Watermarking Continuous Tabular Data Generation

Hengzhi He; Peiyu Yu; Junpeng Ren; Ying Nian Wu; Guang Cheng

cs.CRMay 22, 2024

Watermarking Continuous Tabular Data Generation

Authors: Hengzhi He, Peiyu Yu, Junpeng Ren, Ying Nian Wu, Guang Cheng

Abstract

In this paper, we introduce a simple yet effective tabular data watermarking mechanism with statistical guarantees. We show theoretically that the proposed watermark can be effectively detected, while faithfully preserving the data fidelity, and also demonstrates appealing robustness against additive noise attack. The general idea is to achieve the watermarking through a strategic embedding based on simple data binning. Specifically, it divides the feature's value range into finely segmented intervals and embeds watermarks into selected ``green list" intervals. To detect the watermarks, we develop a principled statistical hypothesis-testing framework with minimal assumptions: it remains valid as long as the underlying data distribution has a continuous density function. The watermarking efficacy is demonstrated through rigorous theoretical analysis and empirical validation, highlighting its utility in enhancing the security of synthetic and real-world datasets.

Figures & tables

Figure 1: Overview of the tabular data watermarking scheme.

Figure 2: Illustration of our proposed watermarking scheme for tabular data. Specifically, our scheme consists of three major steps: i) dividing the continuous interval $[0,1]$ into $2m$ equal parts, forming $m$ pairs of consecutive intervals; ii) randomly selecting one interval from each pair, resulting in the set of $m$ “green list” intervals; and iii) sampling new fractional part for the input element from the nearest “green list” interval if the original fractional part falls outside of this interval.

Panel of Figure 3 — Figure 3: KDE plots for the Gaussian data w/ and w/o our proposed watermark; wm as the shorthand of our watermark; figs and tabs henceforth follows this format.

Panel of Figure 5 — Figure 5: Detection rates of the proposed watermark applied to tabular data with different number of rows and columns. In Figs. 5(c) and 5(d) we plot the detection rates of the watermark after adding noises with different level of variances (in $\log_{10}$ scale). prp is the proportion of the elements in a table being modified. Rates over $1000$ independent samples; error bars over 3 runs. Zoom-in for more details.

	California	Gesture	House	Wilt	Higgs-small	Miniboone
Orig2Gen	0.0222	0.0602	0.0315	0.0767	0.0142	0.0161
Gen2Watermarked	0.0004	0.0004	0.0004	0.0005	0.0003	0.0001
$m$	1000	1000	1000	1000	1000	2500
$1/m$	0.001	0.001	0.001	0.001	0.001	0.0004

Table 1: Wasserstein-1 distance between generated data distribution and watermarked data distribution.

	California	Gesture	House	Wilt	Higgs-small	Miniboone
TVAE	1.000	1.000	1.000	1.000	1.000	1.000
CTABGAN	1.000	1.000	1.000	1.000	1.000	1.000
TabDDPM	1.000	1.000	1.000	1.000	1.000	0.999

Table 2: Accuracy (ROC-AUC score) of the tabular data watermark.

	California	Gesture	House	Wilt	Higgs-small	Miniboone
TVAE	1.000	1.000	1.000	1.000	1.000	1.000
CTABGAN	1.000	1.000	1.000	1.000	1.000	1.000
TabDDPM	1.000	1.000	1.000	1.000	1.000	0.999

Table 3: Accuracy (ROC-AUC score) of the tabular data watermark after additive noise attack.

	Generator	California (R2)	Gesture (F1)	House (R2)
	TVAE	$0.736\pm 0.004$	$0.418\pm 0.012$	$0.448\pm 0.010$
orig. data	CTABGAN	$0.577\pm 0.007$	$0.411\pm 0.005$	$0.327\pm 0.008$
	TabDDPM	$0.823\pm 0.003$	$0.575\pm 0.009$	$0.638\pm 0.007$
	TVAE	$0.735\pm 0.037$	$0.419\pm 0.012$	$0.449\pm 0.011$
wm. data	CTABGAN	$0.577\pm 0.007$	$0.409\pm 0.009$	$0.328\pm 0.007$
	TabDDPM	$0.823\pm 0.003$	$0.554\pm 0.007$	$0.638\pm 0.007$

Table 4: Impact of the tabular data watermark on utility. The metrics used for each dataset is provided after the dataset name. Results calculated using 20 generated copies of the original dataset.

Appendix figures & tables8 assets

Supplementary material from the paper’s appendix.

Appendix

Alias	Name	#Train	#Validation	#Test	#Num	#Cat	Task type
California	California Housing	13209	3303	4128	8	0	Regression
Gesture	Gesture Phase	6318	1580	1975	32	0	Multiclass
House	House 16H	14581	3646	4557	16	0	Regression
Wilt	Wilt	3096	775	968	5	0	Binclass
Higg-small	Higgs Small	62751	15688	19610	28	0	Binclass
Miniboone	MiniBooNE	83240	20811	26013	50	0	Binclass

Appendix

Table A1 : List of datasets used for the evaluation and their descriptions.

