A Locally Tokenized Generative Model for Robust Time-Series Watermarking

Dongbin Kim; Geonwoo Shin; Yujin Choi; Soyeon Park; Jaewook Lee

cs.LGAug 20, 2026

A Locally Tokenized Generative Model for Robust Time-Series Watermarking

Authors: Dongbin Kim, Geonwoo Shin, Yujin Choi, Soyeon Park, Jaewook Lee

Organizations: Seoul National University · Nanyang Technological University

Abstract

Watermarking is a central tool for provenance in generative models, yet its application to multivariate time series remains hindered by reliability failures under post-editing attacks. We show that existing detectors, which rely on globally coupled re-encoding, suffer from bidirectional drift of the null distribution: post-editing attacks can shift the z-score of non-watermarked samples in either direction, invalidating clean-calibrated thresholds. We argue that this instability is a property of the re-encoding, and that reliable detection requires each recovered unit to depend only on a bounded temporal neighborhood. Guided by this principle, we propose L-VQVAE, a generative model in which each discrete token is produced from a short contiguous window, and LVQMark, a watermarking method over this token space that combines logit-bias injection with robust re-encoding for attack-time detection. Experiments on four benchmarks spanning finance, energy, and neuroimaging show that our approach preserves generation quality while stabilizing both detection power and false-positive behavior under post-editing attacks.

Figures & tables

	$z\gg 0$	$z\approx 0$	$z\ll 0$
Watermarked	Correct detection	Miss	Statistical anomaly
Non-watermarked	False positive	Correct rejection	Statistical anomaly

Table 1: Intended interpretation of

z

under a clean-calibrated detector. The validity of this interpretation requires re-encoding stability of

\Phi

under the attack family; in its absence, null drift bidirectionally invalidates the threshold.

Panel of Figure 1 — Figure 1: Bidirectional drift of the null on non-watermarked samples (TimeWak [ 17 ] , Stocks). Crop and insert push the recovered tokens (a) and the resulting $z$ -score (b) in opposite directions, with insert crossing the clean-calibrated threshold and yielding an $85\%$ false-positive rate.

Figure 2: Overview of L-VQVAE and LVQMark. (a) The local tokenizer encodes each temporal window into a discrete VQ token. (b) The global decoder reconstructs the time series from the token sequence. (c) An autoregressive transformer models the token distribution. (d) Watermark injection via scheduled logit bias with alternating partition and unbiased warm-up. (e) Robust detection via token re-encoding, where $E_{\rho}^{*}$ recovers clean token assignments from the attacked signal for the green-ratio test.

Setting

Watermark (TPR

\uparrow

)

Non-watermarked (FPR

\downarrow

| Z-score)

Quality Metric (

\downarrow

)

Dataset

Model

Method

Offset

Crop

Insert

Offset

Crop

Insert

C-FID

Corr.

Disc.

Pred.

Stocks

DiffusionTS

0.00

\mathbf{1.00}

\mathbf{1.00}

\mathbf{0.00}

+0.21

1.00

+69.43

1.00

+8.11

1.52

0.07

0.15

\mathbf{0.04}

\mathbf{1.00}

0.00

\mathbf{1.00}

\mathbf{0.00}

-1.40

\mathbf{0.00}

-14.87

0.05

+1.52

1.50

\underline{0.02}

0.23

\mathbf{0.04}

TimeWak

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{0.00}

-0.19

\mathbf{0.00}

-4.32

0.05

+1.35

0.29

\mathbf{0.01}

0.13

\mathbf{0.04}

SDformer

LVQMark

0.00

0.01

0.00

\mathbf{0.00}

-0.16

0.02

+1.19

\mathbf{0.00}

+0.31

\underline{0.08}

\mathbf{0.01}

\mathbf{0.01}

\mathbf{0.04}

L-VQVAE

LVQMark

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{0.00}

-0.12

0.01

-0.05

0.01

+0.35

\mathbf{0.07}

\underline{0.02}

\underline{0.06}

\mathbf{0.04}

Table 2: Results of synthetic time series watermark detection and quality. Watermarked (TPR) and Non-watermarked (FPR, mean z-score) detections are evaluated under 30% attacks. Quality metrics are for 64-length. Best results are in bold, and second-best are underlined. Z-scores with

|z|>3.09

are marked in red .

Stocks

Energy

ETTh

fMRI

Model

C-FID

Corr.

Disc.

Pred.

C-FID

Corr.

Disc.

Pred.

C-FID

Corr.

Disc.

Pred.

C-FID

Corr.

Disc.

Pred.

TimeVQVAE

0.439

0.079

0.368

0.056

5.423

7.189

0.466

0.293

2.432

0.238

0.453

0.244

18.643

38.410

0.275

0.255

DiffusionTS

0.294

0.013

0.126

\underline{0.037}

0.143

1.519

0.135

\underline{0.251}

0.370

0.134

0.114

0.117

0.446

1.869

0.253

0.100

SDformer

\underline{0.067}

\mathbf{0.007}

\underline{0.043}

\mathbf{0.036}

\mathbf{0.029}

\underline{1.009}

\mathbf{0.081}

\mathbf{0.248}

\underline{0.030}

\mathbf{0.052}

\mathbf{0.008}

\mathbf{0.112}

\mathbf{0.089}

\underline{1.129}

\mathbf{0.114}

\underline{0.084}

L-VQVAE

\mathbf{0.039}

\underline{0.008}

\mathbf{0.018}

\mathbf{0.036}

\underline{0.033}

\mathbf{0.955}

\underline{0.127}

\mathbf{0.248}

\mathbf{0.024}

\underline{0.062}

\underline{0.010}

\underline{0.115}

\underline{0.096}

\mathbf{1.118}

\underline{0.163}

\mathbf{0.083}

Table 3: Results of synthetic time series quality for 64-length sequences. Best results are in bold, and second-best are underlined.

