SemKey: Multifunctional Constructs in ML & Security

• SemKey is a multifaceted term denoting concepts that link semantic processing with various key-based protocols across machine learning, EEG decoding, and cryptography.
• In machine learning, SimKey leverages semantic embeddings and locality-sensitive hashing to robustly watermark language models against paraphrasing and translation attacks.
• In cryptographic and IoT contexts, SemKey underpins secret key derivation, distributed group key management, and session rekeying to secure communications.

SemKey denotes a family of unrelated but thematically adjacent constructs that appear across recent machine learning, information theory, and cryptographic literature. In some works it refers to semantic conditioning or semantic guidance, as in LLM watermarking and EEG-to-text decoding; in others it is attached to secret-key generation, semi-quantum key distribution, semigroup-action group key management, or lightweight session-key rekeying. Accordingly, the term has no single standardized technical meaning. Its most prominent recent uses span semantic-aware watermark seeding for LLMs, signal-grounded decoding from EEG, semantic-security formulations for secret-key problems, mediated semi-quantum protocols, distributed group-key derivation over semigroup actions, and symmetric rekeying for IoT-edge communication (Kodama et al., 11 Oct 2025, Wang et al., 9 Feb 2026, Bunin et al., 2017, Tyagi et al., 2019, Krawec, 2014, Lopez-Ramos et al., 2015, Rakshit et al., 4 Nov 2025).

1. Terminological scope and domain-specific meanings

The principal ambiguity of SemKey is terminological rather than mathematical. In the LLM-watermarking literature, the closest term is SimKey, a semantic key module that binds watermark seeds to the meaning of prior context. In EEG decoding, SemKey is a two-stage framework with four decoupled semantic objectives. In cryptographic and communication-theoretic settings, the same label is associated with secret-key capacity, semi-quantum key establishment, semigroup-based group key management, and per-session symmetric rekeying (Kodama et al., 11 Oct 2025, Wang et al., 9 Feb 2026, Krawec, 2014, Lopez-Ramos et al., 2015, Rakshit et al., 4 Nov 2025).

Domain	Construct	Core mechanism
LLM watermarking	SimKey	SimHash over semantic embeddings for watermark key derivation
EEG-to-text decoding	SemKey	Decoupled semantic prompts with EEG-as-Key/Value cross-attention
Information theory	Secret-key / semantic-security results	Achievable regions and converse bounds
Quantum cryptography	Mediated semi-quantum key distribution	Two semi-quantum users with an untrusted quantum server
Group key management	GSAP protocols	Distributed key derivation via semigroup actions
IoT-edge security	DSEKP session-key rekeying	HKDF-SHA256 session keys with HMAC-authenticated init-ack

A recurring pattern is that “semantic” and “key” are interpreted differently in each area. In some cases “semantic” refers to embedding geometry or high-level attributes; in others it refers to semantic-security in the information-theoretic sense. Likewise, “key” may mean a watermark seed, a cryptographic session key, a group key, or a secret key extracted from a communication protocol.

2. Semantic keying in LLM watermarking

In "SimKey: A Semantically Aware Key Module for Watermarking LLMs" (Kodama et al., 11 Oct 2025), the key innovation is a drop-in key module that can be paired with existing watermarking mark modules such as ExpMin, SynthID, or WaterMax. Rather than seeding next-token sampling with a fixed key or a token-hash seed, SimKey computes a semantic embedding of the entire preceding context,

$\mathbf{v}=f(x_{1:t-1})\in\mathbb{R}^d,$

draws a small random index $idx\in\{1,\dots,k\}$, and derives a pseudo-random seed through SimHash and a cryptographic hash:

$$\mathrm{SimKey}(\mathbf v,\,idx,salt) = H\!\bigl(\bigl[\mathrm{sign}(\mathbf r_1^\top\mathbf v),\dots,\mathrm{sign}(\mathbf r_b^\top\mathbf v)\bigr],\,idx,\,salt\bigr).$$

At generation time, that key is passed into the mark module, which perturbs next-token sampling in its usual way. At detection time, the detector re-embeds the context before each token, recomputes all $k$ candidate keys, evaluates $\text{MarkCost}(key_j,x_t)$ for each $j$, takes the minimum cost, sums these minima over positions, and derives a global $p$-value from the null distribution of costs. For ExpMin, the null is a Gamma distribution in closed form.

