Title: Vector Database Watermarking
Venue: NeurIPS 2025
Accepted: yes
Keywords: Watermark

ANN

Vector database
Abstract: Vector databases support machine learning tasks using Approximate Nearest Neighbour (ANN) query functionality, making them highly valuable digital assets. However, they also face security threats like unauthorized replication. By embedding stealth information, watermarking technology can be used for ownership authentication. This paper introduces a watermarking scheme specifically designed for vector databases. The scheme consists of four steps: generating identifiers, grouping, cryptographic mapping, and modification. Since watermark embedding requires modification of certain vectors, it may negatively affect the ANN query results. Further investigation reveals that in the widely used Hierarchical Navigable Small World (HNSW) indexing structure for vector databases, heuristic edge selection and pruning strategies result in some vectors having fewer edges or even none at all. These vectors exhibit significantly lower query frequencies than others, which means that modifying these vectors incurs less impact on query results. Based on this observation, we propose the Transparent Vector Priority (TVP) watermarking scheme, which prioritizes embedding the watermark in these low-query-frequency “transparent” vectors to minimize the impact of watermark embedding on query results. Experimental results show that compared to the current most effective and relevant watermarking schemes, the TVP scheme can significantly reduce the number of missed and false queries by approximately 75\%.

Vector Database Watermarking

Abstract

Vector databases support machine learning tasks using Approximate Nearest Neighbour (ANN) query functionality, making them highly valuable digital assets. However, they also face security threats like unauthorized replication. By embedding stealth information, watermarking technology can be used for ownership authentication. This paper introduces a watermarking scheme specifically designed for vector databases. The scheme consists of four steps: generating identifiers, grouping, cryptographic mapping, and modification. Since watermark embedding requires modification of certain vectors, it may negatively affect the ANN query results. Further investigation reveals that in the widely used Hierarchical Navigable Small World (HNSW) indexing structure for vector databases, heuristic edge selection and pruning strategies result in some vectors having fewer edges or even none at all. These vectors exhibit significantly lower query frequencies than others, which means that modifying these vectors incurs less impact on query results. Based on this observation, we propose the T ransparent V ector P riority (TVP) watermarking scheme, which prioritizes embedding the watermark in these low-query-frequency 'transparent' vectors to minimize the impact of watermark embedding on query results. Experimental results show that compared to the current most effective and relevant watermarking schemes, the TVP scheme can significantly reduce the number of missed and false queries by approximately 75%.

1 Introduction

A vector database [25] is a data management system specifically designed to store and retrieve vector data. These vectors are generated by machine learning models and represent raw unstructured data such as text, images, and audio. By converting unstructured data into vectors, we can measure the similarity between different data by calculating the distance between the vectors. Vector databases can be applied to scenarios such as retrieval augmentation generation (RAG) [22, 16, 8], recommender systems, and similar case retrieval.

The applications of vector databases rely on approximate nearest neighbor(ANN) search. Nearest neighbor (NN) search refers to finding multiple vectors in a vector dataset that are closest to a given query vector. When the size of the vector dataset is large, the time cost of completely traversing all vectors for an exact search is too high, so the researchers proposed the approximate nearest neighbor search [34, 14, 31]. ANN algorithms can find multiple vectors that are close to the query vector in a reasonable amount of time, and even though these vectors may not be the absolute nearest vectors, they usually satisfy the practical requirements.

Criteria for evaluating ANN algorithms include recall, query response time, index construction time, space occupation, etc. After a long period of development, a variety of ANN methods have emerged, mainly including tree-based [3, 2, 37], graph-based [23, 9, 7], hash-based [32, 35, 21], and

quantization-based methods [15, 11, 6]. Hierarchical Navigational Small World (HNSW) stands out among many methods because of its high recall and fast query speed. Therefore, it is supported by many commercial vector database systems such as Milvus [24] and Pinecone [27], and is currently one of the most important vector database Indexing structures.

Recently, vector databases have been widely used in various AI applications. For example, in medical scenarios, medical institutions can share desensitised disease feature vectors, and patients can retrieve similar cases and the doctors or institutions that have dealt with them through similarity searches, so as to obtain medical reference suggestions without compromising the privacy of patients. This shows that vector databases have high application value, and their copyright protection issues should be given due attention. Watermarking technology [19, 10, 20, 13] is a common means of copyright protection, and watermarks can be embedded into digital assets to prove their ownership. However, existing vector data watermarking methods [33, 28] are primarily applied to coordinate vectors in Geographic Information Systems (GIS), while current database watermarking methods [ li2022secure , 5, 12] are mainly designed for relational databases. Neither of these approaches is suitable for vector databases.

In this paper, we present for the first time a vector database watermarking scheme. The scheme is divided into four steps: identifier generation, vector grouping, cryptographic mapping and modifying partial vectors. The watermark information is embedded by modifying some vectors to change the distribution of vector cryptographic mapping results within the group. We present two vector selection strategies: random selection (RS) and transparent vector priority (TVP). RS is a basic strategy that selects vectors randomly for modification. The defect of RS is that it will change the relative positions and neighbor relationships between the vectors, and may have a negative impact on the ANN query, which is called the 'embedding impact'. In order to quantify this embedding impact, we define the number of missed queries and the number of false queries of the vectors before and after embedding the watermark as the evaluation metrics. In order to reduce the embedding impact of watermarking, we conduct an in-depth study on the HNSW index structure. We conjecture and confirm that due to the heuristic edge selection and pruning strategy of HNSW, some vectors have few or even no edges, and these vectors are less frequently queried compared to other vectors, and thus modifying these vectors results in few query errors. We call these vectors with low query frequency 'transparent vectors'.

Based on this finding, we propose a transparent vector priority vector database watermarking scheme. When selecting vectors for modification, TVP prioritizes transparent vectors to minimize the embedding effect according to the transparency threshold required by the algorithm. Experimental results show that by prioritizing transparent vectors, TVP significantly reduces the impact of watermark embedding on ANN queries while maintaining good robustness.

Contributions . The contributions of this paper are as follows:

Quantifying embedding impact : Defining the number of missed queries and false queries to quantify the impact of watermark embedding on ANN queries for the first time.

Optimizing vector database watermarking schemes : Proposing the first vector database watermarking scheme RS and minimizing embedding impact through the Transparent Vector Priority (TVP) strategy.

Experimental Validation : Experimental results demonstrate that TVP significantly reduces the embedding impact and also has strong robustness.

2 Related Work

This section reviews existing watermarking schemes for relational databases and datasets, highlighting their development, challenges, and differences from vector database watermarking.

Agrawal et al. proposed the first relational database watermarking scheme [1], which embeds the watermark by modifying the least significant bit (LSB) of the data. Although it enables basic embedding and extraction, it is less robust and susceptible to data tampering. Subsequently, Sion et al. [30] and Cui et al. [4] improved it to enhance the robustness, but it still causes data distortion.

Reversible watermarking algorithms [5, 17, 26] have been developed to safeguard the availability of databases. These algorithms can recover the original data, but the process of recovering the

original data is also the process of removing the watermark, so the recovery privileges need to be carefully managed. Schemes based on distortion constraints limit the magnitude of data modification during watermark embedding to maintain usability, but they often require compromises in embedding capacity or extraction accuracy.

Ren et al. [29] propose a statistical property-preserving watermarking scheme for relational databases that ensures that watermark embedding does not affect the statistical properties of the data. TabularMark [36], proposed by Zheng et al. makes watermarking virtually stealth to dataset applications for some machine learning tasks.

Vector database watermarking shares the same goals as these schemes, such as basic embedding/extraction, robustness and usability. However, the metrics to measure the impact of watermarking on usability are different due to different usage scenarios. Therefore, applying existing schemes directly to vector databases may not be effective.

3 Preliminaries

3.1 Approximate Nearest Neighbor (ANN)

Unstructured data (e.g., text, images, audio) can be transformed into high-dimensional vectors via feature extraction. The distance between vectors indicates the similarity of the original data. Nearestneighbor search of vectors enables quick location of similar data in large-scale datasets, supporting intelligent applications.

Let D = { V 1 , V 2 , · · · , V n } represent a vector database with n vectors, where V i ∈ R d . For any two vectors V i and V j in D , the Euclidean distance can be denoted as µ ( V i , V j ) . Nearest neighbor (NN) search aims to find k neighbor vectors N q = { N ∗ 1 , N ∗ 2 , · · · , N ∗ k } in the vector database D that are closest to the query vector q , satisfying:

When the dataset size is large, the time cost of NN search is high. Thus, ANN search is proposed. It relaxes the accuracy requirement and aims to find k vectors N 1 , N 2 , · · · , N k such that:

where c ≥ 1 is the error tolerance, meaning the distance between the found vector and the query vector is at most c times the distance of the true nearest neighbor.

3.2 Hierarchical Navigable Small World

Hierarchical Navigable Small World (HNSW) [23] is an important graph-structured algorithm for ANN querying of high-dimensional data. It balances query efficiency and accuracy through four core ideas: hierarchical, heuristic edge selection, pruning, and greedy search.

Hierarchical : HNSW constructs a multi-layered small world graph. The bottom layer contains all vectors, and as the number of layers increases, the number of vectors and connected edges decreases, creating a sparse structure.

Edge selection strategy : When adding a vector q , HNSW first finds the efConstruct nearest neighbours of q and checks whether q should be connected to it. Given a set S of vectors that have been connected to q , q will be connected to its nearest neighbour e only if µ ( e, q ) < µ ( e, o ) of all o in S .

Operation strategy : Each vector has an upper bound on the number of edges. If adding q causes a vector e to exceed this upper limit (set to 2 M in the bottom layer and M in the other layers), then e must reselect its edges.

Greedy search : In HNSW for ANN search with query vector q to find the K closest vectors, start from the highest-level entry vector and move down layer-by-layer. At non-bottom layers, greedily find the closest vector to q as the next-layer entry. At the bottom layer, maintain sets W (nearest neighbors) and C (candidates). Continuously pick the closest vector from C to q to update W until C

is empty or no C vector is closer to q than W vectors. When K = 1, this process is known as greedy search. More detailed introductions and examples can be found in Appendix A.

3.3 Watermarking Framework

The watermark W ∈ { 0 , 1 } L is a binary string to be embedded into digital carriers for copyright verification. A watermarking scheme for vector database D consists of the following two algorithms:

Embedding Algorithm : Em( D , W, θ 1 ) →D w Input : the original database D , the watermark W , and the embedding parameters θ 1 Output : the watermarked database D w .

.

Extraction Algorithm : Ex( D ′ , θ 2 ) → W ′ Input : a database D ′ that may have been modified and extraction parameters θ 2 . Output : the extracted watermark W ′ .

Before sharing a vector database, data owners can use an embedding algorithm to embed watermarks into the database. When copyright disputes arise, an extraction algorithm can be used to extract watermarks from suspected infringing copies of the data, serving as evidence of copyright ownership.

