison of Prediction Behavior In this section, we further compare the prediction behavior between the reference and the infringing models. At first, we illustrate the distribution compariosn, and the results are shown in Fig. 6. It can be observed that the reference and infringing models exhibit similar behavior on Treal , while showing noticeable differences on the protected datasets Ttrac and Tveri . Moreover, the results in Tab. VI provide a statistical perspective on the behavioral differences between reference and infringing models. Specifically, on the standard test set Tstand , the K-S statistics remain consistently low with large p-values, indicating no significant distributional difference between the two models. This suggests that our method preserves the standard generalization performance and does not introduce noticeable bias on natural data. In contrast, on the verification and tracing test sets (Tveri and Ttrac ), we observe substantially larger K-S statistics accompanied by extremely small p-values (often close to zero), demonstrating statistically significant differences in prediction confidence distributions. This confirms

TABLE V: Accuracy with varying data selection ratio α of DC method(Avg ± STD, %). 0.1 Dataset

CIFAR10

CIFAR100

FashionMNIST

SVHN

IPC

0.2

TABLE VI: Statistical comparison of prediction confidence distributions via the Kolmogorov–Smirnov test, reporting the dstatistic and p-value between referrence and infringing models.

0.3

Epoch Metric ST AR ST AI V T AR V T AI T T AR T T AI

100

56.52±1.90 55.96±1.37 53.96±2.33 79.82±1.96 57.66±1.78 82.56±1.36

57.22±1.46 55.94±1.30 53.46±3.48 78.94±1.97 56.88±2.40 81.48±1.52

56.58±1.43 48.94±1.27 56.42±2.92 95.92±1.29 57.38±2.76 96.74±0.98

56.62±1.16 48.00±1.25 57.64±2.61 97.00±0.67 57.94±1.43 97.66±0.58

55.36±0.86 44.56±1.45 53.20±1.48 98.28±0.36 52.76±1.45 98.30±0.30

57.10±0.95 45.36±1.87 54.40±2.59 98.56±0.22 53.10±2.08 98.38±0.41

ST AR ST AI V T AR V T AI T T AR T T AI

24.40±0.55 23.94±0.43 20.89±0.94 33.91±1.07 22.26±0.63 45.85±0.79

24.16±0.37 24.32±0.47 20.43±1.11 34.13±1.08 21.77±0.99 46.12±0.94

24.41±0.40 21.37±0.38 23.40±0.79 49.65±0.86 16.35±1.10 89.95±0.61

24.02±0.43 21.85±0.37 22.65±0.55 50.43±0.82 15.77±0.76 90.59±1.06

24.25±0.47 20.73±0.52 19.79±0.97 69.32±0.94 19.22±1.03 76.39±0.99

24.37±0.32 20.88±0.43 19.91±1.14 69.77±1.69 19.24±1.28 76.82±1.69

ST AR ST AI V T AR V T AI T T AR T T AI

79.00±1.73 78.62±1.45 85.22±2.63 93.04±0.93 81.94±2.79 96.54±0.65

80.94±0.73 79.90±0.90 87.48±0.77 94.42±0.40 83.42±1.61 97.28±0.20

80.88±1.43 77.24±1.49 86.78±1.32 96.86±1.25 79.22±2.97 95.56±1.14

82.72±0.38 78.50±0.45 88.22±0.58 97.84±0.34 82.32±2.48 96.74±0.28

80.32±1.52 76.98±1.20 86.70±1.83 97.38±0.72 81.72±2.52 98.82±0.17

