RaMark: Radioactive Watermarking for Generated Tabular Data Xin Che
Lingyang Chu
Qiqi Zhang
McMaster University Hamilton, Canada [email protected]
McMaster University Hamilton, Canada [email protected]
McMaster University Hamilton, Canada [email protected]
Xinyu Ma
Xuan Luo
Jian Pei
McMaster University Hamilton, Canada [email protected]
York University Toronto, Canada [email protected]
Duke University Durham, United States [email protected]
Recent advances in generative modeling have made generated tabular data a practical solution for privacy-sensitive data sharing, where watermarking enables ownership verification. However, existing watermarking methods fundamentally fail under retraining attacks, in which an adversary retrains a generative model on a watermarked dataset and regenerates high-utility data that no longer carries the watermark. We address this challenge by introducing radioactivity, the property that a watermark remains detectable after generative model retraining, and propose RaMark, a radioactive watermarking method that embeds a sinusoidal dependency as an intrinsic component of the data distribution. By coupling the watermark with the underlying distribution, RaMark ensures that any generative model preserving data utility also has to preserve the watermark. We theoretically show that with high probability removing watermark degrades utility and alters data distribution. Extensive experiments on two real-world tabular datasets, under a large-scale ownership verification setting with 105 independent data owners, demonstrate that RaMark achieves substantially stronger radioactivity than seven state-of-the-art methods and consistently outperforms them against both retraining and data modification attacks.
Train Original dataset
means owned by data owner means owned by adversary means radioactive watermark
• Do Not Use This Code → Generate the Correct Terms for Your Paper; Generate the Correct Terms for Your Paper; Generate the Correct Terms for Your Paper; Generate the Correct Terms for Your Paper.
Keywords Radioactive watermark, retraining attack, generated tabular data ACM Reference Format: Xin Che, Lingyang Chu, Qiqi Zhang, Xinyu Ma, Xuan Luo, and Jian Pei. 2018. RaMark: Radioactive Watermarking for Generated Tabular Data. In Proceedings of Make sure to enter the correct conference title from your rights Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than the author(s) must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]. Conference acronym ’XX, Woodstock, NY © 2018 Copyright held by the owner/author(s). Publication rights licensed to ACM. ACM ISBN 978-1-4503-XXXX-X/2018/06 https://doi.org/XXXXXXX.XXXXXXX
Sample & Share Generated dataset
Radioactive watermark
Retrain
Generative model 2
(Trained by adversary) Sample
Regenerated dataset
Retraining attack
Figure 1: Illustration of retraining attack and radioactive watermark. The data owner trains a generative model on the original dataset and samples a watermarked dataset that carries a radioactive watermark. An adversary performs a retraining attack by training a new generative model on the watermarked dataset and sampling a regenerated dataset. Because the watermark is radioactive, it remains detectable in the regenerated dataset despite retraining.
confirmation email (Conference acronym ’XX). ACM, New York, NY, USA, 20 pages. https://doi.org/XXXXXXX.XXXXXXX
1 CCS Concepts
Generative model 1
(Trained by data owner)
Embed
arXiv:2607.09000v1 [cs.CR] 10 Jul 2026
Abstract
Introduction
Recent advances [5, 14, 37, 47, 72, 73, 78] in generative modeling enable organizations to generate and share high-quality tabular datasets instead of releasing original data. In many domains involving sensitive information, such as healthcare [8, 10, 54], finance [50, 52, 59], and governance [4, 65], directly sharing original data is restricted by privacy regulations, compliance requirements, or contractual obligations [10, 44, 59, 67, 74]. To enable data sharing and trading in these scenarios, organizations increasingly rely on generative models to produce high-quality generated tabular data that approximate the original data distribution while preserving privacy [19, 40, 55, 70]. These generated datasets are widely used for downstream machine learning tasks [40, 67, 74] and are often redistributed across multiple parties, making them valuable digital assets that require protection of ownership and effective traceability to identify the exact source of unauthorized redistribution. As generated datasets are increasingly reused, redistributed, and licensed to multiple parties, dataset owners often have a strong need to establish ownership and enable traceability when misuse occurs. Data watermarking [28, 75, 80, 84] provides a principled mechanism to protect ownership by embedding a detectable secret signal into the dataset, which enables ownership verification, misuse detection, and traceability after data sharing or redistribution.
Conference acronym ’XX, June 03–05, 2018, Woodstock, NY
However, the same advances in generative modeling [29, 34, 64] that enable high-quality data sharing also equip adversaries with a powerful watermark-removing attack, namely the retraining attack. As shown in Figure 1, an adversary retrains a generative model (Generative model 2) on a watermarked dataset and then samples a regenerated dataset from the retrained model. Because the retrained model learns distributional structure rather than memorizing individual data samples [7, 18, 36], watermark signals embedded via record-level modifications, record identification, or generationtime heuristics are often not reproduced in regenerated data. At the same time, the regenerated dataset can still closely approximate the original data distribution, enabling the adversary to remove the watermark without substantially degrading data utility. This makes retraining attacks a realistic and critical threat to the watermark’s security. Retraining attacks pose a serious threat to existing watermarking methods. Most prior approaches embed watermark signals through per-sample modifications, record-level identification, or generationtime procedures that are not captured as learnable dependencies in the data distribution. When a generative model is retrained on a watermarked dataset, such signals are therefore not reproduced in the regenerated dataset, while the regenerated dataset still retains high utility. This ability to remove watermarks without sacrificing much data utility exposes a fundamental weakness of existing watermarking methods for generated tabular data. To address this weakness, we design watermark signals that persist through generative model retraining and remain detectable in regenerated data. Radioactive watermarks have been well established in image and model watermarking to describe signals that remain detectable after training, fine-tuning, or model reuse [21, 41, 57, 58]. In this paper, we extend radioactivity to the tabular data setting, where the challenge is to make the watermark survive distribution-learning and resampling. Guided by this notion, we propose a novel watermarking method named Radioactive Watermark (RaMark), which achieves strong radioactivity against retraining attacks while maintaining high robustness against many data modification attacks that attempt to remove the watermark by directly modifying the data samples in the released dataset. We summarize our main contributions as follows. First, we introduce watermark radioactivity for tabular datasets as a security property and propose RaMark as a novel watermarking method that achieves strong radioactivity against retraining attacks. The key idea of RaMark is to embed a sinusoidal dependency among continuous-valued data attributes as an intrinsic component of the data distribution, so that a generative model that accurately captures the distribution also learns and reproduces the watermark in regenerated data. Second, we theoretically analyze the radioactivity and robustness of RaMark under retraining attacks and data modification attacks. Our analysis shows that an adversary who aims to preserve data utility needs to preserve the data distribution, which in turn preserves the embedded sinusoidal dependency and keeps the watermark detectable. Conversely, weakening the watermark requires changing the data distribution, which is often achieved at the cost of reduced data utility. This tradeoff makes it challenging for an adversary to remove the watermark without sacrificing data utility, leading to strong radioactivity and robustness.
Anonymous
Last, we conduct extensive experiments on two real-world tabular datasets to compare RaMark with seven state-of-the-art methods in terms of radioactivity and robustness under retraining and data modification attacks. To evaluate these methods in large-scale ownership verification scenarios, we simulate a watermark service provider serving 105 independent data owners, where each owner embeds a unique watermark, and successful ownership verification must both detect the presence of a watermark and correctly identify its owner among all data owners. The results show that RaMark achieves significantly stronger radioactivity than all baselines and consistently outperforms them under data modification attacks. Why this is a data security problem? Generated tabular data is increasingly used as a shareable and tradable asset in machine learning pipelines, especially in privacy-sensitive applications [36]. Ensuring the security of such data requires protecting ownership and enabling reliable traceability under adversarial settings. Retraining attacks allow an adversary to regenerate high-utility data while removing watermark signals, which breaks existing ownership protection mechanisms. Therefore, watermarking for generated tabular data is fundamentally a data security problem, where the goal is to ensure robustness of watermark signals against adversarial attempts under realistic reuse and regeneration workflows. Paper organization. Section 2 reviews related watermarking methods and explains why they fail under retraining attacks. Section 3 presents RaMark, including the watermark detection and embedding procedures. Section 4 analyzes the robustness and radioactivity of RaMark under retraining and data modification attacks. Section 5 reports the experimental evaluation and parameter analysis. Finally, Section 6 concludes the paper and discusses future directions.
2
Related Work
Existing research on generated tabular data watermarking can be broadly divided into two categories: (1) generative methods [12, 85], which modify the data generation process to embed watermarks, and (2) database watermarking methods [30, 31, 33, 43, 45, 60, 62, 71], which embed watermarks into data after generation. A common limitation of most existing methods is that their watermark signals are not embedded as stable, learnable dependencies of the data distribution. Since retraining attacks operate by learning and reproducing the distribution rather than memorizing individual records, watermark signals that remain external to the distribution are typically not reproduced in regenerated data. In the following, we review representative generative and database watermarking methods and analyze why they do not achieve radioactivity, i.e., why their watermark signals are not preserved under retraining attacks. Additional discussion on prior studies of radioactivity is deferred to Appendix A.2. Generative watermarking methods embed watermarks during the data generation process. TabWak [85] perturbs the latent variables of a diffusion model to generate watermarked samples. However, due to the highly nonlinear mapping between latent and data spaces, identical latent perturbations can manifest as inconsistent, samplespecific distortions in data space. These distortions do not induce coherent statistical dependencies in the overall data distribution.
RaMark: Radioactive Watermarking for Generated Tabular Data
As a result, when a generative model is retrained on the watermarked dataset, the watermark signal is not reliably reproduced, and TabWak does not achieve radioactivity. MUSE [16] embeds watermarks by using a scoring function to select specific generated samples. This mechanism introduces perrecord selection bias, but it does not establish global structural dependencies among attributes. Consequently, the watermark signal is tied to a generation-time selection rule rather than to the underlying data distribution. A retrained generative model that learns the distribution of the dataset does not inherit this selection rule, and the watermark is therefore not preserved. Overall, existing generative methods rely on model-specific perturbations or procedural selection rules that are not encoded as intrinsic distributional structure. Such signals are fragile under retraining attacks. Database watermarking methods embed watermarks after data generation. A representative class [30, 31, 33, 43, 45, 60, 62, 71] modifies selected data samples identified through a primary key [1, 2, 26, 27, 43, 66, 71] or a virtual primary key [22, 23, 62, 84]. Watermark detection depends on re-identifying the same records through these keys. Under retraining attacks, however, new samples are generated from the learned distribution rather than reproducing original records. The correspondence required for key-based reidentification is therefore lost, making such methods inherently non-radioactive. Another line of work avoids explicit keys and embeds watermarks by modifying statistical properties of the dataset [11, 28, 49, 83]. PKF [11] introduces artificial correlations among attributes. However, these correlations are externally imposed perturbations rather than stable dependencies of the original distribution, and they are not reliably captured by retrained generative models. WGTD [28], NgoMark [49], and B2Mark [83] adjust the frequencies of selected attribute values using the “green red list” mechanism [25, 35, 79]. These methods rely on sample-level frequency bias and do not establish coherent inter-attribute structure. When a generative model is retrained, such localized perturbations are typically smoothed out, and the watermark signal is not preserved. Overall, whether based on key-dependent record modification or key-free statistical perturbation, existing database watermarking methods embed signals that remain external to the data-generating structure. They are therefore vulnerable to retraining attacks.
3
The RaMark Method
In this section, we present RaMark, a radioactive watermarking method for continuous-valued tabular data. RaMark is built on a central principle: instead of perturbing individual data samples, it embeds a sinusoidal dependency among attributes as an intrinsic component of the data distribution. This sinusoidal dependency serves as the watermark signal carried by the dataset. Consequently, any generative model retrained on the watermarked dataset necessarily reproduces this sinusoidal dependency when approximating the data distribution. This design leads to the key intuition behind RaMark: preserving the watermarked data distribution also preserves the dependency that carries the watermark. Section 4.3 formalizes this
Conference acronym ’XX, June 03–05, 2018, Woodstock, NY
Spectral analysis
Tabular dataset Mapping with watermark 𝜑
Tabular dataset w/o watermark
Discrete-time signal in 2D projected space
Spectrum in frequency domain
Figure 2: Watermarked and unwatermarked signals in the two-dimensional projected space and their spectra.
intuition by analyzing how distributional closeness affects the spectral evidence used for detection. In particular, our analysis shows that a more accurate approximation of the data distribution leads to stronger persistence of the watermark signal in regenerated data, which underlies the radioactivity of RaMark. RaMark has two modules: watermark detection and watermark embedding. The detection module first maps a dataset into a secret two-dimensional projected space and converts the projected points into a discrete-time signal. It then checks whether the signal contains a strong sinusoidal component at the designated frequency. The embedding module embeds this sinusoidal structure through watermark-guided diffusion sampling. We present the detection module first, because it defines the structure of the watermark signal, and then describe how the embedding module embeds this structure during data generation.
3.1
Watermark Detection
The watermark signal embedded by RaMark manifests as sinusoidal dependency of a designated frequency in a secret two-dimensional projected space. Watermark detection therefore reduces to verify whether the projected data exhibits high spectral power at the designated frequency. As shown in Figure 2, to detect the watermark, we transform the tabular dataset into a discrete-time signal in the projected space and analyze its spectral power. If the spectral power at the designated frequency shows a significantly elevated peak, this indicates the presence of the watermark. The detection procedure consists of two steps: (i) mapping the tabular dataset to a discrete-time signal in the two-dimensional projected space, and (ii) measuring the spectral power of the signal at the designated frequency. 3.1.1 Mapping a tabular dataset to a discrete-time signal. To detect a sinusoidal dependency embedded in the data distribution, we first map the dataset into a two-dimensional projected space. Within this projected space, one coordinate induces an ordered indexing structure, while the other coordinate captures the corresponding projected values. By organizing samples according to this indexing structure, the sinusoidal dependency that constitutes the watermark signal manifests as a discrete-time signal, which is later processed by spectral analysis for watermark detection. Let 𝑄 ∈ R𝑛×𝑑 denote a table (i.e., tabular dataset) with 𝑛 rows and 𝑑 columns, where 𝑄𝑖,: is the 𝑖-th data sample. Each sample is mapped to a point (𝑢𝑖 , 𝑣𝑖 ) in the two-dimensional projected space by projection onto two orthogonal unit vectors e𝑢 , e𝑣 ∈ R𝑑 .
Conference acronym ’XX, June 03–05, 2018, Woodstock, NY
Anonymous
𝑐"
𝑐#
𝑢-𝑎𝑥𝑖𝑠
Figure 3: An example of points and mean points. The vertical lines represent the bins 𝐵𝑐 for the values of 𝑐 ∈ {𝑐 1, 𝑐 2, 𝑐 3 }. Algorithm 1 Watermark detection Input: A suspicious dataset 𝑄 and a secret key K = {e𝑢 , e𝑣 , 𝛽, 𝑠, 𝜔 }. Output: Detection score DS(𝜔). 1: Obtain the discrete-time signal 𝑆 = 𝜑 (𝑄). 2: Compute the spectral power 𝐿(𝜔) of 𝑆. 3: Compute FAP(𝜔) based on 𝐿(𝜔). 4: Return the detection score DS(𝜔) = 1 − FAP(𝜔).
Specifically, 𝑣𝑖 = 𝜙 𝑣 (𝑄𝑖,: ) = 𝑄𝑖,: e⊤ 𝑣,
(1)
and j
𝑄𝑖,: e𝑢⊤ 𝛽
k
𝑢𝑖 = 𝜙𝑢 (𝑄𝑖,: ) =
,
(2)
𝑠 ∈ R+ is the bin width that determines the granularity
where 𝛽 of the binning operation along the 𝑢-axis, 𝑠 ∈ R+ is a scaling factor that rescales the spacing of the resulting discrete-time signal along the 𝑢-axis, and ⌊·⌋ denotes the flooring operator to perform binning. Mapping all the data samples in 𝑄 yields a set of points 𝑍 = {(𝑢𝑖 , 𝑣𝑖 ) | 𝑖 = 1, . . . , 𝑛}. Points with the same 𝑢-coordinate are grouped into bins 𝐵𝑐 = {(𝑢𝑖 , 𝑣𝑖 ) | 𝑢𝑖 = 𝑐}.
(3)
¯ 𝑣¯), where 𝑢¯ = 𝑐 and For each bin, we compute the mean point (𝑢, 𝑣¯ is the mean of the corresponding 𝑣𝑖 values. The binning operation in Equation (2) quantizes the projection along e𝑢 into an ordering index, the corresponding 𝑣-values serve as signal values, and the sequence of mean points forms a discrete-time signal 𝑆 = 𝜑 (𝑄). Figure 3 illustrates this aggregation: projected points are grouped into bins and converted into mean points, which form an ordered sequence used as the signal for detection. 3.1.2 Spectral analysis and detection. Given the discrete-time signal 𝑆, watermark detection evaluates whether the signal exhibits high spectral power at the designated frequency 𝜔 corresponding to the sinusoidal dependency. If such high spectral power at the designated frequency is observed, it indicates that the projected dataset contains the sinusoidal dependency that forms the watermark signal, which implies the presence of watermark. Because some bins may be empty, the resulting signal is not necessarily uniformly sampled. We therefore use the Lomb–Scargle Periodogram (LSP) [46], which estimates spectral power for nonuniformly sampled signals. Let 𝐿(𝜔) denote the spectral power of 𝑆 at frequency 𝜔. We define the detection score as DS(𝜔) = 1 − FAP(𝜔),
(4)
𝑧!