Panel of Figure 3 — Figure 3: Per-position green-token probability ( $T{=}64$ , $\delta{=}10$ ). Shaded region: warm-up positions ( $n\leq 3$ ) where the logit bias is suppressed.

Stocks

Energy

ETTh

fMRI

Variant

C-FID

Corr.

Disc.

Pred.

C-FID

Corr.

Disc.

Pred.

C-FID

Corr.

Disc.

Pred.

C-FID

Corr.

Disc.

Pred.

no-alt-warmup

0.222

\mathbf{0.007}

\underline{0.094}

\mathbf{0.036}

0.114

1.060

0.203

\underline{0.250}

0.172

0.098

0.027

0.119

0.324

1.362

\underline{0.199}

0.093

no-warmup

\underline{0.194}

0.020

0.107

\mathbf{0.036}

\underline{0.071}

\mathbf{0.924}

\underline{0.181}

\mathbf{0.248}

\underline{0.061}

\mathbf{0.060}

\mathbf{0.007}

\mathbf{0.114}

\underline{0.255}

\underline{1.186}

\mathbf{0.170}

\underline{0.089}

LVQMark

\mathbf{0.068}

\underline{0.015}

\mathbf{0.055}

\mathbf{0.036}

\mathbf{0.035}

\underline{0.945}

\mathbf{0.151}

\mathbf{0.248}

\mathbf{0.028}

\underline{0.061}

\underline{0.010}

\underline{0.116}

\mathbf{0.133}

\mathbf{1.135}

0.267

\mathbf{0.086}

Table 4: Ablation of watermark scheduling components for 64-length sequences (LVQMark). no-warmup : unbiased warm-up removed. no-alt-warmup : both alternating partition and unbiased warm-up removed. Best results are in bold, and second-best are underlined.

Stocks

Energy

ETTh

fMRI

Model

Type

Offset

Crop

Insert

Offset

Crop

Insert

Offset

Crop

Insert

Offset

Crop

Insert

SDformer

w/o Robust

\underline{0.00}

\underline{0.01}

\underline{0.00}

\mathbf{1.00}

0.02

0.58

0.00

\mathbf{1.00}

0.02

\mathbf{1.00}

w/ Robust

\underline{0.00}

0.00

\mathbf{1.00}

\underline{0.66}

\underline{0.80}

\underline{0.13}

\underline{0.08}

\underline{0.03}

\underline{0.05}

\underline{0.28}

\underline{0.03}

L-VQVAE

w/o Robust

\mathbf{1.00}

0.00

\mathbf{1.00}

\mathbf{1.00}

0.00

\mathbf{1.00}

\mathbf{1.00}

0.01

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

w/ Robust

\mathbf{1.00}

\mathbf{1.00}

\underline{0.98}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

Table 5: Results of watermark detection under attack for 64-length sequences. LVQMark is applied to different variants, and watermark detection performance (TPR) is evaluated under 30% attacks. Best results are in bold, and second-best are underlined.

Panel of Figure 4 — Figure 4: Z-score and Context-FID across watermark strength $\delta$ for 64-length

Appendix figures & tables26 assets

Supplementary material from the paper’s appendix.

Appendix

Parameter	Energy	ETTh	fMRI	Stocks
Encoder / Decoder
Feature size $D$	28	7	50	6
$d_{\text{model}}$	512	512	512	128
Attention heads	8	8	8	4
Encoder layers	5	5	5	5
Local decoder layers	5	5	5	5

Appendix

Table 6: L-VQVAE hyperparameter settings. Stride 2 is used for window

T{=}24

; stride 4 for

T{=}64,128

\dagger

Robust encoder is trained with

\textbf{crop}_{\text{var}}

Parameter	Energy	ETTh	fMRI	Stocks
Encoder / Decoder
Feature size $D$	28	7	50	6
Hidden dim	512	512	512	512
Residual blocks	2	2	2	2
Downsample rate	4	4	4	4
EMA decay	0.99	0.99	0.99	0.99

Appendix

Table 7: SDformer hyperparameter settings.

Dataset	# Timesteps	# Features	Source
Stocks	3,685	6	https://finance.yahoo.com
ETTh	17,420	7	https://github.com/zhouhaoyi/ETDataset
Energy	19,735	28	https://archive.ics.uci.edu
fMRI	10,000	50	https://www.fmrib.ox.ac.uk/datasets

Appendix

Table 8: Details of datasets used in experiments.

Stocks

Energy

ETTh

fMRI

Partition

Offset

Crop

Insert.

Offset

Crop

Insert.

Offset

Crop

Insert.

Offset

Crop

Insert.

KGW

14.96

5.38

2.76

14.73

10.06

9.98

10.51

8.14

7.26

12.71

13.12

9.31

Ours

\mathbf{15.39}

\mathbf{16.19}

\mathbf{9.16}

\mathbf{17.30}

\mathbf{13.77}

\mathbf{13.14}

\mathbf{17.10}

\mathbf{16.09}

\mathbf{13.31}

\mathbf{14.55}

\mathbf{16.72}

\mathbf{11.88}

Appendix

Table 9: Partition rule comparison. Z-scores under 30% attacks. Best results are in bold.

