为大模型嵌入向量设计了基于C2PA的抗干扰水印方案，解决其身份不稳定的难题。
HaloMark: A Spectral Threshold for Embedding-Vector Watermarking under C2PA
- 通过四类标准技术组合，将水印与C2PA元数据绑定
- 在0.19有效秩阈值以上检测准确率保持0.965以上
- 适合需验证嵌入向量来源的部署场景
基础模型嵌入已成为核心数据资产，但图像和音频中适用的内容溯源机制无法直接用于嵌入。由于量化、投影、微调和窗口平均会重塑嵌入，使其缺乏稳定位级或感知标识，传统哈希失效。本文提出HaloMark，一种与C2PA元数据加密绑定的嵌入向量水印方案。其核心是：生产者将输入相关哈希承诺c签名至C2PA侧边栏，验证者从元数据读取c而非重新计算。重算在白化处理下极不稳定——在余弦相似度0.96时，62%的输入会翻转承诺桶。读取已签c后，验证得分降为T = T_null + beta(A)*epsilon，安全性仅依赖单个标量beta，我们对线性和非自适应攻击严格界定了beta，实证刻画了自适应情形。评估覆盖八种基线和十类自适应攻击（含去噪自编码器移除），十一编码器在有效秩/维度≈0.19处呈现显著分离：高于此阈值，所有预算内攻击下三编码器检测AUROC均≥0.98，其余在单种子去噪自编码器攻击下仍≥0.965；低于此阈值则全部失败。为何该阈值与维度无关尚待研究。作为Qdrant准入过滤器部署，验证耗时284微秒，侧边栏仅24字节，经三个C2PA参考SDK端到端验证。
原文摘要 · Abstract (English)
Foundation-model embeddings are now a primary data asset, but the content-provenance machinery built for images and audio does not transfer to them. C2PA binds to an asset with a stable bit-level or perceptual identity; embeddings have neither, since quantisation, projection, fine-tuning, and windowed averaging reshape them in normal use and break any fixed hash. We present HaloMark, a watermark for embedding vectors cryptographically bound to a C2PA manifest. It composes four standard primitives -- a block-diagonal orthogonal rotation, public whitening, an input-dependent LSH commitment, and a per-vector nonce -- around one protocol change: the producer signs the LSH commitment c into the C2PA sidecar, and the verifier reads c from the manifest instead of recomputing it. Recomputing is fragile under whitening, which flips the commitment bucket on 62% of inputs at cos = 0.96; reading the signed c reduces the verifier's score to T = T_null + beta(A)*epsilon, so security turns on a single scalar beta, which we bound rigorously for linear and non-adaptive attackers and characterise empirically for the adaptive case. We evaluate against an adversary holding polynomially many clean/watermarked pairs under one key with full sidecar visibility, across eight baselines and ten adaptive attackers including denoising-autoencoder removal. The eleven encoders separate at an empirical threshold eff_rank(Sigma)/d ~= 0.19: above it, detection AUROC stays at 0.98 or higher across every in-budget attack on the three encoders we sweep in full, and at 0.965 or higher under single-seed DAE removal on the rest; below it every variant we tested fails. Why the threshold is dimension-uniform is left open. Deployed as a Qdrant admission filter, the verifier runs at 284 us and 24 bytes of sidecar per vector, validated end-to-end against three C2PA reference-SDK bindings.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。