HaloMark: A Spectral Threshold for Embedding-Vector Watermarking under C2PA
Tarun Sharma
cs.CR, cs.IR
Submitted: 2026-08-09
Updated: 2026-08-11
Code: https://github.com/tarun-ks/halomark
License: http://creativecommons.org/licenses/by/4.0/
The gist: Foundation-model embeddings are now a primary data asset, but the content-provenance machinery built for images and audio does not transfer to them.
Terminology
Abstract
Foundation-model embeddings are now a primary data asset, but the content-provenance machinery built for images and audio does not transfer to them. C2PA binds to an asset with a stable bit-level or perceptual identity; embeddings have neither, since quantisation, projection, fine-tuning, and windowed averaging reshape them in normal use and break any fixed hash. We present HaloMark, a watermark for embedding vectors cryptographically bound to a C2PA manifest. It composes four standard primitives -- a block-diagonal orthogonal rotation, public whitening, an input-dependent LSH commitment, and a per-vector nonce -- around one protocol change: the producer signs the LSH commitment c into the C2PA sidecar, and the verifier reads c from the manifest instead of recomputing it. Recomputing is fragile under whitening, which flips the commitment bucket on 62% of inputs at cos = 0.96; reading the signed c reduces the verifier's score to T = T null + beta(A)*epsilon, so security turns on a single scalar beta, which we bound rigorously for linear and non-adaptive attackers and characterise empirically for the adaptive case. We evaluate against an adversary holding polynomially many clean/watermarked pairs under one key with full sidecar visibility, across eight baselines and ten adaptive attackers including denoising-autoencoder removal. The eleven encoders separate at an empirical threshold eff rank(Sigma)/d = 0.19: above it, detection AUROC stays at 0.98 or higher across every in-budget attack on the three encoders we sweep in full, and at 0.965 or higher under single-seed DAE removal on the rest; below it every variant we tested fails. Why the threshold is dimension-uniform is left open. Deployed as a Qdrant admission filter, the verifier runs at 284 us and 24 bytes of sidecar per vector, validated end-to-end against three C2PA reference-SDK bindings.
Sources
- SEAL: Semantic Aware Image Watermarking
- Black-Box Forgery Attacks on Semantic Watermarks for Diffusion Models
- WMCopier: Forging Invisible Image Watermarks on Arbitrary Images
- Optimization-Free Universal Watermark Forgery with Regenerative Diffusion Models
- Bileve: Securing Text Provenance in Large Language Models Against Spoofing with Bi-level Signature
- WET: Overcoming Paraphrasing Vulnerabilities in Embeddings-as-a-Service with Linear Transformation Watermarks
- Robust and Minimally Invasive Watermarking for EaaS
- MetaSeal: Defending Against Image Attribution Forgery Through Content-Dependent Cryptographic Watermarks
- RegionMarker: A Region-Triggered Semantic Watermarking Framework for Embedding-as-a-Service Copyright Protection
- From Essence to Defense: Adaptive Semantic-aware Watermarking for Embedding-as-a-Service Copyright Protection
- Geometry-Aware Localized Watermarking for Copyright Protection in Embedding-as-a-Service
- Whitening Sentence Representations for Better Semantics and Faster Retrieval
- MS MARCO: A Human Generated MAchine Reading COmprehension Dataset
- BEIR: A Heterogenous Benchmark for Zero-shot Evaluation of Information Retrieval Models
Related papers
- SoK: AI-Augmented Binary Reversing
- Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
- Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
- Estimating the Social Cost of Corporate Data Breaches
- Efficient Fuzzy PSI under One-Sided Assumptions
- Sealing the Audit-Runtime Gap for LLM Skills