…
𝑧%
𝑥'()
𝑄'()
(b) Reverse denoising process 𝑝 𝑧 𝑧 𝑧$ … 𝑧!"# & ! !"#
𝑧!
…
𝑧%
𝑥*+
𝑄*+
(c) Reverse denoising process with watermark guidance 𝑝 𝑧 𝑧 ,𝑊 … 𝑧% 𝑥+, 𝑄+, 𝑧$ … 𝑧!"# & ! !"# 𝑧!
𝜑 𝑄*+
𝜑 𝑄+,
Discrete-time signal
𝑐!
(a) Forward diffusion process 𝑞 𝑧!"# 𝑧! 𝑧$ … 𝑧!"#
Sampling
points (𝑢, 𝑣) mean points (𝑢', 𝑣̅ ) bins 𝐵$ , 𝑐 ∈ {𝑐! , 𝑐" , 𝑐# }
𝜑 𝑄'()
Training Sampling
𝑣-𝑎𝑥𝑖𝑠
Watermark guidance
Figure 4: Overview of the watermark embedding method. The three scattered plots on the right side show the discretetime signals of the corresponding tabular datasets 𝑄𝑜𝑟𝑖 , 𝑄𝑢𝑤 , and 𝑄 𝑤𝑚 , respectively. where FAP(𝜔) ∈ [0, 1] is the false alarm probability computed by LSP, and it represents the probability that random noise would produce a spectral power of at least 𝐿(𝜔). A large DS(𝜔), thus a small FAP(𝜔), indicates that the spectral power at 𝜔 is unlikely to arise from noise. This indicates a strong watermark signal, which is strong evidence for the presence of the watermark. The final decision on the presence of a watermark is obtained by comparing DS(𝜔) with a predefined threshold. Algorithm 1 summarizes the detection procedure for determining whether a suspicious dataset 𝑄 contains the watermark signal specified by the owner’s secret key. The secret key, denoted by K = {e𝑢 , e𝑣 , 𝛽, 𝑠, 𝜔 }, specifies the projection directions, binning parameters, and designated frequency. The key is known only to the data owner and prevents adversaries from identifying or weakening the watermark signal. The detection algorithm runs in 𝑂 (𝑛(𝑑 + 1)) time and uses 𝑂 (𝑛(𝑑 + 1) + 𝑑) space. The detection module of RaMark is inspired by PKF [11] because both methods detect watermark by examining a sinusoidal signal in the projected space. However, RaMark differs fundamentally from PKF because PKF’s watermark is not radioactive, while RaMark’s watermark is highly radioactive. Specifically, the watermark of PKF imposes artificial correlations among attributes, and these externally added correlations do not form stable or learnable dependencies in the underlying data distribution, so retrained generative models do not reproduce the watermark.
3.2
Watermark Embedding
To embed a sinusoidal dependency into generated data, RaMark performs watermark-guided diffusion sampling, which is driven by an analytic watermark likelihood that is compatible with the detection procedure. Rather than modifying generated samples in a post-hoc manner, the watermark is embedded during the reverse denoising process (i.e., diffusion sampling) of a diffusion model, so that the sampled dataset intrinsically conforms to the target sinusoidal dependency in the projected space. We first provide an overview of the key idea, then define the watermark likelihood, and finally present watermark-guided diffusion sampling and the complete embedding algorithm. 3.2.1 Overview of key idea. Figure 4 illustrates the embedding pipeline by contrasting standard diffusion sampling with RaMark’s watermark-guided sampling. In Figure 4(a), the data owner trains a
RaMark: Radioactive Watermarking for Generated Tabular Data
Conference acronym ’XX, June 03–05, 2018, Woodstock, NY
diffusion model on the original (unwatermarked) dataset 𝑄𝑜𝑟𝑖 . In Figure 4(b), standard diffusion sampling from the trained diffusion model produces an unwatermarked generated dataset 𝑄𝑢𝑤 , whose mapped discrete-time signal does not exhibit the sinusoidal dependency. In Figure 4(c), we add watermark guidance to modify the standard diffusion sampling so that the sampled dataset 𝑄 𝑤𝑚 is biased to exhibit the sinusoidal dependency, thereby successfully embedding the watermark. The quantile transformation (QT) in Figure 4(a) is a standard normalization step in diffusion-based tabular generation [32, 37, 59]. It maps each data sample 𝑥𝑜𝑟𝑖 ∈ 𝑄𝑜𝑟𝑖 in the original 𝑥-space to a normalized latent state 𝑧 0 = QT(𝑥𝑜𝑟𝑖 ) in the 𝑧-space, which is the starting state of the forward diffusion process. Because QT is applied element-wise on attributes, the 𝑥-space and 𝑧-space have the same dimensionality [6, 51]. The training of the diffusion model applies the forward diffusion process to latent states 𝑧 0, . . . , 𝑧𝑇 to learn the reverse denoising transitions. During sampling in Figure 4(b)–(c), we initialize 𝑧𝑇 ∼ N (0, I), iteratively denoise in the 𝑧-space to obtain 𝑧 0 , and decode 𝑧 0 back to the 𝑥-space by 𝑥 = QT−1 (𝑧 0 ).
that the latent states, which decode to samples with reduced deviation from the sinusoidal dependency, receive a higher probability of being sampled. In diffusion models, the diffusion sampling is parameterized as a Gaussian 𝑝𝜃 (𝑧𝑡 | 𝑧𝑡 +1 ) = N 𝑧𝑡 ; 𝜇, Σ , (8) where 𝜇 = 𝜇𝜃 (𝑧𝑡 +1, 𝑡) and Σ = Σ𝜃 (𝑧𝑡 +1, 𝑡) are predicted by the model [29, 77]. To obtain a tractable sampling rule for Equation (7), we locally linearize log Pr(𝑊 | 𝑧𝑡 ) around 𝑧𝑡 = 𝜇. The following result shows that incorporating the watermark likelihood modifies the reverse transition through a simple mean shift proportional to the gradient of the log watermark likelihood. Theorem 3.1. Given 𝑝𝜃 (𝑧𝑡 | 𝑧𝑡 +1 ) = N 𝑧𝑡 ; 𝜇, Σ , the reweighted density 𝑝𝜃 (𝑧𝑡 | 𝑧𝑡 +1 ) Pr(𝑊 | 𝑧𝑡 ) is approximated by 𝑝𝜃 (𝑧𝑡 | 𝑧𝑡 +1 ) Pr(𝑊 | 𝑧𝑡 ) ≈ N 𝑧𝑡 ; 𝜇 + Σ · 𝑔𝑧 , Σ , where 𝑔𝑧 = ∇𝑧𝑡 log Pr(𝑊 | 𝑧𝑡 ) 𝑧𝑡 =𝜇 is the gradient of log Pr(𝑊 | 𝑧𝑡 ) at 𝑧𝑡 = 𝜇, and Σ · 𝑔𝑧 denotes matrix-vector multiplication.
3.2.2 Watermark likelihood. The watermark likelihood quantifies the degree to which a latent state 𝑧𝑡 aligns with the sinusoidal dependency in the projected space. To guide diffusion sampling toward watermarked samples, we need a differentiable objective that quantifies how well a candidate sample matches the target sinusoidal dependency. The watermark likelihood serves exactly this purpose. During diffusion sampling, let 𝑧𝑡 denote the latent state at timestep 𝑡, and let 𝑥𝑡 = QT−1 (𝑧𝑡 ) be the corresponding decoded data sample. We map 𝑥𝑡 into the same two-dimensional projected space used in watermark detection. This obtains (𝑢𝑡 , 𝑣𝑡 ), where 𝑢𝑡 = 𝜙𝑢 (𝑥𝑡 ) and 𝑣𝑡 = 𝜙 𝑣 (𝑥𝑡 ). A sample is more conformed to the watermark if its projected value 𝑣𝑡 lies closer to the target sinusoidal curve at position 𝑢𝑡 . The deviation from the sinusoidal dependency, modelled as 𝑣 = sin(2𝜋𝜔𝑢), is defined as
The proof of Theorem 3.1 is provided in the Appendix A.1. By Theorem 3.1, the guided reverse denoising step replaces the mean 𝜇 with 𝜇 +Σ·𝑔𝑧 , where 𝑔𝑧 points in the direction that increases log Pr(𝑊 | 𝑧𝑡 ). Since log Pr(𝑊 | 𝑧𝑡 ) = −𝑑 (𝑥𝑡 ), this guidance tends to reduce 𝑑 (𝑥𝑡 ) and therefore strengthens the embedded watermark signal. Repeating the guided mean shift over all timesteps progressively biases sampling toward latent states whose decoded data samples are more conformed to the sinusoidal dependency. This yields a dataset carrying the embedded watermark signal. We summarize the complete embedding procedure in Algorithm 2. Repeating Algorithm 2 independently produces 𝑄 𝑤𝑚 . Following Dhariwal and Nichol [13], we include a guidance strength parameter 𝛼 > 0 that controls the influence of the watermark term: 𝑧𝑡 ∼ N 𝜇 + 𝛼 (Σ · 𝑔𝑧 ), Σ . (9)
𝑑 (𝑥𝑡 ) = |𝑣𝑡 − sin(2𝜋𝜔𝑢𝑡 )| ,
This design introduces only controlled and minor perturbations to the generated samples, since the watermark guidance is applied gradually at each denoising step and only slightly adjusts the generated values. The guidance strength 𝛼 further controls how strongly diffusion sampling is biased toward the target sinusoidal dependency. Empirical studies on the effect of 𝛼 are provided in Section 5.5.
(5)
and the watermark likelihood is defined as Pr(𝑊 | 𝑧𝑡 ) ≜ exp(−𝑑 (𝑥𝑡 )) ,
(6)
where 𝑊 denotes the event that the decoded data sample conforms to the sinusoidal dependency. A small deviation 𝑑 (𝑥𝑡 ) corresponds to a strong conformity with the sinusoidal dependency and therefore yields a higher watermark likelihood. 3.2.3 Watermark-guided sampling. Watermark-guided sampling modifies the standard diffusion sampling by incorporating the watermark likelihood as a multiplicative weighting term. The key idea of watermark-guided sampling is that among all denoising directions proposed by the diffusion model, we prefer those that make the sample more consistent with the target sinusoidal dependency. At timestep 𝑡, we interpret the guided reverse denoising step as sampling from the conditional transition 𝑝𝜃 (𝑧𝑡 | 𝑧𝑡 +1,𝑊 ) ∝ 𝑝𝜃 (𝑧𝑡 | 𝑧𝑡 +1 ) Pr(𝑊 | 𝑧𝑡 ),
(7)
where 𝑝𝜃 (𝑧𝑡 | 𝑧𝑡 +1 ) formulates the standard diffusion sampling learned from 𝑄𝑜𝑟𝑖 in Figure 4(a), and 𝜃 denotes the trained diffusion model parameters. This modifies the sampling distribution of 𝑧𝑡 so
3.2.4 Scope of application. RaMark relies on diffusion models for watermark embedding, as the watermark is embedded during the reverse denoising process through watermark-guided sampling. We adopt diffusion models because they provide strong distribution modeling capability and represent the state-of-the-art for tabular data generation [34, 36, 80]. RaMark operates on continuous-valued attributes, which are widely present in real-world tabular datasets such as financial, medical, industrial, and sensor data. In mixed-type tables containing both continuous-valued and categorical attributes, the sinusoidal dependency can be embedded on any subset of continuous columns without modifying discrete or categorical fields. As long as at least two continuous attributes are available, RaMark can construct the required two-dimensional projected space and embed the sinusoidal dependency while preserving the remaining schema. This design allows the watermark signal to be integrated
Conference acronym ’XX, June 03–05, 2018, Woodstock, NY
Algorithm 2 Watermark embedding Input: A secret key K and a trained diffusion model 𝜃 . Output: A watermarked data sample 𝑥 𝑤𝑚 . 1: Sample 𝑧𝑇 from N (0, I) 2: for each 𝑡 ∈ {𝑇 − 1,𝑇 − 2, . . . , 1, 0} do 3: Compute 𝜇 = 𝜇𝜃 (𝑧𝑡 +1, 𝑡), Σ = Σ𝜃 (𝑧𝑡+1, 𝑡) and 𝑔𝑧 4: Sample 𝑧𝑡 from N 𝜇 + 𝛼 (Σ · 𝑔𝑧 ), Σ 5: end for 6: return 𝑥 𝑤𝑚 ← QT −1 (𝑧 0 )
into a broad range of practical tabular datasets without altering their discrete components.
4
Robustness of the Radioactive Watermark
Robustness to watermark removal attacks is a central criterion for evaluating watermarking methods. In this section, we formalize the adversary’s goal and threat model, describe representative watermark removal attacks, and then provide a theoretical analysis of the robustness and radioactivity of RaMark.
4.1
Adversary’s Goal and Threat Model
In tabular data watermarking [28, 33, 42, 56, 84, 85], an adversary aims to weaken or remove the watermark while preserving the utility of the released dataset. We formalize the adversary’s goal and capabilities as follows. 4.1.1 Adversary’s goal. Given a watermarked dataset 𝑄 𝑤𝑚 , the adversary seeks to construct an attacked dataset 𝑄 𝑎𝑡𝑘 that minimizes the watermark detection score without substantially degrading its data utility. We measure data utility by how well 𝑄 𝑎𝑡𝑘 preserves the statistical properties required for downstream learning tasks. Following established works [37, 63, 85], we quantify utility using Machine Learning Efficiency (MLE) [3, 37, 63, 85], which evaluates how well a model trained on 𝑄 𝑎𝑡𝑘 generalizes to real data. The computation of MLE is detailed in Section 5.1. Under this objective, an attack is considered successful only if it weakens or removes the watermark signal while preserving MLE. 4.1.2 Threat model (adversary’s capabilities). We adopt a standard private-key watermarking setting [28, 33, 42, 56, 84, 85] with the following assumptions. • Access to released data. The adversary has full access to the released watermarked dataset 𝑄 𝑤𝑚 , but not to the original dataset 𝑄𝑜𝑟𝑖 , which remains private to the data owner. • No access to the secret key. The adversary does not possess the secret key K, which specifies the projection directions and watermark parameters. The key is retained solely by the data owner [11, 33, 84]. • Semantic consistency of attributes. The adversary cannot alter the semantic meaning of attributes [11, 83]. Changing attribute semantics would produce a dataset that is incompatible with the original task and would severely reduce MLE, which violates the adversary’s goal of preserving utility.
Anonymous
Under this threat model, the adversary is allowed to modify data values or retrain generative models, but must preserve distributional characteristics sufficient to keep the data’s utility for downstream learning tasks. This captures realistic misuse scenarios in data sharing settings, where redistributed datasets are expected to remain functionally equivalent to the original release.
4.2
Watermark Removal Attacks
Watermark removal attacks attempt to transform a watermarked dataset 𝑄 𝑤𝑚 into an attacked dataset 𝑄 𝑎𝑡𝑘 in which the watermark signal is weakened or removed while maintaining data utility. We consider two broad categories of attacks, distinguished by whether the adversary regenerates the data distribution or directly edits the released dataset. 4.2.1 Retraining attack. In a retraining attack, the adversary trains a new generative model on the watermarked dataset 𝑄 𝑤𝑚 and then samples a regenerated dataset 𝑄 𝑎𝑡𝑘 from the newly trained model. The underlying intuition is that a well-trained generative model captures the overall data distribution of 𝑄 𝑤𝑚 but may fail to reproduce watermark signals that are not encoded as stable distributional dependencies. If successful, this attack produces 𝑄 𝑎𝑡𝑘 that retains high data utility while weakening the watermark signal so that it becomes harder to detect the watermark. The adversary may employ any generative model suitable for tabular data. In our experiments, we consider three major classes of deep generative models: (1) Diffusion models: TabDDPM [37] and TabDiff [63]; (2) Generative adversarial networks (GANs): CTABGAN+ [81, 82]; and (3) Variational autoencoders (VAEs): TVAE [76]. These models represent state-of-the-art generative paradigms for tabular data and provide strong retraining baselines. 4.2.2 Data modification attacks. In contrast to retraining, data modification attacks directly edit the released dataset 𝑄 𝑤𝑚 through value-level or structure-level operations. Such transformations are standard in the dataset watermarking literature and aim to weaken the watermark by perturbing the data while preserving its overall statistical characteristics. We consider the following common operations: (1) Noise addition [11, 28, 83]: Each attribute value in 𝑄 𝑤𝑚 is perturbed by adding noise sampled from a uniform distribution 𝑈 [−𝜌𝑛𝑎 , 𝜌𝑛𝑎 ], where 𝜌𝑛𝑎 > 0 controls the perturbation magnitude. (2) Row deletion [33, 56]: A fraction 𝜌𝑟𝑑 ∈ [0, 1] of rows is randomly removed from 𝑄 𝑤𝑚 . (3) Row insertion [30, 33, 62]: A fraction 𝜌𝑟𝑖 ∈ [0, 1] of new rows is inserted into 𝑄 𝑤𝑚 . For each inserted row, the 𝑗-th attribute value is sampled from 𝑈 [𝜇 𝑗 − 𝜎 𝑗 , 𝜇 𝑗 + 𝜎 𝑗 ], where 𝜇 𝑗 and 𝜎 𝑗 are the mean and standard deviation of the 𝑗-th attribute in 𝑄 𝑤𝑚 . (4) Column deletion [11, 83]: A fraction 𝜌𝑐𝑑 ∈ [0, 0.5] of attributes (i.e., columns) is removed from 𝑄 𝑤𝑚 . For all attacks, larger values of 𝜌𝑛𝑎 , 𝜌𝑟𝑑 , 𝜌𝑟𝑖 , and 𝜌𝑐𝑑 correspond to stronger attack strength. These operations model realistic adversarial behaviors that attempt to weaken or remove watermark signal while preserving data utility for downstream tasks.
