Your Semantic-Independent Watermark is Fragile: A Semantic Perturbation Attack against E aa S Watermark (2025)

Abstract: Embedding-as-a-Service (EaaS) has emerged as a successful business pattern but faces significant challenges related to various forms of copyright infringement, particularly the API misuse and model extraction attacks. Various studies have proposed backdoor-based watermarking schemes to protect the copyright of EaaS services. In this paper, we reveal that previous watermarking schemes possess semantic-independent characteristics and propose the Semantic Perturbation Attack (SPA). Our theoretical and experimental analysis demonstrates that this semantic-independent nature makes current watermarking schemes vulnerable to adaptive attacks that exploit semantic perturbation tests to bypass watermark verification. Extensive experimental results across multiple datasets demonstrate that the True Positive Rate (TPR) for identifying watermarked samples under SPA can reach up to more than 95%, rendering watermarks ineffective while maintaining the high utility of the embeddings. In addition, we discuss current potential defense strategies to mitigate SPA. Our code is available at https://github.com/Zk4-ps/EaaS-Embedding-Watermark.

## introduction embedding-as-a-service (eaas) has emerged as a successful business pattern, designed to process user input text and return numerical vectors. eaas supports different downstream tasks for users (e.g., retrieval @xcite , classification @xcite and recommendation @xcite ). however, eaas is highly susceptible to various forms of copyright infringement @xcite , especially the api misuse and model extraction attacks. as shown in figure 1 , after querying the text embeddings, malicious actors may seek to misuse the api of eaas or potentially train their own models to replicate the capabilities of the original models without authorization at a lower cost, falsely claiming them as their own proprietary services. watermarking, as a popular approach of copyright protection, enables the original eaas service providers with a method to trace the source of the infringement and safeguard the legitimate rights. various works @xcite have proposed backdoor-based watermarking schemes for embeddings to protect the copyright of eaas services. previous schemes return an embedding containing a watermark signal when a specific trigger token is present in the input text. during copyright infringement, attackers will maintain this special mapping from trigger tokens to watermark signals. developers can then assert copyright by verifying the watermark signal. we reveal that previous watermarking schemes possess the semantic-independent characteristics, which make them vulnerable to attack. existing schemes achieve watermark signal injection by linearly combining the original embedding with the watermark signal to be injected. thus, the water-mark signal is independent of the input semantics, meaning that the injected signal remains constant regardless of changes in the input text. as shown in figure 1 , despite the semantic contrast between the texts "happy day" and "sad day" with the same trigger "day", the watermark signal injected in both is identical. thus, the watermark signal is insensitive to the semantic perturbations, which contrasts with the behavior of original embeddings. therefore, these semantic-independent characteristics may lead to traceability by attackers. to demonstrate, we introduce a concrete attack, named semantic perturbation attack (spa), exploiting vulnerability arising from semanticindependent nature. spa employs semantic perturbation tests to identify watermarked embeddings and bypass watermark verification. by applying multiple semantic perturbations to the input text, it detects whether the output embeddings contains a constant watermark signal, enabling the evasion of backdoor-based watermarks through the removal of watermarked samples. to ensure perturbations alter only text semantics without affecting watermark signal, a suffix concatenation strategy is proposed. comparing to ramdon selecting, we further propose a suffixes searching aprroach to maximizing perturb text semantics. the perturbed texts are then fed into eaas services, and by analyzing components such as pca components, it becomes possible to determine if output embeddings cluster tightly around a fixed watermark signal, thereby identifying watermarked embeddings. the main contributions of this paper are summarized as following three points: ## motivation as discussed in section 2.2, e t is independent of e o i , showing that the watermark siginal is semantic-independent. the watermark signal will affect watermarked samples and unwatermarked samples differently when faced with semantic perturbations. a key insight is that under semantic perturbations, the text with triggers should exhibit fewer embedding changes than the text without triggers due to the semantic-independent component. effective perturbations increase the likelihood of identifying watermarked embeddings as outliers, accompanied by an upper boundary that guarantees complete identification. for a text sample d i , its perturbed form d ′ i yields the embedding pair (e i , e ′ i ). both e i and e ′ i are highdimensional vectors. to visualize perturbations, we utilize a 2d example with a fixed watermark vector vec t . as illustrated in figure 2 , assume text d i contains triggers, and perturbations preserve the original triggers without introducing new ones. without injecting vec t , the angle between (e i , e ′ i ) is θ 1 . and after injecting vec t , the angle between e i and e ′ i changes to θ 2 . in figure 2 , red vectors represent original ones, transforming to blue vectors after adding vec t . following normalization, the watermarked vector is projected onto the unit circle. the goal of constructing (d i , d ′ i ) is to ensure θ 2 < θ 1 , clustering watermarked embeddings tightly in vector space. this angle distribution difference can be used to identify suspicious samples. when θ 1 is small, achieving θ 2 < θ 1 requires |vec t | to be large and form an @xmath0. for large θ 1 , constraints on vec t relax. θ 1 = 180 • is the upper boundary of semantic perturbation (figure 2 ). if e ′ ## semantic perturbation attack in this section, we offer a detailed explanation of semantic perturbation attack (spa). the key insight of spa lies in leveraging carefully designed semantic perturbations to amplify the divergence between watermarked and non-watermarked embeddings in their responses to semantic variations. since existing watermarking methods are semanticindependent, the watermark signals in watermarked embeddings remain invariant under perturbations, whereas original embeddings exhibit semantically coherent variations. this fundamental discrepancy in variation patterns enables watermark identification. thus, spa is constructed with a total of three components: (1) semantic perturbation strategy; ## discussion of mitigation strategies to counter spa, we explore potential mitigation strategies. we suggest a deep learning-based solution with: (1) a semantic-aware injection model that dynamically injects watermarks based on semantic features, and (2) a verification model. however, this approach introduces a critical trade-off: when the adaptive watermark is learned by a stealer model, verification becomes substantially more challenging. in addition, we attempt to reproduce the adaptive eaas watermarking schemes @xcite in contemporary studies. we discovere conclusions consistent with our exploration. we believe that the semanticaware watermarking paradigm represents a promising direction, yet further investigation into its verification capability remains essential. detailed results and analysis are provided in appendix f. ## conclusion in this paper, we propose spa, a novel attack on eaas watermark exploiting the limitation that current schemes is semantic-independent. spa conducts several semantic perturbations to input text, constructs embedding pairs using the original and perturbed embeddings, measuring the tightness of embeddings and deletes suspicious samples exceeding the threshold while preserving service utility. our extensive experiments demonstrate the effectiveness of spa. we also validate the importance of spa's components and explore mitigation strategies. our work emphasizes the critical role of text semantics in eaas watermarking.