Pith. sign in

REVIEW 4 major objections 5 minor 36 references

Your Semantic-Independent Watermark is Fragile: A Semantic Perturbation Attack against EaaS Watermark

T0 review · 4 major / 5 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper contends that semantically independent backdoor watermarks in embedding services can be identified and removed by a perturbation-clustering attack, reporting true positive rates above 95% without degrading downstream utility.

desk verdict Solid attack idea with a clear mechanism, but the paper overclaims by calling WARDEN bypassed when three of four datasets still show p<0.05 after the attack. read the letter →

arxiv 2411.09359 v2 pith:VFRA2N6U submitted 2024-11-14 cs.CR cs.AI

Zekun Fei , Biao Yi , Jianing Geng , Ruiqi He , Lihai Nie , Zheli Liu This is my paper · ORCID
classification cs.CRcs.AI
keywords semanticperturbationattackembedding-as-a-servicewatermarkbackdoorvulnerabilityidentificationindependencePCAeigenvalueclusteringsuffixEaaScopyrightprotection
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Current backdoor watermarking schemes for Embedding-as-a-Service add a constant watermark vector to the embeddings of texts that contain a trigger, regardless of the text's meaning. The paper argues that this semantic independence is a structural vulnerability: appending a suffix to a text changes its semantic embedding but not the fixed watermark component, so watermarked texts under perturbation cluster tightly while unwatermarked texts scatter. From this observation it builds the Semantic Perturbation Attack (SPA), which appends suffixes, measures the spread of the perturbed embeddings, and deletes the suspicious cluster. In experiments across four datasets and two watermark schemes, SPA identifies and removes over 95% of watermarked samples while keeping downstream classification accuracy roughly intact. If the claim holds, providers relying on such backdoor watermarks for copyright enforcement can no longer detect copying, and watermark designs must become semantic-aware.

What carries the argument

The load-bearing object is the constant watermark vector $e_t$ in the linear mixing formula $e_i \mapsto \mathrm{Norm}((1-\lambda)e_i + \lambda e_t)$, and its multi-vector counterpart in WARDEN. The semantic independence of $e_t$ is what makes a watermarked embedding set contract under perturbation. The attack's measuring instrument is the tightness score: for each text, $k$ suffix-perturbed embeddings are collected and reduced via PCA, and the sum of the top eigenvalues serves as the score, with a bimodal histogram of scores providing a threshold $\varphi$. Suffix selection is guided by a small local sentence encoder, which scores each candidate suffix against the original text and keeps the lowest-similarity suffixes on the assumption that differential properties transfer to the black-box victim encoder.

What would settle it

Use the paper's suffix-ranking procedure with a helper encoder deliberately chosen to be geometrically dissimilar to the victim encoder (for example, a bag-of-words model or a random projection), and check whether the bimodal separation and the reported true positive rates survive; if the separation collapses, the cross-model transfer assumption is what carries the attack.

Watch

Extended reading notes

Core claim

The paper's central contention is that the watermark signal in existing backdoor schemes is semantically independent: in EmbMarker the watermarked embedding is $e'_i = \mathrm{Norm}((1-\lambda)e_i + \lambda e_t)$ with a fixed vector $e_t$, and WARDEN extends this to a sum of fixed vectors. Because $e_t$ does not depend on the input text, perturbing the text by appending a suffix changes the original component $e_i$ but leaves the watermark component unchanged, so the perturbed embeddings of a watermarked text form a tighter cluster than those of a benign text. SPA exploits this by choosing suffixes that maximize semantic distance, querying the victim service $k$ times per text, and measuring the spread of the resulting embedding set using cosine similarity, L2 distance, or the sum of PCA eigenvalues. A bimodal distribution of these scores yields a data-driven threshold; samples below it are deleted as watermarked. The paper reports that this purification raises verification p-values into the benign range, achieving true positive rates above 95% on four text classification datasets against both EmbMarker and WARDEN.

Load-bearing premise

The attack assumes that the ranking of suffixes by semantic distance computed with a small local embedding model (384 dimensions) transfers to the black-box victim embedding model (1536 dimensions), so suffixes that perturb the local model most also perturb the victim most.

