Protecting Intellectual Property of Language Generation APIs with Lexical Watermark
Open accessAbstract
Nowadays, due to the breakthrough in natural language generation (NLG), including machine translation, document summarization, image captioning, etc NLG models have been encapsulated in cloud APIs to serve over half a billion people worldwide and process over one hundred billion word generations per day. Thus, NLG APIs have already become essential profitable services in many commercial companies. Due to the substantial financial and intellectual investments, service providers adopt a pay-as-you-use policy to promote sustainable market growth. However, recent works have shown that cloud platforms suffer from financial losses imposed by model extraction attacks, which aim to imitate the functionality and utility of the victim services, thus violating the intellectual property (IP) of cloud APIs. This work targets at protecting IP of NLG APIs by identifying the attackers who have utilized watermarked responses from the victim NLG APIs. However, most existing watermarking techniques are not directly amenable for IP protection of NLG APIs. To bridge this gap, we first present a novel watermarking method for text generation APIs by conducting lexical modification to the original outputs. Compared with the competitive baselines, our watermark approach achieves better identifiable performance in terms of p-value, with fewer semantic losses. In addition, our watermarks are more understandable and intuitive to humans than the baselines. Finally, the empirical studies show our approach is also applicable to queries from different domains, and is effective on the attacker trained on a mixture of the corpus which includes less than 10% watermarked samples.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Existing one-shot FL methods are mostly impractical or face inherent limitations, such as requiring a public dataset, homogeneous participant models, additional data/model information upload, or unsatisfactory performance.
“Despite the low communication cost, existing one-shot FL methods are mostly impractical or face inherent limitations, e.g. , a public dataset is required, participants' models are homogeneous, additional data/model information needs to be uploaded, unsatisfactory performance [188], [189], [190].”
From Privacy and Robustness in Federated Learning: Attacks and Defenses (2024) · cites this paper as [189]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
Jakubův, J., Chvalovský, K., Goertzel, Z., et al. (2023) · DROPS (Schloss Dagstuhl – Leibniz Center for Informatics) · doi:10.4230/lipics.itp.2023.19 · Cited by 76,648 · see citing works
Microsoft COCO: Common Objects in Context
Lin, T.-Y., Maire, M., Belongie, S., Hays, J., Perona, P., Ramanan, D., Dollár, P., & Zitnick, C. L. (2014) · Lecture Notes in Computer Science · doi:10.1007/978-3-319-10602-1_48 · Cited by 45,460 · see citing works
Neural Machine Translation by Jointly Learning to Align and Translate
Bahdanau, D., Cho, K., & Bengio, Y. (2014) · arXiv · doi:10.48550/arxiv.1409.0473 · Cited by 16,213 · see citing works
Distilling the Knowledge in a Neural Network
Hinton, G., Vinyals, O., & Dean, J. (2015) · arXiv · doi:10.48550/arxiv.1503.02531 · Cited by 14,204 · see citing works
Kilgarriff, A. (2000) · Language · doi:10.2307/417141 · Cited by 11,595 · see citing works
(2004) · Cited by 9,718 · see citing works
Lewis, M., Liu, Y., Goyal, N., Ghazvininejad, M., Mohamed, A., Levy, O., Stoyanov, V., & Zettlemoyer, L. (2020) · Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics · doi:10.18653/v1/2020.acl-main.703 · Cited by 8,821 · see citing works
Show, Attend and Tell: Neural Image Caption Generation with Visual Attention
Xu, K., Ba, J., Kiros, R., Cho, K., Courville, A., Salakhutdinov, R., Zemel, R., & Bengio, Y. (2015) · arXiv · doi:10.48550/arxiv.1502.03044 · Cited by 8,248 · see citing works
Bottom-Up and Top-Down Attention for Image Captioning and Visual Question Answering
Anderson, P., He, X., Buehler, C., Teney, D., Johnson, M., Gould, S. J., & Zhang, L. (2018) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr.2018.00636 · Cited by 5,117 · see citing works
Self-citationDeep visual-semantic alignments for generating image descriptions
Karpathy, A., & Fei-Fei, L. (2015) · 2015 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2015.7298932 · Cited by 4,902 · see citing works
Get To The Point: Summarization with Pointer-Generator Networks
See, A., Liu, P. J., & Manning, C. D. (2017) · Proceedings of the 55th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) · doi:10.18653/v1/p17-1099 · Cited by 3,775 · see citing works
