Pith. sign in

REVIEW 2 major objections 4 minor 39 references

HaloMark: A Spectral Threshold for Embedding-Vector Watermarking under C2PA

T0 review · 2 major / 4 minor · reviewed 2026-08-14 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A C2PA-bound embedding watermark survives known-plaintext removal only when the encoder's effective-rank ratio exceeds about 0.19.

desk verdict The key derivation from the public C2PA claim hash breaks the central secrecy assumption, so the headline security claim collapses; the empirical threshold and published-commit idea remain useful. read the letter →

arxiv 2608.08645 v1 pith:FBJJ32MU submitted 2026-08-09 cs.CR cs.IR

Tarun Sharma This is my paper · ORCID
classification cs.CRcs.IR
keywords embeddingwatermarkingC2PAprovenanceknown-plaintextattackspectralthresholdlocality-sensitivehashingdenoisingautoencodervectordatabasessignatureretention
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

HaloMark tries to establish that embedding vectors can carry a C2PA-bound watermark that survives routine post-processing and even a polynomial known-plaintext attacker, provided the embedding model's spectrum is favorable. The protocol change that makes this tractable is publishing the per-vector locality-sensitive-hash commitment in the signed C2PA sidecar so the verifier reads it instead of recomputing it from a possibly attacked input. That single move reduces the detection score to a null term plus a single retention scalar $\beta(A)\varepsilon$, and the paper claims the scalar stays high exactly when the encoder's effective-rank ratio $\operatorname{eff\_rank}(\Sigma)/d$ is above about $0.19$. On eleven embedders, every above-threshold model defends (AUROC at least 0.98 across all in-budget attacks on the three fully swept encoders, and at least 0.965 under single-seed DAE removal on the rest) while every below-threshold variant fails. If correct, this fixes content provenance for dense vectors in RAG and semantic-search systems where fixed hashes cannot survive normal embedding transformations.

What carries the argument

The load-bearing object is the published commitment $c$: a scale-invariant locality-sensitive-hash bucket computed on the non-watermark subspace of the whitened, rotated embedding, signed into the C2PA sidecar alongside the vector and nonce. Because the verifier reads $c$ from the manifest instead of recomputing it, the verifier-side signatures equal the producer-side signatures bit-for-bit, and the verifier score splits linearly as $T = T_{\mathrm{null}} + \beta(A)\varepsilon$ (Lemma 1). The scalar $\beta(A)$, the attacker's retained signature fraction, then carries the whole security argument: the paper bounds it rigorously for linear attackers via a Wiener-filter characterization $\beta_{\mathrm{char}} = \phi(\nu^*)/\sqrt{d\,\rho(\nu^*)}$ and for non-adaptive attackers via $\mathbb{E}[\beta] \ge 0.97$, while for the adaptive DAE it is measured empirically. Four primitives compose behind that scalar: a block-diagonal orthogonal rotation $Q$ keyed by $K$, public Tikhonov-regularized whitening $W = (\Sigma_{\mathrm{calib}} + \lambda_{\mathrm{reg}} I)^{-1/2}$, a content-dependent LSH commitment, and a per-vector nonce; the production default additionally aligns watermark blocks with the top eigenvectors of $\Sigma_{\mathrm{calib}}$.

What would settle it

Take any published watermarked vector and its C2PA manifest; compute $K=\mathrm{HKDF}(\mathrm{claim\_hash}(m), \text{'HaloMark'})$, regenerate the block-diagonal rotation, commitment, and per-block signatures, and subtract the reconstructed perturbation from $x'$. If the cosine to the clean vector stays at or above 0.95 while the HaloMark score drops to the null distribution, the C4 removal claim fails under the paper's own public-data assumption.

Watch

Extended reading notes

Core claim

The central claim is that a perturbative embedding watermark can be cryptographically bound to C2PA and can resist known-plaintext removal attacks with detection AUROC at least 0.965, not for every encoder, but precisely for encoders whose covariance spectrum is diffuse enough that $\operatorname{eff\_rank}(\Sigma)/d \ge 0.19$. Above the threshold the construction keeps detection AUROC at 0.99 or better on the fully swept encoders under a denoising-autoencoder attacker trained on $10^5$ clean/watermarked pairs with full sidecar visibility, and at 0.965 or higher on the remaining above-threshold encoders. Below the threshold, six structurally distinct perturbative schemes all collapse, including manifold-aligned additive, multiplicative rotation, anchor-pulling, and adversarial-carrier selection. The paper interprets this as a structural limit: below the threshold, any perturbative direction is either off the data manifold and removable by projection, or on it and indistinguishable from data variability. The security statement is the reduction of the whole argument to a single scalar $\beta(A)$, bounded rigorously for linear and non-adaptive attackers and characterized empirically, within about 13%, for the adaptive Wiener/DAE case.

