HaloMark: A Spectral Threshold for Embedding-Vector Watermarking under C2PA

• URL: http://arxiv.org/abs/2608.08645v1
• Date: Sun, 09 Aug 2026 11:36:59 GMT
• Title: HaloMark: A Spectral Threshold for Embedding-Vector Watermarking under C2PA
• Abstract summary: We present HaloMark, a watermark for embedding vectors cryptographically bound to a C2PA manifest.<n>The verifier runs at 284 us and 24 bytes of sidecar per vector, validated end-to-end against three C2PA reference-SDK bindings.
• Score: 3.0458514384586404
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Foundation-model embeddings are now a primary data asset, but the content-provenance machinery built for images and audio does not transfer to them. C2PA binds to an asset with a stable bit-level or perceptual identity; embeddings have neither, since quantisation, projection, fine-tuning, and windowed averaging reshape them in normal use and break any fixed hash. We present HaloMark, a watermark for embedding vectors cryptographically bound to a C2PA manifest. It composes four standard primitives -- a block-diagonal orthogonal rotation, public whitening, an input-dependent LSH commitment, and a per-vector nonce -- around one protocol change: the producer signs the LSH commitment c into the C2PA sidecar, and the verifier reads c from the manifest instead of recomputing it. Recomputing is fragile under whitening, which flips the commitment bucket on 62% of inputs at cos = 0.96; reading the signed c reduces the verifier's score to T = T_null + beta(A)*epsilon, so security turns on a single scalar beta, which we bound rigorously for linear and non-adaptive attackers and characterise empirically for the adaptive case. We evaluate against an adversary holding polynomially many clean/watermarked pairs under one key with full sidecar visibility, across eight baselines and ten adaptive attackers including denoising-autoencoder removal. The eleven encoders separate at an empirical threshold eff_rank(Sigma)/d ~= 0.19: above it, detection AUROC stays at 0.98 or higher across every in-budget attack on the three encoders we sweep in full, and at 0.965 or higher under single-seed DAE removal on the rest; below it every variant we tested fails. Why the threshold is dimension-uniform is left open. Deployed as a Qdrant admission filter, the verifier runs at 284 us and 24 bytes of sidecar per vector, validated end-to-end against three C2PA reference-SDK bindings.

