{"id":"https://openalex.org/W4416549478","doi":"https://doi.org/10.1145/3719027.3744813","title":"RAG-WM: An Efficient Black-Box Watermarking Approach for Retrieval-Augmented Generation of Large Language Models","display_name":"RAG-WM: An Efficient Black-Box Watermarking Approach for Retrieval-Augmented Generation of Large Language Models","publication_year":2025,"publication_date":"2025-11-19","ids":{"openalex":"https://openalex.org/W4416549478","doi":"https://doi.org/10.1145/3719027.3744813"},"language":"en","primary_location":{"id":"doi:10.1145/3719027.3744813","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3719027.3744813","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security","raw_type":"proceedings-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.1145/3719027.3744813","any_repository_has_fulltext":null},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5046057883","display_name":"Peizhuo Lv","orcid":"https://orcid.org/0000-0002-2671-4314"},"institutions":[{"id":"https://openalex.org/I172675005","display_name":"Nanyang Technological University","ror":"https://ror.org/02e7b5302","country_code":"SG","type":"education","lineage":["https://openalex.org/I172675005"]}],"countries":["SG"],"is_corresponding":true,"raw_author_name":"Peizhuo Lv","raw_affiliation_strings":["Nanyang Technological University, Singapore, Singapore"],"affiliations":[{"raw_affiliation_string":"Nanyang Technological University, Singapore, Singapore","institution_ids":["https://openalex.org/I172675005"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5045398573","display_name":"Mengjie Sun","orcid":"https://orcid.org/0009-0008-2042-9855"},"institutions":[{"id":"https://openalex.org/I4210126530","display_name":"Data Assurance and Communication Security","ror":"https://ror.org/02z2gfm30","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210126530","https://openalex.org/I4210156404"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Mengjie Sun","raw_affiliation_strings":["IIE, CAS, Beijing, China and School of Cyber Security, UCAS, Beijing, China"],"affiliations":[{"raw_affiliation_string":"IIE, CAS, Beijing, China and School of Cyber Security, UCAS, Beijing, China","institution_ids":["https://openalex.org/I4210126530"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Hao Wang","orcid":"https://orcid.org/0009-0003-7455-6175"},"institutions":[{"id":"https://openalex.org/I80143920","display_name":"Shandong University of Science and Technology","ror":"https://ror.org/04gtjhw98","country_code":"CN","type":"education","lineage":["https://openalex.org/I80143920"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Hao Wang","raw_affiliation_strings":["School of Cyber Science and Technology, Shandong University, Qingdao, China"],"affiliations":[{"raw_affiliation_string":"School of Cyber Science and Technology, Shandong University, Qingdao, China","institution_ids":["https://openalex.org/I80143920"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5066976667","display_name":"XiaoFeng Wang","orcid":"https://orcid.org/0000-0002-0607-4946"},"institutions":[{"id":"https://openalex.org/I172675005","display_name":"Nanyang Technological University","ror":"https://ror.org/02e7b5302","country_code":"SG","type":"education","lineage":["https://openalex.org/I172675005"]}],"countries":["SG"],"is_corresponding":false,"raw_author_name":"XiaoFeng Wang","raw_affiliation_strings":["Nanyang Technological University, Singapore, Singapore"],"affiliations":[{"raw_affiliation_string":"Nanyang Technological University, Singapore, Singapore","institution_ids":["https://openalex.org/I172675005"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5027504758","display_name":"Shengzhi Zhang","orcid":"https://orcid.org/0000-0001-9432-9779"},"institutions":[{"id":"https://openalex.org/I111088046","display_name":"Boston University","ror":"https://ror.org/05qwgg493","country_code":"US","type":"education","lineage":["https://openalex.org/I111088046"]},{"id":"https://openalex.org/I92609107","display_name":"Metropolitan College of New York","ror":"https://ror.org/012saek46","country_code":"US","type":"education","lineage":["https://openalex.org/I92609107"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Shengzhi