Bleu: a method for automatic evaluation of machine translation
Papineni, K. (2024) · doi:10.57702/ljteqmrb · Cited by 3,682 · see citing works
Mathematical Statistics and Data Analysis
Rabinowitz, L., & Rice, J. A. (1989) · Technometrics · doi:10.2307/3556160 · Cited by 3,142 · see citing works
Petitcolas, F., Anderson, R. J., & Kuhn, M. (1999) · Proceedings of the IEEE · doi:10.1109/5.771065 · Cited by 2,996 · see citing works
Understanding deep learning requires rethinking generalization
Zhang, C., Bengio, S., Hardt, M., Recht, B., & Vinyals, O. (2016) · arXiv · doi:10.48550/arxiv.1611.03530 · Cited by 2,838 · see citing works
Abstractive Text Summarization using Sequence-to-sequence RNNs and Beyond
Nallapati, R., Zhou, B., dos Santos, C., Gulcehre, C., & Xiang, B. (2016) · Proceedings of The 20th SIGNLL Conference on Computational Natural Language Learning · doi:10.18653/v1/k16-1028 · Cited by 2,361 · see citing works
Self-Critical Sequence Training for Image Captioning
Rennie, S. J., Marcheret, E., Mroueh, Y., Ross, J., & Goel, V. (2017) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr.2017.131 · Cited by 2,177 · see citing works
SPICE: Semantic Propositional Image Caption Evaluation
Anderson, P., Fernando, B., Johnson, M., & Gould, S. (2016) · Lecture Notes in Computer Science · doi:10.1007/978-3-319-46454-1_24 · Cited by 1,986 · see citing works
Multilingual Denoising Pre-training for Neural Machine Translation
Liu, Y., Gu, J., Goyal, N., Li, X., Edunov, S., Ghazvininejad, M., Lewis, M., & Zettlemoyer, L. (2020) · Transactions of the Association for Computational Linguistics · doi:10.1162/tacl_a_00343 · Cited by 1,608 · see citing works
Moses : open source toolkit for statistical machine translation
Koehn, P., Hoang, H., Birch, A., Callison-Burch, C., Federico, M., Bertoldi, N., Cowan, B., Shen, W., Moran, C., Zens, R., et al. (2007) · Edinburgh Research Explorer (University of Edinburgh) · Cited by 1,547 · see citing works
Parallel Data, Tools and Interfaces in OPUS
Tiedemann, J. (2012) · Language Resources and Evaluation · Cited by 1,421 · see citing works
Neural Machine Translation of Rare Words with Subword Units
Sennrich, R., Haddow, B., & Birch, A. (2016) · Proceedings of the 54th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) · doi:10.18653/v1/p16-1162 · Cited by 974 · see citing works
Abstractive Sentence Summarization with Attentive Recurrent Neural Networks
Chopra, S., Auli, M., & Rush, A. M. (2016) · Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (NAACL-HLT) · doi:10.18653/v1/n16-1012 · Cited by 896 · see citing works
Neural Summarization by Extracting Sentences and Words
Cheng, J., & Lapata, M. (2016) · Proceedings of the conference - Association for Computational Linguistics. Meeting · doi:10.18653/v1/p16-1046 · Cited by 802 · see citing works
Stealing Machine Learning Models via Prediction APIs
Tramèr, F., Zhang, F., Juels, A., Reiter, M. K., & Ristenpart, T. (2016) · arXiv · doi:10.48550/arxiv.1609.02943 · Cited by 796 · see citing works
Embedding Watermarks into Deep Neural Networks
Uchida, Y., Nagai, Y., Sakazawa, S., & Satoh, S. (2017) · International Conference on Multimedia Retrieval · doi:10.1145/3078971.3078974 · Cited by 709 · see citing works
Findings of the 2014 Workshop on Statistical Machine Translation
Bojar, O., Buck, C., Federmann, C., Haddow, B., Koehn, P., Leveling, J., Monz, C., Pecina, P., Post, M., Saint-Amand, H., et al. (2014) · Conference on Machine Translation (WMT) · doi:10.3115/v1/w14-3302 · Cited by 705 · see citing works
The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networks
Carlini, N., Liu, C., Erlingsson, Ú., Kos, J., & Song, D. (2018) · arXiv · doi:10.48550/arxiv.1802.08232 · Cited by 629 · see citing works
Multilingual Denoising Pre-training for Neural Machine TranslationPreprint
Liu, Y., Gu, J., Goyal, N., et al. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2001.08210 · Cited by 606 · see citing works
Protecting Intellectual Property of Deep Neural Networks with Watermarking
Zhang, J., Gu, Z., Jang, J., Wu, H., Stoecklin, M. P., Huang, H., & Molloy, I. (2018) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/3196494.3196550 · Cited by 556 · see citing works
PRADA: Protecting Against DNN Model Stealing Attacks
Juuti, M., Szyller, S., Marchal, S., & Asokan, N. (2019) · 2019 IEEE European Symposium on Security and Privacy (EuroS&P) · doi:10.1109/eurosp.2019.00044 · Cited by 440 · cited 2× · see citing works
“On the other hand, it is challenging to prevent model extraction, while retaining the utility of the victim models for legitimate users (Alabdulmohsin, Gao, and Zhang 2014; Juuti et al. 2019; Lee et al. 2019).”
Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by BackdooringPreprint
Adi, Y., Baum, C., Cissé, M., Benny Pinkas, B., & Keshet, J. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1802.04633 · Cited by 395 · see citing works
Adversarial frontier stitching for remote neural network watermarking
Merrer, E. L., Pérez, P., & Trédan, G. (2019) · Neural Computing and Applications · doi:10.1007/s00521-019-04434-z · Cited by 342 · see citing works
Findings of the 2015 Workshop on Statistical Machine Translation
Bojar, O., Chatterjee, R., Federmann, C., Haddow, B., Huck, M., Hokamp, C., Koehn, P., Logacheva, V., Monz, C., Negri, M., et al. (2015) · Conference on Machine Translation (WMT) · doi:10.18653/v1/w15-3001 · Cited by 287 · see citing works
Six Challenges for Neural Machine Translation
Koehn, P., & Knowles, R. (2017) · Proceedings of the First Workshop on Neural Machine Translation · doi:10.18653/v1/w17-3204 · Cited by 184 · see citing works
Copycat CNN: Stealing Knowledge by Persuading Confession with Random Non-Labeled Data
Correia-Silva, J. R., Berriel, R. F., Badue, C. S., Souza, A. F. D., & Oliveira-Santos, T. (2018) · International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn.2018.8489592 · Cited by 162 · see citing works
Report on the 11th IWSLT Evaluation Campaign, IWSLT 2014
Cettolo, M., Niehues, J., Stüker, S., Bentivogli, L., & Federico, M. (2014) · Cited by 158 · see citing works
Self-training Improves Pre-training for Natural Language Understanding
Du, J., Grave, É., Gunel, B., Chaudhary, V., Çelebi, O., Auli, M., Stoyanov, V., & Conneau, A. (2021) · Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (NAACL-HLT) · doi:10.18653/v1/2021.naacl-main.426 · Cited by 141 · see citing works
Thieves on Sesame Street! Model Extraction of BERT-based APIs
Krishna, K., Tomar, G. S., Parikh, A. P., Papernot, N., & Iyyer, M. (2019) · arXiv · doi:10.48550/arxiv.1910.12366 · Cited by 111 · see citing works
Defending Against Neural Network Model Stealing Attacks Using Deceptive Perturbations
Lee, T., Edwards, B., Molloy, I., & Su, D. (2019) · IEEE Security and Privacy Workshops (SPW) · doi:10.1109/spw.2019.00020 · Cited by 101 · see citing works
Imitation Attacks and Defenses for Black-box Machine Translation Systems
Wallace, E., Stern, M., & Song, D. (2020) · Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP) · doi:10.18653/v1/2020.emnlp-main.446 · Cited by 75 · see citing works
Model Extraction and Adversarial Transferability, Your BERT is Vulnerable!
He, X., Lyu, L., Sun, L., & Xu, Q. (2021) · Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (NAACL-HLT) · doi:10.18653/v1/2021.naacl-main.161 · Cited by 71 · see citing works
Self-citationDAWN: Dynamic Adversarial Watermarking of Neural NetworksPreprint
Szyller, S., Atli, B. G., Marchal, S., & Asokan, N. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1906.00830 · Cited by 58 · see citing works
Protect, show, attend and tell: Empowering image captioning models with ownership protection
Lim, J. H., Chan, C. S., Ng, K. W., et al. (2021) · Pattern Recognition · doi:10.1016/j.patcog.2021.108285 · Cited by 47 · see citing works
Adding Robustness to Support Vector Machines Against Adversarial Reverse Engineering
Alabdulmohsin, I., Gao, X. D., & Zhang, X. (2014) · doi:10.1145/2661829.2662047 · Cited by 37 · see citing works
Li, M., Zhong, Q., Zhang, L. Y., Du, Y., Zhang, J., & Xiang, Y. (2020) · IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) · doi:10.1109/trustcom50675.2020.00062 · Cited by 34 · see citing works
PRADA: Protecting against DNN Model Stealing AttacksPreprint
Juuti, M., Szyller, S., Marchal, S., et al. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1805.02628 · Cited by 32 · see citing works
Venugopal, A., Uszkoreit, J., Talbot, D., Och, F. J., & Ganitkevitch, J. (2011) · Cited by 25 · see citing works
Imitation Attacks and Defenses for Black-box Machine Translation SystemsPreprint
Wallace, E., Stern, M., & Song, D. X. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2004.15015 · Cited by 19 · see citing works
Generate, Annotate, and Learn: Generative Models Advance Self-Training and Knowledge Distillation.Preprint
He, X., Nassar, I., Kiros, J., Haffari, G., & Norouzi, M. (2021) · arXiv (Cornell University) · Cited by 7 · see citing works
Self-citationProtect, Show, Attend and Tell: Empowering Image Captioning Models with Ownership ProtectionPreprint
Lim, J. H., Chan, C. S., Ng, K. W., et al. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2008.11009 · Cited by 4 · see citing works
Flagged first, then by citations
Research works printed but not linked: 3
- Miller, G. A. 1998. WordNet: An electronic lexical database . MIT press.
