arXiv:2511.13329cs.CLcs.CR2025-11AAAI被引 6

为EaaS模型提供全域抗攻击水印保护,防窃取更可靠。

RegionMarker: A Region-Triggered Semantic Watermarking Framework for Embedding-as-a-Service Copyright Protection

  • 在低维空间设触发区域,用水印嵌入文本向量。
  • 对改写和维度扰动攻击均有效,检测率超95%。
  • 适合需版权保护的NLP模型服务商使用。

Embedding-as-a-Service(EaaS)是解决各类自然语言处理任务的有效部署方案。然而,近期研究发现,EaaS易受模型提取攻击,可能导致模型提供商重大经济损失。现有版权保护方法通过向文本嵌入注入水印来检测侵权行为,但当前方法仅能抵御部分攻击,缺乏全面防护能力。为此,本文提出区域触发语义水印框架RegionMarker,该框架在低维空间内定义触发区域,并将水印注入与这些区域相关的文本嵌入中。通过秘密降维矩阵投影至该子空间并随机选取触发区域,使得水印移除攻击难以逃避检测。此外,通过在整个触发区域内嵌入水印,并利用文本嵌入本身作为水印载体,RegionMarker对改写和维度扰动攻击均具有强鲁棒性。大量实验表明,RegionMarker能有效抵抗多种攻击方式,从而保障EaaS的版权安全。

原文摘要 · Abstract (English)

Embedding-as-a-Service (EaaS) is an effective and convenient deployment solution for addressing various NLP tasks. Nevertheless, recent research has shown that EaaS is vulnerable to model extraction attacks, which could lead to significant economic losses for model providers. For copyright protection, existing methods inject watermark embeddings into text embeddings and use them to detect copyright infringement. However, current watermarking methods often resist only a subset of attacks and fail to provide \textit{comprehensive} protection. To this end, we present the region-triggered semantic watermarking framework called RegionMarker, which defines trigger regions within a low-dimensional space and injects watermarks into text embeddings associated with these regions. By utilizing a secret dimensionality reduction matrix to project onto this subspace and randomly selecting trigger regions, RegionMarker makes it difficult for watermark removal attacks to evade detection. Furthermore, by embedding watermarks across the entire trigger region and using the text embedding as the watermark, RegionMarker is resilient to both paraphrasing and dimension-perturbation attacks. Extensive experiments on various datasets show that RegionMarker is effective in resisting different attack methods, thereby protecting the copyright of EaaS.

版权保护水印技术NLP安全

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。