3.4 Threat Model

Assume that the vector database is stolen. Then the thief may try to remove the watermark through various attacks before using the database, thus preventing us from claiming the copyright. In this context, we define the threat model for watermarking as follows:

Full access privileges : the attacker has all the privileges of the vector database and can perform add, delete, change, and query operations.

Knowledge of the algorithm but not the parameters : the attacker is familiar with the embedding algorithm of the watermark, but does not know the specific parameters used for embedding.

The intensity of attacks is constrained : Since attackers themselves are also database users, they must maintain retrieval functionality while attempting to remove watermarks. Therefore, they will only apply attacks of limited intensity to avoid a significant decline in retrieval accuracy.

4 Basic Methodology: Random Selection

This section describes a basic watermarking scheme for vector databases, which generates a unique identifier ID for each vector, divides the vectors into groups based on the identifier, maps each vector as '1-vector' or '0-vector', and adjusts the ratio of different types of vectors in each group by modifying the vectors to embed the watermark information. Since the vectors are randomly selected for modification, the scheme is called a Random Selection Scheme (RS). In the following, we describe the watermark embedding and extraction process in detail.

4.1 Watermark Embedding

The watermark embedding process consists of four steps: generating vector identifier, vector grouping, cryptographic mapping and vector modification. The pseudo-code is shown in Algorithm 1 in Appendix B.

Generate vector identifier : To avoid relying on the original vector identifiers, we use the Most Significant Bit (MSB) method [36] to generate identifiers directly from the vector data. Initialise the random number generator using the seed parameter to generate a set of random dimension indices I = { d 1 , d 2 , . . . , d m } . Extract the highest bits from each selected dimension and concatenate these bits to form an identifier ID V :

where M ( x ) denotes the highest valid bit of x . For example, given a vector V = (42 , 23 , 78 , 14) and a randomly chosen dimension I = { 2 , 3 } , the identifier is M (78) M (14) = 71 .

Vectors grouping : Watermark W are binary sequences defined by the database owner. If the length of the watermark is L , the vectors are partitioned into L non-overlapping groups. A vector V is assigned to group g when the result of taking the modulo of the hash value of its identifier ( ID V ) with L is equal to g , that is, H ( ID V ) mod L = g .

Cryptographic mapping : each vector V is converted to a binary value (0 or 1). First, the target embedding dimension d w = H ( ID V ) mod d is computed. To avoid changing the identifier ID V of the vector during the watermarking process, if d w is in the dimensions set I used to generate ID V , it is iteratively updated as d w = ( d w + 1) mod d until d w is outside of that set. Next, the value V d w is extracted from the target dimension, converted to a binary b of length l , and the index i = H ( ID V ) mod ( l × f ) + 1 ( 0 < f ≤ 1 ) is computed. The ( l -i ) th bit of b is used as the initial mapping result. The factor f ( 0 < f ≤ 1 ) can modulate the size of the index i , indirectly affecting the magnitude of potential modifications in subsequent processes. For example, for the vector V = (42 , 23 , 78 , 14) , if d w = 3 conflicts with the dimension that produces ID V , it is updated to (3 + 1) mod 4 = 0 . With V 0 = 42 (in binary form b = 101010 , l = 6 ) and i = 3 , the initial mapping bit is b [3] = 0 .

However, this approach faces the "sparsity curse": sparse vectors in the database tend to map primarily to 0, which skews the distribution and weakens the effectiveness of the watermark. To alleviate this problem, we introduce an enhancement strategy: XOR the initial result w with the least significant bit of ( l -i ) , i.e., w = w ⊕ (( l -i ) mod 2) . The pseudo-code is shown in Algorithm 2 in Appendix B.

Vector modification : Vectors mapped to 1 or 0 are respectively referred to as "1-vector" or "0-vector". To embed the g -th bit W g of the watermark W into the g -th group of vectors, the proportion of vectors that can be mapped to the value of W g needs to be increased to the preset watermark strength s . For example, if W g = 1 and the g -th group contains 1,000 vectors, among which 500 are 1-vector, when s = 0 . 7 , it means that we expect the proportion of 1-vector to be 0.7, that is, there should be 700 1-vector. In this case, 200 0-vector need to be converted into 1-vector.

Calculate the number of vectors n m that need to be modified for each group, and then randomly select n m vectors from these vectors that cannot be cryptographically mapped to W g as the carrier vector C V . Change their cryptographic mapping results by flipping the bit b [ l -i ] . For instance, given b = 101010 and i = 3 , flipping b [3] will change the mapping from b [ l -i ] ⊕ (( l -i ) mod 2) = 1 ⊕ 1 = 0 to 0 ⊕ 1 = 1 . By traversing all groups and adjusting the distribution of vectors, the watermark embedding can be completed.

4.2 Watermark Extraction

The extraction process uses the same seed seed as the embedding to ensure that the vector groupings and cryptographic mappings are the same. For each group g , the watermark bit W g is determined by majority voting: if the number of 1-vectors exceeds the number of 0-vectors, then W g = 1 ; otherwise, W g = 0 . Iterate over all groups to reconstruct the extracted watermark W ′ . Pseudo-code is provided in the Algorithm 3 in Appendix B.

5 Embedding Impact

In this section, we define and model the impact of watermark embedding on the query process to guide us in optimizing the watermarking approach.

To quantitatively measure the negative impact of watermarking on vector ANN queries, we give the following definition:

Definition 1 : (Nearest Neighbor Response Domain). The nearest neighbor response domain R V of a vector V is defined as:

For a vector V ∈ D , all the query vectors q from D that consider V as a nearest neighbor vector make up the nearest neighbor response domain R V of V .

Definition 2 : (Number of Missed Queries). The number of missed queries M V of vector V is defined as:

1

2

q

1

2

1

2

q

q

before

adding

q

.

q

is connected

to

1, 2

.

1, 2

disconnect

from

q

.

1

2

q

1

2

1

2

q

q

before

adding

q

.

q

is connected

to

1, 2

.

1, 2

disconnect

from

q

.

(a) Vector q has no edge.

1

2

1

2

1

2

q

q

q

1

disconnect

from

q

.

before

adding

q

.

q

is connected

to

1, 2

.

1

2

1

2

1

2

q

q

q

1

disconnect

from

q

.

before

adding

q

.

q

is connected

to

1, 2

.

where \ represents the relative complement operation and A \ B is the set of elements in A but not in B . V and V W respectively denote the vector data before and after the watermark embedding. Thus, the number of missed queries for V refers to the number of vectors that originally belonged to the nearest neighbor response domain R V of V but are absent from the nearest neighbor response domain R V W of V W .

Definition 3 : (Number of False Queries). The number of false queries F V of vector V is defined as:

The Number of false queries of V refers to the number of vectors that belong to the nearest neighbor response domain R V W of V W but are missing in the nearest neighbor response domain R V of V .

The selection of carrier vectors C V should be considered from the following two aspects:

Low embedding impact : in order to minimize the impact of watermarking on query results, i.e., to reduce M V and F V , vectors that are rarely queried should be preferred as carrier vectors.

High robustness : in order to prevent the attacker from accurately locating and deleting the carrier vectors by their features, the selection of vectors with too obvious features should be avoided.

6 Methodology: Transparent Vector Priority

This section introduces two key concepts, Stealth vectors and Transparent vectors , which are the basis of our proposed scheme. Based on the study of these two types of vectors, a T ransparent V ector P riority scheme is proposed to reduce the impact of embedded watermarks on query results.

6.1 Stealth Vectors and Transparent Vectors

Stealth Vectors : We conjecture that the heuristic edge selection and pruning strategy of HNSW may produce edgeless vectors. Take Fig. 1(a) as an example, the vector q is connected with vector 1 and 2 such that the number of edges of vector 1 and 2 increases to three. If the maximum number of edges is set to 2 , the vector 1 and 2 need to be re-selected according to the pruning strategy. Since they already have two neighbours closer than q , they will not be connected to q , and q becomes an edgeless vector. Experiments on the ANN_SIFT1M dataset verified the existence of such vectors, and the detailed procedure is shown in Appendix C; only the conclusions are presented here. With parameters M = 8 and efConstruct = 100 , the constructed HNSW graph contains 12 connected branches, 11 of which contain only one edgeless vector. In further experiments, all vectors are used as query vectors to retrieve the 10 nearest neighbours, and the number of times each vector is queried is recorded, which shows that the edgeless vector is never queried.

In addition, 40 vectors in the maximum connected branch are never queried, presumably due to the search algorithm falling into a local optimum. As shown in Fig. 1(b), vector 1 is disconnected from the edge of q due to the pruning strategy, and the greedy algorithm will mistakenly take vector 1 as the result when querying q . Experiments show that the average degree of the unqueriable vectors in the maximal connected branch is 1.87, while the average degree of the random 1000 vectors is 8.92, which verifies the property that such vectors have fewer edges.

Based on the above characteristics, we define these two types of unqueriable vectors as Stealth vectors.

Transparent Vectors : Since stealth vectors are never queried, embedding watermarks in such vectors has minimal impact on queries. However, stealth vectors are not optimal watermarking vectors, as they are recognised by their distinctive features, and there is a risk of removing the watermark by deleting all non-queryable vectors. To balance the transparency and robustness of watermarking, we prefer to use vectors that are queried less frequently as carrier vectors, calling such vectors transparent vectors.

Based on the feature that stealth vectors are "far away from other vectors and have fewer edges", we propose the hypothesis that vectors with longer edges and fewer edges are more likely to be transparent vectors. We test this hypothesis experimentally. The experiments found that the number of times a vector is queried decreases when the average edge length of the vector increases, while a decrease in the number of edges also leads to a decrease in the number of queries.

To quantitatively measure the number of times a vector is queried, we construct the transparency parameter ts by combining the average edge length l and the number of edges e of the vector:

where m l and δ l denote the mean and standard deviation of the variable l . To reduce the computational overhead, some of the vectors can be sampled for computation.

Table 1: Correlation coefficient between different parameters and the count of queries.

To compare the correlation e between the transparency parameter ts , the average edge length l and the number of edges with the number of queries, the correlation coefficients ρ between them and the number of queries were calculated, and the results are shown in Table 1. It can be seen that the absolute value of the correlation coefficient between the transparency parameter ts and the number of queries is the largest, which indicates that ts has the strongest correlation with the number of queries, and therefore ts is more suitable to be used as a parameter to measure the transparency of the vector. Furthermore, we calculated the Pearson correlation coefficient between the transparency parameter ts and query frequency under various HNSW configurations (see Appendix C, Table 3). The results consistently fell below -0.66, indicating that ts exhibits a stable and consistent negative correlation with the query frequency, thereby serving as a reliable transparency metric.

In summary, we confirm the existence of transparent vectors in HNSW and conclude that: due to the edge pruning strategy, some vectors far away from other vectors have few edges or even no edges, which makes them difficult to be retrieved; the transparency of vectors can be measured by the transparency score ts , and the larger ts is, the more likely it is a highly transparent vector.

6.2 Transparent Vector Priority (TVP)

This section introduces the Transparent Vector Priority (TVP) vector database watermarking scheme.TVP follows the same framework as the RS scheme, but prioritises highly transparent vectors as carrier vectors to minimise query errors caused by watermark embedding.

