🤖 AI

X-Mark: Saliency-Guided Robust Dataset Ownership Verification for Medical Imaging

X-Mark is a sample-specific, clean-label watermarking method for chest X-ray datasets that utilizes a conditional U-Net and Laplacian regularization to embed saliency-guided perturbations, ensuring robust ownership verification and scale-invariance while preserving diagnostic quality.

Original authors: Pranav Kulkarni, Junfeng Guo, Heng Huang

Published 2026-02-11

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Pranav Kulkarni, Junfeng Guo, Heng Huang

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are a world-class chef who has spent years perfecting a secret, highly nutritious recipe for a special soup. You decide to share it with the world for free so people can stay healthy. However, you’re worried that a big food corporation might take your recipe, put it in a can, and sell it for millions without ever giving you credit or asking permission.

How do you "tag" your recipe so that if you ever see that soup on a supermarket shelf, you can prove it was yours—without actually changing the taste or the look of the soup?

That is the problem this research paper, X-Mark, is trying to solve for medical images (like X-rays).

The Problem: The "Invisible Ingredient" Challenge

In the world of AI, doctors use massive collections of X-rays to teach computers how to spot diseases. These collections are incredibly expensive and difficult to make because they require expert doctors to label them.

Currently, people try to protect these "digital recipes" by adding "watermarks" (digital tags). But medical images are tricky:

They are high-resolution: If you put a big, obvious sticker on an X-ray, a doctor will notice it immediately, and it might even look like a medical error.
They get resized: When computers process images, they often shrink them. If your watermark is a tiny, delicate pattern, it might disappear when the image is resized, like a fine dusting of salt dissolving in water.
They are subtle: Unlike a photo of a cat, an X-ray is mostly shades of gray. You can't just slap a bright color on it.

The Solution: X-Mark (The "Smart Seasoning")

The researchers created X-Mark. Instead of a big, obvious sticker, think of X-Mark as a "Smart Seasoning."

Here is how it works using three clever tricks:

1. The Saliency Guide (The "Targeted Flavoring")
Instead of seasoning the whole soup (the whole image), X-Mark uses a "Saliency Guide." It identifies the most important parts of the X-ray—like the lungs or the heart—and only adds the "seasoning" (the watermark) there. It’s like adding a hint of nutmeg only to the cream part of a dessert where it blends in perfectly, rather than throwing it at the whole plate. This makes the watermark much harder for a human to spot.

2. Laplacian Regularization (The "Smooth Texture")
Sometimes, digital watermarks can be "grainy" or "jittery" (high-frequency noise). This is like adding salt that hasn't been dissolved; you can feel the individual grains. X-Mark uses a mathematical trick called "Laplacian Regularization" to make sure the watermark is smooth and blends into the image. This ensures that even if the image is shrunk or resized, the "flavor" remains consistent and doesn't disappear.

3. The Backdoor Test (The "Secret Taste Test")
To prove someone stole your recipe, you need a way to catch them. X-Mark works by creating a "backdoor."
Imagine if your secret recipe had one tiny, specific way of being seasoned that caused anyone who ate it to suddenly crave a glass of water. If you see a company selling soup, and you notice that every time someone eats it, they reach for water, you know they used your recipe.

In the paper, if a company trains an AI on the stolen X-rays, the researchers can give that AI a specific "test" image. If the AI reacts in a very specific, predictable way, the researchers have "caught them red-handed."

The Results: A Perfect Blend

The researchers tested this on a massive collection of chest X-rays (called CheXpert). Their results were impressive:

100% Success Rate: They were able to catch the "thieves" every single time.
Invisible to Humans: The X-rays still looked perfectly normal to doctors, meaning the "diagnostic quality" wasn't ruined.
Tough to Remove: Even if a thief tried to "wash" the recipe by fine-tuning the AI or "trimming" the edges, the secret seasoning stayed put.

