Elamur Research⌕
☰
home / papers / 2026 / RShield: A User-level Traceable Backdoor Watermark for LLMs in Embedding-as-a-Service

RShield: A User-level Traceable Backdoor Watermark for LLMs in Embedding-as-a-Service

Paper · 2026 · Lingyun Xiang, Yufan Zhong, Chengfu Ou et al.

Summary

Companies that sell text embeddings through APIs (Embedding-as-a-Service, EaaS) are exposed to model extraction, where an attacker trains a cheap surrogate on query–response pairs. Earlier backdoor watermarks such as EmbMarker, WARDEN and ESpeW only answer a yes/no question: was this model copied? They cannot identify which customer account leaked the service. Multi-bit watermarks built for generative LLMs do not transfer either, because embedding models never decode tokens.

RShield addresses this by treating extraction as a noisy communication channel. It encodes a user identifier with Reed–Solomon error-correcting codes and maps the code symbols to a codebook of orthogonal vectors built with the Gram–Schmidt process. A small residual Adapter then injects these vectors into the embeddings of trigger-bearing inputs, adapting to each input instead of using fixed interpolation. On four NLP benchmarks, including SST-2 and Enron Spam, the identifier was fully recovered from extracted models while downstream accuracy stayed high. This makes per-user attribution practical as evidence in copyright disputes.

Key points

  • RShield reports 100% multi-bit recovery from surrogate models. The authors claim its statistical confidence is tens of orders of magnitude stronger than that of zero-bit baselines.
  • On SST-2, payloads from 48 to 144 bits were tested with 4 redundancy symbols. Decoding success remained 100% and accuracy stayed near 93%. At 144 bits, however, PCA revealed visible clusters, so the authors recommend about 128 bits.
  • Deployment costs are modest:
    • Adapter training takes 6–7 minutes.
    • Majority voting plus RS decoding takes 20–34 ms.
    • Recovering a 112-bit payload needs roughly 1,800 API queries.
  • Trigger word frequency strongly affects stealth. Words in the [1.4e−4, 1.6e−4] frequency range blended into the embedding distribution on Enron Spam. Rarer triggers created detectable "island" clusters.
  • The authors note three limitations:
    • Security depends on keeping the codebook secret.
    • Collusion spread evenly across many accounts may exceed what RS correction can handle.
    • Robustness against targeted removal attacks remains open.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

 Fields, topics and concepts

📚 Shelves 4The field of science this work belongs to (OpenAlex fields).Computer Science · 18,614 worksArtificial Intelligence · 17,965 worksComputer Vision and Pattern Recognition · 3,486 worksHardware and Architecture · 167 works

🧭 Topics 1Research subjects and languages the work is about.Language models & pretraining · 3,894 works

Cite

Cite as Lingyun Xiang, Yufan Zhong, Chengfu Ou, Zhihua Xia, Chunfang Yang, Daojian Zeng and Zhangjie Fu. 2026. RShield: A User-level Traceable Backdoor Watermark for LLMs in Embedding-as-a-Service. Findings of the Association for Computational Linguistics: ACL 2026.

The paper itself, not this page. BibTeX from the library's record of the work. DOI 10.18653/v1/2026.findings-acl.1347

@inproceedings{xiang2026rshield,
  title = {{RShield: A User-level Traceable Backdoor Watermark for LLMs in Embedding-as-a-Service}},
  author = {Lingyun Xiang, Yufan Zhong, Chengfu Ou, Zhihua Xia, Chunfang Yang, Daojian Zeng and Zhangjie Fu},
  booktitle = {Findings of the Association for Computational Linguistics: ACL 2026},
  year = {2026},
  doi = {10.18653/v1/2026.findings-acl.1347},
  url = {https://doi.org/10.18653/v1/2026.findings-acl.1347}
}

