cs.LGAug 20, 2026

A Locally Tokenized Generative Model for Robust Time-Series Watermarking

Authors: Dongbin Kim, Geonwoo Shin, Yujin Choi, Soyeon Park, Jaewook Lee

Organizations: Seoul National University · Nanyang Technological University

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

Watermarking is a central tool for provenance in generative models, yet its application to multivariate time series remains hindered by reliability failures under post-editing attacks. We show that existing detectors, which rely on globally coupled re-encoding, suffer from bidirectional drift of the null distribution: post-editing attacks can shift the z-score of non-watermarked samples in either direction, invalidating clean-calibrated thresholds. We argue that this instability is a property of the re-encoding, and that reliable detection requires each recovered unit to depend only on a bounded temporal neighborhood. Guided by this principle, we propose L-VQVAE, a generative model in which each discrete token is produced from a short contiguous window, and LVQMark, a watermarking method over this token space that combines logit-bias injection with robust re-encoding for attack-time detection. Experiments on four benchmarks spanning finance, energy, and neuroimaging show that our approach preserves generation quality while stabilizing both detection power and false-positive behavior under post-editing attacks.

Figures & tables

 z≫0z\gg 0z≈0z\approx 0z≪0z\ll 0
WatermarkedCorrect detectionMissStatistical anomaly
Non-watermarkedFalse positiveCorrect rejectionStatistical anomaly
Table 1: Intended interpretation of zz under a clean-calibrated detector. The validity of this interpretation requires re-encoding stability of Φ\Phi under the attack family; in its absence, null drift bidirectionally invalidates the threshold.
Figure 1: Bidirectional drift of the null on non-watermarked samples (TimeWak [ 17 ] , Stocks). Crop and insert push the recovered tokens (a) and the resulting zz -score (b) in opposite directions, with insert crossing the clean-calibrated threshold and yielding an 85%85\% false-positive rate.
Figure 2: Overview of L-VQVAE and LVQMark. (a) The local tokenizer encodes each temporal window into a discrete VQ token. (b) The global decoder reconstructs the time series from the token sequence. (c) An autoregressive transformer models the token distribution. (d) Watermark injection via scheduled logit bias with alternating partition and unbiased warm-up. (e) Robust detection via token re-encoding, where Eρ∗E_{\rho}^{*} recovers clean token assignments from the attacked signal for the green-ratio test.
SettingWatermark (TPR ↑\uparrow )Non-watermarked (FPR ↓\downarrow | Z-score)Quality Metric ( ↓\downarrow )
DatasetModelMethodOffsetCropInsertOffsetCropInsertC-FIDCorr.Disc.Pred.
StocksDiffusionTSTR0.001.00\mathbf{1.00}1.00\mathbf{1.00}0.00\mathbf{0.00}+0.21+0.211.00+69.43+69.431.00+8.11+8.111.520.070.150.04\mathbf{0.04}
GS1.00\mathbf{1.00}0.001.00\mathbf{1.00}0.00\mathbf{0.00}−1.40-1.400.00\mathbf{0.00}−14.87-14.870.05+1.52+1.521.500.02‾\underline{0.02}0.230.04\mathbf{0.04}
TimeWak1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}0.00\mathbf{0.00}−0.19-0.190.00\mathbf{0.00}−4.32-4.320.05+1.35+1.350.290.01\mathbf{0.01}0.130.04\mathbf{0.04}
SDformerLVQMark0.000.010.000.00\mathbf{0.00}−0.16-0.160.02+1.19+1.190.00\mathbf{0.00}+0.31+0.310.08‾\underline{0.08}0.01\mathbf{0.01}0.01\mathbf{0.01}0.04\mathbf{0.04}
L-VQVAELVQMark1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}0.00\mathbf{0.00}−0.12-0.120.01−0.05-0.050.01+0.35+0.350.07\mathbf{0.07}0.02‾\underline{0.02}0.06‾\underline{0.06}0.04\mathbf{0.04}