Load-bearing premise

The threat model requires that the adversary never learn the watermark key $K$, but the scheme defines $K$ as a hash of the public C2PA manifest claim hash, so a party who can read the signed sidecar can recompute $K$ and every derived signature.

Editorial extensions

If this is right

  • Encoders with $\operatorname{eff\_rank}(\Sigma)/d \ge 0.19$ can deploy C2PA-bound embedding provenance with DAE-removal AUROC at least 0.965, usually above 0.99, even when the adversary holds $10^5$ clean/watermarked pairs and the full signed sidecar.
  • The verifier never needs to re-derive the LSH bucket from an attacked vector; the published commitment removes the whitening-induced bucket-flip fragility that costs about 20 TPR points in a recompute-commit design.
  • Below the threshold, no perturbative watermark design among those tested clears the AUROC 0.85 trip-wire, so the encoder's spectrum, not the watermark construction, decides feasibility.
  • The system fits into existing vector-database pipelines: 24 bytes of sidecar per vector, about 284 microseconds of verification as a vector-database admission filter, and end-to-end C2PA validation across three reference-SDK bindings.
  • When source text travels with the embedding, a MinHash sketch in the same manifest rejects 92% of multi-attempt paraphrases while accepting routine perturbations, closing the paraphrase gap for RAG deployments; pure-vector deployments remain paraphrase-open.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper's own KeyGen derives $K = \mathrm{HKDF}(\mathrm{claim\_hash}(m), \text{'HaloMark'})$ from the public C2PA manifest claim hash, so a sidecar-visible adversary can recompute $K$ and regenerate every signature; the paper does not fold this consequence into its C4 analysis.
  • If the key-derivation issue is patched by deriving $K$ from a verifier-side secret rather than public manifest data, the remaining empirical claims about the spectral threshold, AUROC levels, and latency would stand or fall on their own.
  • The threshold $0.19$ could serve as a deployer-facing screening statistic: compute $\operatorname{eff\_rank}(\Sigma)/d$ from a calibration corpus to predict whether any perturbative watermark can hold before implementing the attack suite.
  • The dimension-uniformity of the threshold across $d \in \{384,512,768,1024\}$ is not captured by the paper's random-Q formula, suggesting a curvature-corrected derivation from the data manifold's geometry; testing embedders beyond $d=1024$ would show whether the uniformity persists.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

2 major / 4 minor

Summary. The paper proposes HaloMark, a watermarking scheme for embedding vectors that binds a per-vector watermarked embedding to a C2PA manifest. The core design publishes an input-dependent LSH commitment c in the C2PA sidecar so that the verifier reads c instead of recomputing it, then derives per-block signatures from the key K, the nonce n, and c. The authors argue that this reduces verification to a single scalar β(A), bound it for linear attackers, and report an empirical spectral threshold: encoders with eff_rank(Σ)/d above roughly 0.19 defend against polynomial-known-plaintext and denoising-autoencoder attacks, while encoders below this threshold fail. The evaluation includes eleven embedders, eight baselines, ten adaptive attackers, multi-tenant isolation, C2PA SDK interop, and a Qdrant admission-filter deployment at 284 μs per vector.

