Conceptio › Archive › arXiv CS

arXiv CSopen access

Geometry-Aware Localized Watermarking for Copyright Protection in Embedding-as-a-Service

Unknown · 2026 · arxiv_cs

arXiv CS · Papers · License: Open Access · 2026

Open Source ↗Direct PDF ↓

cryptography, security, privacy, cybersecurity

arXiv:2604.11344v1 [cs.CR] 13 Apr 2026

Geometry-Aware Localized Watermarking for Copyright Protection in Embedding-as-a-Service Zhimin Chen

Xiaojie Liang

Wenbo Xu

[email protected] School of Computer Science and Engineering, Sun Yat-sen University Guangzhou, China

Yuxuan Liu

Wei Lu∗

[email protected] School of Computer Science and Engineering, Sun Yat-sen University Guangzhou, China

Abstract Embedding-as-a-Service (EaaS) has become an important semantic infrastructure for natural language and multimedia applications, but it is highly vulnerable to model stealing and copyright infringement. Existing EaaS watermarking methods face a fundamental robustness–utility–verifiability tension: trigger-based methods are fragile to paraphrasing, transformation-based methods are sensitive to dimensional perturbation, and region-based methods may incur false positives due to coincidental geometric affinity. To address this problem, we propose GeoMark, a geometry-aware localized watermarking framework for EaaS copyright protection. GeoMark uses a natural in-manifold embedding as a shared watermark target, constructs geometry-separated anchors with explicit target–anchor margins, and activates watermark injection only within adaptive local neighborhoods. This design decouples where watermarking is triggered from what ownership is attributed to, achieving localized triggering and centralized attribution. Experiments on four benchmark datasets show that GeoMark preserves downstream utility and geometric fidelity while maintaining robust copyright verification under paraphrasing, dimensional perturbation, and CSE (Clustering, Selection, Elimination) attacks, with improved verification stability and low false-positive risk.

CCS Concepts • Security and privacy → Digital rights management; • Computing methodologies → Artificial intelligence.

Keywords Model watermarking, model stealing attack, embedding-as-a-service, copyright protection, ai security

Introduction

Large language models (LLMs) [1, 29, 30, 36] have demonstrated remarkable capabilities in producing high-quality semantic representations. To avoid the substantial costs of local deployment, developers increasingly deliver these capabilities through Embeddingas-a-Service (EaaS) APIs, such as OpenAI’s text-embedding-31 . ∗ Corresponding author. 1 https://openai.com/index/new-embedding-models-and-api-updates/

Beyond traditional natural language processing [5, 10, 15, 17, 40, 41], text-based EaaS services have evolved into essential semantic infrastructure for modern multimedia systems. For instance, Multimodal RAG (M-RAG) pipelines heavily rely on text EaaS as semantic anchors to index and retrieve diverse multimedia elements, including parsed document chunks, structured tables, and vision-language image summaries [12, 20, 24]. Consequently, safeguarding the intellectual property (IP) of EaaS models is crucial for sustaining the high-quality infrastructure that these expanding multimedia applications depend on. However, recent studies [18, 23] have shown that EaaS systems are highly vulnerable to model stealing attacks. By querying the victim API on an unlabeled corpus and collecting the returned embeddings, an adversary can train a functionally similar surrogate model at only a fraction of the original computational cost. Such attacks allow malicious actors to deploy competing services without authorization, thereby causing substantial economic losses and infringing upon the IP of model providers. These risks make robust copyright protection for EaaS models increasingly important. Existing EaaS watermarking defenses face a practical robustness– utility–verifiability tension, as illustrated in Figure 1, and can be broadly categorized into three paradigms. First, trigger-based watermarking [23, 26, 34] relies on fragile surface-form cues, making it vulnerable to paraphrasing [13, 27]. Second, transformation-based methods [27] encode ownership via secret transformations, but depend heavily on coordinate structures, rendering them fragile under dimensionality perturbations. Finally, semantic region-based watermarking [37] activates watermarks based on semantic subregions to resist semantic-preserving attacks. However, because natural embeddings are non-uniformly distributed, region-dependent assignment inherently introduces distance bias [16]. This bias causes clean embeddings to coincidentally exhibit geometric affinity to assigned targets, accumulating false-positive risks during verification. Simply reverting to a naive shared-target variant is non-trivial, as it often becomes highly vulnerable to the CSE attack. These observations indicate that robust triggering and reliable verification must be designed jointly rather than optimized in isolation. To address this challenge, we ask a fundamental question: Can an EaaS watermark remain robust against diverse removal attacks while preserving embedding utility and still support reliable copyright

Conference acronym ’XX, June 03–05, 2018, Woodstock, NY

Chen et al.

Trigger based Text Before Paraphrasing:

Text Before Paraphrasing:

The company introduced a new route for commuters.

The company announced a new route for commuters.

Fragile to Paraphrasing

Transformation based

Original Embedding

Fragile to Dimension Perturbation

Provided Embedding

Secret Linear Transformation

Region based

Embedding Space after PCA

Trigger Region and Watermark Embedding

GeoMark (Ours)

𝝉𝒌

False Positive

Robustness

𝝉𝟒

𝝉𝟏 Embedding Space

Coincidental Affinity

𝝉𝟐

𝝉𝟑

Target-Anchor Safety Margin

Verifiability

Utility

Figure 1: Motivation of GeoMark. Existing EaaS watermarking methods face a robustness–utility–verifiability tension, while GeoMark decouples localized triggering from sharedtarget attribution to improve robustness and verification reliability with low false-positive risk. verification with low false-positive risk? We answer this question affirmatively with GeoMark, a geometry-aware localized watermarking framework for Embedding-as-a-Service (EaaS). GeoMark first selects a natural in-manifold embedding from the original embedding space as a shared secret watermark target, and then uses farthest point sampling (FPS) to select well-separated anchors that establish explicit geometric safety margins. Around these anchors, GeoMark further calibrates adaptive local neighborhoods so that watermark activation remains localized. Meanwhile, ownership evidence is always aggregated with respect to the same shared watermark target. In this way, GeoMark decouples where watermarking is triggered from what ownership is attributed to, achieving distributed triggering and centralized attribution. In summary, our main contributions are as follows: • We identify the robustness–utility–verifiability tension in existing EaaS watermarks and show that geometry-aware design is crucial for reliable copyright verification with low false-positive risk. • We propose GeoMark, a geometry-aware localized watermarking framework that decouples localized triggering from shared-target attribution via FPS, improving verification stability and reducing false-positive risk. • Extensive experiments on four benchmark datasets demonstrate that GeoMark preserves embedding utility and geometric fidelity while providing robust copyright verification against diverse watermark removal attacks.

2 Related Work 2.1 Model Stealing Attacks Model stealing attacks [3, 14, 22, 25, 31, 33], also known as model extraction or imitation attacks, aim to replicate a victim model by exploiting black-box query access. By repeatedly querying the

target model and collecting its outputs, an adversary can construct a synthetic input–output dataset and train a surrogate model that approximates the victim’s behavior at a substantially lower cost. Recent studies have shown that this threat is particularly relevant to Embedding-as-a-Service (EaaS) systems [18, 23], where attackers query an embedding API on an unlabeled corpus and train a surrogate encoder using the returned embeddings. This EaaS-oriented query-based extraction setting constitutes the primary threat model studied in this work.