Editorial extensions

If this is right

  • SPA bypasses both single-vector (EmbMarker) and multi-vector (WARDEN) backdoor watermarks without modifying any embeddings, by deleting the samples it identifies as watermarked.
  • Downstream classification accuracy stays roughly the same after purification, and embedding utility is preserved better than with embedding-modifying attacks such as CSE and PA.
  • Identification performance improves and stabilizes as the number of perturbations increases, so the attacker faces a query-cost tradeoff rather than a performance ceiling.
  • Even at low watermark ratios the watermark cluster stays detectable, with PCA AUPRC in the 0.3–0.4 range, so the attack remains relevant to sparse trigger deployments.
  • The paper's proposed mitigation is a semantic-aware watermarking design in which the injected signal depends on the text content rather than a constant vector.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference: if any constant-vector watermark is detectable by perturbation clustering, then the same test should be applied to WET's linear-transformation watermark, which also adds a fixed geometric shift; the paper does not report this experiment.
  • Editorial inference: an obvious stress test is to swap the helper encoder for one with a different architecture and dimensionality; if the attack's success degrades, the transfer premise becomes the critical constraint, and the paper's auxiliary heuristic variant is reported as weaker on two of four datasets.
  • Editorial inference: an attacker could amortize query cost by clustering texts first and perturbing one representative per cluster, or by reusing a shared set of suffixes; the paper's mechanism would still apply but the per-text query count would drop.
  • Editorial inference: providers could monitor for clients that issue many near-duplicate queries with appended suffixes, turning SPA's own query signature into a detection signal; the paper discusses defenses only at the watermark-design level.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes Semantic Perturbation Attack (SPA), a watermark-identification attack against backdoor-based embedding watermarks for Embedding-as-a-Service (EaaS). The authors observe that existing schemes such as EmbMarker and WARDEN inject a constant watermark vector when a trigger token is present, making the injected signal independent of input semantics. SPA appends semantically distant suffixes to each query, measures the tightness of the original and perturbed embeddings via cosine similarity, L2 distance, and a PCA-based score, selects a threshold from the metric distribution, and deletes samples deemed watermarked. The paper reports a TPR above 95% on four datasets for both EmbMarker and WARDEN, claims that watermark verification is rendered ineffective, and discusses possible defense strategies. The manuscript includes a geometric motivation in Section 3, the attack algorithm in Section 4, experiments in Section 5, and ablation studies on perturbation count and watermark ratio.

Significance. If the attack worked as claimed, it would be an important practical result: it would demonstrate that linear trigger-based embedding watermarking can be bypassed by a black-box attacker who has only a small local encoder and query access to the service. The paper's core geometric intuition is plausible, the code is released, and the PCA-based tightness metric is an interesting design choice. The ablation studies across perturbation counts and watermark ratios are useful and show that the proposed mechanism is not purely curve-fitting on one setting. However, the load-bearing claim that SPA 'renders watermarks ineffective' is not supported by the paper's own Table 1 for WARDEN on three of four datasets, and the evaluation has methodological gaps including in-sample threshold selection, missing error bars, and a single victim model. These issues must be resolved before the central claim can be accepted.