Table 2: Results of synthetic time series watermark detection and quality. Watermarked (TPR) and Non-watermarked (FPR, mean z-score) detections are evaluated under 30% attacks. Quality metrics are for 64-length. Best results are in bold, and second-best are underlined. Z-scores with ∣z∣>3.09|z|>3.09 are marked in red .
 StocksEnergyETThfMRI
ModelC-FIDCorr.Disc.Pred.C-FIDCorr.Disc.Pred.C-FIDCorr.Disc.Pred.C-FIDCorr.Disc.Pred.
TimeVQVAE0.4390.0790.3680.0565.4237.1890.4660.2932.4320.2380.4530.24418.64338.4100.2750.255
DiffusionTS0.2940.0130.1260.037‾\underline{0.037}0.1431.5190.1350.251‾\underline{0.251}0.3700.1340.1140.1170.4461.8690.2530.100
SDformer0.067‾\underline{0.067}0.007\mathbf{0.007}0.043‾\underline{0.043}0.036\mathbf{0.036}0.029\mathbf{0.029}1.009‾\underline{1.009}0.081\mathbf{0.081}0.248\mathbf{0.248}0.030‾\underline{0.030}0.052\mathbf{0.052}0.008\mathbf{0.008}0.112\mathbf{0.112}0.089\mathbf{0.089}1.129‾\underline{1.129}0.114\mathbf{0.114}0.084‾\underline{0.084}
L-VQVAE0.039\mathbf{0.039}0.008‾\underline{0.008}0.018\mathbf{0.018}0.036\mathbf{0.036}0.033‾\underline{0.033}0.955\mathbf{0.955}0.127‾\underline{0.127}0.248\mathbf{0.248}0.024\mathbf{0.024}0.062‾\underline{0.062}0.010‾\underline{0.010}0.115‾\underline{0.115}0.096‾\underline{0.096}1.118\mathbf{1.118}0.163‾\underline{0.163}0.083\mathbf{0.083}
Table 3: Results of synthetic time series quality for 64-length sequences. Best results are in bold, and second-best are underlined.
Figure 3: Per-position green-token probability ( T=64T{=}64 , δ=10\delta{=}10 ). Shaded region: warm-up positions ( n≤3n\leq 3 ) where the logit bias is suppressed.
 StocksEnergyETThfMRI
VariantC-FIDCorr.Disc.Pred.C-FIDCorr.Disc.Pred.C-FIDCorr.Disc.Pred.C-FIDCorr.Disc.Pred.
no-alt-warmup0.2220.007\mathbf{0.007}0.094‾\underline{0.094}0.036\mathbf{0.036}0.1141.0600.2030.250‾\underline{0.250}0.1720.0980.0270.1190.3241.3620.199‾\underline{0.199}0.093
no-warmup0.194‾\underline{0.194}0.0200.1070.036\mathbf{0.036}0.071‾\underline{0.071}0.924\mathbf{0.924}0.181‾\underline{0.181}0.248\mathbf{0.248}0.061‾\underline{0.061}0.060\mathbf{0.060}0.007\mathbf{0.007}0.114\mathbf{0.114}0.255‾\underline{0.255}1.186‾\underline{1.186}0.170\mathbf{0.170}0.089‾\underline{0.089}
LVQMark0.068\mathbf{0.068}0.015‾\underline{0.015}0.055\mathbf{0.055}0.036\mathbf{0.036}0.035\mathbf{0.035}0.945‾\underline{0.945}0.151\mathbf{0.151}0.248\mathbf{0.248}0.028\mathbf{0.028}0.061‾\underline{0.061}0.010‾\underline{0.010}0.116‾\underline{0.116}0.133\mathbf{0.133}1.135\mathbf{1.135}0.2670.086\mathbf{0.086}
Table 4: Ablation of watermark scheduling components for 64-length sequences (LVQMark). no-warmup : unbiased warm-up removed. no-alt-warmup : both alternating partition and unbiased warm-up removed. Best results are in bold, and second-best are underlined.
  StocksEnergyETThfMRI
ModelTypeOffsetCropInsertOffsetCropInsertOffsetCropInsertOffsetCropInsert
SDformerw/o Robust0.00‾\underline{0.00}0.01‾\underline{0.01}0.00‾\underline{0.00}1.00\mathbf{1.00}0.020.580.000.000.001.00\mathbf{1.00}0.021.00\mathbf{1.00}
w/ Robust0.00‾\underline{0.00}0.000.001.00\mathbf{1.00}0.66‾\underline{0.66}0.80‾\underline{0.80}0.13‾\underline{0.13}0.08‾\underline{0.08}0.03‾\underline{0.03}0.05‾\underline{0.05}0.28‾\underline{0.28}0.03‾\underline{0.03}
L-VQVAEw/o Robust1.00\mathbf{1.00}0.001.00\mathbf{1.00}1.00\mathbf{1.00}0.001.00\mathbf{1.00}1.00\mathbf{1.00}0.011.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}
w/ Robust1.00\mathbf{1.00}1.00\mathbf{1.00}0.98‾\underline{0.98}1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}
Table 5: Results of watermark detection under attack for 64-length sequences. LVQMark is applied to different variants, and watermark detection performance (TPR) is evaluated under 30% attacks. Best results are in bold, and second-best are underlined.
Figure 4: Z-score and Context-FID across watermark strength δ\delta for 64-length
Appendix figures & tables26 assets

