Embedding-as-a-Service (EaaS) has become an important semantic infrastructure for natural language and multimedia applications, but it is highly vulnerable to model stealing and copyright infringement. Existing EaaS watermarking methods face a fundamental robustness--utility--verifiability tension: trigger-based methods are fragile to paraphrasing, transformation-based methods are sensitive to dimensional perturbation, and region-based methods may incur false positives due to coincidental geometric affinity. To address this problem, we propose GeoMark, a geometry-aware localized watermarking framework for EaaS copyright protection. GeoMark uses a natural in-manifold embedding as a shared watermark target, constructs geometry-separated anchors with explicit target--anchor margins, and activates watermark injection only within adaptive local neighborhoods. This design decouples where watermarking is triggered from what ownership is attributed to, achieving localized triggering and centralized attribution. Experiments on four benchmark datasets show that GeoMark preserves downstream utility and geometric fidelity while maintaining robust copyright verification under paraphrasing, dimensional perturbation, and CSE (Clustering, Selection, Elimination) attacks, with improved verification stability and low false-positive risk.
Figures & tables
Figure 1. Motivation of GeoMark. Existing EaaS watermarking methods face a robustness–utility–verifiability tension, while GeoMark decouples localized triggering from shared-target attribution to improve robustness and verification reliability with low false-positive risk. A motivation overview comparing existing EaaS watermarking paradigms with GeoMark, highlighting the robustness–utility–verifiability tension and the proposed distributed-triggering, centralized-attribution design.
Figure 2. Overall framework of GeoMark. Given a shared in-manifold watermark target, GeoMark performs geometry-aware anchor initialization, localized watermark injection, and shared-target verification for robust EaaS copyright protection. Pipeline diagram of GeoMark showing three stages: geometry-aware initialization with anchors, anchor-centric local injection, and copyright verification against suspicious surrogates.
Defense
Attack
SST-2
Enron
AGNews
MIND
Verif?
Acc. (%)
p -value ↓
Acc. (%)
p -value ↓
Acc. (%)
p -value ↓
Acc. (%)
p -value ↓
Original
–
93.54±0.15
>0.38
94.75±0.15
>0.87
93.43±0.07
>0.99
77.33±0.06
>0.99
✗
WARDEN
No Attack
93.50±0.19
<10−10
94.63±0.07
<10−9
93.48±0.01
<10−10
77.39±0.06
<10−10
✓
+ CSE Attack
89.03±0.53
<10−4
95.53±0.42
<10−5
92.99±0.27
<10−7
75.69±0.03
>0.05
✗
+ Paraphrasing Attack (NLLB)
93.31±0.27
<10−4
93.53±0.13
<10−6
92.54±0.09
<10−10
76.58±0.10
<10−9
✓
+ Paraphrasing Attack (GPT-4o-mini)
92.16±0.62
>0.15
93.83±0.27
<10−4
92.77±0.03
<10−10
76.93±0.14
<10−5
✗
Table 1. Performance comparison of different defense methods on SST-2, Enron, AGNews, and MIND. For utility, higher accuracy is better ( ↑ ), while for ownership verification a lower p -value is better from the defender’s perspective ( ↓ ). In the Verif? column, ✓ and ✗ denote successful and failed copyright protection, respectively. We regard p<0.05 as successful protection.
Method
SST-2
Enron
AGNews
MIND
WARDEN
97.91
97.76
97.59
97.73
EspeW
96.93
96.95
97.09
96.87
WET
1.00
-1.47
-1.08
0.79
GeoMark
98.17
97.99
97.52
97.86
Table 2. Cosine similarity (%) between the original and protected embeddings. All values are reported in percentage form and therefore fall within the range of [−100,100] . Higher values indicate better preservation of semantic utility.
Method
Attack
SST-2
Enron
AGNews
MIND
p -value ↓
Δ cos (%) ↑
ΔL2 (%) ↓
p -value ↓
Δ cos (%) ↑
ΔL2 (%) ↓
p -value ↓
Δ cos (%) ↑
ΔL2 (%) ↓
p -value ↓
Δ cos (%) ↑
ΔL2 (%) ↓
GeoMark
Original
>0.38
0.11
−0.20
>0.87
−1.97
0.64
>0.99
−0.95
1.56
>0.99
−2.66
4.46
No Attack
<10−10
3.26
−6.79
<10−10
5.26
−11.71
<10−10
10.01
−19.19
<10−10
9.24
−19.25
CSE Attack
<10−6
11.25
−7.20
<10−10
19.09
−13.00
<10−10
30.76
−20.69
<10−10
36.02
−24.46
Paraphrasing Attack (NLLB)
<0.002
1.32
−2.78
<10−5
2.18
−4.93
<10−10
6.98
−13.94
<10−10
7.50
−16.07
Paraphrasing Attack (GPT-4o-mini)
<10−4
1.77
−3.69
<10−6
2.43
−5.39
<10−10
8.22
−15.71
<10−10
8.46
−17.30
Table 3. Verifiability and false-positive analysis for GeoMark and related clean-model comparisons. We report the clean-model ( Original ) behavior of GeoMark, an ablation without FPS, and a reimplemented RegionMarker baseline, together with GeoMark results under attack settings.