2.2

EaaS Watermarks

Compared with conventional DNN watermarking settings [2, 32, 38], EaaS watermarking defenses can be broadly grouped into three paradigms, reflecting different trade-offs among robustness, utility, and verifiability. The first paradigm, trigger-based watermarking, injects watermark signals into inputs containing predefined trigger words, as exemplified by EmbMarker [23], WARDEN [26], and EspeW [34]. These methods can effectively inherit ownership evidence under standard extraction, but because their triggering mechanism relies on surface-form cues rather than semantic neighborhoods, they remain vulnerable to paraphrasing attacks. To improve robustness beyond lexical triggers, the second paradigm explores transformation-based methods, such as WET [27], which embed ownership evidence through a secret global transformation in the representation space. However, because such methods depend on preserving the transformed coordinate structure, dimensionality perturbations such as cyclic shifts or truncation can substantially weaken their effectiveness. More recent work has shifted toward a semantic region-based approach, which partitions the embedding space into semantic subregions and activates watermarking according to region membership [37]. This design improves robustness against semanticpreserving attacks, but also makes verification more delicate. Since natural embeddings are not uniformly distributed in semantic space, region-dependent watermark assignment may introduce coincidental geometric affinity between clean embeddings and assigned targets [16]. When verification aggregates evidence across multiple regions, such affinity may accumulate and increase false-positive risk. Meanwhile, simply reverting to a shared-target variant is not a trivial solution, since naive single-target designs can become more vulnerable to the CSE attack. These limitations motivate GeoMark, a geometry-aware localized approach to robust and reliable model watermarking for EaaS copyright protection.

3 Methodology 3.1 Preliminary Threat Model. In an EaaS model stealing attack, an adversary queries the provider’s embedding model Θ𝑝 on an unlabeled corpus and collects the returned embeddings e𝑝 . These embeddings are then used to train a surrogate model Θ𝑠 at only a fraction of the original training cost, enabling a competing service 𝑆𝑠 without authorization. To defend against this threat, the provider applies a watermarking function 𝑓 to inject a watermark signal 𝑡 into the original clean embedding e𝑜 , and returns the protected embedding e𝑝 = 𝑓 (e𝑜 , 𝑡). Consequently, when the adversary trains Θ𝑠 on the

Geometry-Aware Localized Watermarking for Copyright Protection in Embedding-as-a-Service

Conference acronym ’XX, June 03–05, 2018, Woodstock, NY

Geometry-Aware Watermark Initialization

𝝉𝒌

Target-Anchor Safety Margin

𝝉𝟒 Input Provider’s Corpus

Generate

FPS

Victim Model

Distributed Trigger Neighborhoods

Does embedding lie in trigger neighborhood 𝑁𝑘 ?

𝝉𝟒

∗ λ 𝑁𝑜𝑟𝑚

Yes

Victim Model

𝝉𝟐

𝝉𝟑

Stealing

…

Stealer’s Corpus

Model

𝝉𝒌

Judge 𝝉 𝟏

Input

Target Embedding

𝝉𝟑

𝝉𝟐

Natural Embedding Space

Anchor-Centric Local Watermark Injection

𝝉𝟏

Surrogate Model

Trigger Neighborhoods

e𝑛

𝑒𝑏

𝝉𝟒 𝝉𝒌

Backdoor Corpus Calculate Distances With Target

𝝉𝟏 Provider’s Corpus

𝝉𝟐

𝝉𝟑

Trigger Neighborhoods

Benign Corpus

Surrogate Model

Embedding

Δcos , Δ𝐿2 , 𝑝-𝑣𝑎𝑙𝑢𝑒

Figure 2: Overall framework of GeoMark. Given a shared in-manifold watermark target, GeoMark performs geometry-aware anchor initialization, localized watermark injection, and shared-target verification for robust EaaS copyright protection. protected embeddings, the watermark signal can be inherited by the surrogate model and later used for copyright verification. Defense Objectives. Given that adversaries may employ diverse and aggressive strategies to evade detection, a reliable watermarking function 𝑓 should satisfy the following three desiderata simultaneously: (1) Utility, meaning that watermark injection introduces negligible distortion so that the protected embedding e𝑝 remains comparable to the original embedding e𝑜 for downstream use; (2) Robustness, meaning that the watermark persists as a verifiable signal in the extracted model Θ𝑠 despite diverse watermark removal attacks; and (3) Verifiability, meaning that the verification mechanism can reliably distinguish watermarked surrogate models from benign ones with sufficient statistical significance and low false-positive risk.

with centralized attribution. The framework proceeds in three stages, detailed in Sections 3.3–3.5.

3.3

Geometry-Aware Watermark Initialization

Let M ⊂ R𝑑 denote the high-dimensional embedding manifold induced by the provider-side embedding model over natural texts, 𝑁 ⊂ M denote the corresponding clean embedand let E = {e𝑖 }𝑖=1 ding set. GeoMark first selects a natural in-manifold embedding w ∈ E as the shared watermark target. Conditioned on w, we then select 𝐾 anchors by farthest point sampling (FPS), A = {a1, a2, . . . , a𝐾 } ⊂ E, where the anchor selection is defined recursively. Let S𝑘 −1 = {w, a1, . . . , a𝑘 −1 }.

3.2

Overview of GeoMark

Figure 2 presents the overall framework of GeoMark. To address the limitations of existing EaaS watermarking methods, we propose GeoMark, a geometry-aware localized watermarking framework for copyright protection in EaaS. The key idea is to decouple where watermarking is triggered from what ownership is attributed to. Concretely, GeoMark (i) selects a natural in-manifold embedding w ∈ E as a shared watermark target; (ii) uses farthest point sampling (FPS) [8] to select 𝐾 well-separated anchors with explicit geometric safety margins from w; and (iii) activates watermark injection only within anchor-centered local neighborhoods, consistently attributing all activated samples to w. This achieves distributed triggering

(1)

(2)

Then the 𝑘-th anchor is selected as a𝑘 = arg max

min ∥e − s∥ 2 .

e∈ E\S𝑘 −1 s∈ S𝑘 −1

(3)

This target–anchor construction establishes an explicit geometric safety margin on M. By design, watermark activation is restricted to anchor-centered neighborhoods that are deliberately separated from the shared target w. As a result, before watermark injection, activated clean samples are less likely to exhibit accidental affinity to w, which improves verification stability and suppresses false-positive risk. Importantly, the role of FPS here is not merely to spread anchors across the manifold, but to enforce target–anchor

Conference acronym ’XX, June 03–05, 2018, Woodstock, NY

Chen et al.

separation so that watermark triggering and watermark attribution remain geometrically well controlled. For each anchor a𝑘 , we further calibrate an anchor-specific local radius 𝜏𝑘 . Let 𝑑𝑖𝑘 = ∥e𝑖 − a𝑘 ∥ 2, e𝑖 ∈ E. (4) Given a prescribed local coverage ratio 𝜌, we define 𝑁 𝜏𝑘 = Quantile𝜌 {𝑑𝑖𝑘 }𝑖=1 ,

(5)

and the corresponding local neighborhood as N𝑘 = {e ∈ E | ∥e − a𝑘 ∥ 2 ≤ 𝜏𝑘 } .

