WARDEN: Multi-Directional Backdoor Watermarks for Embedding-as-a-Service Copyright Protection (2024)

Abstract: Embedding as a Service (EaaS) has become a widely adopted solution, which offers feature extraction capabilities for addressing various downstream tasks in Natural Language Processing (NLP). Prior studies have shown that EaaS can be prone to model extraction attacks; nevertheless, this concern could be mitigated by adding backdoor watermarks to the text embeddings and subsequently verifying the attack models post-publication. Through the analysis of the recent watermarking strategy for EaaS, EmbMarker, we design a novel CSE (Clustering, Selection, Elimination) attack that removes the backdoor watermark while maintaining the high utility of embeddings, indicating that the previous watermarking approach can be breached. In response to this new threat, we propose a new protocol to make the removal of watermarks more challenging by incorporating multiple possible watermark directions. Our defense approach, WARDEN, notably increases the stealthiness of watermarks and has been empirically shown to be effective against CSE attack.1

heading: 1 Introduction
text: Nowadays, Large Language Models (LLMs), due to their vast capacity, have showcased exceptional proficiency in comprehending and generating natural language and proven effective in many realworld applications (Brown et al., 2020; Radford et al., 2019). Using them as EaaS in a black-box API manner has become one of the most successful commercialization paradigms. Consequently, the owners of these models, such as OpenAI, Google, and Mistral AI, have initiated the provision of EaaS to aid users in various NLP tasks. For instance, one notable provider, OpenAI (2024), with over 150
*Equal contributions. †Corresponding author. 1The code is available at https://github.com/
anudeex/WARDEN.git.
million users, recently released more performant, cheaper EaaS models.2
Given the recent success of EaaS, the associated vulnerabilities have started to attract attention in security and NLP communities (Xu and He, 2023). As a primary example, model extraction attack, a.k.a. imitation attack, has been proven to be effective in stealing the capability of LLMs (Krishna et al., 2020; Tramèr et al., 2016; He et al., 2021a). To conduct such attacks, the attackers query the victim model and then train their own model based on the collected data. Attackers usually invest far less cost and resources than victim to provide competitive services, as shown in Figure 1.a. Therefore, it is imperative to defend against them, and the most popular tactic is to implant statistical signals (or watermarks) via backdoor techniques.
Beyond intellectual property (IP) infringement, further vulnerabilities have been exposed, such as privacy breaches (He et al., 2022a), more performant surrogate models (Xu et al., 2022), and transferable adversarial attacks (He et al., 2021b). As a result, backdoor watermarks are added to EaaS embeddings enabling post-attack lawsuits because the attack models inherit the stealthy watermarks, which could be utilized by EaaS providers to identify them. The first work of this kind uses a predetermined embedding (vector) as the watermark, which is then incorporated into text embeddings in proportion to trigger words (Peng et al., 2023), as illustrated in Figure 1.b. The primary requirements for watermarking methods include: (i) they should not lower the quality of the original application, and (ii) it should be difficult for malicious users to identify or deduce the secret watermark vector (Juuti et al., 2019).
Our first work, CSE attack, challenges the aforementioned second point. It involves creating a
2https://platform.openai.com/docs/apireference/embeddings/
1 13430
framework CSE (Clustering, Selection, Elimination) that selects the suspected embeddings with watermarks by comparing the distortion between embedding pairs of the victim model and a benchmark model, then neutralizes the impact of the watermark on the embeddings, as shown in Figure 1.c. Empirical evidence demonstrates that CSE successfully compromises the watermark while preserving high embedding utility. To mitigate the effects of CSE, our second work introduces WARDEN, a multi-directional Watermark Augmentation for Robust DEfeNse mechanism, which uses multiple watermark embeddings to reduce the chance of attackers breaching all of them, as depicted in Figure 1.d. We notice that WARDEN, even with a limited number of watermarks, is successful in countering CSE. Moreover, we design a corresponding verification protocol to allow every watermark the authority to verify copyright violations.
Our main contributions are as follows:
• We propose CSE (Clustering, Selection, Elimination) framework that breaches the recent state-of-the-art watermarking technique for EaaS, and we conduct extensive experiments to evaluate its effectiveness.
• We design WARDEN to enhance the backdoor watermarks by considering various wa-
termark vectors and conditions. Our studies suggest that the proposed defense method is more robust against CSE and stealthier than EmbMarker on various datasets.