Supplementary material from the paper’s appendix.

Appendix

ParameterEnergyETThfMRIStocks
Encoder / Decoder
Feature size DD287506
dmodeld_{\text{model}}512512512128
Attention heads8884
Encoder layers5555
Local decoder layers5555
Appendix
Table 6: L-VQVAE hyperparameter settings. Stride 2 is used for window T=24T{=}24 ; stride 4 for T=64,128T{=}64,128 . †\dagger Robust encoder is trained with cropvar\textbf{crop}_{\text{var}} .
ParameterEnergyETThfMRIStocks
Encoder / Decoder
Feature size DD287506
Hidden dim512512512512
Residual blocks2222
Downsample rate4444
EMA decay0.990.990.990.99
Appendix
Table 7: SDformer hyperparameter settings.
Dataset# Timesteps# FeaturesSource
Stocks3,6856https://finance.yahoo.com
ETTh17,4207https://github.com/zhouhaoyi/ETDataset
Energy19,73528https://archive.ics.uci.edu
fMRI10,00050https://www.fmrib.ox.ac.uk/datasets
Appendix
Table 8: Details of datasets used in experiments.
 StocksEnergyETThfMRI
PartitionOffsetCropInsert.OffsetCropInsert.OffsetCropInsert.OffsetCropInsert.
KGW14.965.382.7614.7310.069.9810.518.147.2612.7113.129.31
Ours15.39\mathbf{15.39}16.19\mathbf{16.19}9.16\mathbf{9.16}17.30\mathbf{17.30}13.77\mathbf{13.77}13.14\mathbf{13.14}17.10\mathbf{17.10}16.09\mathbf{16.09}13.31\mathbf{13.31}14.55\mathbf{14.55}16.72\mathbf{16.72}11.88\mathbf{11.88}
Appendix
Table 9: Partition rule comparison. Z-scores under 30% attacks. Best results are in bold.
 StocksEnergyETThfMRI
PartitionOffsetCropInsertOffsetCropInsertOffsetCropInsertOffsetCropInsert
KGW12.958.628.4414.8013.3014.2711.099.0210.5512.7713.1412.66
Ours19.51\mathbf{19.51}15.80\mathbf{15.80}16.37\mathbf{16.37}17.35\mathbf{17.35}15.74\mathbf{15.74}16.98\mathbf{16.98}17.65\mathbf{17.65}16.53\mathbf{16.53}17.80\mathbf{17.80}14.68\mathbf{14.68}15.19\mathbf{15.19}14.49\mathbf{14.49}
Appendix
Table 10: Partition rule comparison. Z-scores under 5% attacks. Best results are in bold.
SettingWatermark (TPR ↑\uparrow )Non-watermarked (FPR ↓\downarrow | Z-score)Quality Metric ( ↓\downarrow )
DatasetModelMethodOffsetCropInsertOffsetCropInsertC-FIDCorr.Disc.Pred.
StocksDiffusionTSTR0.001.00\mathbf{1.00}0.000.00\mathbf{0.00}+0.19+0.191.00+63.26+63.260.00\mathbf{0.00}+1.91+1.910.960.100.200.04\mathbf{0.04}
GS1.00\mathbf{1.00}0.451.00\mathbf{1.00}0.00\mathbf{0.00}−1.15-1.150.00\mathbf{0.00}−6.32-6.320.00\mathbf{0.00}+0.16+0.168.880.090.430.04\mathbf{0.04}
TimeWak1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}0.00\mathbf{0.00}−0.99-0.990.02+1.39+1.390.00\mathbf{0.00}−1.77-1.770.330.02‾\underline{0.02}0.160.04\mathbf{0.04}
SDformerLVQMark0.130.810.220.00\mathbf{0.00}+0.51+0.510.86+4.49+4.490.01+1.33+1.330.11‾\underline{0.11}0.01\mathbf{0.01}0.02\mathbf{0.02}0.04\mathbf{0.04}
L-VQVAELVQMark1.00\mathbf{1.00}0.990.980.00\mathbf{0.00}−0.25-0.250.04+1.10+1.100.02+0.38+0.380.07\mathbf{0.07}0.01\mathbf{0.01}0.11‾\underline{0.11}0.04\mathbf{0.04}
Appendix
Table 11: Results of synthetic time series watermark detection and quality. Watermarked (TPR) and Non-watermarked (FPR, mean z-score) detections are evaluated under 30% attacks. Quality metrics are for 24-length. Best results are in bold, and second-best are underlined. Z-scores with ∣z∣>3.09|z|>3.09 are marked in red .
SettingWatermark (TPR ↑\uparrow )Non-watermarked (FPR ↓\downarrow | Z-score)Quality Metric ( ↓\downarrow )
DatasetModelMethodOffsetCropInsertOffsetCropInsertC-FIDCorr.Disc.Pred.
StocksDiffusionTSTR0.001.00\mathbf{1.00}1.00\mathbf{1.00}0.00\mathbf{0.00}+0.30+0.301.00+84.66+84.661.00+20.60+20.603.050.090.240.04\mathbf{0.04}
GS1.00\mathbf{1.00}0.041.00\mathbf{1.00}0.00\mathbf{0.00}−4.40-4.400.00\mathbf{0.00}−10.04-10.040.00\mathbf{0.00}−5.22-5.222.630.04‾\underline{0.04}0.190.04\mathbf{0.04}
TimeWak1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}0.00\mathbf{0.00}−0.16-0.160.00\mathbf{0.00}−4.18-4.180.69+3.74+3.740.340.01\mathbf{0.01}0.15‾\underline{0.15}0.04\mathbf{0.04}
SDformerLVQMark0.000.000.000.00\mathbf{0.00}−0.54-0.540.00\mathbf{0.00}−0.89-0.890.00\mathbf{0.00}−1.20-1.200.12‾\underline{0.12}0.01\mathbf{0.01}0.03\mathbf{0.03}0.04\mathbf{0.04}
