HaloMark: A Spectral Threshold for Embedding-Vector Watermarking under C2PA

1

HaloMark: A Spectral Threshold for Embedding-Vector Watermarking under C2PA

arXiv:2608.08645v1 [cs.CR] 9 Aug 2026

Tarun Sharma

Abstract—Foundation-model embeddings are now a primary data asset, but the content-provenance machinery built for images and audio does not transfer to them. C2PA binds to an asset with a stable bit-level or perceptual identity; embeddings have neither, since quantisation, projection, fine-tuning, and windowed averaging reshape them in normal use and break any fixed hash. We present HaloMark, a watermark for embedding vectors cryptographically bound to a C2PA manifest. It composes four standard primitives—a block-diagonal orthogonal rotation, public whitening, an input-dependent LSH commitment, and a per-vector nonce—around one protocol change: the producer signs the LSH commitment c into the C2PA sidecar, and the verifier reads c from the manifest instead of recomputing it. Recomputing is fragile under whitening, which flips the commitment bucket on 62% of inputs at cos = 0.96; reading the signed c reduces the verifier’s score to T = Tnull +β(A)·ε, so security turns on a single scalar β, which we bound rigorously for linear and non-adaptive attackers and characterise empirically for the adaptive case. We evaluate against an adversary holding polynomially many clean/watermarked pairs under one key with full sidecar visibility, across eight baselines and ten adaptive attackers including denoising-autoencoder removal. The eleven encoders separate at an empirical threshold eff_rank(Σ)/d ≈ 0.19: above it, detection AUROC stays at 0.98 or higher across every in-budget attack on the three encoders we sweep in full, and at 0.965 or higher under single-seed DAE removal on the rest; below it every variant we tested fails. Why the threshold is dimension-uniform is left open. Deployed as a Qdrant admission filter, the verifier runs at 284 µs and 24 bytes of sidecar per vector, validated end-to-end against three C2PA reference-SDK bindings. Index Terms—Watermarking, embeddings, content provenance, C2PA, locality-sensitive hashing, known-plaintext attack, vector databases, information forensics.

I. I NTRODUCTION Embeddings have become a primary data asset. Retrievalaugmented generation, semantic search, recommendation, biometric identification, and content provenance all depend on dense vectors produced by foundation models, and those vectors are now treated as content in their own right: uploaded to vector databases, shared across organisational boundaries, sold as datasets, and ingested by downstream models. C2PA-style provenance binding does not extend to dense vectors. Routine quantisation, projection, and fine-tuning reshape every bit, so a cryptographic hash on the embedding rarely survives legitimate use. We want a watermark on the embedding itself that survives those routine transformations, leaves cosinebased downstream tasks intact, is cryptographically bound to a C2PA manifest, and verifies at microsecond scale. Existing embedding watermarks address some of these properties individually but none together, and none under a threat model T. Sharma is an independent researcher (e-mail: tarun.sharma@ieee.org). Reproducible code and data: https://github.com/tarun-ks/halomark.

that includes a denoising-autoencoder attacker with polynomial (x, x′ ) training pairs. The protocol idea: publish the commit A key-derived embedding watermark wants a contentdependent signature in which the per-block perturbation si depends on a commitment c = Commit(K, x; nonce) over the input. SEAL [1] uses this pattern for image watermarks, with a verifier that recomputes c from the perturbed test input and re-derives the expected signatures. Recomputing c at verification time is fragile under whitening. Whitening W = (Σcalib+λreg I)−1/2 amplifies p perturbations along low-eigenvalue directions by up to 1/ λreg ≈ 100×. The recompute-commit verifier therefore loses roughly 20 percentage points of TPR on small-perturbation attacks even when the watermark signal survives. §IV-B reports the full bucket-flip rate by attack class. Our fix is to publish c in the C2PA-signed sidecar. The producer outputs (x′ , n, c), the manifest signs all three fields, and the verifier reads c directly without recomputing it from x̂. Tampering with c, n, or x′ breaks the C2PA signature before Verify runs. Figure 1 shows the protocol layout. Contributions The headline finding is empirical. Across 11 embedders and six structurally distinct perturbative approaches we find an empirical spectral threshold (§VI-D) near eff_rank(Σ)/d ≈ 0.19: above it the construction defends at AUROC 0.96 or higher; below, every approach collapses to a manifold-projection attacker trained on as few as 10 KPA pairs. The threshold is dimension-uniform but not yet derived; why is left open. Whether a perturbative embedding watermark exists at all on a given encoder is decided by the encoder’s spectrum, not by the watermark design. We adopt the manifold-aligned variant as the default, gaining 10 to 19 percentage points of β over a random-Q baseline on above-threshold encoders. Three supporting contributions make the upper half of that story attainable. First, the published-commit verifier protocol (§IV-A) reduces the security argument to a single signature-retention scalar via the linear decomposition of Eq. (3) (Lemma 1). Second, a closed-form Wiener bound (Theorem 1) characterises the optimal adaptive-linear p attacker through a Gaussian first-order term βchar ≈ ϕ(ν ∗ )/ d ρ(ν ∗ ) within about 13% of the empirical Wiener attack, plus a conservative Cauchy– Schwarz lower bound (β ≥ 0.136 on MiniLM, well below the empirical floor of 0.851 but distribution-free); both are computable in O(d) from the encoder’s eigenspectrum. Third, Mode C (§IV-F) adds a text-MinHash sketch to the C2PA

2

Producer

clean x

whiten W = Σ−1/2

rotate Q (block-diag)

LSH-commit c

sign {si } = PRF(K, n, c)

add ε si → x′

publish c

C2PA-signed sidecar
x′ , n, c read c (no recompute) Verifier

test x̂

whiten W

rotate Q

derive {si } = PRF(K, n, c)

score T = ⟨Qx̂, s⟩

T ≥ τ?

Fig. 1. Published-commit verifier protocol. The producer’s LSH commit c travels with (x′ , n) in the C2PA sidecar (centre). The verifier reads c from the manifest to derive {si } instead of recomputing Commit(K, x̂). The red edge is the only protocol change vs. a recompute-commit verifier; everything else is standard C2PA-bound watermark verification. §IV-B measures the fragility this change removes.

manifest, rejecting 92% of multi-attempt paraphrase attacks remain attached. HaloMark provides exactly this: a watermark while accepting 100% of routine perturbations, and so closes embedded into the vector itself, cryptographically bound to a the paraphrase regime in RAG-style deployments where source C2PA manifest such that neither the vector nor the manifest text accompanies the embedding. can be independently substituted without breaking verification. Deployment-scale results (§VI-E): cross-corpus validation, 64-key multi-tenant isolation up to a 32-key collusion DAE, selfB. C2PA manifests calibration (Mode B), 4-bit-rep4 multi-bit payload decoding, The C2PA specification [2] defines a signed manifest Qdrant 1.17 admission-filter integration at 284 µs per vector, containing a sequence of assertions about a piece of content and end-to-end interop with three independent language bind— origin, processing history, cryptographic hashes, and author ings of the C2PA reference SDK. signatures. Manifests are designed for media. Two properties Threat model: The C4 attacker holds polynomial-many ′ matter for HaloMark: (a) the manifest contains a deterministic (x, x , n, c) tuples under one key plus full sidecar visibility, claim hash that can be hashed into a key, and (b) the manifest with no verifier-oracle access. We exercise a 14-row standard signature allows a verifier to authenticate manifest content attack sweep together with a series of strong DAE variants: 6 without trusting the transport. HaloMark treats the manifest as training on up to 10 pairs, 4× width, four residual layers, an external oracle and does not modify the C2PA specification. FiLM conditioning, a 65,536-bucket gating head, spectrally normalised denoisers with total Lipschitz constant in [1.5, 300], natively budget-constrained DAEs, and a within-C4 surrogate- C. Threat model: Multi-Party Adversary (MPA) PGD attacker. Above the threshold, AUROC stays at 0.99 or We consider a pipeline with three parties: an embedding better across every in-budget attacker we tried; below it even producer E (typically a model provider) who generates a 10-pair DAE defeats the watermark. watermarked embeddings; a vector-store operator V who indexes and serves embeddings; and a consumer C who II. BACKGROUND AND T HREAT M ODEL retrieves embeddings and uses them downstream. HaloMark’s A. Embeddings as protected content threat model assumes that any one of these parties may be d Dense neural embeddings are vectors in R , typically with adversarial, but the C2PA-signed manifest’s signing key is not d ∈ [384, 4096], produced by a foundation model on input compromised. Formally, an MPA adversary A has the following capabilities: content. The relevant invariants are: cosine similarity between related content should be high; cosine similarity between • C1 (Observation). A sees any watermarked embedding unrelated content should be low; the specific coordinate x′ and the corresponding C2PA manifest m. values are not semantically meaningful, only their geometric • C2 (Routine post-processing). A may apply dimensionrelationships are. This last property — rotation invariance of ality reduction (PCA, random projection), quantisation utility — is exactly what HaloMark exploits: we can rotate (int8, int4, 1-bit), normalisation, clipping, and convex the embedding into a secret basis, perturb selected coordinates, combination (averaging). ′ and rotate back, without disturbing any downstream task that • C3 (Fine-tuning drift). A may ingest x into a down′′ depends only on cosine similarity between embeddings. stream model and produce a perturbed x after gradient In a deployed RAG or semantic-search system, embeddings updates. are produced once and then ingested into a vector database, • C4 (Targeted removal under known-plaintext access where they are queried by cosine similarity. The vector is and a semantic-preservation budget). A computes x̃ the asset; the manifest must travel with it for provenance to such that cos(x̃, xclean ) ≥ δC4 and Verify(K, x̃, τdet )