heading: 2 Related Work

heading: 2.1 Imitation Attacks
text: Imitation attacks (Krishna et al., 2020; Orekondy et al., 2019; Yue et al., 2021; Wallace et al., 2020) duplicate cloud models without access to its internal parameters, architecture, or training data. The attack involves sending queries to the victim model and training a functionally similar surrogate model based on API’s responses (Chandrasekaran et al., 2020; Tramèr et al., 2016). Liu et al. 2022, showed that publicly deployed cloud EaaS APIs are also vulnerable to these attacks. It poses a potential threat to EaaS providers, as attackers can easily extract the deployed model in reduced time and with marginal financial investment. More concerningly, such models can outperform victim models (Xu et al., 2022) when involving victim model ensemble and domain adaptation. Subsequently, they may release a similar API at a lower cost, thereby violating IP rights and causing harm to the market.
2

heading: 2.2 Backdoor Attacks and Watermarks
text: Backdoor attacks (Dai et al., 2019), a significant subcategory of adversarial attacks (Alzantot et al., 2018; Ebrahimi et al., 2018), involves inserting textual triggers into a target model such that the victim model behaves normally until the backdoor is activated. Recent works (Zhang et al., 2023; Chen et al., 2022; Huang et al., 2023) have shown that pre-trained LLMs are susceptible to backdoor attacks and transferable to downstream tasks.
Recent research (Li et al., 2022; Tang et al., 2023; Peng et al., 2023) has utilized backdoor as the essential technology to integrate verifiable watermark information in deep learning models, especially LLMs (Kirchenbauer et al., 2023). The reason is that other techniques, such as altering model parameters (Uchida et al., 2017; Lim et al., 2022), need white-box access and are non-transferable in model extraction attacks. Similarly, lexical watermarks (He et al., 2022b,c) do not work on embeddings in the EaaS use case. Drawing inspiration from backdoor attacks, one can correspond EaaS embeddings to a pre-defined watermark when trigger conditions are satisfied. One such work, EmbMarker (Peng et al., 2023), uses just a single embedding and adds this to original embeddings linearly as per the number of moderate-frequency trigger words. However, it was verified against a narrow set of similarity invariant attacks, leaving scope for superior attacks and countermeasures.

heading: 3 Methodology
text: In this section, we first present an overview of the conventional backdoor watermark framework to counter model extraction attacks, then proceed to a detailed design of our CSE attack. Next, we explain WARDEN, the multi-directional watermark extension to the previous watermarking technique.

