mlsanityData to 7 Oct 2026

Your Semantic-Independent Watermark is Fragile: A Semantic Perturbation Attack against EaaS Watermark

arXiv 2411.09359 ↗First posted 14 Nov 2024cs.CR cs.AIcited by 0

Not on the map. Why?

Abstract (arXiv)

Embedding-as-a-Service (EaaS) has emerged as a successful business pattern but faces significant challenges related to various forms of copyright infringement, particularly, the API misuse and model extraction attacks. Various studies have proposed backdoor-based watermarking schemes to protect the copyright of EaaS services. In this paper, we reveal that previous watermarking schemes possess semantic-independent characteristics and propose the Semantic Perturbation Attack (SPA). Our theoretical and experimental analysis demonstrate that this semantic-independent nature makes current watermarking schemes vulnerable to adaptive attacks that exploit semantic perturbations tests to bypass watermark verification. Extensive experimental results across multiple datasets demonstrate that the True Positive Rate (TPR) for identifying watermarked samples under SPA can reach up to more than 95%, rendering watermarks ineffective while maintaining the high utility of embeddings. Furthermore, we discuss potential defense strategies to mitigate SPA. Our code is available at https://github.com/Zk4-ps/EaaS-Embedding-Watermark.

Key facts. No citing papers in the map yet (data through 7 Oct 2026). Builds on 20 of its 40 references that are in the map. First posted on arXiv 14 Nov 2024.

Builds on

20 of 40 references.

References · 20

  1. 2019Sentence-BERT: Sentence Embeddings using Siamese BERT-Networkscited by 9,049
  2. 2016Pointer Sentinel Mixture Modelscited by 2,992
  3. 2015Character-level Convolutional Networks for Text Classificationcited by 2,293
  4. 2018Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooringcited by 334
  5. 2018Knockoff Nets: Stealing Functionality of Black-Box Modelscited by 285
  6. 2014Evaluation of Output Embeddings for Fine-Grained Image Classificationcited by 166
  7. 2020Embedding-based Retrieval in Facebook Searchcited by 155
  8. 2019Thieves on Sesame Street! Model Extraction of BERT-based APIscited by 136
  9. 2018Exploring Connections Between Active Learning and Model Extractioncited by 84
  10. 2018Joint Embedding of Words and Labels for Text Classificationcited by 69
  11. 2021A survey of deep neural network watermarking techniquescited by 69
  12. 2022Towards Data-Free Model Stealing in a Hard Label Settingcited by 57
8 more
  1. 2022Can't Steal? Cont-Steal! Contrastive Stealing Attacks Against Image Encoderscited by 30
  2. 2023Rethinking White-Box Watermarks on Deep Learning Models under Neural Structural Obfuscationcited by 20
  3. 2024BadActs: A Universal Backdoor Defense in the Activation Spacecited by 19
  4. 2023Watermarking Vision-Language Pre-trained Models for Multi-modal Embedding as a Servicecited by 11
  5. 2024WARDEN: Multi-Directional Backdoor Watermarks for Embedding-as-a-Service Copyright Protectioncited by 9
  6. 2024Box-Free Model Watermarks Are Prone to Black-Box Removal Attackscited by 6
  7. 2024WET: Overcoming Paraphrasing Vulnerabilities in Embeddings-as-a-Service with Linear Transformation Watermarkscited by 5
  8. 2024DeepEclipse: How to Break White-Box DNN-Watermarking Schemescited by 4

Built on by

Not cited yet.