3

rejects, where xclean is the original unwatermarked em• We do not address adaptive adversaries with access to a bedding and δC4 is a deployment-driven cosine threshold Verify oracle under the target key. Such an adversary (canonical operational minimum: δC4 =0.95). can in principle learn the watermark subspace through Why δC4 =0.95. δC4 is a single deployer-chosen value; staircase attacks; HaloMark assumes the verifier exposes attacks past whichever value is chosen count as destroying no binary-decision interface to untrusted parties. We the asset for that deployment. δC4 =0.95 is conservative discuss deployment hardening in §VII. • We do not defend against passive side-channel leakage for biometric, deduplication, and near-duplicate detection pipelines [3], [4]; broad ranked retrieval (MS MARCO (timing, cache) from the detection oracle. MRR@10) admits a looser δC4 =0.85 (the MRR@10 These are orthogonal security properties better handled by deltas at cos ∈ {0.95, 0.85, 0.80} are in §VI-B). We report C2PA, by standard key-management, and by deployment-side headline numbers at δC4 =0.95 and mark rows admitted hardening, respectively. only at the relaxed 0.85 budget (Table II, ‡). The L2distance equivalent on unit-normalised embeddings is D. Security goals p 2(1 − δC4 ). HaloMark targets three properties, stated informally: Adversary access. A has access to polynomial-many ′ • Imperceptibility. A watermarked embedding x is indistintuples (xi , x′i , noncei , ci ) under the same key — arbitrarily guishable from an unwatermarked x from the perspective many clean/watermarked pairs together with the producerof any downstream cosine-similarity-based task, up to an published per-vector nonce and commitment from the adjustable parameter ε (§VI-B). manifest sidecar (§IV-A) — and full knowledge of the • Robustness. For all A-attacks in C2–C4, detection AUHaloMark algorithm. A does not have access to the key K ROC ≥ τrobust with τrobust ≥ 0.85 on every C4-valid itself, nor to a Verify oracle (excluded in this section, operating point (§VI-C). reinforced in §VII). The published (noncei , ci ) are strictly • Unforgeability. For all A attempts at C5, verification more information than a recompute-commit construction success probability is at most 2−λ for security parameter would give A; we still defend (§IV-D) under this stronger λ (formalised as Thm. S1, App. S-I). model. Formal definitions appear in Appendix S-I. Outcome accounting. Attacks that achieve Verify rejection by perturbing x′ past the budget (cos(x̃, xclean ) < III. R ELATED W ORK δC4 ) destroy the asset rather than strip the watermark and so are not counted as successful removal — utility A. Positioning relative to prior watermarks loss is itself the deployment-side defence. C4 directly HaloMark differs from prior watermarks on four axes: KPAmirrors the known-plaintext-style forgery and removal resist (defends polynomial (x, x′ )-pair attackers), per-vector attacks shown by Müller et al. [5] and follow-up work [6], freshness, content-dependence, and C2PA-binding. Existing [7] to break content-agnostic image and diffusion-model EaaS embedding watermarks (EmbMarker [9], WARDEN [10], watermarks, extended to embeddings and to the per-outputWET [11], ESpeW [12]) have none of these (they target randomness setting of Bileve [8]. §IV-B reproduces the paraphrase/ clustering removal, not KPA). SEAL [1] adds analogous attack against a content-agnostic ablation of content-dependence for images but recomputes the commit HaloMark and motivates the full construction of §IV-A. at verify time; Bileve [8] adds per-token freshness for LMs; • C5 (Forgery). A attempts to produce a fresh embedding z MetaSeal [13] adds C2PA-binding for images. Only HaloMark ′ and manifest m such that HaloMark verification accepts satisfies all four for embedding vectors — the published-commit ′ (z, m ). step (§IV-A) is what makes the all-yes row tractable under ′ • C6 (Collusion). A observes many (x , m) pairs and whitening on retrieval encoders. attempts to extract the master key or block structure. We formalise the game-based definitions in Appendix S-I. Outside the MPA model: We do not address attacks that compromise the C2PA signing key itself. • We do not address adversaries who control the embedding model’s training data at origin. • We assume the calibration-corpus registry (which serves Σcalib keyed by calibration_corpus_id) is trusted at the same level as a C2PA-CA. A compromised registry could publish a low-rank backdoored Σ that aligns the watermark with attacker-knowable directions; we recommend either pinning the SHA-256 of Σ in the producer’s manifest or recomputing Σ locally from a publicly-available corpus. We discuss this in §IV-E and §VII.

•

B. Embedding watermarking Foundational deep-NN watermarking starts with Uchida et al. [14] (in-weight payloads) and Adi et al. [15] (backdoor-based ownership claims), systematised in Lukas et al. [16]. Saberi et al. [17] raise the bar for what counts as a strong adversary. The closest prior art is the Embeddings-as-a-Service (EaaS) watermarking line, which protects copyright over dense embeddings against imitation and removal: EmbMarker [9] (trigger-based, content-agnostic direction); WARDEN [10] (multi-orthogonal spread for clustering-removal resistance); ESpeW [12] (sparse content-dependent mask); WET [11] (linear-transformation pattern). None target a polynomial known-plaintext adversary. Two 2025 semantic EaaS watermarks postdate this design: RegionMarker [18] triggers watermarks on PCA-defined

4

regions, and SemMark [19] uses LSH to partition the TABLE I N OTATION . T HE RETENTION SCALAR β IS ALWAYS SUBSCRIPTED BY semantic space and inject region-local signatures; both WHICH QUANTITY IS MEANT (βchar , βemp , βmin ); BARE β(A) DENOTES defend model-extraction copyright rather than per-vector THE RETENTION OF A SPECIFIC ATTACKER A. N OTE W ( WHITENING provenance, and neither admits a polynomial KPA adversary. MATRIX ) AND THE BLOCK SUBSET W ARE DISTINCT OBJECTS THAT SHARE A LETTER . A concurrent geometry-aware localized scheme [20] likewise places the mark by data geometry but stays within the same symbol meaning EaaS-copyright model. SemMark’s LSH partitioning is the Encoder geometry closest prior use of locality-sensitive hashing, but it hashes d embedding dimension to place the watermark, whereas we publish the commitment N, b blocks and block size (b=d/N ) w number of watermark-carrying blocks c in the C2PA sidecar so the verifier never recomputes it. Σcalib , µ calibration covariance and mean Our WET-approx re-implementation collapses to AUROC λi eigenvalues of Σcalib ≈ 0.50 under direction-oracle (§VI-E), empirically confirming eff_rank(Σ)/d spectral threshold statistic (≈ 0.19) κeff effective condition number λmax /λ1% the structural argument. Faithful ports of EmbMarker and W whitening matrix (Σcalib +λreg I)−1/2 WARDEN reduce cell-by-cell to AddDir and WET-approx λreg whitening regulariser (default 10−4 ) on our threat model (Table VI). Q block-diagonal orthogonal rotation Adjacent constructions reused here: SEAL [1]’s LSHProtocol and crypto commit pattern (originally for images); Bileve [8]’s per-output K, n, c content key, per-vector nonce, published commit W (set) w-element watermark block subset (not W ) randomness for LM token watermarks; MetaSeal [13]’s C2PAsi , ε per-block signature and watermark amplitude binding pattern. The published-commit step (§IV-A) is the new k, B, P, τ LSH dimension, buckets, projection, cutoffs piece: SEAL recomputes c at the verifier, which is fragile Detection under whitening (§IV-B); we publish c in the C2PA sidecar so T, Tnull verifier score and its H0 component the verifier never recomputes it. Token-stream text watermarks τdet , α detection threshold, operating FPR ζ sub-Gaussian slack (Assumption 1) (KGW [21], Aaronson [22], Christ et al. [23]) and pixel-space image watermarks (HiDDeN [24], RoSteALS [25]) live in Attack model A, q attacker, verifier-oracle query budget different signal domains; we cite Tree-Ring [26] and Stable δC4 cosine-fidelity budget (default 0.95) Signature [27] as the diffusion-output reference. We measure β(A) signature retention ∈ [0, 1] (load-bearing scalar) mutual non-interference with KGW on 500 MS-MARCO βchar Wiener Gaussian characterisation βemp measured Wiener-attack retention (0.752) passages (§VI-E), consistent with the expected orthogonalβmin empirical strict-C4 floor (0.94) composition regime. R∗ (ν), ν ∗ Wiener filter and its cosine-pinned parameter Forgery and known-plaintext attacks on watermarks: The C4 threat model with explicit polynomial (x, x′ ) access plus C2PA-sidecar visibility responds to recent attacks on to embedding vectors with a public nonce per vector (PRF content-agnostic watermarks: Müller et al. [5] demonstrate reduction in Appendix S-I-D). Content-dependent commitments black-box semantic-watermark forgery from a single observed adapt SEAL’s [1] LSH-commit pattern to the non-watermark pair; Dong et al. [6] and Zhu et al. [7] extend with diffusion- subspace of Qx; the producer-published commit step is, to regeneration attacks. §IV-B reproduces the analogous attack our knowledge, new. The block-diagonal orthogonal rotation, against a content-agnostic ablation of HaloMark. which appears in adjacent contexts [31], [32], is repurposed Position relative to prior art: The contribution is not as a key-indexed partition into signal-carrying and signal-free the individual mechanisms but the composition that closes a blocks. Vector-database payload-filtering access control [33] measurable attack class on embeddings under a clean security is complementary: it controls who retrieves a vector, while analysis. Two third-party-pattern baselines from the EaaS line HaloMark controls what the vector claims about itself after port the published structural choices to our threat model: retrieval. SEAL-only and ESpeW-port. Both attain baseline AUROC ≈ 0.71 and survive direction-oracle (content-dependence is IV. T HE H ALO M ARK C ONSTRUCTION sufficient for the single-pair attack) but collapse to AUROC A. Core scheme ≈ 0.55 under DAE-105 (no per-vector nonce). The full The protocol publishes the per-vector LSH commitment HaloMark composition closes the gap to AUROC ≥ 0.997. §III-A makes this concrete on four axes (KPA-resist, per-vector in the C2PA sidecar so that the verifier reads it rather than recomputing it from the perturbed input. Around that decision freshness, content-dependence, C2PA-binding). the construction composes four standard primitives: a blockdiagonal orthogonal rotation, public-Σ whitening, a SEAL-style C. Adjacent primitives we adapt content-dependent LSH commitment, and a per-vector public Three components are adapted from prior work and one nonce in the spirit of Bileve. Each component is familiar combination is new. Tikhonov-regularised whitening, estab- individually, but their composition with the published commit lished in sentence-embedding work [28]–[30], is used here as is what closes the attack class we evaluate. a security primitive (manifold-projection defence, §IV-A), not Let d be the embedding dimension partitioned into N equalfor retrieval quality. Per-vector freshness adapts Bileve’s [8] size blocks of size b = d/N . HaloMark consists of four per-output-randomness pattern from token-stream watermarks routines: KeyGen, Commit, Embed, and Verify.