Significance. If its security claims were valid, the paper would make a useful contribution: the published-commit verifier is a clean way to avoid LSH bucket-flip fragility under whitening, the reduction of the security analysis to a single retention scalar is elegant, and the empirical spectral-threshold observation is interesting even without a derivation. The paper also ships reproducible code, detailed attack sweeps, and careful deployment measurements, which are strengths. However, the central secrecy premise is false: the scheme derives the only secret key from a public manifest field, so the C4 adversary can recompute K and all derived signatures. The security analysis, the AUROC tables, and the threshold claim all measure a protocol whose supposed secret is not secret. As written, the manuscript does not establish the claimed KPA resistance or the claimed C4 removal security.

major comments (2)
  1. [§IV-A, §II-C, §IV-E] The key-secrecy assumption is internally contradicted by the construction. KeyGen(pp, m) sets K = HKDF(claim_hash(m), "HaloMark"), and §IV-E instructs the verifier to derive K from C2PA.manifest_claim_hash. The C2PA manifest and its deterministic claim hash are public, and the C1 adversary is explicitly given the manifest m and full sidecar visibility. Therefore the statement in §II-C that the C4 attacker does not have access to K is false by construction. Any adversary holding the manifest can compute claim_hash(m), derive K, regenerate the block subset W, the rotation Q, the commitment projection P, and every signature s_i(c, n, K) from the published (n, c). For the manifold-aligned production default of §IV-C, the attacker can compute the added watermark component U_top * eta and remove it from a watermarked vector, yielding a vector that satisfies the cosine budget while driving the verifier score toward the null distribution. This is a successful C4 removal with no additional known-plaintext pairs beyond the C1 observation. Lemma 1, Theorem 1, Proposition 1, and the AUROC tables in §VI analyze a protocol whose only secret is publicly derivable; they therefore do not establish the claimed security.
  2. [§IV-D and §VI] The entire empirical security evaluation is conditioned on the broken secrecy premise. The DAE, direction-oracle, and baseline comparisons in Tables II–VI are run against a scheme whose key is recoverable from public manifest data, so the measured AUROC values do not measure KPA resistance under the stated threat model. A correct version of the paper must either provision K as a true secret shared between producer and verifier and rerun the full attack suite under that key-management model, or explicitly state that no secrecy-based security is provided. As written, the protocol's own key-derivation rule and the threat model cannot both be true.
minor comments (4)
  1. [Table I and §IV-A] The same symbol W denotes both the whitening matrix and the w-element block subset; the notation table warns about this, but adjacent equations in §IV-A still use W for both objects. Please use a distinct symbol such as \mathcal{W} for the block subset.
  2. [§IV-D] The proof sketch of Lemma 1 attributes the tail bound to Chernoff; for a sub-Gaussian variable the standard tool is a Hoeffding-type inequality. Please correct the wording.
  3. [§VI-C] The statement that continuous-score PGD drives AUROC to 0 at q=64 should also report the cosine fidelity at that operating point, since an attack that pushes the vector below δ_C4 is not a C4-valid removal by the paper's own outcome accounting.
  4. [§VI-D and Abstract] The 'if and only if' phrasing attached to the eff_rank/d ≈ 0.19 threshold is stronger than the evidence: the threshold is an empirical regularity, the straddling pair consists of one encoder on each side, and the d-uniformity is admittedly unexplained. Please phrase the claim as 'the tested encoders separate at' rather than as a universal iff.

Circularity Check

0 steps flagged · score 0.0 of 10

No circular derivation: HaloMark's security reduction is definitional but its load-bearing quantities are measured or independently bounded, and the threshold is presented as empirical.

full rationale

The paper's central decomposition Eq. (3) defines beta(A) as the attacker's signature retention, and Lemma 1 then lower-bounds TPR in terms of beta; this is a definitional reduction, but the paper does not present it as a prediction from nothing. For linear attackers beta is bounded by Theorem 1 via a Wiener-filter/Cauchy-Schwarz argument computable from the covariance spectrum, and for adaptive attackers beta is measured empirically and the paper explicitly declines to claim the strong bound covers them ('for it, the only rigorous statement is the loose floor, while its strong measured defendability ... is an empirical result'). The eff_rank/d about 0.19 separation is presented as an empirical regularity, not derived; the paper states 'the threshold value rests on the CLIP/bge-base pair that straddles the line' and 'Why the threshold is dimension-uniform is left open.' There are no load-bearing self-citations: the construction adapts SEAL, Bileve, and MetaSeal with attribution, and the new published-commit step is not justified by a self-citation. The key-derivation weakness (K=HKDF(claim_hash(m), 'HaloMark') with claim_hash public under C1) is a serious security-model inconsistency and correctness risk, but it is not a circularity: the security proof assumes K secret, and the flaw is that this premise is internally contradicted in the threat model, not that the derivation smuggles in its conclusion.