heading: 3.1 Preliminary
text: Malicious attackers target the EaaS victim service Sv, based on victim model Θv, by sending texts t as queries to receive corresponding original embeddings eo. Considering the threat of model extraction attacks, the victim backdoors original embedding eo using a watermarking function f to inject an additional pre-defined embedding t to return provided embedding ep = f(eo, t). Then, the attack model Θa is trained on ep which is received by querying Θv, and the attacker provides a competitive service Sa based on model Θa. Copyright protection is feasible when f adheres to these criteria: (i) the original EaaS provider should be able to query Sa to verify if Θa has imitated Θv; (ii) the utility of provided embeddings ep is comparable to eo for downstream tasks.
3.2 CSE Attack Framework
This section outlines our Clustering, Selection, and Elimination (CSE) attack, as the framework shown in Figure 2. This approach aims at (i) identifying
3
the embedding vectors most likely to contain the watermark and (ii) eliminating the influence of the watermark while preserving the essential semantics within the embeddings.
Clustering We first employ clustering algorithms to organize the embeddings in the dataset (which attackers have retrieved) into groups. This action enhances the subsequent selection step by: (i) improving the efficiency of calculating pair-wise distance within smaller sets of embeddings, and (ii) providing distinct groups of poisoned data entries, which facilitates the identification of more anomalous pairs. K-Means algorithm (Arthur et al., 2007) is used as the primary clustering approach, while we discuss the effectiveness of other clustering methods in Appendix C.1. Nevertheless, clustering solely is not sufficient for filtering out the watermarked embeddings. For instance, we can observe from the contour lines in Figure 3 that watermarked samples are spread across clusters and inconspicuous. Furthermore, the centroids of the watermarked samples and overall clusters do not coincide. To counteract this, we thus propose the selection module to identify the most suspicious embeddings with the watermark.
Selection We denote the victim model as Θv and introduce another hold-out standard model (or benchmark model) as Θs. Within each cluster Ci, we conduct pairwise evaluations on the corresponding embeddings ep (provided embedding) and es (standard embedding). Those with distinctive distance changes are considered suspected samples.
EmbMarker incorporates varying proportions of a predetermined target embedding into texts containing trigger words. Since the predefined target embedding lacks shared semantic meaning, we hypothesize that the distance between embedding pairs, which have notable contributions from watermarks, exhibit anomaly behavior (validated in Figure 4) compared to corresponding distances derived from a standard language model, such as BERT (Devlin et al., 2019). Such difference is used to reflect the significance of the abnormal rank of watermarked pairs, as estimated by
Dp = Rank(Dv)− Rank(Ds), (1)
where Dv and Ds are cosine similarity disparities between victim embeddings (i.e., ep1 and ep2) potentially containing watermark, and the standard embeddings 3 (i.e., es1 and es2) probably without watermarks. The Rank function indicates the rank of the similarity scores by the embedding pairs in the set of scores (Dv or Ds). The distinction between the suspected and unsuspected embeddings is illustrated in Figure 4.
Elimination Given the suspicious embeddings that are potentially watermarked from the previous step, we hypothesize that the watermark can be identified and recovered in suspicious embeddings’ top principal components (validated in Section 4.2) because the target embedding would be common among them. Following this idea, we propose an elimination algorithm, composed of two