5

KeyGen(pp, m): K ← HKDF(claim_hash(m), "HaloMark"). Sample Q ∈ O(d) block-diagonal from PRFK ("Q") via Householder [34]; sample P ∈ Rk×(N −w)b from PRFK ("commit_proj") with unit-L2 rows; set τ to the B−1 equi-probable quantile cutoffs of N (0, 1/((N − w)b)). Commit(K, x; n): W is a w-element subset of {1, . . . , N } drawn from PRFK ("blocks", n); y = W (x − µ), u = y/∥y∥; v = (Qu) on the (N − w) non-watermark blocks. The scale-invariant LSH on the unit direction of v is
cj = #{ t ∈ τ : (P v/∥v∥ )j ≥ t }, j = 1, . . . , k, (1)

B. The direction-oracle attack on content-agnostic constructions

Direction-oracle: the structural attack content-agnostic constructions cannot survive: Any embedding watermark whose signature si does not depend on the input x admits a single-pair known-plaintext attack analogous to the forgery and removal attacks recently demonstrated against image and diffusion-model watermarks by Müller et al. [5] and follow-up work [6], [7]: an adversary with one pair (x0 , x′0 ) under key K recovers the constant perturbation δK = x′0 − x0 , then for any target x′ outputs x̃ = x′ − δK , defeating Verify with score collapsing to the null distribution. AUROC drops to 0.500 on the very first known pair, regardless of npairs . We verify and Commit returns (c, W ). this empirically on a content-agnostic ablation of our own Signatures: For each block i ∈ W the signature is construction (§VI-E, the “content-agnostic ablation” row of Table VI): baseline AUROC = 1.000, post-attack AUROC = si (c, n, K) = ε · gi / ∥gi ∥, (2) 0.500 ± 0.0002 across 10 seeds and n 5 pairs ∈ {1, 10, . . . , 10 }. Why a content-dependent commitment is the unique fix: where gi ∈ Rb is drawn from the PRG seeded by Defeating the direction-oracle attack requires that δK (x) vary HKDFK ("sig" ∥ i ∥ c ∥ n). with x in a way the attacker cannot extrapolate. Two candidate Embed(K, x) → (x′ , n, c): fixes: $ 1) Sample fresh nonce n ← − {0, 1}λn . • Per-input random nonce alone (no commitment): the nonce 2) (c, W ) ← Commit(K, x; n). is producer-published in the manifest, so the attacker reads 3) y ← W (x − µ); u ← y/∥y∥; u′ ← Qu. 4) For each i ∈ W : u′i ← u′i + si (c, n, K). it; an attacker with npairs pairs trains a regression to 5) x′ ← W −1 (Q⊤ u′ ) · ∥y∥ + µ. predict δ(x, nonce). Empirically broken at npairs = 105 ′ 6) Output (x , n, c) to the manifest sidecar. by a denoising autoencoder. Verify(K, x̂, n, c, τdet ): • Content-dependent commitment (the HaloMark choice): 1) Recover W from PRFK ("blocks", n). si is a function of Commit(K, x; nonce), an LSH bucket 2) u ← W (x̂ − µ)/∥·∥. 1 P on the non-watermark subspace of Qx. Two different test 3) T ← w i∈W ⟨(Qu)i , si (c, n, K)⟩/∥si ∥. 4) Return accept iff T ≥ τdet . inputs with cos(xa , xb ) < 0.95 land in different commit buckets with high probability, so the attacker’s recovered Critical: step 3 uses the producer’s published c from the δ at (x0 , nonce0 ) does not transfer; the attack reduces to manifest. The verifier does not recompute Commit(K, x̂). a per-bucket recovery, requiring npairs · B k = npairs · 216 This is the protocol move that grounds Lemma 1. effective pairs to mount on any single bucket. Why publish c?: The natural alternative is for the verifier to compute c from x̂ itself. An earlier draft of the construction Empirically, HaloMark post-attack AUROC remains ≥ 0.9999 5 took this route, but we abandoned it because whitening up to npairs = 10 (§VI-C, Table II). The commitment is the amplifies p perturbations in W ’s low-eigenvalue directions by unique component among these candidates that simultaneously up to 1/ λreg ≈ 100× at our defaults. A benign attack preserves C5 imperceptibility (cos change at the producer level with ∥x̃ − x′ ∥ = D in the original space can move the LSH is identical) and breaks the single-pair extrapolation. The whitening × LSH commit-flip measurement: We input far enough to flip a large fraction of bucket assignments; measure the bucket-flip rate of the recompute-commit verifier the resulting wrong signatures collapse the score even when on representative attacks (5 seeds, default parameters; perthe underlying watermark survives. §IV-B reports the full attack JSON in the released artefact). Even on attacks the bucket-flip rates by attack class. Publishing c in the manifest underlying signature survives, the rate is substantial: 5% on sidecar breaks this dependence: detection now follows signature quant-int8 (cos ≈ 0.99), 62% on quant-int4 (cos ≈ 0.96), alignment in (Qu)W rather than the stability of the LSH bucket 47% on noise σ=0.01, 66% on drift-100ep, 90% on noise under perturbation. The C2PA binding is preserved because ′ σ=0.05, ≥ 99% on the PCA / random-projection / strongc travels alongside n and x under the producer’s manifest noise rows. The recompute-commit verifier therefore derives signature, and tampering with any of the three breaks that wrong signatures on the majority of attacked inputs and its signature before Verify runs. Per watermarked vector the producer publishes the tuple score collapses; publishing c removes the fragility (the verifier ′ (x , n, c); per-vector sidecar overhead and the resulting C2PA never recomputes), giving the linear β · ε score decomposition of Lemma 1. manifest layout are detailed in §IV-E. Component roles under attack: Each of the four primitives is load-bearing: removing any one reduces the construction to C. Manifold-aligned variant (production default) a known failure mode. We give the per-component ablation in The manifold-aligned variant replaces the random block§IV-D (“Each component is necessary”) against the baseline diagonal rotation Q of §IV-A with a rotation that places the ports of Table VI. watermark blocks in the top-wb eigendirections of Σcalib .

6

Motivation: A DAE attacker learns an approximation of the data manifold M from polynomial KPA pairs. Any watermark direction that lies outside M is removed by the manifold projection ΠM at little cost to the cosine constraint, since the projection moves the input back toward the manifold along an off-manifold direction. Aligning the watermark with the top eigendirections of Σ places it inside M, so ΠM cannot remove the watermark without also distorting the data signal. Construction: Write Σ = U ΛU ⊤ with eigenvalues sorted in descending order, and let Utop ∈ Rd×wb be the matrix whose columns are the top wb eigenvectors. The only change from §IV-A is the embedding step. We replace W −1 Q⊤ u′ with x + Utop η, where η ∈ Rwb concatenates the w per-block PRF signatures, and then renormalise to unit L2 norm. To verify, the recipient projects x̂ − µ onto Utop and takes the inner product with the expected η derived from the published (K, n, c). Empirical effect: On the three above-threshold encoders, manifold alignment raises the empirical V_blind β from 0.71 (random Q baseline) to 0.851 on MiniLM, 0.674 on MPNet, and 0.551 on CLIP at no cost to baseline AUROC, baseline cosine, or direction-oracle defense; the direction-oracle attack still yields AUROC 1.0000 on all three. Security argument: Utop is public (derivable from Σcalib ); the only secret is K. Signatures inside the top subspace are PRF-pseudorandom under K, so a direction-oracle pair (x0 , x′0 ) recovers only δ0 at (c0 , n0 ) and does not transfer to fresh (c∗ , n∗ ) (empirically AUROC 1.0000). Lemma 1 carries over with β(A) measuring retention in the top-eigenvector subspace; the Wiener bound is unchanged because knowing Utop adds nothing over the data-prior Σ already in Eq. (4).