(6)

Such adaptive calibration is necessary because local semantic density can vary substantially across different regions of the manifold [9, 11]: some anchors lie in semantically crowded areas with many nearby benign embeddings, while others reside in relatively sparse areas. A fixed global radius would therefore yield severely imbalanced activation coverage across anchors. By using anchorspecific quantile thresholds, GeoMark adapts each local neighborhood to its surrounding semantic density, yielding more consistent local coverage and more stable watermark triggering across heterogeneous regions of M. Since 𝜏𝑘 is uniquely determined by 𝜌 via Eq. (5), the meaningful sensitivity variable is 𝜌; hyper-parameter analysis is deferred to Section 4.6. Overall, this initialization stage produces a distributed local triggering structure together with a shared global attribution target: multiple anchor-centered neighborhoods determine where watermark activation may occur, while all activated samples are ultimately attributed to the same secret target w.

3.4

Anchor-Centric Local Watermark Injection

After initializing the anchor-centered local neighborhoods, GeoMark injects watermark only into embeddings that fall within these neighborhoods. For an input embedding e𝑜 ∈ M, the activated anchor set is defined as I (e𝑜 ) = {𝑘 ∈ {1, . . . , 𝐾 } | e𝑜 ∈ N𝑘 } .

(7)

If I (e𝑜 ) ≠ ∅, watermark injection is applied and the protected embedding is obtained as e𝑝 = Norm(e𝑜 + 𝜆w) ,

(8)

where Norm(·) denotes 𝐿2 normalization and 𝜆 controls the watermark injection strength. When an embedding falls into multiple anchor neighborhoods simultaneously, GeoMark still applies a single shared-target injection rather than accumulating multiple perturbations. In other words, overlapping activations only affect the trigger decision, not the perturbation magnitude. This design avoids excessive distortion in dense overlap regions and keeps the watermark strength consistently controlled by the global coefficient 𝜆. In practice, FPS-based anchor selection together with anchor-specific radius calibration also helps reduce excessive overlap by encouraging geometric separation among activated neighborhoods. In this way, watermark activation remains localized to multiple anchor-centered semantic neighborhoods, while all activated samples are softly attracted toward the same shared watermark target w. Since the shared target itself is a natural in-manifold embedding and the injection is performed only within bounded

local regions, the resulting perturbation remains aligned with the intrinsic geometry of the embedding manifold, which better preserves semantic utility. Moreover, because watermark evidence is encoded through relative affinity to a shared natural target rather than through fragile coordinate-specific transformations, GeoMark is more resilient to dimensional perturbation attacks. At the same time, GeoMark does not partition the embedding space into discrete semantic regions with region-specific targets. Instead, it activates watermarking over multiple anchor-centered local neighborhoods while consistently attributing all activated samples to the same target w. Since these samples originate from geometry-separated neighborhoods and are normalized on top of different original embeddings, the resulting watermark distribution remains structured yet heterogeneous, which later contributes to improved resistance against the CSE attack.

3.5

To verify whether a suspicious surrogate model inherits the watermark, GeoMark constructs a verification set consisting of activated samples and benign samples. Specifically, let D𝑏 denote the backdoor verification set, formed by texts whose clean embeddings would activate watermark injection, i.e., texts whose embeddings fall into an anchor-centered local neighborhood N𝑘 . Let D𝑛 denote the benign verification set, formed by texts whose clean embeddings lie outside all such local neighborhoods. Given a suspicious surrogate model, we query it with the texts in D𝑏 and D𝑛 and obtain the returned embeddings. We also query it with the target text corresponding to w and denote the returned embedding by ŵ. Since the surrogate model is trained on protected embeddings, samples in D𝑏 are expected to exhibit stronger affinity to ŵ than those in D𝑛 . This centralized attribution to a single target distinguishes GeoMark from multi-target verification schemes: instead of aggregating evidence across multiple target references, GeoMark measures all activated samples against the same target reference, which simplifies statistical verification and reduces the risk of fragmented evidence accumulation. Specifically, we measure the closeness between a suspicious embedding ê and the returned target embedding ŵ by cosine similarity and 𝐿2 distance: ê⊤ ŵ Cos(ê, ŵ) = , (9) ∥ ê∥ 2 ∥ ŵ∥ 2 ê ŵ L2 (ê, ŵ) = − . (10) ∥ ê∥ 2 ∥ ŵ∥ 2 2 Based on these quantities, we compute the group-level discrepancy between backdoor and benign samples as ∑︁ 1 ∑︁ 1 Δcos = Cos(ê𝑖 , ŵ) − Cos(ê 𝑗 , ŵ), (11) |D𝑏 | ê ∈ D |D𝑛 | ê ∈ D 𝑖

𝑛

𝑗

𝑏

∑︁ 1 ∑︁ 1 Δ𝐿2 = L2 (ê𝑖 , ŵ) − L2 (ê 𝑗 , ŵ), |D𝑏 | ê ∈ D |D𝑛 | ê ∈ D 𝑖

𝑏

𝑗

(12)

𝑛

where a positive Δcos and a negative Δ𝐿2 indicate that the activated samples are, on average, closer to the returned target embedding than benign samples. Furthermore, we perform a one-sided Kolmogorov–Smirnov test [4] on the cosine-similarity distributions of D𝑏 and D𝑛 , where the alternative hypothesis is that backdoor samples are more similar

Geometry-Aware Localized Watermarking for Copyright Protection in Embedding-as-a-Service

to the shared watermark target than benign samples. A sufficiently low 𝑝-value indicates copyright infringement, while Δcos and Δ𝐿2 serve as auxiliary interpretation metrics.

4 Experiments 4.1 Experimental Settings Datasets. We conduct experiments on four widely used benchmark datasets: SST-2 [28], AGNews [39], Enron [21], and MIND [35]. Specifically, SST-2 is used for sentiment classification, AGNews and MIND are used for news-related topic classification and recommendation, respectively, and Enron is used for spam detection. Together, these datasets span diverse domains and semantic characteristics, providing a representative benchmark suite for evaluating EaaS watermarking methods. Evaluation Metrics. Following prior EaaS watermarking studies [16, 37], we evaluate all methods from three perspectives: task performance, similarity performance, and detection performance. Task performance is measured by downstream classification accuracy. Similarity performance is measured by the cosine similarity between the original embedding e𝑜 and the protected embedding e𝑝 . Detection performance is evaluated primarily by the 𝑝-value of the one-sided KS test, while Δcos and Δ𝐿2 are used as auxiliary interpretation metrics. We regard 𝑝 < 0.05 as the threshold for successful copyright verification. Baseline Methods. We compare GeoMark with three primary baselines: WARDEN [26], EspeW [34], and WET [27]. WARDEN injects multiple watermark embeddings based on trigger words. EspeW embeds watermark signals into a subset of embedding dimensions. WET applies a secret linear transformation to all embeddings. We do not include EmbMarker [23], because WARDEN represents a stronger extension of the same trigger-based watermarking line. In addition, because our main claim concerns verification reliability and false-positive behavior relative to region-triggered attribution, we include a RegionMarker-style reimplementation only as a targeted clean-model reference in Table 3. Since no official implementation is available, we do not treat this comparison as a fully matched attack-benchmark evaluation; instead, we use it to isolate whether region-triggered attribution itself can induce spurious ownership evidence in the unwatermarked setting. Overall, these baselines cover representative trigger-based and transformationbased EaaS watermarking paradigms. RegionMarker is included solely for clean-model false-positive analysis in Table 3: a method that already fails verifiability on unwatermarked models cannot serve as a meaningful robustness baseline, since robustness is only relevant when the verification signal itself is trustworthy. Stealing Attack Settings. Following established threat models and evaluation protocols in recent EaaS watermarking literature [23, 26, 27, 34], we use OpenAI’s text-embedding-ada-002 as the provider model and BERT [7] as the surrogate model. The adversary trains the stealer on the protected embeddings with a two-layer MLP using MSE loss and AdamW [19], where the learning rate is set to 5 × 10−5 and the batch size is 32. Watermark Removal Attack Settings. We evaluate all methods under three categories of watermark removal attacks: CSE, paraphrasing, and dimensional perturbation. Unless otherwise noted,