L-VQVAELVQMark1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}0.00\mathbf{0.00}+0.09+0.090.00\mathbf{0.00}−0.09-0.090.00\mathbf{0.00}+0.23+0.230.08\mathbf{0.08}0.01\mathbf{0.01}0.180.04\mathbf{0.04}
Appendix
Table 12: Results of synthetic time series watermark detection and quality. Watermarked (TPR) and Non-watermarked (FPR, mean z-score) detections are evaluated under 30% attacks. Quality metrics are for 128-length. Best results are in bold, and second-best are underlined. Z-scores with ∣z∣>3.09|z|>3.09 are marked in red .
 StocksEnergyETThfMRI
ModelC-FIDCorr.Disc.Pred.C-FIDCorr.Disc.Pred.C-FIDCorr.Disc.Pred.C-FIDCorr.Disc.Pred.
TimeVQVAE0.5070.0490.3610.047‾\underline{0.047}2.5276.6320.4760.3834.4170.2630.4150.19912.53261.5990.4590.156
DiffusionTS0.3290.0220.1600.037\mathbf{0.037}0.0871.5340.1370.253‾\underline{0.253}0.2310.2120.0780.1210.1811.9760.085‾\underline{0.085}0.100
SDformer0.028\mathbf{0.028}0.009\mathbf{0.009}0.023\mathbf{0.023}0.037\mathbf{0.037}0.030‾\underline{0.030}1.088‾\underline{1.088}0.093‾\underline{0.093}0.252\mathbf{0.252}0.036‾\underline{0.036}0.066‾\underline{0.066}0.010\mathbf{0.010}0.120‾\underline{0.120}0.114‾\underline{0.114}1.833\mathbf{1.833}0.056\mathbf{0.056}0.092\mathbf{0.092}
L-VQVAE0.034‾\underline{0.034}0.010‾\underline{0.010}0.140‾\underline{0.140}0.037\mathbf{0.037}0.018\mathbf{0.018}1.008\mathbf{1.008}0.033\mathbf{0.033}0.252\mathbf{0.252}0.029\mathbf{0.029}0.052\mathbf{0.052}0.018‾\underline{0.018}0.117\mathbf{0.117}0.105\mathbf{0.105}1.875‾\underline{1.875}0.2090.095‾\underline{0.095}
Appendix
Table 13: Results of synthetic time series quality for 24-length sequences. Best results are in bold, and second-best are underlined.
 StocksEnergyETThfMRI
ModelC-FIDCorr.Disc.Pred.C-FIDCorr.Disc.Pred.C-FIDCorr.Disc.Pred.C-FIDCorr.Disc.Pred.
TimeVQVAE0.2930.0870.1350.0397.7386.6310.4980.3442.2050.2510.2560.14330.67245.6920.2500.149
DiffusionTS0.3440.014‾\underline{0.014}0.1520.037‾\underline{0.037}0.1691.5050.2350.2491.0750.1750.1450.113‾\underline{0.113}0.8101.8120.3570.100
SDformer0.128‾\underline{0.128}0.013\mathbf{0.013}0.032\mathbf{0.032}0.036\mathbf{0.036}0.032‾\underline{0.032}0.708\mathbf{0.708}0.057\mathbf{0.057}0.244\mathbf{0.244}0.032\mathbf{0.032}0.050\mathbf{0.050}0.062‾\underline{0.062}0.113‾\underline{0.113}0.064\mathbf{0.064}0.801\mathbf{0.801}0.176‾\underline{0.176}0.080\mathbf{0.080}
L-VQVAE0.038\mathbf{0.038}0.013\mathbf{0.013}0.035‾\underline{0.035}0.036\mathbf{0.036}0.031\mathbf{0.031}0.733‾\underline{0.733}0.155‾\underline{0.155}0.246‾\underline{0.246}0.039‾\underline{0.039}0.052‾\underline{0.052}0.025\mathbf{0.025}0.107\mathbf{0.107}0.096‾\underline{0.096}0.895‾\underline{0.895}0.054\mathbf{0.054}0.082‾\underline{0.082}
Appendix
Table 14: Results of synthetic time series quality for 128-length sequences. Best results are in bold, and second-best are underlined.
 StocksEnergyETThfMRI
VariantC-FIDCorr.Disc.Pred.C-FIDCorr.Disc.Pred.C-FIDCorr.Disc.Pred.C-FIDCorr.Disc.Pred.
no-alt-warmup0.2110.0140.141‾\underline{0.141}0.037\mathbf{0.037}0.0811.1720.1510.2540.1800.1130.0660.123‾\underline{0.123}0.4192.3500.2980.101
no-warmup0.160‾\underline{0.160}0.013‾\underline{0.013}0.2240.037\mathbf{0.037}0.060‾\underline{0.060}1.063‾\underline{1.063}0.130‾\underline{0.130}0.253‾\underline{0.253}0.093‾\underline{0.093}0.059‾\underline{0.059}0.039‾\underline{0.039}0.123‾\underline{0.123}0.346‾\underline{0.346}2.067‾\underline{2.067}0.296‾\underline{0.296}0.098‾\underline{0.098}
LVQMark0.074\mathbf{0.074}0.007\mathbf{0.007}0.110\mathbf{0.110}0.037\mathbf{0.037}0.028\mathbf{0.028}1.022\mathbf{1.022}0.090\mathbf{0.090}0.252\mathbf{0.252}0.046\mathbf{0.046}0.048\mathbf{0.048}0.021\mathbf{0.021}0.117\mathbf{0.117}0.200\mathbf{0.200}1.920\mathbf{1.920}0.229\mathbf{0.229}0.097\mathbf{0.097}
Appendix
Table 15: Ablation of watermark scheduling components for 24-length sequences (LVQMark). no-warmup : unbiased warm-up removed. no-alt-warmup : both alternating partition and unbiased warm-up removed. Best results are in bold, and second-best are underlined.
 StocksEnergyETThfMRI