RaMark: Radioactive Watermarking for Generated Tabular Data
4.3
Robustness Analysis
This subsection links distributional similarity between two tabular datasets to the spectral power of their mapped discrete-time signals at the designated frequency 𝜔. We first present two theorems: the first converts closeness between the signal distributions into closeness of spectral power, and the second shows that closeness between dataset distributions is (with high probability) preserved by the dataset-to-signal mapping 𝜑. We then give three remarks that explain why these results imply strong radioactivity and robustness of RaMark against watermark removal attacks. The proofs of both theorems are provided in the Appendix A.1. 4.3.1 Setup. Let 𝑄 𝐴 and 𝑄 𝐵 be two tabular datasets, each containing 𝑛 samples, with corresponding discrete-time signals 𝑆𝐴 = {(𝑢¯𝐴𝑗 , 𝑣¯𝐴𝑗 )}ℓ𝑗=1 and 𝑆 𝐵 = {(𝑢¯𝐵𝑗 , 𝑣¯𝐵𝑗 )}ℓ𝑗=1 obtained by applying the same mapping 𝜑 (hence the same secret key). Let 𝑉 = max1≤ 𝑗 ≤ℓ {|𝑣¯𝐴𝑗 |, |𝑣¯𝐵𝑗 |} be an amplitude bound, and let 𝜎𝐴2 and 𝜎𝐵2 , respectively, be the sample variances of {¯𝑣 𝐴𝑗 }ℓ𝑗=1 and {¯𝑣 𝐵𝑗 }ℓ𝑗=1 , with 𝜎 2 = min{𝜎𝐴2 , 𝜎𝐵2 }. Denote by 𝑃 𝐴 and 𝑃 𝐵 the distributions of 𝑆𝐴 and 𝑆 𝐵 , and by 𝐿𝐴 (𝜔) and 𝐿𝐵 (𝜔) their spectral powers at frequency 𝜔, resepctively. Denote by W1 (·, ·) the Wasserstein-1 distance between two distributions. Theorem 4.1 (Probabilistic Bound on Spectral Power Difference). For any 𝜖 > 0, ℓ𝜖 2 𝐶 W (𝑃 , 𝑃 ) 2 1 𝐴 𝐵 , Pr |𝐿𝐴 (𝜔) − 𝐿𝐵 (𝜔)| ≥ 𝜖 ≤ 4 exp − + 𝐶1 𝜖 4
2
2 2
2
2
/𝜎 ) and 𝐶 2 = 12𝑉 (𝑉𝜎 4 +𝜎 ) . where 𝐶 1 = 288𝑉 (1+𝑉 𝜎4
Theorem 4.1 states a clean message: if the signal distributions 𝑃 𝐴 and 𝑃 𝐵 are close in Wasserstein-1 distance, then their spectral powers at 𝜔 are unlikely to differ much. The exponential term decays with the signal length ℓ, while the second term scales linearly with W1 (𝑃 𝐴 , 𝑃 𝐵 ). 4.3.2 From datasets to signals. Let 𝑇𝐴 and 𝑇𝐵 be the data-sample distributions of 𝑄 𝐴 and 𝑄 𝐵 (in the original 𝑑-dimensional attribute space), respectively. Recall that 𝜑 bins points by their 𝑢-coordinates. For any bin coordinate 𝑐, let Pr(𝑢𝐴 = 𝑐) (resp., Pr(𝑢𝐵 = 𝑐)) be the probability that a sample from 𝑇𝐴 (resp., 𝑇𝐵 ) is mapped by 𝜙𝑢 to 𝑢 = 𝑐. Define 𝑝 = min∀𝑐 {Pr(𝑢𝐴 = 𝑐), Pr(𝑢𝐵 = 𝑐)} and let 𝑟 be the maximum number of samples that fall into any bin in either dataset. Theorem 4.2 (Preservation of Wasserstein-1 Distance through Dataset-to-Signal Mapping). If W1 (𝑇𝐴 ,𝑇𝐵 ) ≤ 𝜁 , then √︄ ! 𝐶 1 𝜁 2𝑉 2 4ℓ + 1 + 𝜁 + 2ℓ log Pr W1 (𝑃 𝐴 , 𝑃 𝐵 ) ≤ 𝑝 𝑠 𝛽 (1 − 𝛿)𝑟𝑝 𝜂 𝛿2 ≥ 1 − 2ℓ exp − 𝑟𝑝 − 𝜂, 2 where 𝐶 = max{1, 4𝑉 }, 𝛽 > 0 and 𝑠 > 0 are the bin width and scaling factor in 𝜑, and 𝛿 ∈ (0, 1) and 𝜂 ∈ (0, 1) are concentration parameters introduced by Chernoff’s and Hoeffding’s inequalities. Theorem 4.2 formalizes the straight intuition: small changes in the dataset distribution (small W1 (𝑇𝐴 ,𝑇𝐵 )) typically lead to small changes in the signal distribution (small W1 (𝑃 𝐴 , 𝑃 𝐵 )), up to finitesample fluctuations controlled by 𝑟 , 𝑝, and ℓ.
Conference acronym ’XX, June 03–05, 2018, Woodstock, NY
4.3.3 Putting the two theorems together. Combining Theorem 4.2 with Theorem 4.1 yields a simple chain: W1 (𝑇𝐴 ,𝑇𝐵 ) small =⇒ W1 (𝑃 𝐴 , 𝑃 𝐵 ) small (with high probability) =⇒ |𝐿𝐴 (𝜔) − 𝐿𝐵 (𝜔)| small (with high probability). We now interpret this chain under attacks by setting 𝑄 𝐴 = 𝑄 𝑤𝑚 to be the watermarked dataset, and 𝑄 𝐵 = 𝑄 𝑎𝑡𝑘 to be the attacked dataset. Remark 1 (Utility–watermark trade-off). An adversary aims to weanken watermark signal while preserving data utility. However, high data utility typically requires the attacked dataset 𝑄 𝐵 to remain distributionally close to the watermarked dataset 𝑄 𝐴 , that is, W1 (𝑇𝐴 ,𝑇𝐵 ) must be small and the effective sample support across bins must remain sufficient. Under these conditions, Theorem 4.2 implies that the signal distributions 𝑃 𝐴 and 𝑃 𝐵 remain close with high probability, and Theorem 4.1 further implies that the spectral powers 𝐿𝐴 (𝜔) and 𝐿𝐵 (𝜔) remain close with high probability. Since 𝑄 𝐴 has a large 𝐿𝐴 (𝜔), 𝐿𝐵 (𝜔) also remains large, which means the watermark stays detectable in 𝑄 𝐵 . Therefore, substantially weakening the watermark signal requires increasing W1 (𝑇𝐴 ,𝑇𝐵 ) or significantly reducing the sample support of bins, both of which distort the data distribution and typically degrade utility. This establishes an inherent utility-watermark trade-off: preserving utility tends to preserve the watermark, while suppressing the watermark requires sacrificing utility. Remark 2 (Radioactivity against retraining attacks). A retraining attack trains a new generative model on 𝑄 𝐴 and outputs 𝑄 𝐵 by sampling from that model. If retraining succeeds at preserving utility, then the generated distribution 𝑇𝐵 must approximate 𝑇𝐴 , meaning W1 (𝑇𝐴 ,𝑇𝐵 ) is small. By Theorem 4.2, this implies 𝑃 𝐵 remains close to 𝑃 𝐴 with high probability (w.h.p.); by Theorem 4.1, this further implies 𝐿𝐵 (𝜔) ≈ 𝐿𝐴 (𝜔) with high probability. Because the watermark in 𝑄 𝐴 creates an elevated spectral power peak at 𝜔 (large 𝐿𝐴 (𝜔)), the retrained model reproduces this elevated spectral power in 𝑄 𝐵 as part of matching the data distribution. Hence, retraining preserves the watermark rather than removing it, which leads to exactly the radioactivity of RaMark. Remark 3 (Robustness against data modification attacks). A data modification attack constructs 𝑄 𝐵 by directly perturbing 𝑄 𝐴 (e.g., adding noise, deleting/inserting rows, or deleting columns). Such operations can be viewed as perturbing the underlying sample distribution from 𝑇𝐴 to a nearby 𝑇𝐵 . If the adversary keeps the perturbation mild to preserve utility, then W1 (𝑇𝐴 ,𝑇𝐵 ) remains small and the effective bin coverage (captured by 𝑟𝑝) remains sufficiently large. The same implication chain applies: 𝑃 𝐵 stays close to 𝑃 𝐴 (w.h.p.), and thus 𝐿𝐵 (𝜔) stays close to 𝐿𝐴 (𝜔) (w.h.p.), so the watermark remains detectable. Therefore, to effectively suppress 𝐿𝐵 (𝜔), the adversary must apply modifications strong enough to substantially change 𝑇𝐵 or severely reduce effective sample support across bins, which typically causes a noticeable utility drop.
5
Experiments
In this section, we empirically evaluate the robustness and utility of RaMark under the threat models defined in Section 4.1. Our experiments focus on the central question of this paper: whether
Conference acronym ’XX, June 03–05, 2018, Woodstock, NY
Anonymous
Table 1: Statistics of datasets. #Train, #Valid, and #Test are the number of data samples in the training, validation, and test splits, respectively, and #Attri is the number of attributes. Name
#Train
#Valid
#Test
#Attri
ML Task
Higgs Small House 16H
62,751 14,581
15,688 3,646
19,610 4,557
28 16
Classification Regression
the watermark remains detectable when an adversary attempts to remove it while preserving data utility. We compare RaMark with seven state-of-the-art watermarking methods on two real-world tabular datasets, under both retraining attacks and data modification attacks. All experiments were conducted on a desktop with an Intel(R) Core(TM) i9-10900K CPU and 64 GB RAM. The remainder of this section is organized as follows. Section 5.1 describes the datasets, baselines, and basic experiment setup. Section 5.2 introduces the evaluation protocols of watermark robustness. Section 5.3, Section 5.4, and Section 5.5 address the following questions, respectively: Q1: Is RaMark radioactive against retraining attacks? Q2: How robust is RaMark against data modification attacks? Q3: How do key parameters in RaMark affect its effectiveness?
5.1
Experimental Setup
5.1.1 Datasets. We evaluate all methods on two widely used public tabular datasets. Higgs Small (HS) [69] is derived from high-energy physics experiments and is used for binary classification. House-16H (HO) 1 is a regression dataset for predicting house prices from 16 attributes, such as house area, number of rooms, and furnishing status. For each dataset, we randomly select 25% of the columns to carry the watermark, that is, seven columns for HS and four columns for HO. Basic statistics of the datasets are summarized in Table 1. 5.1.2 Baseline methods. We compare RaMark against seven representative watermarking methods for tabular data: S2R2W [42], WGTD [28], PKF [11], TabWak [85], TabularMark [84], MUSE [16], and B2Mark [83]. We use the publicly available implementations for all baselines. The code for TabularMark, PKF, TabWak, MUSE, and B2Mark was released by the original authors. The implementations of S2R2W and WGTD were provided by the authors of TabularMark and MUSE, respectively. In our verification, all implementations reproduce the performance trends reported in their corresponding papers. Since S2R2W and TabularMark are designed for single-column watermarking, we extend them to multi-column watermarking following [11, 61, 62]: the same watermark is independently embedded into multiple columns, and final detection is decided by majority voting across watermarked columns. For S2R2W, which requires a primary key, we follow TabularMark [84] and use the top-10 most significant bits of one attribute as the primary key.
1 https://www.dcc.fc.up.pt/~ltorgo/Regression/census.html
5.1.3 Aligning watermark strength. A fair robustness comparison requires that different methods operate under comparable watermark strength. However, watermark strength is controlled differently across methods and is not directly comparable. We therefore use Machine Learning Efficiency (MLE) [3, 37, 63, 85] as a common, method-independent proxy. MLE measures how well generated data preserve statistical properties relevant for downstream tasks, under the standard Training on Generated and Testing on Real protocol [17, 37, 39]. If generated data accurately approximate the real distribution, models trained on them generalize well to real data, yielding high MLE. Stronger watermark perturbations typically distort the data distribution more, resulting in lower MLE [11, 85]. Based on the above observation, we align watermark strength across different watermarking methods by imposing an MLE budget constraint [11]: MLE(𝑄𝑢𝑤 ) − MLE(𝑄 𝑤𝑚 ) ≤ 𝛾,
(10)
where 𝑄𝑢𝑤 and 𝑄 𝑤𝑚 denote the unwatermarked and watermarked generated datasets, respectively. The budget 𝛾 controls the maximum allowable utility degradation caused by watermark embedding. In our setting, 𝛾 also serves as a control on perturbations introduced by the watermark, since a watermark is only accepted when the resulting utility loss remains small. Therefore, the embedded dependency is not an unconstrained distortion, but a utility-aware and controlled perturbation of the generated distribution. Following Kotelnikov et al. [37], we evaluate MLE using CatBoost [53] on both the datasets of HS and HO. For the classification task on HS, we report F1-score as MLE; for the regression task on HO, we report the coefficient of determination 𝑅 2 as MLE [9, 20, 37]. In all experiments, we set 𝛾 = 1%. For each method, watermarkspecific hyperparameters are tuned to achieve the strongest possible watermark under this MLE constraint, while other parameters remain at default settings. Because all methods are restricted to the same utility degradation, their watermark strengths are aligned, which enables a fair robustness comparison. Following the literature [37, 84], we use MLE to evaluate the data utility because we focus on ML-oriented data usage scenarios, where predictive performance is the primary concern. 5.1.4 Measuring attack strength. Given a watermarked dataset 𝑄 𝑤𝑚 and an attacked dataset 𝑄 𝑎𝑡𝑘 , we measure attack strength by the resulting utility degradation: MLE(𝑄 𝑤𝑚 ) − MLE(𝑄 𝑎𝑡𝑘 ).
(11)
This mirrors the watermark strength alignment principle: stronger attacks induce larger utility loss. Reporting attack strength alongside watermark robustness in our experimental results allows us to directly examine the utility–watermark trade-off predicted by our theoretical analysis in Section 4.3.
5.2
Evaluation Protocol of Robustness
We evaluate watermark robustness by simulating a watermark service provider (WSD) that manages 105 data owners. Each owner registers a unique secret key with the WSD and embeds a watermark using that key. Given a suspicious dataset, the WSD performs verification in two stages: (i) a detecting stage, which determines
RaMark: Radioactive Watermarking for Generated Tabular Data
Conference acronym ’XX, June 03–05, 2018, Woodstock, NY
Table 2: Radioactivity against retraining attacks on the datasets HS and HO.