Conference acronym ’XX, June 03–05, 2018, Woodstock, NY

the attack configurations follow prior EaaS watermarking studies [34, 37]. For CSE, we use 𝑛 = 20 and 𝑁𝑐 = 50. For paraphrasing, the attacker rewrites the stealing corpus with NLLB [6] or GPT-4omini, generates five paraphrases per input, and filters low-quality candidates with a cosine similarity threshold of 80%. For dimensional perturbation, we consider Dimension-shift, which cyclically shifts dimensions by 100 positions, and Dimension-reduction, which retains only the first 1024 dimensions. Implementation Details. For GeoMark, we set the number of anchors 𝐾 to 5 and the local coverage ratio 𝜌 to 0.04, yielding an overall watermark ratio of 20%. The watermark injection strength 𝜆 is set to 0.4; among 𝜆 ∈ {0.1, 0.2, 0.3, 0.4, 0.5}, we find that 𝜆 = 0.4 provides a stable trade-off between embedding similarity and verification significance across datasets. We reproduce the defense methods using their default settings. Each experiment is repeated three times with different random seeds, and we report the mean and standard deviation. Additional details are deferred to the supplementary material.

4.2

Utility Analysis

A practical EaaS watermark should preserve the semantic utility of the returned embeddings. We evaluate this property from two complementary perspectives: downstream task performance and geometric similarity. As shown in Table 1, Original denotes the unwatermarked reference setting, where the provider returns clean embeddings without watermark injection and the attacker trains the surrogate model directly on these clean embeddings. Compared with this setting, GeoMark preserves strong task utility in the no-attack setting and incurs only negligible accuracy changes across all four datasets. Table 2 further evaluates geometric fidelity by measuring the cosine similarity between original and protected embeddings. Transformation-based methods such as WET apply a global linear projection that substantially alters the coordinate system, leading to severe geometric distortion, including near-zero or even negative cosine similarity. In contrast, GeoMark consistently maintains similarity above 97.5% across all datasets, outperforming WARDEN and EspeW. These results are consistent with the design of GeoMark. Watermark injection is activated only within bounded local neighborhoods, and the shared target is itself a natural in-manifold embedding. As a result, the perturbation remains localized and semantically aligned with the intrinsic embedding geometry, jointly maintaining downstream utility and a strong copyright signal.

4.3

Robustness Analysis

We evaluate all defense methods under three representative categories of watermark removal attacks: CSE, paraphrasing, and dimensional perturbation. As shown in Table 1, GeoMark consistently maintains successful verification (𝑝 < 0.05) across all attack scenarios and all four datasets, while preserving competitive downstream utility. Compared with the baselines, GeoMark exhibits the most consistent robustness across diverse attack types. Resistance to Paraphrasing. Trigger-based methods such as WARDEN and EspeW remain vulnerable to advanced rewriting

Conference acronym ’XX, June 03–05, 2018, Woodstock, NY

Chen et al.

Table 1: Performance comparison of different defense methods on SST-2, Enron, AGNews, and MIND. For utility, higher accuracy is better (↑), while for ownership verification a lower 𝑝-value is better from the defender’s perspective (↓). In the Verif? column, ✓ and ✗ denote successful and failed copyright protection, respectively. We regard 𝑝 < 0.05 as successful protection. Defense

SST-2

Attack

Enron

AGNews

MIND

Verif?

Acc. (%)

𝑝 -value ↓

Acc. (%)

𝑝 -value ↓

Acc. (%)

𝑝 -value ↓

Acc. (%)

𝑝 -value ↓

93.54 ± 0.15

> 0.38

94.75 ± 0.15

> 0.87

93.43 ± 0.07

> 0.99

77.33 ± 0.06

> 0.99

✗

No Attack + CSE Attack + Paraphrasing Attack (NLLB) WARDEN + Paraphrasing Attack (GPT-4o-mini) + Dimension-shift Attack + Dimension-reduction Attack

93.50 ± 0.19 89.03 ± 0.53 93.31 ± 0.27 92.16 ± 0.62 93.27 ± 0.19 93.00 ± 0.46

< 10 −10

< 10−7 < 10 −10 < 10 −10 < 10 −10 < 10 −10

77.39 ± 0.06 75.69 ± 0.03 76.58 ± 0.10 76.93 ± 0.14 77.43 ± 0.07 77.25 ± 0.10

< 10 −10

< 10−5 < 10−6 < 10−4 < 10−9 < 10−9

93.48 ± 0.01 92.99 ± 0.27 92.54 ± 0.09 92.77 ± 0.03 93.43 ± 0.04 93.36 ± 0.09

< 10 −10

< 10 −4 < 10 −4 > 0.15 < 10−10 < 10 −10

94.63 ± 0.07 95.53 ± 0.42 93.53 ± 0.13 93.83 ± 0.27 94.42 ± 0.18 94.07 ± 0.13

< 10−9

> 0.05 < 10−9 < 10−5 < 10 −10 < 10 −10

✓ ✗ ✓ ✗ ✓ ✓

EspeW

No Attack + CSE Attack + Paraphrasing Attack (NLLB) + Paraphrasing Attack (GPT-4o-mini) + Dimension-shift Attack + Dimension-reduction Attack

93.35 ± 0.23 86.85 ± 0.31 93.16 ± 0.19 92.39 ± 0.27 93.39 ± 0.42 93.16 ± 0.07

< 10 −6 < 10 −9 > 0.11 > 0.11 < 10−6 < 10−6

94.65 ± 0.30 95.73 ± 0.17 93.17 ± 0.13 93.90 ± 0.20 94.80 ± 0.45 94.18 ± 0.17

< 10−5 < 10−9 < 0.02 < 0.01 < 10−5 < 10−4

93.42 ± 0.15 92.93 ± 0.23 92.49 ± 0.13 92.88 ± 0.02 93.60 ± 0.11 93.20 ± 0.05

< 10 −10 < 10−8 < 10 −9 < 10 −8 < 10 −10 < 10 −10

77.17 ± 0.11 75.59 ± 0.17 76.57 ± 0.03 76.88 ± 0.02 77.24 ± 0.03 77.00 ± 0.05

< 10−4 < 10−9 < 0.002 < 0.002 < 10−4 < 10−3

✓ ✓ ✗ ✗ ✓ ✓

WET

No Attack + CSE Attack + Paraphrasing Attack (NLLB) + Paraphrasing Attack (GPT-4o-mini) + Dimension-shift Attack + Dimension-reduction Attack