Figure 3. Effect of local coverage ratio on CSE reconstruction on Enron. Increasing ρ reduces reconstruction similarity and improves post-CSE verification significance. A dual-axis line plot on Enron showing reconstructed-target cosine similarity and post-CSE verification significance across different local coverage ratios. Higher local coverage reduces reconstruction fidelity and improves verification after CSE.
Figure 4. Hyper-parameter analysis on the number of anchors K on the Enron dataset. Line charts on the Enron dataset comparing model accuracy, negative log p-value, and attribution signal across different anchor counts under multiple attack settings.
Figure 5. Hyper-parameter analysis on local coverage ratio ρ on the Enron dataset. Line charts on the Enron dataset comparing model accuracy, negative log p-value, and attribution signal across different local coverage ratios under multiple attack settings.
Large language model (LLM) watermarking operates on the next-token distribution that evolves during generation. In streaming generation, each sampled token becomes part of the text and affects subsequent distributions. Embedding therefore proceeds with a changing host, unlike classical watermarking, which adapts embedding to an existing host signal. To accommodate this difference, we formulate a novel embedding framework for LLM watermarking based on two principles. We first argue that embedding should be adaptive, retaining the state of previous sampling decisions to better guide subsequent choices. We further argue that embedding should be host-dependent, using the current LLM distribution to constrain both token selection and state updates. Guided by these principles and the two requirements of distribution preservation and robustness to text editing, we propose ClockMark. It combines adaptive and host-dependent embedding with message spreading, embedding the full payload in each watermarked token. Theoretically, we prove that ClockMark preserves the original LLM sequence distribution, thereby maintaining generation quality. Empirically, extensive experiments against 12 baselines demonstrate improved robustness to text editing, with gains of up to 16.08 percentage points in bit accuracy over the strongest tested baseline.
Yupeng Qiu, Han Fang, Ee-Chien Chang
School of Computing, National University of Singapore, Singapore · School of Cyber Science and Technology, University of Science and Technology of China, Hefei, Anhui, China
Language model watermarking schemes fall into two broad categories: inference-time methods, which modify the decoding process at generation time, and model-embedded methods, which encode a secret signal directly into the model weights. Inference-time watermarking methods incur additional inference overhead and are not applicable in the increasingly prevalent open-weight model settings. In contrast, model-embedded watermarks introduce no additional inference latency-generation uses the standard sampling pipeline-and are particularly well-suited to open-weight settings. However, existing model-embedded approaches such as GaussMark face a fundamental quality-detectability trade-off: achieving strong detection power typically requires weight perturbations that noticeably degrade generation quality. Our key insight is that regularizing toward a high-quality reference distribution decouples quality preservation from proximity to the base model, enabling a better quality-detectability trade-off. Building on this insight, we introduce MarkTune, a theoretically grounded on-policy fine-tuning framework that uses the GaussMark detection statistic as a reward while preserving generation quality through cross-entropy on high-quality human text or KL divergence to a stronger oracle model. Empirically, MarkTune substantially improves the quality-detectability frontier of GaussMark, approaching the detectability of strong inference-time schemes while preserving generation quality and downstream task performance. Marktune also remains robust under the evaluated text-editing and open-weight attacks and generalizes across datasets, retaining substantial detection power on corpora unseen during training. Code is available at https://github.com/zhyzmath/MarkTune-LLM-Watermarking.
Yizhou Zhao, Zhiwei Steven Wu, Adam Block
University of Pennsylvania · Carnegie Mellon University · Columbia University
We present FlowMark, a video watermarking framework guided by automatically predicted object masks. In contrast to prior region-based approaches that require user-supplied mask guidance, FlowMark learns to identify optimal regions for watermark embedding through a dedicated Mask Predictor network. Our end-to-end trainable architecture combines region-aware encoding with noise-augmented training to ensure robustness against compression, geometric transformations, and content variation, while preserving high perceptual quality. Our content-adaptive masking keeps watermark signals coherent with natural video dynamics, effectively eliminating perceptual flicker. Beyond compression robustness, FlowMark maintains reliable watermark recovery under video-native temporal edits (e.g., frame swap, insertion, deletion, resampling, and interpolation) and real-world social media distribution pipelines (e.g., YouTube and Facebook re-encoding). Experimental results on both image and video datasets show that FlowMark reliably embeds 128-bit messages with up to 50.08 dB PSNR, offering strong performance for content provenance, temporal authenticity verification, and video integrity protection.