VariantC-FIDCorr.Disc.Pred.C-FIDCorr.Disc.Pred.C-FIDCorr.Disc.Pred.C-FIDCorr.Disc.Pred.
no-alt-warmup0.1850.008‾\underline{0.008}0.148‾\underline{0.148}0.036\mathbf{0.036}0.0930.8690.2350.2470.1660.0830.0350.111‾\underline{0.111}0.2571.0230.1340.084‾\underline{0.084}
no-warmup0.095‾\underline{0.095}0.007\mathbf{0.007}0.120\mathbf{0.120}0.036\mathbf{0.036}0.066‾\underline{0.066}0.774‾\underline{0.774}0.200‾\underline{0.200}0.246‾\underline{0.246}0.073‾\underline{0.073}0.063‾\underline{0.063}0.027‾\underline{0.027}0.108\mathbf{0.108}0.198‾\underline{0.198}0.900‾\underline{0.900}0.086‾\underline{0.086}0.084‾\underline{0.084}
LVQMark0.079\mathbf{0.079}0.0090.1790.036\mathbf{0.036}0.033\mathbf{0.033}0.740\mathbf{0.740}0.190\mathbf{0.190}0.244\mathbf{0.244}0.042\mathbf{0.042}0.050\mathbf{0.050}0.021\mathbf{0.021}0.108\mathbf{0.108}0.127\mathbf{0.127}0.896\mathbf{0.896}0.060\mathbf{0.060}0.082\mathbf{0.082}
Appendix
Table 16: Ablation of watermark scheduling components for 128-length sequences (LVQMark). no-warmup : unbiased warm-up removed. no-alt-warmup : both alternating partition and unbiased warm-up removed. Best results are in bold, and second-best are underlined.
  StocksEnergyETThfMRI
ModelTypeOffsetCropInsertOffsetCropInsertOffsetCropInsertOffsetCropInsert
SDformerw/o Robust0.13‾\underline{0.13}0.81‾\underline{0.81}0.221.00\mathbf{1.00}0.76‾\underline{0.76}1.00\mathbf{1.00}0.98‾\underline{0.98}0.030.071.00\mathbf{1.00}0.99‾\underline{0.99}1.00\mathbf{1.00}
w/ Robust0.070.200.081.00\mathbf{1.00}0.681.00\mathbf{1.00}1.00\mathbf{1.00}0.57‾\underline{0.57}0.96‾\underline{0.96}1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}
L-VQVAEw/o Robust1.00\mathbf{1.00}0.210.35‾\underline{0.35}1.00\mathbf{1.00}0.001.00\mathbf{1.00}1.00\mathbf{1.00}0.011.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}
w/ Robust1.00\mathbf{1.00}0.99\mathbf{0.99}0.98\mathbf{0.98}1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}
Appendix
Table 17: Results of watermark detection under attack for 24-length sequences. LVQMark is applied to different variants, and watermark detection performance (TPR) is evaluated under 30% attacks. Best results are in bold, and second-best are underlined.
  StocksEnergyETThfMRI
ModelTypeOffsetCropInsertOffsetCropInsertOffsetCropInsertOffsetCropInsert
SDformerw/o Robust0.00‾\underline{0.00}0.00‾\underline{0.00}0.00‾\underline{0.00}1.00\mathbf{1.00}0.000.320.140.040.040.10‾\underline{0.10}0.02‾\underline{0.02}0.03‾\underline{0.03}
w/ Robust0.00‾\underline{0.00}0.00‾\underline{0.00}0.00‾\underline{0.00}1.00\mathbf{1.00}0.20‾\underline{0.20}0.85‾\underline{0.85}0.41‾\underline{0.41}0.11‾\underline{0.11}0.29‾\underline{0.29}0.050.010.01
L-VQVAEw/o Robust1.00\mathbf{1.00}00.991.000.000.811.000.001.001.001.000.62
w/ Robust1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}0.99\mathbf{0.99}1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}
Appendix
Table 18: Results of watermark detection under attack for 128-length sequences. LVQMark is applied to different variants, and watermark detection performance (TPR) is evaluated under 30% attacks. Best results are in bold, and second-best are underlined.
SettingWatermark (TPR ↑\uparrow )Non-watermarked (FPR ↓\downarrow | Z-score)Quality Metric ( ↓\downarrow )
DatasetModelMethodOffsetCropInsertOffsetCropInsertC-FIDCorr.Disc.Pred.
StocksDiffusionTSTR0.001.00\mathbf{1.00}0.000.00\mathbf{0.00}+0.06+0.061.00+52.15+52.150.00\mathbf{0.00}+0.41+0.410.960.100.200.04\mathbf{0.04}
GS1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}0.00\mathbf{0.00}−0.27-0.271.00+22.14+22.140.43+2.88+2.888.880.090.430.04\mathbf{0.04}
TimeWak1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}0.00\mathbf{0.00}−0.20-0.201.00+9.36+9.360.00\mathbf{0.00}+0.58+0.580.330.02‾\underline{0.02}0.160.04\mathbf{0.04}
SDformerLVQMark0.190.440.720.00\mathbf{0.00}+0.19+0.190.53+3.11+3.110.00\mathbf{0.00}+0.22+0.220.11‾\underline{0.11}0.01\mathbf{0.01}0.02\mathbf{0.02}0.04\mathbf{0.04}
L-VQVAELVQMark1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}0.00\mathbf{0.00}+0.11+0.110.02\mathbf{0.02}+0.43+0.430.00\mathbf{0.00}+0.09+0.090.07\mathbf{0.07}0.01\mathbf{0.01}0.11‾\underline{0.11}0.04\mathbf{0.04}