- Vaswani, A.; Shazeer, N.; Parmar, N.; Uszkoreit, J.; Jones, L.; Gomez, A. N.; Kaiser, Ł.; and Polosukhin, I. 2017. Attention is all you need. In Advances in neural information processing systems , 5998-6008.
- Xu, Q.; He, X.; Lyu, L.; Qu, L.; and Haffari, G. 2021. Beyond Model Extraction: Imitation Attack for Black-Box NLP APIs. arXiv preprint arXiv:2108.13873 . · arXiv
Cited by
Sorted by citations
Privacy and Robustness in Federated Learning: Attacks and Defenses
Lyu, L., Yu, H., Ma, X., Chen, C., Sun, L., Zhao, J., Yang, Q., & Yu, P. S. (2024) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2022.3216981 · Cited by 548 · see citing works
Self-citationA Watermark for Large Language Models
Kirchenbauer, J., Geiping, J., Wen, Y., Katz, J., Miers, I., & Goldstein, T. (2023) · arXiv · doi:10.48550/arxiv.2301.10226 · Cited by 194 · see citing works
“3 , the average PPL of attacked sequences increases by 3 × in addition to requiring more model calls.”
Language Model Behavior: A Comprehensive Survey
Chang, T. A., & Bergen, B. K. (2024) · Computational Linguistics · doi:10.1162/coli_a_00492 · Cited by 105 · see citing works
ModelShield: Adaptive and Robust Watermark Against Model Extraction Attack
Pang, K., Qi, T., Wu, C., Bai, M., Jiang, M., & Huang, Y. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2025.3530691 · Cited by 29 · see citing works
M4: Multi-generator, Multi-domain, and Multi-lingual Black-Box Machine-Generated Text Detection
Wang, Y., Mansurov, J., Ivanov, P., Su, J., Shelmanov, A., Tsvigun, A., Whitehouse, C., Afzal, O. M., Mahmoud, T., Sasaki, T., et al. (2023) · arXiv · doi:10.48550/arxiv.2305.14902 · Cited by 19 · see citing works
“Various approaches range from text-level posthoc lexical substitutions and synonym replacement over generated outputs (Szyller et al., 2021; He et al., 2022), and soft watermarking (Kirchenbauer et al., 2023) using green and red token lists, to hidden-space operations, such as injecting secret…”
BackgroundProtecting Language Models Against Unauthorized Distillation through Trace Rewriting
Ma, X., Yeoh, W., Zhang, N., & Vorobeychik, Y. (2026) · arXiv · doi:10.48550/arxiv.2602.15143
“We compare our instruction-based rewriting approach with four state-of-the-art API watermarking baselines: (1) He et al. (2022a), which uses 7 Table 1: Watermark detection results on GSM8K.”
Influential
- Authors
- He, X., Xu, Q., Lyu, L., Wu, F., & Wang, C.
- Affiliations
- Monash University (AU)
- Australian National University (AU)
- Sony (Japan) (JP)
- Microsoft Research Asia (China) (CN)
- University of California, Berkeley (US)
- Venue
- Proceedings of the AAAI Conference on Artificial Intelligence
- Published
- 2022-06-28
- Volume
- 36
- Issue
- 10
- Pages
- 10758-10766
- ISSN
- 2159-5399 (ISSN-L)
- 2374-3468
- OpenAlex
- W4226014375
- Cited by
- 56
- References
- 51
- Citations by year
- 2026: 6 · 2025: 17 · 2024: 10 · 2023: 17 · 2022: 6
- FWCI
- 6.91
- Type
- conference paper
- Language
- en
- Open access
- diamond
- doi.org
- Locations
- Proceedings of the AAAI Conference on Artificial Intelligence (publishedVersion)
- arXiv (Cornell University) (submittedVersion)
- AAAI Publications (The Association for the Advancement of Artificial Intelligence (AAAI)) (submittedVersion)
- arXiv (Cornell University)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Computer Vision and Pattern Recognition › Advanced Steganography and Watermarking Techniques
- Physical Sciences › Computer Science › Hardware and Architecture › Physical Unclonable Functions (PUFs) and Hardware Security
- Keywords
- intellectual property protection, model extraction attacks, attacker identification
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
