Research map / Graph learning / Knowledge and temporal graphs
KGMark: A Diffusion Watermark for Knowledge Graphs
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes KGMark, a diffusion-based watermarking scheme for knowledge graph embeddings that uses community-based graph alignment, redundant embedding, and a learnable mask matrix, with likelihood-based detection.
Problem
Watermarking knowledge graphs is hard because dynamic, structured KG data varies spatially (node relabeling, isomorphism) and temporally (edits, deletions), and existing watermarks target static text or images.
Approach
Embeds a watermark signature in the Fourier domain of DDIM-inverted latents of a VAE-encoded KG embedding, using a learnable adaptive mask matrix for transparency, degree/clustering-based graph alignment against isomorphism, redundant community-level embedding, and a noncentral chi-squared likelihood test for detection.
Key results
- Detection AUC up to 0.99 on clean KG embeddings (KGMark 0.9991 on AliF).
- Average AUC across attacks of 0.9697 (AliF), 0.9762 (MIND), 0.9707 (Last-FM), outperforming DwtDct, DctQim, TreeRing and GaussianShading baselines.
- Cosine similarity of 0.9482 on AliF at 75 DDIM steps; downstream Hits@10 0.8296 vs 0.8318 without watermark.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| apply KGMark instead of DwtDct | KG watermarking · AliF, all attack settings | AUC (Avg): 0.8776 -> 0.9697 | Helped |
| apply KGMark instead of TreeRing | KG watermarking · MIND, all attack settings | AUC (Avg): 0.8685 -> 0.9762 | Helped |
| apply KGMark instead of GaussianShading | KG watermarking · Last-FM, all attack settings | AUC (Avg): 0.8922 -> 0.9707 | Helped |
| replace fixed-density mask with learnable adaptive watermark mask (ablation) | KGMark · AliF, all attack settings | AUC (Avg): 0.9625 -> 0.9697 | Helped |
| replace fixed-density mask with learnable adaptive watermark mask (ablation) | KGMark · MIND, all attack settings | AUC (Avg): 0.9727 -> 0.9762 | Helped |
| replace fixed-density mask with learnable adaptive watermark mask (ablation) | KGMark · Last-FM, all attack settings | AUC (Avg): 0.9711 -> 0.9707 | Hurt |
| combine Community Layer and Vertex Layer instead of using Community Layer only (ablation) | KGMark · AliF, all attack settings | AUC (Avg): 0.9218 -> 0.9697 | Helped |
| combine Community Layer and Vertex Layer instead of using Community Layer only (ablation) | KGMark · MIND, all attack settings | AUC (Avg): 0.9497 -> 0.9762 | Helped |
| combine Community Layer and Vertex Layer instead of using Community Layer only (ablation) | KGMark · Last-FM, all attack settings | AUC (Avg): 0.9427 -> 0.9707 | Helped |
| combine Community Layer and Vertex Layer instead of using Vertex Layer only (ablation) | KGMark · AliF, all attack settings | AUC (Avg): 0.9459 -> 0.9697 | Helped |
| combine Community Layer and Vertex Layer instead of using Vertex Layer only (ablation) | KGMark · MIND, all attack settings | AUC (Avg): 0.9554 -> 0.9762 | Helped |
| combine Community Layer and Vertex Layer instead of using Vertex Layer only (ablation) | KGMark · Last-FM, all attack settings | AUC (Avg): 0.9383 -> 0.9707 | Helped |
Surprising findings
- The variant without the learnable mask (W/O LAWMM) showed comparable or slightly higher detectability in some settings, which the authors attribute to stronger signal strength.
Limitations
- Sensitive to triple deletion and high-intensity smoothing attacks (AUC drops to 0.93 at 50% deletion on AliF).
- Compatibility with advanced samplers beyond DDIM remains open.
- Relational GNN encoders are more vulnerable to adversarial edits than non-relational ones.
Experimental setup
Datasets: Alibaba-iFashion MIND Last-FM
Benchmarks: Alibaba-iFashion MIND Last-FM
Metrics: AUC cosine similarity GMR HMR AMR Hits@10
Baselines: DwtDct DctQim TreeRing GaussianShading W/O LAWMM Only CL Only VL
Builds on: DDIM Tree-Ring watermark Gaussian Shading RotatE RGAT
Closest papers by meaning
- Black-Box Forgery Attacks on Semantic Watermarks for Diffusion Models (CVPR 2025 · similarity 0.85)
- SleeperMark: Towards Robust Watermark against Fine-Tuning Text-to-image Diffusion Models (CVPR 2025 · similarity 0.84)
- TimeWak: Temporal Chained-Hashing Watermark for Time Series Data (NeurIPS 2025 · similarity 0.84)
- StableGuard: Towards Unified Copyright Protection and Tamper Localization in Latent Diffusion Models (NeurIPS 2025 · similarity 0.83)
- Harnessing Frequency Spectrum Insights for Image Copyright Protection Against Diffusion Models (CVPR 2025 · similarity 0.83)
- AquaLoRA: Toward White-box Protection for Customized Stable Diffusion Models via Watermark LoRA (ICML 2024 · similarity 0.83)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.