Assumptions & free parameters 5 free parameters · 5 assumptions · 0 invented entities

The construction leans on four families of assumptions: the secrecy of K (which fails because claim_hash is public), the sub-Gaussian score tail, the manifold-projection model for DAE attackers, and trust in the calibration registry. The free parameters lambda_reg, epsilon, tau_C, delta_C4, and the block count w are chosen by hand or tuned on the evaluation corpus, and the headline beta and threshold numbers depend on them. No new physical entities are introduced.

free parameters (5)
  • lambda_reg = 1e-4
    Whitening regularizer; changed from 1e-3 to 1e-4, raising random-Q beta from 0.705 to 0.752 in Section VI-A. Central robustness numbers depend on this choice.
  • epsilon = 0.07
    Watermark amplitude; chosen as default in Section VI-A. Balances imperceptibility (cosine 0.967) against detectability, and the threshold analysis in Eq. (6) depends on it.
  • tau_C = 0.70
    Mode C MinHash acceptance threshold; tuned on the MS MARCO subset where 0.65 gives Youden index 1.000, then raised to 0.70 for cross-encoder deployment (Section IV-F).
  • delta_C4 = 0.95
    Deployer-chosen cosine fidelity budget; attacks that fall below it are counted as asset destruction rather than watermark removal (Section II-C). The C4-valid AUROC numbers are defined relative to this budget.
  • w (watermark block count) = 16
    Hand-chosen default; the proposed threshold formula Eq. (6) scales with w, so the empirical threshold may vary with this choice, and no sweep over w is reported.
assumptions (5)
  • ad hoc to paper K can serve as a secret key even though it is derived from the C2PA manifest claim hash.
    KeyGen sets K=HKDF(claim_hash(m),'HaloMark') and the threat model assumes the adversary lacks K, but the claim hash is public manifest data. This assumption is false and is the load-bearing failure.
  • domain assumption Assumption 1: the verifier score under H0 is sub-Gaussian with variance bound (1+zeta)/(wd).
    Needed for the Chernoff tail in Lemma 1; measured only on MS MARCO MiniLM and MPNet, with a Chebyshev fallback for other encoders (Section IV-D).
  • domain assumption DAE attackers can be modeled as learners of a manifold projection.
    The security argument for manifold alignment assumes a DAE learns the data manifold and removes off-manifold watermark directions; this is used in Section IV-C but not formally proved.
  • domain assumption The calibration-corpus registry is trusted at the same level as a C2PA CA.
    A compromised Sigma_calib could align the watermark with attacker-knowable directions; the paper recommends pinning SHA-256 and discusses the risk in Sections II-C and VII.
  • standard math HKDF-as-PRF and the C2PA ECDSA signature are secure.
    The security reductions rely on these standard cryptographic assumptions, inherited from the cited C2PA and PRF literature.

how reviews work

0 comments
Cite this review

Pith. "Pith review of HaloMark: A Spectral Threshold for Embedding-Vector Watermarking under C2PA." pith.science (2026). https://pith.science/paper/FBJJ32MU

@misc{pith2026260808645,
  author       = {Pith},
  title        = {Pith review of: HaloMark: A Spectral Threshold for Embedding-Vector Watermarking under C2PA},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/FBJJ32MU}},
  note         = {Machine review of arXiv:2608.08645}
}
read the original abstract

Foundation-model embeddings are now a primary data asset, but the content-provenance machinery built for images and audio does not transfer to them. C2PA binds to an asset with a stable bit-level or perceptual identity; embeddings have neither, since quantisation, projection, fine-tuning, and windowed averaging reshape them in normal use and break any fixed hash. We present HaloMark, a watermark for embedding vectors cryptographically bound to a C2PA manifest. It composes four standard primitives -- a block-diagonal orthogonal rotation, public whitening, an input-dependent LSH commitment, and a per-vector nonce -- around one protocol change: the producer signs the LSH commitment c into the C2PA sidecar, and the verifier reads c from the manifest instead of recomputing it. Recomputing is fragile under whitening, which flips the commitment bucket on 62% of inputs at cos = 0.96; reading the signed c reduces the verifier's score to T = T_null + beta(A)*epsilon, so security turns on a single scalar beta, which we bound rigorously for linear and non-adaptive attackers and characterise empirically for the adaptive case. We evaluate against an adversary holding polynomially many clean/watermarked pairs under one key with full sidecar visibility, across eight baselines and ten adaptive attackers including denoising-autoencoder removal. The eleven encoders separate at an empirical threshold eff_rank(Sigma)/d ~= 0.19: above it, detection AUROC stays at 0.98 or higher across every in-budget attack on the three encoders we sweep in full, and at 0.965 or higher under single-seed DAE removal on the rest; below it every variant we tested fails. Why the threshold is dimension-uniform is left open. Deployed as a Qdrant admission filter, the verifier runs at 284 us and 24 bytes of sidecar per vector, validated end-to-end against three C2PA reference-SDK bindings.