major comments (4)
  1. [Table 1; Section 5.2] The statement in Section 5.2 that SPA 'effectively bypasses all four datasets' is contradicted by Table 1: for WARDEN, the post-attack KS p-values on SST2, MIND, and AG News are all 10^-2, which are at or below the conventional 0.05 significance threshold, and the DeltaCos/DeltaL2 values (e.g., MIND 0.0280/-0.0561, SST2 -0.0108/0.0216) are not near zero. According to the paper's own success criterion in Section 5.1 ('a higher p-value, with DeltaCos and DeltaL2 values approaching zero'), WARDEN verification would still assert the presence of the watermark on these three datasets. This directly undermines the abstract's claim that SPA renders watermarks ineffective. The authors should either modify the attack so that p-values exceed the verification threshold on all datasets, or substantially revise the claim to acknowledge that WARDEN remains effective in most of the tested settings.
  2. [Section 4.4] The threshold φ is selected from the PCA-score distribution of the same dataset on which the TPR/FPR values in Table 2 are computed, so the reported TPR/FPR are in-sample numbers rather than predictive performance. An attacker must choose the threshold before observing the attack data, or use a separate validation set, for the reported detection rates to be meaningful. The paper should evaluate SPA with a threshold selected on a held-out split and report the resulting TPR/FPR, or provide the full precision-recall curve with the operating point explicitly marked.
  3. [Algorithm 1; Section 4.2] Algorithm 1 selects suffixes by computing cosine(Θs(dci), Θs(perbj)) (line 10), i.e., the similarity between the original text embedding and the suffix embedding alone, rather than the similarity between Θs(dci) and Θs(dci + perbj), which is what a semantic perturbation of dci would require. The claim that this procedure 'can effectively conduct semantic perturbation on dci' therefore relies on an unstated proxy relationship, and the assertion in Section 4.2 that 'the differential properties between them are consistent' across models is not supported by any evidence. The paper should either justify the proxy, run the main experiments with Algorithm 2 (Appendix C.3) that actually encodes the concatenated text, or compare Algorithm 1 against random suffix selection to show that the guidance mechanism is what drives the reported AUPRC values.
  4. [Section 5.1; Table 2] All experiments use a single victim encoder, OpenAI's text-embedding-ada-002, and the reported AUPRC/TPR/FPR values are given without error bars or variance measures despite the statement that results are 'the average of multiple experiments'. Because SPA depends critically on the transfer of differential properties from Sentence-BERT to the victim encoder, the absence of any second victim model makes the transferability claim untested. The paper should repeat the main experiments on at least one additional victim encoder, ideally an open-source one, and report standard deviations across repeated runs.
minor comments (5)
  1. [Section 3] In the first paragraph of Section 3, 'the watermark siginal' is a typo and should read 'the watermark signal'.
  2. [Appendix B] The first sentence of Appendix B contains a duplicated article: 'TThe attacker aims' should be 'The attacker aims'.
  3. [Table 3; Appendix E] The text in Appendix E states that the largest dataset includes 'over 12,000 data items', but Table 3 and the standard AG News statistics show 120,000 training samples; this number should be corrected.
  4. [References] The reference to Kalpesh et al. lists the authors in a non-standard order ('Krishna Kalpesh, Tomar Gaurav Singh, P Parikh Ankur, Papernot Nicolas, Iyyer Mohit'); the names should be formatted consistently with the rest of the bibliography.
  5. [Figure 3; Section 4.2] Figure 3 is difficult to parse, particularly the relationship between the 'Purified Embedding Set' and the downstream stolen model; clarifying whether the deleted samples are dropped before or after the stealer training loop would improve readability.

Circularity Check

1 steps flagged · score 2.0 of 10

One mild fitted-threshold circularity in the TPR evaluation; the attack mechanism itself is a legitimate direct consequence of the watermark construction, not definitionally circular.

  1. fitted input called prediction [Section 4.4 Threshold Selection and Section 5.2 / Table 2 Deletion Performance]
    "The metric distributions exhibit a long-tail phenomenon due to texts containing triggers. An anomalous rise occurs in the long-tail region, resulting in another peak. ... We select the metric value at this point as the threshold φ. Samples with metrics below φ are removed from Dc."

    The threshold φ is selected from the PCA-score / cosine / L2 metric distribution of the very dataset Dc on which Table 2 then reports TPR, FPR, and Precision. No held-out calibration split or independent threshold-setting procedure is described. The reported 'True Positive Rate' and 'False Positive Rate' are therefore in-sample properties of a threshold fitted to the attacked batch's own distribution, rather than independent predictions of attack performance on unseen data. Because the headline claim 'TPR of over 95%' is partially measuring the fit, this matches the fitted-input-called-prediction pattern. The threshold-free AUPRC metric provides some independent grounding, so the circularity is partial rather than total.