93.27 ± 0.42 87.19 ± 1.92 93.27 ± 0.42 92.78 ± 0.45 93.23 ± 0.23 –

< 10 −10 < 10 −10 < 10−10 < 10 −10 > 0.80 –

94.23 ± 0.22 95.55 ± 0.25 93.12 ± 0.20 93.63 ± 0.17 94.45 ± 0.20 –

< 10 −10 < 10 −10 < 10 −10 < 10 −10 > 0.96 –

93.21 ± 0.12 90.53 ± 2.64 93.32 ± 0.07 92.66 ± 0.05 93.27 ± 0.24 –

< 10 −10 < 10 −10 < 10 −10 < 10 −10 > 0.92 –

76.83 ± 0.05 75.12 ± 0.18 76.25 ± 0.13 76.68 ± 0.08 76.91 ± 0.12 –

< 10 −10 < 10 −10 < 10 −10 < 10 −10 > 0.72 –

✓ ✓ ✓ ✓ ✗ ✗

GeoMark (Ours)

No Attack + CSE Attack + Paraphrasing Attack (NLLB) + Paraphrasing Attack (GPT-4o-mini) + Dimension-shift Attack + Dimension-reduction Attack

93.23 ± 0.23 88.23 ± 0.65 93.46 ± 0.35 92.43 ± 0.12 93.62 ± 0.53 93.35 ± 0.11

< 10 −10 < 10 −6 < 0.002 < 10−4 < 10−10 < 10−7

94.72 ± 0.28 95.43 ± 0.22 93.63 ± 0.37 93.97 ± 0.23 94.85 ± 0.30 94.22 ± 0.13

< 10 −10 < 10 −10 < 10 −5 < 10−6 < 10 −10 < 10 −10

93.45 ± 0.05 92.97 ± 0.16 92.50 ± 0.17 92.81 ± 0.11 93.47 ± 0.01 93.24 ± 0.13

< 10 −10 < 10 −10 < 10 −10 < 10 −10 < 10 −10 < 10 −10

77.21 ± 0.16 74.86 ± 0.10 76.49 ± 0.07 76.85 ± 0.13 77.22 ± 0.09 77.06 ± 0.10

< 10 −10 < 10 −10 < 10 −10 < 10 −10 < 10 −10 < 10 −10

✓ ✓ ✓ ✓ ✓ ✓

Original

–

Table 2: Cosine similarity (%) between the original and protected embeddings. All values are reported in percentage form and therefore fall within the range of [−100, 100]. Higher values indicate better preservation of semantic utility. Method

SST-2

Enron

AGNews

MIND

WARDEN EspeW WET GeoMark

97.91 96.93 1.00 98.17

97.76 96.95 -1.47 97.99

97.59 97.09 -1.08 97.52

97.73 96.87 0.79 97.86

because their watermark activation is ultimately tied to surfaceform cues. This weakness becomes apparent under GPT-4o-mini paraphrasing, where both methods fail on SST-2. In contrast, GeoMark defines watermark activation over geometry-aware local neighborhoods rather than lexical triggers. As long as the rewritten text preserves its core semantics and the resulting embedding remains within the corresponding local neighborhood, watermark injection is still activated, enabling stable copyright verification under semantic-preserving paraphrases. Resistance to Dimensional Perturbation. Dimensional manipulation is particularly destructive for transformation-based defenses. WET relies on preserving a specific transformed coordinate structure, and therefore fails under the Dimension-shift attack and is not compatible with the Dimension-reduction setting, because

once the attacker truncates part of the embedding dimensions, the secret linear transformation matrix can no longer be correctly applied to the reduced representation. By contrast, GeoMark does not encode ownership evidence into fragile coordinate-wise signatures. Instead, it performs copyright verification through the relative affinity between suspicious embeddings and the shared natural target w. Because both the protected embeddings and the watermark target remain natural in-manifold representations, their geometric relationship is preserved under cyclic shifting and truncation, yielding consistently significant verification across all dimensionalperturbation settings. Resistance to CSE Attack. The CSE attack identifies suspicious samples within each cluster and reconstructs a removal direction to eliminate the watermark signal. GeoMark resists this attack not by relying on multiple unrelated watermark targets, but by creating a heterogeneous activated sample population under a shared attribution target. Although all activated samples are biased toward the same watermark target w, they originate from multiple geometry-separated local neighborhoods and are normalized on top of different original embeddings. As a result, the watermark does not form a single monolithic anomalous cluster that can be cleanly isolated and removed. Instead, it appears as a structured yet heterogeneous distribution embedded within natural semantic neighborhoods, making a single reconstructed removal target less effective. This mechanism is especially important on semantically

Geometry-Aware Localized Watermarking for Copyright Protection in Embedding-as-a-Service

Conference acronym ’XX, June 03–05, 2018, Woodstock, NY

Table 3: Verifiability and false-positive analysis for GeoMark and related clean-model comparisons. We report the clean-model (Original) behavior of GeoMark, an ablation without FPS, and a reimplemented RegionMarker baseline, together with GeoMark results under attack settings. Method

SST-2

Attack

Enron

AGNews

MIND

𝑝 -value ↓ Δcos (%) ↑ Δ𝐿2 (%) ↓ 𝑝 -value ↓ Δcos (%) ↑ Δ𝐿2 (%) ↓ 𝑝 -value ↓ Δcos (%) ↑ Δ𝐿2 (%) ↓ 𝑝 -value ↓ Δcos (%) ↑ Δ𝐿2 (%) ↓

GeoMark

Original No Attack CSE Attack Paraphrasing Attack (NLLB) Paraphrasing Attack (GPT-4o-mini) Dimension-shift Attack Dimension-reduction Attack

> 0.38 < 10−10 < 10 −6 < 0.002 < 10 −4 < 10 −10 < 10 −7

0.11 3.26 11.25 1.32 1.77 3.36 2.71

−0.20 −6.79 −7.20 −2.78 −3.69 −6.96 −6.28

> 0.87 < 10 −10 < 10 −10 < 10 −5 < 10 −6 < 10 −10 < 10 −10

−1.97 5.26 19.09 2.18 2.43 5.28 4.04

0.64 −11.71 −13.00 −4.93 −5.39 −11.75 −10.00

> 0.99 < 10 −10 < 10 −10 < 10 −10 < 10 −10 < 10 −10 < 10 −10

w/o FPS

Original

> 0.57†

0.02

−0.00

> 0.82

−1.65

2.88

> 0.54†

0.05

Original

> 0.17†

0.31

−0.62

< 0.006

1.32

−2.64

< 10−10

2.75

RegionMarker∗

−0.95 10.01 30.76 6.98 8.22 10.00 8.25

> 0.99 < 10 −10 < 10 −10 < 10 −10 < 10 −10 < 10 −10 < 10 −10

−2.66 9.24 36.02 7.50 8.46 9.17 7.41

−0.07

> 0.56

−0.38

0.76

−5.49

< 10 −10

2.11

−4.22

1.56 −19.19 −20.69 −13.94 −15.71 −19.18 −17.28

4.46 −19.25 −24.46 −16.07 −17.30 −19.19 −16.97

∗ RegionMarker denotes our reimplementation based on the method description in [37]. † Although the aggregated 𝑝 -value remains above the significance threshold, this setting exhibited instability with individual trials falling below the 0.05 significance threshold.

