TabWak: A Watermark for Tabular Diffusion Models
Authors: Chaoyi Zhu
Jiayi Tang
Jeroen M. Galjaard
Pin-Yu Chen
Robert Birke
Cornelis Bos
Lydia Y. Chen
Venue: ICLR 2025 Spotlight (2025)
Keywords: Watermarking
Tabular data
Generative models
Tabular diffusion models
Primary area: alignment, fairness, safety, privacy, and societal considerations
TL;DR: We propose Tabwak, the first watermarking method for tabular diffusion models that ensures high data quality, detectability, and robustness against post-editing attacks

Abstract: Synthetic data offers alternatives for data augmentation and sharing. Till date, it remains unknown how to use watermarking techniques to trace and audit synthetic tables generated by tabular diffusion models to mitigate potential misuses. In this paper, we design TabWak, the first watermarking method to embed invisible signatures that control the sampling of Gaussian latent codes used to synthesize table rows via the diffusion backbone. TabWak has two key features. Different from existing image watermarking techniques, TabWak uses self-cloning and shuffling to embed the secret key in positional information of random seeds that control the Gaussian latents, allowing to use different seeds at each row for high inter-row diversity and enabling row-wise detectability. To further boost the robustness of watermark detection against post-editing attacks, TabWak uses a valid-bit mechanism that focuses on the tail of the latent code distribution for superior noise resilience. We provide theoretical guarantees on the row diversity and effectiveness of detectability. We evaluate TabWak on five datasets against baselines to show that the quality of watermarked tables remains nearly indistinguishable from non-watermarked tables while achieving high detectability in the presence of strong post-editing attacks, with a 100% true positive rate at a 0.1% false positive rate on synthetic tables with fewer than 300 rows. Our code is available at the following anonymized repository https://github.com/chaoyitud/TabWak.

Published as a conference paper at ICLR 2025
TABWAK: A WATERMARK FOR TABULAR DIFFUSION MODELS
Chaoyi Zhu', .Jayi Tang', Jeroen Galjaard',
Yu Chen', Robert Birke", Cornelis Bos 1,5 Lydia Y. Chen TU Delft', University of Neuchâtel', IBM Research", University of Turin', Tata Steel Research {c. zhu-zuu22 2, gam.galjaard, c.bos, y chen 10 fetudellft........oommme j.tang-14ést 14@student. tudelft.nl pin-yu. ctnnyyacchenale wwwn@ibm....eecc...m. com robert fobert.birke@unn www.keeunito....
ABSTRACT
Synthetic data offers alternatives for data augmentation and sharing. Till date, it remains unknown how to use watermarking techniques to trace and audit synthetic tables generated by tabular diffusion models to mitigate potential misuses. In this paper, we design TabWak, the first watermarking method to embed invisible sig- natures that control the sampling of Gaussian latent codes used to synthesize table rows via the diffusion backbone. TabWak has two key features. Different from existing image watermarking techniques, TabWak uses self-cloning and shuffling embed the secret key in positional information of random seeds that control the Gaussian latents, allowing to use different seeds at each row for high inter-row diversity and enabling row-wise detectability. To further boost the robustness of watermark detection against post-editing attacks, TabWak uses valid-bit mech- anism that focuses on the tail of the latent code distribution for superior noise re- silience. We provide theoretical guarantees on the row diversity and effectiveness of detectability. We evaluate TabWak on five datasets against baselines to show that the quality of watermarked tables remains nearly indistinguishable from non- watermarked tables while achieving high detectability in the presence of strong post-editing attacks, with 100% true positive rate at O. % false positive rate on synthetic tables with fewer than 300 rows. Our code is available the following repository
INTRODUCTION
Synthetic data from generative models is becoming integral to today's 's data management and artificial intelligence services. Synthetic tables generated from tabular generative adversarial networks (Zhao
2019) and tabular diffusion models (Kotelnikov al.] (023) used to augment the data for training machine learning models and substitute the original data for protect- ing privacy (Guo & Chen 2024). Synthetic tabular is the most common modality in industry and organizations, which increasingly embrace synthetic data as a privacy-preserving data-sharing so- lution (Liu et al. 2022, Qian al., 2024 Pooluru et al. (0244.. data generator to verify if piece of table is generated by itself and then take responsibility for the (misa)usage of such data. Synthetic tables pose subtler yet significant risks. For instance: 1) Financial Fraud: Synthetic datasets can manipulate performance metrics, enabling hedge funds to fabricate high returns and conceal losses. Watermarking ensures that only genuine data is used for informed decision-making diagnostic tools or treatment recommendations, potentially leading to issues like over wrerprresciitioo of medications. Watermarking safeguards data integrity, fostering trust in healthcare models. 3) Regulatory Evasion: Companies may exploit synthetic data to falsify compliance records, inflate profits, create misleading sustainability reports. As such, synthetic data is increasingly adopted
al. 2021 Xu et al.]
is important for the synthetic
2) Healthcare Misdiagnosis: Altered synthetic patient data can skew