3We use state-of-the-art SBERT (Reimers and Gurevych, 2019) embeddings offering benefits in distance measurement.
4
steps. First, we apply singular value decomposition (SVD) (Golub and Reinsch, 1970) to analyze and identify the top K principal components. Then, the contribution of these components are iteratively eliminated using the Gram-Schmidt (GS) process (Trefethen and Bau, 1997). The elimination step for each principal component vector is demonstrated as follows:
u⟨k+1⟩ = e⟨k⟩ − Proj(e⟨k⟩, c⟨k⟩). (2) In the projection function (Perwass et al., 2009), e⟨k⟩ is projected onto the k-th principal component c⟨k⟩, denoted as
Proj(e⟨k⟩, c⟨k⟩) = c⟨k⟩ · e⟨k⟩ ||c⟨k⟩|| · c ⟨k⟩. (3)
Here, e⟨0⟩ is initialized with ep. After each iteration, e⟨k+1⟩ is acquired by normalizing u⟨k+1⟩ such that Norm ( u⟨k+1⟩ ) = u⟨k+1⟩/||u⟨k+1⟩||.
3.3 WARDEN Defense Framework In response to the successful CSE attack, we propose Watermark Augmentation for Robust DEfeNse (WARDEN) as a counter measurement, which incorporates multiple directions as watermarking embeddings.
Multi-Directional Watermarks To diversify the possibility of watermark directions (or target embeddings), we introduce multiple watermarks, noted as W = {w1,w2, ...,wR}. This strategy increases the difficulty of inferring all of them via the elimination module in CSE attack. These watermarks remain confidential on servers and can be subject to regular updates. We randomly split the trigger words set, T into R independent subsets Tr for R watermarks. Then the trigger counting function, λr is the frequency of trigger words in Tr set with a maximum threshold of m (level of watermark). Finally, we add watermarks to the original embedding eo for text S to generate the corresponding embedding ep as follows:
Norm ( (1− R∑
r=1
λr(S)) · eo + R∑
r=1
λr(S) ·wr ) . (4)
One thing to note is that because we split T for multiple watermarks, the proportion of watermarked samples is independent of R and is the same as in the single watermark case. Due to weight values being implicitly normalised λ(S) = λ1(S) + λ2(S) + . . . + λR(S), where λ(S) is watermark weight used on a single trigger set.
Multi-Watermark Verification We adopt a conservative approach to copyright verification with multiple watermarks, i.e., if any watermark confidently flags IP infringement, we consider it positive. Hence, we build verification datasets, backdoor texts Dbr and benign text Dn as follows:
Dbr = {[t1, t2, ..., tm]|ti ∈ Tr},∀r ∈ [1..R], Dn = {[t1, t2, ..., tm]|ti /∈ T}. (5)
The premise is that embeddings for these backdoor texts will be closer to their corresponding target embedding in contrast to benign texts in the case of watermarks. We leverage this behavior of embedding backdoors to verify copyright infringement at each watermark level. We quantify the closeness by computing cosine similarity and squared L2 distance between target embeddings W and embeddings of Dbr and Dn, i.e.,
cosir = ei ·wr
||ei|| · ||wr|| , l2ir =
∣∣∣∣ ∣∣∣∣ ei
||ei|| − wr||wr||
∣∣∣∣ ∣∣∣∣ 2 ,
Cbr = {cosir |i ∈ Dbr}, Cnr = {cosir |i ∈ Dn}, Lbr = {l2ir|i ∈ Dbr}, Lnr = {l2ir|i ∈ Dn},
(6) where r ∈ [1..R].
The copyright detection performance is evaluated by taking the difference of averaged cosine similarity and averaged squared L2 distance as per Equation 7. Furthermore, we compute the p-valuej using the Kolmogorov-Smirnov (KS) test (Berger and Zhou, 2014) as the third metric, which compares these test value distributions. We aim to reject the null hypothesis: The two cosine similarity value sets Cbr and Cnr are consistent.
∆cosr = 1 |Cbr | ∑
i∈Cbr
i− 1|Cnr | ∑
j∈Cnr j,
∆l2r = 1 |Lbr | ∑
i∈Lbr
i− 1|Lnr | ∑
j∈Lnr j.
(7)
We evaluate these three metrics independently for all the watermarks and then combine them,
∆cos = max 1≤r≤R ∆cosr ,
∆l2 = min 1≤r≤R ∆l2r ,
p-value = min 1≤r≤R p-valuer.
(8)
The core idea is that overall infringement can be certified by the infringement of any one of the target watermarking embeddings.
5