Assumption 1 (H-D, whitened). T under H0 on DW is σT -subGaussian with σT2 ≤ (1+ζ)/(wd). Measured ζ = 0.001 ± 0.008 on MS MARCO MiniLM and ζ = 0.011 ± 0.012 on MPNet over 5 seeds; both BERT-family encoders satisfy the assumption. For non-BERT-family encoders or deployments where Assumption 1 cannot be empirically validated, the distribution-free Chebyshev variant of Lemma 1 (App. S-I) √ applies with the constant C1 ≤ 4 instead of the tight Gaussian 2. Lemma 1 (Signature retention). Under Assumption 1, conditional on the producer’s C2PA manifest signature on (n, c, x′ ) verifying: p TPR∗ (A) ≥ Φ(β(A)·ε· wd/(1+ζ) − zα ). Proof sketch. Because the verifier reads the producer’s published c, the verifier-side si equals the producer-side si bit-for-bit. The score T (A(·)) decomposes linearly into a β(A)·ε retainedsignature mean plus a sub-Gaussian residual; a Chernoff tail finishes it. Full proof in App. S-I. Wiener floor (closed form): The optimal C4-bounded linear attacker is the data-prior Wiener filter R∗ (ν) = Σ (Σ + νI)−1 .

D. Security analysis Under the published-commit protocol the verifier’s score decomposes into a null-distribution component plus a single signature-retention term: T = Tnull + β(A) · ε,

for it, the only rigorous statement is the loose floor, while its strong measured defendability (β = 0.851, Prop. 1) is an empirical result that the Wiener analysis characterises (within 13%) but does not bound. We lean on the empirical breadth for the adaptive case and do not claim the strong bound covers it. Notation: PLet W = (Σcalib + λreg I)−1/2 and T (z) P:= w1 i∈W⟨(Qz)i , si ⟩/∥si ∥. Define β(A) := Ex [ w1 i∈W ⟨(QuA )i , si ⟩/ε].

(3)

(4)

Intuitively, this is the best linear attack that trades cosine fidelity against watermark removal by aligning its perturbation with the embedding’s natural covariance: it succeeds where isotropic noise fails because random directions cost more cosine per unit of β-removal than the data-prior directions do. The cosine constraint pins ν ∗ implicitly via:

where Tnull is the sub-Gaussian residual under H0 and β(A) ∈ [0, 1] is the C4-bounded attacker’s signature retention. Lemma 1 A(ν ∗ ) + ∥µ∥2 p = δC4 , (5) is the load-bearing result: it reduces verifier TPR via (3) to a B(ν ∗ ) + ∥µ∥2 single scalar β(A). The main theoretical claim is Theorem 1, which gives a Gaussian first-order characterisation of β for where A(ν) = P λ2 /(λi + ν) and B(ν) = P λ3 /(λi + ν)2 i i i i the optimal adaptive-linear attacker (within 13% of empirical) are computable in O(d) from Σ’s eigenvalues. Equation (5) plus a rigorous Cauchy–Schwarz lower bound for any linear is monotone in ν, so ν ∗ (δC4 , {λi }) is found by 1D bisection. C4 attacker. An asymptotic ROM floor (Lemma S1) lifted to Then: HKDF-as-PRF, and a non-adaptive E[β] ≥ 0.97 (Theorem S4), Theorem 1 (Wiener characterisation & rigorous bound). complete the picture. For any linear C4-bounded attacker on an embedder with Scope of the guarantee: We are explicit about which covariance Σ, eigenvalues {λi }: regime each bound reaches, because they do not all cover the headline adversary. The Cauchy–Schwarz floor (Theorem 1, 1) Gaussian pfirst-order characterisation: P βchar (δC4 , {λi }) = ∗ ∗ ) where ϕ(ν) = part 2) is distribution-free and holds for any linear C4 attacker, ϕ(ν )/ d · ρ(ν i λi /(λi +ν), ρ(ν) = P 2 but is loose (β ≥ 0.136 on MiniLM). Theorem S4 gives (λ /(λ +ν)) . On MS MARCO MiniLM at δC4 =0.95: i i i a strong E[β] ≥ 0.97, but only for non-adaptive attackers βchar = 0.838 vs. empirical Wiener attack βemp = 0.752. (random/isotropic noise, fine-tuning drift) whose perturbation 2) Rigorous Cauchy–Schwarz p lower bound (any linear 2 2 ) where is independent of the watermark direction. The adaptive KPAC4 attacker): β(A) ≥ δC4 / 1 + κeff (1 − δC4 DAE attacker the paper is built around is correlated with the κeff = λmax /λ1% . On MiniLM at δC4 =0.95: κeff = 443 watermark by construction and so falls outside that hypothesis: giving β ≥ 0.136.

7

Proof sketch. Writing the Wiener attacker as z = R∗ (ν)(x−µ)+ four must succeed; manifest, nonce/commit, embedding, or µ and substituting E[z ⊤ x] = A(ν)+∥µ∥2 and E[∥z∥2 ] = B(ν)+ calibration tampering each break one of these checks. ∥µ∥2 into the cosine constraint gives (5); the score ratio at ν ∗ Operating modes: We distinguish three deployment modes yields βchar , and Cauchy–Schwarz (A(ν)2 ≤ trace(Σ) B(ν)) (orthogonal, combinable): Mode A (default, trusted-registry gives the rigorous bound. Full proof in App. S-I. Σcalib ), Mode B (producer-signed Σself , §VI-E), and Mode C Discussion. The characterisation βchar = 0.838 is a leading- (text-MinHash addendum for paraphrase defence, §IV-F). Sidecar overhead: At defaults (λn , k) = (16, 8) bytes, order Gaussian approximation; it overshoots βemp = 0.752 by per-vector overhead is 24 bytes (1.6% of a 1,536-byte float-32 about 0.09 due to a per-sample Jensen correction scaling as √ 1/ d. Across the seven above-threshold encoders we measured, embedding); Mode C (§IV-F) adds 512 bytes for the textthe gap stayed below 0.1 in every case. To check this, we MinHash sketch. End-to-end demonstration in §S-III. drew Gaussian samples from ΣMiniLM and ran the Wiener attack on them: the simulated β of 0.7568 matches the MS- F. Mode C: text-hash binding for paraphrase defense MARCO empirical value βemp = 0.752 to within 0.005, so For deployments where source text travels with the embedthe remaining gap reflects the Gaussian approximation rather ding (RAG, document indexes), the producer adds a 64-element than non-Gaussian structure in the data. The rigorous Cauchy– MinHash sketch over character 5-grams of the source text, Schwarz bound β ≥ 0.136 is conservative, but it holds for keyed by HKDFK ("text-hash" ∥ calibration_corpus_id), any linear C4 attacker without distributional assumptions and to the manifest as a new field text_minhash. Each (encoder, yields computable scalars from the encoder’s eigenspectrum producer) pair gets its own commitment domain (sketch alone. is text-derived but encoder-bound). The verifier accepts iff Proposition 1 (Empirical β-floor at the production default). At Jaccard similarity to the published sketch exceeds τC . Cost: the manifold-aligned default (λreg =10−4 , top-wb eigenvector 512 bytes/passage; default τC =0.70 (unified cross-encoder alignment), 5 seeds, N =1 500 test vectors: the strict-C4 (cos ≥ operating point; see below). 0.95) sweep gives βmin = 0.94 (Gaussian-noise σ = 0.01). On On 200 MS-MARCO passages: accepts 100% of routine the relaxed cos ≥ 0.85 budget admitting DAE-105 , β = 0.851 perturbations and light edits (up to ∼10% token replacement), on MiniLM (+10 p.p. vs. random-Q at the same λreg =10−4 ; rejects 92% of multi-attempt paraphrase (4 attempts/passage, +14 p.p. vs. the λreg =10−3 random-Q baseline). βV_blind = attacker-best variant; Jaccard mean 0.301 vs. 0.863 for light 0.851 on MiniLM, 0.674 on MPNet, 0.551 on CLIP. Native- edits). On the MS-MARCO subset alone, τC =0.65 gives budget DAEs match post-hoc-projected β to within |∆β| ≤ Youden index 1.000 (perfect separation): 100% routine TPR, 5×10−4 . 0% paraphrase FPR; for cross-encoder deployment we use τ =0.70 (next sentence). At a unified τC =0.70, Mode C Each component is necessary: Removing any one ingredi- C extends across all eight tested encoders — the three aboveent produces a known failure (Table VI). A content-agnostic sigthreshold (MiniLM, MPNet, CLIP) and the five below-threshold nature breaks at the direction-oracle attack. Skipping whitening (BGE-1024, bge-base-768, e5-large, T5-768, gte-large) — at lets a manifold-projection attacker succeed. Reusing the same routine TPR ≥99.5% and paraphrase FPR ≤0.5%. Encodernonce across embeddings lets a polynomial-pair attacker invert invariance is at the aggregate level: the max paraphrase-FPR the per-key transform. Recomputing the commit at verification delta across the eight encoders at this threshold is 0.005 (0.5 time produces the 62% LSH-bucket-flip fragility of §IV-B. percentage points), with per-passage exact-match agreement Using a random rotation Q instead of the manifold-aligned of 85.3%. The residual disagreement reflects the per-encoder variant costs 10 to 19 percentage points of β on above-threshold MinHash keying above: each encoder’s sketch is drawn from encoders. an independent 64-hash domain, so passages whose Jaccard sits near τC can split decisions across encoders even though the aggregate FPRs agree. Mode C is complementary to E. C2PA manifest binding the perturbative watermark, not a replacement; vector-only The HaloMark manifest sidecar contains four fields per EaaS deployments without source text remain bound by watermarked embedding plus one per-key calibration reference: the paraphrase-open limitation (§VII). Positioning. Mode C manifest = { complements the perturbative scheme rather than extending it: "calibration_corpus_id": "MS-MARCO-MiniLM-Sigma-v1", paraphrase defense comes from the text-level check, routine"calibration_sigma_sha256": "<32B hex>", "vectors": [{ "x_prime": <d-dim float>, perturbation and KPA-DAE defense come from the perturbative "nonce": <16B>, "commit": <8B>, layer, and both live under the same C2PA-signed sidecar. In "text_minhash": <512B; Mode C> }], "signature": <ECDSA over manifest> } deployments where source text travels with the embedding (RAG, document indexes), Mode C closes the paraphrase K = HKDF(C2PA.manifest_claim_hash, "HaloMark"). regime; in pure-vector deployments without source text, the (W, µ, signal_scale) is loaded from the public calibration perturbative scheme remains paraphrase-open (§VII). registry indexed by calibration_corpus_id and verified to hash to calibration_sigma_sha256. Verifier protocol: The verifier (i) validates the C2PA signature, (ii) derives K, (iii) loads (W, µ) and verifies its SHA256, (iv) runs Verify(K, x̂, nonce, c, τdet ) on each vector. All

