💬 NLP

Geometry-Aware Localized Watermarking for Copyright Protection in Embedding-as-a-Service

The paper proposes GeoMark, a geometry-aware localized watermarking framework for Embedding-as-a-Service that resolves the robustness-utility-verifiability trade-off by decoupling localized triggering from centralized attribution to ensure copyright protection against various attacks while preserving downstream utility.

Original authors: Zhimin Chen, Xiaojie Liang, Wenbo Xu, Yuxuan Liu, Wei Lu

Published 2026-08-05

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Zhimin Chen, Xiaojie Liang, Wenbo Xu, Yuxuan Liu, Wei Lu

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine the internet as a giant, bustling library where the most valuable books aren't made of paper, but of "meaning." These are digital maps that turn words, images, and ideas into lists of numbers, allowing computers to understand that a "cat" is similar to a "kitten" but different from a "toaster." Companies build these super-smart maps, called embedding models, and offer them as a service, like renting a high-powered microscope. But here's the catch: just as a thief could sneak into a library, copy the books, and sell them as their own, a hacker can trick these digital microscopes into revealing their secrets. By asking the service millions of questions and recording the answers, a thief can build a fake, cheap copy of the original model. This is called "model stealing," and it's a huge problem because it steals the hard work and money of the people who built the original tools. To stop this, scientists have tried to hide invisible "watermarks" in the answers, like a secret stamp on a banknote. But so far, these stamps have been tricky: some wash away if you rewrite the question, others break if you change the size of the answer, and some accidentally stamp innocent people by mistake.

This paper introduces a new, clever way to stamp these digital maps called GeoMark. Think of the digital map not as a flat sheet of paper, but as a giant, bumpy 3D landscape where similar ideas are close together and different ideas are far apart. Previous methods tried to stamp the whole landscape or specific flat zones, which often failed when the landscape was squished or stretched. GeoMark takes a different approach. Instead of stamping everywhere, it picks a few special "anchor" spots on the landscape that are far away from a secret "target" spot. It only stamps the area immediately around these anchors. If a thief tries to steal the model, the stamp is hidden in these specific neighborhoods. Even if the thief tries to rewrite the questions (paraphrasing) or chop off parts of the answer (dimensional perturbation), the stamp stays because it's tied to the shape of the neighborhood, not the specific words or numbers.

The researchers tested this idea on four different types of data, ranging from news articles to email spam. They found that GeoMark is like a super-durable stamp. It survived attacks where the thief tried to rewrite the stolen data using advanced AI tools, and it even survived attacks where the thief tried to shrink or shift the data's dimensions. Most importantly, it didn't accidentally stamp innocent, clean data. In the experiments, the system correctly identified the stolen models with a very high degree of confidence (a statistical value called a p-value less than 0.05), while rarely making a mistake on models that hadn't been stolen. The paper suggests that by separating where the stamp is applied from what the stamp looks like, they created a system that is both tough to break and easy to verify.

The team also checked if this new method slowed down the service. They found that adding the stamp took almost no time at all—about 0.017 milliseconds per question—which is so fast it's practically invisible. They also tested how changing the number of "anchor" spots or the size of the stamped neighborhoods affected the results. They found that having a few anchors (around 5) and covering a small, specific percentage of the area (about 4%) worked best, keeping the service fast and the stamp strong.

In short, the authors propose that by using the natural shape of the data landscape to hide the watermark in specific, scattered neighborhoods, they can protect digital models from thieves much better than before. The paper suggests that this "geometry-aware" approach solves the old problem where watermarks were either too fragile or too prone to false alarms. While the results are based on computer simulations and tests on specific datasets, the evidence points to a method that keeps the service useful for everyone while making it very hard for thieves to steal the technology without getting caught.

Technical Summary: Geometry-Aware Localized Watermarking for Copyright Protection in Embedding-as-a-Service

1. Problem Statement

Embedding-as-a-Service (EaaS) has become a critical semantic infrastructure for natural language and multimedia applications. However, EaaS models are highly vulnerable to model stealing attacks, where adversaries query the API on unlabeled corpora to train functionally similar surrogate models at a fraction of the computational cost. This threatens the intellectual property (IP) of model providers.

Existing watermarking defenses for EaaS face a fundamental robustness–utility–verifiability tension:

Trigger-based methods (e.g., relying on specific words) are fragile to paraphrasing attacks.
Transformation-based methods (e.g., secret linear transformations) are sensitive to dimensional perturbations (e.g., shifting or truncating embedding dimensions).
Region-based methods (partitioning the space into semantic subregions) often suffer from false positives. Because natural embeddings are non-uniformly distributed, clean embeddings can coincidentally exhibit geometric affinity to assigned regional targets, leading to spurious copyright claims.

The core challenge is to design a watermarking scheme that remains robust against diverse removal attacks (paraphrasing, dimensional perturbation, and Clustering-Selection-Elimination attacks) while preserving embedding utility and ensuring reliable verification with low false-positive risk.

2. Methodology: GeoMark

The authors propose GeoMark, a geometry-aware localized watermarking framework. The central innovation is decoupling the location where watermarking is triggered from the target to which ownership is attributed.