The central robustness claim follows from the standard SimHash guarantee. If two embeddings $\mathbf v,\mathbf v'$ have angular separation $\theta$, then the probability of agreement on all $b$ bits is

$idx\in\{1,\dots,k\}$0

This is used to motivate robustness under paraphrase and round-trip translation, since meaning-preserving edits produce embeddings with small angular displacement. Empirically, for whole-text translation attacks on 80 watermarked examples and 120 controls at $idx\in\{1,\dots,k\}$1, true positive rate rose from 11.3% to 50.0% for ExpMin, from 62.5% to 68.8% for SynthID, and from 1.3% to 30.0% for WaterMax. Under 30 related replacements generated via BERT masked-fill, ExpMin improved from 6.3% to 32.5%, SynthID from 28.8% to 80.0%, and WaterMax from 1.3% to 37.5%.

A second design objective is to prevent false attribution. When unrelated tokens are inserted or replaced, the semantics shift and the embedding changes sufficiently that the key changes and watermark detection fails. The reported table for 15 and 30 unrelated random token replacements shows that SimKey’s $idx\in\{1,\dots,k\}$2 tracks the baseline rather than causing unrelated additions to inherit the watermark. The paper also states that generation perplexity and output quality remain essentially identical to standard hashing variants because SimKey changes only the key module, leaving the mark module and underlying LLM untouched.

A common misconception is that semantic keying yields fully semantic watermarking. The paper explicitly limits that claim: the mark module itself remains token-based, so replacing a watermarked token with a synonym may still destroy that token’s watermark signal. The authors therefore identify fully semantic mark modules as a future direction rather than a property already achieved.

3. SemKey for EEG-to-text decoding

In "Escaping the BLEU Trap: A Signal-Grounded Framework with Decoupled Semantic Guidance for EEG-to-Text Decoding" (Wang et al., 9 Feb 2026), SemKey is a two-stage architecture for decoding natural language from non-invasive EEG. Stage 1, termed “Parallel Multi-task Attribute Extraction,” trains a signal-grounded EEG encoder that aligns with a frozen LLM latent space while explicitly disentangling four semantic attributes: sentiment, topic, length, and surprisal. Stage 2, termed “Multi-Perspective Active Retrieval Decoding,” freezes the attribute predictors and uses their outputs to steer Flan-T5 through an active Query-Key-Value mechanism.

The encoder consumes raw EEG $idx\in\{1,\dots,k\}$3 and employs a Conformer-style hierarchy with Prior Label Injection. It produces sequence embeddings $idx\in\{1,\dots,k\}$4, which preserve word-level temporal detail, and a global embedding $idx\in\{1,\dots,k\}$5, obtained via attention pooling. Stage 1 combines reconstruction loss $idx\in\{1,\dots,k\}$6, an alignment loss $idx\in\{1,\dots,k\}$7, two classification losses for sentiment and topic, and two regression losses for length and surprisal:

$idx\in\{1,\dots,k\}$8

Stage 2 does not merely concatenate EEG features to text. Instead, it builds a natural-language prompt from the four predicted attributes and injects $idx\in\{1,\dots,k\}$9 as Keys and Values in the frozen LLM’s cross-attention layers, while the prompt hidden states serve as Queries:

$$\mathrm{SimKey}(\mathbf v,\,idx,salt) = H\!\bigl(\bigl[\mathrm{sign}(\mathbf r_1^\top\mathbf v),\dots,\mathrm{sign}(\mathbf r_b^\top\mathbf v)\bigr],\,idx,\,salt\bigr).$$0

Cross-attention is then

$$\mathrm{SimKey}(\mathbf v,\,idx,salt) = H\!\bigl(\bigl[\mathrm{sign}(\mathbf r_1^\top\mathbf v),\dots,\mathrm{sign}(\mathbf r_b^\top\mathbf v)\bigr],\,idx,\,salt\bigr).$$1

The paper characterizes this as an “active retrieval” paradigm that forces each generated token to depend on the EEG signal.