Taking advantage of the edge correlation property of HNSW, we use transparent vectors with low query frequency as the ideal carrier. Theoretically, in order to find these transparent vectors accurately, it is necessary to count the number of queries for each vector through a large number of queries, from which the vectors with low query frequency are filtered out. Based on the study of transparent vectors in the previous section, we can quickly find transparent vectors by using the ts parameter.

Specifically, the TVP algorithm uses the threshold parameter τ (0 - 1) to select the first τ × 100% of transparent vectors. It randomly samples the vectors, computes the mean and variance of their edge length l and number of edges e , computes the transparency score ts , and determines the filtering threshold ts τ based on the top τ ranked vectors.

When the embedding algorithm needs to select vectors for modification, it no longer selects vectors randomly, but prefers vectors with transparency score ts greater than the threshold ts τ , i.e., vectors with higher transparency and lower query frequency. If τ is set smaller, there may not be enough eligible vectors, and the algorithm will only select vectors with slightly lower transparency scores.

7 Experiments

A watermarking algorithm can be evaluated from two aspects: embedding impact and watermark robustness.

Weuse the average number of missed queries ( AMQ ) and the average number of false queries ( AFQ ) of watermarked vectors containing watermarks after adding watermarks to measure the embedding impact. The specific calculation methods of these two indicators are as follows:

Watermark robustness is the ability to accurately extract watermarks from watermark-containing vectors under attack. Given the threat model in section 3.4, an attacker who knows about our watermarking approach will use an adaptive attack strategy. All robustness experiments involve such adaptive attacks. Among them, adaptive deletion and modification attacks are the most effective. In the former attack, the attacker removes a certain percentage of transparent vectors to remove the watermark. In the latter attack, the attacker modifies the values of some of the dimensions of the partially transparent vector. We measure robustness using the bit error rate (BER) between the extracted watermark and the embedded watermark, which is calculated as:

where w i is the i -th watermark, and w ′ i is the extracted i -th watermark.

The data and environment used for the experiments are consistent with Section 6.1, i.e., the commonly used vector dataset ANN_SIFT1M[18] was implemented and experimented with using Python and Faiss libraries on PCs equipped with AMD Ryzen 5 5600G processors. Experimental results are generally the average of multiple runs. The default parameters for the experiment are M = 8 , efConstruct = 100 , and k = 100 neighbors per query.

7.1 Comparison

In this section, we apply state-of-the-art relevant watermarking schemes to vector databases and compare them with TVP. Specifically, they include SCPW, a watermarking scheme for relational databases proposed in 2023; TabularMark, a watermarking scheme for tabular datasets proposed in 2024; and RS, a scheme proposed in Section 4 of this paper. In the comparison experiments, the public parameters of all the schemes are kept the same, while the private parameters of the schemes are chosen to have the optimal configurations according to their characteristics.

Table 2 demonstrates the AMQ and AFQ before and after embedding watermarks using different schemes. The results show that the AMQ and AFQ of the TVP scheme are reduced by approximately 75% compared to the other schemes. This is because the other schemes do not fully consider minimizing the impact of watermarking on queries, while TVP reduces the number of false and missed queries by preferring transparent vectors that have been queried less often to embed watermarks.

Additionally, we evaluated the variance and maximum values of missed queries (MQ) and false queries (FQ) across different schemes. The results indicate that TVP exhibits lower volatility. Detailed findings are presented in Appendix D Table 4. We further evaluated generalization capabilities of TVP on other datasets, with results indicating it consistently achieves significant reductions in AMQ and AFQ across all datasets. Detailed results are presented in Tables 5 and 6 in Appendix D.

Since TabularMark does not embed watermarked plaintext, its robustness cannot be directly measured using BER. Therefore, following the method proposed by the authors of the scheme, we use the

0.1

0.2

0.3

0.4

0.5

0.6

0.7

0.8

Deletion Proportion (p)

0.0

0.1

0.2

0.3

0.4

0.5

0.6

0.7

0.8

BER or MP

Watermark Extraction Performance under Deletion Attack

TVP (BER)

RS (BER)

SCPW (BER)

TabularMark (MP)

(a) Deletion Attack.

0.1

0.2

0.3

0.4

0.5

0.6

0.7

0.8

Modification Proportion (p)

0.0

0.1

0.2

0.3

0.4

BER or MP

Watermark Extraction Performance under Modification Attack

TVP (BER)

RS (BER)

SCPW (BER)

TabularMark (MP)

(b) Modification Attack.

proportion of watermarks flipped due to vector modification, i.e., Mismatch Percentage (MP), as a metric for robustness under modification attack. For deletion attack, the proportion of watermarked vectors deleted is used as the robustness metric. Since deletion also leads to mismatches, we also denote this metric by MP.

Figure 2(a) illustrates the BER or MP of different schemes after being subjected to a deletion attack. Different colored lines represent different schemes. It can be seen that the BER of TVP is comparable to other schemes, indicating that its robustness can be as strong as existing schemes. Figure 2(b) shows the BER or mismatch percentage of different schemes after a modification attack. Again, the robustness of TVP is similar to the existing schemes.

In summary, the experimental results show that TVP not only significantly reduces query errors but also maintains considerable robustness compared to the current optimal watermarking scheme. Therefore, TVP is currently the most suitable watermarking scheme for vector databases.

7.2 Method Validation And Parameter Analysis Experiments

This section presents a more comprehensive set of experiments designed to: (1) test the effectiveness of the proposed TVP strategy; (2) investigate the impact of key parameters on embedding impact and watermark robustness, thereby providing guidance for parameter selection. Detailed experimental procedures and most of the results are presented in the Appendix E.

TVP Strategy Effectiveness : We evaluated the impact of TVP strategy on query performance under different HNSW parameter configurations. Results indicate that both AMQ and AFQ remain at low levels and are minimally affected by parameter variations. Detailed results are presented in Appendix E Table 7. To evaluate the impact of TVP on recall rate, we compared the recall rate (R@k) at different k values before and after watermark embedding. As shown in Appendix E Table 8, the recall rate remained virtually unchanged, indicating that TVP has a negligible effect on retrieval accuracy. We evaluated the generalization capability of the TVP strategy across multiple ANN index structures. By recording the query frequency of vectors, TVP prioritises embedding watermarks in low-frequency vectors. This strategy was compared against the baseline method of randomly selecting vectors (RS). Experimental results, as shown in Appendix E Table 9, demonstrate that TVP reduces the impact on query performance caused by embedding across all indexes. Therefore, the concept of transparent vector priority applies not only to HNSW but also to other ANN indexes.

Embedding Impact : The parameter τ significantly influences both AMQ and AFQ. A smaller value of τ means that the algorithm prefers more transparent vectors as the carrier vectors, which drastically reduces the number of false queries and missed queries. As shown in Fig. 7 of Appendix E, the smaller τ is, the less impact it has on the query. The parameter s affects the number of vectors that need to be modified. The larger the s , the more vectors need to be adjusted to match the watermark bits, which has a greater impact on the query result.

Watermark Robustness : The larger value of s enables more carrier vectors in each group after embedding to be mapped to the target watermarked bits and enhances the robustness of watermarking. Fixing other parameters, experiments are conducted on different combinations of s and deletion

0.2

0.4

0.6

0.8

0.0

0.2

0.4

s = 0.55

s = 0.6

s = 0.7

s = 0.8

s = 0.9

s = 1

(a) Deletion Attack(

s

).

0.2

0.4

0.6

0.8

0.0

0.2

0.4

=0.2

=0.4

=0.6

=0.8

=1

(b) Deletion Attack(

τ

).

0.2

0.4

0.6

0.8

0.0

0.2

0.4

s = 0.55

s = 0.6

s = 0.7

s = 0.8

s = 0.9

s = 1

(c) Modification Attack(

s

)

0.2

0.4

0.6

0.8

0.0

0.2

0.4

=0.2

=0.4

=0.6

=0.8

=1

(d) Modification Attack(

τ

)

attack proportion p , and the results are shown in Fig. 3(a). It can be seen that under the same attack strength, the larger the value of s , the smaller the BER, i.e., the stronger the robustness. The results of the modified attack experiments (Fig. 3(b)) also confirm this conclusion. The smaller the τ value is, the more prominent the carrier vector features are, and the watermark is easily damaged by the adaptive attack. From Fig. 3(c) and Fig. 3(d), the smaller τ is, the larger BER is, and the weaker the robustness is.

8 Conclusion

This paper explores watermarking techniques in vector databases and proposes the first watermarking scheme, RS. However, RS will modify some vectors, leading to false queries and missed queries in ANN queries. To reduce these embedding impact, we conducted an in-depth study of the most popular index structure, HNSW, and discovered its characteristic: certain vectors in the HNSW graph have few or no edges, resulting in lower query frequencies for these vectors. Modifying these "transparency vectors" will not result in too many false queries and missed queries. Building upon this insight, we refine RS into TVP, prioritising transparent vectors as watermark carriers to minimise embedding impact. Experimental results demonstrate that TVP significantly reduces false queries and missed queries while exhibiting robust performance.

Limitations : This paper presents a transparency score ts construction formula specifically for HNSW. For other index structures, no suitable ts currently exists to enable rapid selection of transparent vectors. In future work, we shall explore concrete methods for extending the concept of transparent vectors priority to other index structures.

References

Rakesh Agrawal and Jerry Kiernan. 'Watermarking relational databases'. In: VLDB'02: Proceedings of the 28th International Conference on Very Large Databases . Elsevier. 2002, pp. 155-166.

Jon Louis Bentley. 'K-d trees for semidynamic point sets'. In: Proceedings of the sixth annual symposium on Computational geometry . 1990, pp. 187-197.

Jon Louis Bentley. 'Multidimensional binary search trees used for associative searching'. In: Communications of the ACM 18.9 (1975), pp. 509-517.

Xinchun Cui et al. 'A robust algorithm for watermark numeric relational databases'. In: Lecture notes in control and information sciences 344 (2006), p. 810.

Javier Franco-Contreras and Gouenou Coatrieux. 'Robust watermarking of relational databases with ontology-guided distortion control'. In: IEEE transactions on information forensics and security 10.9 (2015), pp. 1939-1952.

Jianyang Gao and Cheng Long. 'RaBitQ: Quantizing High-Dimensional Vectors with a Theoretical Error Bound for Approximate Nearest Neighbor Search'. In: Proceedings of the ACM on Management of Data 2.3 (2024), pp. 1-27.

Fabian Groh et al. 'Ggnn: Graph-based gpu nearest neighbor search'. In: IEEE Transactions on Big Data 9.1 (2022), pp. 267-279.

Bernal Jiménez Gutiérrez et al. 'Hipporag: Neurobiologically inspired long-term memory for large language models'. In: The Thirty-eighth Annual Conference on Neural Information Processing Systems . 2024.

Ben Harwood and Tom Drummond. 'Fanng: Fast approximate nearest neighbour graphs'. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition . 2016, pp. 5713-5722.