full rationale

The paper's central attack mechanism is not circular. SPA's premise is taken from the prior watermark definitions: EmbMarker and WARDEN produce watermarked embeddings by linearly adding a constant vector et (Eqs. 1 and 2), so the claim that the watermark signal is semantic-independent is a direct consequence of those cited constructions, not a result defined in terms of SPA's success. The geometric argument in Section 3 (θ2 < θ1 after adding et, with θ1 = 180° as the upper boundary) is a legitimate derivation from that linear combination, not a circular reduction. There are no load-bearing self-citations: references to EmbMarker, WARDEN, WET, ESSA, and CSE are all external prior work, and no uniqueness theorem from the present authors is invoked. The appendix's honest limitation statements—requiring a local model, re-querying the EaaS service, and the risk of failure with too few suffixes—show that SPA is an empirical attack with stated assumptions rather than a definitional tautology. The main genuine concerns are correctness and robustness issues rather than circularity: the unvalidated transfer assumption that Sentence-BERT's differential properties match text-embedding-ada-002, the implementation gap in Algorithm 1 (it scores cos(seci, seperb) rather than cos(seci, s'eci)), and Table 1's WARDEN p-values remaining at 10^-2 on three datasets, which contradict the claim of effectively bypassing all four datasets. The only noticeable circularity is the in-sample threshold selection in Section 4.4 feeding directly into the reported deletion metrics, which I flag as a mild fitted-input-called-prediction issue.

Assumptions & free parameters 3 free parameters · 5 assumptions · 0 invented entities

The central attack mechanism adds no new entities; its parameters are experimental. The key uncharged assumptions are cross-model transfer of perturbation differentials, rarity of trigger introduction by suffixes, and bimodality of the score distribution. The threshold is fit to the same data used for evaluation, which is the main burden on the claimed TPR.

free parameters (3)
  • k (number of perturbations per sample) = 10
    Chosen to balance time and cost (Section 5.1); ablation shows performance grows with k, so the reported TPR depends on this choice.
  • D_pca (PCA reduced dimension) = 2 in Figure 4, otherwise unspecified
    Equation 4 leaves D_pca unspecified; PCA score and threshold selection rely on it.
  • Threshold phi = Data-derived per dataset
    Selected from the metric distribution of the same target dataset (Section 4.4), so TPR/FPR are in-sample; no held-out calibration.
assumptions (5)
  • domain assumption Differential properties of embedding changes are consistent across different encoder models (Section 4.2).
    Used to justify Sentence-BERT suffix guidance for OpenAI ada-002; asserted but not verified.
  • standard math Adding a shared watermark vector to normalized embeddings makes watermarked pairs closer under semantic perturbation (theta2 < theta1) for sufficiently large perturbation angles (Section 3, Figure 2).
    A geometric claim supporting the detection mechanism; conditions are not formally proven.
  • domain assumption Suffix concatenation preserves existing trigger tokens and rarely introduces new ones (Section 4.2).
    If suffixes introduce triggers, benign samples can be misclassified; not tested with the actual trigger vocabulary.
  • domain assumption The metric distribution is bimodal with an anomalous rise marking watermarked samples, enabling threshold selection (Section 4.4, Figure 5).
    Empirical claim; AG News PCA AUPRC 0.7052 shows separation can be weak.
  • domain assumption OpenAI text-embedding-ada-002 is a representative EaaS victim model.
    All experiments use this single API; generalized claim about EaaS depends on representativeness.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Your Semantic-Independent Watermark is Fragile: A Semantic Perturbation Attack against EaaS Watermark." pith.science (2026). https://pith.science/paper/VFRA2N6U

@misc{pith2026241109359,
  author       = {Pith},
  title        = {Pith review of: Your Semantic-Independent Watermark is Fragile: A Semantic Perturbation Attack against EaaS Watermark},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/VFRA2N6U}},
  note         = {Machine review of arXiv:2411.09359}
}
read the original abstract

Embedding-as-a-Service (EaaS) has emerged as a successful business pattern but faces significant challenges related to various forms of copyright infringement, particularly, the API misuse and model extraction attacks. Various studies have proposed backdoor-based watermarking schemes to protect the copyright of EaaS services. In this paper, we reveal that previous watermarking schemes possess semantic-independent characteristics and propose the Semantic Perturbation Attack (SPA). Our theoretical and experimental analysis demonstrate that this semantic-independent nature makes current watermarking schemes vulnerable to adaptive attacks that exploit semantic perturbations tests to bypass watermark verification. Extensive experimental results across multiple datasets demonstrate that the True Positive Rate (TPR) for identifying watermarked samples under SPA can reach up to more than 95\%, rendering watermarks ineffective while maintaining the high utility of embeddings. Furthermore, we discuss potential defense strategies to mitigate SPA. Our code is available at https://github.com/Zk4-ps/EaaS-Embedding-Watermark.