---

Published as a conference paper at ICLR 2025
for critical tasks, it is paramount to ensure its traceability and auditability to avoid harm and mis- usages. Recent advancements in watermarking technology (Kirchenbauer et al., 2023; Kuditipudi et al. 2023 Wen et al. 2023 Zhu et al.] 2024 Yang al.; 2024) have demonstrated significant promise in texts from language models and images from diffusion models. The key challenges of designing watermarks twofold: the trade-off between the data quality and detectability, and their robustness against post-editing operations, such as deletions and insertions (Kuditipudi et al.) 2023)
Existing studies on image and language generative models focus on embedding watermarking keys during the training (Fernandez et al. (202)), sampling (Wen et al., [223] Kirchenbauer et al. 2023), and post-editing phases (Topkara
al. 2006; Barni et al. 2001] He et al. (024). Sampling phase watermarking, which alters only the sampling process without changing the model weights yet main- tains high data quality (Wen et al., 2023; Kirchenbauer et al. 2023), offers a favorable trade-off be- tween computational overhead and robustness. In the context of moken-based large language models (e.g., GPT), secret keys (Kirchenbauer et al., 2023) are used to modify the logit values of vocab- ulary tokens, thereby adjusting token probabilities for the next-word generation according to the context and keys. For image diffusion models, watermarking is proposed to be embedded in the latent space (Wen et al., 2023 Yang et al., 2024). Despite substantial research watermarking synthetic texts and images, there is, unfortunately no study on watermarking tabular generative models during the sampling phase.
Existing techniques for watermarking diffusion models (Wen et al. good balance between data quality and detectability images. However, they do not allow for direction application to the tabular domain. Applied at table level, such watermarks become susceptible to common row-level operations like sorting, shuffling, and selection, which hinders detectability. Conversely, applied at the row level using fixed pattern across rows for row-order independence diminishes cross-row diversity, ultimately negatively impacting the quality of the gen- erated data. This challenge between ensuring watermark robustness and data diversity underscores the need for new approach that safeguards against row-level transformations while preserving the overall quality and diversity of the generated tabular data.
2023 Yang et al. 2024) achieve
In this paper, we propose the first watermarking scheme, TabWak, for tabular generative models in the sampling phase. Particularly, we consider Latent Diffusion Model (LDM) (Zhang et al.) 2024) that encodes heterogeneous (i.e., both continuous and categorical) variables into a unified latent space via auto-encoder networks which diffusion models synthesize latent codes. In Tabwak, we preserve the latent distribution to be close to the model's 's assumptions (i.e., the standard Gaussian) while enabling row-wise detection for tabular data. During synthesis, a joint self-cloning and seeded shuffling technique ensures row-level variation, preventing repetitive patterns to prevent synthetic table quality degradation due repetition. During detection, our proposed valid bit mechanism increases robustness against distortions and attacks, with theoretically guaranteed improvements in detection reliability.
We evaluate T Tablak on five datasets with synthetic tables generated by TabSyn (Zhang et al. 2024) under normal and adversarial post-editing eettings.Therein Therein comparing the data quality, detectability, and robustness of TabWak against two state-of-the-ar baselines, Tree-ring (Wen et al.) (2023) (TR), and Gaussian Shading YYngg et al. 2024) (GS). Due to its close alignment with the standard Gaus- sian distribution and row-level latent variation, TabWak imposes minimal loss of data quality over original synthetic data in both terms of in terms of shape, trend, discriminability, and machine learn- ing performance (MLE). Moreover, five datasets, Tabwak demonstrates strong detectability of detecting watermarks with only 1K rows when the Z-score is higher than 3.95, which corresponds to theoretical false positive rate below 3.9 x 10 10-5, To assess the robustness of Tabwak, we designed five post-editing attacks: deletion at the row, column, and cell level, plus noise injection and shuffling across rows. Our row-wise de- tection mechanism ensures inherent robustness against row-level attacks, such as row deletion and shuffling, without any loss in detectability. Furthermore, our valid bit mechanism provides enhanced resilience against other forms of attack, ensuring best robustness among all methods.
measured by Z-scores (Casella & Berger, 2024) across all
Our primary contribution is the design and validation of TabWak, the pioneering watermarking scheme for latent tabular diffusion models. The technical contributions are detailed as follows:
2