V. I MPLEMENTATION Reference implementation: implemented in ∼4.8 kLoC of

HaloMark is Python: 1,640

8

lines for core.py plus construction primitives Embedding models: sentence-transformers/ (whitening, commitment, keys, orthogonal, all-MiniLM-L6-v2 [4], [36] (d=384) is the default. Ten metrics, c2pa_binding, manifold_aligned, additional embedders are reported in §VI-C, §VI-D, and higher_order_watermark), the attack suite §VI-E: all-MiniLM-L12-v2 (d=384), distilroberta-v1 (d=768), (attacks, attacks_lipschitz, attacks_sidecar, MPNet-768, multi-qa-mpnet-base (d=768), CLIP-ViT-B/32 attacks_adversarial_signatures, text head (d=512), bge-base-en-v1.5 (d=768), sentence-T5attacks_score_distillation), and four base (d=768), e5-large-v2 (d=1024), BGE-large-en-v1.5 baseline ports (baselines, baselines_seal, (d=1024), and gte-large (d=1024). Together with MiniLM-L6 baselines_treering, baselines_espew). NumPy is this is the eleven-embedder set quoted in the abstract and the only numerical dependency for the core primitives; §VI-D. the cryptography library handles ECDSA and Default parameters: (d, w, ε, k, B) = (384, 16, 0.07, 8, 4) HKDF/PRF/HMAC. Orthogonal-matrix sampling uses with regulariser λreg = 10−4 . The λreg change alone (relative the Householder reflection method over PRF-seeded Gaussian to the prior 10−3 ) raises the random-Q baseline βV_blind from vectors [34], producing uniform samples from O(b) per 0.705 to 0.752 at zero cost on baseline AUROC, cosine fidelity, block; sign-corrected QR ensures byte-identical Q across dir-oracle defence, or PCA-d/2 defence; combined with the NumPy / OpenBLAS / Accelerate (a 30-line wrapper around manifold-aligned variant (§IV-C) the production default reaches numpy.linalg.qr). The dominant cost in Embed and βV_blind = 0.851 on MiniLM (Table II). Nonce length λn = Verify — the block-diagonal orthogonal rotation in W -space 128 bits. The signal-scale calibration on MS MARCO yields — is BLAS-bound; LSH commit and per-block PRF derivation E[∥W x∥] ≈ 14.6 across the 100 000-passage corpus. are constant-time SHA-256 calls and account for <5% of Metrics: per-vector latency at d=384. A Dockerfile with pinned • Detection AUROC: Mann–Whitney rank statistic between dependencies and fixed seeds (0–4) reproduces every number scores on watermarked-then-attacked vectors and unwaterin this paper from scratch in ∼6 h on a single 32-core CPU; marked nulls, with mid-rank tie handling. Reported with the per-claim→JSON mapping is in App. S-IV. 95 % bootstrap CI over 5 seeds. Verifier-side throughput: On a single core of an Apple • Operational TPR/FPR: empirical at the threshold that M-series CPU, Verify costs 180 µs per vector at d=384 achieves Prnull [T ≥ τdet ] = 10−3 . AUROC and opera(MiniLM) and 199 µs at d=1024 (ada-2 class); Embed is 194 tional TPR can diverge under binary-decision attackers and 238 µs/vec respectively. (§VI-C, §VI-E). • β(A): signature retention defined per Lemma 1. Vector-database integration: The verifier exposes • Cosine fidelity: cos(x̃, xclean ) and cos(x̃, xwm ) per atVerify(K, x′ , nonce, c) as a per-vector callable that vector tacked vector, averaged across the test set. databases can invoke at insert time and at query time before • Retrieval: MRR@10, Recall@100, nDCG@10 against returning hits to a downstream LLM. The callable is stateless MS MARCO dev queries. after KeyGen and a one-time load of the public whitening matrix W (1.18 MB at d=384); a typical insert-side filter Baselines: Eight baselines run through the same pipeline costs ∼200 µs per accepted vector on top of an existing attack suite (§VI-E): AddDir, WET-approx [11], ≳ 1 ms vector-database write. SEAL-only [1], Tree-Ring [26], ESpeW [12], faithful C2PA library: The C2PA-binding path uses the ref- ports of EmbMarker [9] and WARDEN [10] with a publishederence c2pa-python bindings (which wrap the official verifier KS-test substitute, and a content-agnostic ablation c2pa-rs Rust SDK). The producer signs a manifest con- HaloMark-CA (BDOT plus fixed key-derived signatures, no taining a SHA-256 digest of the per-vector HaloMark sidecar whitening, no nonce, no commit). Reproducibility: All experiments use deterministic seeds (a custom org.halomark.v1.sidecar_digest asser(0–4 for 5 seeds; seed 0 alone where indicated). Calibration tion); the verifier reads the manifest with c2pa.Reader, corpus hashes, embedding caches, and per-experiment configuvalidates the C2PA signature, recomputes the sidecar digest, and ration are captured in results/; see Appendix S-IV. runs Verify on each tuple. End-to-end interop is exercised in §S-III. B. Imperceptibility We watermark the 100,000-passage MS MARCO corpus at default parameters and evaluate retrieval impact on 2,000 dev queries with per-query bootstrap 95% CIs over 1,000 resamples. A. Experimental setup Average cosine fidelity is cos(xwm , xclean ) = 0.967. Our reDatasets: We evaluate on MS MARCO Passage Rank- trieval numbers were measured at λreg = 10−3 (cosine 0.9713); ing [35]: 100 000 passages from the train split form the the 0.005 drift to the current λreg = 10−4 default is well public calibration corpus (used to compute Σcalib , µ, and below BEIR’s per-corpus reproducibility band, so we report signal_scale); a disjoint 1 500-passage subset per seed is the the existing measurements. With ∆ = clean − watermarked, test corpus, and another 1 500 are null embeddings for FPR the measured deltas are ∆MRR@10 = +0.0039 (95% calibration. The denoising-autoencoder attacker has access to CI [−0.0021, +0.0097]), ∆nDCG@10 = +0.0032 (CI 100 000 augmented training pairs unless otherwise noted. [−0.0015, +0.0078]), and ∆Recall@100 = +0.0015 (0.15% VI. E VALUATION