Figures

Figures reproduced from arXiv: 2411.09359 by the authors.

Figure 1
Figure 1. An Overview of EaaS Watermark. As shown in [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Semantic Perturbation Demonstration in 2D [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. The Framework of Semantic Perturbation Attack. Attackers apply the semantic perturbation strategy to [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (6 more)
Figure 4
Figure 4. Figure 4: PCA Score Visualization. Significant distribu [PITH_FULL_IMAGE:figures/full_fig_p005_4.png]
Figure 5
Figure 5. Figure 5: Threshold Selection. Our semantic perturba [PITH_FULL_IMAGE:figures/full_fig_p005_5.png]
Figure 6
Figure 6. Figure 6: PCA AUPRC and Number of Perturbations. 0.005 0.01 0.05 0.1 Watermark Ratios 0.30 0.51 0.72 0.93 1.14 1.35 PCA AUPRC EmbMarker WARDEN (a) Enron Spam 0.005 0.01 0.05 0.1 Watermark Ratios 0.30 0.51 0.72 0.93 1.14 1.35 PCA AUPRC EmbMarker WARDEN (b) SST2 0.005 0.01 0.05 0.…
Figure 7
Figure 7. Figure 7: PCA AUPRC and Watermark Ratio. 0.1. However, a high watermark ratio will result in excessive watermark injection and embedding modification. Nevertheless, the PCA AUPRC con￾sistently remains above 0.9, demonstrating SPA’s robustness across varying watermark ratios. 6 D…
Figure 8
Figure 8. Figure 8: Different Approaches of Semantic Perturba [PITH_FULL_IMAGE:figures/full_fig_p011_8.png]
Figure 9
Figure 9. Figure 9: Cosine similarity metric distribution and KDE [PITH_FULL_IMAGE:figures/full_fig_p012_9.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

36 extracted references · 29 canonical work pages

  1. [1]

    online" 'onlinestring :=

    ENTRY address archivePrefix author booktitle chapter edition editor eid eprint eprinttype howpublished institution journal key month note number organization pages publisher school series title type volume year doi pubmed url lastchecked label extra.label sort.label short.list INTEGERS output.state before.all mid.sentence after.sentence after.block STRING...

  2. [2]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION word.in bbl.in capitalize " " * FUNCT...

  3. [3]

    Yossi Adi, Carsten Baum, Moustapha Cisse, Benny Pinkas, and Joseph Keshet. 2018. Turning your weakness into a strength: Watermarking deep neural networks by backdooring. In USENIX security symposium (USENIX Security), pages 1615--1631

    work page 2018

  4. [4]

    Zeynep Akata, Scott Reed, Daniel Walter, Honglak Lee, and Bernt Schiele. 2015. Evaluation of output embeddings for fine-grained image classification. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 2927--2936

    work page 2015

  5. [5]

    Haonan An, Guang Hua, Zhiping Lin, and Yuguang Fang. 2024. Box-free model watermarks are prone to black-box removal attacks. arXiv preprint arXiv:2405.09863

    arXiv 2024

  6. [6]

    Varun Chandrasekaran, Kamalika Chaudhuri, Irene Giacomelli, Somesh Jha, and Songbai Yan. 2020. Exploring connections between active learning and model extraction. In USENIX Security Symposium (USENIX Security), pages 1309--1326

    work page 2020

  7. [7]

    Chengyuan Deng, Yiqun Duan, Xin Jin, Heng Chang, Yijun Tian, Han Liu, Henry Peng Zou, Yiqiao Jin, Yijia Xiao, Yichen Wang, et al. 2024. Deconstructing the ethics of large language models from long-standing issues to new-emerging dilemmas. arXiv preprint arXiv:2406.05392

    arXiv 2024

  8. [8]

    Debasis Ganguly, Dwaipayan Roy, Mandar Mitra, and Gareth JF Jones. 2015. Word embedding based generalized language model for information retrieval. In Proceedings of the ACM SIGIR International Conference on Research and Development in Information Retrieval (SIGIR), pages 795--798

    work page 2015

Show all 36 references
  1. [9]

    Xing Hu, Ling Liang, Shuangchen Li, Lei Deng, Pengfei Zuo, Yu Ji, Xinfeng Xie, Yufei Ding, Chang Liu, Timothy Sherwood, et al. 2020. Deepsniffer: A dnn model extraction framework based on learning architectural hints. In Proceedings of International Conference on Architectural...