Stocks

Energy

ETTh

fMRI

Partition

Offset

Crop

Insert

Offset

Crop

Insert

Offset

Crop

Insert

Offset

Crop

Insert

KGW

12.95

8.62

8.44

14.80

13.30

14.27

11.09

9.02

10.55

12.77

13.14

12.66

Ours

\mathbf{19.51}

\mathbf{15.80}

\mathbf{16.37}

\mathbf{17.35}

\mathbf{15.74}

\mathbf{16.98}

\mathbf{17.65}

\mathbf{16.53}

\mathbf{17.80}

\mathbf{14.68}

\mathbf{15.19}

\mathbf{14.49}

Appendix

Table 10: Partition rule comparison. Z-scores under 5% attacks. Best results are in bold.

Setting

Watermark (TPR

\uparrow

)

Non-watermarked (FPR

\downarrow

| Z-score)

Quality Metric (

\downarrow

)

Dataset

Model

Method

Offset

Crop

Insert

Offset

Crop

Insert

C-FID

Corr.

Disc.

Pred.

Stocks

DiffusionTS

0.00

\mathbf{1.00}

0.00

\mathbf{0.00}

+0.19

1.00

+63.26

\mathbf{0.00}

+1.91

0.96

0.10

0.20

\mathbf{0.04}

\mathbf{1.00}

0.45

\mathbf{1.00}

\mathbf{0.00}

-1.15

\mathbf{0.00}

-6.32

\mathbf{0.00}

+0.16

8.88

0.09

0.43

\mathbf{0.04}

TimeWak

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{0.00}

-0.99

0.02

+1.39

\mathbf{0.00}

-1.77

0.33

\underline{0.02}

0.16

\mathbf{0.04}

SDformer

LVQMark

0.13

0.81

0.22

\mathbf{0.00}

+0.51

0.86

+4.49

0.01

+1.33

\underline{0.11}

\mathbf{0.01}

\mathbf{0.02}

\mathbf{0.04}

L-VQVAE

LVQMark

\mathbf{1.00}

0.99

0.98

\mathbf{0.00}

-0.25

0.04

+1.10

0.02

+0.38

\mathbf{0.07}

\mathbf{0.01}

\underline{0.11}

\mathbf{0.04}

Appendix

Table 11: Results of synthetic time series watermark detection and quality. Watermarked (TPR) and Non-watermarked (FPR, mean z-score) detections are evaluated under 30% attacks. Quality metrics are for 24-length. Best results are in bold, and second-best are underlined. Z-scores with

|z|>3.09

are marked in red .

Setting

Watermark (TPR

\uparrow

)

Non-watermarked (FPR

\downarrow

| Z-score)

Quality Metric (

\downarrow

)

Dataset

Model

Method

Offset

Crop

Insert

Offset

Crop

Insert

C-FID

Corr.

Disc.

Pred.

Stocks

DiffusionTS

0.00

\mathbf{1.00}

\mathbf{1.00}

\mathbf{0.00}

+0.30

1.00

+84.66

1.00

+20.60

3.05

0.09

0.24

\mathbf{0.04}

\mathbf{1.00}

0.04

\mathbf{1.00}

\mathbf{0.00}

-4.40

\mathbf{0.00}

-10.04

\mathbf{0.00}

-5.22

2.63

\underline{0.04}

0.19

\mathbf{0.04}

TimeWak

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{0.00}

-0.16

\mathbf{0.00}

-4.18

0.69

+3.74

0.34

\mathbf{0.01}

\underline{0.15}

\mathbf{0.04}

SDformer

LVQMark

0.00

\mathbf{0.00}

-0.54

\mathbf{0.00}

-0.89

\mathbf{0.00}

-1.20

\underline{0.12}

\mathbf{0.01}

\mathbf{0.03}

\mathbf{0.04}

L-VQVAE

LVQMark

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{0.00}

+0.09

\mathbf{0.00}

-0.09

\mathbf{0.00}

+0.23

\mathbf{0.08}

\mathbf{0.01}

0.18

\mathbf{0.04}

Appendix

Table 12: Results of synthetic time series watermark detection and quality. Watermarked (TPR) and Non-watermarked (FPR, mean z-score) detections are evaluated under 30% attacks. Quality metrics are for 128-length. Best results are in bold, and second-best are underlined. Z-scores with

|z|>3.09

are marked in red .

Stocks

Energy

ETTh

fMRI

Model

C-FID

Corr.

Disc.

Pred.

C-FID

Corr.

Disc.

Pred.

C-FID

Corr.

Disc.

Pred.

C-FID

Corr.

Disc.

Pred.

TimeVQVAE

0.507

0.049

0.361

\underline{0.047}

2.527

6.632

0.476

0.383

4.417

0.263

0.415

0.199

12.532

61.599

0.459

0.156

DiffusionTS

0.329

0.022

0.160

\mathbf{0.037}

0.087

1.534

0.137

\underline{0.253}

0.231

0.212

0.078

0.121

0.181

1.976

\underline{0.085}

0.100

SDformer

\mathbf{0.028}

\mathbf{0.009}

\mathbf{0.023}

\mathbf{0.037}

\underline{0.030}

\underline{1.088}

\underline{0.093}

\mathbf{0.252}

\underline{0.036}

\underline{0.066}

\mathbf{0.010}

\underline{0.120}

\underline{0.114}

\mathbf{1.833}

\mathbf{0.056}

\mathbf{0.092}

L-VQVAE

\underline{0.034}

\underline{0.010}

\underline{0.140}

\mathbf{0.037}

\mathbf{0.018}

\mathbf{1.008}

\mathbf{0.033}

\mathbf{0.252}

\mathbf{0.029}

\mathbf{0.052}

\underline{0.018}

\mathbf{0.117}

\mathbf{0.105}

\underline{1.875}

0.209

\underline{0.095}

Appendix

Table 13: Results of synthetic time series quality for 24-length sequences. Best results are in bold, and second-best are underlined.