Dataset / Measure
Watermark Method
MLE(𝑄 𝑤𝑚 )
HS / Detectability (Det_AUC)
S2R2W TabularMark WGTD PKF TabWak MUSE B2Mark RaMark
0.703±0.009 0.703±0.008 0.703±0.005 0.703±0.006 0.704±0.005 0.703±0.004 0.703±0.006 0.704±0.004
Dataset / Measure
Watermark Method
MLE(𝑄 𝑤𝑚 )
HS / Traceability (Tra_AUC)
S2R2W TabularMark WGTD PKF TabWak MUSE B2Mark RaMark
0.704±0.003 0.703±0.007 0.703±0.008 0.703±0.012 0.703±0.003 0.703±0.003 0.703±0.005 0.704±0.008
Dataset / Measure
Watermark Method
MLE(𝑄 𝑤𝑚 )
HO / Detectability (Det_AUC)
S2R2W TabularMark WGTD PKF TabWak MUSE B2Mark RaMark
0.610±0.013 0.610±0.010 0.610±0.006 0.609±0.008 0.610±0.005 0.609±0.004 0.609±0.005 0.610±0.005
Dataset / Measure
Watermark Method
MLE(𝑄 𝑤𝑚 )
HO / Traceability (Tra_AUC)
S2R2W TabularMark WGTD PKF TabWak MUSE B2Mark RaMark
0.609±0.002 0.610±0.007 0.610±0.008 0.608±0.009 0.610±0.005 0.609±0.005 0.609±0.005 0.610±0.007
TabDDPM MLE(𝑄 𝑎𝑡𝑘 ) Det_AUC 0.688±0.008 0.51 0.689±0.005 0.51 0.684±0.011 0.51 0.685±0.004 0.52 0.679±0.003 0.51 0.680±0.003 0.50 0.679±0.006 0.60 0.685±0.003 1.00
TabDiff MLE(𝑄 𝑎𝑡𝑘 ) Det_AUC 0.680±0.003 0.50 0.679±0.010 0.51 0.682±0.003 0.53 0.679±0.005 0.52 0.678±0.003 0.55 0.681±0.003 0.54 0.680±0.005 0.60 0.680±0.006 0.98
CTAB-GAN+ MLE(𝑄 𝑎𝑡𝑘 ) Det_AUC 0.634±0.008 0.51 0.639±0.003 0.50 0.630±0.011 0.57 0.635±0.009 0.51 0.630±0.008 0.53 0.629±0.009 0.54 0.630±0.005 0.56 0.639±0.010 0.82
TVAE MLE(𝑄 𝑎𝑡𝑘 ) Det_AUC 0.608±0.006 0.51 0.607±0.005 0.51 0.604±0.009 0.55 0.605±0.009 0.51 0.599±0.008 0.53 0.599±0.009 0.53 0.600±0.007 0.57 0.605±0.009 0.79
TabDDPM MLE(𝑄 𝑎𝑡𝑘 ) Tra_AUC 0.687±0.008 0.03 0.689±0.005 0.50 0.688±0.012 0.53 0.689±0.004 0.52 0.679±0.003 0.51 0.679±0.003 0.51 0.680±0.006 0.05 0.689±0.009 1.00
TabDiff MLE(𝑄 𝑎𝑡𝑘 ) Tra_AUC 0.679±0.003 0.01 0.680±0.003 0.51 0.679±0.003 0.51 0.681±0.005 0.53 0.680±0.006 0.51 0.681±0.005 0.50 0.680±0.002 0.05 0.678±0.008 0.97
CTAB-GAN+ MLE(𝑄 𝑎𝑡𝑘 ) Tra_AUC 0.635±0.008 0.02 0.633±0.003 0.51 0.634±0.011 0.50 0.633±0.010 0.50 0.629±0.008 0.54 0.632±0.009 0.53 0.633±0.004 0.03 0.634±0.010 0.79
TVAE MLE(𝑄 𝑎𝑡𝑘 ) Tra_AUC 0.607±0.008 0.01 0.599±0.008 0.50 0.606±0.008 0.50 0.598±0.009 0.54 0.601±0.011 0.52 0.601±0.005 0.53 0.599±0.005 0.04 0.605±0.009 0.78
TabDDPM MLE(𝑄 𝑎𝑡𝑘 ) Det_AUC 0.597±0.002 0.51 0.597±0.005 0.50 0.598±0.001 0.50 0.598±0.004 0.50 0.591±0.003 0.51 0.592±0.003 0.50 0.596±0.007 0.59 0.598±0.005 1.00
TabDiff MLE(𝑄 𝑎𝑡𝑘 ) Det_AUC 0.591±0.006 0.51 0.589±0.005 0.51 0.591±0.003 0.53 0.588±0.005 0.52 0.588±0.003 0.55 0.588±0.003 0.54 0.590±0.005 0.59 0.590±0.012 0.98
CTAB-GAN+ MLE(𝑄 𝑎𝑡𝑘 ) Det_AUC 0.483±0.007 0.52 0.485±0.009 0.50 0.482±0.006 0.50 0.481±0.008 0.51 0.481±0.018 0.53 0.481±0.009 0.54 0.480±0.019 0.56 0.481±0.011 0.80
TVAE MLE(𝑄 𝑎𝑡𝑘 ) Det_AUC 0.471±0.008 0.51 0.470±0.009 0.51 0.471±0.009 0.50 0.469±0.009 0.51 0.471±0.012 0.53 0.470±0.009 0.53 0.469±0.006 0.56 0.470±0.010 0.79
TabDDPM MLE(𝑄 𝑎𝑡𝑘 ) Tra_AUC 0.597±0.004 0.02 0.597±0.002 0.50 0.598±0.011 0.50 0.598±0.005 0.50 0.588±0.003 0.51 0.589±0.003 0.51 0.596±0.007 0.06 0.598±0.005 1.00
TabDiff MLE(𝑄 𝑎𝑡𝑘 ) Tra_AUC 0.588±0.003 0.01 0.591±0.003 0.51 0.592±0.003 0.51 0.589±0.005 0.50 0.592±0.002 0.51 0.589±0.003 0.50 0.590±0.005 0.05 0.589±0.007 0.97
CTAB-GAN+ MLE(𝑄 𝑎𝑡𝑘 ) Tra_AUC 0.483±0.012 0.02 0.486±0.018 0.50 0.481±0.007 0.50 0.481±0.008 0.50 0.481±0.008 0.53 0.480±0.009 0.52 0.480±0.019 0.04 0.481±0.014 0.80
TVAE MLE(𝑄 𝑎𝑡𝑘 ) Tra_AUC 0.469±0.008 0.01 0.473±0.008 0.50 0.469±0.009 0.51 0.471±0.008 0.50 0.471±0.009 0.50 0.469±0.008 0.53 0.469±0.006 0.04 0.469±0.006 0.79
whether the dataset contains a watermark, and (ii) a tracing stage, which identifies the owner among the 105 registered data owners if a watermark is detected in the detection stage. 5.2.1 Detectability. Detectability measures how well a method distinguishes watermarked datasets from unwatermarked ones. We model the detecting stage as a binary classification task over 100 datasets: 50 watermarked (positive case) and 50 unwatermarked (negative case). The unwatermarked datasets are independently generated by TabDDPM [37]. Each watermarked dataset is generated by using a distinct secret key sampled uniformly from the 105 registered keys. For post-hoc methods (S2R2W [42], TabularMark [84], WGTD [28], PKF [11], B2Mark [83]), which embed watermark after data generation, we first generate datasets using TabDDPM and then embed watermarks. For generative methods (TabWak [85], MUSE [16]), which embed watermark during data generation, watermarked datasets are generated directly using their default procedures. To evaluate detectability, we compute 105 detection scores for each dataset against all 105 keys and take the maximum score as
the final score, representing the strongest evidence of watermark presence. Detectability is quantified by the Area Under the ROC Curve (AUC) computed from the 100 final scores of the 100 datasets, denoted as Det_AUC. A higher Det_AUC indicates better separation between watermarked and unwatermarked datasets. 5.2.2 Traceability. Traceability measures how well a method identifies the correct owner among all the data owners. We construct a binary classification task over 100 watermarked datasets including 50 positive cases and 50 negative cases. Each dataset is watermarked using a distinct secret key sampled from the 105 registered keys. For a positive case, the final score is the detection score computed using its ground-truth key. For a negative case, the final score is the maximum detection score obtained using all incorrect keys (i.e., the strongest false match among the remaining 105 − 1 keys). Traceability is quantified by the AUC of the ROC curve computed from these 100 final scores, denoted as Tra_AUC. A higher Tra_AUC indicates stronger owner discrimination. 5.2.3 Evaluation with varying thresholds. As described in Section 3.1, the final decision on the presence of a watermark is obtained by
Conference acronym ’XX, June 03–05, 2018, Woodstock, NY
comparing DS(𝜔) with a predefined threshold. In our evaluation, we use AUC as the evaluation metric, which summarizes detection performance over all possible thresholds. This is particularly useful in our setting, as different watermarking methods may produce detection scores with different scales. By measuring performance across varying thresholds, AUC enables a more comprehensive and fair comparison of both detectability and traceability across methods. Throughout the remainder of the paper, we use AUC to refer to either Det_AUC or Tra_AUC when the context is clear. 5.2.4 Evaluating robustness under attacks. To evaluate robustness under attacks, we apply each attack described in Section 4.2 to the watermarked datasets in the positive cases before computing detection scores. This setting applies to both the computation of Det_AUC and Tra_AUC.
5.3
Radioactivity against Retraining Attack
We evaluate robustness under retraining attack using the four generative models introduced in Section 4.2: TabDDPM, TabDiff, CTABGAN+, and TVAE. A higher robustness against retraining attack means a higher radioactivity of the watermark. For each watermarking method, we retrain the attack model on the watermarked dataset 𝑄 𝑤𝑚 and generate a new dataset 𝑄 𝑎𝑡𝑘 . The results on HS and HO are summarized in Table 2. As it is shown in Table 2, MLE(𝑄 𝑤𝑚 ) reports the mean ± standard deviation over the 50 watermarked datasets in the positive cases, and MLE(𝑄 𝑎𝑡𝑘 ) reports the corresponding results after performing retraining attack. Because all methods are constrained by the same MLE budget during embedding, the MLE(𝑄 𝑤𝑚 ) values are closely aligned across methods. This confirms that watermark strengths are comparable. Similarly, for each attack model, the MLE(𝑄 𝑎𝑡𝑘 ) values across methods are also close, since the same retraining procedure is applied. Therefore, the comparison in Table 2 reflects robustness differences rather than discrepancies in watermark strength or attack strength. 5.3.1 Main observation. RaMark consistently achieves the highest AUC under all four retraining models and on both datasets. In particular, RaMark maintains Det_AUC close to 1.00 for TabDDPM and TabDiff, and remains substantially higher than all baselines even under CTAB-GAN+ and TVAE. This empirical result directly validates the theoretical analysis in Remarks 1 and 2: when retraining preserves data utility (small distributional deviation), the elevated spectral power at frequency 𝜔 is preserved, and the detection score remains high. 5.3.2 Why baselines fail? The failure of baseline methods can be traced back to how their watermark signals are embedded. S2R2W and TabularMark rely on (virtual) primary keys derived from specific attribute values. After retraining, newly generated samples differ from the original ones, so the corresponding primary keys cannot be reconstructed. As a result, watermark localization fails and detection performance collapses. PKF embeds weak artificial correlations into the data distribution. Although these correlations are statistically detectable in the original watermarked dataset, they form only a minor component of the distribution and are not reliably reproduced by retrained
Anonymous
generative models. Consequently, the spectral signal weakens after retraining. WGTD embeds the watermark through independent numeric perturbations on selected values. Retrained models do not reproduce these exact perturbations, and thus the watermark signal disappears. TabWak depends on a deterministic mapping between latent seeds and generated samples. Retraining breaks this mapping, so the watermark cannot be reconstructed in 𝑄 𝑎𝑡𝑘 . MUSE embeds the watermark through a generation-time selection rule based on discrete bucket preferences. While this creates bias in the generated dataset, the rule itself is not encoded as a stable global dependency. Retrained models approximate the overall distribution but do not preserve this procedural selection mechanism, causing the watermark to vanish. 5.3.3 Detectability vs. traceability. In Table 2, S2R2W and B2Mark exhibit Tra_AUC values close to zero under retraining. Both methods encode the watermark as a bit sequence and compute detection scores using normalized Hamming similarity. After retraining, the recovered bit sequence is severely distorted, so the score under the correct key (positive case) becomes lower than the maximum score among incorrect keys (negative cases). This reversal drives Tra_AUC toward zero. By contrast, their Det_AUC values remain near 0.5, because in detectability evaluation both positive and negative cases use the maximum score over all keys, resulting in statistically indistinguishable score distributions after retraining. 5.3.4 Effect of retraining strength. Across TabDDPM, TabDiff, CTABGAN+, and TVAE, the MLE(𝑄 𝑎𝑡𝑘 ) values decrease progressively, indicating increasing distributional distortion caused by retraining. As predicted by the theoretical trade-off in Section 4.3, the AUC values of RaMark also decrease as MLE(𝑄 𝑎𝑡𝑘 ) decreases. However, even when MLE(𝑄 𝑎𝑡𝑘 ) drops by approximately 10% ∼ 15% relative to MLE(𝑄 𝑤𝑚 ), RaMark still maintains substantially higher AUC than all baselines. This confirms that the watermark embedded by RaMark is tightly coupled to the data distribution and therefore persists under distribution-preserving retraining.
5.4
Robustness to Data Modification Attacks
We next evaluate robustness under the four data modification attacks defined in Section 4.2, including noise addition (na), row deletion (rd), row insertion (ri), and column deletion (cd). 5.4.1 Utility under attack. Figure 5 reports MLE performance when attack strength increases. The curves from detectability and traceability experiments are nearly identical because they are derived from watermarked datasets with the same underlying distribution. For clarity, we therefore report only the MLE curves from the detectability experiments. Moreover, since all watermarking methods exhibit comparable MLE under the same attack on the same dataset, we report the mean and standard deviation of MLE across all methods for each attack setting. We can see from Figure 5 that the following three observations are consistent across all attacks. First, MLE(𝑄 𝑤𝑚 ) values are nearly identical across different watermarking methods, which confirms that the watermark strengths are aligned by the same MLE budget
RaMark: Radioactive Watermarking for Generated Tabular Data
0.70 0.65 0.60 0.55 0.0 0.2 0.4 0.6 0.8 1.0 (a) MLE on HS
MLE
MLE
noise addition row deletion row insertion column deletion 0.63 0.52 0.41 0.30 0.0 0.2 0.4 0.6 0.8 1.0 (b) MLE on HO
Figure 5: The mean and standard deviation of the MLE(𝑄 𝑤𝑚 ) and MLE(𝑄 𝑎𝑡𝑘 ) for all the watermarking methods in the detectability experiments. The 𝑥-axis shows the attack strength 𝜌 ∈ {𝜌𝑛𝑎 , 𝜌𝑟𝑑 , 𝜌𝑟𝑖 , 𝜌𝑐𝑑 } of each data modification attack. The 𝑦-axis shows the MLE for each attack. The leftmost point on each curve shows MLE(𝑄 𝑤𝑚 ) when the attack strength is zero, which means watermarked datasets are not attacked. The other points show MLE(𝑄 𝑎𝑡𝑘 ). The legend shows the markers for different data modification attacks. The standard deviation is shown by the error bar of each point on the curves, which can be better viewed when zoomed in.
constraint. Second, MLE(𝑄 𝑎𝑡𝑘 ) values are comparable with small standard deviation across watermarking methods under the same attack configuration, which means comparable attack strength is applied to all methods and thus ensures fair comparison of their watermark robustness. Third, as attack strength increases, MLE consistently decreases for all methods, which indicates stronger distortion of the data distribution. In practice, this means that increasing attack strength inevitably reduces data utility, which reinforces the trade-off discussed in Remark 1. 5.4.2 Detectability and traceability under attack. Figure 6 and Figure 7 report Det_AUC and Tra_AUC, respectively, under varying attack strengths. We analyze each attack type below. Noise addition. Noise addition perturbs every attribute value with random noise. Methods that rely on precise numeric perturbations of selected table entries (S2R2W, TabularMark, WGTD, B2Mark) exhibit rapidly decreasing AUC, since random noise directly disrupts their pointwise modifications. In contrast, PKF, TabWak, MUSE, and RaMark maintain higher AUC because their watermark signals are distributed across global statistical structure rather than individual values. Since moderate noise affects local values more than global dependencies, these methods are more robust. Row deletion. Row deletion removes a fraction of samples. S2R2W degrades quickly because it modifies only a subset of samples; deleting these samples directly removes watermark evidence. TabularMark, WGTD, and B2Mark also degrade because their detection relies on statistical aggregation over selected ranges; reducing sample size increases variance and weakens detection reliability. By contrast, PKF, TabWak, MUSE, and RaMark distribute watermark signals across many rows through attribute-level dependencies. Partial row removal preserves much of this structure, resulting in stronger robustness.
Conference acronym ’XX, June 03–05, 2018, Woodstock, NY
Row insertion. Row insertion adds new samples. S2R2W and TabularMark are vulnerable because they depend on virtual primary keys (VPKs); inserted rows may introduce key conflicts, leading to misidentification of watermarked samples [23]. WGTD and B2Mark also degrade because inserted rows alter attribute frequencies within watermark-encoded ranges. In contrast, PKF, TabWak, MUSE, and RaMark do not rely on VPKs and aggregate watermark signals across all rows. Inserted rows dilute but do not eliminate the embedded structural dependencies, so AUC remains comparatively high. Column deletion. Column deletion removes a fraction of attributes. WGTD, TabularMark, and B2Mark degrade because their detection relies on selected attribute subsets; removing these columns reduces valid statistical evidence. S2R2W remains relatively stable because it embeds watermark redundantly across columns, allowing detection as long as at least one watermarked column survives. PKF, TabWak, MUSE, and RaMark also maintain high AUC because their watermark is encoded through joint correlations in latent representations. Removing part of the attributes weakens but does not eliminate these correlations, thus the watermark signal is still preserved. 5.4.3 Summary. Across all four data modification attacks and both datasets, RaMark achieves the highest or near-highest AUC under comparable utility degradation. These empirical results align with the theoretical analysis in Remark 1 and Remark 3, that is, as long as the attacked dataset remains distributionally close to the watermarked dataset to preserve data utility, the watermark signal, which is embedded as a stable distribution-level sinusoidal dependency among attributes, remains detectable.
5.5
Parameter Analysis
RaMark involves two types of parameters with distinct roles. The first is the guidance strength 𝛼 in Equation (9), which controls the strength of watermark guidance during the diffusion sampling process. The second is a set of mapping parameters, including the bin width 𝛽 and the scaling factor 𝑠 in Equation (2), which determine how data samples are mapped into the discrete-time signal used for spectral analysis. In this subsection, we focus on analyzing 𝛼. The sensitivity of 𝛽 and 𝑠 is provided in Appendix A.4, where we show that RaMark remains stable across a wide range of these signal-construction parameters. As shown in Figure 8, we study how 𝛼 affects the trade-off between watermark detectability and data utility. we report both the detection score 𝐷𝑆 (𝜔) and MLE under different values of 𝛼 on HS and HO. When 𝛼 increases, DS(𝜔) increases monotonically and quickly approaches 1.0. This behavior follows directly from Equation (9): a larger 𝛼 amplifies the mean shift 𝛼 (Σ · 𝑔𝑧 ) in each reverse denoising step, which steers generated samples closer to the predefined sinusoidal dependency. Consequently, the spectral power 𝐿(𝜔) at frequency 𝜔 increases, the false alarm probability FAP(𝜔) decreases, and the detection score DS(𝜔) = 1 − FAP(𝜔) increases. When 𝛼 is sufficiently large, the embedded watermark becomes highly prominent and is detected with near-perfect confidence.