9

relative). MRR@10 and nDCG@10 CIs straddle zero; the D. Spectral threshold and structural limit Recall@100 CI excludes zero but is below BEIR’s per-corpus The construction defends against polynomial-KPA DAE reproducibility band of ±0.005 [37], i.e. operationally inert. attackers if and only if the encoder’s effective-rank ratio sits The full table is in Appendix S-III. above a clean The effective rank eff_rank(Σ) = P P threshold. 2 2 Why δ = 0.95: At cos = 0.95, MRR@10 drops by 0.7% ( λ ) / λ (participation ratio) measures how many i i i i relative while 1-NN identity match drops by 7.7%. At cos = directions the data manifold meaningfully occupies. Table IV 0.85 the gap widens to 1.8% versus 13.3%. Since 1-NN identity reports the C4-projected V_blind DAE attack on the manifoldis the load-bearing metric for deduplication, near-duplicate aligned construction across 11 embedders. The encoders detection, biometric attribution, and RAG provenance, δ = 0.95 separate at an empirical threshold eff_rank/d ≈ 0.19: above is the right budget for identity-preserving deployments; the it the construction defends (DAE-C4 AUROC 0.965–0.997); construction also holds at cos ≥ 0.85 for the looser ranked- at eff_rank/d = 0.180 defendability has already collapsed retrieval budget. (AUROC 0.602, well below the 0.85 deployment trip-wire), and below it every variant we tested sits in the failed band (AUROC 0.59–0.71). The transition is empirically clean, but the C. Robustness above threshold threshold value rests on the CLIP/bge-base pair that straddles We run the full 15-attack sweep on three above-threshold the line (CLIP at 0.197 defends across all five seeds, bge-base encoders (MiniLM, MPNet, CLIP) at the manifold-aligned at 0.180 fails), so we treat 0.19 as an empirical regularity rather default (λreg =10−4 , top-wb eigenvector alignment); the other than a derived constant. It is also dimension-uniform across three above-threshold encoders (MiniLM-L12, distilroberta, d ∈ {384, 512, 768, 1024}—which our first-order model does multi-qa-mpnet) appear in Table IV with a single-seed DAE- not predict (Eq. (6))—and we return to this as the central open C4 measurement. §VI-D covers below-threshold encoders. We question below. use 5 seeds with N =1,500 test vectors per seed, 105 KPA Why the threshold: On a manifold of low effective rank, pairs available to the adversary, and 95% bootstrap confidence any perturbative watermark direction is either off-manifold, in intervals. The unattacked AUROC on MiniLM is 1.0000, with which case manifold projection removes it, or on-manifold, producer-side cosine cos(xwm , xclean ) = 0.9669. Of the 15 in which case it is indistinguishable from data variability. A attacks in Table II, 6 remain inside the strict C4 budget cos ≥ DAE trained on KPA pairs learns the manifold projection Π 0.95, and 2 more (PCA-d/2 and DAE-105 ) become admissible in finite samples and the watermark collapses regardless of at the relaxed cos ≥ 0.85 budget. which subspace it occupies. Cross-embedder above-threshold (Table III): DAE-C4 Six structural approaches: To check that this is not AUROC stays in [0.990, 0.997] across MiniLM, MPNet, and specific to a single perturbation pattern we tested six structurally CLIP, with direction-oracle AUROC 1.000 on all three; β drops distinct approaches on the below-threshold encoders. V1 is from 0.851 on MiniLM to 0.551 on CLIP, tracking the inverse additive uniform-Q (the random-Q baseline). V2 is manifoldtrend of eff_rank/d. On below-threshold encoders the DAE aligned additive (our default). V3 is multiplicative rotation. V4 drives cosclean <0.95 before reaching the AUROC trip-wire, is anchor-pulling, with xwm = (1−α)x+α anchor(K, n, c). A1 so the C4 budget catches the attack by design (§VI-D). is adversarial-carrier selection: a 5-DAE bootstrap-resampled Strong-attacker stress test (Appendix S-II): On MiniLM ensemble identifies eigvecs where the watermark survives a we pressure-test the construction with ten adaptive-attacker vari- held-out DAE seed, and the production watermark lives in ants spanning DAE capacity/data/depth, sidecar-aware DAEs that DAE-resilient subspace. A2 is √ multi-key disjoint-chunk (FiLM and 65,536-bucket gating), Lipschitz-bounded DAEs, voting with per-chunk amplitude ε/ M . Table V shows that native-budget DAEs, and surrogate-PGD / continuous-score none of V1–V4 defend below the threshold; on above-threshold score-distillation attackers — enumerated in App. S-II. β stays encoders V2 improves β over V1 by 10 to 19 percentage points. above 0.997 across the DAE/Lipschitz/native-budget block; Across all six approaches × the below-threshold encoders the two surrogate attackers leave β ≥ 0.989 on every above- (V1–V4 on four encoders in Table V, V2 on bge-base-768 in threshold encoder with surrogate-score Pearson saturating at Table IV, A1/A2 on all five), no (approach, encoder) cell clears 0.0–0.2 on seven of eight (CLIP outlier ∼0.5). Native-budget the AUROC ≥0.85 trip-wire (App. S-II). The structural-limit DAEs match post-hoc-projected β to within |∆β| ≤ 5 × 10−4 . reading holds across every variant we tested. Verifier-oracle attackers (outside C4): The C4 model Adversarial-carrier side-finding: On above-threshold enexcludes verifier-oracle access. With continuous-score oracle coders the adversarial-carrier approaches (A1 with single-DAE access, autograd PGD [38] drives AUROC to 0 at q = 64. and 5-DAE-ensemble selectors) defend 3 of 6 (approach, With 1-bit binary access against a deterministic threshold encoder) cells: both cells on MiniLM (eff_rank/d=0.440) verifier, HopSkipJump [39] forces operational rejection on and the ensemble selector on CLIP (eff_rank/d=0.197); they 98.6% of vectors at q = 20, even though AUROC remains at fail both cells on MPNet (eff_rank/d=0.256) and the single0.93. Reporting only AUROC therefore understates the severity DAE selector on CLIP. The pattern is consistent with the of an active oracle attacker, and §VII accordingly recommends manifold-aligned variant’s design: at low spectral slack, DAEthat production verifiers rate-limit queries per (key, source) survival-based carrier selection does not reliably generalise pair. A Laplace-noised binary decision provides partial cover at across DAE seeds, while alignment with the encoder’s intrinsic the cost of legitimate-TPR (falling from 0.99 to 0.73 at noise top eigenvectors does not depend on a specific DAE realisation scale b = 0.05). and defends uniformly above threshold. This refines but does

10

TABLE II ROBUSTNESS ON MS MARCO M INI LM-L6 AT THE MANIFOLD - ALIGNED DEFAULT (5 SEEDS , BOOTSTRAP CI S ). ‡ MARKS ROWS ADMITTED ONLY AT THE RELAXED cos ≥ 0.85 BUDGET. T HE PRODUCTION DEFAULT ( MANIFOLD ALIGNMENT AT λreg =10−4 ) REACHES βDAE = 0.851: +10 P. P. FROM ALIGNMENT OVER RANDOM -Q AT THE SAME λreg =10−4 (0.752), AND +14 P. P. OVER THE λreg =10−3 RANDOM -Q BASELINE (0.71).

AUROC [95 % CI]

cos(x̃, xclean )

cos(x̃, xwm )

β

1.0000 [0.9999, 1.0000] 0.9982 [0.9978, 0.9986] 0.9877 [0.9870, 0.9884] 0.9944 [0.9941, 0.9948] 0.9608 [0.9596, 0.9621] 0.8934 [0.8917, 0.8954] 0.9505 [0.9501, 0.9509] 0.8528 [0.8516, 0.8537] 0.9999 [0.9999, 1.0000] 0.9565 [0.9555, 0.9576] 0.8220 [0.8155, 0.8284] 0.9999 [0.9999, 1.0000] 0.9999 [0.9999, 1.0000] 0.9971 [0.9967, 0.9973] 1.0000 [0.9999, 1.0000]

0.9669 0.9577 0.7674 0.9072 0.7672 0.6227 0.6824 0.4817 0.9519 0.6909 0.4397 0.9668 0.9659 0.9381 0.9670

1.0000 0.9892 0.7906 0.9281 0.7833 0.6353 0.7037 0.4969 0.9806 0.7117 0.4524 0.9999 0.9899 0.9698 1.0000

1.000 0.847 0.595 0.84 0.469 0.333 0.444 0.280 0.94 0.455 0.247 1.000 0.996 0.851 1.000

attack quant-int8 quant-int4 quant-binary PCA k = d/2 PCA k = d/4 PCA k = d/8 random-proj k = d/2 random-proj k = d/4 Gaussian noise σ = 0.01 Gaussian noise σ = 0.05 Gaussian noise σ = 0.10 fine-tuning drift, 1ep fine-tuning drift, 100ep DAE, 105 pairs direction-oracle, 105 pairs

TABLE III A BOVE - THRESHOLD MULTI - EMBEDDER , MANIFOLD - ALIGNED DEFAULT (3 5 SEEDS ). DAE-10 IS C4- PROJECTED TO cos ≥0.95. S MALL DIFFERENCES FROM TABLE IV ( E . G . CLIP 0.992 VS 0.991) REFLECT THE 3- VS 5- SEED COUNTS . embedder

cosbase

DAE_C4 AUROC

DAE_C4 β

dir-oracle

MiniLM-384 MPNet-768 CLIP-512

0.963 0.963 0.963

0.997 0.990 0.992

0.851 0.674 0.551

1.000 1.000 1.000

TABLE IV S PECTRAL THRESHOLD ( MANIFOLD - ALIGNED , DAE-105 PROJECTED TO cos ≥ 0.95, N =1 000). DAE-C4 IS THE 5- SEED MEAN ± 95 % CI HALF - WIDTH ( SEEDS 0–4); † MARKS THE FOUR ENCODERS MEASURED AT A SINGLE SEED . A BOVE THE DASHED LINE THE CONSTRUCTION DEFENDS ; BELOW, EVERY ENCODER FALLS WELL UNDER THE 0.85 TRIP - WIRE (5- SEED - CONFIRMED EXCEPT BGE - BASE ). CLIP (eff _rank/d=0.197), THE DEFENDING SIDE OF THE STRADDLE , HOLDS ACROSS ALL FIVE SEEDS ([0.989, 0.994]). embedder MiniLM-L6 MiniLM-L12 distilroberta MPNet multi-qa-mpnet CLIP

d eff_rank eff_rank/d 384 384 768 768 768 512

169.1 161.6 199.8 196.8 183.7 101.0

DAE-C4 def.

