mlsanityData to 7 Oct 2026

Are You Copying My Model? Protecting the Copyright of Large Language Models for EaaS via Backdoor Watermark

arXiv 2305.10036 ↗First posted 17 May 2023cs.CL cs.CYcited by 61

On the map: LLM safety and security → Watermarking generated content and models

Abstract (arXiv)

Large language models (LLMs) have demonstrated powerful capabilities in both text understanding and generation. Companies have begun to offer Embedding as a Service (EaaS) based on these LLMs, which can benefit various natural language processing (NLP) tasks for customers. However, previous studies have shown that EaaS is vulnerable to model extraction attacks, which can cause significant losses for the owners of LLMs, as training these models is extremely expensive. To protect the copyright of LLMs for EaaS, we propose an Embedding Watermark method called EmbMarker that implants backdoors on embeddings. Our method selects a group of moderate-frequency words from a general text corpus to form a trigger set, then selects a target embedding as the watermark, and inserts it into the embeddings of texts containing trigger words as the backdoor. The weight of insertion is proportional to the number of trigger words included in the text. This allows the watermark backdoor to be effectively transferred to EaaS-stealer's model for copyright verification while minimizing the adverse impact on the original embeddings' utility. Our extensive experiments on various datasets show that our method can effectively protect the copyright of EaaS models without compromising service quality.

Key facts. Cited by 61 papers in the map (data through 7 Oct 2026). Placed in Watermarking generated content and models, one of 12 directions in LLM safety and security. Builds on 21 of its 32 references that are in the map. First posted on arXiv 17 May 2023.

Builds on

21 of 32 references.

Closest ancestors · 2

Same direction, newest first

  1. 2022CATER: Intellectual Property Protection on Text Generation APIs via Conditional Watermarks19 Sep
  2. 2021Protecting Intellectual Property of Language Generation APIs with Lexical Watermark5 Dec

Other references · 19

  1. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,204
  2. 2020Language Models are Few-Shot Learnerscited by 32,199
  3. 2023LLaMA: Open and Efficient Foundation Language Modelscited by 13,958
  4. 2016Pointer Sentinel Mixture Modelscited by 2,992
  5. 2015Character-level Convolutional Networks for Text Classificationcited by 2,293
  6. 2018Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooringcited by 334
  7. 2018Knockoff Nets: Stealing Functionality of Black-Box Modelscited by 285
  8. 2017Embedding Watermarks into Deep Neural Networkscited by 227
  9. 2020Entangled Watermarks as a Defense against Model Extractioncited by 144
  10. 2019Thieves on Sesame Street! Model Extraction of BERT-based APIscited by 136
  11. 2017Adversarial Frontier Stitching for Remote Neural Network Watermarkingcited by 110
  12. 2021Be Careful about Poisoned Word Embeddings: Exploring the Vulnerability of the Embedding Layers in NLP Modelscited by 96
7 more
  1. 2019DAWN: Dynamic Adversarial Watermarking of Neural Networkscited by 94
  2. 2019Analyzing Information Leakage of Updates to Natural Language Modelscited by 89
  3. 2021Hidden Backdoors in Human-Centric Language Modelscited by 83
  4. 2021BadPre: Task-agnostic Backdoor Attacks to Pre-trained NLP Foundation Modelscited by 76
  5. 2020A Systematic Review on Model Watermarking for Neural Networkscited by 49
  6. 2021Red Alarm for Pre-trained Models: Universal Vulnerability to Neuron-Level Backdoor Attackscited by 44
  7. 2020Protect, Show, Attend and Tell: Empowering Image Captioning Models with Ownership Protectioncited by 18

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 9; 2024: 31; 2025: 13; 2026: 8.

61 papers.

Sort:

By area:

  1. 2023Large Language Models for Generative Information Extraction: A Surveycited by 183
  2. 2024Watch Out for Your Agents! Investigating Backdoor Threats to LLM-Based Agentscited by 135
  3. 2023A Survey of Text Watermarking in the Era of Large Language Modelscited by 102
  4. 2023When Foundation Model Meets Federated Learning: Motivations, Challenges, and Future Directionscited by 83
  5. 2024Watermark Stealing in Large Language Modelscited by 79
  6. 2024Instructional Fingerprinting of Large Language Modelscited by 64
  7. 2024Navigating the Risks: A Survey of Security, Privacy, and Ethics Threats in LLM-Based Agentscited by 63
  8. 2024Watermarking Makes Language Models Radioactivecited by 52
  9. 2024Securing Large Language Models: Threats, Vulnerabilities and Responsible Practicescited by 36
  10. 2024A Survey of Recent Backdoor Attacks and Defenses in Large Language Modelscited by 36
  11. 2024Copyright Protection in Generative AI: A Technical Perspectivecited by 35
  12. 2024REEF: Representation Encoding Fingerprints for Large Language Modelscited by 34
38 more
  1. 2024Navigating LLM Ethics: Advancements, Challenges, and Future Directionscited by 28
  2. 2023Embarrassingly Simple Text Watermarkscited by 23
  3. 2024Deconstructing The Ethics of Large Language Models from Long-standing Issues to New-emerging Dilemmas: A Surveycited by 23
  4. 2024Watermarking Techniques for Large Language Models: A Surveycited by 20
  5. 2024Double-I Watermark: Protecting Model Copyright for LLM Fine-tuningcited by 18
  6. 2023Necessary and Sufficient Watermark for Large Language Modelscited by 16
  7. 2025Model Provenance Testing for Large Language Modelscited by 15
  8. 2023Defenses in Adversarial Machine Learning: A Surveycited by 14
  9. 2024Decoding the AI Pen: Techniques and Challenges in Detecting AI-Generated Textcited by 14
  10. 2024SoK: Dataset Copyright Auditing in Machine Learning Systemscited by 14
  11. 2025Attack and defense techniques in large language models: A survey and new perspectivescited by 13
  12. 2024LLMs with Industrial Lens: Deciphering the Challenges and Prospects -- A Surveycited by 12
  13. 2024Do LLMs Know to Respect Copyright Notice?cited by 12
  14. 2023Watermarking Vision-Language Pre-trained Models for Multi-modal Embedding as a Servicecited by 11
  15. 2023Language Models as a Service: Overview of a New Paradigm and its Challengescited by 10
  16. 2024WARDEN: Multi-Directional Backdoor Watermarks for Embedding-as-a-Service Copyright Protectioncited by 9
  17. 2024QUEEN: Query Unlearning against Model Extractioncited by 9
  18. 2024SudoLM: Learning Access Control of Parametric Knowledge with Authorization Alignmentcited by 8
  19. 2025Agent Guide: A Simple Agent Behavioral Watermarking Frameworkcited by 8
  20. 2025CoTSRF: Utilize Chain of Thought as Stealthy and Robust Fingerprint of Large Language Modelscited by 7
  21. 2024WET: Overcoming Paraphrasing Vulnerabilities in Embeddings-as-a-Service with Linear Transformation Watermarkscited by 5
  22. 2024Prompting Video-Language Foundation Models with Domain-specific Fine-grained Heuristics for Video Question Answeringcited by 5
  23. 2024FreqMark: Frequency-Based Watermark for Sentence-Level Detection of LLM-Generated Textcited by 5
  24. 2026AgentMark: Utility-Preserving Behavioral Watermarking for Agentscited by 5
  25. 2024On Evaluating The Performance of Watermarked Machine-Generated Texts Under Adversarial Attackscited by 4
  26. 2024Robust and Minimally Invasive Watermarking for EaaScited by 4
  27. 2025RegionMarker: A Region-Triggered Semantic Watermarking Framework for Embedding-as-a-Service Copyright Protectioncited by 4
  28. 2024From Intentions to Techniques: A Comprehensive Taxonomy and Challenges in Text Watermarking for Large Language Modelscited by 3
  29. 2024No Size Fits All: The Perils and Pitfalls of Leveraging LLMs Vary with Company Sizecited by 3
  30. 2025AWM: Accurate Weight-Matrix Fingerprint for Large Language Modelscited by 3
  31. 2024PreGIP: Watermarking the Pretraining of Graph Neural Networks for Deep Intellectual Property Protectioncited by 2
  32. 2025BESA: Boosting Encoder Stealing Attack with Perturbation Recoverycited by 2
  33. 2025FPEdit: Robust LLM Fingerprinting through Localized Parameter Editingcited by 2
  34. 2025ISACL: Internal State Analyzer for Copyrighted Training Data Leakagecited by 2
  35. 2025From Essence to Defense: Adaptive Semantic-aware Watermarking for Embedding-as-a-Service Copyright Protectioncited by 2
  36. 2025AGATE: Stealthy Black-box Watermarking for Multimodal Model Copyright Protectioncited by 1
  37. 2026Let Them Steal: Trapping Large Language Model Extraction Attacks with Knowledge Honeypotcited by 1
  38. 2023Tokenized Model: A Blockchain-Empowered Decentralized Model Ownership Verification Platformcited by 0

50 most cited of 61 All 61 (JSON)