Conference acronym ’XX, June 03–05, 2018, Woodstock, NY
0.50 0.0 0.2 0.4 0.6 0.8 1.0 na
1.00 0.75 0.50 0.0 0.2 0.4 0.6 0.8 1.0 na
0.75 0.50 0.0 0.2 0.4 0.6 0.8 1.0 rd
0.75 0.50 0.0 0.2 0.4 0.6 0.8 1.0 ri
1.00 0.75 0.50 0.0 0.2 0.4 0.6 0.8 1.0 ri
(e) Row Insertion, HS
B2Mark
RaMark
1.00 0.75 0.50 0.0 0.2 0.4 0.6 0.8 1.0 rd
(c) Row Deletion, HS
Det_AUC
1.00
MUSE
1.00
(b) Noise Addition, HO
Det_AUC
Det_AUC
(a) Noise Addition, HS
TabWak
Det_AUC
0.75
PKF
1.00 0.75 0.50 0.0 0.1 0.2 0.3 0.4 0.5 cd
(f) Row Insertion, HO
(d) Row Deletion, HO
Det_AUC
1.00
WGTD
Det_AUC
TabularMark Det_AUC
Det_AUC
S2R2W
Anonymous
1.00 0.75 0.50 0.0 0.1 0.2 0.3 0.4 0.5 cd
(g) Column Deletion, HS
(h) Column Deletion, HO
Figure 6: The Det_AUC under different attack strengths. The attack strengths 𝜌𝑛𝑎 , 𝜌𝑟𝑑 , 𝜌𝑟𝑖 , 𝜌𝑐𝑑 are defined in Section 4.2.
0.00 0.0 0.2 0.4 0.6 0.8 1.0 na
1.00 0.50 0.00 0.0 0.2 0.4 0.6 0.8 1.0 na
0.50 0.00 0.0 0.2 0.4 0.6 0.8 1.0 rd
0.50 0.00 0.0 0.2 0.4 0.6 0.8 1.0 ri
1.00 0.50 0.00 0.0 0.2 0.4 0.6 0.8 1.0 ri
(e) Row Insertion, HS
B2Mark
RaMark
1.00 0.50 0.00 0.0 0.2 0.4 0.6 0.8 1.0 rd
(c) Row Deletion, HS
Tra_AUC
1.00
MUSE
1.00
(b) Noise Addition, HO
Tra_AUC
Tra_AUC
(a) Noise Addition, HS
TabWak
Tra_AUC
0.50
PKF
1.00 0.50 0.00 0.0 0.1 0.2 0.3 0.4 0.5 cd
(f) Row Insertion, HO
(g) Column Deletion, HS
(d) Row Deletion, HO
Tra_AUC
1.00
WGTD
Tra_AUC
TabularMark Tra_AUC
Tra_AUC
S2R2W
1.00 0.50 0.00 0.0 0.1 0.2 0.3 0.4 0.5 cd (h) Column Deletion, HO
Figure 7: The Tra_AUC under different attack strengths. The attack strengths 𝜌𝑛𝑎 , 𝜌𝑟𝑑 , 𝜌𝑟𝑖 , 𝜌𝑐𝑑 are defined in Section 4.2. MLE
15 (a) HS
1.00
0.63
0.50
0.58
0.00
MLE
( )
MLE
0
DS
( ) DS
0.50 0.00
( ) 0.72 0.71 0.70 30 DS
1.00
0
15
0.53 30
(b) HO
Figure 8: The effect of the guidance strength 𝛼. At the same time, MLE gradually decreases as 𝛼 increases. This is because increasing 𝛼 strengthens the watermark guidance term and shifts samples further away from the distribution learned from 𝑄𝑜𝑟𝑖 . While this improves watermark alignment, it also introduces distributional distortion that reduces sample fidelity and degrades the performance of downstream learning tasks, which manifests as lower MLE.
Overall, the results demonstrate a clear and controlled tradeoff governed by 𝛼. Smaller 𝛼 preserves data utility (high MLE) but yields weaker watermark signals (lower DS(𝜔)), whereas larger 𝛼 strengthens watermark signal at the cost of reduced data utility. This trade-off between watermark and data utility is consistent with prior watermarking studies [11, 33, 38, 83] and aligns with the theoretical utility–watermark trade-off established in Section 4.3. In practice, setting 𝛼 in the range of [5, 10] is sufficient to achieve strong detectability while maintaining good data utility on both datasets.
6
Conclusion
In this paper, we study radioactive watermarking for generated tabular data under retraining attacks, where an adversary trains a new generative model on a watermarked dataset and regenerates data that removes the watermark signal while preserving data
RaMark: Radioactive Watermarking for Generated Tabular Data
utility. This problem arises in machine learning systems for generated data sharing and trading, especially in privacy-sensitive domains where the original data cannot be released directly. In such settings, watermarking provides a principled mechanism for ownership verification through detection and traceability after sharing or redistribution. We show that existing watermarking methods fail to achieve radioactivity, as their signals are not embedded as intrinsic distributional properties and are therefore not preserved under retraining. To address this challenge, we propose RaMark, which embeds watermark signals as sinusoidal dependencies in the data distribution through watermark-guided diffusion sampling. Our theoretical analysis establishes a principled link between distribution preservation, spectral power preservation, and watermark robustness. In particular, we show that preserving data utility implies persistence of the watermark signal, which leads to an inherent utility–watermark trade-off for adversaries. Extensive experiments on two real-world datasets demonstrate that RaMark consistently achieves substantially higher detectability and traceability than state-of-the-art baselines while operating under the same data utility budget under both retraining attacks and data modification attacks. RaMark currently focuses on tabular datasets with at least two continuous-valued attributes. Extending radioactive watermarking to categorical or textual attributes remains an important direction for future work.
References [1] Rakesh Agrawal, Peter J Haas, and Jerry Kiernan. 2003. Watermarking relational data: Framework, algorithms and analysis. The VLDB Journal 12 (2003), 157–169. [2] Rakesh Agrawal and Jerry Kiernan. 2002. Watermarking relational databases. International Conference on Very Large Databases 12 (2002), 155–166. [3] Omar Y Al-Jarrah, Paul D Yoo, Sami Muhaidat, George K Karagiannidis, and Kamal Taha. 2015. Efficient machine learning for big data: A review. Big Data Research 2 (2015), 87–93. [4] Zamil S Alzamil and Miklos A Vasarhelyi. 2019. A new model for effective and efficient open government data. International Journal of Disclosure and Governance 16 (2019), 174–187. [5] André Bauer, Simon Trapp, Michael Stenger, Robert Leppich, Samuel Kounev, Mark Leznik, Kyle Chard, and Ian Foster. 2024. Comprehensive exploration of synthetic data generation: A survey. arXiv preprint arXiv:2401.02524 (2024). [6] Konrad Bogner, Florian Pappenberger, and Hannah L Cloke. 2012. The normal quantile transformation and its application in a flood forecasting system. Hydrology and Earth System Sciences 16 (2012), 1085–1094. [7] Hanqun Cao, Cheng Tan, Zhangyang Gao, Yilun Xu, Guangyong Chen, PhengAnn Heng, and Stan Z Li. 2024. A survey on generative diffusion models. IEEE Transactions on Knowledge and Data Engineering 36 (2024), 2814–2830. [8] Cinzia Cappiello, Marco Gribaudo, Pierluigi Plebani, Mattia Salnitri, and Letizia Tanca. 2022. Enabling real-world medicine with data lake federation: A research perspective. International Conference on Very Large Databases (2022), 39–56. [9] George Casella and Roger Berger. 2024. Statistical inference. Chapman and Hall/CRC. [10] Taha Ceritli, Ghadeer O Ghosheh, Vinod Kumar Chauhan, Tingting Zhu, Andrew P Creagh, and David A Clifton. 2023. Synthesizing mixed-type electronic health records using diffusion models. arXiv preprint arXiv:2302.14679 (2023). [11] Xin Che, Mohammad Akbari, Shaoxin Li, David Yue, Yong Zhang, and Lingyang Chu. 2025. Primary key free watermarking for numerical tabular datasets in machine learning. International Conference on Pattern Recognition (2025), 254– 270. [12] Yuzhuo Chen, Zehua Ma, Han Fang, Weiming Zhang, and Nenghai Yu. 2025. TAG-WM: Tamper-aware generative image watermarking via diffusion inversion sensitivity. arXiv preprint arXiv:2506.23484 (2025). [13] Prafulla Dhariwal and Alexander Nichol. 2021. Diffusion models beat GANs on image synthesis. Advances in Neural Information Processing Systems 34 (2021), 8780–8794. [14] Yuntao Du and Ninghui Li. 2024. Systematic assessment of tabular data synthesis algorithms. arXiv preprint arXiv:2402.06806 (2024).
Conference acronym ’XX, June 03–05, 2018, Woodstock, NY
[15] David A Edwards. 2011. On the kantorovich–rubinstein theorem. Expositiones Mathematicae 29 (2011), 387–398. [16] Liancheng Fang, Aiwei Liu, Henry Peng Zou, Yankai Chen, Hengrui Zhang, Zhongfen Deng, and Philip S Yu. 2025. MUSE: Model-agnostic tabular watermarking via multi-sample selection. arXiv preprint arXiv:2505.24267 (2025). [17] Mohammad Navid Fekri, Ananda Mohon Ghosh, and Katarina Grolinger. 2019. Generating energy data for machine learning with recurrent generative adversarial networks. Energies 13 (2019), 130. [18] Pierre Fernandez, Guillaume Couairon, Hervé Jégou, Matthijs Douze, and Teddy Furon. 2023. The stable signature: Rooting watermarks in latent diffusion models. International Conference on Computer Vision (2023), 22466–22477. [19] Lin Geng Foo, Hossein Rahmani, and Jun Liu. 2025. AI-generated content for various data modalities: A survey. Comput. Surveys 57 (2025), 1–66. [20] Paul H Garthwaite, Ian T Jolliffe, and Byron Jones. 2002. Statistical inference. OUP Oxford. [21] Mehdi Ben Ghali, Gouenou Coatrieux, and Reda Bellafqira. 2025. Radioactive tabular datasets to detect unauthorized machine learning. Advances in Signal Processing and Artificial Intelligence (2025), 206–211. [22] Maikel Lázaro Pérez Gort, Claudia Feregrino-Uribe, Agostino Cortesi, and Félix Fernández-Peña. 2019. HQR-scheme: A high quality and resilient virtual primary key generation approach for watermarking relational data. Expert Systems with Applications 138 (2019), 795–825. [23] Maikel Lázaro Pérez Gort, Claudia Feregrino-Uribe, Agostino Cortesi, and Félix Fernández-Pena. 2020. A double fragmentation approach for improving virtual primary key-based watermark synchronization. IEEE Access 8 (2020), 504–516. [24] Bochao Gu, Hengzhi He, and Guang Cheng. 2024. Watermarking generative categorical data. arXiv preprint arXiv:2411.10898 (2024). [25] Yuxuan Guo, Zhiliang Tian, Yiping Song, Tianlun Liu, Liang Ding, and Dongsheng Li. 2024. Context-aware watermark with semantic balanced green-red lists for large language models. Conference on Empirical Methods in Natural Language Processing (2024), 22633–22646. [26] Gaurav Gupta and Josef Pieprzyk. 2009. Database relation watermarking resilient against secondary watermarking attacks. Information Systems Security 1 (2009), 222–236. [27] Gaurav Gupta and Josef Pieprzyk. 2009. Reversible and blind database watermarking using difference expansion. International Journal of Digital Crime and Forensics 1 (2009), 42–54. [28] Hengzhi He, Peiyu Yu, Junpeng Ren, Ying Nian Wu, and Guang Cheng. 2024. Watermarking generative tabular data. arXiv preprint arXiv:2405.14018 (2024). [29] Jonathan Ho, Ajay Jain, and Pieter Abbeel. 2020. Denoising diffusion probabilistic models. Advances in Neural Information Processing Systems 33 (2020), 6840–6851. [30] Donghui Hu, Dan Zhao, and Shuli Zheng. 2018. A new robust approach for reversible database watermarking with distortion control. IEEE Transactions on Knowledge and Data Engineering 31 (2018), 1024–1037. [31] Mustafa Bilgehan Imamoglu, Mustafa Ulutas, and Guzin Ulutas. 2017. A new reversible database watermarking approach with firefly optimization algorithm. Mathematical Problems in Engineering 2017 (2017). [32] Fengwei Jia, Hongli Zhu, Fengyuan Jia, Xinyue Ren, Siqi Chen, Hongming Tan, and Wai Kin Victor Chan. 2024. A tabular data generation framework guided by downstream tasks optimization. Scientific Reports 14 (2024), 15267. [33] Muhammad Kamran and Muddassar Farooq. 2018. A comprehensive survey of watermarking relational databases research. arXiv preprint arXiv:1801.08271 (2018). [34] G Charbel N Kindji, Lina Maria Rojas-Barahona, Elisa Fromont, and Tanguy Urvoy. 2024. Under the hood of tabular data generation models: The strong impact of hyperparameter tuning. arXiv preprint arXiv:2406.12945 (2024). [35] John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. 2023. A watermark for large language models. International Conference on Machine Learning (2023), 17061–17084. [36] Heejoon Koo. 2023. A survey on generative diffusion models for structured data. arXiv preprint arXiv:2306.04139 (2023). [37] Akim Kotelnikov, Dmitry Baranchuk, Ivan Rubachev, and Artem Babenko. 2023. Tabddpm: Modelling tabular data with diffusion models. International Conference on Machine Learning (2023), 17564–17579. [38] Sanjay Kumar, Binod Kumar Singh, and Mohit Yadav. 2020. A recent survey on multimedia and database watermarking. Multimedia Tools and Applications 79 (2020), 149–197. [39] Neetu Kumari and Enayat Rajabi. 2024. A comparative exploration of two diffusion generative models on tabular data synthesis. International Journal of Data Science and Analytics (2024), 1–12. [40] De Zhang Lee, Han Fang, Hanyi Wang, and Ee-Chien Chang. 2025. Removal Attack and Defense on AI-generated Content Latent-based Watermarking. In ACM SIGSAC Conference on Computer and Communications Security. 2174–2188. [41] Kexin Li, Guozhen Ding, Ilya Grishchenko, and David Lie. 2025. HMARK: Radioactive multi-bit semantic-latent watermarking for diffusion models. arXiv preprint arXiv:2512.00094 (2025). [42] Wenling Li, Ning Li, Jianen Yan, Zhaoxin Zhang, Ping Yu, and Gang Long. 2022. Secure and high-quality watermarking algorithms for relational database based
Conference acronym ’XX, June 03–05, 2018, Woodstock, NY
on semantic. IEEE Transactions on Knowledge and Data Engineering 35 (2022), 7440–7456. [43] Yingjiu Li, Vipin Swarup, and Sushil Jajodia. 2005. Fingerprinting relational databases: Schemes and specialties. IEEE Transactions on Dependable and Secure Computing 2 (2005), 34–45. [44] Fan Liu, Zhiyong Cheng, Huilin Chen, Yinwei Wei, Liqiang Nie, and Mohan Kankanhalli. 2022. Privacy-preserving synthetic data generation for recommendation systems. In International ACM SIGIR Conference on Research and Development in Information Retrieval. 1379–1389. [45] Qiang Liu, Hequ Xian, Jiancheng Zhang, and Kunpeng Liu. 2022. A random reversible watermarking scheme for relational data. International Conference on Security and Privacy in Communication Systems (2022), 413–430. [46] Nicholas R Lomb. 1976. Least-squares frequency analysis of unequally spaced data. Astrophysics and Space Science 39 (1976), 447–462. [47] Peizhuo Lv, Mengjie Sun, Hao Wang, Xiaofeng Wang, Shengzhi Zhang, Yuxuan Chen, Kai Chen, and Limin Sun. 2025. Rag-wm: An efficient black-box watermarking approach for retrieval-augmented generation of large language models. In ACM SIGSAC Conference on Computer and Communications Security. 1709–1723. [48] Colin McDiarmid. 1998. Concentration. In Probabilistic Methods for Algorithmic Discrete Mathematics. Springer, 195–248. [49] Dung Daniel Ngo, Daniel Scott, Saheed Obitayo, Vamsi K Potluru, and Manuela Veloso. 2024. Adaptive and robust watermark for generative tabular data. arXiv preprint arXiv:2409.14700 (2024). [50] Adedoyin Tolulope Oyewole, Bisola Beatrice Oguejiofor, Nkechi Emmanuella Eneh, Chidiogo Uzoamaka Akpuokwe, and Seun Solomon Bakare. 2024. Data privacy laws and their impact on financial technology companies: A review. Computer Science & IT Research Journal 5 (2024), 628–650. [51] Bo Peng, Robert K Yu, Kevin L DeHoff, and Christopher I Amos. 2007. Normalizing a large number of quantitative traits using empirical normal quantile transformation. BMC Proceedings 1 (2007), 156–168. [52] Vamsi K Potluru, Daniel Borrajo, Andrea Coletta, Niccolò Dalmasso, Yousef El-Laham, Elizabeth Fons, Mohsen Ghassemi, Sriram Gopalakrishnan, Vikesh Gosai, Eleonora Kreačić, et al. 2023. Synthetic data applications in finance. arXiv preprint arXiv:2401.00081 (2023). [53] Liudmila Prokhorenkova, Gleb Gusev, Aleksandr Vorobev, Anna Veronika Dorogush, and Andrey Gulin. 2018. CatBoost: Unbiased boosting with categorical features. Advances in Neural Information Processing Systems 31 (2018). [54] Zhaozhi Qian, Thomas Callender, Bogdan Cebere, Sam M Janes, Neal Navani, and Mihaela van der Schaar. 2024. Synthetic data for privacy-preserving clinical risk prediction. Scientific Reports 14 (2024), 25676. [55] Zhaozhi Qian, Rob Davis, and Mihaela van der Schaar. 2023. Synthcity: A benchmark framework for diverse use cases of tabular synthetic data. Advances in Neural Information Processing Systems 36 (2023), 3173–3188. [56] Zhiwen Ren, Han Fang, Jie Zhang, Zehua Ma, Ronghao Lin, Weiming Zhang, and Nenghai Yu. 2023. A robust database watermarking scheme that preserves statistical characteristics. IEEE Transactions on Knowledge and Data Engineering 36 (2023), 2329–2342. [57] Alexandre Sablayrolles, Matthijs Douze, Cordelia Schmid, and Hervé Jégou. 2020. Radioactive data: Tracing through training. International Conference on Machine Learning (2020), 8326–8335. [58] Tom Sander, Pierre Fernandez, Alain Durmus, Matthijs Douze, and Teddy Furon. 2024. Watermarking makes language models radioactive. Advances in Neural Information Processing Systems 37 (2024), 21079–21113. [59] Timur Sattarov, Marco Schreyer, and Damian Borth. 2023. Findiff: Diffusion models for financial tabular data generation. International Conference on AI in Finance (2023), 64–72. [60] Francesc Sebé, Josep Domingo-Ferrer, and Jordi Castella-Roca. 2006. Watermarking numerical data in the presence of noise. International Journal of Uncertainty, Fuzziness and Knowledge-Based Systems 14 (2006), 495–508. [61] Francesc Sebé, Josep Domingo-Ferrer, and Agustí Solanas. 2005. Noise-robust watermarking for numerical datasets. Modeling Decisions for Artificial Intelligence (2005), 134–143. [62] Mohamed Shehab, Elisa Bertino, and Arif Ghafoor. 2007. Watermarking relational databases using optimization-based techniques. IEEE Transactions on Knowledge and Data Engineering 20 (2007), 116–129. [63] Juntong Shi, Minkai Xu, Harper Hua, Hengrui Zhang, Stefano Ermon, and Jure Leskovec. 2024. Tabdiff: A mixed-type diffusion model for tabular data generation. arXiv preprint arXiv:2410.20626 (2024). [64] Ruxue Shi, Yili Wang, Mengnan Du, Xu Shen, and Xin Wang. 2025. A comprehensive survey of synthetic tabular data generation. arXiv preprint arXiv:2504.16506 (2025). [65] Dalbir Singh. 2020. Towards data privacy and security framework in big data governance. International Journal of Software Engineering and Computer Systems 6 (2020), 41–51. [66] Radu Sion, Mikhail Atallah, and Sunil Prabhakar. 2003. Rights protection for relational data. International Conference on Management of Data (2003), 98–109. [67] Mihaela CÄ Stoian, Eleonora Giunchiglia, and Thomas Lukasiewicz. 2025. A survey on tabular data generation: Utility, alignment, fidelity, privacy, and beyond.