    2020

  2. [10]

    Jui Ting Huang, Ashish Sharma, Shuying Sun, Li Xia, David Zhang, Philip Pronin, Janani Padmanabhan, Giuseppe Ottaviano, and Linjun Yang. 2020. Embedding-based retrieval in facebook search. In Proceedings of the ACM SIGKDD International Conference on Knowledge Discovery and Dat...

    2020

  3. [11]

    Krishna Kalpesh, Tomar Gaurav Singh, P Parikh Ankur, Papernot Nicolas, and Iyyer Mohit. 2020. Thieves on sesame street! model extraction of bert-based apis. In Proceedings of International Conference on Learning Representations (ICLR), pages 1--19

    2020

  4. [12]

    Sam Leroux, Stijn Vanassche, and Pieter Simoens. 2024. Multi-bit black-box watermarking of deep neural networks in embedded applications. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 2121--2130

    2024

  5. [13]

    Yiming Li, Yang Bai, Yong Jiang, Yong Yang, Shu-Tao Xia, and Bo Li. 2022. Untargeted backdoor watermark: Towards harmless and stealthy dataset copyright protection. Advances in Neural Information Processing Systems (NIPS), 35:13238--13250

    2022

  6. [14]

    Yue Li, Hongxia Wang, and Mauro Barni. 2021. A survey of deep neural network watermarking techniques. Neurocomputing, 461:171--193

    2021

  7. [15]

    Yupei Liu, Jinyuan Jia, Hongbin Liu, and Neil Zhenqiang Gong. 2022. Stolenencoder: stealing pre-trained encoders in self-supervised learning. In Proceedings of the ACM SIGSAC Conference on Computer and Communications Security (CCS), pages 2115--2128

    2022

  8. [16]

    Peizhuo Lv, Pan Li, Shengzhi Zhang, Kai Chen, Ruigang Liang, Hualong Ma, Yue Zhao, and Yingjiu Li. 2023. A robustness-assured white-box watermark in neural networks. IEEE Transactions on Dependable and Secure Computing (TDSC), 20(6):5214--5229

    2023

  9. [17]

    Peizhuo Lv, Pan Li, Shenchen Zhu, Shengzhi Zhang, Kai Chen, Ruigang Liang, Chang Yue, Fan Xiang, Yuling Cai, Hualong Ma, Yingjun Zhang, and Guozhu Meng. 2024. Ssl-wm: A black-box watermarking approach for encoders pre-trained by self-supervised learning. Proceedings of the Net...

    2024

  10. [18]

    Stephen Merity, Caiming Xiong, James Bradbury, and Richard Socher. 2016. Pointer sentinel mixture models. arXiv preprint arXiv:1609.07843

    2016 arXiv

  11. [19]

    Vangelis Metsis, Ion Androutsopoulos, and Georgios Paliouras. 2006. Spam filtering with naive bayes-which naive bayes? In Conference on Email and Anti-Spam (CEAS), volume 17, pages 28--69

    2006

  12. [20]

    Shumpei Okura, Yukihiro Tagami, Shingo Ono, and Akira Tajima. 2017. Embedding-based news recommendation for millions of users. In Proceedings of the ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (SIGKDD), pages 1933--1942

    2017

  13. [21]

    Tribhuvanesh Orekondy, Bernt Schiele, and Mario Fritz. 2019. Knockoff nets: Stealing functionality of black-box models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 4954--4963

    2019

  14. [22]

    Alessandro Pegoraro, Carlotta Segna, Kavita Kumari, and Ahmad-Reza Sadeghi. 2024. Deepeclipse: How to break white-box dnn-watermarking schemes. arXiv preprint arXiv:2403.03590

    2024 arXiv

  15. [23]

    Wenjun Peng, Jingwei Yi, Fangzhao Wu, Shangxi Wu, Bin Bin Zhu, Lingjuan Lyu, Binxing Jiao, Tong Xu, Guangzhong Sun, and Xing Xie. 2023. Are you copying my model? protecting the copyright of large language models for eaas via backdoor watermark. In Proceedings of Annual Meeting...