---

Published as a conference paper at ICLR 2025
We propose novel watermarking technique that enables row-wise embedding in tabular data with minimal impact on data quality over non ootermarrarreed results regarding statistical and machine learning performance.
We introduce a valid bit mechanism to enhance the watermark's 's detectability under adver- sarial post-editing attacks.
We derive theoretical guarantee regarding row-level diversity and detection effectiveness.
We develop comprehensive benchmark for evaluating the robustness of tabular water- marks, incorporating five distinct attack types targeted at tabular data.
Extensive empirical evaluation demonstrating that TabWak meets three key objectives: i) preserving the quality of synthetic data, ii) achieving high watermark detectability across multiple datasets, with average Z-score significantly exceeding 3.95, and iii) ensuring ro- bustness, with 100% true positive rate at 0.1% false positive rate synthetic tables with fewer than 300 rows under various post-editing attacks.
RELATED WORKS
Watermarking Synthetic Data With the ability to create contents that mimic human creativity, generative Al models have achieved notable proficiency in generating high-fidelity images, videos, texts, and more (Borsos et al., 2023 OpenAT| 2023). However, this progress also introduces chal- lenges, notably the potential for misuse, such deepfakes and misinformation enabling fraud and scams (Schreyer et al. 2019 Cupta et al. 2023 Karnouskos 2020). To ensure accountability against potential misuse and risks, watermarking across various data modalities has been proposed as ef- fective strategy to enhance traceability by embedding hidden signatures into all generated content.
Watermarking Images and Text Watermarking can be integrated into generative models by mod- ifying training procedures through explicit training or modified sampling. The former involves em- bedding watermark into the training data, ensuring that the generated images Yuu et al. 202 b
Zhao et al., (223)) or text (Tang et al. 2023 Sun et al. 2023) inherently contain the watermark. The latter, on the other hand, does not require the re-training
generator per watermark. For images
Pivotal Tuning Watermarking (Lukas & Kerschbaum 2023) offers a method for watermarking pre-
trained GANs by adjusting the models during post-training Other methods use the invertibility of diffusion models (Wen et (003)) employ additional encoders and decoders to embed water- mark message-matrix (Xiong et al. 2023). without retraining. For text, alternatives use the token sequence to modify the probability distribution of the next predicted token either during the logits generation (Kirchenbauer et al. 2023) Zhu et al., 2024) or directly during the token sampling phase without modifying the logits. The latter can be implemented at the word (Kuditipudi et al. 2023) or sentence HHou et al.) 2023) level. Yet, due to their assumption on representation order, these methods fail to address the need for diversity scale and resilience column reordering of tabular data.
Watermarking Tables Recent works (He et al. 2024 Zheng et al. 2024) on watermarking syn- thetic tabular data have focused on embedding watermarks through additive post-editing noise to ensure numerical values fall into strategically chosen intervals. However, no existing method ad- dresses watermarking at the sampling phase, where the watermark is embedded in the noisy latent space rather than directly modifying the tabular data itself. In this work, we extend watermarking techniques to latent tabular diffusion models in the sampling phase with our proposed T TabWak, which maintains high synthetic data quality, achieves superior watermark detectability, and demon- strates strong resilience against post-editing attacks.
TABWAK: ROW-WISE TABLE WATERMARKING
The primary distinction between diffusion models for images and tables lies in the nature of their latent representations. For image diffusion, the latent representation encapsulates all pixels of single image as a unified whole, allowing watermarking techniques to target this holistic represen- tation. In contrast, tabular diffusion models generate row-specifie latent representations, where each row of a table is treated as an independent unit to enhance the diversity between rows and water- mark robustness post-editing attacks. This is analogous to watermarking batch of independent
3