83.14±0.49 76.46±1.64 88.86±0.65 97.78±0.29 84.74±0.88 99.06±0.25

ST AR ST AI V T AR V T AI T T AR T T AI

81.34±0.61 80.70±0.45 78.00±0.98 77.48±1.32 76.04±1.88 93.30±0.60

81.78±0.62 81.04±0.45 77.48±1.32 90.74±0.54 75.76±2.22 94.04±0.44

79.54±0.66 78.62±0.58 77.64±1.08 96.32±0.47 76.78±1.25 97.64±0.32

79.60±0.37 78.18±0.90 77.44±1.09 96.12±0.44 76.52±0.97 97.58±0.42

79.54±0.66 76.62±0.58 77.64±1.08 96.32±0.47 76.78±1.25 97.64±0.32

79.60±0.37 77.18±0.90 77.44±1.09 96.12±0.44 76.52±0.97 97.58±0.42

that the proposed markers effectively induce distinguishable behavioral patterns that can be reliably detected.

Dataset

Test set type

K-S statistic (d)

p-value

CIFAR10 IPC=10

Tstand Tveri Ttrac

0.048 0.101 0.108

0.613 1.14e-02 5.83e-03

CIFAR10 IPC=50

Tstand Tveri Ttrac

0.062 0.332 0.360

0.060 8.54e-25 3.52e-29

CIFAR100 IPC=10

Tstand Tveri Ttrac

0.012 0.108 0.163

0.890 8.43e-26 2.26e-58

FashionMNIST IPC=50

Tstand Tveri Ttrac

0.026 0.172 0.356

0.996 7.10e-07 1.57e-28

SVHN IPC=50

Tstand Tveri Ttrac

0.070 0.216 0.318

0.173 1.26e-10 9.54e-23

TABLE VII: Performance of our proposed method on Transformer.

G. Visualization One of our design goals is to ensure that the protection remains imperceptible to human observers, so as to preserve data usability and avoid introducing detectable artifacts that may interfere with downstream applications. We present visualizations of samples from the original distilled dataset and the protected dataset in Fig. 7. It can be observed that the modifications introduced by our method are visually imperceptible, preserving the overall appearance of the distilled data. This demonstrates that our method does not introduce noticeable artifacts.

Dataset

IPC

Model Metric CVSR (%) DLTSR (%) CVSR (%) DLTSR (%) CVSR (%) DLTSR (%) CVSR (%) DLTSR (%)

Epoch 50

10 100 CIFAR10 50 50 100 50 10 100 FashionMNIST 50 50 100 50 10 100 SVHN 50

H. Computational Complexity

50 100

VGG11

VIT-Tiny

VIT-Small

CaiT-Small

Swin

71.50 32.00 74.00 38.00 97.00 82.00 97.50 92.00

67.00 65.00 73.00 60.00 72.00 65.00 77.00 60.00

84.00 59.00 84.00 85.00 78.00 65.00 78.00 80.00

80.00 70.00 78.00 97.00 81.00 99.00 77.00 100.00

94.00 100.00 87.00 100.00 96.00 100.00 95.00 100.00

70.00 87.00 60.00 98.00 70.00 67.00 74.00 97.00

CVSR (%) DLTSR (%) CVSR (%) DLTSR (%) CVSR (%) DLTSR (%) CVSR (%) DLTSR (%)

75.00 76.00 75.50 82.00 99.00 51.00 100.00 67.00

61.00 70.00 67.00 73.00 66.00 47.00 65.00 55.00

59.00 81.00 64.00 100.00 88.00 98.00 91.00 97.00

51.00 100.00 56.00 100.00 88.00 100.00 93.00 100.00

96.00 99.00 88.00 100.00 100.00 100.00 99.00 100.00

64.00 54.00 66.00 82.00 98.00 85.00 98.00 90.00

CVSR (%) DLTSR (%) CVS (%)R DLTSR (%) CVSR (%) DLTSR (%) CVSR (%) DLTSR (%)