Figures

Figures reproduced from arXiv: 2608.08645 by the authors.

Figure 1
Figure 1. Published-commit verifier protocol. The producer’s LSH commit [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

39 extracted references · 26 canonical work pages

  1. [1]

    SEAL: Seman- tic aware image watermarking,

    K. Arabi, R. T. Witter, C. Hegde, and N. Cohen, “SEAL: Seman- tic aware image watermarking,” inProc. IEEE/CVF ICCV, 2025, arXiv:2503.12172

    arXiv 2025

  2. [2]

    C2PA specification, version 2.0,

    Coalition for Content Provenance and Authenticity, “C2PA specification, version 2.0,” https://spec.c2pa.org/specifications/specifications/2.0/index. html, 2024

    work page 2024

  3. [3]

    Dense passage retrieval for open-domain question answering,

    V . Karpukhin, B. O˘guz, S. Min, P. Lewis, L. Wu, S. Edunov, D. Chen, and W. tau Yih, “Dense passage retrieval for open-domain question answering,” inProc. EMNLP, 2020

    work page 2020

  4. [4]

    Sentence-BERT: Sentence embeddings using Siamese BERT-networks,

    N. Reimers and I. Gurevych, “Sentence-BERT: Sentence embeddings using Siamese BERT-networks,” inProc. EMNLP, 2019

    work page 2019

  5. [5]

    Black- box forgery attacks on semantic watermarks for diffusion models,

    A. Müller, D. Lukovnikov, J. Thietke, A. Fischer, and E. Quiring, “Black- box forgery attacks on semantic watermarks for diffusion models,” in Proc. IEEE/CVF CVPR, 2025, arXiv:2412.03283

    arXiv 2025

  6. [6]

    WMCopier: Forging invisible image watermarks on arbitrary images,

    Z. Dong, C. Shuai, Z. Ba, P. Cheng, Z. Qin, Q. Wang, and K. Ren, “WMCopier: Forging invisible image watermarks on arbitrary images,” inProc. NeurIPS, 2025, arXiv:2503.22330

    arXiv 2025

  7. [7]

    Optimization-free universal watermark forgery with regenerative diffusion models,

    C. Zhu, Z. Li, R. Yang, R. Birke, P.-Y . Chen, T.-Y . Ho, and L. Y . Chen, “Optimization-free universal watermark forgery with regenerative diffusion models,” arXiv preprint arXiv:2506.06018, 2025

    arXiv 2025

  8. [8]

    Bileve: Securing text provenance in large language models against spoofing with bi-level signature,

    T. Zhou, X. Zhao, X. Xu, and S. Ren, “Bileve: Securing text provenance in large language models against spoofing with bi-level signature,” in Proc. NeurIPS, 2024, arXiv:2406.01946

    arXiv 2024

Show all 39 references
  1. [9]

    Are you copying my model? Protecting the copyright of large language models for EaaS via backdoor watermark,

    W. Peng, J. Yi, F. Wu, S. Wu, B. B. Zhu, L. Lyu, B. Jiao, T. Xu, G. Sun, and X. Xie, “Are you copying my model? Protecting the copyright of large language models for EaaS via backdoor watermark,” inProc. ACL, 2023

    2023

  2. [10]

    WARDEN: Multi-directional backdoor watermarks for embedding-as-a-service copyright protection,

    A. Shetty, Y . Teng, K. He, and Q. Xu, “WARDEN: Multi-directional backdoor watermarks for embedding-as-a-service copyright protection,” inProc. ACL, 2024

    2024

  3. [11]

    WET: Overcoming paraphrasing vulnerabilities in embeddings-as-a-service with linear transformation watermarks,

