WARDEN: Multi-Directional Backdoor Watermarks for Embedding-as-a-Service Copyright Protection
Fuente:
arXiv
Guardado en:
| Autores principales: | , , , |
|---|---|
| Formato: | Preprint |
| Publicado: |
2024
|
| Materias: | |
| Acceso en línea: | |
| Etiquetas: |
Agregar Etiqueta
Sin Etiquetas, Sea el primero en etiquetar este registro!
|
| _version_ | 1866910477363183616 |
|---|---|
| author | Shetty, Anudeex Teng, Yue He, Ke Xu, Qiongkai |
| author_facet | Shetty, Anudeex Teng, Yue He, Ke Xu, Qiongkai |
| contents | Embedding as a Service (EaaS) has become a widely adopted solution, which offers feature extraction capabilities for addressing various downstream tasks in Natural Language Processing (NLP). Prior studies have shown that EaaS can be prone to model extraction attacks; nevertheless, this concern could be mitigated by adding backdoor watermarks to the text embeddings and subsequently verifying the attack models post-publication. Through the analysis of the recent watermarking strategy for EaaS, EmbMarker, we design a novel CSE (Clustering, Selection, Elimination) attack that removes the backdoor watermark while maintaining the high utility of embeddings, indicating that the previous watermarking approach can be breached. In response to this new threat, we propose a new protocol to make the removal of watermarks more challenging by incorporating multiple possible watermark directions. Our defense approach, WARDEN, notably increases the stealthiness of watermarks and has been empirically shown to be effective against CSE attack. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2403_01472 |
| institution | arXiv |
| publishDate | 2024 |
| record_format | arxiv |
| spellingShingle | WARDEN: Multi-Directional Backdoor Watermarks for Embedding-as-a-Service Copyright Protection Shetty, Anudeex Teng, Yue He, Ke Xu, Qiongkai Cryptography and Security Computation and Language Machine Learning Embedding as a Service (EaaS) has become a widely adopted solution, which offers feature extraction capabilities for addressing various downstream tasks in Natural Language Processing (NLP). Prior studies have shown that EaaS can be prone to model extraction attacks; nevertheless, this concern could be mitigated by adding backdoor watermarks to the text embeddings and subsequently verifying the attack models post-publication. Through the analysis of the recent watermarking strategy for EaaS, EmbMarker, we design a novel CSE (Clustering, Selection, Elimination) attack that removes the backdoor watermark while maintaining the high utility of embeddings, indicating that the previous watermarking approach can be breached. In response to this new threat, we propose a new protocol to make the removal of watermarks more challenging by incorporating multiple possible watermark directions. Our defense approach, WARDEN, notably increases the stealthiness of watermarks and has been empirically shown to be effective against CSE attack. |
| title | WARDEN: Multi-Directional Backdoor Watermarks for Embedding-as-a-Service Copyright Protection |
| topic | Cryptography and Security Computation and Language Machine Learning |
| url | https://arxiv.org/abs/2403.01472 |