Rent-a-RAG：用于审计第三方检索增强生成（RAG）的嵌入空间水印
Rent-a-RAG: Embedding-Space Watermarks for Auditing Third-Party RAG
浏览论文内容
中文总结 AI 辅助
针对第三方RAG市场的文档复用审计难题，提出DirBucket嵌入空间水印框架，可在黑盒访问下准确检测不合规复用，且具备抗攻击性与跨基准迁移性。
中文摘要 AI 辅助
第三方检索增强生成（RAG）市场催生了新的审计问题：数据提供方可将语料库授权给RAG运营方，但后续无法知晓其文档是否被未付费复用。审计此类滥用行为颇具难度，原因在于运营方不配合、生成器会对答案进行paraphrasing（释义改写），且单个响应可能整合了多个提供方的证据。我们提出DirBucket，这是一种面向多提供方RAG中文档级复用的提供方侧语义水印与黑盒审计框架。DirBucket通过保留语义的释义对文档加水印，这些释义的嵌入会偏向提供方桶的秘密方向，可从黑盒答案中检测复用，同时保留检索效用。在反映黑盒访问下多提供方复用的挑战性基准上，DirBucket是唯一能持续实现强目标检测且无目标外激活的方法，在主基准的23个审计答案内即可检测到所有不合规情况。该水印可抵御对抗性答案后清洗，所有被评估的规避策略均无法同时击败检测且保留用户感知的答案质量。检测效果可原封不动迁移至由真实临床、网络威胁情报及法律提供方语料库构建的第二个基准。这些结果表明，嵌入空间水印可使第三方RAG中的文档复用具备统计可审计性。
英文摘要
Third-party retrieval-augmented generation (RAG) marketplaces create a new auditing problem: data providers may license corpora to a RAG operator, yet later have no visibility into whether their documents are being reused without compensation. Auditing this misuse is difficult because the operator is non-cooperative, answers are paraphrased by the generator, and one response may combine evidence from many providers. We propose DirBucket, a provider-side semantic watermarking and black-box auditing framework for document-level reuse in multi-provider RAG. DirBucket watermarks documents by meaning-preserving paraphrases whose embeddings are biased toward provider-bucket secret directions, enabling detection from black-box answers while preserving retrieval utility. On a challenging benchmark that reflects mixed-provider reuse under black-box access, DirBucket is the only method that consistently achieves strong target detection with no non-target activation, detecting non-compliance in every audit within 23 audited answers on our primary benchmark. The watermark survives adversarial post-answer laundering, and none of the evaluated evasion strategies simultaneously defeats detection while preserving user-perceived answer quality. Detection transfers unchanged to a second benchmark built from real clinical, cyber-threat-intelligence, and legal provider corpora. These results suggest that embedding-space watermarking can make document reuse in third-party RAG statistically auditable.
发表机构
- IMDEA Networks Institute（IMDEA网络研究所）
- Universidad Carlos III de Madrid（马德里卡洛斯三世大学）
- Singapore Management University（新加坡管理大学）
机构由 AI 辅助整理，请以论文原文为准。