    A. Shetty, Q. Xu, and J. H. Lau, “WET: Overcoming paraphrasing vulnerabilities in embeddings-as-a-service with linear transformation watermarks,” inProc. ACL, 2025, arXiv:2409.04459

    2025 arXiv

  4. [12]

    Robust and minimally invasive watermarking for EaaS,

    Z. Wang, B. Wu, J. Deng, and Y . Yang, “Robust and minimally invasive watermarking for EaaS,” inFindings of ACL, 2025, arXiv:2410.17552. Method named “ESpeW” in the paper text

    2025 arXiv

  5. [13]

    MetaSeal: Defending against image attribution forgery through content-dependent cryptographic watermarks,

    T. Zhou, R. Ding, G. Liu, C. Fleming, R. R. Kompella, Y . Fei, X. Xu, and S. Ren, “MetaSeal: Defending against image attribution forgery through content-dependent cryptographic watermarks,”Transactions on Machine Learning Research, Feb. 2026, arXiv:2509.10766

    2026

  6. [14]

    Embedding watermarks into deep neural networks,

    Y . Uchida, Y . Nagai, S. Sakazawa, and S. Satoh, “Embedding watermarks into deep neural networks,” inProc. ACM ICMR, 2017

    2017

  7. [15]

    Turning your weakness into a strength: Watermarking deep neural networks by backdooring,

    Y . Adi, C. Baum, M. Cisse, B. Pinkas, and J. Keshet, “Turning your weakness into a strength: Watermarking deep neural networks by backdooring,” inProc. USENIX Security, 2018

    2018

  8. [16]

    SoK: How robust is image classification deep neural network watermarking?

    N. Lukas, E. Jiang, X. Li, and F. Kerschbaum, “SoK: How robust is image classification deep neural network watermarking?” inProc. IEEE S&P, 2022

    2022

  9. [17]

    Robustness of AI-image detectors: Fundamental limits and practical attacks,

    M. Saberi, V . S. Sadasivan, K. Rezaei, A. Kumar, A. Chegini, W. Wang, and S. Feizi, “Robustness of AI-image detectors: Fundamental limits and practical attacks,” inProc. ICLR, 2024

    2024

  10. [18]

    RegionMarker: A region-triggered semantic watermarking framework for embedding-as-a-service copyright protection,

    S. Yang, Z. Cheng, Z. Jiang, Y . Yin, C. Wang, S. Ge, Y . Fu, and Q. Gu, “RegionMarker: A region-triggered semantic watermarking framework for embedding-as-a-service copyright protection,” inProc. AAAI Conf. Artif. Intell. (AAAI), 2026, arXiv:2511.13329

    2026

  11. [19]

    From essence to defense: Adaptive semantic-aware watermarking for embedding-as-a- service copyright protection,

    H. Li, Y . Ren, Y . Cao, Y . Li, F. Fang, and X. Wang, “From essence to defense: Adaptive semantic-aware watermarking for embedding-as-a- service copyright protection,” arXiv preprint arXiv:2512.16439, 2025

    2025

  12. [20]

    Geometry-aware localized watermarking for copyright protection in embedding-as-a-service,

    Z. Chen, X. Liang, W. Xu, Y . Liu, and W. Lu, “Geometry-aware localized watermarking for copyright protection in embedding-as-a-service,” arXiv preprint arXiv:2604.11344, 2026

    2026 arXiv

  13. [21]

    A watermark for large language models,

    J. Kirchenbauer, J. Geiping, Y . Wen, J. Katz, I. Miers, and T. Goldstein, “A watermark for large language models,” inProc. ICML, 2023

    2023

  14. [22]

    My AI safety lecture for UT Effective Altruism,

    S. Aaronson, “My AI safety lecture for UT Effective Altruism,” https: //scottaaronson.blog/?p=6823, 2022

    2022

  15. [23]

    Undetectable watermarks for language models,

    M. Christ, S. Gunn, and O. Zamir, “Undetectable watermarks for language models,” inProc. COLT, 2024

    2024

  16. [24]

    HiDDeN: Hiding data with deep networks,

    J. Zhu, R. Kaplan, J. Johnson, and L. Fei-Fei, “HiDDeN: Hiding data with deep networks,” inProc. ECCV, 2018

    2018

  17. [25]