    2023

  16. [24]

    Nils Reimers and Iryna Gurevych. 2019. Sentence-bert: Sentence embeddings using siamese bert-networks. In Proceedings of Conference on Empirical Methods in Natural Language Processing (EMNLP), pages 3980--3990

    2019

  17. [25]

    Sunandini Sanyal, Sravanti Addepalli, and R Venkatesh Babu. 2022. Towards data-free model stealing in a hard label setting. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 15284--15293

    2022

  18. [26]

    Zeyang Sha, Xinlei He, Ning Yu, Michael Backes, and Yang Zhang. 2023. Can't steal? cont-steal! contrastive stealing attacks against image encoders. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 16373--16383

    2023

  19. [27]

    Anudeex Shetty, Yue Teng, Ke He, and Qiongkai Xu. 2024 a . Warden: Multi-directional backdoor watermarks for embedding-as-a-service copyright protection. In Proceedings of Annual Meeting of the Association for Computational Linguistics (ACL), pages 13430--13444

    2024

  20. [28]

    Anudeex Shetty, Qiongkai Xu, and Jey Han Lau. 2024 b . Wet: Overcoming paraphrasing vulnerabilities in embeddings-as-a-service with linear transformation watermarks. arXiv preprint arXiv:2409.04459

    2024 arXiv

  21. [29]

    Richard Socher, Alex Perelygin, Jean Wu, Jason Chuang, Christopher D Manning, Andrew Y Ng, and Christopher Potts. 2013. Recursive deep models for semantic compositionality over a sentiment treebank. In Proceedings of Conference on Empirical Methods in Natural Language Processi...

    2013

  22. [30]

    Yuanmin Tang, Jing Yu, Keke Gai, Xiangyan Qu, Yue Hu, Gang Xiong, and Qi Wu. 2023. Watermarking vision-language pre-trained models for multi-modal embedding as a service. arXiv preprint arXiv:2311.05863

    2023 arXiv

  23. [31]

    Guoyin Wang, Chunyuan Li, Wenlin Wang, Yizhe Zhang, Dinghan Shen, Xinyuan Zhang, Ricardo Henao, and Lawrence Carin. 2018. Joint embedding of words and labels for text classification. In Proceedings of Annual Meeting of the Association for Computational Linguistics (ACL), pages...

    2018

  24. [32]

    Fangzhao Wu, Ying Qiao, Jiun-Hung Chen, Chuhan Wu, Tao Qi, Jianxun Lian, Danyang Liu, Xing Xie, Jianfeng Gao, Winnie Wu, et al. 2020. Mind: A large-scale dataset for news recommendation. In Proceedings of Annual Meeting of the Association for Computational Linguistics (ACL), p...

    2020

  25. [33]

    Yifan Yan, Xudong Pan, Mi Zhang, and Min Yang. 2023. Rethinking White-Box watermarks on deep learning models under neural structural obfuscation. In USENIX Security Symposium (USENIX Security), pages 2347--2364

    2023

  26. [34]

    Zuopeng Yang, Pengyu Chen, Tao Li, Kangjun Liu, Yuan Huang, and Xin Lin. 2024. Defending against similarity shift attack for eaas via adaptive multi-target watermarking. Information Sciences, page 120893

    2024

  27. [35]

    Xiang Zhang, Junbo Zhao, and Yann LeCun. 2015. Character-level convolutional networks for text classification. Advances in Neural Information Processing Systems (NIPS), 28

    2015

  28. [36]

    Bowen Zheng, Yupeng Hou, Hongyu Lu, Yu Chen, Wayne Xin Zhao, Ming Chen, and Ji-Rong Wen. 2024. Adapting large language models by integrating collaborative semantics for recommendation. In IEEE International Conference on Data Engineering (ICDE), pages 1435--1448

    2024

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.