2.1 Geometry-Aware Watermark Initialization

Shared Target: GeoMark selects a single natural in-manifold embedding ( $w$ ) from the original embedding space to serve as a shared secret watermark target.
Geometry-Separated Anchors: Using Farthest Point Sampling (FPS), the method selects $K$ well-separated anchors ( $A = \{a_1, ..., a_K\}$ ) from the embedding space. These anchors are chosen to maximize the minimum distance to the shared target $w$ and previously selected anchors, establishing explicit geometric safety margins.
Adaptive Local Neighborhoods: For each anchor $a_k$ , an adaptive local radius $\tau_k$ is calibrated based on a local coverage ratio $\rho$ . This accounts for varying semantic densities across the manifold, ensuring consistent local coverage without a fixed global radius.

2.2 Anchor-Centric Local Watermark Injection

Localized Triggering: Watermark injection is activated only if an input embedding falls within the local neighborhood of one or more anchors.
Shared-Target Attribution: Regardless of which anchor(s) trigger the injection, the watermark is always injected by shifting the embedding toward the same shared target $w$ . The protected embedding is computed as $e_p = \text{Norm}(e_o + \lambda w)$ , where $\lambda$ controls the injection strength.
Design Rationale: This design ensures that while the triggering is distributed across multiple geometric regions, the attribution remains centralized. This prevents the "coincidental affinity" issue of region-based methods (since clean samples are unlikely to be near the specific anchors) while avoiding the fragility of multi-target schemes against CSE attacks.

2.3 Copyright Verification

Verification Set: A set of "backdoor" samples (those falling into anchor neighborhoods) and "benign" samples (those outside) is constructed.
Centralized Metric: The suspicious surrogate model is queried with these samples and the target text corresponding to $w$ . Verification relies on measuring the relative geometric affinity between the returned embeddings and the returned target embedding $\hat{w}$ .
Statistical Testing: The method uses cosine similarity and $L_2$ distance to compute group-level discrepancies ( $\Delta_{cos}$ , $\Delta_{L2}$ ). A one-sided Kolmogorov–Smirnov (KS) test is performed to determine if backdoor samples are significantly closer to the target than benign samples.

3. Key Contributions

Identification of Tension: The paper identifies the specific trade-offs in existing EaaS watermarks and argues that geometry-aware design is essential for low false-positive verification.
GeoMark Framework: The proposal of a framework that decouples localized triggering (via FPS-selected anchors) from shared-target attribution. This achieves distributed triggering with centralized attribution.
Robustness and Utility: Extensive experiments demonstrate that GeoMark preserves downstream utility and geometric fidelity while maintaining robust verification against paraphrasing, dimensional perturbation, and CSE attacks.

4. Experimental Results

Experiments were conducted on four benchmark datasets (SST-2, AGNews, Enron, MIND) against three baseline methods (WARDEN, EspeW, WET) and various attack scenarios.

Utility Preservation: GeoMark preserves downstream task accuracy comparable to the unwatermarked baseline. In terms of geometric fidelity, GeoMark maintains >97.5% cosine similarity between original and protected embeddings, significantly outperforming transformation-based methods (like WET) which often result in near-zero or negative similarity due to global coordinate distortion.
Robustness:
- Paraphrasing: GeoMark remains verifiable under NLLB and GPT-4o-mini paraphrasing attacks, whereas trigger-based methods (WARDEN, EspeW) fail on certain datasets (e.g., SST-2 with GPT-4o-mini).
- Dimensional Perturbation: GeoMark is robust to dimension shifting and reduction. Unlike WET, which fails when the coordinate structure is altered, GeoMark's reliance on relative affinity to a natural target remains effective.
- CSE Attack: GeoMark resists the Clustering-Selection-Elimination attack. By creating a heterogeneous activated sample population under a shared target, the watermark does not form a single monolithic cluster that can be easily reconstructed and removed.
Verifiability and False Positives:
- GeoMark demonstrates low false-positive risk. On clean (unwatermarked) models, the $p$ -values for ownership verification remain well above the significance threshold ( $p > 0.05$ ).
- In contrast, a re-implemented region-based baseline (RegionMarker) showed statistically significant false positives on several datasets.
- Ablation studies confirm that removing FPS (random anchor selection) leads to unstable verification and higher false-positive risks, validating the importance of geometric separation.

5. Significance and Claims

The paper claims that GeoMark addresses the critical gap in EaaS copyright protection by jointly designing watermark activation and ownership attribution. Its significance lies in:

Decoupling Mechanism: Successfully separating the "where" (localized, geometry-separated triggers) from the "what" (shared, natural target attribution), which resolves the tension between robustness and verifiability.
Practical Deployment: The method introduces negligible overhead (approx. 0.017 ms per query) and requires no retraining of the backbone encoder, making it suitable for real-world EaaS deployment.
Reliability: It provides a solution that is robust against diverse removal attacks while maintaining low false-positive rates, a critical requirement for legal and commercial copyright enforcement.

The authors conclude that robust copyright protection for EaaS requires a joint design of activation and attribution, rather than optimizing these components in isolation.