Xuanli He et al. 'Cater: Intellectual property protection on text generation apis via conditional watermarks'. In: Advances in Neural Information Processing Systems 35 (2022), pp. 54315445.

Jae-Pil Heo, Zhe Lin, and Sung-Eui Yoon. 'Distance encoded product quantization for approximate k-nearest neighbor search in high-dimensional space'. In: IEEE transactions on pattern analysis and machine intelligence 41.9 (2018), pp. 2084-2097.

Donghui Hu et al. 'Reversible database watermarking based on order-preserving encryption for data sharing'. In: ACM Transactions on Database Systems 48.2 (2023), pp. 1-25.

Huayang Huang, Yu Wu, and Qian Wang. 'Robin: Robust and invisible watermarks for diffusion models with adversarial optimization'. In: Advances in Neural Information Processing Systems 37 (2024), pp. 3937-3963.

Elias Jääsaari, Ville Hyvönen, and Teemu Roos. 'LoRANN: Low-Rank Matrix Factorization for Approximate Nearest Neighbor Search'. In: Advances in Neural Information Processing Systems 37 (2024), pp. 102121-102153.

Herve Jegou, Matthijs Douze, and Cordelia Schmid. 'Product quantization for nearest neighbor search'. In: IEEE transactions on pattern analysis and machine intelligence 33.1 (2010), pp. 117-128.

Xinke Jiang et al. 'Ragraph: A general retrieval-augmented graph learning framework'. In: Advances in Neural Information Processing Systems 37 (2024), pp. 29948-29985.

Muhammad Kamran, Sabah Suhail, and Muddassar Farooq. 'A robust, distortion minimizing technique for watermarking relational databases using once-for-all usability constraints'. In: IEEE Transactions on Knowledge and Data Engineering 25.12 (2013), pp. 2694-2707.

Laurent Amsaleg and Hervé Jégou. Datasets for approximate nearest neighbor search . http: //corpus-texmex.irisa.fr/ . Accessed: 2024-08-03. 2010.

Yiming Li et al. 'Untargeted backdoor watermark: Towards harmless and stealthy dataset copyright protection'. In: Advances in Neural Information Processing Systems 35 (2022), pp. 13238-13250.

Hongbin Liu et al. 'Audiomarkbench: Benchmarking robustness of audio watermarking'. In: Advances in Neural Information Processing Systems 37 (2024), pp. 52241-52265.

Wanqi Liu et al. 'EI-LSH: An early-termination driven I/O efficient incremental c-approximate nearest neighbor search'. In: The VLDB Journal 30 (2021), pp. 215-235.

Zihan Liu et al. 'Chatqa: Surpassing gpt-4 on conversational qa and rag'. In: Advances in Neural Information Processing Systems 37 (2024), pp. 15416-15459.

Yu A Malkov and Dmitry A Yashunin. 'Efficient and robust approximate nearest neighbor search using hierarchical navigable small world graphs'. In: IEEE transactions on pattern analysis and machine intelligence 42.4 (2018), pp. 824-836.

Milvus. Milvus . https://milvus.io/docs/overview.md . Accessed: 2025-05-14. 2025.

James Jie Pan, Jianguo Wang, and Guoliang Li. 'Survey of vector database management systems'. In: The VLDB Journal (2024), pp. 1-25.

Maikel L Pérez Gort, Claudia Feregrino Uribe, and Jyrki Nummenmaa. 'A minimum distortion: High capacity watermarking technique for relational data'. In: Proceedings of the 5th ACM Workshop on Information Hiding and Multimedia Security . 2017, pp. 111-121.

pinecone. pinecone . https://www.pinecone.io/learn/a-developers-guide-toann-algorithms/ . Accessed: 2025-05-14. 2025.

Na Ren et al. 'Commutative encryption and watermarking based on SVD for secure GIS vector data'. In: Earth Science Informatics 14 (2021), pp. 2249-2263.

Zhiwen Ren et al. 'A Robust Database Watermarking Scheme That Preserves Statistical Characteristics'. In: IEEE Transactions on Knowledge and Data Engineering (2023).

Radu Sion, Mikhail Atallah, and Sunil Prabhakar. 'Rights protection for categorical data'. In: IEEE transactions on knowledge and data engineering 17.7 (2005), pp. 912-926.

Philip Sun et al. 'SOAR: improved indexing for approximate nearest neighbor search'. In: Advances in Neural Information Processing Systems 36 (2023), pp. 3189-3204.

Yao Tian, Xi Zhao, and Xiaofang Zhou. 'DB-LSH 2.0: Locality-sensitive hashing with querybased dynamic bucketing'. In: IEEE Transactions on Knowledge and Data Engineering (2023).

Michael Voigt, Bian Yang, and Christoph Busch. 'Reversible watermarking of 2D-vector data'. In: Proceedings of the 2004 Workshop on Multimedia and Security . MMSec '04. Magdeburg, Germany: Association for Computing Machinery, 2004, pp. 160-165. ISBN: 1581138547. DOI: 10.1145/1022431.1022459 . URL: https://doi.org/10.1145/1022431.1022459 .

Ming Yang, Yuzheng Cai, and Weiguo Zheng. 'CSPG: Crossing Sparse Proximity Graphs for Approximate Nearest Neighbor Search'. In: Advances in Neural Information Processing Systems 37 (2024), pp. 103076-103100.

Xi Zhao et al. 'Towards efficient index construction and approximate nearest neighbor search in high-dimensional spaces'. In: Proceedings of the VLDB Endowment 16.8 (2023), pp. 19791991.

Yihao Zheng et al. 'Tabularmark: Watermarking tabular datasets for machine learning'. In: Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security . 2024, pp. 3570-3584.

Yifan Zhu et al. 'Pivot selection algorithms in metric spaces: a survey and experimental study'. In: The VLDB Journal 31.1 (2022), pp. 23-47.

A Hierarchical Navigable Small World

Hierarchical Navigable Small World (HNSW)[23] is an efficient graph-structured algorithm for ANN querying, aiming at accelerating the querying process of high-dimensional data, and it is the most dominant vector database index. The core ideas of HNSW include hierarchization, heuristic edge selection strategy, pruning strategy and greedy search. The query efficiency and result accuracy are balanced by quickly locating the query target in the high-level graph, and then searching in a refined way through the low-level graph.

Hierarchization : HNSW constructs a small-world graph containing multiple layers. At the bottom layer, the graph contains all vectors and constitutes the edges of the graph by connecting each point to several vectors in its neighborhood. As the number of layers of the graph increases, the number of vectors in each layer decreases, and the number of connected edges also decreases, creating a sparse graph structure.

Heuristic edge selection strategy : At each layer, HNSW uses a heuristic edge selection strategy to determine which vectors the newly added vector should be connected to. Let efConstruct ∈ N be a parameter, that for a vector q to be added to HNSW, the efConstruct near-neighbors of q are first found and then traversed in order of proximity to q . Here it is important to distinguish between the concepts of near-neighbor and neighbor; for a vector, a near-neighbor is a vector that is close to it, and a neighbor is a vector that is connected to it and can be accessed by each other. The set of vectors already connected to q is denoted as S . For a near-neighbor e of q , q will only connect to e if the distance from e to q is less than the distance from e to any vector in S (i.e., ∀ o ∈ S, µ ( e, q ) < µ ( e, o ) ).

Pruning strategy : Let M ∈ N be a parameter that controls the upper limit of the number of edges for each vector. If the addition of q causes the vector e to have more edges than the upper limit, e must re-select its edges to conform to the edge limit. This upper limit is set to 2 M in the bottom layer of the graph, and M in the other layers.

For example, set efConstruct = 3 , M = 1 . As shown in Figure 4(a), there are already three vectors 1 , 2 , and 3 in the HNSW graph, with two edges E (1 , 2) and E (1 , 3) . Now add a vector q , where µ (1 , q ) < µ (2 , q ) < µ (3 , q ) . Follow these steps to determine whether q connects to 1 , 2 , and 3 : First, connect to 1 , since q has no neighbors yet; do not connect to 2 , because µ (2 , q ) > µ (2 , 1) ; connect to 3 , because µ (3 , q ) < µ (3 , 1) . At this point, the heuristic edge selection for vector q is complete, as shown in Figure 4(d); due to the addition of q , the number of edges for vector 1 increases to 3 , exceeding the upper limit 2 M = 2 , so vector 1 needs to prune some edges. The final HNSW graph is shown in Figure 4(f). q 1 2 3 q 1 2 3 q 1 2 3 q 1 2 3 q 1 2 3 q 1 2 3

q

3

q

q

1

2

3

q

1

2

3

q

1

2

q

1

2

q

1

2

(a)

Before

adding

vector

q

.

1

2

q

1

2

3

1

2

q

1

2

q

1

2

(b) Connect

q

and

1

.

q

1

2

3

q

1

2

3

q

1

2

q

1

2

q

1

2

(c) Do

not

connect

q

and

2

, since

d

(2

, q

)

>

d

(2

,

1)

.

q

1

2

3

q

1

2

3

(d) Connect

q

and

3

,

since

d

(3

, q

)

<

d

(3

,

1)

.

q

1

2

3

q

1

2

3

q

3

(e)

Vector

1

reselect

neighbors.

q

1

2

3

q

1

2

3

q

1

2

3

(f)

Final sit-

uation

after

adding

q

.

Greedy search : The ANN search process in HNSW is described next. Suppose we have a query vector q , and the goal is to find the K closest vectors to q . The search process starts at the highest level of the entry vector of the HNSW and proceeds downward layer by layer. At each layer except the bottom layer, a greedy search is performed to find the closest vector to the query vector q at that layer, which serves as the entry vector for the next layer. At the bottom layer, two sets W (the set of nearest neighbor vectors) and C (the set of candidate vectors) need to be maintained, and the closest vector to q from C is continuously selected to update W until C is empty or the vectors in C are no longer closer to q than any vectors in W . At this point the vectors kept in W are the nearest neighbors of q . When K = 1, this process is known as greedy search.

1

q

3

2

1

2

B Pseudo-code

Algorithm 2: Cryptographic Mapping

C Stealth Vectors and Transparent Vectors

C.1 Stealth Vectors

According to the heuristic edge selection and pruning strategy of HNSW, we believe that there are vectors with no edges in the bottom layer, and such vectors are difficult to query. As shown in Figure 5(a), vector q is chosen to be connected to vectors 1 and 2 , resulting in these two vectors having three edges both. If the upper limit of the number of edges is set to 2 , according to the pruning strategy, vectors 1 and 2 will reselect edges. If vector q is far away from them, they will not connect to q as they already have two neighbors that are closer than q . Since q does not have any edges, it cannot be queried from any other vector as an entry vector.

To test whether such vectors exist, we employ the widely-used vector dataset ANN_SIFT1M [18], as an example. The experiment was conducted on a PC equipped with an AMD Ryzen 5 5600G processor and implemented using Python and the Faiss library. Specifically, we test whether the graph at the bottom of the HNSW is divided into multiple connected components. When M = 8 and efConstruct = 100 , there are 12 connected components in the graph constructed by HNSW, yet 11 of them contain only one vector without edges. All the other vectors are in the last biggest connected. This confirms the existence of vectors without edges.

