From Essence to Defense: Adaptive Semantic-aware Watermarking for Embedding-as-a-Service Copyright Protection

TL;DR

This paper introduces SemMark, a semantic-aware watermarking method for Embeddings-as-a-Service that enhances copyright protection by embedding imperceptible, diverse, and robust watermarks into semantic regions, addressing prior limitations.

Contribution

SemMark is a novel semantic-based watermarking framework that employs locality-sensitive hashing and adaptive mechanisms to improve stealthiness and robustness for EaaS copyright protection.

Findings

SemMark achieves high verifiability and diversity of watermarks.

The method demonstrates superior stealthiness and harmlessness.

Extensive experiments validate its robustness against various attacks.

Abstract

Benefiting from the superior capabilities of large language models in natural language understanding and generation, Embeddings-as-a-Service (EaaS) has emerged as a successful commercial paradigm on the web platform. However, prior studies have revealed that EaaS is vulnerable to imitation attacks. Existing methods protect the intellectual property of EaaS through watermarking techniques, but they all ignore the most important properties of embedding: semantics, resulting in limited harmlessness and stealthiness. To this end, we propose SemMark, a novel semantic-based watermarking paradigm for EaaS copyright protection. SemMark employs locality-sensitive hashing to partition the semantic space and inject semantic-aware watermarks into specific regions, ensuring that the watermark signals remain imperceptible and diverse. In addition, we introduce the adaptive watermark weight mechanism based on the local outlier factor to preserve the original embedding distribution. Furthermore, we propose Detect-Sampling and Dimensionality-Reduction attacks and construct four scenarios to evaluate the watermarking method. Extensive experiments are conducted on four popular NLP datasets, and SemMark achieves superior verifiability, diversity, stealthiness, and harmlessness.