Frequency–spatial dual-domain imperceptible watermarking for robust image datasets copyright protection

While trigger-based watermarking enables dataset ownership verification, existing methods often remain vulnerable to structural distortions and rely mainly on behavior-only evidence. Unlike conventional image watermarking, dataset protection requires imperceptible ownership signals to propagate from protected samples to downstream model behavior while remaining owner-authenticatable. To address these limitations, we propose a frequency–spatial dual-domain dataset watermarking framework that integrates adaptive embedding, mixed asymmetric robust co-training, and two-stage verification under a dataset-to-model ownership-transfer formulation. We evaluate the method on MNIST, CIFAR-10, and CIFAR-100 with a watermark injection ratio of 10% of the training set. We further evaluate its applicability on Caltech-101 and PASCAL VOC 2012 for high-resolution classification and semantic segmentation, respectively. The evaluation covers common distortions, geometric and augmentation-style transformations, watermark-removal preprocessing, method-aware low-pass suppression, and black-box transfer attacks. Experimental results show that the proposed method achieves strong visual imperceptibility, with PSNR up to 39.0 dB on low-resolution benchmarks, 38.44 dB on Caltech-101, and 43.46 dB on PASCAL VOC 2012, while maintaining clean accuracy comparable to unwatermarked models. Under common distortions such as JPEG compression, Gaussian blur, and noise, it still preserves high watermark effectiveness. By providing complementary behavioral and owner-side query-authentication evidence, the framework offers a more comprehensive verification basis and provides preliminary evidence of applicability across image resolutions and task types.