G uard E mb: Dynamic Watermark for Safeguarding Large Language Model Embedding Service Against Model Stealing Attack (2024)

Abstract: Large language model (LLM) companies provide Embedding as a Service (EaaS) to assist the individual in efficiently dealing with downstream tasks such as text classification and recommendation. However, recent works reveal the risk of the model stealing attack, posing a financial threat to EaaS providers. To protect the copyright of EaaS, we propose GuardEmb, a dynamic embedding watermarking method, striking a balance between enhancing watermark detectability and preserving embedding functionality. Our approach involves selecting special tokens and perturbing embeddings containing these tokens to inject watermarks. Simultaneously, we train a verifier to detect these watermarks. In the event of an attacker attempting to replicate our EaaS for profit, their model inherits our watermarks. For watermark verification, we construct verification texts to query the suspicious EaaS, and the verifier identifies our watermarks within the responses, effectively tracing copyright infringement. Extensive experiments across diverse datasets showcase the high detectability of our watermark method, even in out-of-distribution scenarios, without compromising embedding functionality. Our code is publicly available at https://github.com/Melodramass/Dynamic-Watermark.

## threat model consider an embedding as a service (eaas) provider that generates high-quality embeddings, denoted as e, in response to customer queries con-taining text data d. an adversary aims to replicate the underlying model powering this service by exploiting the relationship between query texts and their corresponding embeddings. their goal is to launch a model stealing attack, ultimately creating a competing service for profit. the adversary operates in a challenging environment where they have no direct access to the target model's architecture, training data, or specific watermarking techniques. forced to operate in a black-box setting, they rely on publicly available information and inferences drawn from querying the eaas. while possessing the financial means to query the eaas, the attacker likely has limited computational resources compared to the eaas provider, restricting their ability to train large-scale models or conduct exhaustive attacks. crucially, the attacker's training data differs significantly from the data used to train the target model and any associated watermarking scheme. this data mismatch creates a critical vulnerability that the defender can exploit. furthermore, this motivated attacker is capable of employing various techniques to identify and circumvent watermarking or other protective measures in their pursuit of stealing the eaas model. ## conclusion in this paper, we develop a learnable embedding watermark method, called guardemb, which aims to detect the copyright infringement of llm embeddings. guardemb maintains the embedding utility and improves the accuracy of watermark detection compared to the previous method. we first sample special tokens from the suitable token frequency interval. then we watermark the embedding corresponding to text that contains special tokens by slightly tuning. meanwhile, we train a verifier to distinguish the watermarked and clean embeddings. this verifier will be applied to detect the watermarks from suspicious embeddings we query from the api, returning the confidence score about the watermark's existence. various experiments demonstrate the effect and robustness of guardemb.