Stocks

Energy

ETTh

fMRI

Model

C-FID

Corr.

Disc.

Pred.

C-FID

Corr.

Disc.

Pred.

C-FID

Corr.

Disc.

Pred.

C-FID

Corr.

Disc.

Pred.

TimeVQVAE

0.293

0.087

0.135

0.039

7.738

6.631

0.498

0.344

2.205

0.251

0.256

0.143

30.672

45.692

0.250

0.149

DiffusionTS

0.344

\underline{0.014}

0.152

\underline{0.037}

0.169

1.505

0.235

0.249

1.075

0.175

0.145

\underline{0.113}

0.810

1.812

0.357

0.100

SDformer

\underline{0.128}

\mathbf{0.013}

\mathbf{0.032}

\mathbf{0.036}

\underline{0.032}

\mathbf{0.708}

\mathbf{0.057}

\mathbf{0.244}

\mathbf{0.032}

\mathbf{0.050}

\underline{0.062}

\underline{0.113}

\mathbf{0.064}

\mathbf{0.801}

\underline{0.176}

\mathbf{0.080}

L-VQVAE

\mathbf{0.038}

\mathbf{0.013}

\underline{0.035}

\mathbf{0.036}

\mathbf{0.031}

\underline{0.733}

\underline{0.155}

\underline{0.246}

\underline{0.039}

\underline{0.052}

\mathbf{0.025}

\mathbf{0.107}

\underline{0.096}

\underline{0.895}

\mathbf{0.054}

\underline{0.082}

Appendix

Table 14: Results of synthetic time series quality for 128-length sequences. Best results are in bold, and second-best are underlined.

Stocks

Energy

ETTh

fMRI

Variant

C-FID

Corr.

Disc.

Pred.

C-FID

Corr.

Disc.

Pred.

C-FID

Corr.

Disc.

Pred.

C-FID

Corr.

Disc.

Pred.

no-alt-warmup

0.211

0.014

\underline{0.141}

\mathbf{0.037}

0.081

1.172

0.151

0.254

0.180

0.113

0.066

\underline{0.123}

0.419

2.350

0.298

0.101

no-warmup

\underline{0.160}

\underline{0.013}

0.224

\mathbf{0.037}

\underline{0.060}

\underline{1.063}

\underline{0.130}

\underline{0.253}

\underline{0.093}

\underline{0.059}

\underline{0.039}

\underline{0.123}

\underline{0.346}

\underline{2.067}

\underline{0.296}

\underline{0.098}

LVQMark

\mathbf{0.074}

\mathbf{0.007}

\mathbf{0.110}

\mathbf{0.037}

\mathbf{0.028}

\mathbf{1.022}

\mathbf{0.090}

\mathbf{0.252}

\mathbf{0.046}

\mathbf{0.048}

\mathbf{0.021}

\mathbf{0.117}

\mathbf{0.200}

\mathbf{1.920}

\mathbf{0.229}

\mathbf{0.097}

Appendix

Table 15: Ablation of watermark scheduling components for 24-length sequences (LVQMark). no-warmup : unbiased warm-up removed. no-alt-warmup : both alternating partition and unbiased warm-up removed. Best results are in bold, and second-best are underlined.

Stocks

Energy

ETTh

fMRI

Variant

C-FID

Corr.

Disc.

Pred.

C-FID

Corr.

Disc.

Pred.

C-FID

Corr.

Disc.

Pred.

C-FID

Corr.

Disc.

Pred.

no-alt-warmup

0.185

\underline{0.008}

\underline{0.148}

\mathbf{0.036}

0.093

0.869

0.235

0.247

0.166

0.083

0.035

\underline{0.111}

0.257

1.023

0.134

\underline{0.084}

no-warmup

\underline{0.095}

\mathbf{0.007}

\mathbf{0.120}

\mathbf{0.036}

\underline{0.066}

\underline{0.774}

\underline{0.200}

\underline{0.246}

\underline{0.073}

\underline{0.063}

\underline{0.027}

\mathbf{0.108}

\underline{0.198}

\underline{0.900}

\underline{0.086}

\underline{0.084}

LVQMark

\mathbf{0.079}

0.009

0.179

\mathbf{0.036}

\mathbf{0.033}

\mathbf{0.740}

\mathbf{0.190}

\mathbf{0.244}

\mathbf{0.042}

\mathbf{0.050}

\mathbf{0.021}

\mathbf{0.108}

\mathbf{0.127}

\mathbf{0.896}

\mathbf{0.060}

\mathbf{0.082}

Appendix

Table 16: Ablation of watermark scheduling components for 128-length sequences (LVQMark). no-warmup : unbiased warm-up removed. no-alt-warmup : both alternating partition and unbiased warm-up removed. Best results are in bold, and second-best are underlined.