Anonymous
arXiv preprint arXiv:2503.05954 (2025). [68] Jacob T VanderPlas. 2018. Understanding the lomb–scargle periodogram. The Astrophysical Journal Supplement Series 236 (2018), 1–16. [69] Joaquin Vanschoren, Jan N Van Rijn, Bernd Bischl, and Luis Torgo. 2014. OpenML: Networked science in machine learning. ACM SIGKDD Explorations Newsletter 15 (2014), 49–60. [70] Alex X Wang, Binh P Nguyen, and Colin R Simpson. 2025. Generative AI for tabular data synthesis. Pacific-Asia Conference on Knowledge Discovery and Data Mining (2025), 381–398. [71] Chundong Wang and Yue Li. 2023. A copyright authentication method balancing watermark robustness and data distortion. International Conference on Computer Supported Cooperative Work in Design (2023), 1178–1183. [72] Peiran Wang, Qiyu Li, Longxuan Yu, Ziyao Wang, Ang Li, and Haojian Jin. 2024. Moderator: Moderating text-to-image diffusion models through fine-grained context-based policies. In ACM SIGSAC Conference on Computer and Communications Security. 1181–1195. [73] Shu Wang, Kun Sun, and Yan Zhai. 2024. Dye4AI: Assuring Data Boundary on Generative AI Services. In ACM SIGSAC Conference on Computer and Communications Security. 2281–2295. [74] Yuxin Wang, Duanyu Feng, Yongfu Dai, Zhengyu Chen, Jimin Huang, Sophia Ananiadou, Qianqian Xie, and Hao Wang. 2024. HARMONIC: Harnessing LLMs for tabular data synthesis and privacy protection. arXiv preprint arXiv:2408.02927 (2024). [75] Yuxin Wen, John Kirchenbauer, Jonas Geiping, and Tom Goldstein. 2023. Treerings watermarks: Invisible fingerprints for diffusion images. Advances in Neural Information Processing Systems 36 (2023), 58047–58063. [76] Lei Xu, Maria Skoularidou, Alfredo Cuesta-Infante, and Kalyan Veeramachaneni. 2019. Modeling tabular data using conditional GAN. Advances in Neural Information Processing Systems 32 (2019). [77] Ling Yang, Zhilong Zhang, Yang Song, Shenda Hong, Runsheng Xu, Yue Zhao, Wentao Zhang, Bin Cui, and Ming-Hsuan Yang. 2023. Diffusion models: A comprehensive survey of methods and applications. Comput. Surveys 56 (2023), 1–39. [78] Hengrui Zhang, Jiani Zhang, Balasubramaniam Srinivasan, Zhengyuan Shen, Xiao Qin, Christos Faloutsos, Huzefa Rangwala, and George Karypis. 2023. Mixedtype tabular data synthesis with score-based diffusion in latent space. arXiv preprint arXiv:2310.09656 (2023). [79] Xuandong Zhao, Prabhanjan Ananth, Lei Li, and Yu-Xiang Wang. 2023. Provable robust watermarking for AI-generated text. arXiv preprint arXiv:2306.17439 (2023). [80] Yunqing Zhao, Tianyu Pang, Chao Du, Xiao Yang, Ngai-Man Cheung, and Min Lin. 2023. A recipe for watermarking diffusion models. arXiv preprint arXiv:2303.10137 (2023). [81] Zilong Zhao, Aditya Kunar, Robert Birke, and Lydia Y Chen. 2021. Ctab-gan: Effective table data synthesizing. Asian Conference on Machine Learning (2021), 97–112. [82] Zilong Zhao, Aditya Kunar, Robert Birke, Hiek Van der Scheer, and Lydia Y Chen. 2024. Ctab-gan+: Enhancing tabular data synthesis. Frontiers in Big Data 6 (2024), 1–12. [83] Yihao Zheng, Jinfei Liu, Kui Ren, and Li Xiong. 2025. B2Mark: A blind and buyertraceable watermarking scheme for tabular datasets. International Conference on Management of Data 3 (2025), 1–26. [84] Yihao Zheng, Haocheng Xia, Junyuan Pang, Jinfei Liu, Kui Ren, Lingyang Chu, Yang Cao, and Li Xiong. 2024. Tabularmark: Watermarking tabular datasets for machine learning. In ACM SIGSAC Conference on Computer and Communications Security. 3570–3584. [85] Chaoyi Zhu, Jiayi Tang, Jeroen M Galjaard, Pin-Yu Chen, Robert Birke, Cornelis Bos, Lydia Y Chen, et al. 2025. TabWak: A Watermark for tabular diffusion models. International Conference on Learning Representations (2025), 1–28.
RaMark: Radioactive Watermarking for Generated Tabular Data
Conference acronym ’XX, June 03–05, 2018, Woodstock, NY
A Appendix A.1 Theoretical Analysis and Proof
By the triangle inequality, |𝐿𝐴 (𝜔) − 𝐿𝐵 (𝜔)|
Theorem 3.1. Given 𝑝𝜃 (𝑧𝑡 | 𝑧𝑡 +1 ) = N 𝑧𝑡 ; 𝜇, Σ , the reweighted density 𝑝𝜃 (𝑧𝑡 | 𝑧𝑡 +1 ) Pr(𝑊 | 𝑧𝑡 ) is approximated by 𝑝𝜃 (𝑧𝑡 | 𝑧𝑡 +1 ) Pr(𝑊 | 𝑧𝑡 ) ≈ N 𝑧𝑡 ; 𝜇 + Σ · 𝑔𝑧 , Σ ,
=| (𝐿𝐴 (𝜔) − E[𝐿𝐴 (𝜔)]) + (E[𝐿𝐴 (𝜔)] − E[𝐿𝐵 (𝜔)])
where 𝑔𝑧 = ∇𝑧𝑡 log Pr(𝑊 | 𝑧𝑡 ) 𝑧𝑡 =𝜇 is the gradient of log Pr(𝑊 | 𝑧𝑡 ) at 𝑧𝑡 = 𝜇, and Σ · 𝑔𝑧 denotes matrix-vector multiplication.
(12)
where 𝐴 is a constant. Then we approximate log Pr(𝑊 | 𝑧𝑡 ) using a Taylor expansion around 𝑧𝑡 = 𝜇 as log Pr(𝑊 | 𝑧𝑡 ) ≈ log Pr(𝑊 | 𝑧𝑡 ) 𝑧𝑡 =𝜇 + (𝑧𝑡 − 𝜇)∇𝑧𝑡 log Pr(𝑊 | 𝑧𝑡 ) 𝑧𝑡 =𝜇
(15)
≤|𝐿𝐴 (𝜔) − E[𝐿𝐴 (𝜔)]| + |𝐿𝐵 (𝜔) − E[𝐿𝐵 (𝜔)] | + |E[𝐿𝐴 (𝜔)] − E[𝐿𝐵 (𝜔)] | . Hence, for any 𝜖 > 0, Pr(|𝐿𝐴 (𝜔) − 𝐿𝐵 (𝜔)| ≥ 𝜖) ≤ Pr |𝐿𝐴 (𝜔) − E[𝐿𝐴 (𝜔)] | + |𝐿𝐵 (𝜔) − E[𝐿𝐵 (𝜔)] |
Proof. By the definition of 𝑝𝜃 (𝑧𝑡 | 𝑧𝑡 +1 ), we have 1 log 𝑝𝜃 (𝑧𝑡 | 𝑧𝑡 +1 ) = − (𝑧𝑡 − 𝜇)𝑇 Σ −1 (𝑧𝑡 − 𝜇) + 𝐴, 2
+ (E[𝐿𝐵 (𝜔)] − 𝐿𝐵 (𝜔)) |
(13)
=(𝑧𝑡 − 𝜇)𝑔𝑧 + 𝐴1 . Here, 𝑔𝑧 = ∇𝑧𝑡 log Pr(𝑊 | 𝑧𝑡 ) 𝑧𝑡 =𝜇 , and 𝐴1 is a constant. This gives
log 𝑝𝜃 (𝑧𝑡 | 𝑧𝑡 +1 ) Pr(𝑊 | 𝑧𝑡 ) 1 ≈ − (𝑧𝑡 − 𝜇)𝑇 Σ −1 (𝑧𝑡 − 𝜇) + (𝑧𝑡 − 𝜇)𝑔𝑧 + 𝐴2 2 1 1 = − (𝑧𝑡 − 𝜇 − Σ · 𝑔𝑧 )𝑇 Σ −1 (𝑧𝑡 − 𝜇 − Σ · 𝑔𝑧 ) + 𝑔⊤ Σ · 𝑔𝑧 + 𝐴2 2 2 1 = − (𝑧𝑡 − 𝜇 − Σ · 𝑔𝑧 )𝑇 Σ −1 (𝑧𝑡 − 𝜇 − Σ · 𝑔𝑧 ) + 𝐴3 2 (14) The quadratic term in the above expression is exactly the exponent of a Gaussian density with mean 𝜇 + Σ · 𝑔𝑧 and covariance Σ. We have thus found that the conditional reverse transition can be approximated by a Gaussian similar to the unconditional reverse transition, but with its mean shifted by Σ · 𝑔𝑧 . □
+ |E[𝐿𝐴 (𝜔)] − E[𝐿𝐵 (𝜔)] | ≥ 𝜖 . (16) By the union bound, Pr(|𝐿𝐴 (𝜔) − 𝐿𝐵 (𝜔)| ≥ 𝜖) is divided to three parts: Pr(|𝐿𝐴 (𝜔) − 𝐿𝐵 (𝜔)| ≥ 𝜖) 𝜖 𝜖 + Pr |𝐿𝐵 (𝜔) − E[𝐿𝐵 (𝜔)] | ≥ ≤ Pr |𝐿𝐴 (𝜔) − E[𝐿𝐴 (𝜔)] | ≥ 3 3 𝜖 + Pr |E[𝐿𝐴 (𝜔)] − E[𝐿𝐵 (𝜔)] | ≥ 3 (17) We next analyze the first two terms and the third term in Equation (17) separately. (I) Concentration via McDiarmid’s inequality. We apply McDiarmid’s inequality [48] to 𝐿𝐴 (𝜔), and the same argument applies to 𝐿𝐵 (𝜔). For McDiarmid’s inequality, we need coordinate-wise sensitivity constants 𝑐𝑘 [48]. Formally, 𝑐𝑘 := sup |𝐿(𝑆) − 𝐿(𝑆 ′ )|
(18)
𝑆,𝑆 ′
where 𝑆 and 𝑆 ′ only 𝑘-the entry differs. Since sampling times are identical and fixed across the two discrete-time signals, i.e., 𝑢¯𝐴𝑗 = 𝑢¯𝐵𝑗 = 𝑢¯ 𝑗 , ∀𝑗 ∈ {1, . . . , ℓ }, we have |𝐿(𝑆) − 𝐿(𝑆 ′ )| ≤
𝜕𝐿 · |𝑣¯𝑘 − 𝑣¯𝑘′ | 𝜕¯ 𝑣¯𝑘 ∈ [ −𝑉 ,𝑉 ] 𝑣 𝑘 sup
(19) ≤ 2𝑉
𝜕𝐿 . 𝜕¯ 𝑣¯𝑘 ∈ [ −𝑉 ,𝑉 ] 𝑣 𝑘 sup
Thus, Theorem 4.1 (Probabilistic Bound on Spectral Power Difference). For any 𝜖 > 0, ℓ𝜖 2 𝐶 W (𝑃 , 𝑃 ) 2 1 𝐴 𝐵 Pr |𝐿𝐴 (𝜔) − 𝐿𝐵 (𝜔)| ≥ 𝜖 ≤ 4 exp − , + 𝐶1 𝜖 4
2
2 2
2
2
/𝜎 ) where 𝐶 1 = 288𝑉 (1+𝑉 and 𝐶 2 = 12𝑉 (𝑉𝜎 4 +𝜎 ) . 𝜎4
Proof. Without loss of generality, we assume 𝑢¯𝐴𝑗 = 𝑢¯𝐵𝑗 = 𝑢¯ 𝑗 , ∀𝑗 ∈ {1, . . . , ℓ }, due to the following reasons: (1) 𝑆𝐴 and 𝑆 𝐵 are mapped by 𝜑 using the same secret key, thus the 𝑢-coordinates of the same bin are the same; and (2) extra bins in either 𝑆𝐴 and 𝑆 𝐵 can be clipped to ensure the one-to-one match of the 𝑢-coordinates in 𝑆𝐴 and 𝑆 𝐵 . Since we focus only on the spectral power at frequency 𝜔, we simplify notation by writing 𝐿𝐴 (𝜔) and 𝐿𝐵 (𝜔) as 𝐿𝐴 and 𝐿𝐵 , respectively.