---

Published as a conference paper at ICLR 2025
images, where each row behaves like separate image. These fundamental differences introduce ad- ditional challenges that make a straightforward application of image-based watermarking methods unsuitable for tabular diffusion models, demarcated by three key factors:
Independent Row Units: Row-level operations such as row shuffling, deletion, or reorder- ing are common when handling tables. This necessitates row-wise detection of watermarks rather than treating the table unified entity. The watermarking technique proposed by (Wen et al. 2023), for example, embeds the watermark in the Fourier space of the latent space, treating the table holistically. This approach, however, unsuitable for row-by-row detection in tabular data, where the dependence across rows is crucial for detecting any alterations or attacks granular level.
Latent Representation Diversity: Unlike images, where different prompts naturally con- tribute to diverse generated outputs, tabular data lacks this diversity enhancer. In fact, the latent representations across rows are too homogeneous, e.g., due equal per-row watermarking like Yang et al. (2024), the quality and utility of the generated table can sig- nificantly degrade. Therefore, ensuring diversity across row-wise latent representations is critical for maintaining the table's integrity while embedding a robust watermark.
Unique Post-editing Attacks: Post-processing in the tabular domain differs significantly from the image domain. Tabular-specific attacks, such as row delction, row shuffling, and column deletion, require a watermarking scheme to be robust against these unique chal- lenges.
In summary, our watermarking method focuses on the following: (i) Performing watermarking row- wise, thereby alleviating the dependence on row-ordering during detection. (ii) Ensuring row-wise diversity in the latent representations via self-cloning with shuffling. (iii) Robustness against post- editing attacks.
Latent Diffusion Models Inversion Latent diffusion models use latent variables x, for [T....0] throughout the generation process, necessitating a decoder 'D that converts the denoised latent variable 2p into tabular data X,. Watermark detection necessitates reversing the process. During detection, we reconstruct the latent tabular data through iterative gradient descent, follow- ing (Hong al.) 2024). Thereby reducing latent reconstruction error due to the in-exact mapping of the encoder and decoder mapping. Furthermore, to recover the latent variable zy, we incorporate the DDIM (Denoising Diffusion Implicit Models) inversion (Wen al., (003). enabling the recovery of ăr from the reconstructed latent &o following the decoder inversion step.
3.1 GAUSSIAN WATERMARK EMBEDDING
The dimension of the latent representation Zy for a single row defined as m. Let Φ(x) denote the probability density function of the standard Gaussian distribution (O, 1), and (xx) represent its cumulative distribution function (CDF). The function Φ(x) is partitioned into quantiles (segments) of equal cumulative probability. Using the prressioon-reervingg approach in (Yang et al., 2024). we construct a control seed d consisting of integers of the length m, where each element d, E 10, l). When d, = the watermarked latent representation 2y is constrained the k-th quantile of o(x). implying that =Y,; is sampled from the following conditional distribution:
p (2T,a d. = -k) 1. (z(0 0
if <
<x
I
[+
otherwise.
Self-Cloning plus Shuffling Mechanism Previous methods for image generation (Yang et al.) 2024) use as the control seed. Using the same d for all rows leads to poor diversity (see Appendix]] F for example). Conversely, using row-specific d requires matching each row to the correct d during detection, which makes the watermark vulnerable to even simple row reordering attacks. In contrast, introduce self-cloning plus shuffling mechanism that embeds the secret watermark key into the ordering of the elements in d. This allows the generation of distinct control seeds while ensuring row-level detectability via unique watermark key.
4

---

Published as a conference paper at ICLR 2025
Watermark embodding
X
Seifeeloning
deg 2011
Shuffling
Dirtusion
col.
col2
col3
Preserving
KLOE BST
11.2
mire
0.8
Sampling
28
10.3
6.7
Atticks
Comparison
66.77 75,
Reverie
Burk
Diffasion
cal1
23
col.
col3
0.38-- 4
100%
100%
UnssufMinn
Sampling
2f
Inversion
29
10.7
6.3
Watermark dotection
3m
X
2
DEG Decoder Inversion
The framework of TabWak. The first half of the control seed, do: 1,, is randomly drawn from discrete uniform distribution over 0, After self-cloning and shuffling, the control seed is used for distribution-presstd preeserrinnnnneiiinnggggg sampling. The tabular data is then generated by the latent diffusion model. During detection, the control seed is recovered through diffusion inversion, reverse sampling, and un-shuffting. Finally, the bit accuracy between the first and second halves of each row checked.
Figure 1:
The proposed method divides the control seed d. with length m, into two parts: dom//21 and d where represents the dimensionality of the latent vector for row. In our experiments, m is model- and data-related hyperparameter, calculated as the product of the token dimension and the number of columns in the table. The first part, do:m/2-1, is sampled from discrete uniform distribution over the set {0, .1...,,....................... I - 1}. while the second part, dm/22mm is set to be identical to d0.m/2-1- The elements of the sequence are shuffled using a pseudo-random permutation, seeded by the watermark key K, to produce the row signature d' Let d (do, di,,... dm-i) represent the control sequence. The shuffling process can be described using permutation π. of the indices (0, 1.... m 1}, where n, is determined by the watermark key n.
The new shuffled signature d' is then given by:
di - = for = 1,,,..., 1
Given 1) from discrete uniform distribution, subsequently sample the latent variable 2r as:
1 + d=
+
27
where - (+) is the percent point function (PPF) of a standard Gaussian distribution (-). For detection and extraction of the watermark, the inverse mapping is given by,
d' = | + (z]").
Given the watermark key K, the original control seed d can be recovered from the shuffled sequence d' using क,. which reverses the effect of the shuffle πx,- The inverse-shuffle sequence it then obtained following.
d; 4= x (i)
for 0, o,l....,m 1,
where πテ is the pvvess-permutttiinn function mapping each permuted each index in d back to its original index in d.
5

