VICTOR: Dataset Copyright Auditing in Video Recognition Systems

VICTOR: Dataset Copyright Auditing in Video Recognition Systems

Speakers: Quan Yuan

Conference: NDSS Symposium 2026

YouTube: https://www.youtube.com/watch?v=pmDSfUYclrQ

Overview

As video recognition systems become integral to autonomous driving, security surveillance, and healthcare monitoring, the datasets used to train these models have become valuable intellectual property. Many high-quality video datasets are published under strict open-source licenses that prohibit unauthorized commercial use, yet detecting violations is extremely difficult. This talk introduces VICTOR, the first dataset copyright auditing approach specifically designed for video recognition systems. By amplifying behavioral differences between modified and original samples, VICTOR enables dataset owners to detect unauthorized use of their data in third-party models with high accuracy and robustness, even under adversarial evasion attempts.

The core challenge is that existing image-based auditing techniques cannot be directly applied to video datasets due to flexible video lengths, increased model architecture complexity, and the need to aggregate information across multiple frames. VICTOR addresses these challenges through a three-phase workflow -- sample modification, sample selection, and copyright verification -- that achieves high true positive rates with near-zero false positives across multiple architectures and datasets, all while avoiding the harmful backdoor injections used by prior approaches.

Background

▶ Watch: Problem definition: detecting unauthorized commercial use of open-source data... (0:30)

Dataset copyright protection has become a pressing legal and ethical issue in machine learning. High-quality datasets require enormous effort to collect, curate, and annotate, and their creators increasingly publish them under licenses that restrict commercial use. However, once a dataset is publicly available, there is little to prevent a malicious actor from downloading it and training commercial models without authorization. Recent real-world litigation underscores the urgency: Disney sent a cease-and-desist letter to Google demanding it stop alleged copyright infringement in its AI systems, demonstrating that dataset copyright disputes are moving from theoretical concern to active legal battleground.

Prior work on dataset copyright auditing has focused primarily on image recognition systems, with approaches like MLDDA and MT (Membership Testing). However, video datasets present unique challenges. Video data comprises sequences of frames with uncertain length, making fixed-size modification strategies difficult to apply. Video recognition models such as I3D, SlowFast, TSM, and TimeSformer rely on temporal aggregation across multiple frames, adding architectural complexity. Furthermore, some image auditing approaches rely on backdoor injection, which introduces harmful triggers into training data -- an approach that is ethically problematic and potentially detectable.

Key Findings

▶ Watch: Core idea: amplifying behavioral differences in published samples (2:45)

VICTOR achieves high auditing accuracy across multiple datasets and model architectures while maintaining several important properties:

Effectiveness without backdoors: Unlike prior approaches that inject harmful backdoor triggers, VICTOR modifies only a small fraction of the dataset using a label augmentation mechanism that amplifies behavioral differences without introducing malicious patterns. This means the published dataset remains safe for legitimate users.

Cross-architecture robustness: Evaluated on four video recognition models spanning three different architectures -- I3D, SlowFast, TSM, and TimeSformer -- VICTOR consistently achieves high true positive rates (TPR) with zero or near-zero false positive rates (FPR).

Low modification budget: The approach achieves high auditing accuracy even with a modification ratio as low as 6 samples, and maintains competitive performance with very small fractions of the dataset modified. There is a trade-off between auditing accuracy and normal task performance, but it is manageable.

Resilience to evasion: Under adversarial countermeasures including input perturbation, early stopping, and post-training adjustments, VICTOR's TPR shows only slight decreases while FPR remains at zero. Critically, any evasion attempt that significantly degrades auditing accuracy also causes noticeable degradation in the model's normal task performance, making evasion costly.

Technical Deep Dive

▶ Watch: VICTOR three-phase workflow: modification, selection, verification (3:30)

VICTOR's architecture consists of three tightly integrated phases:

Phase 1 -- Sample Modification: An evaluation model is first trained on the original video dataset. For each sample in the dataset, VICTOR generates a modified version using a label augmentation technique. The evaluation model then computes prediction outputs for both the original and modified versions of each sample, producing a set of behavioral signatures that serve as the basis for the next phase.