𝑐𝑘 ≤ 2𝑉
𝜕𝐿 . 𝜕¯ 𝑣¯𝑘 ∈ [ −𝑉 ,𝑉 ] 𝑣 𝑘 sup
(20)
By the definition of Lomb-Scargle Periodogram[68], 1 𝑁𝑐2 𝑁𝑠2 𝐿(𝑆) = + , (21) 2ℓ𝜎 2 𝐷𝑐 𝐷𝑠 where ℓ ℓ ∑︁ ∑︁ 𝑁𝑐 = 𝑣¯𝑗 cos 2𝜋𝜔 (𝑢¯ 𝑗 − 𝜏) , 𝐷𝑐 = cos2 2𝜋𝜔 (𝑢¯ 𝑗 − 𝜏) , 𝑗=1
𝑁𝑠 =
ℓ ∑︁ 𝑗=1
𝑗=1
𝑣¯𝑗 sin 2𝜋𝜔 (𝑢¯ 𝑗 − 𝜏) ,
𝐷𝑠 =
ℓ ∑︁
sin2 2𝜋𝜔 (𝑢¯ 𝑗 − 𝜏) ,
𝑗=1
and 𝜏 is the phase-shift term depending only on the sample times 𝑢¯ 𝑗 , i.e., Í𝑙 sin (4𝜋𝜔𝑢¯ 𝑗 ) 1 𝑗=1 𝜏= tan−1 Í𝑙 . 4𝜋𝜔 𝑗=1 cos (4𝜋𝜔𝑢¯ 𝑗 )
Conference acronym ’XX, June 03–05, 2018, Woodstock, NY
Anonymous
Since 𝐷𝑐 , 𝐷𝑠 and 𝜏 depend only on 𝑢¯ 𝑗 , not on the 𝑣¯𝑗 , according to the Quotient rule2 , differentiating with respect to 𝑣¯𝑘 is 𝑁 𝜕𝑁 1 𝜕(𝜎 −2 ) 𝑁𝑐2 𝑁𝑠2 𝑁𝑠 𝜕𝑁𝑠 𝜕𝐿 𝑐 𝑐 = +2 + + 𝜎 −2 2 . 𝜕¯𝑣𝑘 2ℓ 𝜕¯𝑣𝑘 𝐷𝑐 𝐷𝑠 𝐷𝑐 𝜕¯𝑣𝑘 𝐷𝑠 𝜕¯𝑣𝑘 (22) Furthermore, we have 𝜕(𝜎 −2 ) −2¯𝑣𝑘 = , 𝜕¯𝑣𝑘 ℓ𝜎 4
(23)
𝜕𝑁𝑐 = cos(2𝜋𝜔 (𝑢¯𝑘 − 𝜏)), 𝜕¯𝑣𝑘
(24)
(II) Deterministic expectation difference via Wasserstein bound. The third term in Equation (17) is deterministic: 𝜖 Pr |E[𝐿𝐴 (𝜔)] − E[𝐿𝐵 (𝜔)]| ≥ 3 𝜖 =1 |E[𝐿𝐴 (𝜔)] − E[𝐿𝐵 (𝜔)]| ≥ (31) 3 3|E[𝐿𝐴 (𝜔)] − E[𝐿𝐵 (𝜔)]| ≤ . 𝜖 By Kantorovich–Rubinstein duality [15], if 𝑓 : Rℓ → R is 𝐾Lipschitz with respect to ℓ 1 then |E[𝑓 (𝑋 )]−E[𝑓 (𝑌 )]| ≤ 𝐾W1 (𝑋, 𝑌 ). Viewing 𝐿 as a function of the ℓ-vector 𝑣¯ (with 𝑢¯ 𝑗 fixed) and using Equation (26), we obtain the Lipschitz constant 𝐾 as follows. 𝐾=
𝜕𝑁𝑠 = sin(2𝜋𝜔 (𝑢¯𝑘 − 𝜏)). 𝜕¯𝑣𝑘
sup
𝜕𝐿 𝜕¯𝑣𝑘 𝑉2
ℓ 𝑘=1 𝑣¯ ∈ [ −𝑉 ,𝑉 ]
(25)
Using the bounds |𝑣¯𝑗 | ≤ 𝑉 , |𝑁𝑐 |, |𝑁𝑠 | ≤ ℓ𝑉 , and 𝐷𝑐 , 𝐷𝑠 ≥ ℓ/2, we obtain the absolute bounds 𝜕𝐿 1 4𝑉 3 4𝑉 4𝑉 𝑉2 ≤ + 2 = 2 1+ 2 . (26) 4 𝜕¯𝑣𝑘 ℓ 𝜎 𝜎 ℓ𝜎 𝜎
ℓ ∑︁
4𝑉 1+ 2 ℓ𝜎 2 𝜎 4𝑉 (𝑉 2 + 𝜎 2 ) . = 𝜎4 ≤ℓ·
(32)
Hence |E[𝐿𝐴 (𝜔)] − E[𝐿𝐵 (𝜔)]|
Consequently, 𝑐𝑘 ≤ 2𝑉 ·
4𝑉 ℓ𝜎 2
1+
𝑉2 𝜎2
=
8𝑉 2 ℓ𝜎 2
1+
(33) 4𝑉 (𝑉 2 + 𝜎 2 ) W1 (𝑃 𝐴 , 𝑃 𝐵 ). 4 𝜎 Based on Equation (31) and Equation (33), we get 𝜖 12𝑉 (𝑉 2 + 𝜎 2 ) W1 (𝑃 𝐴 , 𝑃 𝐵 ) Pr |E[𝐿𝐴 (𝜔)] − E[𝐿𝐵 (𝜔)]| ≥ ≤ · . 3 𝜎4 𝜖 (34) ≤ 𝐾 · W1 (𝑃 𝐴 , 𝑃 𝐵 ) =
𝑉2 , 𝜎2
and therefore ℓ ∑︁
𝑐𝑘2 ≤ ℓ ·
8𝑉 2 2 ℓ𝜎 2
1+
𝑉 2 2 𝜎2 (27)
𝑘=1
1 64𝑉 4 𝑉 2 2 1 64𝑉 4 (𝜎 2 + 𝑉 2 ) 2 . = · 4 1+ 2 = · ℓ 𝜎 𝜎 ℓ 𝜎8 Apply McDiarmid’s inequality with 𝛿 = 𝜖/3: 2𝛿 2 Pr |𝐿𝐴 (𝜔) − E[𝐿𝐴 (𝜔)]| ≥ 𝛿 ≤ 2 exp − Íℓ . 2 𝑘=1 𝑐 𝑘
(28)
Combining Equation (27) and 𝛿 = 𝜖/3, we have Pr |𝐿𝐴 (𝜔) − E[𝐿𝐴 (𝜔)]| ≥
which is the claimed bound. (29)
The same estimate holds for 𝐿𝐵 (𝜔). Combining the two concentration terms gives 𝜖 𝜖 Pr |𝐿𝐴 (𝜔) − E[𝐿𝐴 (𝜔)]| ≥ + Pr |𝐿𝐵 (𝜔) − E[𝐿𝐵 (𝜔)]| ≥ 3 3 ℓ𝜖 2 𝜎 4 ≤ 4 exp − . 288𝑉 4 (1 + 𝑉 2 /𝜎 2 ) 2 (30)
2 https://en.wikipedia.org/wiki/Quotient_rule
Pr(|𝐿𝐴 (𝜔) − 𝐿𝐵 (𝜔)| ≥ 𝜖) 12𝑉 (𝑉 2 + 𝜎 2 ) W (𝑃 , 𝑃 ) ℓ 𝜖2 𝜎4 1 𝐴 𝐵 ≤4 exp − · , + 4 2 2 2 288 𝑉 (1 + 𝑉 /𝜎 ) 𝜎4 𝜖 (35) 4 2 /𝜎 2 ) 2 12𝑉 (𝑉 2 +𝜎 2 ) Denote by 𝐶 1 = 288𝑉 (1+𝑉 and 𝐶 = , we have 2 𝜎4 𝜎4 ℓ𝜖 2 𝐶 W (𝑃 , 𝑃 ) 2 1 𝐴 𝐵 Pr(|𝐿𝐴 (𝜔) − 𝐿𝐵 (𝜔)| ≥ 𝜖) ≤ 4 exp − + , (36) 𝐶1 𝜖
𝜖 3
ℓ𝜖 2 𝜎 8 ≤2 exp − 288𝑉 4 (𝜎 2 + 𝑉 2 ) 2 ℓ𝜖 2 𝜎 4 =2 exp − . 4 2 2 2 288𝑉 (1 + 𝑉 /𝜎 )
(III) Combine (I) and (II). Substituting the bounds from (I) and (II) into Equation (17) yields
□
Theorem 4.2 (Preservation of Wasserstein-1 Distance through Dataset-to-Signal Mapping). If W1 (𝑇𝐴 ,𝑇𝐵 ) ≤ 𝜁 , then √︄ ! 𝐶 1 𝜁 2𝑉 2 4ℓ Pr W1 (𝑃 𝐴 , 𝑃 𝐵 ) ≤ + 1 + 𝜁 + 2ℓ log 𝑝 𝑠 𝛽 (1 − 𝛿)𝑟𝑝 𝜂 𝛿2 ≥ 1 − 2ℓ exp − 𝑟𝑝 − 𝜂, 2 where 𝐶 = max{1, 4𝑉 }, 𝛽 > 0 and 𝑠 > 0 are the bin width and scaling factor in 𝜑, and 𝛿 ∈ (0, 1) and 𝜂 ∈ (0, 1) are concentration parameters introduced by Chernoff’s and Hoeffding’s inequalities. Proof. As described in Section 3.1.1, the process of mapping a tabular dataset to a discrete-time signal in a two-dimensional projected space is performed in two steps:
RaMark: Radioactive Watermarking for Generated Tabular Data
Conference acronym ’XX, June 03–05, 2018, Woodstock, NY
(1) A projection and binning map 𝜙 : R𝑑 → R2 that produces a point in the two-dimensional projected space from a data sample, as shown in Equation (1) and Equation (2). (2) An aggregation operator 𝜓 that maps a finite multiset of points to a discrete-time signal of length ℓ by averaging the 𝑣-values within each bin 𝐵𝑐 , as shown in Section 3.1.1. We prove the theorem in three stages: (1) relate W1 (𝑇𝐴 ,𝑇𝐵 ) to W1 (𝑃𝐴 , 𝑃𝐵 ) with 𝜙; (2) relate W1 (𝑃𝐴 , 𝑃𝐵 ) to W1 (𝑃 𝐴 , 𝑃 𝐵 ) with 𝜓 ; and (3) control finite-sample deviations with high probability.
Stage 2: Relate W1 (𝑃𝐴 , 𝑃𝐵 ) to W1 (𝑃 𝐴 , 𝑃 𝐵 ) with 𝜓 . Let 𝑃 𝐴 and 𝑃 𝐵 be the resulting signal distributions. Define their Wasserstein-1 distance as W1 (𝑃 𝐴 , 𝑃 𝐵 ) =
W1 (𝑇𝐴 ,𝑇𝐵 ) :=
inf 𝜋 ∈Π (𝑇𝐴 ,𝑇𝐵 )
E (𝑎,𝑏 )∼𝜋 [∥𝑎 − 𝑏 ∥ 1 ],
(37)
where Π(𝑇𝐴 ,𝑇𝐵 ) denotes the set of all couplings of 𝑇𝐴 and 𝑇𝐵 . Since W1 (𝑇𝐴 ,𝑇𝐵 ) ≤ 𝜁 , there exists a coupling 𝜋 satisfying E (𝑎,𝑏 )∼𝜋 [∥𝑎 − 𝑏 ∥ 1 ] ≤ 𝜁 .
(38)
Let 𝑃𝐴 and 𝑃𝐵 denote the pushforward distributions of 𝑇𝐴 and 𝑇𝐵 under 𝜙. Denote by 𝜋˜ the induced coupling of 𝑃𝐴 and 𝑃𝐵 obtained by applying 𝜙 to (𝑎, 𝑏) ∼ 𝜋. Then W1 (𝑃𝐴 , 𝑃𝐵 ) ≤ E (𝜙 (𝑎),𝜙 (𝑏 ) )∼𝜋˜ [∥𝜙 (𝑎) − 𝜙 (𝑏)∥ 1 ].
(39)
Expanding the norm gives W1 (𝑃𝐴 , 𝑃𝐵 ) ≤ E𝜋˜ [|𝜙𝑢 (𝑎) − 𝜙𝑢 (𝑏)|] + E𝜋˜ [|𝜙 𝑣 (𝑎) − 𝜙 𝑣 (𝑏)|]. (40) Since 𝜙 𝑣 (·) is a linear projection, |𝜙 𝑣 (𝑎) − 𝜙 𝑣 (𝑏)| = |(𝑎 − 𝑏) ⊤ e𝑣 | ≤ ∥𝑎 − 𝑏 ∥ 2,
(41)
hence E𝜋˜ [|𝜙 𝑣 (𝑎) − 𝜙 𝑣 (𝑏)|] ≤ E𝜋 [∥𝑎 − 𝑏 ∥ 2 ]. 𝜙𝑢 (·) involves flooring and scaling, by definition: ⊤ 1 𝑎 ⊤ e𝑢 𝑏 e𝑢 |𝜙𝑢 (𝑎) − 𝜙𝑢 (𝑏)| = − . 𝑠 𝛽 𝛽 Using the elementary inequality 𝑦 |𝑥 − 𝑦| 𝑥 − ≤ + 1, 𝛽 𝛽 𝛽
(42)
(43)
1 E𝜋 [∥𝑎 − 𝑏 ∥ 2 ] +1 . 𝑠 𝛽
(44)
(45)
Substituting Equation (42) and Equation (45) into Equation (40) yields 1 E𝜋 [∥𝑎 − 𝑏 ∥ 2 ] W1 (𝑃𝐴 , 𝑃𝐵 ) ≤ + 1 + E𝜋 [∥𝑎 − 𝑏 ∥ 2 ]. (46) 𝑠 𝛽 Since ∥𝑥 ∥ 2 ≤ ∥𝑥 ∥ 1 for any 𝑥 Therefore,
∈ R𝑑 , we have E𝜋 [∥𝑎 − 𝑏 ∥ 2 ] ≤ 𝜁 .