Training is explicitly staged. Stage 1 trains only the EEG encoder and four MLP heads for 50 epochs with batch size 72, peak learning rate $$\mathrm{SimKey}(\mathbf v,\,idx,salt) = H\!\bigl(\bigl[\mathrm{sign}(\mathbf r_1^\top\mathbf v),\dots,\mathrm{sign}(\mathbf r_b^\top\mathbf v)\bigr],\,idx,\,salt\bigr).$$2, 15-epoch warmup, and cosine annealing. Stage 2 freezes the LLM and trains the projector with LoRA adapters of approximately 37 M parameters for 25 epochs, with layer-wise learning rates of $$\mathrm{SimKey}(\mathbf v,\,idx,salt) = H\!\bigl(\bigl[\mathrm{sign}(\mathbf r_1^\top\mathbf v),\dots,\mathrm{sign}(\mathbf r_b^\top\mathbf v)\bigr],\,idx,\,salt\bigr).$$3 for the encoder, $$\mathrm{SimKey}(\mathbf v,\,idx,salt) = H\!\bigl(\bigl[\mathrm{sign}(\mathbf r_1^\top\mathbf v),\dots,\mathrm{sign}(\mathbf r_b^\top\mathbf v)\bigr],\,idx,\,salt\bigr).$$4 for the projector, and $$\mathrm{SimKey}(\mathbf v,\,idx,salt) = H\!\bigl(\bigl[\mathrm{sign}(\mathbf r_1^\top\mathbf v),\dots,\mathrm{sign}(\mathbf r_b^\top\mathbf v)\bigr],\,idx,\,salt\bigr).$$5 for LoRA. Additional measures include spectral whitening of EEG, dropout 0.3 in the MLP heads, and Multiple Text Variants augmentation.

The evaluation protocol is notable because it is designed to move beyond BLEU. The paper adopts N-way Retrieval Accuracy and Fréchet Distance, and also reports Content Recall and diversity metrics including Dist-1/2, Self-BLEU, and Prefix Entropy. On ZuCo 1.0 and ZuCo 2.0, SemKey outperformed EEG-to-Text* and GLIM on the reported test metrics: 2-Way Accuracy 86.1% versus 83.3%, 24-Way Accuracy 19.5% versus 14.3%, Dist-2 22.6% versus 8.1%, Self-BLEU 52.0% versus 90.8%, and FD 0.26 versus 0.57. In a Gaussian-noise robustness test, SemKey collapsed to gibberish under noise with Content Recall approaching 0.04%, Dist-2 approaching 99.6%, and FD 1.27, whereas the baselines continued to hallucinate fluent text. The authors interpret this as evidence that the baselines over-relied on language priors.

A second misconception addressed by the paper is that robust scores can be obtained by lexical fluency alone. The “BLEU Trap” is defined precisely as the inflation of evaluation by stopwords and generic templates, and SemKey is presented as a signal-grounded alternative rather than a purely language-model-driven decoder.

4. Secret-key capacity and semantic-security formulations

A distinct research line connects SemKey-related nomenclature to information-theoretic secret-key problems. In "Key and Message Semantic-Security over State-Dependent Channels" (Bunin et al., 2017), the setting is a state-dependent wiretap channel with non-causal CSI at the encoder. A code consists of a stochastic encoder that maps a message and the full state sequence to a secret key and channel input sequence, together with a decoder that reconstructs both message and key. Performance is measured by maximal error, key uniformity, and semantic-security leakage $$\mathrm{SimKey}(\mathbf v,\,idx,salt) = H\!\bigl(\bigl[\mathrm{sign}(\mathbf r_1^\top\mathbf v),\dots,\mathrm{sign}(\mathbf r_b^\top\mathbf v)\bigr],\,idx,\,salt\bigr).$$6.

