Implementation guide
OWASP AISVS v1.01
Training Data Integrity & Traceability · Training Data Origin & Data Security
Watermark your datasets
Verify that datasets are watermarked so their use can be attributed and any unauthorized use detected.
OWASP AISVS v1.01, requirement 1.1.5
In plain English
Mark your datasets so you can later show that a particular model or copy used them, and so you can tell when they turn up where they should not. This is a Level 3 control. It matters most for data that is expensive, licensed or commercially sensitive.
What good looks like
- High-value datasets carry a watermark or fingerprint that survives normal cleaning, shuffling and deduplication.
- There is a documented test for checking a suspect model or dataset for the mark, and it has been tried.
- A register records which mark went into which dataset version and which recipient.
- The marks are known only to the few people who need them.
How teams usually do it
- Canary records: a small number of unique, made-up entries that a model trained on the data will tend to reproduce or score with unusual confidence.
- A different set of canaries for each recipient or licensee, so a leak points to its source.
- Statistical marking methods from the research literature (often called radioactive data or dataset inference) where canaries are too easy to strip.
Suggested evidence
- The watermarking method and the register of marks by dataset version.
- Results from running the detection test on a model you know was trained on the data, and on one that was not.
Common mistakes
- Canaries that routine deduplication or outlier removal deletes.
- Marking the data with no plan for how you would ever test for the mark.
- Canaries that look like real personal data and cause a privacy problem of their own.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.