Stocks

Energy

ETTh

fMRI

Model

Type

Offset

Crop

Insert

Offset

Crop

Insert

Offset

Crop

Insert

Offset

Crop

Insert

SDformer

w/o Robust

\underline{0.13}

\underline{0.81}

0.22

\mathbf{1.00}

\underline{0.76}

\mathbf{1.00}

\underline{0.98}

0.03

0.07

\mathbf{1.00}

\underline{0.99}

\mathbf{1.00}

w/ Robust

0.07

0.20

0.08

\mathbf{1.00}

0.68

\mathbf{1.00}

\mathbf{1.00}

\underline{0.57}

\underline{0.96}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

L-VQVAE

w/o Robust

\mathbf{1.00}

0.21

\underline{0.35}

\mathbf{1.00}

0.00

\mathbf{1.00}

\mathbf{1.00}

0.01

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

w/ Robust

\mathbf{1.00}

\mathbf{0.99}

\mathbf{0.98}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

Appendix

Table 17: Results of watermark detection under attack for 24-length sequences. LVQMark is applied to different variants, and watermark detection performance (TPR) is evaluated under 30% attacks. Best results are in bold, and second-best are underlined.

Stocks

Energy

ETTh

fMRI

Model

Type

Offset

Crop

Insert

Offset

Crop

Insert

Offset

Crop

Insert

Offset

Crop

Insert

SDformer

w/o Robust

\underline{0.00}

\underline{0.00}

\underline{0.00}

\mathbf{1.00}

0.00

0.32

0.14

0.04

\underline{0.10}

\underline{0.02}

\underline{0.03}

w/ Robust

\underline{0.00}

\underline{0.00}

\underline{0.00}

\mathbf{1.00}

\underline{0.20}

\underline{0.85}

\underline{0.41}

\underline{0.11}

\underline{0.29}

0.05

0.01

L-VQVAE

w/o Robust

\mathbf{1.00}

0.99

1.00

0.00

0.81

1.00

0.00

1.00

0.62

w/ Robust

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{0.99}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

Appendix

Table 18: Results of watermark detection under attack for 128-length sequences. LVQMark is applied to different variants, and watermark detection performance (TPR) is evaluated under 30% attacks. Best results are in bold, and second-best are underlined.

Setting

Watermark (TPR

\uparrow

)

Non-watermarked (FPR

\downarrow

| Z-score)

Quality Metric (

\downarrow

)

Dataset

Model

Method

Offset

Crop

Insert

Offset

Crop

Insert

C-FID

Corr.

Disc.

Pred.

Stocks

DiffusionTS

0.00

\mathbf{1.00}

0.00

\mathbf{0.00}

+0.06

1.00

+52.15

\mathbf{0.00}

+0.41

0.96

0.10

0.20

\mathbf{0.04}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{0.00}

-0.27

1.00

+22.14

0.43

+2.88

8.88

0.09

0.43

\mathbf{0.04}

TimeWak

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{0.00}

-0.20

1.00

+9.36

\mathbf{0.00}

+0.58

0.33

\underline{0.02}

0.16

\mathbf{0.04}

SDformer

LVQMark

0.19

0.44

0.72

\mathbf{0.00}

+0.19

0.53

+3.11

\mathbf{0.00}

+0.22

\underline{0.11}

\mathbf{0.01}

\mathbf{0.02}

\mathbf{0.04}

L-VQVAE

LVQMark

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{0.00}

+0.11

\mathbf{0.02}

+0.43

\mathbf{0.00}

+0.09

\mathbf{0.07}

\mathbf{0.01}

\underline{0.11}

\mathbf{0.04}

Appendix

Table 19: Results of synthetic time series watermark detection and quality. Watermarked (TPR) and Non-watermarked (FPR, mean z-score) detections are evaluated under 5% attacks. Quality metrics are for 24-length. Best results are in bold, and second-best are underlined. Z-scores with

|z|>3.09

are marked in red .

Setting

Watermark (TPR

\uparrow

)

Non-watermarked (FPR

\downarrow

| Z-score)

Quality Metric (

\downarrow

)

Dataset

Model

Method

Offset

Crop

Insert

Offset

Crop

Insert

C-FID

Corr.

Disc.

Pred.

Stocks

DiffusionTS

0.00

\mathbf{1.00}

0.00

\mathbf{0.00}

+0.06

1.00

+55.65

\mathbf{0.00}

+2.06

1.52

0.07

0.15

\mathbf{0.04}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{0.00}

-0.35

\mathbf{0.00}

-4.62

0.05

+1.55

1.50

\underline{0.02}

0.22

\mathbf{0.04}

TimeWak

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{0.00}

-0.12

0.29

+2.56

\mathbf{0.00}

+0.11

0.29

\mathbf{0.01}

0.13

\mathbf{0.04}

SDformer

LVQMark

0.01

0.03

0.01

\mathbf{0.00}

-0.17

\mathbf{0.00}

+0.58

0.01

+0.32

\underline{0.08}

\mathbf{0.01}

\mathbf{0.01}

\mathbf{0.04}

L-VQVAE

LVQMark

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{0.00}

-0.33

\mathbf{0.00}

+0.08

\mathbf{0.00}

+0.30

\mathbf{0.07}

\mathbf{0.01}

\underline{0.06}

\mathbf{0.04}

Appendix

Table 20: Results of synthetic time series watermark detection and quality. Watermarked (TPR) and Non-watermarked (FPR, mean z-score) detections are evaluated under 5% attacks. Quality metrics are for 64-length. Best results are in bold, and second-best are underlined. Z-scores with

|z|>3.09

are marked in red .