The paper derives an inner bound on the achievable semantic-security SM-SK region. For any conditional law $$\mathrm{SimKey}(\mathbf v,\,idx,salt) = H\!\bigl(\bigl[\mathrm{sign}(\mathbf r_1^\top\mathbf v),\dots,\mathrm{sign}(\mathbf r_b^\top\mathbf v)\bigr],\,idx,\,salt\bigr).$$7 and induced joint distribution with Markov chain $$\mathrm{SimKey}(\mathbf v,\,idx,salt) = H\!\bigl(\bigl[\mathrm{sign}(\mathbf r_1^\top\mathbf v),\dots,\mathrm{sign}(\mathbf r_b^\top\mathbf v)\bigr],\,idx,\,salt\bigr).$$8–$$\mathrm{SimKey}(\mathbf v,\,idx,salt) = H\!\bigl(\bigl[\mathrm{sign}(\mathbf r_1^\top\mathbf v),\dots,\mathrm{sign}(\mathbf r_b^\top\mathbf v)\bigr],\,idx,\,salt\bigr).$$9–$k$0, all rate pairs satisfying

$k$1

$k$2

$k$3

are achievable. The coding argument uses superposition codebooks, a likelihood encoder, joint-typicality decoding, and two soft-covering lemmas: strong superposition soft-covering and heterogeneous soft-covering. For a less-noisy-eavesdropper class with an additional external key $k$4, the paper states that the inner bound is capacity-achieving and simplifies the region to

$k$5

The work is explicitly positioned as improving prior SM-SK trade-off bounds and as being strictly larger than previously reported regions in some cases.

A related capacity-oriented result appears in "Secret Key Capacity For Multipleaccess Channel With Public Feedback" (Tyagi et al., 2019). There, three terminals communicate over a secure multipleaccess channel while interacting over a noiseless public channel visible to an eavesdropper. Under “source-emulation” protocols, the secret-key capacity is upper-bounded by the maximum symmetric rate $k$6 in the ordinary MAC capacity region. Under “no-input-communication” protocols, it is upper-bounded by the maximum symmetric rate $k$7 in the MAC-with-feedback capacity region. For symmetric MACs, the paper presents an explicit scheme that achieves $k$8, yielding

$k$9

For the adder MAC, the application gives the closed-form capacity

$\text{MarkCost}(key_j,x_t)$0

These two papers use “semantic-security” and “secret key” in their classical information-theoretic senses. This is conceptually different from semantic embeddings or semantic prompts, even though the terminology can appear similar.

5. Protocol-oriented SemKey variants in quantum, algebraic, and IoT settings

In "Mediated Semi-Quantum Key Distribution" (Krawec, 2014), SemKey designates a protocol in which two semi-quantum users, limited to computational-basis preparation and measurement or reflection, establish a shared secret key with the aid of a fully quantum but untrusted server. The server may prepare arbitrary two-qubit states, perform any joint quantum operation on the returned qubits, and broadcast one classical bit $\text{MarkCost}(key_j,x_t)$1. If both users reflect, they expect $\text{MarkCost}(key_j,x_t)$2 and use deviations to estimate a test statistic $\text{MarkCost}(key_j,x_t)$3. If both measure and resend and the server announces $\text{MarkCost}(key_j,x_t)$4, they keep the resulting bits as raw key. Security is analyzed by reducing to collective attacks, representing the adversary’s action as a unitary-plus-measurement instrument, and applying the Devetak-Winter bound

$\text{MarkCost}(key_j,x_t)$5

The paper gives an explicit observable lower bound,

$\text{MarkCost}(key_j,x_t)$6

and reports several threshold regimes: in a semi-honest depolarizing setting, $\text{MarkCost}(key_j,x_t)$7 for $\text{MarkCost}(key_j,x_t)$8; under the worst-case bound with $\text{MarkCost}(key_j,x_t)$9 and $j$0, $j$1 for $j$2; with an improved estimate, the threshold becomes $j$3 for $j$4.

In "Group key management based on semigroup actions" (Lopez-Ramos et al., 2015), SemKey refers to a suite of distributed multiparty key-agreement protocols over a finite abelian semigroup $j$5 acting on a set $j$6. The security assumption is the hardness of the Semigroup Action Problem and, in particular, the Diffie-Hellman Semigroup Action Problem. Public parameters are the semigroup, the set $j$7, a transitive action $j$8, and a public base element $j$9. Each user chooses a private $p$0, and the shared key is

$p$1

The paper presents three main protocols. GSAP-1 is a sequential chain with $p$2 rounds and $p$3 messages and total cost $p$4. GSAP-2 is a broadcast variant with $p$5 rounds, $p$6 total messages, and total cost $p$7. GSAP-3 assumes $p$8 is a group and completes in 4 rounds with $p$9 messages and total cost $\mathbf v,\mathbf v'$0. Concrete instantiations are given over prime-field multiplicative groups, elliptic-curve groups, matrix semigroups, and semiring/semimodule settings.

