Are You Copying My Model? Protecting the Copyright of Large Language Models for EaaS via Backdoor Watermark

Challenge:	Large language models (LLMs) have demonstrated exceptional abilities in both text understanding and generation.
Approach:	They propose an Embedding Watermark method that implants backdoors on embeddings to protect copyright of large language models.
Outcome:	The proposed method protects the copyright of large language models without compromising service quality while minimizing the adverse impact on the original embeddings’ utility.

Similar Papers

Overview

Challenge

Approach

Outcome

GuardEmb: Dynamic Watermark for Safeguarding Large Language Model Embedding Service Against Model Stealing Attack (2024.findings-emnlp)

Copied to clipboard

Liaoyaqi Wang, Minhao Cheng

Semantic Text Processing

Challenge:	Recent studies reveal the risk of the model stealing attack, posing a financial threat to EaaS providers.
Approach:	They propose a dynamic embedding watermarking method that detects watermarks in embedded text . this method is a cross-platform approach that trains a verifier to detect watermark .
Outcome:	The proposed method enables an attacker to replicate the proposed method for profit without compromising embedding functionality.

WET: Overcoming Paraphrasing Vulnerabilities in Embeddings-as-a-Service with Linear Transformation Watermarks (2025.acl-long)

Copied to clipboard

Anudeex Shetty, Qiongkai Xu, Jey Han Lau

Semantic Text Processing

Challenge:	Existing EaaS watermarks can be removed by paraphrasing when attackers clone the model.
Approach:	They propose a method that integrates a target embedding into the original embeddable based on the presence of trigger words in the input text.
Outcome:	The proposed technique is empirically and theoretically robust against paraphrasing.

RShield: A User-level Traceable Backdoor Watermark for LLMs in Embedding-as-a-Service (2026.findings-acl)

Copied to clipboard

Lingyun Xiang, Yufan Zhong, Chengfu Ou, Zhihua Xia, Chunfang Yang, Daojian Zeng, Zhangjie Fu

Semantic Text Processing

Challenge:	Existing backdoor watermarking techniques are limited to zero-bit detection . RShield enables reliable user-level attribution of large language models under model extraction attacks.
Approach:	They propose a multi-bit backdoor watermarking technique that enables reliable user-level attribution of large language models under model extraction attacks.
Outcome:	RShield achieves 100% multi-bit watermark recovery and high semantic fidelity under model extraction attacks compared to existing methods.

WARDEN: Multi-Directional Backdoor Watermarks for Embedding-as-a-Service Copyright Protection (2024.acl-long)

Copied to clipboard

Anudeex Shetty, Yue Teng, Ke He, Qiongkai Xu

Robustness in NLP

Challenge:	Prior studies have shown that EaaS can be prone to model extraction attacks, however, this concern could be mitigated by adding backdoor watermarks to the text embeddings.
Approach:	They propose a new method that removes backdoor watermarks while maintaining the high utility of embeddings.
Outcome:	The proposed approach increases the stealthiness of watermarks and has been empirically shown to be effective against CSE attacks.

Combating Security and Privacy Issues in the Era of Large Language Models (2024.naacl-tutorials)

Copied to clipboard

Muhao Chen, Chaowei Xiao, Huan Sun, Lei Li, Leon Derczynski, Anima Anandkumar, Fei Wang

Responsible & Trustworthy NLP

Challenge:	a tutorial aims to provide a summary of risks and vulnerabilities in large language models . a number of studies have focused on security, privacy and copyright aspects of LLMs .
Approach:	This tutorial seeks to provide a systematic summary of risks and vulnerabilities in large language models . authors will discuss security, privacy and copyright aspects of LLMs .
Outcome:	This tutorial aims to provide a systematic summary of risks and vulnerabilities in large language models . it will also outline emerging challenges in security, privacy and reliability of LLMs .

Watermarking PLMs on Classification Tasks by Combining Contrastive Learning with Weight Perturbation (2023.findings-emnlp)

Copied to clipboard

Chenxi Gu, Xiaoqing Zheng, Jianhan Xu, Muling Wu, Cenyuan Zhang, Chengsong Huang, Hua Cai, Xuanjing Huang

Semantic Text Processing

Challenge:	Large pre-trained language models (PLMs) are highly valuable intellectual property due to their expensive training costs.
Approach:	They propose to embed backdoors that can be triggered by specific inputs into models by model watermarking.
Outcome:	The proposed method can be used to protect the intellectual property of large pre-trained language models without knowledge about downstream tasks.

Robust and Minimally Invasive Watermarking for EaaS (2025.findings-acl)

Copied to clipboard

Zongqi Wang, Baoyuan Wu, Jingyuan Deng, Yujiu Yang

Robustness in NLP

Challenge:	Existing watermarking methods use a target embedding to create watermarks, but this method results in each embeddable having the same component, making it difficult to remove the watermark.
Approach:	They propose to use embedding watermarks to protect EaaS from model extraction attacks . eaas is vulnerable to model extraction, highlighting the need for copyright protection .
Outcome:	The proposed method can watermark embeddings against model extraction attacks without sacrificing the quality of the embeddables.

SHIELD: Evaluation and Defense Strategies for Copyright Compliance in LLM Text Generation (2024.emnlp-main)

Copied to clipboard

Xiaoze Liu, Ting Sun, Tianyang Xu, Feijie Wu, Cunxiang Wang, Xiaoqian Wang, Jing Gao

Robustness in NLP

Challenge:	Large Language Models (LLMs) have transformed machine learning but have raised significant legal concerns due to their potential to produce text that infringes on copyrights.
Approach:	They propose a lightweight, real-time defense mechanism to prevent the generation of copyrighted text by evaluating methods and testing attack strategies.
Outcome:	The proposed defense significantly reduces the volume of copyrighted text generated by LLMs by effectively refusing malicious requests.

Beyond A Fixed Seal: Adaptive Stealing Watermark in Large Language Models (2026.findings-acl)

Copied to clipboard

Shuhao Zhang, Yuli Chen, Jiale Han, Bo Cheng, Jiabao Ma

Robustness in NLP

Challenge:	Existing detection methods for large language models rely on fixed strategies to steal watermarks.
Approach:	They propose a novel steal-based watermark algorithm that derives watermark information from watermarked texts to craft highly targeted adversarial attacks.
Outcome:	The proposed system significantly increases steal efficiency against target watermarks under identical conditions.

Your Semantic-Independent Watermark is Fragile: A Semantic Perturbation Attack against EaaS Watermark (2025.findings-emnlp)

Copied to clipboard

Zekun Fei, Biao Yi, Jianing Geng, He Ruiqi, Lihai Nie, Zheli Liu

Robustness in NLP

Challenge:	Embedding-as-a-Service (EaaS) is a successful business pattern but faces significant challenges related to various forms of copyright infringement.
Approach:	They propose a semantic-independent watermarking scheme that exploits semantic perturbation tests to bypass verification.
Outcome:	The proposed watermarking schemes possess semantic-independent characteristics and exploit semantic perturbation tests to bypass verification.