Setting

Watermark (TPR

\uparrow

)

Non-watermarked (FPR

\downarrow

| Z-score)

Quality Metric (

\downarrow

)

Dataset

Model

Method

Offset

Crop

Insert

Offset

Crop

Insert

C-FID

Corr.

Disc.

Pred.

Stocks

DiffusionTS

0.00

\mathbf{1.00}

\mathbf{1.00}

\mathbf{0.00}

+0.09

1.00

+66.42

1.00

+5.55

3.05

0.09

0.24

\mathbf{0.04}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{0.00}

-1.32

\mathbf{0.00}

-3.91

\mathbf{0.00}

-0.47

2.63

\underline{0.04}

0.19

\mathbf{0.04}

TimeWak

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{0.00}

-0.17

1.00

+11.97

0.16

+2.05

0.34

\mathbf{0.01}

\underline{0.15}

\mathbf{0.04}

SDformer

LVQMark

0.00

\mathbf{0.00}

-0.82

\mathbf{0.00}

-0.22

\mathbf{0.00}

-0.02

\underline{0.12}

\mathbf{0.01}

\mathbf{0.03}

\mathbf{0.04}

L-VQVAE

LVQMark

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{0.00}

+0.02

\mathbf{0.00}

+0.16

0.01

+0.15

\mathbf{0.08}

\mathbf{0.01}

0.18

\mathbf{0.04}

Appendix

Table 21: Results of synthetic time series watermark detection and quality. Watermarked (TPR) and Non-watermarked (FPR, mean z-score) detections are evaluated under 5% attacks. Quality metrics are for 128-length. Best results are in bold, and second-best are underlined. Z-scores with

|z|>3.09

are marked in red .

Stocks

Energy

ETTh

fMRI

Model

Type

Offset

Crop

Insert

Offset

Crop

Insert

Offset

Crop

Insert

Offset

Crop

Insert

SDformer

w/o Robust

\underline{0.19}

0.44

0.72

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

0.01

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

w/ Robust

0.08

0.57

0.24

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

L-VQVAE

w/o Robust

\mathbf{1.00}

\underline{0.78}

\underline{0.86}

\mathbf{1.00}

\underline{0.76}

\mathbf{1.00}

\mathbf{1.00}

\underline{0.90}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

w/ Robust

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

Appendix

Table 22: Results of watermark detection under attack for 24-length sequences. LVQMark is applied to different variants, and watermark detection performance (TPR) is evaluated under 5% attacks. Best results are in bold, and second-best are underlined.

Stocks

Energy

ETTh

fMRI

Model

Type

Offset

Crop

Insert

Offset

Crop

Insert

Offset

Crop

Insert

Offset

Crop

Insert

SDformer

w/o Robust

\underline{0.01}

\underline{0.03}

\underline{0.01}

\mathbf{1.00}

0.46

\mathbf{1.00}

\underline{0.27}

0.00

0.06

\underline{0.24}

\underline{0.29}

\underline{0.24}

w/ Robust

0.00

\mathbf{1.00}

\underline{0.95}

\mathbf{1.00}

0.14

0.09

\underline{0.10}

0.04

0.12

0.10

L-VQVAE

w/o Robust

\mathbf{1.00}

0.00

\mathbf{1.00}

\mathbf{1.00}

0.03

\mathbf{1.00}

\mathbf{1.00}

\underline{0.93}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

w/ Robust

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

Appendix

Table 23: Results of watermark detection under attack for 64-length sequences. LVQMark is applied to different variants, and watermark detection performance (TPR) is evaluated under 5% attacks. Best results are in bold, and second-best are underlined.

Stocks

Energy

ETTh

fMRI

Model

Type

Offset

Crop

Insert

Offset

Crop

Insert

Offset

Crop

Insert

Offset

Crop

Insert

SDformer

w/o Robust

\underline{0.00}

0.00

\underline{0.00}

\mathbf{1.00}

0.14

\mathbf{1.00}

\underline{0.52}

0.03

0.10

\underline{0.10}

\underline{0.12}

\underline{0.11}

w/ Robust

\underline{0.00}

0.00

\underline{0.00}

\mathbf{1.00}

\underline{0.85}

\mathbf{1.00}

0.34

0.31

\underline{0.35}

0.06

0.04

0.02

L-VQVAE

w/o Robust

\mathbf{1.00}

\underline{0.94}

\mathbf{1.00}

\mathbf{1.00}

0.02

\mathbf{1.00}

\mathbf{1.00}

\underline{0.50}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

w/ Robust

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

\mathbf{1.00}

Appendix

Table 24: Results of watermark detection under attack for 128-length sequences. LVQMark is applied to different variants, and watermark detection performance (TPR) is evaluated under 5% attacks. Best results are in bold, and second-best are underlined.

Setting

Watermark (Z-score

\uparrow

)

Non-watermarked (Z-score)

Quality Metric (

\downarrow

)

Dataset

Model

Method

Offset

Crop

Insert

Offset

Crop

Insert

C-FID

Corr.

Disc.

Pred.