77.50 64.00 83.00 74.00 99.00 66.00 93.00 77.00

72.00 36.00 73.00 45.00 90.00 74.00 91.00 78.00

63.00 88.00 63.00 98.00 76.00 75.00 84.00 80.00

52.00 87.00 55.00 100.00 51.00 77.00 77.00 76.00

98.00 100.00 97.00 100.00 88.00 81.00 90.00 78.00

80.00 70.00 77.00 95.00 69.00 53.00 72.00 74.00

&RPSXWDWLRQ7LPHVHFRQGV

We analyze the computational complexity of our method, and the results are shown in Fig. 8. Overall, our proposed protection method is highly efficient, requiring less than one minute to process a distilled dataset in most cases, and in some settings even completing within 10 seconds. This low computational overhead enables fast deployment in practical scenarios, allowing users to seamlessly regenerate protected datasets when switching keys without incurring significant delay.

ConvNet

&90 8670

& & & & & & & ,3 )$5,3 $5,3 1,67,3 1,67,3 69+1,3 69+1,3 5 0 0 ) Q Q , &,)$ &, R R & )DVKL )DVKL

I. Experiments in Transformers

All previous experiments are conducted on convolutional architectures. To further evaluate the generality of our method, we Fig. 8: Computational efficiency analysis. extend our experiments to DLTSR-based models. Specifically, building upon the CVM trained on ConvNet, we additionally Transformer-based marker is combined with the ConvNettrain CVM and USTM using ViT-Tiny [42], resulting in based markers, the proposed framework still preserves effective a unified setting where three markers are jointly applied. copyright verification on convolutional architectures, indicating Correspondingly, the reference behavior bank is also expanded that the protection signals remain robust under heterogeneous by incorporating ViT-Tiny-based responses. We consider ViT- backbone settings. Small [42], CaiT-Small [43], and Swin Transformer (Swin) [44] VII. C ONCLUSION as the user-side models. The results are shown in Tab. VII. It can be observed that our method maintains strong performance In this paper, we propose SubPopMark, a harmless frameon Transformer architectures, demonstrating its generalizabil- work for copyright protection and data leakage tracing of ity beyond convolutional models. Moreover, even when the distilled datasets in a post-distillation setting. Unlike prior

