Geometry-Aware Localized Watermarking for Copyright Protection in Embedding-as-a-Service

Zhimin Chen; Xiaojie Liang; Wenbo Xu; Yuxuan Liu; Wei Lu

cs.CRApr 13, 2026

Geometry-Aware Localized Watermarking for Copyright Protection in Embedding-as-a-Service

Authors: Zhimin Chen, Xiaojie Liang, Wenbo Xu, Yuxuan Liu, Wei Lu

Organizations: School of Computer Science and Engineering, Sun Yat-sen University, Guangzhou, Guangdong, China

Abstract

Embedding-as-a-Service (EaaS) has become an important semantic infrastructure for natural language and multimedia applications, but it is highly vulnerable to model stealing and copyright infringement. Existing EaaS watermarking methods face a fundamental robustness--utility--verifiability tension: trigger-based methods are fragile to paraphrasing, transformation-based methods are sensitive to dimensional perturbation, and region-based methods may incur false positives due to coincidental geometric affinity. To address this problem, we propose GeoMark, a geometry-aware localized watermarking framework for EaaS copyright protection. GeoMark uses a natural in-manifold embedding as a shared watermark target, constructs geometry-separated anchors with explicit target--anchor margins, and activates watermark injection only within adaptive local neighborhoods. This design decouples where watermarking is triggered from what ownership is attributed to, achieving localized triggering and centralized attribution. Experiments on four benchmark datasets show that GeoMark preserves downstream utility and geometric fidelity while maintaining robust copyright verification under paraphrasing, dimensional perturbation, and CSE (Clustering, Selection, Elimination) attacks, with improved verification stability and low false-positive risk.

Figures & tables

Figure 1. Motivation of GeoMark. Existing EaaS watermarking methods face a robustness–utility–verifiability tension, while GeoMark decouples localized triggering from shared-target attribution to improve robustness and verification reliability with low false-positive risk. A motivation overview comparing existing EaaS watermarking paradigms with GeoMark, highlighting the robustness–utility–verifiability tension and the proposed distributed-triggering, centralized-attribution design.

Figure 2. Overall framework of GeoMark. Given a shared in-manifold watermark target, GeoMark performs geometry-aware anchor initialization, localized watermark injection, and shared-target verification for robust EaaS copyright protection. Pipeline diagram of GeoMark showing three stages: geometry-aware initialization with anchors, anchor-centric local injection, and copyright verification against suspicious surrogates.

Defense	Attack	SST-2		Enron		AGNews		MIND		Verif?
Defense	Attack	Acc. (%)	$p$ -value $\downarrow$	Acc. (%)	$p$ -value $\downarrow$	Acc. (%)	$p$ -value $\downarrow$	Acc. (%)	$p$ -value $\downarrow$	Verif?
Original	–	$93.54\pm 0.15$	$>0.38$	$94.75\pm 0.15$	$>0.87$	$93.43\pm 0.07$	$>0.99$	$77.33\pm 0.06$	$>0.99$	✗
WARDEN	No Attack	$93.50\pm 0.19$	$<10^{-10}$	$94.63\pm 0.07$	$<10^{-9}$	$93.48\pm 0.01$	$<10^{-10}$	$77.39\pm 0.06$	$<10^{-10}$	✓
	+ CSE Attack	$89.03\pm 0.53$	$<10^{-4}$	$95.53\pm 0.42$	$<10^{-5}$	$92.99\pm 0.27$	$<10^{-7}$	$75.69\pm 0.03$	$>0.05$	✗
	+ Paraphrasing Attack (NLLB)	$93.31\pm 0.27$	$<10^{-4}$	$93.53\pm 0.13$	$<10^{-6}$	$92.54\pm 0.09$	$<10^{-10}$	$76.58\pm 0.10$	$<10^{-9}$	✓
	+ Paraphrasing Attack (GPT-4o-mini)	$92.16\pm 0.62$	$>0.15$	$93.83\pm 0.27$	$<10^{-4}$	$92.77\pm 0.03$	$<10^{-10}$	$76.93\pm 0.14$	$<10^{-5}$	✗

Table 1. Performance comparison of different defense methods on SST-2, Enron, AGNews, and MIND. For utility, higher accuracy is better (

\uparrow

), while for ownership verification a lower

p

-value is better from the defender’s perspective (

\downarrow

). In the Verif? column, ✓ and ✗ denote successful and failed copyright protection, respectively. We regard

p<0.05

as successful protection.

Method	SST-2	Enron	AGNews	MIND
WARDEN	97.91	97.76	97.59	97.73
EspeW	96.93	96.95	97.09	96.87
WET	1.00	-1.47	-1.08	0.79
GeoMark	98.17	97.99	97.52	97.86

Table 2. Cosine similarity (%) between the original and protected embeddings. All values are reported in percentage form and therefore fall within the range of

[-100,100]

. Higher values indicate better preservation of semantic utility.