---

Published as a conference paper at ICLR 2025
The bit accuracy is then defined as,
m/2-1
1
Abst
Σ
[[d: dm/2+e),
m/2
where I(.) is the indicator function returning if the clause (.) holds, else O. Fig. summarizes the overall embedding and detection procedure.
Valid Bit Mechanism To improve the robustness of our detection, reconstruct d' at finer granularity by setting / = 4, i.e., mapped to four quantiles as opposed to two during generation. This change helps mitigate the effects of random noise introduced into the recovered latent during recovery or under attacks, which we denote as 27. We use the following quantile-based transfor-
mation to classify the latent values into 1 = categories: d' = 4 $ (2%) where & (-) is the
empirical CDF of latent 27. And after the inverse shufiling, we get d, d= '
To perform the bit accuracy calculation, we focus primarily on the extrema values of the distribution (i.e, low 2υ < (0.25), and high 2 > (00.7)) in the sequence, they are less likely to be altered by noise or attacks. Thus, the bit accuracy is computed as follows:
Ema2 ((d: and dm/2+i or 1) or (d: = and dmm/24 = 2 or 3))
Aubit
EmI (d: d, 3)
Expected bit accuracy under Gaussian Noise Theorems [ and 2 in Appendix C present expected bit accuracy for TabWak, both with and without the valid bit mechanism, when the latents generated by the control sequence d are perturbed by Gaussian noise following (0, σ), i.... = 2r c(o), where N(0, o). In summary, under these conditions, the expected bit accuracy for TabWak without the Valid Bit Mechanism given by
(
00
(-
x )
6(z) dx) + ( Φ
x
E [Abu]
1 +
x(x)
dx
Similarly, the expected bit accuracy for TabWak with the Valid Bit Mechanism is expressed as:
| (0025)
+b
40 (0.25))
225)/===* 7 +x
(x))dz
(5=-
(0.25))
+ (+) o(z)dz)
+ (0.25)
(0.25) 1+0
((x)dx
+ (00(0025)
+ (==) ((x)dx)
E [Aviii] = 16
+ (0.25)
(0.25) 11
(lx)dx
x
(0.1(0
+ ( ((x))dr)
((x)) dr
+ ((x)) )xr
4 (0.25)
(0.25)
Figure 2 presents the curves for E [Aii |o| and Avbit o). As expected, the bit accuracy for both models is 0.5 when ES is randomly sampled from a standard Gaussian distribution (i.e., without wa- termarking). Moreover, it is evident that, for the
Expeeted Bit Accomey
same noise level a, E [Aviil] consistently exceeds [Abi]]. This implies that (E [biit - 0.5) S
(E [Avba o] 0.5) for > O. Consequently, at
equivalent noise levels, the Valid Bit Mechanism in TabWak introduces greater disparity in bit ac- curacy compared to randomly drawn latents (non- watermarked latents). In other words, the Valid Bit Mechanism enhances robustness against noise, re- sulting in improved detection accuracy.
Sigma
Figure 2: Comparison of expected bit aceu- racy with and without the Valid Bit Mecha- nism.