Summary

X-Mark is like a high-tech, invisible, and indestructible "digital signature" designed specifically for the delicate world of medical imaging. It protects the hard work of medical researchers while ensuring that the images remain clear and safe for doctors to use.

Technical Summary: X-Mark: Saliency-Guided Robust Dataset Ownership Verification for Medical Imaging

1. Problem Statement

The commercialization of medical AI tools has increased the risk of unauthorized use of high-quality, expert-annotated medical datasets (e.g., CheXpert, MIMIC). Existing Dataset Ownership Verification (DOV) methods, primarily designed for natural images, fail in the medical domain due to three specific challenges:

Scale Invariance: Medical scans (like Chest X-rays) are high-resolution and dynamic. Static watermark patterns used in natural images scale poorly when images are downsampled for deep learning training.
Visual Constraints: Medical images are grayscale with subtle anatomical structures. Watermarks must be embedded in a single channel without compromising diagnostic quality or introducing high-frequency artifacts that are easily detectable by radiologists.
Limited Diversity: The low visual diversity in medical imaging makes it difficult to embed "unlearnable" features that don't inadvertently trigger benign models (false positives).

2. Methodology

The authors propose X-Mark, a sample-specific, clean-label backdoor watermarking method. Unlike traditional methods that use fixed triggers, X-Mark uses a learned generator to create unique, subtle perturbations.

A. The Watermark Generator ( $G$ ):

Architecture: A residual U-Net with strided convolutions (optimized for efficiency) acts as the generator.
Saliency Conditioning: To ensure perturbations are medically plausible, the authors incorporate an EigenCAM-based saliency module at the U-Net bottleneck. This guides the generator to place perturbations only within the salient anatomical regions (e.g., the chest area) rather than on the background.
Multi-Component Training Objective: The generator is trained using a surrogate model with four loss functions:
1. Target Sample Loss ( $L_t$ ): Ensures target-class samples reinforce the watermark-label association.
2. Non-Target Sample Loss ( $L_{nt}$ ): Ensures non-target samples are misclassified as the target class when watermarked (the "backdoor" trigger).
3. Perceptual Similarity Loss ( $L_{LPIPS}$ ): Maintains visual imperceptibility.
4. Laplacian Regularization ( $L_{Lap}$ ): A novel addition that penalizes high-frequency perturbations using a Laplacian pyramid. This forces the watermark to be "smooth" and robust to the downsampling processes common in DL training.

B. Verification Process:
Ownership is verified in a black-box setting using hypothesis testing. The owner queries a suspicious model with both benign and watermarked non-target samples. If the model shows a statistically significant tendency to misclassify watermarked samples as the target class (measured via a one-sided paired t-test), unauthorized use is confirmed.

3. Key Contributions

Sample-Specific Approach: Moves away from static triggers to unique, saliency-aware perturbations tailored to each image.
Scale-Invariant Design: Introduces Laplacian regularization to ensure watermarks survive the transition from high-resolution scans to low-resolution training inputs.
Medical-Centric Optimization: Specifically addresses the constraints of grayscale, high-stakes diagnostic imaging.

4. Experimental Results

Evaluated on the CheXpert dataset, X-Mark demonstrated superior performance:

Effectiveness: Achieved a 100% Watermark Success Rate (WSR) and maintained high Benign Accuracy (BA) of 84.88%.
Robustness: Showed strong resistance to downsampling (effective up to $128 \times 128$ resolution) and model-agnostic transferability (works across ResNet and VGG architectures).
Security: Resisted common removal attacks, including model fine-tuning and model pruning.
Comparison: Outperformed state-of-the-art clean-label methods (like SSCL-BW) by producing more anatomically realistic images (lower LPIPS/higher diagnostic integrity) and reducing false positives in independent model scenarios.

5. Significance

X-Mark provides a robust framework for protecting the intellectual property of medical dataset creators. By ensuring that watermarks are both imperceptible to clinicians and resilient to the standard preprocessing pipelines of deep learning, it bridges the gap between theoretical copyright protection and the practical, high-resolution requirements of medical radiology.