1

2

q

1

2

1

2

q

q

before

adding

q

.

q

is connected

to

1, 2

.

1, 2

disconnect

from

q

.

1

2

q

1

2

1

2

q

q

before

adding

q

.

q

is connected

to

1, 2

.

1, 2

disconnect

from

q

.

1

2

1

2

1

2

q

q

q

1

disconnect

from

q

.

before

adding

q

.

q

is connected

to

1, 2

.

1

2

1

2

1

2

q

q

q

1

disconnect

from

q

.

before

adding

q

.

q

is connected

to

1, 2

.

Next we test whether these vectors are unsearchable. We queried the 10 nearest neighbors using all vectors as query vectors and recorded the number of times each vector was queried. The edgeless vectors are never queried, which is as expected. However, we also find that 40 vectors in the biggest connected component are never queried. A possible reason is that the greedy algorithm used in

100

200

300

400

Average Edge Length

0

5

10

15

20

25

(a)

0

4

8

12

16

Number of Edges

0

5

10

15

20

25

(b)

-2

-1

0

1

2

Transparency Score(ts)

0

5

10

15

20

25

30

(c)

the search process falls into a local optimum, resulting in another class of unsearchable vectors that are difficult to search for. As shown in Figure 5(b), due to the pruning strategy of HNSW, q would only have neighbor 2 . When querying vector q , if the current vector is 1 , the algorithm will consider 1 to be the query result and fail to find the real search result q since for any neighbor v of 1 , µ ( v, q ) > µ (1 , q ) . From the fact that q cannot be queried starting from all black nodes in the graph. This explains why there are vectors in the main connected component that are not queried. It can be seen that the edge between q and 1 is the key edge that determines whether q can be queried or not, and when the key edge is pruned, q becomes difficult to be queried.

To summarize, the above properties of unsearchable vectors lead to a possible conclusion: vectors with fewer edges are more likely to be unsearchable due to the prune of key edges. Indeed, in the above test, the average degree of vectors that are never queried in the main connected component is 1.87, while the average degree of 1000 randomly chosen vectors is 8.92, which confirms this conclusion to some extent. We define stealth vectors as follows.

Definition 4 : (Stealth Vector). A vector V ∈ D is a stealth vector if

Stealth vectors are indeed vectors whose nearest neighbor response domain is empty. According to the above analysis, there are two classes of stealth vectors: the first category is the no-edge vectors, which are far away from other vectors, and the pruning strategy causes all neighboring vectors to be disconnected from them; and the second category is the vectors that have a small number of edges, but their key edges are disconnected due to the pruning strategy, which makes these vectors unsearchable when searched using the greedy algorithm.

C.2 Transparent Vectors

Because stealth vectors are never queried, embedding watermarks in such vectors has the lowest embedding impact. However, stealth vectors are not the most suitable candidates for watermarking since their distinct characteristics make them easily identifiable, resulting in the risk of watermark remove by deleting all vectors that cannot be queried. To better balance the watermark transparency and robustness, we expand the range of carrier vectors available for selection with relatively low transparency requirements. These vectors are named transparency vectors with the following definition:

Definition 5 : (Transparency Vector). A vector V ∈ D is a t -transparency vector if

The transparency of a vector is measured using the size of the nearest neighbor response domain; the smaller the nearest neighbor response domain is, the higher transparent the vector is. The Stealth vector is an extreme case of the transparent vector when t = 0 .

Longer edges and fewer edges characterize stealth vectors, thus we have the following hypothesis: Vectors with longer and fewer edges are likely to be transparent vectors. To validate this, a series of validation experiments were conducted. We take the average edge length of the vector at the bottom

layer of the graph as its average edge length. In order to examine the effect of the average edge length on the number of queries, we divide the range of average edge lengths and group the vectors within the same range into one class, and calculate the average number of queries for each class of vectors. The experimental results are shown in Fig. 6(a), where the horizontal axis represents the average edge length and the vertical axis represents the average number of queries. It can be seen that the number of queries decreases with the increase of the average edge length, especially when the average edge length is extremely large, the number of queries is close to zero, indicating that the long edge vectors are rarely queried. Similarly, we verified the effect of the number of edges of a vector on the number of queries. We calculated the average number of queries for vectors with the same number of edges. The experimental results are shown in Fig. 6(b), which shows that as the number of edges decreases, the average number of queries for the vector decreases.

The transparency parameter ts is constructed from the vector's average edge length l and the number of edges e , serving to evaluate the frequency with which the vector is queried. The specific formula for calculating ts is provided in Equation( 7) of the main text. A larger ts indicates either a greater average edge length or fewer edges in the vector, and such vectors are typically queried less frequently. Based on this, it can be hypothesised that the transparency parameter ts exhibits a negative correlation with the number of queries. To validate this hypothesis, we experimentally analysed the relationship between ts and query frequency. Specifically, we divided the range of ts into several intervals, grouped vectors within each interval into a category, and calculated the average query frequency for each category. The experimental results are shown in Figure 6(c), where the horizontal axis represents ts and the vertical axis denotes the average query count. It can be observed that as ts increases, the average query count decreases, confirming the hypothesis of a negative correlation between ts and query frequency. Concurrently, Table 1 in the main text lists the correlation coefficients between the average edge length l , the number of edges e , and ts with the number of queries. The results indicate that ts exhibits the highest absolute correlation coefficient with the number of queries, signifying the strongest relationship between the two. This demonstrates that employing ts as a metric for measuring the number of vector queries yields optimal effectiveness.

Additionally, to verify the stability of the transparency parameter ts under different HNSW configurations, we calculated the Pearson correlation coefficient between the ts value of each vector and its actual query frequency for different parameter combinations. The results are shown in Table 3.

These results indicate that, under all parameter settings, ts maintains a significant negative correlation with vector query frequency (Pearson coefficients all below -0.66), suggesting that ts is a stable and generalizable transparency metric that can reliably guide carrier vector selection.

In this section, we confirm the existence of transparent vectors in HNSW and draw the following conclusions through analysis and experiments:

Some vectors that are far away from other vectors may have fewer edges or even no edges due to the edge pruning strategy, which ultimately makes them difficult to be searched.

The transparency of a vector can be measured by its transparency score ts . The larger ts is, the more likely it is a highly transparent vector.

D Comparison experiment

To conduct a more comprehensive analysis of the impact of TVP on query behavior, we conducted experiments and recorded the variance and maximum values of missed queries (MQ) and false queries (FQ) under each scheme. The results are shown in Table 4.

As can be seen from Table 4, the fluctuations in MQ and FQ caused by TVP are significantly smaller than those caused by other methods, with both variance and maximum values being notably lower. This indicates that TVP more effectively controls query errors, not only achieving a smaller average value but also minimizing the impact in worst-case scenarios, thereby demonstrating greater stability.

Since 'transparent' vectors (i.e., vectors with relatively low query frequencies) are common in any dataset, we speculate that the TVP method has good cross-dataset generalization capabilities.

To validate this hypothesis, we conducted extended experiments on two widely used deep learning embedding datasets: arxiv-nomic-768-normalized (derived from VIBE, representing text summaries) and deep1b (a classic large-scale image vector dataset). The experimental parameters were consistent with those in the paper. We evaluated the average missed queries (AMQ) and average false queries (AFQ) caused by different watermark embedding schemes, with experimental results shown in Tables 5 and 6.

It can be observed that, on both datasets, the TVP scheme achieves significantly lower average missed query counts (AMQ) and average false positive query counts (AFQ) compared to other methods. This indicates that the strategy of prioritizing 'transparent' vectors for modification can also reduce query errors on other datasets, thereby validating the cross-dataset generalization capability of our method.

E Method Validation And Parameter Analysis Experiment

E.1 TVP Strategy Effectiveness

We evaluated the average number of missed queries (AMQ) and average number of false queries (AFQ) introduced by TVP under various HNSW parameter settings ( M ∈ { 4 , 8 , 12 , 16 } and efConstruct ∈ { 50 , 100 , 150 } ), with the number of retrieved neighbors fixed at k = 100 . The results are summarized in Table 7.

It can be seen that regardless of how the HNSW parameters change, the AMQ/AFQ values of TVP remain at a low level, indicating minimal impact on queries. This demonstrates that TVP has good adaptability to different parameter configurations.

We conducted a supplementary evaluation of TVP's impact on standard approximate nearest neighbor (ANN) retrieval performance, focusing on recall metrics for vector databases. Specifically, we measured recall at k ( R @ k ), which represents the proportion of true nearest neighbors successfully retrieved within the top k results. A higher R @ k indicates greater retrieval accuracy. We compared the recall of the original, unembedded watermark database with that of the database after embedding watermarks using the TVP method, summarizing the results in Table 8.

As shown in the table, recall remains nearly unchanged at all k levels after watermark embedding. For instance, at R @1 , recall decreased only from 0.9933 to 0.9914, a drop of less than 0.2%. Similarly, at R @100 , the change was negligible, from 0.6847 to 0.6843. These results indicate that TVP has a minimal impact on retrieval quality.

We further validated the generalization capability of the Transparent Vector Priority (TVP) strategy by applying it to multiple Approximate Nearest Neighbor (ANN) index structures. We conducted experiments on four typical indexes: NSG, LSH, IVFFlat, and IVFPQ. By recording the query frequency of each vector, we prioritized embedding watermarks in low-frequency vectors (TVP) and compared this approach with a baseline method that randomly selects vectors for embedding (RS). The experiments evaluated the performance of both schemes on average missed queries (AMQ) and average false queries (AFQ), with results shown in Table 9.

As shown in the table, TVP achieves lower AMQ and AFQ than RS across all index structures. This indicates that TVP is not only applicable to HNSW but also demonstrates excellent adaptability across index structures.

E.2 Embedding impact

The most critical parameter affecting the embedding effect is the threshold τ , which determines the transparency requirement of the algorithm for the watermark carrier vectors. A smaller value of τ implies a higher transparency requirement and fewer queries for the selected carrier vectors, which reduces the number of false queries and missed queries due to watermark embedding.

Under the premise of keeping other parameters unchanged, we adjust the parameter th to study its effect on the watermark embedding effect. For each set value of th , the watermark embedding algorithm is executed, and the changes in the near-neighbor response domains of the carrier vectors before and after embedding are recorded, the number of false and missed queries are counted, and their averages are finally calculated.