---

Published as a conference paper at ICLR 2025
4 EVALUATION
4.1 EXPERIMENTS SETUP
Datasets We used five widely utilized tabular datasets to evaluate the performance of the pro- posed Tabwak on synthetic data quality, its effectiveness of watermark detection, and its robustness against post-editing attacks. These include: Shoppers (Sakar & Kastro Kastro|[018)) Magic (Bock) 2007), Credit (Yeh) 2016), Adult (Becker & Kohavi, 1996). and Diabetes (Strack et al. 2014). Additional details regarding these datasets are provided Appendix E.
Metries Data quality: The quality of synthetic data is assessed through similarity, discriminability, and utility. Similarity measures how well the synthetic data reflects the original, focusing on shape (distribution comparisons using Dolmogorov-Sminno and total variation distance) and trend (cor- relation preservation across columns). Discriminability uses logistic regression to evaluate whether a model can distinguish between synthetic and real data, with higher scores indicating better indis- tinguishability. Utility assesses how well synthetic data performs machine learning tasks, using olassfication/regressoon models to compare AUC and RMSE scores, Detectabilty: Detectability is assessed using Z-score. which measures the difference in mean values between synthetic table with and without watermark, and TPR @ XFPR, which evaluates the True Positive Rate (TPR) at a X% False Positive Rate (XFPR) in the detection of the watermarked table.
Tabular generative model All experiments used consistent latent tabular model architecture based on the Tabsyn framework Zhang et al. (2024). that all watermarking methods are applied dur- ing the generator's sampling phase, models for each dataset are shared across methods. Hence, for each dataset, the same generator is sampled multiple times with different watermarked latent codes to evaluate the watermark's 's effectiveness. Detailed model specifications are provided in Ap- pendix B.
Baselines. To the best of our knowledge, no sampling phase watermarking technique for tabular data has yet been proposed in related work. Therefore, we adapt two commonly used watermarking techniques in image diffusion Modell-TTree-Ringg (TR) (Wen et al., 2023) and Gaussian Shading (GS) (Yang et al. 2024)-44 to the tabular diffusion model. And poss-processig watermark (He) et al. 2024) is also included in the Appendix F3 Detailed implementation of these methods can
be found in Appendix D.1
4.2 GENERATIVE TABULAR DATA QUALITY AND WATERMARK DETECTABILITY
To evaluate the quality of the watermarked tabular data, for each comparison we generate as many rows as the original datasets. To evaluate the detectability of the watermarks, we generate given number of rows to compute the Z-score. The mean and standard deviation across 100 tests of each quality metric and Z-score for 1K, 5K and 10K rows are presented in Table 1 These all one- tailed Z-scores. Specifically, for Tree-Ring, the distance between watermark batches in the Fourier space for the watermarked table is expected be smaller than for the won-waaermrrred table. For Gaussian Shading and our method, the bit accuracy of the watermarked table is expected to be higher than that of the watermaardd table. The relationship between the one-tailed Z-score and p-value is illustrated in Figure in in the Appendix E.2
From the results, we observe that our method consistently delivers the best or second-best quality scores both with and without the valid bit mechanism, except the Diabetes dataset where Tree- Ring at times comes in second. The quality metrics for our method are also close to those of non- watermarked data. In contrast, Gaussian Shading exhibits the worst quality scores. For instance, in all datasets, the Logistic detection score for Gaussian Shading is at least 0.4 points worse than our proposed method. This significant drop is likely caused by Gaussian Shadings' fixed control seed across rows, resulting in less diversity in the generated tabular data.
Regarding detectability, the Gaussian Shading method shows the highest Z-scores in the Magic, Adult, Credit, and Diabetes datasets, and the second highesst Z-score in the Shoppers dataset, thanks to the shared control seed. With the valid bit mechanism, the detcctability of our method improves significantly, achieving the highest Z-score in the Shoppers dataset and the second- -ighestt in the others, except for the Adult dataset. Across all datasets and row counts, the Z-scores consistently
7