work relying on backdoors or label manipulation, our method introduces a carefully designed behavior bias into the models trained on our protected datasets via two components, CVM and USTM, enabling both copyright verification and userlevel leakage tracing without affecting semantic labels. We further design a behavior signature retrieval strategy to support downstream-agnostic detection. Extensive experiments across multiple datasets, distillation methods, and architectures demonstrate that SubPopMark achieves strong verification and tracing performance while preserving data utility and visual quality. Overall, this work provides a practical and non-invasive asymmetric protection strategy for distilled datasets. In future work, we will extend this framework to distilled datasets across different modalities. R EFERENCES [1] Shiye Lei and Dacheng Tao. A comprehensive survey of dataset distillation. IEEE Transactions on Pattern Analysis and Machine Intelligence, 46(1):17–32, 2023. [2] Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. Bert: Pre-training of deep bidirectional transformers for language understanding. In Proceedings of the 2019 conference of the North American chapter of the association for computational linguistics: human language technologies, volume 1 (long and short papers), pages 4171– 4186, 2019. [3] Qingyong Hu, Bo Yang, Linhai Xie, Stefano Rosa, Yulan Guo, Zhihua Wang, Niki Trigoni, and Andrew Markham. Randla-net: Efficient semantic segmentation of large-scale point clouds. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 11108–11117, 2020. [4] Yu Rong, Yatao Bian, Tingyang Xu, Weiyang Xie, Ying Wei, Wenbing Huang, and Junzhou Huang. Self-supervised graph transformer on largescale molecular data. Advances in neural information processing systems, 33:12559–12571, 2020. [5] Roy Schwartz, Jesse Dodge, Noah A Smith, and Oren Etzioni. Green ai. Communications of the ACM, 63(12):54–63, 2020. [6] Yan Liang, Ziyuan Yang, Zhuxin Lei, Mengyu Sun, Yingyu Chen, and Yi Zhang. Trust the unreliability: Inward backward dynamic unreliability driven coreset selection for medical image classification, 2026. [7] Jiawei Du, Xin Zhang, Juncheng Hu, Wenxing Huang, and Joey T Zhou. Diversity-driven synthesis: Enhancing dataset distillation through directed weight adjustment. Advances in neural information processing systems, 37:119443–119465, 2024. [8] Peng Sun, Bei Shi, Daiwei Yu, and Tao Lin. On the diversity and realism of distilled dataset: An efficient dataset distillation paradigm. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 9390–9399, 2024. [9] Bo Zhao and Hakan Bilen. Dataset condensation with distribution matching. In Proceedings of the IEEE/CVF winter conference on applications of computer vision, pages 6514–6523, 2023. [10] Ruonan Yu, Songhua Liu, Jingwen Ye, and Xinchao Wang. Teddy: Efficient large-scale dataset distillation via taylor-approximated matching. In European Conference on Computer Vision, pages 1–17. Springer, 2024. [11] Ziyuan Yang, Ming Yan, Yi Zhang, and Joey Tianyi Zhou. Poisoned distillation: Injecting backdoors into distilled datasets without raw data access. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 40, pages 1444–1452, 2026. [12] Tongzhou Wang, Jun-Yan Zhu, Antonio Torralba, and Alexei A Efros. Dataset distillation. arXiv preprint arXiv:1811.10959, 2018. [13] Yugeng Liu, Zheng Li, Michael Backes, Yun Shen, and Yang Zhang. Backdoor attacks against dataset distillation. arXiv preprint arXiv:2301.01197, 2023. [14] Noel Loo, Ramin Hasani, Alexander Amini, and Daniela Rus. Efficient dataset distillation using random feature approximation. Advances in Neural Information Processing Systems, 35:13877–13891, 2022. [15] Yilan Chen, Wei Huang, and Tsui-Wei Weng. Provable and efficient dataset distillation for kernel ridge regression. Advances in Neural Information Processing Systems, 37:88739–88771, 2024.