Method	Attack	SST-2			Enron			AGNews			MIND
Method	Attack	$p$ -value $\downarrow$	$\Delta$ cos (%) $\uparrow$	$\Delta L_{2}$ (%) $\downarrow$	$p$ -value $\downarrow$	$\Delta$ cos (%) $\uparrow$	$\Delta L_{2}$ (%) $\downarrow$	$p$ -value $\downarrow$	$\Delta$ cos (%) $\uparrow$	$\Delta L_{2}$ (%) $\downarrow$	$p$ -value $\downarrow$	$\Delta$ cos (%) $\uparrow$	$\Delta L_{2}$ (%) $\downarrow$
GeoMark	Original	$>0.38$	$0.11$	$-0.20$	$>0.87$	$-1.97$	$0.64$	$>0.99$	$-0.95$	$1.56$	$>0.99$	$-2.66$	$4.46$
	No Attack	$<10^{-10}$	$3.26$	$-6.79$	$<10^{-10}$	$5.26$	$-11.71$	$<10^{-10}$	$10.01$	$-19.19$	$<10^{-10}$	$9.24$	$-19.25$
	CSE Attack	$<10^{-6}$	$11.25$	$-7.20$	$<10^{-10}$	$19.09$	$-13.00$	$<10^{-10}$	$30.76$	$-20.69$	$<10^{-10}$	$36.02$	$-24.46$
	Paraphrasing Attack (NLLB)	$<0.002$	$1.32$	$-2.78$	$<10^{-5}$	$2.18$	$-4.93$	$<10^{-10}$	$6.98$	$-13.94$	$<10^{-10}$	$7.50$	$-16.07$
	Paraphrasing Attack (GPT-4o-mini)	$<10^{-4}$	$1.77$	$-3.69$	$<10^{-6}$	$2.43$	$-5.39$	$<10^{-10}$	$8.22$	$-15.71$	$<10^{-10}$	$8.46$	$-17.30$

Table 3. Verifiability and false-positive analysis for GeoMark and related clean-model comparisons. We report the clean-model ( Original ) behavior of GeoMark, an ablation without FPS, and a reimplemented RegionMarker baseline, together with GeoMark results under attack settings.

Figure 3. Effect of local coverage ratio on CSE reconstruction on Enron. Increasing

\rho

reduces reconstruction similarity and improves post-CSE verification significance. A dual-axis line plot on Enron showing reconstructed-target cosine similarity and post-CSE verification significance across different local coverage ratios. Higher local coverage reduces reconstruction fidelity and improves verification after CSE.

Figure 4. Hyper-parameter analysis on the number of anchors

K

on the Enron dataset. Line charts on the Enron dataset comparing model accuracy, negative log p-value, and attribution signal across different anchor counts under multiple attack settings.

Figure 5. Hyper-parameter analysis on local coverage ratio

\rho

on the Enron dataset. Line charts on the Enron dataset comparing model accuracy, negative log p-value, and attribution signal across different local coverage ratios under multiple attack settings.

Robust Watermarking

Robust watermarking embeds or verifies ownership and provenance signals that survive editing, compression, model changes, and deliberate removal.

See all 207 papers

ClockMark: Adaptive and Host-Dependent Watermarking for Large Language Models
Oct 19, 2026Yupeng Qiu, Han Fang, Ee-Chien ChangLLM Watermarking Robust Watermarking
School of Computing, National University of Singapore, Singapore · School of Cyber Science and Technology, University of Science and Technology of China, Hefei, Anhui, China
MarkTune: Improving the Quality-Detectability Trade-off in Model-Embedded LLM Watermarking
Dec 3, 2025Yizhou Zhao, Zhiwei Steven Wu, Adam BlockLLM Watermarking Robust Watermarking
University of Pennsylvania · Carnegie Mellon University · Columbia University
FlowMark: Mask-Guided Video Watermarking
Jul 6, 2026Vishal Asnani, Shruti Agarwal, John CollomosseRobust Watermarking
Adobe Research · DECaDE, University of Surrey

Oct 19, 2026J/K move · Enter open · S save

ClockMark: Adaptive and Host-Dependent Watermarking for Large Language Models

Yupeng Qiu, Han Fang, Ee-Chien Chang

School of Computing, National University of Singapore, Singapore · School of Cyber Science and Technology, University of Science and Technology of China, Hefei, Anhui, China

LLM Watermarking Robust Watermarking Multi-Bit Watermarking

Open paper AskPDF arXiv

Large language model (LLM) watermarking operates on the next-token distribution that evolves during generation. In streaming generation, each sampled token becomes part of the text and affects subsequent distributions. Embedding therefore proceeds with a changing host, unlike classical watermarking, which adapts embedding to an existing host signal. To accommodate this difference, we formulate a novel embedding framework for LLM watermarking based on two principles. We first argue that embedding should be adaptive, retaining the state of previous sampling decisions to better guide subsequent choices. We further argue that embedding should be host-dependent, using the current LLM distribution to constrain both token selection and state updates. Guided by these principles and the two requirements of distribution preservation and robustness to text editing, we propose ClockMark. It combines adaptive and host-dependent embedding with message spreading, embedding the full payload in each watermarked token. Theoretically, we prove that ClockMark preserves the original LLM sequence distribution, thereby maintaining generation quality. Empirically, extensive experiments against 12 baselines demonstrate improved robustness to text editing, with gains of up to 16.08 percentage points in bit accuracy over the strongest tested baseline.

Abstract

Robust Watermarking

Explore similar work

ClockMark: Adaptive and Host-Dependent Watermarking for Large Language Models

MarkTune: Improving the Quality-Detectability Trade-off in Model-Embedded LLM Watermarking

FlowMark: Mask-Guided Video Watermarking