Phase 2 -- Sample Selection: This phase identifies which samples are most likely to produce detectable behavioral amplification when used for training. VICTOR calculates the difference in the evaluation model's predictions between original and modified versions. Samples with larger prediction differences are placed in a candidate set, while those with smaller differences go into a remaining set. From the candidate set, two subsets are selected: a modification set (whose modified versions will be published) and a reference set (whose original versions will be published). The published dataset then consists of modified samples from the modification set, plus original samples from the reference and remaining sets.

Phase 3 -- Copyright Verification: When auditing a suspect model, VICTOR queries it with samples from both the modification and reference sets. The key insight is that if the suspect model was trained on the published dataset, there will be a statistically significant difference in its performance between the published versions (which it saw during training) and the unpublished versions (which it did not). This behavioral divergence is quantified using statistical testing to produce a binary auditing decision.

The evaluation model in Phase 1 serves as a proxy to predict which samples will exhibit the strongest amplification effect. The experiments show that while the evaluation model enhances auditing effectiveness, VICTOR achieves competitive performance even without it, suggesting the approach is robust to evaluation model quality.

Demo / Proof of Concept

▶ Watch: Impact of modification budget and ratio on accuracy (7:00)

The experimental evaluation spans three standard video recognition benchmarks: HMDB51, UCF-101, and Something-Something V2 (SSV2). Four target models were tested: I3D, SlowFast, TSM, and TimeSformer. VICTOR outperformed both baseline image auditing methods (MLDDA and MT) across all configurations. The MT method, while performing better than MLDDA, suffered from obvious visual distortion due to its image-mixing approach, making it detectable. Under adversarial conditions -- input perturbation, early stopping, and post-training adjustments -- VICTOR's TPR showed modest decreases while maintaining zero FPR. Notably, the SlowFast model was most affected by early stopping because it trains from scratch without pre-trained weights, requiring more epochs to learn dataset characteristics. In all evasion scenarios, the attacker faces a fundamental trade-off: reducing auditing accuracy requires accepting significant degradation in normal model performance.

Defensive Implications

▶ Watch: Robustness against adversarial evasion: input perturbation and early stopping (8:15)

For dataset creators and research institutions, VICTOR provides a practical tool to enforce copyright compliance without resorting to harmful backdoor injection. The low modification budget means that only a small fraction of the dataset needs to be altered, minimizing impact on legitimate users. The statistical verification approach provides evidence that could support legal claims of unauthorized dataset use.

For organizations deploying video recognition systems, the existence of tools like VICTOR raises the bar on dataset provenance. Companies training models on publicly available datasets should ensure their licenses permit commercial use, as auditing tools are becoming sophisticated enough to detect violations even when models are trained with adversarial countermeasures. The cost of evasion -- degraded model performance -- makes it impractical to use unauthorized data while avoiding detection.

For the broader ML security community, VICTOR demonstrates that copyright auditing can be done without introducing security risks. By avoiding backdoor-based approaches, the method protects both the dataset owner's rights and the safety of the machine learning ecosystem.

Key Takeaways

• VICTOR is the first dataset copyright auditing approach specifically designed for video recognition systems
• The method amplifies behavioral differences between modified and original samples rather than injecting harmful backdoor triggers
• High auditing accuracy is achieved across I3D, SlowFast, TSM, and TimeSformer architectures with near-zero false positives
• Only a small fraction of the dataset (as few as 6 samples) needs modification for effective auditing
• Adversarial evasion attempts (input perturbation, early stopping, post-adjustment) reduce auditing accuracy only at the cost of significant model performance degradation
• The statistical verification approach provides a foundation for legal evidence of unauthorized dataset use

About the Speaker(s)

Quan Yuan is affiliated with Zhejiang University. The paper is a joint work between researchers at Zhejiang University, Xinjiang University, VU Amsterdam, and Hohai University. Due to visa issues, the authors were unable to attend in person, and the work was presented by a colleague on their behalf. The research focuses on the intersection of intellectual property protection and machine learning security.