0.975 0.969

0.970

0.966

0.965

4.06

3.95

0.960 0.955

0.01

0.005

Reconstructed target cosine

0.01

0.015

Local coverage ratio

Post-CSE significance ( log10 (p))

12 10 10.00 8 6 4 2 0.958 0

log10 (p)

Cosine similarity

0.980 0.979

0.02 Threshold (p = 0.05)

Figure 3: Effect of local coverage ratio on CSE reconstruction on Enron. Increasing 𝜌 reduces reconstruction similarity and improves post-CSE verification significance.

complex datasets such as MIND, where GeoMark remains verifiable while WARDEN fails under CSE. This interpretation is further supported by the Enron analysis shown in Figure 3. Following WARDEN, we quantify CSE reconstruction quality by linearly combining the principal components removed by CSE to recover an approximate target embedding, and then measuring its cosine similarity to the true watermark target w. As the local coverage ratio 𝜌 increases, the reconstructed target becomes less similar to w, while post-CSE verification significance improves. For example, increasing 𝜌 from 0.005 to 0.02 reduces the reconstruction cosine from 0.979 to 0.958 and restores statistically significant verification after CSE. This suggests that even a moderate reduction in reconstruction fidelity can substantially weaken single-direction CSE removal. This trend is qualitatively consistent with the observation reported in WARDEN. Specifically, WARDEN reports that when 𝑅 = 2, the reconstructed target reaches a cosine similarity of 99.02, whereas increasing the number of watermark directions to 𝑅 = 5 reduces the similarity to 95.27 and improves robustness against CSE. At the same time, WARDEN also reports that using more watermark directions can introduce false-positive behavior in terms of 𝑝-value, including settings reported for 𝑅 ≥ 3. In contrast, GeoMark is not a multi-watermark scheme: it maintains a shared attribution

target and improves resistance to CSE through more heterogeneous localized activation, thereby obtaining anti-CSE benefits without introducing the multi-target verification risk associated with existing multi-watermark designs.

4.4

Verifiability and False-Positive Analysis

A central motivation of GeoMark is to improve verification reliability while maintaining robustness. We therefore analyze verifiability and false-positive behavior using the 𝑝-value, Δcos , and Δ𝐿2 metrics in Table 3. Low False-Positive Risk. When evaluated on the Original setting, i.e., the unwatermarked extraction setting, GeoMark consistently yields high 𝑝-values (𝑝 ≫ 0.05) across all datasets. Although Δcos fluctuates slightly around zero, none of these deviations is statistically significant. For example, on SST-2, Δcos is only 0.11%, while the corresponding 𝑝-value remains above 0.38. These results indicate that clean embeddings do not systematically exhibit abnormal affinity to the shared watermark target w, supporting GeoMark’s low false-positive behavior. Comparison with Region-Based Attribution. To further examine false-positive behavior in region-triggered verification, we additionally evaluate a RegionMarker-style baseline in the clean Original setting. As shown in Table 3, RegionMarker∗ produces statistically significant ownership signals on several unwatermarked datasets, including Enron, AGNews, and MIND, indicating elevated false-positive susceptibility. In contrast, GeoMark maintains cleanmodel 𝑝-values well above the significance threshold across all four datasets, supporting our claim that decoupling localized triggering from shared-target attribution improves verification reliability. Ablation on Geometry-Aware Anchors. To evaluate the role of the proposed geometric safety margin, we consider a variant denoted w/o FPS, which replaces FPS with random anchor selection. As shown in the bottom row of Table 3, this variant yields much less stable verification on the original model. Although the averaged 𝑝-value can still remain above the significance threshold, some individual runs fall below 0.05, indicating poor verification stability. This behavior is consistent with our design intuition: without FPS, anchors may be selected in semantically crowded regions that are insufficiently separated from the shared target w, thereby weakening the statistical boundary between activated and benign samples.

Conference acronym ’XX, June 03–05, 2018, Woodstock, NY

ACC (%)

95 90

100 94.65

94.55

95.15

10.00

94.75

10.00

80 75 70

100 93.80

93.60

90 10

93.40

93.85

93.60

10.00

10 6.40

5.83

5.49

4.87

5.56

75 70

1.53

1.26

2.17

2.79

2.93

0 7

94.65

94.60

94.55

94.80

10.00

80 75

95.40

95.20

95.10

95.65

95.30

21.94 19.84

21.40

22.69

23.64

20 15

80 5.58

P-value(−log10 ) ↑

(b) Paraphrasing Attack (NLLB)

5.04

5.65

6.01

5.65

10.00

75 70

30 25

90 10

Accuracy(%) ↑

(a) No Attack

100 94.75

5.41

80 5.43

P-value, ΔCos

100

Chen et al.

95.10

95.65

ΔCos(%) ↑

(d) CSE Attack

Figure 4: Hyper-parameter analysis on the number of anchors 𝐾 on the Enron dataset.

ACC (%)

95 90

100 94.60

94.55

95.00

10.00

94.70

94.80

10.00

100 93.90

93.60

93.75

93.80

93.50

10.00

10 85

75 70

6.57

5.75

4.87

5.43

1.11

0.04

0.06

0.08

0.1

0.02

2.31 1.26

0.04

1.74

0.06

2.56

3.53

0 0.08

94.65

94.80

94.90

10.00

94.70

95.30

95.20

95.00

23.93

25.75

10 85

5.04

6.58 5.55

23.36

0.02

0.04

17.87 10.00

0.06

0.08

0.1

20 15

10.00

3.95

P-value(−log10 ) ↑

(b) Paraphrasing Attack (NLLB)

5.86

35 30

10.00

0.1

Accuracy(%) ↑

(a) No Attack

100 94.50

19.84

2.95

3.80

0.02

5.41

P-value, ΔCos

100

0.02

0.04

0.06

0.08

0.1

ΔCos(%) ↑

(d) CSE Attack

Figure 5: Hyper-parameter analysis on local coverage ratio 𝜌 on the Enron dataset. This ablation highlights that FPS is important not merely for distributing anchors, but for enforcing the target–anchor separation that underlies reliable low-false-positive verification in practice.

4.5

Efficiency and Overhead Analysis

GeoMark introduces minimal online overhead for practical EaaS deployment. After the backbone encoder produces the original embedding, watermark triggering only requires computing the 𝐿2 distance to 𝐾 anchors, with time complexity O (𝐾𝑑); if activated, watermark injection adds only a vector addition and 𝐿2 normalization, with complexity O (𝑑). Under our default setting (𝑑 = 1536, 𝐾 = 5), the isolated watermark module incurs an average latency of only 0.017 ms per query on a single-thread Intel Xeon Gold 6226R CPU. Since GeoMark relies solely on lightweight geometric operations, this added cost is negligible in practice relative to embedding inference, suggesting excellent scalability for real-world EaaS system deployment. Beyond per-query latency, GeoMark also introduces negligible memory and deployment overhead. The online module stores only one shared target embedding, 𝐾 anchor embeddings, and their calibrated radii {𝜏𝑘 }, resulting in an O (𝐾𝑑) memory footprint. Anchor selection and radius calibration are performed offline, so deployment requires no modification to the backbone encoder or retraining of model parameters. This lightweight design makes GeoMark easy to integrate into existing EaaS pipelines.