0.2

0.4

0.6

0.8

1.0

2.5

5.0

7.5

10.0

12.5

15.0

Average Query Count

Average Missed and False Queries vs Threshold

Average Missed Queries

Average False Queries

Threshold (th)

The experimental results are shown in Figure 7, where the horizontal axis represents the threshold τ and the vertical axis represents the number of queries, and the two curves correspond to the average number of false queries (AFQ) and the average number of missed queries (AMQ), respectively. It can be seen that when τ is small, the values of AFQ and AMQ are also small, which indicates that the impact of watermark embedding on the query results can indeed be kept at a very low level when the transparency requirement is high. As th increases, AFQ and AMQ also increase synchronously, indicating that the th parameter can effectively regulate the impact of watermark embedding, which is a key regulating factor. In addition, the figure presents an interesting phenomenon: the values of AFQ and AMQ are close to equal. We hypothesize that this is because the number of times the carrier vectors are queried does not change significantly before and after the watermark embedding, and thus the number of false queries and missed queries are roughly equal. Through experiments, we verify this speculation and explain the phenomenon in the figure.

The parameter s indicates the proportion of vectors in each group that can be correctly mapped to the corresponding watermark bit after embedding the watermark. Before embedding the watermark, the mapping results are usually more uniform across the groups, with equal proportions of 1 and 0 vectors. Therefore, if s is large, it is necessary to increase the proportion of vectors in a certain category from 0.5 to a very high one, which will result in more vectors needing to be modified, thus having a large impact on the query results.

E.3 Watermark robustness

This section explores the effect of algorithm parameters on the robustness of watermarking. Based on the threat model in Section 3.4, the attacker is aware of our watermarking method and thus will adopt an adaptive attack strategy of transparent vector prioritization, e.g., prioritizing the deletion of transparent vectors when deleting vectors to remove the watermark more effectively. All the attacks discussed in this section are such adaptive attacks.

Adaptive Deletion Attack : An adaptive modification attack is an attempt by the attacker to remove the watermark by deleting a certain percentage of transparent vectors. The larger the parameter s is, the more vectors are mapped to the corresponding watermark in each group after embedding

0.2

0.4

0.6

0.8

Deletion Proportion (p)

0.0

0.1

0.2

0.3

0.4

Bit Error Rate (BER)

Impact of Adaptive Deletion on Bit Error Rate

s = 0.55

s = 0.6

s = 0.7

s = 0.8

s = 0.9

s = 1

s

.

0.2

0.4

0.6

0.8

Deletion Proportion (p)

0.0

0.1

0.2

0.3

0.4

Bit Error Rate (BER)

Impact of Adaptive Deletion on Bit Error Rate

=0.2

=0.4

=0.6

=0.8

=1

(b) Transparency Threshold

τ

.

the watermark, and theoretically, the more robust it should be against the adaptive deletion attack. To verify this hypothesis, we conducted experiments under the condition of τ = 0 . 5 for different combinations of adaptive deletion proportion p and watermark strengths s , embedded the watermark using the parameter s , and then deleted the vectors of the most transparent p proportion, and then extracted the watermarks and computed the BER.

The experimental results are shown in Figure 8(a). The horizontal axis represents the deletion proportion p , the larger p means the stronger the attack intensity; the vertical axis represents the BER, the larger the BER means the more extraction errors and the worse the robustness. The lines of different colors represent different s values.

The following points can be observed from the Figure 8(a):

Performance under no attack: for all curves, when the deletion proportion p = 0 , the BER is also 0. This indicates that the watermark can be extracted completely and accurately without attack, which proves that the basic embedding and extracting functions of this scheme are reliable.

Relation between Attack Strength and BER: as the deletion proportion p increases, the BER also rises, which indicates that adaptive deletion is indeed an effective means of attack.

Effect of watermark strength s on robustness: for the same strength of deletion attack, the larger the s , the lower the BER. This indicates that larger values of s can enhance the robustness of watermarking, which is consistent with our speculation.

High robustness: when s =1, the BER always remains 0, which means that the watermark can be extracted accurately no matter how strong the attack is. This result shows that the proposed scheme is very robust at s =1 and can meet the needs of application scenarios that require high robustness.

Next, we discuss the impact of the transparency threshold τ on the robustness. τ determines the requirement of the algorithm on the transparency of the carrier vectors. The smaller τ is, the higher the transparency of the selected vectors, and the more obvious their features are, which are easier to be recognized and suffer from accurate attacks under adaptive attacks. Therefore, the smaller τ is, the less robust the watermark should be.

To verify this hypothesis, we conducted experiments under the condition of s = 0 . 7 for different combinations of adaptive deletion proportion p and thresholds th , embedded the watermark using the parameter τ , and then deleted the vectors of the most transparent p proportion, then extracted the watermark and computed the BER.

The experimental results are shown in Figure 8(b). The horizontal axis represents the deletion proportion p , which indicates the strength of the attack; the vertical axis represents the BER. The lines of different colors represent different τ values. It can be seen that for the same deletion proportion, the smaller τ is, the larger the BER is, which is consistent with our hypothesis. In addition, the curves of τ = 0 . 2 and τ = 0 . 4 almost overlap in the figure. This indicates that the setting of the complementary vectors plays a role in the selection of the carrier vectors. When τ is too small and s

0.25

0.50

0.75

Deletion Proportion (p)

30

40

50

60

70

80

Count

Flase Queries

(a) Deletion Attack.

0.25

0.50

0.75

Modification Proportion (p)

10

20

30

40

50

60

Count

Flase Queries

(b) Modification Attack.

is large, the number of vectors satisfying the transparency requirement may be insufficient. In this case, the algorithm, after prioritizing the high transparency vectors, will supplement the selection of some vectors with lower transparency. Therefore, although τ is different, the selected vectors are similar in this case, and the BER are similar when facing adaptive deletion attacks.

According to the analysis of the threat model, an attacker needs to balance the effect of watermark removal with its impact on their own use of the database. To this end, we test the specific impact of adaptive deletion attacks on query results. The experiment sets the number of query neighbors k = 100 and measures the average number of query errors of all vectors before and after deleting varying proportions of vectors, and the experimental results are shown in Figure 9(a). The figure shows that the number of query errors rises significantly as the deletion proportion increases. When the deletion rate reaches 0.5, the average number of query errors is close to 50, which means that the proportion of query errors is close to half of the total number of queries. At this intensity, the query result has been seriously distorted, and it is difficult to meet the actual application requirements. Therefore, attackers usually do not choose such a high intensity attack, and it can be inferred that the actual attack intensity is lower than the maximum value set by the experiment.

Adaptive Modification Attack : An adaptive modification attack is an attempt by the attacker to remove the watermark by modifying a certain percentage of transparent vectors, where the modifications are conducted on the partial dimension values of the vectors.

Under the condition of threshold τ = 0 . 5 , we conducted experiments for different combinations of watermark strength s and modification proportion p . The specific steps include watermark embedding, performing modification attacks, and then extracting the watermark and recording the BER . The test results show that a significant bit error rate occurs only when the modification dimension reaches 30. Therefore, we set the number of modified dimensions for the modification attack to 30.

The experimental results are shown in Figure 10(a). The horizontal axis represents the modification attack strength, and the vertical axis represents the BER. The lines of different colors represent different s values. It can be seen that for the same modification proportion, the larger the s , the smaller the BER, indicating the higher robustness. This verifies that a higher value of s can significantly enhance the modification resistance of the watermark.

Next, we test the effect of the transparency threshold τ on watermark robustness. Under the condition of watermark strength s = 0 . 7 , we conducted experiments for different combinations of transparency threshold th and modification proportion p . The experimental steps also include watermark embedding, performing a modification attack, and then extracting the watermark followed by recording the BER .

The experimental results are shown in Figure 10(b). The horizontal axis represents the strength of the modification attack (i.e., modification proportion p ) and the vertical axis represents the BER . The lines of different colors represent different τ values. It can be seen that with the same modification proportion, the larger the τ , the smaller the BER, indicating the higher robustness.

0.2

0.4

0.6

0.8

Modification Proportion (p)

0.0

0.1

0.2

0.3

0.4

Bit Error Rate (BER)

Impact of Adaptive Modification on Bit Error Rate

s = 0.55

s = 0.6

s = 0.7

s = 0.8

s = 0.9

s = 1

s

.

0.2

0.4

0.6

0.8

Modification Proportion (p)

0.0

0.1

0.2

0.3

0.4

Bit Error Rate (BER)

Impact of Adaptive Modification on Bit Error Rate

=0.2

=0.4

=0.6

=0.8

=1

(b) Transparency Threshold

τ

.

Finally, we evaluated the impact of this attack on query results. We measured the average number of query errors for all vectors before and after modifying different proportions of vectors. The results are shown in Figure 9(b). As the proportion of modified vectors increases, the number of false queries increases rapidly. On the other hand, since the watermarking algorithm modifies only one dimension for each vector, and the attack needs to modify multiple dimensions to significantly impact watermark extraction, it indicates that the modification attack is more expensive to implement. Therefore, to ensure database availability, attackers usually avoid high-intensity adaptive modification attack strategies, which limits the actual threat of the attack.

Shuffle Attack : Shuffle Attack is to disturb the order between vectors and the correspondence between vectors and IDs. The watermark extraction of TVP does not depend on the order of vectors or their original IDs, so this attack is not effective for TVP.

Reconstructed Index Attack : Reconstruction indexing attack refers to reconstructing the indexes of vectors. Since the index construction process has a certain degree of randomness, even if the same vectors are used to construct the index multiple times, the results will be different. If the watermark is embedded in the index structure, reconstructing the index will lead to wrong watermark extraction. The TVP scheme does not depend on the index structure, so the reconstructed index attack is also ineffective for TVP.

By analyzing the experiments in Section E.2 and Section E.3, we draw the following brief conclusions:

Transparency Threshold τ : the smaller τ is, the smaller the impact on query result is, but the robustness will become worse.

Watermark Strength s : the larger s is, the stronger the robustness is, but more vectors need to be modified and the impact on query results increases.

NeurIPS Paper Checklist

1. Claims

Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?

Answer: [Yes]

Justification: The abstract and introduction provide a precise overview of the motivation and contributions of the paper.

Guidelines:

The answer NA means that the abstract and introduction do not include the claims made in the paper.

The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.

The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.

It is fine to include aspirational goals as motivation as long as it is clear that these goals are not attained by the paper.

2. Limitations

Question: Does the paper discuss the limitations of the work performed by the authors?

Answer: [Yes]

Justification: The limitations of this work are discussed in the conclusion section.

Guidelines:

The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.

The authors are encouraged to create a separate "Limitations" section in their paper.

The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.

The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on a few datasets or with a few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.

The authors should reflect on the factors that influence the performance of the approach. For example, a facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or a speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.

The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.

If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.

While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an important role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.

3. Theory assumptions and proofs

Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof?

Answer: [Yes]

Justification: The hypothesis on the existence of edgeless vectors is verified by theoretical analyses and experiments.

Guidelines:

The answer NA means that the paper does not include theoretical results.

All the theorems, formulas, and proofs in the paper should be numbered and crossreferenced.

All assumptions should be clearly stated or referenced in the statement of any theorems.

The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch to provide intuition.

Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.

Theorems and Lemmas that the proof relies upon should be properly referenced.

4. Experimental result reproducibility

Question: Does the paper fully disclose all the information needed to reproduce the main experimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?

Answer: [Yes]

Justification: The dataset used for the experiments, and the key parameters have been described.