0.440 0.997 ± .001 0.421 0.991† 0.260 0.973† 0.256 0.987 ± .001 0.239 0.965† 0.197 0.991 ± .002

Y Y Y Y Y Y

eff_rank/d ≈ 0.19 threshold bge-base T5 e5-large BGE-large gte-large

768 768 1024 1024 1024

138.6 121.9 161.5 157.6 138.6

0.180 0.159 0.158 0.154 0.135

0.602† 0.706 ± .041 0.594 ± .019 0.606 ± .024 0.653 ± .028

N N N N N

not contradict the structural-limit reading: above-threshold encoders admit a defense, but the choice of perturbative variant matters more as the encoder approaches the threshold from above. Rate-limiting cannot rescue below-threshold encoders: At ntrain = 10 KPA pairs the DAE has already learned

C4-valid YES YES no ‡

no no no no YES no no YES YES ‡

YES

TABLE V F OUR V- VARIANTS × FOUR BELOW- THRESHOLD EMBEDDERS . BGE - BASE -768 (V2 = 0.602 PER TABLE IV) IS OMITTED FROM V1, V3, V4 COLUMNS FOR COMPACTNESS ; THE STRUCTURAL - LIMIT READING IS SUPPORTED BY THE FULL TABLE IV SWEEP. C ELL VALUES FOR THE TWO ADDITIONAL APPROACHES (A1 ADVERSARIAL - CARRIER , A2 MULTI - KEY VOTING ) ARE REPORTED IN - LINE IN THE SIX - STRUCTURAL - APPROACHES PARAGRAPH ABOVE : NONE OF THE 10 BELOW- THRESHOLD (A- APPROACH , ENCODER ) CELLS CLEARS THE AUROC ≥0.85 TRIP - WIRE . DAE-105 PROJECTED TO cos ≥0.95; V1/V3/V4 ARE SINGLE - SEED , AND THE V2 ( MANIFOLD - ALIGNED DEFAULT ) COLUMN REPRODUCES THE 5- SEED DAE-C4 MEANS OF TABLE IV.

∗

embedder

V1 add V2 mfd V3 mult V4 anch

BGE-large-1024 e5-large-1024 T5-768 gte-large-1024

0.54 0.53 0.62 0.59

0.606 0.594 0.706 0.653

0.50∗ 0.50∗ — —

0.52 0.49 0.58 0.57

V3 multiplicative is structurally non-detectable (verifier baseline AUROC ≈ 0.50); reported for completeness.

enough of a low-rank manifold to drive AUROC to chance. We therefore restrict the universal-defense claim to encoders with eff_rank(Σ)/d ≥ 0.19. A 5-seed CI sweep across δC4 ∈ {0.85, 0.90, 0.95, 0.99} (App. S-II) shows tight intervals and consistent behaviour, with MPNet at δC4 =0.99 the only borderline cell (AUROC 0.843). Toward a formal threshold prediction: The threshold eff_rank/d ≥ 0.19 is empirically uniform but not p derived. A random-Q Wiener-style analysis predicts βrQ ≈ r/d, giving the closed-form threshold: r z2 ≥ 2AUROC . d ε ·w·d

(6)

At (ε, w, z0.99 )=(0.07, 16, 2.33): this predicts r/d≥0.180 at d=384 (matching empirical ∼0.19 to within 0.01); r/d≥0.090 at d=768 (under-predicts; empirical is ∼0.19). The empirical d-uniformity is not captured; the gap is attributable to manifoldcurvature corrections beyond the scope of this paper. A curvature-corrected derivation using Riemannian geometry of the data manifold remains open.

11

with MiniLM: multi-attempt paraphrase (4 per passage, attacker-best variant) places 44.5% inside C4 at attacker-best AUROC 0.395. Composing HaloMark with a KGW-style text-level watermark raises detection from 51.5% (KGW alone) to 53% on attacker-best paraphrases; Mode C (§IV-F) rejects construction int4 PCAd/2 noise DAE-105 dir-or. 92% of multi-attempt paraphrases at the unified cross-encoder threshold τC =0.70. AddDir .835 .706 .761 .499 .502 WET-approx .827 .698 .756 .503 .505 C2PA interop and Qdrant: Signed asSEAL-only .622 .519 .503 .550 .712 sets validate against three c2pa-rs bindings ESpeW-port .617 .515 .500 .553 .707 Tree-Ring .649 .582 .609 .494 .493 (c2pa-python v0.32.6, c2patool v0.26.56, HaloMark-CA .9999 .973 .999 .504 .505 @contentauth/c2pa-node v0.5.5); verifier runs as HaloMark .9999 .989 .987 .997 .9999 a Qdrant 1.17 admission filter at 284 µs/vec (3,527 vec/s, single-core). On a 1k-vector smoke test, Verify rejects Future-work paradigm shifts (encoder cooperation, robust- 87/100 vectors under σ=0.20 Gaussian tampering (outside tampering hash hybrid, adversarial-trained meta-learning) are discussed C4) and 97/100 under wrong-key probing; sidecar−128 is caught upstream by the C2PA signature at 1−2 . in §VII. TABLE VI BASELINE AUROC S ON THE LOAD - BEARING ATTACKS (MS MARCO M INI LM-L6, 5 SEEDS ). E M B M A R K E R _ P O R T MATCHES A D D D I R , AND WARDEN_ P O R T MATCHES WET- A P P R O X , CELL - BY- CELL — EMPIRICALLY CONFIRMING THE §III-B REDUCTION .

E. Baselines and deployment-scale evidence

VII. D ISCUSSION AND L IMITATIONS We run the eight baselines listed in §VI-A through the attack suite (5 seeds, 105 KPA pairs, bootstrap CIs; faithful Below-threshold encoders: At eff_rank(Σ)/d < 0.19, all centroid-direction EmbMarker [9] and WARDEN [10] ports in six structural approaches we tested fail inside C4 (§VI-D); at App. S-II). ntrain =10 KPA pairs the DAE already removes the watermark Three patterns: content-agnostic schemes (AddDir, WET- — a structural limit of perturbative watermarking. Mode C approx, Tree-Ring) fail at direction-oracle (chance). Content- closes the gap for deployments with source text; pure-vector dependent without per-vector freshness (SEAL-only, ESpeW- EaaS remains open (candidates: encoder cooperation [27] or port) survive dir-oracle but fail at DAE-105 . HaloMark-CA robust-hash hybrids; KGW composition of §VI-E adds only collapses on both. Only the full HaloMark composition holds ∼1.5pp). against both at AUROC ≥ 0.99. Trust assumptions outside scope: Producer-key comproPublished verifiers under C4: Implementing each basemise; calibration drift (refresh Σcalib when shift ratio > 1.3); line’s published statistical verification under C4, EmbMarker malicious producer with a valid C2PA key (PKI, not waterfails on both DAE and direction-oracle (p > 0.45), WARDEN’s marking); ECDSA/HKDF-SHA-256 pre-quantum migration max-of-m test survives DAE but collapses under directioninherited from C2PA; batch-level cross-vector correlations oracle, while HaloMark holds at AUROC ≥ 0.995. Multi-corpus validation: On four BEIR/MTEB corpora under shared calibration_corpus_id. Verifier-oracle leakage: Decision feedback is inherent to (NFCorpus, FiQA, ArguAna, CodeSearchNet) with 3 seeds and N = 1,000 test vectors, direction-oracle AUROC is 1.0000 any threshold detector (§VI-C, Table S2): with continuous-score on every cell and DAE-105 AUROC stays between 0.91 and access PGD drives AUROC to 0 at q = 64, and with 1-bit access 0.999 across the eight (corpus, calibration) cells (App. S-II). HopSkipJump forces operational rejection on 98.6% of vectors Multi-tenant isolation at 64 keys: With 64 PRF- at q = 20 even while AUROC stays at 0.93. This is most acute independent producer keys, a joint-trained k-collude DAE in the Qdrant admission-filter deployment (§VI-E), where an (k ∈ {2, 4, 8, 16, 32}, 800,000 joint pairs at k=32) transfers adversary controlling inserts and queries harvests accept/reject to a fresh target key at AUROC 0.996, β = 0.707 — decisions directly, so oracle access is an operational reality indistinguishable from single-key V_blind (App. S-II for the there, not a hypothetical. Our defenses are correspondingly k=64 reduction argument). BDOT key independence holds at operational, not cryptographic: a hard rate limit of q ≤ 100 per (key, source) per day, operating FPR α = 10−4 (30-day forgery production scale. Self-calibration (Mode B; defined §IV-E): Three producers expectation below 0.3), advisory-only score release, and an (30k vectors each) yield baseline AUROC 0.9999 with V_blind optional Laplace-noised decision that blunts the oracle at a β = 0.71; a cross-producer DAE achieves no transfer (AUROC legitimate-TPR cost (0.99 → 0.73 at noise scale b = 0.05); full 0.997); an adversarial Σ that zeroes the bottom 50% of analysis in App. S-V. By contrast the within-C4 surrogate-PGD eigenvalues still gives AUROC 1.0000, publicly auditable from attacker without oracle access fails on every encoder (AUROC ≥ 0.9998), so for oracle-exposed deployments this leakage, the manifest spectrum. Multi-bit payload decoding: Three coding schemes (3 not in-budget removal, is the dominant residual risk. Theory gaps: Theorem 1’s Cauchy–Schwarz bound (β ≥ seeds, MiniLM) under DAE-105 : 4-bit-rep4 decodes at 89.4%, 0.136 on MiniLM) is loose vs. the empirical floor 0.851. The Hamming(7,4) at 67.1%, raw 16-bit at 4.6% (App. S-III). Paraphrase and composed defenses: We closed-form random-Q threshold matches at d=384 within 0.01 paraphrase 200 MS-MARCO passages with (§VI-D) but under-predicts at d ≥ 768; a curvature-corrected chatgpt_paraphraser_on_T5_base and re-embed derivation capturing the empirical d-uniformity is open.