References

40 references, 7 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. Vance W. Berger and YanYan Zhou. 2014. mogorov–smirnov test: Overview. find
  2. Kol-Nicholas Carlini, Daniel Paleka, Krishnamurthy Dj Dvijotham, Thomas Steinke, Jonathan Hayase, A. Feder Cooper, Katherine Lee, Matthew Jagielski, Milad Nasr, Arthur Conmy, Eric Wallace, David Rolnick, and Florian Tramèr. 2024. Stealing part of a production language model. In Proceedings of the 41… find
  3. Varun Chandrasekaran, Kamalika Chaudhuri, Irene Giacomelli, Somesh Jha, and Songbai Yan. 2020. Exploring connections between active learning and model extraction. In 29th USENIX Security Symposium (USENIX Security 20), pages 1309–1326. USENIX Association. find
  4. Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. 2019. BERT: Pre-training of deep bidirectional transformers for language understanding. In Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies,…
  5. Google. 2023. How to use grounding for llms with text embeddings. Google Cloud Blog. find
  6. Xuanli He, Qiongkai Xu, Yi Zeng, Lingjuan Lyu, Fangzhao Wu, Jiwei Li, and Ruoxi Jia. 2022. Cater: Intellectual property protection on text generation apis via conditional watermarks. In Advances in Neural Information Processing Systems, volume 35, pages 5431–5445. Curran Associates, Inc. find
  7. Kalpesh Krishna, Gaurav Singh Tomar, Ankur P. Parikh, Nicolas Papernot, and Mohit Iyyer. 2020. Thieves on sesame street! model extraction of bert-based apis. In International Conference on Learning Representations. find
  8. Erwan Le Merrer, Patrick Perez, and Gilles Trédan. 2020. Adversarial frontier stitching for remote neural network watermarking. Neural Computing and Applications, 32(13):9233–9244. find
  9. Hao Li, Yubing Ren, Yanan Cao, Yingjie Li, Fang Fang, and Xuebin Wang. 2025. From essence to defense: Adaptive semantic-aware watermarking for embedding-as-a-service copyright protection. Preprint, arXiv:2512.16439. — [arXiv:2512.16439](https://arxiv.org/abs/2512.16439) find
  10. Yupei Liu, Jinyuan Jia, Hongbin Liu, and Neil Zhenqiang Gong. 2022. Stolenencoder: Stealing pre-trained encoders in self-supervised learning. In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, CCS ’22, page 2115–2128, New York, NY, USA. Association for Computin… find
  11. Ilya Loshchilov and Frank Hutter. 2019. Decoupled weight decay regularization. In International Conference on Learning Representations. find
  12. Stephen Merity, Caiming Xiong, James Bradbury, and Richard Socher. 2017. Pointer sentinel mixture models. In International Conference on Learning Representations.
  13. Vangelis Metsis, Ion Androutsopoulos, and Georgios Paliouras. 2006. Spam filtering with naive bayes – which naive bayes? In Proceedings of the 3rd Conference on Email and Anti-Spam (CEAS), pages 28–69, Mountain View, California, USA. find
  14. OpenAI. 2024. New embedding models and api updates. https://openai.com/blog/ new-embedding-models-and-api-updates. [Accessed 02-02-2024]. ↗
  15. OpenAI, Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, Red Avila, Igor Babuschkin, Suchir Balaji, Valerie Balcom, Paul Baltescu, Haiming Bao, Mohammad Bavarian, Jeff Belgum, and 262 others.… — GPT-4 Technical Report
  16. Tribhuvanesh Orekondy, Bernt Schiele, and Mario Fritz. 2019. Knockoff nets: Stealing functionality of black-box models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 4949–4958. find
  17. Wenjun Peng, Jingwei Yi, Fangzhao Wu, Shangxi Wu, Bin Bin Zhu, Lingjuan Lyu, Binxing Jiao, Tong Xu, Guangzhong Sun, and Xing Xie. 2023. Are you copying my model? protecting the copyright of large language models for EaaS via backdoor watermark. In Proceedings of the 61st Annual Meeting of the Associ… find
  18. Wenjie Qu, Wengrui Zheng, Tianyang Tao, Dong Yin, Yanze Jiang, Zhihua Tian, Wei Zou, Jinyuan Jia, and Jiaheng Zhang. 2025. Provably robust multi-bit watermarking for ai-generated text. In Proceedings of the 34th USENIX Conference on Security Symposium, SEC ’25, pages 201–220, USA. USENIX Association… find
  19. Adnan Siraj Rakin, Md Hafizul Islam Chowdhuryy, Fan Yao, and Deliang Fan. 2022. Deepsteal: Advanced model extractions leveraging efficient weight stealing in memories. In 2022 IEEE Symposium on Security and Privacy (SP), pages 1157–1174. find
  20. I. S. Reed and G. Solomon. 1960. Polynomial codes over certain finite fields. Journal of the Society for Industrial and Applied Mathematics, 8(2):300–304. find
  21. Anudeex Shetty, Yue Teng, Ke He, and Qiongkai Xu. 2024. WARDEN: Multi-directional backdoor watermarks for embedding-as-a-service copyright protection. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 13430–13444, Bangkok, Thail… find
  22. Anudeex Shetty, Qiongkai Xu, and Jey Han Lau. 2025. WET: Overcoming paraphrasing vulnerabilities in embeddings-as-a-service with linear transformation watermarks. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 23024–23043, Vi… find