$n\times p$	$10\times 10$	$10\times 100$	$10\times 1000$
AUC	$0.850$	$0.700$	$0.580$
$n\times p$	$100\times 10$	$100\times 100$	$100\times 1000$
AUC	$1.000$	$1.000$	$0.970$
$n\times p$	$1000\times 10$	$1000\times 100$	$1000\times 1000$
AUC	$1.000$	$1.000$	$1.000$

Appendix

Table A2 : Detection results on watermarking a single column in simulated tables.

$n\times p$	$100\times 100$	$100\times 1000$	$100\times 10000$
TPR/TNR	$1.000/1.000$	$1.000/1.000$	$1.000/1.000$
AUC	$1.000$	$1.000$	$1.000$

Appendix

Table A3 : Detection results on simulated high dimensional tables. We report the true postive (TPR) and true negative rates (TNR) as well as ROC-AUC scores. We create

100

watermarked and unwatermarked tables to calculate the scores.

	$s=0.001$	$s=0.1$	$s=1$	$s=10$
$p=0.50$	$1.000$	$1.000$	$1.000$	$1.000$
$p=0.75$	$1.000$	$1.000$	$1.000$	$1.000$
$p=0.90$	$1.000$	$0.970$	$0.990$	$0.870$
$p=0.95$	$1.000$	$0.780$	$0.850$	$0.690$

Appendix

Table A4 : Detection results after attacks on watermarking a single column in simulated tables. s represents the variances of additive noises; p represents the proportions of elements being modified by the attacks.

	California	Gesture	House	Wilt	Higgs-small	Miniboone
TVAE	8/8	32/32	16/16	5/5	24/28	50/50
CTABGAN	8/8	32/32	16/16	5/5	24/28	50/50
TabDDPM	5/8	32/32	7/16	5/5	24/28	27/50

Appendix

Table A5 : Number of columns selected for each generated dataset.

	California	Gesture	House	Wilt	Higgs-small	Miniboone
Orig2Gen	0.1327	0.1198	0.0658	0.0906	0.1797	0.6720
Gen2Watermarked	0.0004	0.0004	0.0004	0.0003	0.0003	0.0004
$m$	1000	1000	1000	1000	1000	1000
$1/m$	0.001	0.001	0.001	0.001	0.001	0.001

Appendix

Table A6 : Wasserstein-1 distance between TVAE generated data and watermarked data distributions.

	California	Gesture	House	Wilt	Higgs-small	Miniboone
Orig2Gen	0.1683	0.1771	0.0926	0.1003	0.0606	0.6471
Gen2Watermarked	0.0004	0.0004	0.0004	0.0004	0.0004	0.0004
$m$	1000	1000	1000	1000	1000	2500
$1/m$	0.001	0.001	0.001	0.001	0.001	0.0004

Appendix

Table A7 : Wasserstein-1 distance between CTABGAN generated data and watermarked data distributions.

Panel of Figure 16 — Figure A1 : Histogram of spiky column data distributions. Examples generated by TabDDPM.

Dataset Watermarking

Dataset watermarking embeds detectable signals in data to verify ownership or trace its use in trained models while preserving data utility.

See all 21 papers

Observation-Level Watermarking and Detection for Tabular Data
Jul 12, 2026Dongyu Cui, Xuan BiDataset Watermarking Robust Watermarking
School of Statistics, University of Minnesota · Carlson School of Management, University of Minnesota
RaMark: Radioactive Watermarking for Generated Tabular Data
Jul 10, 2026Xin Che, Lingyang Chu, Qiqi Zhang +3Data Provenance Dataset Watermarking
McMaster University Hamilton, Canada · York University Toronto, Canada · Duke University Durham, United States
Refined Detection for Gumbel Watermarking
Mar 31, 2026Tor LattimoreWatermark Removal Detection Text Watermarking
Google DeepMind

Jul 12, 2026J/K move · Enter open · S save

Observation-Level Watermarking and Detection for Tabular Data

Dongyu Cui, Xuan Bi

School of Statistics, University of Minnesota · Carlson School of Management, University of Minnesota

Dataset Watermarking Robust Watermarking Watermark Removal Detection

Open paper AskPDF arXiv

With the development of generative AI, watermarking techniques have been widely used to detect the authenticity of AI-generated data and protect the rights of users and creators. While it is already well applied in data types including imaging and text data, watermarking tabular data is still under-explored. Existing methods primarily focus on numerical data, leaving discrete, categorical, and mixed data less studied. In this work, we propose STAMP (Single-observation Tabular Attribution and Marking Procedure), a novel framework for watermarking tabular data that can accommodate and preserve a wide range of distributions. We also develop a corresponding detection mechanism, which can reliably identify watermarks even when the sample size is as small as one. We establish theoretical guarantees for asymptotic consistency and detection accuracy. Finally, through extensive simulation studies and two real-data applications, we demonstrate that the proposed method is effective and robust to subsetting, while maintaining data fidelity and a high detection rate.

Abstract

Dataset Watermarking

Explore similar work

Observation-Level Watermarking and Detection for Tabular Data

RaMark: Radioactive Watermarking for Generated Tabular Data

Refined Detection for Gumbel Watermarking