Related papers

• Reversibility-Verified De-identification for Cloud-Local LLM Inference: A Locally Certified Dehydrate-Rehydrate Loop with Layered Assurance (DR-SL) [1.802678437602184]
  DR-SL (Dehydrate-Rehydrate with Self-Learning loop) formalizes de-identification completeness as two measurable conditions.<n>A fully local two-branch verifier iterates dehydration under a lexicographic gate with guaranteed termination.<n>We prove Fano-type lower bounds, a Pufferfish witness, and a rate-privacy feasibility criterion, and state their scope plainly.
  arXiv  Detail & Related papers  (2026-09-14T01:04:58Z)
• From Positionwise Confidence to Prefix Scheduling: Verifier Skipping in Speculative Decoding [41.41611499810411]
  Speculative diffusion decoding (SDD) generates every position in a draft block in parallel with a discrete diffusion model.<n>This paper recognizes that this creates a new control handle: whether to invoke the verifier at all.
  arXiv  Detail & Related papers  (2026-08-14T18:00:08Z)
• Fidelity Is Not Safety: Gently-Compressed LLMs Pass Every Data-Free Quality Guard Yet Invent Procedure Steps in Agentic Execution [0.0]
  Practitioners accept a compressed language model once it clears a stack of data-cheap quality guards.<n>Across three model families, gently-compressed models clear every guard and then invent procedure steps that were never in the instructions.<n>We characterize the blindspot and dissociation with paired confidence intervals on a pre-registered, powered canary.
  arXiv  Detail & Related papers  (2026-07-30T13:33:09Z)
• Forgetful Attention: A Trainable Support-Vector Memory with Certified Selection and Exact Unlearning [0.16921396880325776]
  We introduce Support Vector Attention (SV-Attention), a memory whose weights are support coefficients of a one-class Sfp with fixed box parameter C.<n>Its active-set partition gives reserve tokens exactly zero weight, output weights; a incremental incremental solver token to recover the state produced by retraining without it under the same C.<n>We also demonstrate surgical eviction, exact editing, patient-record deletion, and a forgettable retrieval memory over real sentence embeddings.
  arXiv  Detail & Related papers  (2026-07-13T23:13:57Z)
• MIRAGE: A Polarity-Flipping Encoding Subspace in LLM Agents [2.896184275229374]
  LLM agents are coerced into covertly encoding sensitive data.<n>The resulting outputs evade output-side detection but the underlying computation does not.<n>We build MIRAGE, a two-channel real-time monitor exploiting both signals.
  arXiv  Detail & Related papers  (2026-06-09T01:45:19Z)
• Amplifying, Not Learning: Fine-Tuned AI Text Detectors Amplify a Pretrained Direction [51.56484100374058]
  Text detectors amplify a pretrained typicality axis; they do not construct an AI-vs-human boundary.<n>On raw encoders before any task supervision, projecting onto centroid(AI)-centroid(HC3) achieves NYT-vs-HC3 AUROC 0.806/0.944/0.834 across three architectures.<n>On RoBERTa-base, raw projection exceeds fine-tuning; on RoBERTa-base, full fine-tuning reduces discrimination below raw on both fluent-formal populations tested.
  arXiv  Detail & Related papers  (2026-05-20T19:08:38Z)
• VectorSmuggle: Steganographic Exfiltration in Embedding Stores and a Cryptographic Provenance Defense [0.0]
  Modern retrieval-augmented generation (RAG) systems convert sensitive content into high-dimensional embeddings and store them in vector databases that treat the resulting numerical artifacts as opaque.<n>We show this opens a class of steganographic exfiltration attacks.<n>An attacker with write access to the ingestion pipeline can hide payload data inside embeddings.
  arXiv  Detail & Related papers  (2026-05-13T16:44:20Z)
• Committed SAE-Feature Traces for Audited-Session Substitution Detection in Hosted LLMs [2.6382975801439836]
  Hosted-LLM providers have a silent-substitution incentive: advertise a stronger model while serving cheaper replies.<n>We propose a commit-open protocol that closes this gap.<n>We instantiate the protocol on three backbones -- Qwen3-1.7B, Gemma-2-2B, and a 4.5x scale-up to Gemma-2-9B with a 131k-feature SAE.
  arXiv  Detail & Related papers  (2026-04-20T12:34:56Z)
• Compiling Activation Steering into Weights via Null-Space Constraints for Stealthy Backdoors [48.881343993730844]
  Safety-aligned large language models (LLMs) are increasingly deployed in real-world pipelines.<n> adversaries can distribute backdoored checkpoints that behave normally under standard evaluation but jailbreak when a hidden trigger is present.<n>Recent post-hoc weight-editing methods offer an efficient approach to injecting such backdoors.
  arXiv  Detail & Related papers  (2026-04-14T06:48:33Z)
• BiGain: Unified Token Compression for Joint Generation and Classification [47.040577759493004]
  BiGain is a training-free, plug-and-play framework that preserves generation quality while improving classification in accelerated diffusion models.<n>Our key insight is frequency separation, which disentangles fine detail from global semantics, enabling compression that respects both generative fidelity and discriminative utility.<n>Our analyses indicate that balanced spectral retention, preserving high-frequency detail and low/mid-frequency semantics, is a reliable design rule for token compression in diffusion models.
  arXiv  Detail & Related papers  (2026-03-12T17:55:53Z)
• Authenticated Contradictions from Desynchronized Provenance and Watermarking [48.47756819432157]
  This work formalizes and empirically demonstrates the $textitIntegrity Clash$, a condition in which a digital asset carries a cryptographically valid C2PA manifest asserting human authorship.<n>We propose a cross-layer audit protocol that jointly evaluates provenance metadata and watermark detection status, achieving 100% classification accuracy across 3,500 test images.
  arXiv  Detail & Related papers  (2026-03-02T20:42:12Z)
• One Sample is Enough to Make Conformal Prediction Robust [53.78604391939934]
  We show that conformal prediction attains some robustness even with a forward pass on a single randomly perturbed input.<n>Our approach returns robust sets with smaller average set size compared to SOTA methods which use many (e.g. around 100) passes per input.
  arXiv  Detail & Related papers  (2025-06-19T19:14:25Z)
• Principal Bit Analysis: Autoencoding with Schur-Concave Loss [45.420030784128166]
  We consider a linear autocoder in which the variables are latent or corrupted by noise. As a second application, we consider a prototypical prototypical fixed-rate compressor.
  arXiv  Detail & Related papers  (2021-06-05T04:45:30Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.