---

Published as a conference paper at ICLR 2025
Table 1: Synthetic Table Quality and Watermark Detectability: Comparison of methods without
watermarking ("W/O"), Tree-Ring ("TR"), Gaussian Shading ( ('GS"), ) and TabWak without ("Ours') and with ( ("Ours"") the Valid Bit Mechanism. Best results are shown in Bold, and second-best results are underlined. Metrics include various quality measures and Z-scores for different row counts.
Quality Metric
Z-score 5K rows
Datasets
Method
Shupe1
Trend"
Logistic
MCE1
TK rows
IOK rows]
W/O
0,922a-0001
0.907
0.635
08.12
TR
0.892#0001
0.876=0.201
0.499
0.864+00.00
3.1
6.17=0.75
6.68
Shoppers
GS
0.767
0.7161:0000
0.166.20000
0.81610031
10.02
22.66.um77
31.92:091
Ours
0,905
40.000
0.523
0.878
5,42a0as
11.89
16,94
Ours"
0.914
0.906
0.580
0.867 10002
15.46
34.52.1105
48.59 2015
W/O
0.917
0.939
0.7 0.710
0,906.10:004
TR
0.890
0.928
0.626=00000
0,904::0.04
1.54:075
3.56=0094
4.72=0097
Magic
GS
0.812
0,913
0,383
0,902.00m6
16.54_992
36,77
52.11 11:89
Ours
0.897
0.934
0.656.m00
0.904
5.88
13.17
+114
Ours
0.908
0.927.0011
0.705
0.876
11.29
25.30
15.98
W/O
0,93310001
0.887
0.653200m
0,876100e
TR
0,924
0.868
0.6402:0013
0,872
0.77
0.84
0,93
Adult
GS
0.732g000
0.487
0.023amm0
0.85810000
18.63
41.6411.9
58.60
Ours 0.932.10m1
0.872
0.661
0.874
15.8
35.08
49. 99.70.
Ours
0.981
0.884:00.0
0.645=0000
0.874
12.58
28.452105
15
W/O
0.9302000
0.905
0,741
0.74310013
TR
0.912
1:0.022
0.737 2:0012
2.90
5.56=1.0
6.48
Credit
0.56620000
0.65520000
0. 0.1
0.715
$7.69:0088
84.09
118.81
Ours Ours*
0.928
0.905
0.750=0.006
0.741
4.99
11.35au97
15.79
0.922+0010
0.892+0016
0.677 -6677=0066
0,744+0009
10
22.91
12.04
W/O
0.873
0.743
0.748=00034
0.803
0.858
0.726..0.84
0.69820024
0.794
2.33
6. 6.86
7.59 2009
Diabetes
GS
0.73220004
0.720
0.129::000
0.000+00000
24.94=0.50
55.56:005
78.8
Ours
0.749
0.737
0.777
2.39
5.42=0.9
7.70 7.86-0.1
Ours*
0.849
0.733
0.694:00022
0.801=0039
3.95
11.27
higher than 3.95, indicating that we can detect our watermark in all cases with a false positive rate (FPR) less than 3.9 x 10-5
4.3 ROBUSTNESS AGAINST POST-EDITING ATTACKS
For robustness against post-editing attacks, we designed five types of attacks: row deletion, column deletion, cell deletion, Gaussian noise, and shuffling. In the row deletion and cell deletion attacks, a certain percentage of rows or cells (5%, 10%, 20%) is removed. In the column deletion attack, specific number of columns (1-3 columns) are deleted. For the Gaussian noise attack, noise is added to the numeric columns of the tabular data, where the noise's standard deviation is percentage of the cell value. In the shuffling attack, the rows of the table are shuffled.
For the Tree-Ring watermark, which does not support row-by-row detection, handle row dele- tions by replacing the deleted rows with those from a non-watermarked table. Similarly, for column and cell deletions across all watermarking methods, replace deleted values with randomly sam- pled non- -otermaerrdr data to obtain the corresponding latent codes.
Table presents the average Z-score for watermarked table with 5K rows under different types of attacks across 100 tests. To reduce the impact of failed tests on the average Z-score, we set negative Z-scores in the one-tailed Z-test zero when calculating the average. From the results, we ob- serve that Tree-Ring, which performs ordered table-level detection, exhibits low robustness against row-related attacks, such as row deletion and row shuffling, with Z-scores falling below 0.6. In con- trast, Gaussian Shading and our method, which are inherently robust against these types of attacks, demonstrate superior performance. Notably, the valid bit mechanism shows strong performance. For our method without the valid bit mechanism, the Z-score drops lot under stronger attacks. In the case of column deletion attacks, the Z-score drops to in 2 out of 5 datasets. However, for our method with the valid bit mechanism, the average Z-score remains above 4 across all test conditions. In most cases, the Z-score is either the highest or second-highess, among the compared methods.
Figure 3 Fillustrates the trade-off between detectability and data quality across various watermarking methods. The x-axis represents the theoretical false positive rate (p vallll,), while the y-axis shows the average of four data quality metrics (Shape, Trend, Logistic, and MLE) from Table T evaluated
8

