Research map / Vision-language and multimodal / Multimodal LLMs

Safeguarding Multimodal Knowledge Copyright in the RAG-as-a-Service Environment

ICLR 2026 · Vision-language and multimodal › Multimodal LLMs · approach: Interleaved image-text generation with MLLMs · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes AQUA, a watermarking framework that embeds acronym-based or spatial-relation semantic triggers into synthetic images to detect unauthorized use of image knowledge in text-to-text multimodal RAG services.

Problem

Copyright protection for image knowledge contributed to shared multimodal RAG-as-a-Service knowledge bases; existing RAG watermarks only handle text, and image watermarks are implicit perturbations not suited to explicit retrieval-based verification.

Approach

Embed uncommon acronym-to-full-name pairs (decoded via VLM OCR) or unusual spatial object configurations (answered via spatial reasoning) into synthetic images as watermarks, with probe queries (trigger + instruction) verified by substring matching and Welch's t-test across repeated queries.

Key results

• AQUA_acronym on MMQA with LLaVA-NeXT achieves CGSR 85.36% and Rank 1.03 versus 31.03% CGSR for the optimization baseline.
• Under WAVES image attacks with Qwen2.5-VL-Instruct (7B), AQUA_acronym keeps CGSR above 96% across rescale, rotate, Gaussian, compression and regeneration attacks.
• Watermark-included verification reaches significance within about 30 queries, while the Opt. baseline needs over 200 queries.

Surprising findings

• The optimization-based PGD baseline is weaker than the acronym method on most models, and on InternVL3 it reaches only 19.34% CGSR on MMQA, lower than the naive baseline's 27.11%.
• Adding up to 10,000 watermarked images to the 50,000-image MMQA set kept the watermark-image FPR below 0.1% on benign queries.

Limitations

• Relies on the generator's OCR or spatial reasoning ability; for models with limited OCR, the spatial variant is needed and is weaker on some models.
• Reference distributions and significance thresholds must be calibrated per dataset and RAG system in real deployments.
• Evaluation limited to text-to-text multimodal RAG with CLIP retriever and a small set of VLM generators.

Experimental setup

Datasets: MMQA WebQA

Benchmarks: MMQA WebQA

Metrics: Rank CGSR p-value (Welch's t-test) VSR TPR/FPR SimScore retrieval rate

Baselines: Naive common-image watermark Opt. PGD adversarial perturbation watermark

Builds on: Welch's t-test projected gradient descent CLIP

Closest papers by meaning

• WMarkGPT: Watermarked Image Understanding via Multimodal Large Language Models (ICML 2025 · similarity 0.86)
• Can Watermarking Large Language Models Prevent Copyrighted Text Generation and Hide Training Data? (AAAI 2025 · similarity 0.85)
• ArcMark: Distortion-Free Multi-Byte LLM Watermark via Optimal Transport (NeurIPS 2026 · similarity 0.85)
• Black-Box Detection of Language Model Watermarks (ICLR 2025 · similarity 0.85)
• ImageSentinel: Protecting Visual Datasets from Unauthorized Retrieval-Augmented Image Generation (NeurIPS 2025 · similarity 0.85)
• No Free Lunch in LLM Watermarking: Trade-offs in Watermarking Design Choices (NeurIPS 2024 · similarity 0.84)