mlsanityData to 14 Oct 2026

WARDEN: Multi-Directional Backdoor Watermarks for Embedding-as-a-Service Copyright Protection

arXiv 2403.01472 ↗First posted 3 Mar 2024cs.CR cs.CL cs.LGcited by 12

Not on the map. Why?

Abstract (arXiv)

Embedding as a Service (EaaS) has become a widely adopted solution, which offers feature extraction capabilities for addressing various downstream tasks in Natural Language Processing (NLP). Prior studies have shown that EaaS can be prone to model extraction attacks; nevertheless, this concern could be mitigated by adding backdoor watermarks to the text embeddings and subsequently verifying the attack models post-publication. Through the analysis of the recent watermarking strategy for EaaS, EmbMarker, we design a novel CSE (Clustering, Selection, Elimination) attack that removes the backdoor watermark while maintaining the high utility of embeddings, indicating that the previous watermarking approach can be breached. In response to this new threat, we propose a new protocol to make the removal of watermarks more challenging by incorporating multiple possible watermark directions. Our defense approach, WARDEN, notably increases the stealthiness of watermarks and has been empirically shown to be effective against CSE attack.

Key facts. Cited by 12 papers in the map (data through 14 Oct 2026). Builds on 25 of its 47 references that are in the map. First posted on arXiv 3 Mar 2024.

Builds on

25 of 47 references.

References · 25

  1. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,399
  2. 2020Language Models are Few-Shot Learnerscited by 32,419
  3. 2019Sentence-BERT: Sentence Embeddings using Siamese BERT-Networkscited by 9,170
  4. 2016Pointer Sentinel Mixture Modelscited by 3,096
  5. 2015Character-level Convolutional Networks for Text Classificationcited by 2,330
  6. 2016Stealing Machine Learning Models via Prediction APIscited by 619
  7. 2018Generating Natural Language Adversarial Examplescited by 424
  8. 2018Knockoff Nets: Stealing Functionality of Black-Box Modelscited by 292
  9. 2017Embedding Watermarks into Deep Neural Networkscited by 248
  10. 2019A backdoor attack against LSTM-based text classification systemscited by 227
  11. 2018PRADA: Protecting against DNN Model Stealing Attackscited by 165
  12. 2019Thieves on Sesame Street! Model Extraction of BERT-based APIscited by 139
13 more
  1. 2018Exploring Connections Between Active Learning and Model Extractioncited by 85
  2. 2021BadPre: Task-agnostic Backdoor Attacks to Pre-trained NLP Foundation Modelscited by 85
  3. 2021Protecting Intellectual Property of Language Generation APIs with Lexical Watermarkcited by 84
  4. 2020Imitation Attacks and Defenses for Black-box Machine Translation Systemscited by 81
  5. 2022CATER: Intellectual Property Protection on Text Generation APIs via Conditional Watermarkscited by 76
  6. 2023Are You Copying My Model? Protecting the Copyright of Large Language Models for EaaS via Backdoor Watermarkcited by 67
  7. 2021Model Extraction and Adversarial Transferability, Your BERT is Vulnerable!cited by 53
  8. 2021Red Alarm for Pre-trained Models: Universal Vulnerability to Neuron-Level Backdoor Attackscited by 49
  9. 2021Black-Box Attacks on Sequential Recommenders via Data-Free Model Extractioncited by 37
  10. 2023Training-free Lexical Backdoor Attacks on Language Modelscited by 31
  11. 2020Protect, Show, Attend and Tell: Empowering Image Captioning Models with Ownership Protectioncited by 20
  12. 2021Student Surpasses Teacher: Imitation Attack for Black-Box NLP APIscited by 18
  13. 2023Watermarking Vision-Language Pre-trained Models for Multi-modal Embedding as a Servicecited by 11

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2024: 6; 2025: 3; 2026: 3.

12 papers.

  1. 2024Watermarking Techniques for Large Language Models: A Surveycited by 23
  2. 2024ModelShield: Adaptive and Robust Watermark against Model Extraction Attackcited by 7
  3. 2024WET: Overcoming Paraphrasing Vulnerabilities in Embeddings-as-a-Service with Linear Transformation Watermarkscited by 7
  4. 2024Robust and Minimally Invasive Watermarking for EaaScited by 4
  5. 2025RegionMarker: A Region-Triggered Semantic Watermarking Framework for Embedding-as-a-Service Copyright Protectioncited by 4
  6. 2025From Essence to Defense: Adaptive Semantic-aware Watermarking for Embedding-as-a-Service Copyright Protectioncited by 2
  7. 2026EmbTracker: Traceable Black-box Watermarking for Federated Language Modelscited by 1
  8. 2024Protecting Copyright of Medical Pre-trained Language Models: Training-Free Backdoor Model Watermarkingcited by 0
  9. 2024Your Semantic-Independent Watermark is Fragile: A Semantic Perturbation Attack against EaaS Watermarkcited by 0
  10. 2025Rotation, Scale, and Translation Resilient Black-box Fingerprinting for Intellectual Property Protection of EaaS Modelscited by 0
  11. 2026Geometry-Aware Localized Watermarking for Copyright Protection in Embedding-as-a-Servicecited by 0
  12. 2026ArmSSL: Adversarial Robust Black-Box Watermarking for Self-Supervised Learning Pre-trained Encoderscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025Watermarks for Embeddings-as-a-Service Large Language Models
  2. 2025SEAL: Subspace-Anchored Watermarks for LLM Ownership
  3. 2025Towards Dataset Copyright Evasion Attack against Personalized Text-to-Image Diffusion Models
  4. 2023Watermarking Text Data on Large Language Models for Dataset Copyright
  5. 2025SoK: Are Watermarks in LLMs Ready for Deployment?
  6. 2023Advancing Beyond Identification: Multi-bit Watermark for Large Language Models
  7. 2025CEFW: A Comprehensive Evaluation Framework for Watermark in Large Language Models
  8. 2024From Intentions to Techniques: A Comprehensive Taxonomy and Challenges in Text Watermarking for Large Language Models