    RoSteALS: Robust steganography using autoencoder latent space,

    T. Bui, S. Agarwal, N. Yu, and J. Collomosse, “RoSteALS: Robust steganography using autoencoder latent space,” inProc. CVPRW, 2023

    2023

  18. [26]

    Tree-rings watermarks: Invisible fingerprints for diffusion images,

    Y . Wen, J. Kirchenbauer, J. Geiping, and T. Goldstein, “Tree-rings watermarks: Invisible fingerprints for diffusion images,” inProc. NeurIPS, 2023

    2023

  19. [27]

    The stable signature: Rooting watermarks in latent diffusion models,

    P. Fernandez, G. Couairon, H. Jégou, M. Douze, and T. Furon, “The stable signature: Rooting watermarks in latent diffusion models,” inProc. ICCV, 2023

    2023

  20. [28]

    Whitening sentence representations for better semantics and faster retrieval,

    J. Su, J. Cao, W. Liu, and Y . Ou, “Whitening sentence representations for better semantics and faster retrieval,” arXiv preprint arXiv:2103.15316, 2021

    2021 arXiv

  21. [29]

    On the sentence embeddings from pre-trained language models,

    B. Li, H. Zhou, J. He, M. Wang, Y . Yang, and L. Li, “On the sentence embeddings from pre-trained language models,” inProc. EMNLP, 2020

    2020

  22. [30]

    Kernel-whitening: Overcome dataset bias with isotropic sentence embedding,

    S. Gao, S. Dou, Q. Zhang, and X. Huang, “Kernel-whitening: Overcome dataset bias with isotropic sentence embedding,” inProc. EMNLP, 2022

    2022

  23. [31]

    Block-diagonal orthogonal relation and matrix entity for knowledge graph embedding,

    Y . Zhu and H. Shimodaira, “Block-diagonal orthogonal relation and matrix entity for knowledge graph embedding,” inFindings of EMNLP, 2024, pp. 16 956–16 972

    2024

  24. [32]

    Fast and robust sparsity-aware block diagonal representation,

    A. Ta¸ stan, M. Muma, and A. M. Zoubir, “Fast and robust sparsity-aware block diagonal representation,”IEEE Trans. Signal Processing, 2024

    2024

  25. [33]

    Access-controlled semantic search: Implementing role- based filtering in vector databases for enterprise document management,

    M. Yonathan, “Access-controlled semantic search: Implementing role- based filtering in vector databases for enterprise document management,” Research Square preprint, rs-7338381, 2025

    2025

  26. [34]

    The efficient generation of random orthogonal matrices with an application to condition estimators,

    G. W. Stewart, “The efficient generation of random orthogonal matrices with an application to condition estimators,”SIAM J. Numer. Anal., vol. 17, no. 3, pp. 403–409, 1980

    1980

  27. [35]

    MS MARCO: A human-generated machine-reading comprehension dataset,

    T. Nguyen, M. Rosenberg, X. Song, J. Gao, S. Tiwary, R. Majumder, and L. Deng, “MS MARCO: A human-generated machine-reading comprehension dataset,” inNIPS Workshop on Cognitive Computation, 2016, arXiv:1611.09268v1

    2016 arXiv

  28. [36]

    Model card: all-MiniLM-L6-v2,

    Sentence-Transformers, “Model card: all-MiniLM-L6-v2,” https: //huggingface.co/sentence-transformers/all-MiniLM-L6-v2, 2021

    2021

  29. [37]

    BEIR: A heterogeneous benchmark for zero-shot evaluation of information retrieval models,

    N. Thakur, N. Reimers, A. Rücklé, A. Srivastava, and I. Gurevych, “BEIR: A heterogeneous benchmark for zero-shot evaluation of information retrieval models,” inProc. NeurIPS Datasets and Benchmarks Track, 2021, arXiv:2104.08663

    2021 arXiv

  30. [38]

    Towards deep learning models resistant to adversarial attacks,

    A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,” inProc. ICLR, 2018

    2018

  31. [39]

    HopSkipJumpAttack: A query-efficient decision-based attack,

    J. Chen, M. I. Jordan, and M. J. Wainwright, “HopSkipJumpAttack: A query-efficient decision-based attack,” inProc. IEEE S&P, 2020

    2020

Pith tools

Reviewed August 14, 2026 · model on record in the stance chip above.