heading: 4 Experiments

heading: 4.1 Experimental Settings
text: Evaluation Dataset To benchmark our attack and defense, we employ standard NLP datasets: Enron (Metsis et al., 2006), SST2 (Socher et al., 2013), AG News (Zhang et al., 2015), and MIND (Wu et al., 2020). We use Enron dataset for email spam classification. AG News and MIND are newsbased and used for recommendation and classification tasks. We use SST2 for sentiment classification. The statistics of these datasets are reported in Table 1.
Evaluation Metrics To evaluate different aspects of our techniques, we adopt the following metrics:
• (Downstream) Task Performance We construct a multi-layer perceptron (MLP) classifier with the EaaS embeddings as inputs. The quality of the embeddings is measured by the accuracy and F1-score of the classifiers on the downstream tasks.
• (Reconstruction) Attack Performance We measure the closeness of reconstructed target embedding(s) (more details in Section 4.2) with original target embedding(s) by reporting their cosine similarity.
• (Infringement) Detection Performance Following previous work (Peng et al., 2023), we employ three metrics, i.e., p-value, difference of cosine similarity, and difference of squared L2 distance. Their customized variations for WARDEN are defined in Section 3.3. Our findings largely rely on this evaluation as it reflects the performance in real-world applications.
Experimental environment is detailed in the Appendix A.
4.2 CSE Experiments CSE is designed to assist model extraction attack bypassing post-publish copyright verification.
Hence, we evaluate whether we are able to bypass the copyright verification using the same watermark detection metrics with an opposite objective, i.e., lower p-value and the absolute values of ∆ metrics close to zero.
Watermark Elimination One of the critical elements in the EmbMarker is the secret target embedding (w) used for adding the watermark. The objective of CSE is to recover and erase this direction from the provided embeddings to circumvent copyright verification. We show later (see Table 3) that such elimination is feasible and does not deteriorate the EaaS quality. To demonstrate that, we start with a simplified case where we assume access to this target embedding and directly remove this direction. Expectedly, as seen in Table 2, we can bypass the copyright verification with minimal impact on the downstream utility performance. Moreover, this validates the importance of the projection technique employed in CSE. Additionally, this raises another technique’s vulnerability of ensuring target embedding is kept secure.
Watermark Reconstruction In a successful attack, the principal components c⟨k⟩ removed from the embeddings erase the watermark by recovering the target embedding. To validate this conjecture, we model and solve an optimization problem as defined in Equation 9 where a linear combination of c⟨k⟩ results in the recovered target embedding w. We then calculate cosine similarity to the target embedding w. A high cosine similarity demonstrates the CSE technique’s effectiveness. For CSE, the reconstructed target embedding is extremely (99+% cosine similarity) close to the original target embedding (more in following Section 4.2),
min α
∥∥∥∥w − K∑
k=1
αk · c⟨k⟩ ∥∥∥∥ 2 . (9)
6
Effectiveness Evaluation In Table 3, CSE along with model extraction attack is proved effective in removing the influence from EmbMarker. Detection performance dropped to almost the original case, which indicates the EaaS provider will not be able to detect the imitation attack performed by the attacker. In addition, for SST2, MIND, AG News datasets, the downstream performance dropped 1- 2%, which demonstrates the attack preserves the embeddings utility. We skip attack performance in the Table 3 as they all have (almost) full watermark reconstruction. However, we discuss this in Section 4.3 where we observe varying values due to the ineffectiveness of CSE attack against WARDEN defense.
Ablation Study An attacker will not be aware whether the model they are trying to imitate is watermarked. Table 4 shows that our attack leads to
only minor quality degradation for such scenarios, demonstrating the suitability of CSE. We perform further extensive quantitative and qualitative sensitivity study to investigate how other factors (such as algorithms, parameters, and models) affect the efficacy of our suggested CSE attack in Appendix C.
4.3 WARDEN Experiments
Watermarking Performance of WARDEN We illustrate the efficiency of employing multiple watermarks in Figure 5, which demonstrates the outstanding performance (yellow and green line upward trend) of WARDEN with increasing R and
7
marginal degradation (blue line) in the downstream utility. The results on other datasets also show similar patterns which can be found in Appendix D.1.
WARDEN against CSE Now, we investigate the effectiveness of WARDEN against CSE (shown in Figure 6). As observed in the previous section, WARDEN is stealthier with increasing watermarks. As expected, the performance of CSE diminishes, correlating with decreasing attack performance (red line). Due to the usage of more watermarks, there is a natural increase in the likelihood that one of them will detect an infringement. Moreover, in extreme scenarios, a mixture of multiple target embeddings will substitute the watermarked samples (Equation 4), reducing the impact of the CSE attack’s exploitation of the semantic distortion in the embeddings.
Gram-Schmidt Extension To further strengthen WARDEN, we investigate the application of the Gram-Schmidt (GS) process (Trefethen and Bau, 1997) on target embeddings W , as we assume the orthogonal set of watermark embeddings are more distinguishable to each other. In our experiments, as reported in Figure 7, the detection performance is stronger after GS selection. In addition, due to orthogonality, the reconstructed target embedding cosine similarities will be significantly lower, indicating CSE might also be ineffective. We observe the same from the corresponding ablation study in Appendix D.1.

heading: 93.12 93.00 93.35 93.00 93.58
text: Ablation Study Similar to the experiments for CSE, we perform WARDEN on non-watermarked models. Due to our strict verification, for the high value of R, the p-value could be noisy. It is because the verification process might find closeness due to genuine semantics instead of backdoors as a result of a high pool of watermark directions. This could lead to false positives, i.e., incorrectly classifying models as copied. However, in such cases, we observe that other detection metrics (∆ based) metrics are reliable, which should aid the entity in making appropriate decisions (refer Figure 18). We conduct a further detailed ablation study dissecting the WARDEN components and showing its stealthiness in Appendix D.