  23. Richard Socher, Alex Perelygin, Jean Wu, Jason Chuang, Christopher D. Manning, Andrew Ng, and Christopher Potts. 2013. Recursive deep models for semantic compositionality over a sentiment treebank. In Proceedings of the 2013 Conference on Empirical Methods in Natural Language Processing, pages 1631–…
  24. Sebastian Szyller, Buse Gul Atli, Samuel Marchal, and N. Asokan. 2021. Dawn: Dynamic adversarial watermarking of neural networks. In Proceedings of the 29th ACM International Conference on Multimedia, MM ’21, page 4417–4425, New York, NY, USA. Association for Computing Machinery. find
  25. Manveer Singh Tamber, Jasper Xian, and Jimmy Lin. 2025. Can’t hide behind the API: Stealing black-box commercial embedding models. In Findings of the Association for Computational Linguistics: NAACL 2025, pages 1958–1969, Albuquerque, New Mexico. Association for Computational Linguistics. find
  26. Hugo Touvron, Thibaut Lavril, Gautier Izacard, Xavier Martinet, Marie-Anne Lachaux, Timothée Lacroix, Baptiste Rozière, Naman Goyal, Eric Hambro, Faisal Azhar, Aurelien Rodriguez, Armand Joulin, Edouard Grave, and Guillaume Lample. 2023. Llama: Open and efficient foundation language models. Preprint…
  27. Florian Tramèr, Fan Zhang, Ari Juels, Michael K. Reiter, and Thomas Ristenpart. 2016. Stealing machine learning models via prediction APIs. In 25th USENIX Security Symposium (USENIX Security 16), pages 601–618, Austin, TX. USENIX Association. find
  28. Lloyd N. Trefethen and David Bau. 1997. Numerical Linear Algebra. SIAM. find
  29. Yusuke Uchida, Yuki Nagai, Shigeyuki Sakazawa, and Shin’ichi Satoh. 2017. Embedding watermarks into deep neural networks. In Proceedings of the 2017 ACM on International Conference on Multimedia Retrieval, ICMR ’17, page 269–277, New York, NY, USA. Association for Computing Machinery. find
  30. Eric Wallace, Mitchell Stern, and Dawn Song. 2020. Imitation attacks and defenses for black-box machine translation systems. In Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP), pages 5531–5546, Online. Association for Computational Linguistics. find
  31. Lean Wang, Wenkai Yang, Deli Chen, Hao Zhou, Yankai Lin, Fandong Meng, Jie Zhou, and Xu Sun. 2024. Towards codable watermarking for injecting multi-bits information to LLMs. In The Twelfth International Conference on Learning Representations. find
  32. Liaoyaqi Wang and Minhao Cheng. 2024. GuardEmb: Dynamic watermark for safeguarding large language model embedding service against model stealing attack. In Findings of the Association for Computational Linguistics: EMNLP 2024, pages 7518–7534, Miami, Florida, USA. Association for Computational Lingu… find
  33. Zongqi Wang, Baoyuan Wu, Jingyuan Deng, and Yujiu Yang. 2025. Robust and minimally invasive watermarking for EaaS. In Findings of the Association for Computational Linguistics: ACL 2025, pages 2167–2191, Vienna, Austria. Association for Computational Linguistics. find
  34. Fangzhao Wu, Ying Qiao, Jiun-Hung Chen, Chuhan Wu, Tao Qi, Jianxun Lian, Danyang Liu, Xing Xie, Jianfeng Gao, Winnie Wu, and Ming Zhou. 2020. MIND: A large-scale dataset for news recommendation. In Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, pages 3597–36…
  35. Qiongkai Xu, Xuanli He, Lingjuan Lyu, Lizhen Qu, and Gholamreza Haffari. 2022. Student surpasses teacher: Imitation attack for black-box NLP APIs. In Proceedings of the 29th International Conference on Computational Linguistics, pages 2849–2860, Gyeongju, Republic of Korea. International Committee o… find
  36. Zuopeng Yang, Pengyu Chen, Tao Li, Kangjun Liu, Yuan Huang, and Xin Lin. 2024. Defending against similarity shift attack for eaas via adaptive multi-target watermarking. Information Sciences, 678:120893. find
  37. KiYoon Yoo, Wonhyuk Ahn, and Nojun Kwak. 2024. Advancing beyond identification: Multi-bit watermark for large language models. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers), pa… find
  38. Zhenrui Yue, Zhankui He, Huimin Zeng, and Julian McAuley. 2021. Black-box attacks on sequential recommenders via data-free model extraction. In Proceedings of the 15th ACM Conference on Recommender Systems, RecSys ’21, page 44–54, New York, NY, USA. Association for Computing Machinery. find
  39. Xiang Zhang, Junbo Zhao, and Yann LeCun. 2015. Character-level convolutional networks for text classification. In Advances in Neural Information Processing Systems, volume 28. Curran Associates, Inc.
  40. Kaixiang Zhao, Lincan Li, Kaize Ding, Neil Zhenqiang Gong, Yue Zhao, and Yushun Dong. 2025. A survey on model extraction attacks and defenses for large language models. In Proceedings of the 31st ACM SIGKDD Conference on Knowledge Discovery and Data Mining V.2, KDD ’25, page 6227–6236, New York, NY,… find

Updated

↑ back to top

This page in Markdown → https://md.research.elamur.ai/free/en/papers/xiang-2026-rshield-user-level-traceable-backdoor/