[16] Bo Zhao, Konda Reddy Mopuri, and Hakan Bilen. Dataset condensation with gradient matching. In Ninth International Conference on Learning Representations 2021, 2021. [17] Bo Zhao and Hakan Bilen. Dataset condensation with differentiable siamese augmentation. In International Conference on Machine Learning, pages 12674–12685. PMLR, 2021. [18] Muquan Li, Qian Dong, Dongyang Zhang, Ke Qin, and Guangchun Luo. Efficient industrial dataset distillation with textual trajectory matching. IEEE Transactions on Industrial Informatics, pages 1–12, 2026. [19] George Cazenavette, Tongzhou Wang, Antonio Torralba, Alexei A Efros, and Jun-Yan Zhu. Dataset distillation by matching training trajectories. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 4750–4759, 2022. [20] Justin Cui, Ruochen Wang, Si Si, and Cho-Jui Hsieh. Scaling up dataset distillation to imagenet-1k with constant memory. In International Conference on Machine Learning, pages 6565–6590. PMLR, 2023. [21] Yuanfang Guo, Oscar C Au, Rui Wang, Lu Fang, and Xiaochun Cao. Halftone image watermarking by content aware double-sided embedding error diffusion. IEEE Transactions on Image Processing, 27(7):3387– 3402, 2018. [22] Poonam Kadian, Shiafali M Arora, and Nidhi Arora. Robust digital watermarking techniques for copyright protection of digital data: A survey. Wireless Personal Communications, 118(4):3225–3249, 2021. [23] Hua Deng, Zheng Qin, Qianhong Wu, Zhenyu Guan, Robert H Deng, Yujue Wang, and Yunya Zhou. Identity-based encryption transformation for flexible sharing of encrypted data in public cloud. IEEE Transactions on Information Forensics and Security, 15:3168–3180, 2020. [24] Yiming Li, Peidong Liu, Yong Jiang, and Shu-Tao Xia. Visual privacy protection via mapping distortion. In ICASSP 2021-2021 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 3740–3744. IEEE, 2021. [25] Jiawang Bai, Yiming Li, Jiawei Li, Xue Yang, Yong Jiang, and Shu-Tao Xia. Multinomial random forest. Pattern Recognition, 122:108331, 2022. [26] Yiming Li, Mingyan Zhu, Xue Yang, Yong Jiang, Tao Wei, and Shu-Tao Xia. Black-box dataset ownership verification via backdoor watermarking. IEEE Transactions on Information Forensics and Security, 18:2318–2332, 2023. [27] Ruixiang Tang, Qizhang Feng, Ninghao Liu, Fan Yang, and Xia Hu. Did you train on my dataset? towards public dataset protection with cleanlabel backdoor watermarking. ACM SIGKDD Explorations Newsletter, 25(1):43–53, 2023. [28] Zhuxin Lei, Ziyuan Yang, and Yi Zhang. Zero-sacrifice persistentrobustness adversarial defense for pre-trained encoders. In Proceedings of the International Conference on Learning Representations, 2026. [29] Tong Zhang. Statistical behavior and consistency of classification methods based on convex risk minimization. The Annals of Statistics, 32(1):56–85, 2004. [30] Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervision. In International conference on machine learning, pages 8748–8763. PmLR, 2021. [31] Zhou Wang, Eero P Simoncelli, and Alan C Bovik. Multiscale structural similarity for image quality assessment. In The thrity-seventh asilomar conference on signals, systems & computers, 2003, volume 2, pages 1398–1402. Ieee, 2003. [32] Fips Pub. Secure hash standard (shs). Fips pub, 180(4):2012, 2012. [33] Kingma Diederik. Adam: A method for stochastic optimization. (No Title), 2014. [34] Alex Krizhevsky, Ilya Sutskever, and Geoffrey E Hinton. Imagenet classification with deep convolutional neural networks. Advances in neural information processing systems, 25, 2012. [35] Alex Krizhevsky, Ilya Sutskever, and Geoffrey E Hinton. Imagenet classification with deep convolutional neural networks. Communications of the ACM, 60(6):84–90, 2017. [36] Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. arXiv preprint arXiv:1409.1556, 2014. [37] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 770–778, 2016. [38] Ziyao Guo, Kai Wang, George Cazenavette, Hui Li, Kaipeng Zhang, and Yang You. Towards lossless dataset distillation via difficulty-aligned

trajectory matching. In The Twelfth International Conference on Learning Representations, 2024. [39] Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009. [40] Han Xiao, Kashif Rasul, and Roland Vollgraf. Fashion-mnist: a novel image dataset for benchmarking machine learning algorithms. arXiv preprint arXiv:1708.07747, 2017. [41] Yuval Netzer, Tao Wang, Adam Coates, Alessandro Bissacco, Baolin Wu, Andrew Y Ng, et al. Reading digits in natural images with unsupervised feature learning. In NIPS workshop on deep learning and unsupervised feature learning, volume 2011, page 4. Granada, 2011. [42] Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, et al. An image is worth 16x16 words: Transformers for image recognition at scale. arXiv preprint arXiv:2010.11929, 2020. [43] Hugo Touvron, Matthieu Cord, Alexandre Sablayrolles, Gabriel Synnaeve, and Hervé Jégou. Going deeper with image transformers. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), pages 32–42, October 2021. [44] Ze Liu, Yutong Lin, Yue Cao, Han Hu, Yixuan Wei, Zheng Zhang, Stephen Lin, and Baining Guo. Swin transformer: Hierarchical vision transformer using shifted windows. In Proceedings of the IEEE/CVF international conference on computer vision, pages 10012–10022, 2021.

Record · ID 180597 · SHA-256 709e4aa702d564b9
Retrieved via Conceptio — every document is proof-bundled with source, license, and retrieval metadata.