W1 (𝑃𝐴 , 𝑃𝐵 ) ≤
𝑐
(48)
𝑐
+
∑︁
|𝑠 𝐵 (𝑐) − 𝜇𝐵 (𝑐)|,
𝑐
(49) where 𝜇𝐴 (𝑐) = E[𝑣 𝐴 |𝑢𝐴 = 𝑐], 𝜇𝐵 (𝑐) = E[𝑣 𝐵 |𝑢𝐵 = 𝑐]. Í We will (i) bound 𝑐 |𝜇𝐴 (𝑐) − 𝜇𝐵 (𝑐)| in terms of W1 (𝑃𝐴 , 𝑃𝐵 ) and (ii) bound empirical deviations |𝑠 𝐴 (𝑐) − 𝜇𝐴 (𝑐)| and |𝑠 𝐵 (𝑐) − 𝜇𝐵 (𝑐)| via concentration inequalities. Let 𝑝𝐴 (𝑐) = Pr(𝑢𝐴 = 𝑐) and 𝑝 𝐵 (𝑐) = Pr(𝑢𝐵 = 𝑐) denote the marginal probabilities of bin index 𝑐 under 𝑃𝐴 and 𝑃𝐵 , respectively, and define 𝑝 = min∀𝑐 {Pr(𝑢𝐴 = 𝑐), Pr(𝑢𝐵 = 𝑐)} as the shared bin mass. Consider any coupling 𝜋˜ ∈ Π(𝑃𝐴 , 𝑃𝐵 ) between 𝑃𝐴 and 𝑃𝐵 . Under this coupling, one can bound the binwise difference of aggregated means by the joint deviations of the paired samples. Specifically, using the triangle inequality and the boundedness of 𝑣 (i.e., |𝑣 | ≤ 𝑉 ), we have ∑︁ 𝑝 |𝜇𝐴 (𝑐) − 𝜇𝐵 (𝑐)| ≤ E𝜋˜ [|𝑣 𝐴 − 𝑣 𝐵 |] + 4𝑉 E𝜋˜ [|𝑢 𝐴 − 𝑢 𝐵 |]. (50) 𝑐
Then dividing both sides by 𝑝 gives ∑︁ 1 E𝜋˜ [|𝑣 𝐴 − 𝑣 𝐵 |] + 4𝑉 E𝜋˜ [|𝑢 𝐴 − 𝑢 𝐵 |] . (51) |𝜇𝐴 (𝑐) −𝜇𝐵 (𝑐)| ≤ 𝑝 𝑐 Taking infimum over all couplings 𝜋˜ ∈ Π(𝑃𝐴 , 𝑃𝐵 ) yields ∑︁ 𝐶 𝐶 = max{1, 4𝑉 }. (52) |𝜇𝐴 (𝑐) − 𝜇𝐵 (𝑐)| ≤ W1 (𝑃𝐴 , 𝑃𝐵 ), 𝑝 𝑐 For each bin 𝑐, let 𝑟 𝑟 ∑︁ ∑︁ 𝑚𝐴 (𝑐) = 1{𝑢𝑖𝐴 = 𝑐} and 𝑚𝐵 (𝑐) = 1{𝑢𝑖𝐵 = 𝑐}. 𝑖=1
we obtain E𝜋˜ [|𝜙𝑢 (𝑎) − 𝜙𝑢 (𝑏)|] ≤
E (𝑠 𝐴 ,𝑠 𝐵 )∼𝜋 [∥𝑠 𝐴 − 𝑠 𝐵 ∥ 1 ],
Í where ∥𝑠 𝐴 − 𝑠 𝐵 ∥ 1 = 𝑐 ∈ I |𝑠 𝐴 (𝑐) − 𝑠 𝐵 (𝑐)|. We decompose the total discrepancy as ∑︁ ∑︁ ∑︁ |𝑠 𝐴 (𝑐) − 𝑠 𝐵 (𝑐)| ≤ |𝑠 𝐴 (𝑐) − 𝜇𝐴 (𝑐)| + |𝜇𝐴 (𝑐) − 𝜇𝐵 (𝑐)| 𝑐
Stage 1: Relate W1 (𝑇𝐴 ,𝑇𝐵 ) to W1 (𝑃𝐴 , 𝑃𝐵 ) with 𝜙. Let 𝑇𝐴 , 𝑇𝐵 be two probability distributions over R𝑑 satisfying W1 (𝑇𝐴 ,𝑇𝐵 ) ≤ 𝜁 . By the definition of the Wasserstein-1 distance under ℓ1 norm,
inf 𝜋 ∈Π (𝑃 𝐴 ,𝑃 𝐵 )
(53)
𝑖=1
Since 𝑚𝐴 (𝑐) ∼ Binomial(𝑟, 𝑝𝐴 (𝑐)), Chernoff’s inequality3 gives 𝛿2 (54) Pr 𝑚𝐴 (𝑐) ≤ (1 − 𝛿)𝑟𝑝 ≤ exp − 𝑟𝑝 , 2 and similarly for 𝑚𝐵 (𝑐). Applying a union bound over ℓ bins yields the event 𝐺 defined as follows. n o 𝐺 := ∀𝑐 ∈ I : 𝑚𝐴 (𝑐) ≥ (1 − 𝛿)𝑟𝑝 and 𝑚𝐵 (𝑐) ≥ (1 − 𝛿)𝑟𝑝 . (55) By a union bound over all 𝑐 ∈ I, ∑︁ ∑︁ Pr(𝐺 𝑐 ) ≤ Pr(𝑚𝐴 (𝑐) < (1 − 𝛿)𝑟𝑝) + Pr(𝑚𝐵 (𝑐) < (1 − 𝛿)𝑟𝑝) 𝑐∈I
𝑐∈I
𝛿2 𝛿2 ≤ 2|I| exp − 𝑟𝑝 = 2ℓ exp − 𝑟𝑝 . 2 2
(56) 1 𝜁 + 1 +𝜁. 𝑠 𝛽
(47)
3 https://courses.cs.washington.edu/courses/cse312/20su/files/student_drive/6.2.pdf
Conference acronym ’XX, June 03–05, 2018, Woodstock, NY
Anonymous
Therefore, 𝛿2 Pr(𝐺) ≥ 1 − 2ℓ exp − 𝑟𝑝 (57) 2 𝐴 𝐵 Conditional on 𝐺, each empirical average 𝑠 (𝑐) (or 𝑠 (𝑐)) is a mean of at least 𝑚 min = (1 − 𝛿)𝑟𝑝 bounded random variables in [−𝑉 , 𝑉 ]. By Hoeffding’s inequality4 , 𝑚 𝑡2 min Pr |𝑠 𝐴 (𝑐) − 𝜇𝐴 (𝑐)| > 𝑡 | 𝐺 ≤ 2 exp − , 2𝑉 2 and similarly for 𝑠 𝐵 (𝑐). Applying a union bound over 2ℓ events gives that with probability at least 1 − 𝜂,
∀𝑐, |𝑠 𝐴 (𝑐) − 𝜇𝐴 (𝑐)| ≤ 𝑡 and |𝑠 𝐵 (𝑐) − 𝜇𝐵 (𝑐)| ≤ 𝑡,
(58)
where √︄ 𝑡=
2𝑉 2 4ℓ log . (1 − 𝛿)𝑟𝑝 𝜂
(59)
Combining Equation (51), Equation (57), and Equation (58), and recalling that ∑︁ 𝐶 (60) |𝑠 𝐴 (𝑐) − 𝑠 𝐵 (𝑐)| ≤ W1 (𝑃𝐴 , 𝑃𝐵 ) + 2ℓ𝑡, 𝑝 𝑐 we obtain the high-probability inequality √︄ 𝐶 2𝑉 2 4ℓ W1 (𝑃 𝐴 , 𝑃 𝐵 ) ≤ W1 (𝑃𝐴 , 𝑃𝐵 ) + 2ℓ log , 𝑝 (1 − 𝛿)𝑟𝑝 𝜂
(61)
𝛿2
holding with probability at least 1 − 2ℓ𝑒 − 2 𝑟𝑝 − 𝜂. Stage 3: Combining the first two stages. Substituting the deterministic bound from Equation (47) into Equation (61) gives √︄ 4ℓ 𝐶 1 𝜁 2𝑉 2 + 1 + 𝜁 + 2ℓ log . (62) W1 (𝑃 𝐴 , 𝑃 𝐵 ) ≤ 𝑝 𝑠 𝛽 (1 − 𝛿)𝑟𝑝 𝜂 That is to say, √︄ ! 2𝑉 2 4ℓ 𝐶 1 𝜁 Pr W1 (𝑃 𝐴 , 𝑃 𝐵 ) ≤ + 1 + 𝜁 + 2ℓ log 𝑝 𝑠 𝛽 (1 − 𝛿)𝑟𝑝 𝜂 𝛿2 ≥ 1 − 2ℓ exp − 𝑟𝑝 − 𝜂, 2 (63) □
A.2
Prior Studies on Radioactivity
For completeness, we briefly discuss prior studies on radioactivity and explain why these techniques cannot be directly extended to continuous-valued tabular data. The notion of radioactivity has been explored in other modalities, including image classification, language modeling, and diffusion-based image generation [21, 41, 57, 58]. These works study whether specific training data leave detectable traces in trained models or generated outputs. Their objectives, threat models, and data modalities differ fundamentally from tabular dataset watermarking under retraining attacks. In particular, they focus on watermarking models or tracing training data usage, whereas our goal is to ensure watermark persistence in regenerated tabular datasets under distribution-preserving retraining. Another work [24] studies watermark persistence under 4 https://www.stat.cmu.edu/~larry/=stat700/Lecture6.pdf
retraining attacks for categorical data. However, this approach is restricted to categorical data and cannot extend to watermarking continuous-valued tabular data. Consequently, existing radioactive techniques developed for images, text, or categorical data cannot be directly extended to continuous-valued tabular data. To the best of our knowledge, RaMark is the first method to achieve radioactive watermarking in this setting.
A.3
Runtime Analysis
We empirically evaluate the runtime of watermark embedding and detection for RaMark and all baseline methods, with two objectives: comparing runtime across methods and quantifying the additional overhead introduced by watermark guidance in RaMark. To ensure reliable and stable measurements, each experiment is repeated 50 times, and we report the mean and standard deviation of the runtime across these runs. Table 3 reports the runtimes of diffusion-model training, standard sampling without watermarking, post-generation watermarking overhead, and generative sampling with watermarking. Diffusion training is a one-time cost for the data owner and is independent of the watermarking method. Standard sampling takes 61 seconds on HS and 15 seconds on HO. Following the taxonomy in Section 2, we categorize baseline methods into database watermarking methods and generative watermarking methods. Database watermarking methods embed the watermark after data generation, and therefore their embedding runtime appears as post-generation watermarking overhead in Table 3. From Table 3, we observe that database watermarking methods incur lower embedding runtime than generative methods. For database watermarking methods such as S2R2W, TabularMark, WGTD, PKF, and B2Mark, embedding consists of sampling from a diffusion model to generate an unwatermarked dataset and then applying the watermark embedding procedure. The additional overhead after sampling is minimal as all five baselines require at most 0.050 seconds on HS and 0.013 seconds on HO. As a result, the end-to-end computational cost of producing a watermarked dataset is dominated by diffusion sampling. Moreover, once an unwatermarked dataset is sampled, database watermarking methods can reuse it to embed multiple watermarks without re-running the sampling process. In contrast, generative methods such as TabWak, MUSE, and RaMark integrate watermark embedding into the sampling process, which requires one sampling run for each watermark. However, this comparison should be interpreted jointly with data utility. Prior studies [16, 75] have observed that when using the same generative backbone and comparable watermark strength, generative watermarking methods can better maintain data utility than database watermarking methods, as the watermark is incorporated during generation rather than imposed through postgeneration modifications. Moreover, as discussed in Section 5.1.3, we align watermark strength across methods using an MLE budget constraint in our experiments. Therefore, data utility differences are controlled and do not confound our comparison. Among the generative methods, RaMark is slightly faster than TabWak and MUSE on both datasets. This difference can be attributed to how watermark embedding is integrated into the sampling
RaMark: Radioactive Watermarking for Generated Tabular Data
Conference acronym ’XX, June 03–05, 2018, Woodstock, NY
Table 3: Embedding runtime on datasets HS and HO (in seconds). We report diffusion training time, standard sampling time without watermarking, and watermark embedding runtime. Diffusion backbone
Post-generation watermarking overhead
Generative sampling w/ watermark
Dataset HS HO
Training
Sampling w/o WM
S2R2W
TabularMark
WGTD
PKF
B2Mark
TabWak
MUSE
RaMark
960.000±12.500 300.000±6.200
61.000±1.842 15.000±0.612
0.050±1.831 0.013±0.450
0.041±1.526 0.007±0.375
0.035±2.136 0.006±0.560
0.033±1.220 0.007±0.539
0.031±1.830 0.007±0.552
77.890±3.115 17.941±0.757
75.300±2.259 17.497±0.699
67.248±2.689 16.071±0.642
Table 4: Detection runtime on datasets HS and HO (in seconds). Dataset
S2R2W
TabularMark
WGTD
PKF
B2Mark
TabWak
MUSE
RaMark
HS HO
0.043±0.004 0.011±0.001
0.308±0.008 0.074±0.006
0.021±0.001 0.005±0.000
0.017±0.002 0.004±0.000
0.018±0.002 0.004±0.000
370.200±8.772 88.000±5.280
5.250±0.204 1.240±0.099
0.017±0.001 0.004±0.000
process. TabWak constructs row-wise watermarked latent seeds through self-cloning, shuffling, and a valid-bit mechanism before sampling, which increases embedding runtime. MUSE generates multiple candidate rows for each output row and selects the highestscoring candidate according to a watermark scoring function, which introduces repeated sampling and scoring-selection overhead. In contrast, RaMark only modifies the reverse denoising transition through an additional guidance term, which results in a lower embedding runtime than TabWak and MUSE. We next analyze the computational overhead introduced by watermark guidance in RaMark. RaMark follows a guidance-based diffusion framework, where the reverse transition is modified by incorporating an additional gradient term derived from the watermark likelihood. The overall runtime is dominated by the diffusion backbone, while the guidance computation introduces only a small additional cost. As shown in Table 3, RaMark requires 67.248±2.689 seconds on HS, compared to approximately 61 seconds for standard sampling, corresponding to about 10.2% overhead. A similar trend is observed on HO, where the embedding time is only slightly higher than standard sampling, with an overhead of about 7.1%. For watermark detection, as shown in Table 4, most methods achieve comparable and efficient runtime on both datasets. RaMark is efficient because detection operates directly on the suspicious dataset without requiring access to the diffusion model or reverse sampling. It maps the dataset to a discrete-time signal and computes the spectral power at the designated frequency. In contrast, TabWak exhibits significantly higher detection runtime because it requires diffusion inversion and reverse sampling to recover latent representations before detecting the watermark.
A.4
Effects of the Mapping Parameters 𝛽 and 𝑠
In this subsection, we study the sensitivity of RaMark to the two mapping parameters in Equation (2): the bin width 𝛽 and the scaling factor 𝑠. As explained in Section 3.1.1, these two parameters determine how data samples are mapped into the discrete-time signal. Specifically, 𝛽 controls the granularity of the binning operation along the 𝑢-axis, while 𝑠 rescales the spacing of the resulting discrete-time signal along the 𝑢-axis. Since watermark detection is performed by measuring the spectrum power at the designated frequency 𝜔, we evaluate the effect of
Table 5: Effect of the bin width 𝛽 on the mapped signal and watermark detectability. Dataset
𝛽
avg( |𝐵𝑐 | )
ℓ
#periods
𝐷𝑆 (𝜔 )
HS (𝑠 = 5000)
0.005 0.01 0.03 0.05 0.07 0.09 0.50
4.2 18.7 52.9 86.4 119.8 151.2 282.5
11850.4 3124.8 1128.6 708.2 503.6 402.7 218.9
60.0 57.2 44.3 34.7 24.9 17.8 0.2
0.26 0.99 1.00 1.00 1.00 0.99 0.14
HO (𝑠 = 5000)
0.005 0.01 0.03 0.05 0.07 0.09 0.50
3.3 20.4 55.3 90.6 121.5 149.6 259.2
1984.6 642.7 238.5 142.2 109.3 91.7 49.8
44.8 39.6 29.4 21.6 15.8 9.9 0.2
0.20 0.98 1.00 1.00 0.99 0.98 0.12
these parameters using the detection score 𝐷𝑆 (𝜔). A larger 𝐷𝑆 (𝜔) indicates a stronger watermark signal. To better understand why 𝐷𝑆 (𝜔) changes under different parameter settings, we additionally report several statistics of the constructed sinusoidal signal, including the average number of points in each bin avg(|𝐵𝑐 |), the length of the discrete-time signal ℓ, and the number of periods spanned by the resulting discrete-time signal. These statistics explain how the mapping function 𝜙𝑢 determines the characteristics of the sinusoidal signal used for spectral analysis, and thus help explain the change of 𝐷𝑆 (𝜔). Specifically, avg(|𝐵𝑐 |) measures how many points are aggregated to produce each mean point, as RaMark first groups points with the same 𝑢coordinate into bins and then computes one mean point for each bin to form the discrete-time signal. The length of the discrete-time signal ℓ corresponds to the number of bins, and the number of periods reflects whether the mapped signal contains sufficient periodic structure for reliable spectral analysis. We conduct a one-factor-at-a-time sensitivity analysis. When studying 𝛽, we vary 𝛽 ∈ {0.005, 0.01, 0.03, 0.05, 0.07, 0.09, 0.5} while fixing 𝑠 = 5000. When studying 𝑠, we vary 𝑠 ∈ {500, 1000, 3000, 5000, 7000, 9000, 12000} while fixing 𝛽 = 0.05. The projection vectors e𝑢 and e𝑣 are randomly sampled as a pair of orthogonal unit vectors, and the designated frequency is fixed at 𝜔 = 30. Effect of the bin width 𝛽. As shown in Table 5, increasing 𝛽 leads to coarser binning along the 𝑢-axis. Consequently, more points fall
Conference acronym ’XX, June 03–05, 2018, Woodstock, NY
Anonymous
Table 6: Effect of the scaling factor 𝑠 on the mapped signal and watermark detectability. Dataset
𝑠
avg( |𝐵𝑐 | )
ℓ
#periods
𝐷𝑆 (𝜔 )
HS (𝛽 = 0.05)
500 1000 3000 5000 7000 9000 12000
86.4 86.4 86.4 86.4 86.4 86.4 86.4
708.2 708.2 708.2 708.2 708.2 708.2 708.2
62.5 56.8 43.2 34.7 24.3 16.5 0.3
0.30 0.99 1.00 1.00 0.99 0.98 0.15
HO (𝛽 = 0.05)
500 1000 3000 5000 7000 9000 12000
90.6 90.6 90.6 90.6 90.6 90.6 90.6
142.2 142.2 142.2 142.2 142.2 142.2 142.2
48.7 41.9 30.5 21.6 14.8 9.7 0.4
0.35 0.98 1.00 1.00 0.99 0.98 0.18
into each bin, which increases avg(|𝐵𝑐 |). Since each mean point is obtained by averaging the points within a bin, a larger avg(|𝐵𝑐 |) makes each mean point less sensitive to the variation of individual points. However, increasing 𝛽 also reduces the number of bins ℓ, and thus shortens the discrete-time signal. Meanwhile, the number of periods covered by the mapped signal also decreases. These effects reveal a trade-off controlled by 𝛽. When 𝛽 is very small, e.g., 𝛽 = 0.005, the bin width is small and each bin contains only a few points, resulting in a small avg(|𝐵𝑐 |). Although the signal has a large ℓ, each mean point is determined by only a few points, and the sinusoidal pattern is less clearly reflected in the sequence of mean points. As a result, the spectral power at the designated frequency is reduced, leading to a lower 𝐷𝑆 (𝜔). When 𝛽 is very large, e.g., 𝛽 = 0.5, each bin contains a large number of points. However, the number of bins ℓ is significantly reduced, and the signal spans only a small number of periods. In this case, the signal does not provide sufficient periodic coverage for spectral analysis at the designated frequency, which also leads to a decrease in 𝐷𝑆 (𝜔). In the middle range, e.g., 𝛽 = 0.01 to 𝛽 = 0.09, the mapping achieves a good balance between avg(|𝐵𝑐 |) and the number of periods, and 𝐷𝑆 (𝜔) remains consistently high. Effect of the scaling factor 𝑠. The scaling factor 𝑠 controls the spacing of the discrete-time index along the 𝑢-axis after binning, and therefore directly affects how many periods of the sinusoidal signal are spanned by the mapped signal. As shown in Table 6, changing 𝑠 does not affect the binning process. Therefore, avg(|𝐵𝑐 |) and ℓ remain unchanged when 𝛽 is fixed. Instead, 𝑠 primarily changes the number of periods covered by the signal. As 𝑠 increases, the discrete-time signal becomes more compressed along the 𝑢-axis, and the number of periods decreases. When 𝑠 is small, e.g., 𝑠 = 500, the signal spans a large number of periods. However, the number of mean points within each period becomes relatively small, which makes the sinusoidal pattern within each period less clearly represented. This reduces the spectral power at the designated frequency and leads to a lower 𝐷𝑆 (𝜔). When 𝑠 is large, e.g., 𝑠 = 12000, the signal spans only a small number of periods. Although each period contains more mean points, the limited number of periods makes it difficult to reliably identify the designated frequency, which also leads to a decrease in 𝐷𝑆 (𝜔) For moderate values such as 𝑠 ∈ [1000, 9000], the mapping achieves a
good balance between the number of mean points per period and the total number of periods, and 𝐷𝑆 (𝜔) remains consistently high. Overall, the results show that RaMark is robust to the choice of the mapping parameters 𝛽 and 𝑠. For both parameters, the detection score 𝐷𝑆 (𝜔) remains consistently high over a wide range of values and only degrades at extreme settings. Received 20 February 2007; revised 12 March 2009; accepted 5 June 2009