{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/are-you-copying-my-model-protecting-the","title":"Are You Copying My Model? Protecting the Copyright of Large Language Models for EaaS via Backdoor Watermark","arxiv_id":"2305.10036","date":"2023-05-17","proceeding":null,"authors":["Wenjun Peng","Jingwei Yi","Fangzhao Wu","Shangxi Wu","Bin Zhu","Lingjuan Lyu","Binxing Jiao","Tong Xu","Guangzhong Sun","Xing Xie"],"abstract":"Large language models (LLMs) have demonstrated powerful capabilities in both text understanding and generation. Companies have begun to offer Embedding as a Service (EaaS) based on these LLMs, which can benefit various natural language processing (NLP) tasks for customers. However, previous studies have shown that EaaS is vulnerable to model extraction attacks, which can cause significant losses for the owners of LLMs, as training these models is extremely expensive. To protect the copyright of LLMs for EaaS, we propose an Embedding Watermark method called EmbMarker that implants backdoors on embeddings. Our method selects a group of moderate-frequency words from a general text corpus to form a trigger set, then selects a target embedding as the watermark, and inserts it into the embeddings of texts containing trigger words as the backdoor. The weight of insertion is proportional to the number of trigger words included in the text. This allows the watermark backdoor to be effectively transferred to EaaS-stealer's model for copyright verification while minimizing the adverse impact on the original embeddings' utility. Our extensive experiments on various datasets show that our method can effectively protect the copyright of EaaS models without compromising service quality.","url_abs":"https://arxiv.org/abs/2305.10036v3","url_pdf":"https://arxiv.org/pdf/2305.10036v3.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"are-you-copying-my-model-protecting-the","repo_url":"https://github.com/yjw1029/embmarker","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":0,"framework":"pytorch","reach":{"status":"ok","spdx":"MIT"}}],"tasks":[{"task_slug":"model-extraction","task_name":"Model extraction"}],"methods":[{"method_slug":null,"method_name":null}],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"syntology_url":"https://syntology.ai/paper/2305.10036","atlas_url":"https://app.syntology.ai/?focus=2305.10036","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2305.10036"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-25T09:33:49+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/yjw1029/embmarker","reach":{"status":"ok","spdx":"MIT"}},{"provenance":"deterministic:regex_extraction","url":"https://github.com/yjw1029/EmbMarker","reach":{"status":"ok","spdx":"MIT"}}],"summary":{"ran":2,"unverified":8},"by_repo_kind":{"official":{"samples":10,"ran":2,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"903f1433d8d2db1f","entry":"BackDoorClassifyOutput","repo":"yjw1029/EmbMarker","repo_kind":"official","path":"src/model/copier/bert.py","file_url":"https://github.com/yjw1029/EmbMarker/blob/HEAD/src/model/copier/bert.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"903f1433d8d2db1f"}},{"code_sha256_prefix":"86093b919ea4359f","entry":"BertForClassifyWithBackDoor","repo":"yjw1029/EmbMarker","repo_kind":"official","path":"src/model/copier/bert.py","file_url":"https://github.com/yjw1029/EmbMarker/blob/HEAD/src/model/copier/bert.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"86093b919ea4359f"}},{"code_sha256_prefix":"1c3e5679dd810aea","entry":"convert_mind_tsv_dict","repo":"yjw1029/embmarker","repo_kind":"official","path":"src/dataset/utils.py","file_url":"https://github.com/yjw1029/embmarker/blob/HEAD/src/dataset/utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"1c3e5679dd810aea"}},{"code_sha256_prefix":"b3400e6c8205d71d","entry":"eval_copier","repo":"yjw1029/embmarker","repo_kind":"official","path":"src/run_gpt_backdoor.py","file_url":"https://github.com/yjw1029/embmarker/blob/HEAD/src/run_gpt_backdoor.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"b3400e6c8205d71d"}},{"code_sha256_prefix":"f77001035699a79b","entry":"flatten","repo":"yjw1029/embmarker","repo_kind":"official","path":"src/utils.py","file_url":"https://github.com/yjw1029/embmarker/blob/HEAD/src/utils.py","link_basis":"plan_row","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"f77001035699a79b"}},{"code_sha256_prefix":"2d6b92ecffe170d3","entry":"get_label_dict","repo":"yjw1029/embmarker","repo_kind":"official","path":"src/dataset/utils.py","file_url":"https://github.com/yjw1029/embmarker/blob/HEAD/src/dataset/utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"2d6b92ecffe170d3"}},{"code_sha256_prefix":"a56d8bae91268b94","entry":"load_gpt_embeds","repo":"yjw1029/embmarker","repo_kind":"official","path":"src/dataset/emb_cache.py","file_url":"https://github.com/yjw1029/embmarker/blob/HEAD/src/dataset/emb_cache.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"a56d8bae91268b94"}},{"code_sha256_prefix":"77269134ce3b18bc","entry":"load_mind","repo":"yjw1029/embmarker","repo_kind":"official","path":"src/dataset/utils.py","file_url":"https://github.com/yjw1029/embmarker/blob/HEAD/src/dataset/utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"77269134ce3b18bc"}},{"code_sha256_prefix":"37ec69a16ec99bbd","entry":"merge_flatten_metrics","repo":"yjw1029/embmarker","repo_kind":"official","path":"src/utils.py","file_url":"https://github.com/yjw1029/embmarker/blob/HEAD/src/utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"37ec69a16ec99bbd"}},{"code_sha256_prefix":"5bbc5ec0e19a75ed","entry":"train_copier","repo":"yjw1029/embmarker","repo_kind":"official","path":"src/run_gpt_backdoor.py","file_url":"https://github.com/yjw1029/embmarker/blob/HEAD/src/run_gpt_backdoor.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"5bbc5ec0e19a75ed"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}