In "Lightweight Session-Key Rekeying Framework for Secure IoT-Edge Communication" (Rakshit et al., 4 Nov 2025), the DSEKP session-key protocol is presented as a fully symmetric extension to PSK for constrained IoT-edge links. A device generates a 12-byte random nonce DevNonce, increments a 2-byte session counter SessCtr, reads a 4-byte UNIX timestamp $\mathbf v,\mathbf v'$1, and forms

$\mathbf v,\mathbf v'$2

The session secret is then

$\mathbf v,\mathbf v'$3

with the 128-bit AES-GCM session key taken as the first 16 bytes. The client authenticates the init message using

$\mathbf v,\mathbf v'$4

and the edge server verifies this proof in a single init-ack exchange. Data messages are then encrypted under AES-GCM with fresh 12-byte IVs and 16-byte tags, optionally binding JSON metadata as associated data.

The experimental system used an ESP32 sensor node, a Raspberry Pi 5 edge server, and a Mosquitto MQTT broker, with benchmarks over more than 6,500 encrypted packets per configuration. Relative to a static PSK baseline, DSEKP reported mean latency 360.0 ± 129.8 ms versus 283.0 ± 182.9 ms, mean payload 170.8 bytes versus 154.8 bytes, throughput 1,366.8 bps versus 1,243.5 bps, and reliability 99.8% versus 99.6%. The abstract summarizes the trade-off as nearly identical throughput and reliability, with mean latency increased by 27% and payload size by 10%, while providing per-session forward secrecy and replay protection through fresh DevNonce, SessCtr, timestamping, and per-message sequence checking.

6. Conceptual distinctions, limitations, and recurring themes

The most important interpretive point is that SemKey is not a unified framework. In LLM watermarking, the “key” is a seed for a mark module and the “semantic” component is an embedding-driven locality-sensitive hash. In EEG decoding, “semantic” refers to four decoupled attributes and prompt-guided conditioning, while the “key” in the Query-Key-Value mechanism is the standard attention object rather than a cryptographic secret. In information theory, “semantic-security” is a leakage criterion, not an embedding-space notion. In semi-quantum, semigroup, and IoT settings, the central object is a cryptographic key in the ordinary sense (Kodama et al., 11 Oct 2025, Wang et al., 9 Feb 2026, Bunin et al., 2017, Krawec, 2014, Lopez-Ramos et al., 2015, Rakshit et al., 4 Nov 2025).

Several limitations are domain-specific. SimKey improves key robustness under paraphrasing and translation, but its mark module remains token-based, so meaning-preserving token substitutions can still break local watermark evidence (Kodama et al., 11 Oct 2025). The EEG-to-text SemKey framework addresses hallucination and template collapse partly by freezing the LLM and forcing cross-attention to EEG Keys and Values, but its empirical claims are tied to ZuCo 1.0 and ZuCo 2.0 and to the specific robust metrics adopted in that work (Wang et al., 9 Feb 2026). The semi-quantum protocol assumes authenticated classical communication and derives asymptotic thresholds under specific observable statistics (Krawec, 2014). The semigroup protocols depend on the hardness of SAP and DHSAP in the chosen algebraic setting (Lopez-Ramos et al., 2015). DSEKP is explicitly a symmetric extension to PSK rather than a public-key protocol, and its forward secrecy is described as per-session, tied to fresh session material on each boot or rotation (Rakshit et al., 4 Nov 2025).

A plausible implication is that the shared label persists because each line of work uses “SemKey” or closely related terminology to connect semantic structure, key selection, or secure key establishment. That superficial overlap, however, should not obscure the fact that the underlying objects, threat models, and evaluation criteria are fundamentally different.