As shown in Figure 4, varying the number of anchors from 4 to 8 leaves task accuracy highly stable across all attack settings. At the same time, a larger 𝐾 generally improves verification strength, especially under CSE and paraphrasing attacks. Under CSE, Δcos increases from 21.94% to 23.64% as 𝐾 grows, suggesting that a larger number of geometry-separated activation neighborhoods makes the activated sample population more diverse and therefore harder to neutralize with a single reconstructed removal direction. Under paraphrasing, increasing 𝐾 also improves verification significance, indicating that distributed local triggering provides more stable semantic coverage against rewriting-induced embedding drift. Figure 5 shows the effect of 𝜌 (𝜏𝑘 is determined by 𝜌 via Eq. (5) and is not independent). Task accuracy remains stable across all tested values. Meanwhile, increasing 𝜌 generally strengthens the detectable watermark signal and improves trigger stability under paraphrasing, by reducing the chance that a rewritten embedding drifts outside its activation neighborhood. Overall, our results show that GeoMark performs reliably across a wide practical range of hyperparameters. Notably, these trends are achieved without sacrificing task utility across the tested settings. More importantly, the trends in 𝐾 and 𝜌 validate the method’s geometric intuition: stronger robustness stems from better coverage and diversity of the locally activated samples, rather than from greater global distortion.

5 4.6

Hyper-parameter Analysis

To understand the sensitivity of GeoMark to its core geometric configurations, we analyze the effects of the number of anchors 𝐾 and the local coverage ratio 𝜌 on the Enron dataset.

Conclusion

In this paper, we study the robustness–utility–verifiability tension in Embedding-as-a-Service (EaaS) watermarking and propose GeoMark, a geometry-aware localized framework for copyright protection. GeoMark achieves distributed triggering with centralized

Geometry-Aware Localized Watermarking for Copyright Protection in Embedding-as-a-Service

attribution. Experiments on four benchmark datasets show that GeoMark preserves utility and geometric fidelity while remaining verifiable under paraphrasing, dimensional perturbation, and CSE attacks. Additional analyses confirm improved verification stability and low false-positive behavior. Our results further suggest that decoupling watermark triggering from ownership attribution is a principled way to improve robustness and verification reliability.

References [1] Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, et al. 2023. Gpt-4 technical report. arXiv preprint arXiv:2303.08774 (2023). [2] Yossi Adi, Carsten Baum, Moustapha Cisse, Benny Pinkas, and Joseph Keshet. 2018. Turning your weakness into a strength: Watermarking deep neural networks by backdooring. In 27th USENIX security symposium (USENIX Security 18). 1615–1631. [3] James Beetham, Navid Kardan, Ajmal Mian, and Mubarak Shah. 2023. Dual student networks for data-free model stealing. arXiv preprint arXiv:2309.10058 (2023). [4] Vance W Berger and YanYan Zhou. 2014. Kolmogorov–smirnov test: Overview. Wiley statsref: Statistics reference online (2014). [5] Zifeng Cheng, Zhonghui Wang, Yuchen Fu, Zhiwei Jiang, Yafeng Yin, Cong Wang, and Qing Gu. 2025. Contrastive prompting enhances sentence embeddings in llms through inference-time steering. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers). 3475–3487. [6] Marta R Costa-Jussà, James Cross, Onur Çelebi, Maha Elbayad, Kenneth Heafield, Kevin Heffernan, Elahe Kalbassi, Janice Lam, Daniel Licht, Jean Maillard, et al. 2022. No language left behind: Scaling human-centered machine translation. arXiv preprint arXiv:2207.04672 (2022). [7] Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. 2019. BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding. In Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, NAACL-HLT 2019. 4171–4186. [8] Yuval Eldar, Michael Lindenbaum, Moshe Porat, and Yehoshua Y Zeevi. 1997. The farthest point strategy for progressive image sampling. IEEE transactions on image processing 6, 9 (1997), 1305–1315. [9] Kawin Ethayarajh. 2019. How contextual are contextualized word representations? Comparing the geometry of BERT, ELMo, and GPT-2 embeddings. In Proceedings of the 2019 conference on empirical methods in natural language processing and the 9th international joint conference on natural language processing (EMNLP-IJCNLP). 55–65. [10] Yuchen Fu, Zifeng Cheng, Zhiwei Jiang, Zhonghui Wang, Yafeng Yin, Zhengliang Li, and Qing Gu. 2025. Token prepending: A training-free approach for eliciting better sentence embeddings from llms. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers). 3168– 3181. [11] Jun Gao, Di He, Xu Tan, Tao Qin, Liwei Wang, and Tie-Yan Liu. 2019. Representation degeneration problem in training natural language generation models. arXiv preprint arXiv:1907.12009 (2019). [12] Chi-Hsiang Hsiao, Yi-Cheng Wang, Tzung-Sheng Lin, Yi-Ren Yeh, and ChuSong Chen. 2025. MegaRAG: Multimodal Knowledge Graph-Based Retrieval Augmented Generation. arXiv:2512.20626 [cs.AI] https://arxiv.org/abs/2512. 20626 [13] Kalpesh Krishna, Yixiao Song, Marzena Karpinska, John Wieting, and Mohit Iyyer. 2023. Paraphrasing evades detectors of ai-generated text, but retrieval is an effective defense. Advances in neural information processing systems 36 (2023), 27469–27500. [14] Kalpesh Krishna, Gaurav Singh Tomar, Ankur P. Parikh, Nicolas Papernot, and Mohit Iyyer. 2020. Thieves on Sesame Street! Model Extraction of BERT-based APIs. In 8th International Conference on Learning Representations, ICLR 2020, Addis Ababa, Ethiopia, April 26-30, 2020. OpenReview.net. https://openreview. net/forum?id=Byl5NREFDr [15] Chankyu Lee, Rajarshi Roy, Mengyao Xu, Jonathan Raiman, Mohammad Shoeybi, Bryan Catanzaro, and Wei Ping. 2024. Nv-embed: Improved techniques for training llms as generalist embedding models. arXiv preprint arXiv:2405.17428 (2024). [16] Hao Li, Yubing Ren, Yanan Cao, Yingjie Li, Fang Fang, and Xuebin Wang. 2025. From Essence to Defense: Adaptive Semantic-aware Watermarking for Embedding-as-a-Service Copyright Protection. arXiv:2512.16439 [cs.CR] https://arxiv.org/abs/2512.16439 [17] Xianming Li and Jing Li. 2024. Bellm: Backward dependency enhanced large language model for sentence embeddings. In Proceedings of the 2024 Conference