Appendix
Table 19: Results of synthetic time series watermark detection and quality. Watermarked (TPR) and Non-watermarked (FPR, mean z-score) detections are evaluated under 5% attacks. Quality metrics are for 24-length. Best results are in bold, and second-best are underlined. Z-scores with ∣z∣>3.09|z|>3.09 are marked in red .
SettingWatermark (TPR ↑\uparrow )Non-watermarked (FPR ↓\downarrow | Z-score)Quality Metric ( ↓\downarrow )
DatasetModelMethodOffsetCropInsertOffsetCropInsertC-FIDCorr.Disc.Pred.
StocksDiffusionTSTR0.001.00\mathbf{1.00}0.000.00\mathbf{0.00}+0.06+0.061.00+55.65+55.650.00\mathbf{0.00}+2.06+2.061.520.070.150.04\mathbf{0.04}
GS1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}0.00\mathbf{0.00}−0.35-0.350.00\mathbf{0.00}−4.62-4.620.05+1.55+1.551.500.02‾\underline{0.02}0.220.04\mathbf{0.04}
TimeWak1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}0.00\mathbf{0.00}−0.12-0.120.29+2.56+2.560.00\mathbf{0.00}+0.11+0.110.290.01\mathbf{0.01}0.130.04\mathbf{0.04}
SDformerLVQMark0.010.030.010.00\mathbf{0.00}−0.17-0.170.00\mathbf{0.00}+0.58+0.580.01+0.32+0.320.08‾\underline{0.08}0.01\mathbf{0.01}0.01\mathbf{0.01}0.04\mathbf{0.04}
L-VQVAELVQMark1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}0.00\mathbf{0.00}−0.33-0.330.00\mathbf{0.00}+0.08+0.080.00\mathbf{0.00}+0.30+0.300.07\mathbf{0.07}0.01\mathbf{0.01}0.06‾\underline{0.06}0.04\mathbf{0.04}
Appendix
Table 20: Results of synthetic time series watermark detection and quality. Watermarked (TPR) and Non-watermarked (FPR, mean z-score) detections are evaluated under 5% attacks. Quality metrics are for 64-length. Best results are in bold, and second-best are underlined. Z-scores with ∣z∣>3.09|z|>3.09 are marked in red .
SettingWatermark (TPR ↑\uparrow )Non-watermarked (FPR ↓\downarrow | Z-score)Quality Metric ( ↓\downarrow )
DatasetModelMethodOffsetCropInsertOffsetCropInsertC-FIDCorr.Disc.Pred.
StocksDiffusionTSTR0.001.00\mathbf{1.00}1.00\mathbf{1.00}0.00\mathbf{0.00}+0.09+0.091.00+66.42+66.421.00+5.55+5.553.050.090.240.04\mathbf{0.04}
GS1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}0.00\mathbf{0.00}−1.32-1.320.00\mathbf{0.00}−3.91-3.910.00\mathbf{0.00}−0.47-0.472.630.04‾\underline{0.04}0.190.04\mathbf{0.04}
TimeWak1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}0.00\mathbf{0.00}−0.17-0.171.00+11.97+11.970.16+2.05+2.050.340.01\mathbf{0.01}0.15‾\underline{0.15}0.04\mathbf{0.04}
SDformerLVQMark0.000.000.000.00\mathbf{0.00}−0.82-0.820.00\mathbf{0.00}−0.22-0.220.00\mathbf{0.00}−0.02-0.020.12‾\underline{0.12}0.01\mathbf{0.01}0.03\mathbf{0.03}0.04\mathbf{0.04}
L-VQVAELVQMark1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}0.00\mathbf{0.00}+0.02+0.020.00\mathbf{0.00}+0.16+0.160.01+0.15+0.150.08\mathbf{0.08}0.01\mathbf{0.01}0.180.04\mathbf{0.04}
Appendix
Table 21: Results of synthetic time series watermark detection and quality. Watermarked (TPR) and Non-watermarked (FPR, mean z-score) detections are evaluated under 5% attacks. Quality metrics are for 128-length. Best results are in bold, and second-best are underlined. Z-scores with ∣z∣>3.09|z|>3.09 are marked in red .
  StocksEnergyETThfMRI
ModelTypeOffsetCropInsertOffsetCropInsertOffsetCropInsertOffsetCropInsert
SDformerw/o Robust0.19‾\underline{0.19}0.440.721.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}0.011.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}
w/ Robust0.080.570.241.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}
L-VQVAEw/o Robust1.00\mathbf{1.00}0.78‾\underline{0.78}0.86‾\underline{0.86}1.00\mathbf{1.00}0.76‾\underline{0.76}1.00\mathbf{1.00}1.00\mathbf{1.00}0.90‾\underline{0.90}1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}
w/ Robust1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}
Appendix
Table 22: Results of watermark detection under attack for 24-length sequences. LVQMark is applied to different variants, and watermark detection performance (TPR) is evaluated under 5% attacks. Best results are in bold, and second-best are underlined.
  StocksEnergyETThfMRI