12

VIII. C ONCLUSION Perturbative embedding watermarks separate at an empirical threshold eff_rank(Σ)/d ≈ 0.19: above this line the publishedcommit construction defends and Mode C closes paraphrase when source text is co-available; below it every variant we tested fails. The deployed cost is 24 bytes of sidecar per vector at ∼284 µs verifier latency, validated end-to-end against three language bindings of the C2PA SDK. Open: below-threshold encoders, pure-vector paraphrase, and a curvature-corrected threshold derivation that captures the empirical d-uniformity. R EFERENCES [1] K. Arabi, R. T. Witter, C. Hegde, and N. Cohen, “SEAL: Semantic aware image watermarking,” in Proc. IEEE/CVF ICCV, 2025, arXiv:2503.12172. [2] Coalition for Content Provenance and Authenticity, “C2PA specification, version 2.0,” https://spec.c2pa.org/specifications/specifications/2.0/index. html, 2024. [3] V. Karpukhin, B. Oğuz, S. Min, P. Lewis, L. Wu, S. Edunov, D. Chen, and W. tau Yih, “Dense passage retrieval for open-domain question answering,” in Proc. EMNLP, 2020. [4] N. Reimers and I. Gurevych, “Sentence-BERT: Sentence embeddings using Siamese BERT-networks,” in Proc. EMNLP, 2019. [5] A. Müller, D. Lukovnikov, J. Thietke, A. Fischer, and E. Quiring, “Blackbox forgery attacks on semantic watermarks for diffusion models,” in Proc. IEEE/CVF CVPR, 2025, arXiv:2412.03283. [6] Z. Dong, C. Shuai, Z. Ba, P. Cheng, Z. Qin, Q. Wang, and K. Ren, “WMCopier: Forging invisible image watermarks on arbitrary images,” in Proc. NeurIPS, 2025, arXiv:2503.22330. [7] C. Zhu, Z. Li, R. Yang, R. Birke, P.-Y. Chen, T.-Y. Ho, and L. Y. Chen, “Optimization-free universal watermark forgery with regenerative diffusion models,” arXiv preprint arXiv:2506.06018, 2025. [8] T. Zhou, X. Zhao, X. Xu, and S. Ren, “Bileve: Securing text provenance in large language models against spoofing with bi-level signature,” in Proc. NeurIPS, 2024, arXiv:2406.01946. [9] W. Peng, J. Yi, F. Wu, S. Wu, B. B. Zhu, L. Lyu, B. Jiao, T. Xu, G. Sun, and X. Xie, “Are you copying my model? Protecting the copyright of large language models for EaaS via backdoor watermark,” in Proc. ACL, 2023. [10] A. Shetty, Y. Teng, K. He, and Q. Xu, “WARDEN: Multi-directional backdoor watermarks for embedding-as-a-service copyright protection,” in Proc. ACL, 2024. [11] A. Shetty, Q. Xu, and J. H. Lau, “WET: Overcoming paraphrasing vulnerabilities in embeddings-as-a-service with linear transformation watermarks,” in Proc. ACL, 2025, arXiv:2409.04459. [12] Z. Wang, B. Wu, J. Deng, and Y. Yang, “Robust and minimally invasive watermarking for EaaS,” in Findings of ACL, 2025, arXiv:2410.17552. Method named “ESpeW” in the paper text. [13] T. Zhou, R. Ding, G. Liu, C. Fleming, R. R. Kompella, Y. Fei, X. Xu, and S. Ren, “MetaSeal: Defending against image attribution forgery through content-dependent cryptographic watermarks,” Transactions on Machine Learning Research, Feb. 2026, arXiv:2509.10766. [14] Y. Uchida, Y. Nagai, S. Sakazawa, and S. Satoh, “Embedding watermarks into deep neural networks,” in Proc. ACM ICMR, 2017. [15] Y. Adi, C. Baum, M. Cisse, B. Pinkas, and J. Keshet, “Turning your weakness into a strength: Watermarking deep neural networks by backdooring,” in Proc. USENIX Security, 2018. [16] N. Lukas, E. Jiang, X. Li, and F. Kerschbaum, “SoK: How robust is image classification deep neural network watermarking?” in Proc. IEEE S&P, 2022. [17] M. Saberi, V. S. Sadasivan, K. Rezaei, A. Kumar, A. Chegini, W. Wang, and S. Feizi, “Robustness of AI-image detectors: Fundamental limits and practical attacks,” in Proc. ICLR, 2024. [18] S. Yang, Z. Cheng, Z. Jiang, Y. Yin, C. Wang, S. Ge, Y. Fu, and Q. Gu, “RegionMarker: A region-triggered semantic watermarking framework for embedding-as-a-service copyright protection,” in Proc. AAAI Conf. Artif. Intell. (AAAI), 2026, arXiv:2511.13329. [19] H. Li, Y. Ren, Y. Cao, Y. Li, F. Fang, and X. Wang, “From essence to defense: Adaptive semantic-aware watermarking for embedding-as-aservice copyright protection,” arXiv preprint arXiv:2512.16439, 2025.

[20] Z. Chen, X. Liang, W. Xu, Y. Liu, and W. Lu, “Geometry-aware localized watermarking for copyright protection in embedding-as-a-service,” arXiv preprint arXiv:2604.11344, 2026. [21] J. Kirchenbauer, J. Geiping, Y. Wen, J. Katz, I. Miers, and T. Goldstein, “A watermark for large language models,” in Proc. ICML, 2023. [22] S. Aaronson, “My AI safety lecture for UT Effective Altruism,” https: //scottaaronson.blog/?p=6823, 2022. [23] M. Christ, S. Gunn, and O. Zamir, “Undetectable watermarks for language models,” in Proc. COLT, 2024. [24] J. Zhu, R. Kaplan, J. Johnson, and L. Fei-Fei, “HiDDeN: Hiding data with deep networks,” in Proc. ECCV, 2018. [25] T. Bui, S. Agarwal, N. Yu, and J. Collomosse, “RoSteALS: Robust steganography using autoencoder latent space,” in Proc. CVPRW, 2023. [26] Y. Wen, J. Kirchenbauer, J. Geiping, and T. Goldstein, “Tree-rings watermarks: Invisible fingerprints for diffusion images,” in Proc. NeurIPS, 2023. [27] P. Fernandez, G. Couairon, H. Jégou, M. Douze, and T. Furon, “The stable signature: Rooting watermarks in latent diffusion models,” in Proc. ICCV, 2023. [28] J. Su, J. Cao, W. Liu, and Y. Ou, “Whitening sentence representations for better semantics and faster retrieval,” arXiv preprint arXiv:2103.15316, 2021. [29] B. Li, H. Zhou, J. He, M. Wang, Y. Yang, and L. Li, “On the sentence embeddings from pre-trained language models,” in Proc. EMNLP, 2020. [30] S. Gao, S. Dou, Q. Zhang, and X. Huang, “Kernel-whitening: Overcome dataset bias with isotropic sentence embedding,” in Proc. EMNLP, 2022. [31] Y. Zhu and H. Shimodaira, “Block-diagonal orthogonal relation and matrix entity for knowledge graph embedding,” in Findings of EMNLP, 2024, pp. 16 956–16 972. [32] A. Taştan, M. Muma, and A. M. Zoubir, “Fast and robust sparsity-aware block diagonal representation,” IEEE Trans. Signal Processing, 2024. [33] M. Yonathan, “Access-controlled semantic search: Implementing rolebased filtering in vector databases for enterprise document management,” Research Square preprint, rs-7338381, 2025. [34] G. W. Stewart, “The efficient generation of random orthogonal matrices with an application to condition estimators,” SIAM J. Numer. Anal., vol. 17, no. 3, pp. 403–409, 1980. [35] T. Nguyen, M. Rosenberg, X. Song, J. Gao, S. Tiwary, R. Majumder, and L. Deng, “MS MARCO: A human-generated machine-reading comprehension dataset,” in NIPS Workshop on Cognitive Computation, 2016, arXiv:1611.09268v1. [36] Sentence-Transformers, “Model card: all-MiniLM-L6-v2,” https: //huggingface.co/sentence-transformers/all-MiniLM-L6-v2, 2021. [37] N. Thakur, N. Reimers, A. Rücklé, A. Srivastava, and I. Gurevych, “BEIR: A heterogeneous benchmark for zero-shot evaluation of information retrieval models,” in Proc. NeurIPS Datasets and Benchmarks Track, 2021, arXiv:2104.08663. [38] A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,” in Proc. ICLR, 2018. [39] J. Chen, M. I. Jordan, and M. J. Wainwright, “HopSkipJumpAttack: A query-efficient decision-based attack,” in Proc. IEEE S&P, 2020.

Related documents

• Rethinking Visual Token Compression for Video Large Language Models: A Simple Yet Strong Baseline#1129983
• CORE-BREW: LLR-Based Soft Decoding for Robust Multi-Bit LLM Watermarking#303158
• Flip, Don't Shuffle: Watermarking LLMs at the Speed of Inference#926723
• More Haste, Less Speed: Weaker Single-Layer Watermark Improves Distortion-Free Watermark Ensembles#792703
• More Haste, Less Speed: Weaker Single-Layer Watermark Improves Distortion-Free Watermark Ensembles#788703