Guidelines:

The answer NA means that the paper does not include experiments.

If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.

If the contribution is a dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.

Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.

While NeurIPS does not require releasing code, the conference does require all submissions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example

(a) If the contribution is primarily a new algorithm, the paper should make it clear how to reproduce that algorithm.

(b) If the contribution is primarily a new model architecture, the paper should describe the architecture clearly and fully.

(c) If the contribution is a new model (e.g., a large language model), then there should either be a way to access this model for reproducing the results or a way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).

(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome to describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.

5. Open access to data and code

Question: Does the paper provide open access to the data and code, with sufficient instructions to faithfully reproduce the main experimental results, as described in supplemental material?

Answer: [Yes]

Justification: I will provide all the code and datasets for the experiment.

Guidelines:

The answer NA means that paper does not include experiments requiring code.

Please see the NeurIPS code and data submission guidelines ( https://nips.cc/ public/guides/CodeSubmissionPolicy ) for more details.

While we encourage the release of code and data, we understand that this might not be possible, so 'No' is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for a new open-source benchmark).

The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines ( https: //nips.cc/public/guides/CodeSubmissionPolicy ) for more details.

The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.

The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only a subset of experiments are reproducible, they should state which ones are omitted from the script and why.

At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).

Providing as much information as possible in supplemental material (appended to the paper) is recommended, but including URLs to data and code is permitted.

6. Experimental setting/details

Question: Does the paper specify all the training and test details (e.g., data splits, hyperparameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?

Answer: [Yes]

Justification: This paper describes the details of the experiment.

Guidelines:

The answer NA means that the paper does not include experiments.

The experimental setting should be presented in the core of the paper to a level of detail that is necessary to appreciate the results and make sense of them.

The full details can be provided either with the code, in appendix, or as supplemental material.

7. Experiment statistical significance

Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?

Answer: [NA]

Justification: In papers in the field of watermarking, reporting the average of multiple experiments is sufficient. I did not use error lines, confidence intervals, or statistical significance tests because they are not standard practice in the validation of my work.

Guidelines:

The answer NA means that the paper does not include experiments.

The authors should answer "Yes" if the results are accompanied by error bars, confidence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.

The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).

The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)

The assumptions made should be given (e.g., Normally distributed errors).

It should be clear whether the error bar is the standard deviation or the standard error of the mean.

It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have a 96% CI, if the hypothesis of Normality of errors is not verified.

For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out of range (e.g. negative error rates).

If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.

8. Experiments compute resources

Question: For each experiment, does the paper provide sufficient information on the computer resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?

Answer: [Yes]

Justification: These are mentioned in the paper.

Guidelines:

The answer NA means that the paper does not include experiments.

The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.

The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.

The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make it into the paper).

9. Code of ethics

Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics https://neurips.cc/public/EthicsGuidelines ?

Answer: [Yes]

Justification: We comply with the NeurIPS Code of Ethics in every respect.

Guidelines:

The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.

If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics.

The authors should make sure to preserve anonymity (e.g., if there is a special consideration due to laws or regulations in their jurisdiction).

10. Broader impacts

Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?

Answer: [Yes]

Justification: As a technology for copyright protection and prevention of illegal distribution, watermarking inherently brings about positive social impacts.

Guidelines:

The answer NA means that there is no societal impact of the work performed.

If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.

Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.

The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.

The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.

If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML).

11. Safeguards

Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?

Answer: [NA]

Justification: The paper poses no such risks.

Guidelines:

The answer NA means that the paper poses no such risks.

Released models that have a high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.

Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.

We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make a best faith effort.

12. Licenses for existing assets

Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?

Answer: [Yes]

Justification: The creators of datasets from http://corpus-texmex.irisa.fr/ waived copyright rights, fulfilling proper crediting and license - respect requirements.

Guidelines:

The answer NA means that the paper does not use existing assets.

The authors should cite the original paper that produced the code package or dataset.

The authors should state which version of the asset is used and, if possible, include a URL.

The name of the license (e.g., CC-BY 4.0) should be included for each asset.

For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.

If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswithcode.com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of a dataset.

For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.

If this information is not available online, the authors are encouraged to reach out to the asset's creators.

13. New assets

Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?

Answer: [NA]

Justification: The paper does not release new assets.

Guidelines:

The answer NA means that the paper does not release new assets.

Researchers should communicate the details of the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.

The paper should discuss whether and how consent was obtained from people whose asset is used.

At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.

14. Crowdsourcing and research with human subjects

Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?

Answer: [NA]

Justification: The paper does not involve crowdsourcing nor research with human subjects. Guidelines:

The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.

Including this information in the supplemental material is fine, but if the main contribution of the paper involves human subjects, then as much detail as possible should be included in the main paper.

According to the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.

15. Institutional review board (IRB) approvals or equivalent for research with human subjects

Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?

Answer: [NA]

Justification: The paper does not involve crowdsourcing nor research with human subjects.

Guidelines:

The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.

Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.

We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.

For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.

16. Declaration of LLM usage

Question: Does the paper describe the usage of LLMs if it is an important, original, or non-standard component of the core methods in this research? Note that if the LLM is used only for writing, editing, or formatting purposes and does not impact the core methodology, scientific rigorousness, or originality of the research, declaration is not required.

Answer: [NA]

Justification: The core method development in this research does not involve LLMs as any important, original, or non-standard components.

Guidelines:

The answer NA means that the core method development in this research does not involve LLMs as any important, original, or non-standard components.

Please refer to our LLM policy ( https://neurips.cc/Conferences/2025/LLM ) for what should or should not be described.

Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper introduces the innovative Transparent Vector Priority (TVP) watermarking scheme for vector databases, effectively protecting these assets from unauthorized replication while preserving ANN query accuracy. By leveraging the HNSW structure’s edge properties, TVP prioritizes low-query-frequency transparent vectors, reducing query errors by ~75% compared to existing methods, as demonstrated on the ANN_SIFT1M dataset. Its robust design against various attacks and commitment to open access for code and data highlight a significant contribution to secure vector database management.\n\nSTRENGTHS AND WEAKNESSES:\nStrength:\nThe paper’s Transparent Vector Priority (TVP) scheme innovatively uses HNSW’s graph properties to embed watermarks in low-query-frequency vectors, reducing ANN query errors by ~75% and ensuring robustness against attacks, with reproducible results on ANN_SIFT1M.\n\nWeakness:\n1. Limited Graph-Theoretic Depth: TVP relies on basic node degree and edge length metrics for transparent vector selection, lacking advanced graph-theoretic analysis (e.g., spectral or centrality measures), reducing its innovation in graph-based watermarking.\n2. Narrow Experimental Scope: Experiments use fixed HNSW parameters (\\(M=8\\), \\(efConstruct=100\\)) and a single dataset (ANN_SIFT1M), limiting validation of TVP’s applicability across varied configurations and datasets.\n\nQUESTIONS:\n1. The TVP scheme uses basic graph metrics like degree and edge length. Have the authors considered more refined measures, such as spectral properties or centrality, to improve carrier selection and theoretical grounding?\n2. The experiments are conducted with fixed HNSW parameters (\\(M=8\\), \\(efConstruct=100\\)). How does the TVP scheme perform under different HNSW configurations (e.g., varying \\(M\\) or \\(efConstruct\\)), and can the authors validate the robustness of the transparency parameter (ts) across these variations?\n3. Given the reliance on ANN_SIFT1M, have the authors tested or considered evaluating TVP on other datasets, such as deep1b dataset, to ensure the generalizability of the transparent vector selection strategy?\n\nLIMITATIONS:\nyes", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 3, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-06-09"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe proposed method deals with embedding watermark information into feature vectors to prevent unauthorized replication of the vector DB.\nEach data point belongs to one of L groups and is converted to a binary value by cryptographic mapping.\nThen the ratio of 1-vectors to 0-vectors in the g-th group determines the g-th value of the watermark code.\nIf the watermark code is pre-defined, a portion of bits in $n_m$ vectors must be flipped to match the ratio of 0- or 1-vectors to the watermark code.\nThe main contribution of the proposed method is that it selects the data to be flipped based on their expected lower search frequency, rather than choosing them randomly.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths\n\n1. The proposed method appears to be robust against deletion attacks because altering a specific g-th watermark bit requires changing the majority in the g-th group, which cannot be achieved by deleting only a few data points.\n\n2. The paper provides a clear introduction to the important yet underexplored area of preventing unauthorized replication in vector databases.\n\n3. Although the paper states that the method is limited to HNSW, it appears to be applicable to other indexing structures as long as the method for determining the transparency parameter is modified.\n\nWeaknesses\n\n1. However, the method inherently modifies the original feature vectors, which inevitably leads to performance degradation.\nIt would be more ideal to embed watermark information without altering the original feature vectors, such as by using the connectivity of the ANN graph or the indices of nodes selected in the upper layers of HNSW.\n\n2. The modifications are applied to vectors that are expected to be searched less frequently, so the overall performance degradation is minimal. \nHowever, if a query with the modified vector as its first nearest neighbor is provided as input, significant performance degradation can occur.\n\n3. The impact of bit flips during the modification stage is highly concerning when used together with VQ.\nWhile bit flips have little effect on data measured by Hamming distance, they have a much greater impact on data measured by L2 distance.\nMoreover, when each bit of the feature refers to a pre-defined codebook index, as in VQ, this impact is further amplified.\n\nQUESTIONS:\n[Question 1]\nAs mentioned in Weakness 1, this method inevitably introduces performance degradation. \nHowever, since the paper does not use standard ANN evaluation metrics such as R@1, it is difficult to quantify the extent of this degradation. \nThe authors should report these metrics.\n\n[Question 2]\nAs mentioned in Weakness 2, it would be beneficial to provide the variance and maximum values of MQ and FQ instead of the average.\nAdditionally, the paper should show the difference between queries whose first nearest neighbor is a modified data point and those whose first nearest neighbor is an unmodified data point.\n\n[Question 3]\nAs mentioned in Weakness 3, bit flips can completely alter the feature information when used together with VQ techniques like product quantization. \nSince HNSW and VQ techniques are often used in combination, an ablation study on this case should be provided.\n\n[Question 4]\nIf the watermark code S is chosen according to the original cryptographic value distribution, wouldn’t it be possible to skip the modification step?\n\nLIMITATIONS:\nyes", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 3, "CLARITY": 2, "IMPACT": 2, "ORIGINALITY": 2, "DATE": "2025-06-26"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper introduces a watermarking scheme for vector databases, focusing on addressing the security threat of unauthorized replication. The core of the scheme is the Transparent Vector Priority (TVP) strategy, which leverages the characteristic of the Hierarchical Navigable Small World (HNSW) indexing structure where some vectors have few or no edges and thus low query frequencies. By prioritizing watermark embedding in these \"transparent\" vectors, TVP minimizes the impact on Approximate Nearest Neighbor (ANN) query results. Experiments show that TVP reduces missed and false queries by about 75% compared to existing schemes. The paper's contributions include proposing the first vector database watermarking scheme, defining metrics to quantify embedding impact, and optimizing the scheme via transparent vector prioritization to balance query performance and watermark robustness.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\n1. Proposing the first kind vector database watermarking scheme (RS) fills a gap in the research field.\n2. Defining missed queries and false queries to measure the impact of watermark embedding on ANN queries is a precise and necessary step. \n3. The TVP scheme shows a smart optimization approach. By leveraging the characteristics of the HNSW index structure (identifying vectors with low query frequency as \"transparent vectors\") to minimize the impact of watermark embedding, it addresses a key concern in watermarking—preserving the normal operation of the database. \nWeakness:\n1. The allocation of space in the paper is problematic: the sections Basic Methodology: Random Selection and Preliminaries are somewhat lengthy, which results in some important ablation studies being relegated to the appendix. There is still some content overlap between the main text and the appendix, such as Table 1 and Table3\n2. The experimental validation is insufficient, as the experiments were conducted on only a single dataset. Moreover, the two baseline methods used for comparison were not specifically designed for vector datasets, which introduces a certain degree of unfairness.\n\nQUESTIONS:\n1. May I ask if the phrase “Presenting RS” summarized in the Contributions section is a typo? The main technical contribution of this paper should be the TVP strategy.\n2. Could the authors provide comparisons with more methods or evaluate the model's performance on additional datasets?\n\nLIMITATIONS:\n1. The authors should improve the writing and structure of the paper to make it more readable and easier to understand.\n2. See in Weakness.", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 3, "CLARITY": 2, "IMPACT": 2, "ORIGINALITY": 3, "DATE": "2025-06-30"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper introduces the problem of vector database watermarking. With the advent of vector embeddings as a prominent data modality, vector databases have become valuable digital assets. As a result, this paper is the first to extend the idea of watermarking, which has previously been well studied in the context of relational databases, to the new domain of vector DBs. In this paper, the authors propose two vector DB watermarking schemes: random selection (RS) and transparent vector priority (TVP). Random selection selects vectors randomly for perturbation and has the benefit of being agnostic to the specifics of the how the vector DB is implemented. However, RS has relatively poor \"embeddings impact\" as the perturbations can significantly degrade the quality of the vector DB results. In fact, Table 2 shows that RS performs worse than a method designed for tabular data and not vector DBs specifically. On the other hand, TVP focuses on watermarking for the specific case of the popular HNSW index. The authors propose a novel scheme for identifying \"transparent vectors\" -- those that are far away from others in the graph -- and seek to perturb those. In Table 2, the authors report that TVP outperforms other watermarking baselines for HNSW by a sizable margin. In summary, this paper is the first to introduce the problem of vector database watermarking and proposes two candidate solutions: random selection and transparent vector priority. The paper also discusses the tradeoffs between these watermarking approaches and presents metrics for assessing the quality of vector DB watermarks.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths\n\n1. [Originality] To my knowledge, this paper is the first to introduce the problem of vector database watermarking and thus this works stands out for blazing a trail and addressing an original problem. The authors successfully position their work as an evolution of prior literature on watermarking for datasets and relational databases and they introduce a corresponding new sets of evaluation metrics to measure watermarking impact on queries in this domain. \n\n2. [Significance] This paper introduces a potentially high-impact problem and presents the first solutions to tackle this challenge. Given the impact that the first relational database watermarking papers have had in both industry and in follow-up academic work, I see this paper has having the potential to be a pioneering work in establishing a new research area. \n\n\nWeaknesses\n\n1. [Clarity] While I am enthusiastic about the potential for this paper to establish a new, high-impact research direction, I feel the execution in the current version of the paper can be improved considerably. First and foremost, the paper lacks clarity in several places. Perhaps most crucially, the threat model introduced in Section 3.3 is vague and lacks precise definitions. Moreover, while the components of a watermark are described in Section 4.1, I don't believe there is a formal definition of watermarking included in the paper. Beyond just orienting readers to the nature of the problem, I think these formal definitions are critical to be able to judge the quality of the proposed watermarking schemes presented in the paper. For example, in Section 3.3, the authors mention that their threat model assumes attackers are \"not too strong\" but it is unclear what exactly this means. Is the attacker computationally bounded in some manner (e.g. it can run only in polynomial time)? What would then be the time complexity of an attacker trying to recover the watermark? I think this paper would benefit greatly from a revision that introduces formal definitions of the key concepts behind a watermark and then organizes the evaluation of the paper in relation to these definitions. I believe this change would improve the clarity of this work quite a bit. \n\n2. [Quality] In addition to improving the quality of the paper's presentation, I think the authors could also make this submission stronger by either improving the efficacy of their proposed watermarking schemes, or presenting a more comprehensive case that their schemes are viable solutions to the vector DB watermarking problem. For example, the authors present random selection (RS) as a universal method that can be applied to any vector DB regardless of how the index is implemented. But Table 2 seems to suggest that a tabular watermark can match or even exceed the performance of RS. It would be interesting to understand why this is the case. Does TabularMark work as well as RS on other datasets beyond SIFT 1M or is this a one-off result. Moreover, I think it is critical for the authors to evaluate their technique on additional vector datasets, especially those with embeddings derived from modern deep learning models (SIFT is not a deep learning based dataset). Furthermore, while TVP attains the best performance when compared to the baseline methods in Table 2, it is unclear if result this generalizes to other datasets, or even if the transparent vector technique proposed by the authors extends to other datasets. I think this is a critical question to address. Another weakness of TVP is that the technique is presented as an approach highly specialized to HNSW, which limits its impact. Could TVP work for other navigable small world graph indexes like Vamana/DiskANN or NSG? This would give me more confidence in the generality of the technique. With a more comprehensive experimental evaluation, I believe this paper can be much stronger.\n\nQUESTIONS:\nQ1. Can you provide formal definitions of watermarking (and specifically a vector DB watermark)? *I would be willing to raise my evaluation score if the authors can revise their paper to present a formal definition and demonstrate how their proposed schemes fit within this definition.*\n\nQ2. Can you provide a formal definition of the threat model and include a (possibly informal) proof of security associated with your proposed watermarking schemes? I am particularly interested in seeing a more formal treatment of the adversary's capabilities and computational power? For example, would an adversary with unlimited computational power be able to break these watermarking schemes? *I would be willing to raise my evaluation score if the authors can provide a formal treatment of the threat model and provide a proof of security about to their proposed schemes in relation to an adversary with precisely defined capabilities.*\n\nQ3. Can you extend the watermarking evaluation to more datasets beyond SIFT 1M? I would particularly be interested in seeing results for deep learning based embedding datasets. [VIBE](https://github.com/vector-index-bench/vibe), [ANN Benchmarks](https://github.com/erikbern/ann-benchmarks) and [BigANN Benchmarks](https://github.com/harsha-simhadri/big-ann-benchmarks) might all be good places to obtain additional datasets. *I would be willing to raise my evaluation score if the authors can demonstrate that their proposed techniques generalize across a variety of datasets. In particular, I am curious to see if the logic behind node selection in TVP generalizes to additional datasets. I would also be curious to know of TabularMark is still on par or better than RS on additional datasets.*\n\nLIMITATIONS:\nYes", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 4, "CLARITY": 2, "IMPACT": 3, "ORIGINALITY": 4, "DATE": "2025-07-03"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper introduces Transparent Vector Priority (TVP) watermarking, a novel scheme designed for embedding watermarks into vector databases, specifically focusing on minimizing the impact on Approximate Nearest Neighbor (ANN) query results. Vector databases, which are crucial for machine learning tasks, are susceptible to security threats like unauthorized replication, and watermarking offers a solution for ownership authentication.\n\nThe core challenge addressed is that modifying vectors to embed a watermark can negatively affect ANN query performance. The authors observe that within widely used indexing structures like Hierarchical Navigable Small World (HNSW), some \"transparent\" vectors have significantly fewer edges or no edges at all and consequently exhibit much lower query frequencies.\n\nKey Contributions of this work are:\n\n-C1. Novel Watermarking Scheme: The paper proposes the Transparent Vector Priority (TVP) watermarking scheme specifically for vector databases, addressing the critical security need for ownership authentication.\n\n-C2. Minimizing Query Impact: It introduces a unique approach by identifying and prioritizing \"transparent\" vectors (low-query-frequency vectors with fewer or no edges in HNSW graphs) for watermark embedding, thereby minimizing the degradation of ANN query results.\n\nSTRENGTHS AND WEAKNESSES:\n1. Strengths:\n\nS1- Addresses a Critical Security Need: The paper tackles the important and practical problem of ownership authentication in vector databases, which are increasingly vital for machine learning applications and susceptible to unauthorized replication.\n\nS2- Minimises Impact on Query Performance: A key strength is the innovative approach of identifying and prioritising \"transparent\" vectors (those with fewer or no edges and low query frequency in HNSW graphs) for watermark embedding. This strategic placement significantly reduces the negative impact on Approximate Nearest Neighbor (ANN) query results, which is often a major drawback of watermarking schemes.\n\nS3- Leverages HNSW Structure Intelligently: The scheme cleverly exploits the inherent characteristics of the widely used Hierarchical Navigable Small World (HNSW) indexing structure, demonstrating a deep understanding of how these databases operate.\n\n2. Weaknesses: Dependence on Specific Indexing Structure- While a strength, the method's reliance on the existence and characteristics of \"transparent vectors\" derived from HNSW's edge selection and pruning strategies suggests that its direct applicability or optimal performance might be limited to HNSW or very similar graph-based indexing structures. Its generalizability to other types of ANN indexes (e.g., IVF, tree-based, or pure hashing methods) is not explicitly discussed and might be challenging\n\nQUESTIONS:\nQ1- The proposed TVP watermarking scheme effectively leverages the characteristics of \"transparent\" vectors within the HNSW indexing structure. Have you explored, or do you have plans to investigate, how this scheme might be adapted or optimized for other widely used ANN indexing structures (e.g., IVF, tree-based methods, or different graph-based approaches) that may not exhibit the same 'transparent' vector properties as HNSW?\n\nQ2- Beyond the HNSW structure, how might the concept of prioritising low-impact vectors be identified and applied in other types of vector database architectures or even different data management systems where modifications are necessary but impact needs to be minimised?\n\nLIMITATIONS:\nL1- Robustness Against Sophisticated Attacks: The paper focuses on ownership authentication and minimising query impact. While all watermarking schemes face challenges, the specific robustness of TVP against various advanced adversarial attacks (e.g., subtle noise injection, vector perturbations, or targeted attempts to remove the watermark without destroying the data's utility) is not detailed as a primary focus of this work.\n\nL2- Subtle Impact on \"Transparent\" Vectors: Although \"transparent\" vectors have low query frequency, modifying them still alters the original data. In highly specialized or niche analytical tasks, even these seldom-queried vectors might hold unique information, and their alteration, however minimal, could theoretically have unforeseen, tiny impacts on very specific data analysis or rare queries.", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 3, "CLARITY": 2, "IMPACT": 2, "ORIGINALITY": 2, "DATE": "2025-07-06"}