Conference acronym ’XX, June 03–05, 2018, Woodstock, NY

of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers). 792–804. [18] Yupei Liu, Jinyuan Jia, Hongbin Liu, and Neil Zhenqiang Gong. 2022. Stolenencoder: stealing pre-trained encoders in self-supervised learning. In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security. 2115–2128. [19] Ilya Loshchilov and Frank Hutter. 2017. Decoupled weight decay regularization. arXiv preprint arXiv:1711.05101 (2017). [20] Elias Lumer, Alex Cardenas, Matt Melich, Myles Mason, Sara Dieter, Vamse Kumar Subbiah, Pradeep Honaganahalli Basavaraju, and Roberto Hernandez. 2025. Comparison of Text-Based and Image-Based Retrieval in Multimodal Retrieval Augmented Generation Large Language Model Systems. arXiv:2511.16654 [cs.CL] https://arxiv.org/abs/2511.16654 [21] Vangelis Metsis, Ion Androutsopoulos, and Georgios Paliouras. 2006. Spam filtering with naive bayes-which naive bayes?. In CEAS, Vol. 17. Mountain View, CA, 28–69. [22] Tribhuvanesh Orekondy, Bernt Schiele, and Mario Fritz. 2019. Knockoff nets: Stealing functionality of black-box models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. 4954–4963. [23] Wenjun Peng, Jingwei Yi, Fangzhao Wu, Shangxi Wu, Bin Bin Zhu, Lingjuan Lyu, Binxing Jiao, Tong Xu, Guangzhong Sun, and Xing Xie. 2023. Are you copying my model? protecting the copyright of large language models for eaas via backdoor watermark. In Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers). 7653–7668. [24] Rashmi R and Vidyadhar Upadhya. 2025. Multimodal RAG for Unstructured Data:Leveraging Modality-Aware Knowledge Graphs with Hybrid Retrieval. arXiv:2510.14592 [cs.LG] https://arxiv.org/abs/2510.14592 [25] Yaling Shen, Zhixiong Zhuang, Kun Yuan, Maria-Irina Nicolae, Nassir Navab, Nicolas Padoy, and Mario Fritz. 2025. Medical multimodal model stealing attacks via adversarial domain alignment. In Proceedings of the AAAI Conference on Artificial Intelligence, Vol. 39. 6842–6850. [26] Anudeex Shetty, Yue Teng, Ke He, and Qiongkai Xu. 2024. WARDEN: MultiDirectional Backdoor Watermarks for Embedding-as-a-Service Copyright Protection. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), Lun-Wei Ku, Andre Martins, and Vivek Srikumar (Eds.). Association for Computational Linguistics, Bangkok, Thailand, 13430–13444. doi:10.18653/v1/2024.acl-long.725 [27] Anudeex Shetty, Qiongkai Xu, and Jey Han Lau. 2025. WET: Overcoming Paraphrasing Vulnerabilities in Embeddings-as-a-Service with Linear Transformation Watermarks. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), Wanxiang Che, Joyce Nabende, Ekaterina Shutova, and Mohammad Taher Pilehvar (Eds.). Association for Computational Linguistics, Vienna, Austria, 23024–23043. https: //aclanthology.org/2025.acl-long.1122/ [28] Richard Socher, Alex Perelygin, Jean Wu, Jason Chuang, Christopher D Manning, Andrew Y Ng, and Christopher Potts. 2013. Recursive deep models for semantic compositionality over a sentiment treebank. In Proceedings of the 2013 conference on empirical methods in natural language processing. 1631–1642. [29] Gemini Team, Rohan Anil, Sebastian Borgeaud, Jean-Baptiste Alayrac, Jiahui Yu, Radu Soricut, Johan Schalkwyk, Andrew M Dai, Anja Hauth, Katie Millican, et al. 2023. Gemini: a family of highly capable multimodal models. arXiv preprint arXiv:2312.11805 (2023). [30] Hugo Touvron, Thibaut Lavril, Gautier Izacard, Xavier Martinet, Marie-Anne Lachaux, Timothée Lacroix, Baptiste Rozière, Naman Goyal, Eric Hambro, Faisal Azhar, et al. 2023. Llama: Open and efficient foundation language models. arXiv preprint arXiv:2302.13971 (2023). [31] Florian Tramèr, Fan Zhang, Ari Juels, Michael K Reiter, and Thomas Ristenpart. 2016. Stealing machine learning models via prediction { APIs } . In 25th USENIX security symposium (USENIX Security 16). 601–618. [32] Yusuke Uchida, Yuki Nagai, Shigeyuki Sakazawa, and Shin’ichi Satoh. 2017. Embedding watermarks into deep neural networks. In Proceedings of the 2017 ACM on international conference on multimedia retrieval. 269–277. [33] Eric Wallace, Mitchell Stern, and Dawn Song. 2020. Imitation Attacks and Defenses for Black-box Machine Translation Systems. In Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP), Bonnie Webber, Trevor Cohn, Yulan He, and Yang Liu (Eds.). Association for Computational Linguistics, Online, 5531–5546. doi:10.18653/v1/2020.emnlp-main.446 [34] Zongqi Wang, Baoyuan Wu, Jingyuan Deng, and Yujiu Yang. 2025. Robust and Minimally Invasive Watermarking for EaaS. In Findings of the Association for Computational Linguistics: ACL 2025, Wanxiang Che, Joyce Nabende, Ekaterina Shutova, and Mohammad Taher Pilehvar (Eds.). Association for Computational Linguistics, Vienna, Austria, 2167–2191. doi:10.18653/v1/2025.findings-acl.112 [35] Fangzhao Wu, Ying Qiao, Jiun-Hung Chen, Chuhan Wu, Tao Qi, Jianxun Lian, Danyang Liu, Xing Xie, Jianfeng Gao, Winnie Wu, et al. 2020. Mind: A large-scale dataset for news recommendation. In Proceedings of the 58th annual meeting of the association for computational linguistics. 3597–3606. [36] An Yang, Anfeng Li, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chang Gao, Chengen Huang, Chenxu Lv, et al. 2025. Qwen3 technical

Conference acronym ’XX, June 03–05, 2018, Woodstock, NY

report. arXiv preprint arXiv:2505.09388 (2025). [37] Shufan Yang, Zifeng Cheng, Zhiwei Jiang, Yafeng Yin, Cong Wang, Shiping Ge, Yuchen Fu, and Qing Gu. 2025. RegionMarker: A Region-Triggered Semantic Watermarking Framework for Embedding-as-a-Service Copyright Protection. arXiv:2511.13329 [cs.CL] https://arxiv.org/abs/2511.13329 [38] Jialong Zhang, Zhongshu Gu, Jiyong Jang, Hui Wu, Marc Ph Stoecklin, Heqing Huang, and Ian Molloy. 2018. Protecting intellectual property of deep neural networks with watermarking. In Proceedings of the 2018 on Asia conference on computer and communications security. 159–172. [39] Xiang Zhang, Junbo Zhao, and Yann LeCun. 2015. Character-level convolutional networks for text classification. Advances in neural information processing systems

Chen et al.

28 (2015). [40] Xueyan Zhang, Jinman Zhao, Zhifei Yang, Yibo Zhong, Shuhao Guan, Linbo Cao, and Yining Wang. 2025. UORA: Uniform orthogonal reinitialization adaptation in parameter efficient fine-tuning of large models. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers). 11709–11728. [41] Jinman Zhao, Xueyan Zhang, Jiaru Li, Jingcheng Niu, Yulan Hu, Erxue Min, and Gerald Penn. 2025. Tiny Budgets, Big Gains: Parameter Placement Strategy in Parameter Super-Efficient Fine-Tuning. In Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing. 6326–6344.

Record · ID 10264 · SHA-256 12c838ffb372274a
Conceptio Open Knowledge Archive — every document is proof-bundled with source, license, and retrieval metadata.