Zhang","raw_affiliation_strings":["Metropolitan College, Boston University, Boston, USA"],"affiliations":[{"raw_affiliation_string":"Metropolitan College, Boston University, Boston, USA","institution_ids":["https://openalex.org/I92609107","https://openalex.org/I111088046"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100342249","display_name":"Yuxuan Chen","orcid":"https://orcid.org/0000-0003-0000-5031"},"institutions":[{"id":"https://openalex.org/I80143920","display_name":"Shandong University of Science and Technology","ror":"https://ror.org/04gtjhw98","country_code":"CN","type":"education","lineage":["https://openalex.org/I80143920"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yuxuan Chen","raw_affiliation_strings":["School of Cyber Science and Technology, Shandong University, Qingdao, China"],"affiliations":[{"raw_affiliation_string":"School of Cyber Science and Technology, Shandong University, Qingdao, China","institution_ids":["https://openalex.org/I80143920"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100437976","display_name":"Kai Chen","orcid":"https://orcid.org/0000-0002-5624-2987"},"institutions":[{"id":"https://openalex.org/I4210126530","display_name":"Data Assurance and Communication Security","ror":"https://ror.org/02z2gfm30","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210126530","https://openalex.org/I4210156404"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Kai Chen","raw_affiliation_strings":["IIE, CAS, Beijing, China and School of Cyber Security, UCAS, Beijing, China"],"affiliations":[{"raw_affiliation_string":"IIE, CAS, Beijing, China and School of Cyber Security, UCAS, Beijing, China","institution_ids":["https://openalex.org/I4210126530"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5061643975","display_name":"Limin Sun","orcid":"https://orcid.org/0000-0003-2745-7521"},"institutions":[{"id":"https://openalex.org/I4210126530","display_name":"Data Assurance and Communication Security","ror":"https://ror.org/02z2gfm30","country_code":"CN","type":"facility","lineage":["https://openalex.org/I19820366","https://openalex.org/I4210126530","https://openalex.org/I4210156404"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Limin Sun","raw_affiliation_strings":["IIE, CAS, Beijing, China and School of Cyber Security, UCAS, Beijing, China"],"affiliations":[{"raw_affiliation_string":"IIE, CAS, Beijing, China and School of Cyber Security, UCAS, Beijing, China","institution_ids":["https://openalex.org/I4210126530"]}]}],"institutions":[],"countries_distinct_count":3,"institutions_distinct_count":8,"corresponding_author_ids":["https://openalex.org/A5046057883"],"corresponding_institution_ids":["https://openalex.org/I172675005"],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.18910761,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"1709","last_page":"1723"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.305400013923645,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.305400013923645,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11273","display_name":"Advanced Graph Neural Networks","score":0.15539999306201935,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10028","display_name":"Topic Modeling","score":0.1388999968767166,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/watermark","display_name":"Watermark","score":0.9092000126838684},{"id":"https://openalex.org/keywords/digital-watermarking","display_name":"Digital watermarking","score":0.8392999768257141},{"id":"https://openalex.org/keywords/shadow","display_name":"Shadow (psychology)","score":0.5651999711990356},{"id":"https://openalex.org/keywords/intellectual-property","display_name":"Intellectual property","score":0.513700008392334},{"id":"https://openalex.org/keywords/knowledge-base","display_name":"Knowledge base","score":0.4781000018119812},{"id":"https://openalex.org/keywords/copyright-infringement","display_name":"Copyright infringement","score":0.43309998512268066},{"id":"https://openalex.org/keywords/tuple","display_name":"Tuple","score":0.4300000071525574},{"id":"https://openalex.org/keywords/benchmark","display_name":"Benchmark (surveying)","score":0.36149999499320984}],"concepts":[{"id":"https://openalex.org/C164112704","wikidata":"https://www.wikidata.org/wiki/Q7974348","display_name":"Watermark","level":3,"score":0.9092000126838684},{"id":"https://openalex.org/C150817343","wikidata":"https://www.wikidata.org/wiki/Q875932","display_name":"Digital watermarking","level":3,"score":0.8392999768257141},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7275000214576721},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.6402999758720398},{"id":"https://openalex.org/C117797892","wikidata":"https://www.wikidata.org/wiki/Q286363","display_name":"Shadow (psychology)","level":2,"score":0.5651999711990356},{"id":"https://openalex.org/C34974158","wikidata":"https://www.wikidata.org/wiki/Q131257","display_name":"Intellectual property","level":2,"score":0.513700008392334},{"id":"https://openalex.org/C4554734","wikidata":"https://www.wikidata.org/wiki/Q593744","display_name":"Knowledge base","level":2,"score":0.4781000018119812},{"id":"https://openalex.org/C2779776346","wikidata":"https://www.wikidata.org/wiki/Q647578","display_name":"Copyright infringement","level":3,"score":0.43309998512268066},{"id":"https://openalex.org/C118930307","wikidata":"https://www.wikidata.org/wiki/Q600590","display_name":"Tuple","level":2,"score":0.4300000071525574},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3723999857902527},{"id":"https://openalex.org/C185798385","wikidata":"https://www.wikidata.org/wiki/Q1161707","display_name":"Benchmark (surveying)","level":2,"score":0.36149999499320984},{"id":"https://openalex.org/C5655090","wikidata":"https://www.wikidata.org/wiki/Q192588","display_name":"Relational database","level":2,"score":0.3549000024795532},{"id":"https://openalex.org/C75949130","wikidata":"https://www.wikidata.org/wiki/Q848010","display_name":"Database transaction","level":2,"score":0.3450999855995178},{"id":"https://openalex.org/C2780581891","wikidata":"https://www.wikidata.org/wiki/Q15738686","display_name":"Copy protection","level":4,"score":0.30090001225471497},{"id":"https://openalex.org/C71745522","wikidata":"https://www.wikidata.org/wiki/Q2476929","display_name":"Confidentiality","level":2,"score":0.2971999943256378},{"id":"https://openalex.org/C42058472","wikidata":"https://www.wikidata.org/wiki/Q810214","display_name":"Base (topology)","level":2,"score":0.2827000021934509},{"id":"https://openalex.org/C108827166","wikidata":"https://www.wikidata.org/wiki/Q175975","display_name":"Internet privacy","level":1,"score":0.27309998869895935},{"id":"https://openalex.org/C43521106","wikidata":"https://www.wikidata.org/wiki/Q2165493","display_name":"Pipeline (software)","level":2,"score":0.2721000015735626},{"id":"https://openalex.org/C189950617","wikidata":"https://www.wikidata.org/wiki/Q937228","display_name":"Property (philosophy)","level":2,"score":0.2671999931335449},{"id":"https://openalex.org/C161615301","wikidata":"https://www.wikidata.org/wiki/Q309396","display_name":"Keystroke logging","level":2,"score":0.2653999924659729},{"id":"https://openalex.org/C48145219","wikidata":"https://www.wikidata.org/wiki/Q1335365","display_name":"Security token","level":2,"score":0.2540999948978424},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.2540000081062317}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1145/3719027.3744813","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3719027.3744813","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security","raw_type":"proceedings-article"},{"id":"pmh:oai:dr.ntu.edu.sg:10356/204813","is_oa":false,"landing_page_url":"https://hdl.handle.net/10356/204813","pdf_url":null,"source":{"id":"https://openalex.org/S4306402609","display_name":"DR-NTU (Nanyang Technological University)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I172675005","host_organization_name":"Nanyang Technological University","host_organization_lineage":["https://openalex.org/I172675005"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":null,"raw_type":"Conference