Embedding as a Service (EaaS) has become a widely adopted solution, which
offers feature extraction capabilities for addressing various downstream tasks
in Natural Language Processing (NLP). Prior studies have shown that EaaS can be
prone to model extraction attacks; nevertheless, this concern could be
mitigated by adding backdoor watermarks to the text embeddings and subsequently
verifying the attack models post-publication. Through the analysis of the
recent watermarking strategy for EaaS, EmbMarker, we design a novel CSE
(Clustering, Selection, Elimination) attack that removes the backdoor watermark
while maintaining the high utility of embeddings, indicating that the previous
watermarking approach can be breached. In response to this new threat, we
propose a new protocol to make the removal of watermarks more challenging by
incorporating multiple possible watermark directions. Our defense approach,
WARDEN, notably increases the stealthiness of watermarks and empirically has
been shown effective against CSE attack.

Embedding as a Service (EaaS) 是一个被广泛采用的解决方案，它提供了用于处理自然语言处理（NLP）中各种下游任务的特征提取功能。然而，之前的研究表明 EaaS 可能容易受到模型提取攻击的影响，为了缓解这一问题，可以通过向文本嵌入添加后门水印，并在发布后验证攻击模型。通过对最近的 EaaS 水印策略 EmbMarker 的分析，我们设计了一种新的 CSE（聚类、选择、淘汰）攻击，它可以去除后门水印并保持嵌入的高效性，表明之前的水印方法可以被攻破。针对这一新的威胁，我们提出了一个新的协议，通过整合多个可能的水印方向，使水印的去除更加困难。我们的防御方法 WARDEN 显著增加了水印的隐蔽性，并经实证表明对抗 CSE 攻击有效。