ModelTypeOffsetCropInsertOffsetCropInsertOffsetCropInsertOffsetCropInsert
SDformerw/o Robust0.01‾\underline{0.01}0.03‾\underline{0.03}0.01‾\underline{0.01}1.00\mathbf{1.00}0.461.00\mathbf{1.00}0.27‾\underline{0.27}0.000.060.24‾\underline{0.24}0.29‾\underline{0.29}0.24‾\underline{0.24}
w/ Robust0.000.000.001.00\mathbf{1.00}0.95‾\underline{0.95}1.00\mathbf{1.00}0.140.090.10‾\underline{0.10}0.040.120.10
L-VQVAEw/o Robust1.00\mathbf{1.00}0.001.00\mathbf{1.00}1.00\mathbf{1.00}0.031.00\mathbf{1.00}1.00\mathbf{1.00}0.93‾\underline{0.93}1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}
w/ Robust1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}
Appendix
Table 23: Results of watermark detection under attack for 64-length sequences. LVQMark is applied to different variants, and watermark detection performance (TPR) is evaluated under 5% attacks. Best results are in bold, and second-best are underlined.
  StocksEnergyETThfMRI
ModelTypeOffsetCropInsertOffsetCropInsertOffsetCropInsertOffsetCropInsert
SDformerw/o Robust0.00‾\underline{0.00}0.000.00‾\underline{0.00}1.00\mathbf{1.00}0.141.00\mathbf{1.00}0.52‾\underline{0.52}0.030.100.10‾\underline{0.10}0.12‾\underline{0.12}0.11‾\underline{0.11}
w/ Robust0.00‾\underline{0.00}0.000.00‾\underline{0.00}1.00\mathbf{1.00}0.85‾\underline{0.85}1.00\mathbf{1.00}0.340.310.35‾\underline{0.35}0.060.040.02
L-VQVAEw/o Robust1.00\mathbf{1.00}0.94‾\underline{0.94}1.00\mathbf{1.00}1.00\mathbf{1.00}0.021.00\mathbf{1.00}1.00\mathbf{1.00}0.50‾\underline{0.50}1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}
w/ Robust1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}1.00\mathbf{1.00}
Appendix
Table 24: Results of watermark detection under attack for 128-length sequences. LVQMark is applied to different variants, and watermark detection performance (TPR) is evaluated under 5% attacks. Best results are in bold, and second-best are underlined.
SettingWatermark (Z-score ↑\uparrow )Non-watermarked (Z-score)Quality Metric ( ↓\downarrow )
DatasetModelMethodOffsetCropInsertOffsetCropInsertC-FIDCorr.Disc.Pred.
StocksDiffusionTSTR0.59±0.030.59_{\pm 0.03}51.54±0.6651.54_{\pm 0.66}0.22±0.040.22_{\pm 0.04}0.19±0.030.19_{\pm 0.03}63.26±0.6963.26_{\pm 0.69}1.91±0.091.91_{\pm 0.09}0.96±0.150.96_{\pm 0.15}0.10±0.010.10_{\pm 0.01}0.20±0.020.20_{\pm 0.02}0.04±0.000.04_{\pm 0.00}
GS85.77±0.8085.77_{\pm 0.80}3.11±0.673.11_{\pm 0.67}52.58±0.8052.58_{\pm 0.80}−1.15±1.22-1.15_{\pm 1.22}−6.32±0.69-6.32_{\pm 0.69}0.16±0.810.16_{\pm 0.81}8.88±0.628.88_{\pm 0.62}0.09±0.010.09_{\pm 0.01}0.43±0.010.43_{\pm 0.01}0.04±0.000.04_{\pm 0.00}
TimeWak180.18±0.86180.18_{\pm 0.86}11.24±0.9411.24_{\pm 0.94}56.48±1.1356.48_{\pm 1.13}−0.99±0.99-0.99_{\pm 0.99}1.39±0.861.39_{\pm 0.86}−1.77±1.03-1.77_{\pm 1.03}0.33±0.030.33_{\pm 0.03}0.02±0.010.02_{\pm 0.01}0.16±0.020.16_{\pm 0.02}0.04±0.000.04_{\pm 0.00}
SDformerLVQMark2.14±0.962.14_{\pm 0.96}4.21±1.194.21_{\pm 1.19}2.39±0.942.39_{\pm 0.94}0.51±0.910.51_{\pm 0.91}4.49±1.284.49_{\pm 1.28}1.33±0.821.33_{\pm 0.82}0.11±0.020.11_{\pm 0.02}0.01±0.000.01_{\pm 0.00}0.02±0.020.02_{\pm 0.02}0.04±0.000.04_{\pm 0.00}
L-VQVAELVQMark11.16±1.1211.16_{\pm 1.12}6.97±1.406.97_{\pm 1.40}5.45±0.885.45_{\pm 0.88}−0.25±0.85-0.25_{\pm 0.85}1.10±1.211.10_{\pm 1.21}0.38±1.180.38_{\pm 1.18}0.07±0.010.07_{\pm 0.01}0.01±0.010.01_{\pm 0.01}0.11±0.090.11_{\pm 0.09}0.04±0.000.04_{\pm 0.00}
Appendix
Table 25: Results of synthetic time series watermark detection and quality. Watermark and Non-watermarked detections (Z-score) are evaluated under 30% attacks. Detection and quality metrics (mean ±\pm std) are for 24-length.
SettingWatermark (Z-score ↑\uparrow )Non-watermarked (Z-score)Quality Metric ( ↓\downarrow )
DatasetModelMethodOffsetCropInsertOffsetCropInsertC-FIDCorr.Disc.Pred.
StocksDiffusionTSTR0.88±0.030.88_{\pm 0.03}56.36±0.8456.36_{\pm 0.84}4.60±0.174.60_{\pm 0.17}0.21±0.030.21_{\pm 0.03}69.43±0.7769.43_{\pm 0.77}8.11±0.218.11_{\pm 0.21}1.52±0.111.52_{\pm 0.11}0.07±0.020.07_{\pm 0.02}0.15±0.050.15_{\pm 0.05}0.04±0.000.04_{\pm 0.00}