Stocks

DiffusionTS

0.59_{\pm 0.03}

51.54_{\pm 0.66}

0.22_{\pm 0.04}

0.19_{\pm 0.03}

63.26_{\pm 0.69}

1.91_{\pm 0.09}

0.96_{\pm 0.15}

0.10_{\pm 0.01}

0.20_{\pm 0.02}

0.04_{\pm 0.00}

85.77_{\pm 0.80}

3.11_{\pm 0.67}

52.58_{\pm 0.80}

-1.15_{\pm 1.22}

-6.32_{\pm 0.69}

0.16_{\pm 0.81}

8.88_{\pm 0.62}

0.09_{\pm 0.01}

0.43_{\pm 0.01}

0.04_{\pm 0.00}

TimeWak

180.18_{\pm 0.86}

11.24_{\pm 0.94}

56.48_{\pm 1.13}

-0.99_{\pm 0.99}

1.39_{\pm 0.86}

-1.77_{\pm 1.03}

0.33_{\pm 0.03}

0.02_{\pm 0.01}

0.16_{\pm 0.02}

0.04_{\pm 0.00}

SDformer

LVQMark

2.14_{\pm 0.96}

4.21_{\pm 1.19}

2.39_{\pm 0.94}

0.51_{\pm 0.91}

4.49_{\pm 1.28}

1.33_{\pm 0.82}

0.11_{\pm 0.02}

0.01_{\pm 0.00}

0.02_{\pm 0.02}

0.04_{\pm 0.00}

L-VQVAE

LVQMark

11.16_{\pm 1.12}

6.97_{\pm 1.40}

5.45_{\pm 0.88}

-0.25_{\pm 0.85}

1.10_{\pm 1.21}

0.38_{\pm 1.18}

0.07_{\pm 0.01}

0.01_{\pm 0.01}

0.11_{\pm 0.09}

0.04_{\pm 0.00}

Appendix

Table 25: Results of synthetic time series watermark detection and quality. Watermark and Non-watermarked detections (Z-score) are evaluated under 30% attacks. Detection and quality metrics (mean

\pm

std) are for 24-length.

Setting

Watermark (Z-score

\uparrow

)

Non-watermarked (Z-score)

Quality Metric (

\downarrow

)

Dataset

Model

Method

Offset

Crop

Insert

Offset

Crop

Insert

C-FID

Corr.

Disc.

Pred.

Stocks

DiffusionTS

0.88_{\pm 0.03}

56.36_{\pm 0.84}

4.60_{\pm 0.17}

0.21_{\pm 0.03}

69.43_{\pm 0.77}

8.11_{\pm 0.21}

1.52_{\pm 0.11}

0.07_{\pm 0.02}

0.15_{\pm 0.05}

0.04_{\pm 0.00}

143.09_{\pm 1.43}

-14.28_{\pm 0.94}

64.00_{\pm 0.80}

-1.40_{\pm 0.78}

-14.87_{\pm 0.92}

1.52_{\pm 1.01}

1.50_{\pm 0.32}

0.02_{\pm 0.01}

0.22_{\pm 0.03}

0.04_{\pm 0.00}

TimeWak

335.49_{\pm 0.81}

16.23_{\pm 0.92}

79.44_{\pm 1.28}

-0.19_{\pm 0.95}

-4.32_{\pm 0.91}

1.35_{\pm 0.91}

0.29_{\pm 0.03}

0.01_{\pm 0.00}

0.13_{\pm 0.03}

0.04_{\pm 0.00}

SDformer

LVQMark

0.59_{\pm 0.81}

0.99_{\pm 0.87}

0.42_{\pm 0.93}

-0.16_{\pm 0.89}

1.19_{\pm 1.05}

0.31_{\pm 1.04}

0.08_{\pm 0.01}

0.01_{\pm 0.00}

0.01_{\pm 0.01}

0.04_{\pm 0.00}

L-VQVAE

LVQMark

15.21_{\pm 1.05}

28.43_{\pm 1.33}

8.23_{\pm 0.85}

-0.12_{\pm 0.95}

-0.05_{\pm 1.28}

0.32_{\pm 1.06}

0.07_{\pm 0.01}

0.01_{\pm 0.01}

0.06_{\pm 0.02}

0.04_{\pm 0.00}

Appendix

Table 26: Results of synthetic time series watermark detection and quality. Watermark and Non-watermarked detections (Z-score) are evaluated under 30% attacks. Detection and quality metrics (mean

\pm

std) are for 64-length.

Setting

Watermark (Z-score

\uparrow

)

Non-watermarked (Z-score)

Quality Metric (

\downarrow

)

Dataset

Model

Method

Offset

Crop

Insert

Offset

Crop

Insert

C-FID

Corr.

Disc.

Pred.