Paper"}],"best_oa_location":{"id":"doi:10.1145/3719027.3744813","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3719027.3744813","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security","raw_type":"proceedings-article"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G1020630730","display_name":null,"funder_award_id":"ZR2022QF012","funder_id":"https://openalex.org/F4320324174","funder_display_name":"Natural Science Foundation of Shandong Province"}],"funders":[{"id":"https://openalex.org/F4320324174","display_name":"Natural Science Foundation of Shandong Province","ror":null}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":23,"referenced_works":["https://openalex.org/W20646389","https://openalex.org/W1605292408","https://openalex.org/W1975586457","https://openalex.org/W1993332882","https://openalex.org/W2036999337","https://openalex.org/W2076652283","https://openalex.org/W2087796744","https://openalex.org/W2107658650","https://openalex.org/W2108498102","https://openalex.org/W2133531446","https://openalex.org/W2470818894","https://openalex.org/W2889787757","https://openalex.org/W2912924812","https://openalex.org/W3006625877","https://openalex.org/W4317898419","https://openalex.org/W4385571271","https://openalex.org/W4389519118","https://openalex.org/W4392745757","https://openalex.org/W4393318705","https://openalex.org/W4404782556","https://openalex.org/W4407938156","https://openalex.org/W4410705984","https://openalex.org/W4411552177"],"related_works":[],"abstract_inverted_index":{"In":[0],"recent":[1],"years,":[2],"tremendous":[3],"success":[4],"has":[5],"been":[6],"witnessed":[7],"in":[8,20,87,178,209],"Retrieval-Augmented":[9],"Generation":[10],"(RAG),":[11],"widely":[12],"used":[13],"to":[14,41,67,76,115,138],"enhance":[15],"Large":[16],"Language":[17],"Models":[18],"(LLMs)":[19],"domain-specific,":[21],"knowledge-intensive,":[22],"and":[23,33,60,135,147,160,193],"privacy-sensitive":[24,162],"tasks.":[25],"However,":[26],"attackers":[27],"may":[28],"steal":[29],"those":[30,103],"valuable":[31],"RAGs":[32,68,177],"deploy":[34],"or":[35],"commercialize":[36],"them,":[37],"making":[38],"it":[39],"essential":[40],"detect":[42,77,116],"Intellectual":[43],"Property":[44],"(IP)":[45],"infringement.":[46],"Most":[47],"existing":[48],"ownership":[49],"protection":[50],"solutions,":[51],"such":[52],"as":[53],"watermarks,":[54],"are":[55],"designed":[56],"for":[57,83],"relational":[58,70],"databases":[59],"texts.":[61],"They":[62],"cannot":[63],"be":[64],"directly":[65],"applied":[66],"because":[69],"database":[71],"watermarks":[72],"require":[73],"white-box":[74],"access":[75],"IP":[78,117,211],"infringement,":[79],"which":[80],"is":[81,184],"unrealistic":[82],"the":[84,92,151,175],"knowledge":[85,191,194],"base":[86],"RAGs.":[88,120],"Meanwhile,":[89],"post-processing":[90],"by":[91],"adversary's":[93],"deployed":[94,180],"LLMs":[95],"typically":[96],"destructs":[97],"text":[98],"watermark":[99,140,144,202],"information.":[100],"To":[101],"address":[102],"problems,":[104],"we":[105],"propose":[106],"a":[107,123,128],"novel":[108],"black-box":[109],"''knowledge":[110],"watermark''":[111],"approach,":[112],"named":[113],"RAG-WM,":[114],"infringement":[118,212],"of":[119,213],"RAG-WM":[121,156,172,183,198],"uses":[122],"multi-LLM":[124],"interaction":[125],"framework,":[126],"comprising":[127],"Watermark":[129,136],"Generator,":[130],"Shadow":[131],"LLM":[132],"&":[133],"RAG,":[134],"Discriminator,":[137],"create":[139],"texts":[141],"based":[142],"on":[143,164],"entity-relationship":[145],"tuples":[146],"inject":[148],"them":[149],"into":[150],"target":[152],"RAG.":[153],"We":[154],"evaluate":[155],"across":[157],"three":[158],"domain-specific":[159],"two":[161],"tasks":[163],"four":[165],"benchmark":[166],"LLMs.":[167,181],"Experimental":[168],"results":[169],"show":[170],"that":[171],"effectively":[173],"detects":[174],"stolen":[176],"various":[179],"Furthermore,":[182],"robust":[185],"against":[186],"paraphrasing,":[187],"unrelated":[188],"content":[189],"removal,":[190],"insertion,":[192],"expansion":[195],"attacks.":[196],"Lastly,":[197],"can":[199],"also":[200],"evade":[201],"detection":[203],"approaches,":[204],"highlighting":[205],"its":[206],"promising":[207],"application":[208],"detecting":[210],"RAG":[214],"systems.":[215]},"counts_by_year":[],"updated_date":"2026-04-09T08:11:56.329763","created_date":"2025-11-23T00:00:00"}