GS143.09±1.43143.09_{\pm 1.43}−14.28±0.94-14.28_{\pm 0.94}64.00±0.8064.00_{\pm 0.80}−1.40±0.78-1.40_{\pm 0.78}−14.87±0.92-14.87_{\pm 0.92}1.52±1.011.52_{\pm 1.01}1.50±0.321.50_{\pm 0.32}0.02±0.010.02_{\pm 0.01}0.22±0.030.22_{\pm 0.03}0.04±0.000.04_{\pm 0.00}
TimeWak335.49±0.81335.49_{\pm 0.81}16.23±0.9216.23_{\pm 0.92}79.44±1.2879.44_{\pm 1.28}−0.19±0.95-0.19_{\pm 0.95}−4.32±0.91-4.32_{\pm 0.91}1.35±0.911.35_{\pm 0.91}0.29±0.030.29_{\pm 0.03}0.01±0.000.01_{\pm 0.00}0.13±0.030.13_{\pm 0.03}0.04±0.000.04_{\pm 0.00}
SDformerLVQMark0.59±0.810.59_{\pm 0.81}0.99±0.870.99_{\pm 0.87}0.42±0.930.42_{\pm 0.93}−0.16±0.89-0.16_{\pm 0.89}1.19±1.051.19_{\pm 1.05}0.31±1.040.31_{\pm 1.04}0.08±0.010.08_{\pm 0.01}0.01±0.000.01_{\pm 0.00}0.01±0.010.01_{\pm 0.01}0.04±0.000.04_{\pm 0.00}
L-VQVAELVQMark15.21±1.0515.21_{\pm 1.05}28.43±1.3328.43_{\pm 1.33}8.23±0.858.23_{\pm 0.85}−0.12±0.95-0.12_{\pm 0.95}−0.05±1.28-0.05_{\pm 1.28}0.32±1.060.32_{\pm 1.06}0.07±0.010.07_{\pm 0.01}0.01±0.010.01_{\pm 0.01}0.06±0.020.06_{\pm 0.02}0.04±0.000.04_{\pm 0.00}
Appendix
Table 26: Results of synthetic time series watermark detection and quality. Watermark and Non-watermarked detections (Z-score) are evaluated under 30% attacks. Detection and quality metrics (mean ±\pm std) are for 64-length.
SettingWatermark (Z-score ↑\uparrow )Non-watermarked (Z-score)Quality Metric ( ↓\downarrow )
DatasetModelMethodOffsetCropInsertOffsetCropInsertC-FIDCorr.Disc.Pred.
StocksDiffusionTSTR0.96±0.030.96_{\pm 0.03}60.85±0.6860.85_{\pm 0.68}19.13±0.3919.13_{\pm 0.39}0.30±0.030.30_{\pm 0.03}84.66±0.6584.66_{\pm 0.65}20.60±0.4320.60_{\pm 0.43}3.05±0.783.05_{\pm 0.78}0.09±0.010.09_{\pm 0.01}0.24±0.050.24_{\pm 0.05}0.04±0.000.04_{\pm 0.00}
GS158.85±1.94158.85_{\pm 1.94}1.08±0.951.08_{\pm 0.95}56.98±0.9556.98_{\pm 0.95}−4.40±1.00-4.40_{\pm 1.00}−10.04±0.81-10.04_{\pm 0.81}−5.22±1.01-5.22_{\pm 1.01}2.63±0.162.63_{\pm 0.16}0.04±0.020.04_{\pm 0.02}0.19±0.030.19_{\pm 0.03}0.04±0.000.04_{\pm 0.00}
TimeWak466.00±1.19466.00_{\pm 1.19}10.37±1.0110.37_{\pm 1.01}76.52±1.2976.52_{\pm 1.29}−0.16±0.90-0.16_{\pm 0.90}−4.18±0.93-4.18_{\pm 0.93}3.74±1.033.74_{\pm 1.03}0.34±0.080.34_{\pm 0.08}0.01±0.000.01_{\pm 0.00}0.15±0.040.15_{\pm 0.04}0.04±0.000.04_{\pm 0.00}
SDformerLVQMark−0.57±0.94-0.57_{\pm 0.94}−0.77±0.66-0.77_{\pm 0.66}−0.78±0.95-0.78_{\pm 0.95}−0.54±0.87-0.54_{\pm 0.87}−0.89±0.98-0.89_{\pm 0.98}−1.20±1.10-1.20_{\pm 1.10}0.12±0.010.12_{\pm 0.01}0.01±0.010.01_{\pm 0.01}0.03±0.030.03_{\pm 0.03}0.04±0.000.04_{\pm 0.00}
L-VQVAELVQMark19.79±1.5119.79_{\pm 1.51}13.17±1.6413.17_{\pm 1.64}13.82±1.2013.82_{\pm 1.20}0.09±0.920.09_{\pm 0.92}−0.09±1.24-0.09_{\pm 1.24}0.23±0.960.23_{\pm 0.96}0.08±0.010.08_{\pm 0.01}0.01±0.010.01_{\pm 0.01}0.18±0.120.18_{\pm 0.12}0.04±0.000.04_{\pm 0.00}
Appendix
Table 27: Results of synthetic time series watermark detection and quality. Watermark and Non-watermarked detections (Z-score) are evaluated under 30% attacks. Detection and quality metrics (mean ±\pm std) are for 128-length.
Figure 5: Visualization of original and generated samples on the Stocks dataset with length 64.
Figure 6: Visualization of original and generated samples on the ETTh dataset with length 64.
Figure 7: Visualization of original and generated samples on the Energy dataset with length 64.
Figure 8: Visualization of original and generated samples on the fMRI dataset with length 64.

Explore similar work

CardsList

  1. TTMark: Pairwise Distortion-Free Watermarking Beyond Single-Token Entropy

    Sep 28, 2026Ruibo Chen, Zhengmian Hu, Donghang Lu +5Text WatermarkingLLM Watermarking

    University of Maryland, College Park · TikTok

  2. Attribute-based Undetectable Watermarking for Generative AI Models

    Aug 4, 2026Miryam Mi-Ying Huang, Chung-Wei Lee, Max Raffel +1Robust Watermarking

    Carnegie Mellon University Pittsburgh, PA, USA · Independent Researcher · University of Southern California Los Angeles, CA, USA +1

  3. WaterVIB: Learning Minimal Sufficient Watermark Representations via Variational Information Bottleneck

    Feb 25, 2026Haoyuan He, Yu Zheng, Jie Zhou +1Robust Watermarking

    Department of Automation, Tsinghua University.