Rotation, Scale, and Translation Resilient Black-box Fingerprinting for Intellectual Property Protection of EaaS Models

TL;DR

The paper tackles intellectual property protection for Embedding as a Service (EaaS) models, highlighting the vulnerability of traditional watermarking to geometric transformations. It proposes POSTER, a fingerprinting framework that treats victim and suspect embeddings as point clouds and performs robust alignment to resist rotation, scaling, and translation (RST) without retraining. The method comprises two steps—Point Cloud Alignment and Similarity Score Determination—followed by a statistical hypothesis test to confirm ownership, and it is demonstrated to preserve downstream embedding utility while delivering strong RST robustness on both visual and textual tasks. This approach enables covert, scalable black-box verification of EaaS ownership with significant p-values under diverse attacks, offering practical IP protection for cloud-based embedding services.

Abstract

Feature embedding has become a cornerstone technology for processing high-dimensional and complex data, which results in that Embedding as a Service (EaaS) models have been widely deployed in the cloud. To protect the intellectual property of EaaS models, existing methods apply digital watermarking to inject specific backdoor triggers into EaaS models by modifying training samples or network parameters. However, these methods inevitably produce detectable patterns through semantic analysis and exhibit susceptibility to geometric transformations including rotation, scaling, and translation (RST). To address this problem, we propose a fingerprinting framework for EaaS models, rather than merely refining existing watermarking techniques. Different from watermarking techniques, the proposed method establishes EaaS model ownership through geometric analysis of embedding space's topological structure, rather than relying on the modified training samples or triggers. The key innovation lies in modeling the victim and suspicious embeddings as point clouds, allowing us to perform robust spatial alignment and similarity measurement, which inherently resists RST attacks. Experimental results evaluated on visual and textual embedding tasks verify the superiority and applicability. This research reveals inherent characteristics of EaaS models and provides a promising solution for ownership verification of EaaS models under the black-box scenario.

Figures (7)

• Figure 1: An intuitive illustration for the model extraction attack.
• Figure 2: An intuitive illustration for the RST attack.
• Figure 3: An intuitive illustration for RST operations within the 2D embedding space: (a) rotation, (b) scaling, (c) translation, and (d) hybrid transformation.
• Figure 4: Example for the embedding distribution of the original model and the suspect model in the absence of attacks. The number of embeddings presented is $500\times 2 = 1,000$. The high-dimensional embeddings were reduced to 3-D by randomly selecting three of their components. For image embedding, both the original model and suspect model use Inception-ResNet as the backbone. The same setting applies below unless otherwise stated.
• Figure 5: Example for the embedding distribution of the original model and the suspect model under a single attack: (a, d) the rotation angle is $60^\circ$, (b, e) the scaling factor is $2$, (c, f) the translation length is $5$. The rotation direction and translation direction are randomly specified in advance.