heading: 5 Conclusion
text: In this paper, we first demonstrate that our new CSE attack can bypass the recent EaaS watermarking technique. CSE cleanses the watermarked dataset by clustering them first, then selecting embedding pairs with disparity, and finally eliminating their top principal components, while maintaining the service utility. To remedy this shortcoming, we propose a simple yet effective watermarking method, WARDEN, which augments the previous approach by introducing multiple watermarks to embeddings. Our intensive experiments show that WARDEN is superior in verifying the copyright of EaaS from prior works. Furthermore, WARDEN is also effective against potent CSE, which shows its resilience to different attacks. We also conduct detailed ab-
8
lation studies to verify the importance of every component of CSE and WARDEN. Future studies may consider exploring watermark ownership under multi-owner service settings.
Limitations
We test our WARDEN defense against CSE attack, acknowledging that various other attacks might overcome the uni-directional watermark approach. Although publishing the WARDEN algorithm to the public may inspire future attacks against it, we do not foresee it to be a trivial task, as the capability of WARDEN can be enhanced by using more conservative strategies, e.g., more stealthy trigger patterns and watermarking techniques.
We also know that by having access to the ground-truth watermarking vectors, combined with the GS process, one can eliminate the WARDEN watermarks, as discussed in Appendix D.3. However, it is the service provider’s responsibility to maintain the confidentiality of their watermarking keys.
We also note the false positive of the p-value for non-watermarked models when a large number of watermark vectors are augmented (Figure 18), even though other metrics rectify this incorrect signal. We suggest service providers conduct a preliminary study to select the number of watermarks for WARDEN. In this regard, the current work is an empirical observation study, and theoretical analysis might help decide the optimal number of watermarks. In future, we will endeavour to investigate advanced watermarking mechanisms focusing on defence purposes.
Social Impact
We developed a CSE attack, which could aid attackers in circumventing EaaS IP infringements. We agree that with CSE, any existing system using EmbMarker is vulnerable. Yet, we argue that it is critical to show the possibility of such attacks and make users aware of them. The usual first step in security is to first expose the vulnerability. Additionally, to mitigate the aforementioned threat, we contribute an improved watermarking technique, WARDEN, which could be incorporated with minimal effort.

heading: Acknowledgements
text: We would like to appreciate the valuable feedback from all anonymous reviewers. This research was
supported by The University of Melbourne’s Research Computing Services and the Petascale Campus Initiative. Qiongkai Xu would like to express his gratitude to the FSE Staff Travel Scheme and FSE DDRI grant for the support in both travel and research. Anudeex Shetty would like to express his gratitude to Newman College for the support in travel and research.

heading: A Experimental Settings
text: We leverage the standard codebase of the Transformers (Wolf et al., 2020) library and AdamW (Loshchilov and Hutter, 2019) algorithm for model training and development. Likewise, we use scikitlearn (Pedregosa et al., 2011) for clustering algorithms and other utility calculations. We use GPT-3 text-embedding-002 API as original benign embeddings and the BERT (Devlin et al., 2019) model as the victim model. We perform all the experiments on a single A100 GPU with CUDA 11.7 and pytorch 2.1.2. We assume that both the victim model and imitators use the same datasets to separate the effects of the watermarking technique from other factors. Furthermore, we assume that the extracted model is trained only using the watermarked outputs from the victim model. Finally, we implement the EmbMarker and other experiments following their default configurations and settings, i.e., m = 4, n = 20, and frequency interval = [0.5%, 1%]. The only exception is the R = 10 case in WARDEN, where we use n = 50 to have enough trigger words. A standard dataset, WikiText (Merity et al., 2016) consisting of 1, 801, 350 entries, serves as a hold-out dataset for selecting moderate-frequency words as watermark triggers (T ).