Stocks

DiffusionTS

0.96_{\pm 0.03}

60.85_{\pm 0.68}

19.13_{\pm 0.39}

0.30_{\pm 0.03}

84.66_{\pm 0.65}

20.60_{\pm 0.43}

3.05_{\pm 0.78}

0.09_{\pm 0.01}

0.24_{\pm 0.05}

0.04_{\pm 0.00}

158.85_{\pm 1.94}

1.08_{\pm 0.95}

56.98_{\pm 0.95}

-4.40_{\pm 1.00}

-10.04_{\pm 0.81}

-5.22_{\pm 1.01}

2.63_{\pm 0.16}

0.04_{\pm 0.02}

0.19_{\pm 0.03}

0.04_{\pm 0.00}

TimeWak

466.00_{\pm 1.19}

10.37_{\pm 1.01}

76.52_{\pm 1.29}

-0.16_{\pm 0.90}

-4.18_{\pm 0.93}

3.74_{\pm 1.03}

0.34_{\pm 0.08}

0.01_{\pm 0.00}

0.15_{\pm 0.04}

0.04_{\pm 0.00}

SDformer

LVQMark

-0.57_{\pm 0.94}

-0.77_{\pm 0.66}

-0.78_{\pm 0.95}

-0.54_{\pm 0.87}

-0.89_{\pm 0.98}

-1.20_{\pm 1.10}

0.12_{\pm 0.01}

0.01_{\pm 0.01}

0.03_{\pm 0.03}

0.04_{\pm 0.00}

L-VQVAE

LVQMark

19.79_{\pm 1.51}

13.17_{\pm 1.64}

13.82_{\pm 1.20}

0.09_{\pm 0.92}

-0.09_{\pm 1.24}

0.23_{\pm 0.96}

0.08_{\pm 0.01}

0.01_{\pm 0.01}

0.18_{\pm 0.12}

0.04_{\pm 0.00}

Appendix

Table 27: Results of synthetic time series watermark detection and quality. Watermark and Non-watermarked detections (Z-score) are evaluated under 30% attacks. Detection and quality metrics (mean

\pm

std) are for 128-length.

Panel of Figure 5 — Figure 5: Visualization of original and generated samples on the Stocks dataset with length 64.

Panel of Figure 6 — Figure 6: Visualization of original and generated samples on the ETTh dataset with length 64.

Panel of Figure 7 — Figure 7: Visualization of original and generated samples on the Energy dataset with length 64.

Panel of Figure 8 — Figure 8: Visualization of original and generated samples on the fMRI dataset with length 64.

Explore similar work

Sep 28, 2026

TTMark: Pairwise Distortion-Free Watermarking Beyond Single-Token Entropy

Distortion-free watermarking enables reliable attribution of machine-generated text while preserving output distribution. However, existing methods operate independently on each generated token, making their detection capability fundamentally constrained by the entropy of the next-token distribution. We present Tandem Token WaterMark (TTMARK), a general pairwise watermarking framework that extends distortion-free watermarking from individual tokens to adjacent token pairs. By watermarking the joint distribution of consecutive tokens, TTMARK enlarges the effective watermarking alphabet from V to

V^2

, allowing the detector to exploit both token entropy and conditional entropy while preserving distortion-freeness over the joint distribution. We further introduce a branch-isolating concatenated tandem generation algorithm that efficiently constructs the joint distribution in a single forward pass. Theoretically, we show that pairwise watermarking achieves better expected detection strength in low-entropy regimes. Extensive experiments across multiple language models, datasets, and three representative distortion-free watermarking schemes demonstrate that TTMARK consistently improves detectability without degrading generation quality, while also improving robustness to edits and substantially enhancing localized watermark detection.

Ruibo Chen, Zhengmian Hu, Donghang Lu +5

University of Maryland, College Park · TikTok

Text Watermarking LLM Watermarking Robust Watermarking

Ask PDF

Aug 4, 2026

Attribute-based Undetectable Watermarking for Generative AI Models

Generative AI systems increasingly produce content whose provenance is difficult to verify, motivating watermarking techniques for identifying model-generated outputs. Existing cryptographic watermarking methods provide strong undetectability guarantees: without a detection key, watermarked outputs are computationally indistinguishable from unwatermarked ones. However, these approaches do not address the crucial deployment challenge of how to safely delegate detection capabilities. With an unrestricted detection key, a malicious detector may use the detection key beyond its intended scope, enabling watermark sanitization, scope abuse, and user profiling. To mitigate this safety concern, we introduce, to the best of our knowledge, the first attribute-based watermarking for generative AI models, providing fine-grained, policy-controlled watermark detection. In our approach, each generated output is associated with attributes, and each detection key is constrained by a policy on potential attributes. A detection key can only be used to detect watermarked outputs whose attributes satisfy the corresponding policy, while watermarked outputs that fall outside the policy remain computationally indistinguishable from unwatermarked ones. We construct such an attribute-based watermarking scheme and formalize its security properties, including consistency, adaptive robustness to bounded corruptions, undetectability, and soundness, along with a security proof under standard cryptographic assumptions. Our construction integrates constrained pseudorandom functions, pseudorandom error-correcting codes, and randomness recovery procedures with generative AI models. Finally, we implement a prototype and an empirical evaluation, demonstrating that attribute-based watermarking is both effective and practical.

Miryam Mi-Ying Huang, Chung-Wei Lee, Max Raffel +1

Carnegie Mellon University Pittsburgh, PA, USA · Independent Researcher · University of Southern California Los Angeles, CA, USA +1

Robust Watermarking

Ask PDF

Feb 25, 2026

WaterVIB: Learning Minimal Sufficient Watermark Representations via Variational Information Bottleneck

Robust watermarking is critical for intellectual property protection, whereas existing methods face a severe vulnerability against regeneration-based AIGC attacks. We identify that existing methods fail because they entangle the watermark with high-frequency cover texture, which is susceptible to being rewritten during generative purification. To address this, we propose WaterVIB, a theoretically grounded framework that reformulates the encoder as an information sieve via the Variational Information Bottleneck. Instead of overfitting to fragile cover details, our approach forces the model to learn a Minimal Sufficient Statistic of the message. This effectively filters out redundant cover nuances prone to generative shifts, retaining only the essential signal invariant to regeneration. We theoretically prove that optimizing this bottleneck is a necessary condition for robustness against distribution-shifting attacks. Extensive experiments demonstrate that WaterVIB significantly outperforms state-of-the-art methods, achieving superior zero-shot resilience against unknown diffusion-based editing.

Haoyuan He, Yu Zheng, Jie Zhou +1

Department of Automation, Tsinghua University.

Robust Watermarking

Ask PDF