heading: B Similarity Distribution Plots
text: The observations (captured in Figure 8) for other datasets are similar to SST2 as seen in Figure 4, i.e., watermarked embeddings are closer to target embedding, and there is a clear difference in similarities for watermarked and non-watermarked embeddings. Due to skewness between the number of suspected and unsuspected embeddings, we employ sampling for unsuspected entries in these plots.
C CSE Attack Analyses
In this section, we perform detailed ablation studies for CSE attack.
C.1 Comparison of Clustering Algorithms
The previous experiments utilize K-Means as the clustering algorithm. However, alternative algorithms such as Gaussian Mixture Models (GMM) (Reynolds et al., 2009) are also valid options. The subsequent table, Table 5, illustrates the comparative performance between K-Means and GMM. While K-Means exhibits superior performance
in downstream utility for AG News, Enron, and MIND datasets, it is less confident for delta values in the case of Enron and MIND. Overall both algorithms demonstrate satisfactory performance, suggesting that the clustering module for CSE is universally adaptable to different clustering algorithms.
C.2 Number of Clusters (n)
We can see from Figure 9 that there is no significant role in the number of clusters (n). In all the cases, CSE attack is successful, though we use n = 20 in our experiments. However, considering pairwise distance comparison, it is preferable to have fewer clusters to increase the likelihood of watermarked pairs. We also visualize these clusters in Figure 10.
C.3 Number of Principal Components (K)
In Section 4.2, we formulated an optimization problem to compute how much of the watermark we are recovering for a given number of principal components (ck). As expected, with increasing K, we will recover more of the target embeddings, as noted from the red line in Figure 11. However, the utility metrics deteriorate more significantly (blue line). Meanwhile, a lower K does not recover enough target embedding to bypass copyright verification (yellow and green lines – detection performance). To achieve the best of both worlds—downstream utility and avoiding watermark—we must strike a balance, and 50 components seem appropriate. Further, in some cases, we observe that the increasing K does not affect the downstream utility metrics. The downstream task’s simplicity could be the cause of this. For example, Enron dataset is a binary classification task wherein required data could be represented in a few embedding dimensions.
12
C.4 Impact of Attacker Model Size
We evaluate if there are any differences in our attack’s performance for different attacker model sizes. This is tested by performing experiments on small, base, and large versions of the BERT (Devlin et al., 2019) model. As illustrated in the Table 6, the attack effectively bypasses the watermark when the stealer uses different sizes of the backbone model.
D WARDEN Defense Analyses
D.1 Remaining Dataset Results In this subsection, we present the results (Figure 12- 15) for all the remaining datasets discussed in Section 4.3.
D.2 Number of Principal Components (K) in CSE
Because we augment more target embeddings in WARDEN, default configurations of CSE may not be adequate. We tweak the CSE attack by increasing the principal components eliminated, as shown in Figure 16. We note that for a higher number of principal components, CSE is effective in some setups, as we recover more of the target embeddings. However, one thing to note is that the downstream metrics are poor if we eliminate a large number of principal components, undermining the attacker’s objective.
D.3 Access to Target Embeddings In the unlikely event that an attacker has access to all the target embeddings, it should be possible to bypass WARDEN. We replicate this scenario and apply the elimination step of the CSE attack using these embeddings. As expected, in such a case, we can circumvent WARDEN (see Figure 17).
13
14
15

heading: Future Work
text: Future studies may consider exploring watermark ownership under multi-owner service settings. Limitations
We test our WARDEN defense against CSE attack, acknowledging that various other attacks might overcome the uni-directional watermark approach. Although publishing the WARDEN algorithm to the public may inspire future attacks against it, we do not foresee it to be a trivial task, as the capability of WARDEN can be enhanced by using more conservative strategies, e. g. , more stealthy trigger patterns and watermarking techniques. We also know that by having access to the ground-truth watermarking vectors, combined with the GS process, one can eliminate the WARDEN watermarks, as discussed in Appendix D. 3. However, it is the service provider’s responsibility to maintain the confidentiality of their watermarking keys. We also note the false positive of the p-value for non-watermarked models when a large number of watermark vectors are augmented (Figure 18), even though other metrics rectify this incorrect signal. We suggest service providers conduct a preliminary study to select the number of watermarks for WARDEN. In this regard, the current work is an empirical observation study, and theoretical analysis might help decide the optimal number of watermarks. In future, we will endeavour to investigate advanced watermarking mechanisms focusing on defence purposes. Social Impact
We developed a CSE attack, which could aid attackers in circumventing EaaS IP infringements. We agree that with CSE, any existing system using EmbMarker is vulnerable. Yet, we argue that it is critical to show the possibility of such attacks and make users aware of them. The usual first step in security is to first expose the vulnerability. Additionally, to mitigate the aforementioned threat, we contribute an improved watermarking technique, WARDEN, which could be incorporated with minimal effort