---

Published as a conference paper at ICLR 2025
Robustness Against Post-Editing Attacks: Average Z-score on 5K rows, repeated 100 times, for methods without watermarking ("W/O'), Tree-Ring ("TR'), Gaussian Shading ('GS"), and TabWak without ('Ours') and with ("Ours")) the Valid Bit Mechanism. Best results are shown in Bold, and second-best results are underlined. Z-scores without attacks at 5K rows reprinted in (parentheses) from Table
Table 2:
Attacks
Daraset
Method
Row DXtettion
Cplamn Delettioe
Call Deletion
Cimessian Noise
SPatfling
55%
105
2016
2 coll
5.col
5%
10%
20%
15%
10%
20%
[6.17)
1.55
3.87
Shoppers
GS
(22.66)
21.95
21.36
20.02
20.99
19.18
9.19
22.29
21.96
22.02
22.25
21.24
21.64
22.49
Ours
(11.89)
11.54
11.27
10.68
12.19
15.70
9.41
12.48
13.34
14.48
11.60
6.26
0.00
11.81
(34.52)
33.58
32.69
34.33
37.38
33.36
27.60
29.84
TR
[3,56]
0.41
0.34
0.41
2.29
1.01
00:42
4.33
4.53
4.06
4.95
4.39
4,38
0.00
GS
(36.77)
35.97
35.11
33,07
35.73
32,80
34.37
35.37
34.08
31.96
36.89
36.91
36.86
36.92
Magic
Ours
(13.17)
12.88
12.68
0.00
0.00
12.87
11.19
Ours
(25.30)
24.78
23.98
22.61
32.38
32.35
37.80
26.92
28.13
30.17
25.51
25.12
25.06
25.39
TR
(0.84)
0.39
0.37
0.36
0.4%
0.57
0.30
0.37
0.29
0.67
1,46
Adult
GS
Durs
(35.08)
(41.64)
40.43
34.17
39.40
33.49
31.46
37.34
37.94
31.32
48.50
29.24
50.79
19.55
43.14
36.41
43.55
34.08
43.39
35.60
51.02
28.02
66.03
14.22
83.84
3.83
35.30
41.67
24.92
27.57
52.53
1K
[5,56]
0.38
0.39
0.39
3.31
1.14
0.37
3.35
4.31
3.36
5.70
5.37
4.75
0.00
Credit
GS
(84.09)
82.20
79.88
75.45
84.59
84.49
88.94
83.78
84.05
84,21
74,20
73.16
76.30
84.36
Ours
(11.35)
10.52
8.93
Ours
(22,91)
22.11
21.65
20.29
27.31
32.71
34.98
26.65
30.31
36.24
23.18
24.31
27.17
22.88
TR
(6,86]
0.83
0.42
0.39
1.60
3.13
2.15
6.56
6.27
5:70
6.51
5.38
2.37
0.00
Diabotes
Ours
(55.56)
(5.42)
5.42
52.88
4.94
4.71
1.27
56.94
0.00
58.93
0.00
1.15
2.31
50.72
3.84
53.81
0.08
0.02
0.23
5.32
Ours
(7.86)
7,76
7,63
7,11
4.98
10.94
12.74
4.76
4.41
3.61
6,56
6.73
3.83
7.91
Ary spalt
Minteet
Lhdkert Minton
Higge
Mouk
Cuaca
030
044
pintter
pirater
pindee
(a) Row Del. (20%)
(b) Column Del. (3 col)
(c) Cell Del. (20%)
(d) Gaussian Noise (20%)
Figure 3: The trade-off between p-value under various attacks and the average data quality
iiddiattt under the strongest attack settings. Notably, TabWak with valid bit mechanism(Ouss* indicated by filled plus markers) predominantly occupies the upper-left region, signifying superior performance in most scenarios, except under cell deletion and Gaussian noise attacks on the Diabetes dataset. In contrast, Gaussian Shading (GS), while demonstrating strong detectability, consistently appears in the lower-left region, emphasizing its compromise on data quality for robustness.
Figure explores the relationship between the number of rows and TPR @0. 1%FPR (True Positive Rate under 0.1 % False Positive Rate). For each row count, 10 repetitive experiments were conducted on 100 tables. The strongest attacks from Table@were used: Cell and Noise attacks were set 20% strength, and three columns were deleted for the Column Deletion (Del.) attack.
As shown in Figure 4 our method with the valid bit mechanism (Ours*) consistently demonstrates a significantly higher TPR compared to the version without it (Ours). Notably, our method with- out the valid bit mechanism underperforms, achieving a TPR %FPR below 0.5 out of 12 cases effesvvffettielly random guessing. In contrast, our method with the valid bit mechanism achieves a 1.0 TPR @0.10001111 FPRR all cases with 11 cases requiring as few as 200 rows and 1 case needing fewer than 300 rows. Moreover, our method with the valid bit mechanism shows similar better detectability than Gaussian Shading in most scenarios while maintaining a significantly higher data quality.

---

Published as a conference paper at ICLR 2025
Shopper
Magic
Adult
Credit
Colurn Del.
THULE 1787
5 5
TRRge 11277
TRAIE
Namber Bonva
Naator Rtrea
Natbero Rowa
Numbo of
Cell Del.
Narker Roos
No Booes
Narber Ross
Ntesber
TPRE 75PPP
Noise
TPR-8
20
10
60
1100
1900
Figure 4: @PR@0.1% FPR versus row count four datasets under various attacks. Cell and Noise attacks are set 20% strength; Column Deletion (Del.) is fixed to three columns.
5 CONCLUSION
Motivated by the necessity and urgency to audit the usage of synthetic tables, we propose TabWak- the first row-wise watermarking scheme for tabular diffusion models. TabWak aims embed an imperceptible pattern in each row, while maintaining high quality of tables and detectability in the presence of post-editing attacks. The novel feature of TabWak to embed the secrete key in the positional information and values of random seeds that control Gaussian latent codes for each row, without affecting the Gaussian distribution nor limiting the sampling choices. Another feature of TabWak is the valid-bit detection, particularly the tail distribution of latent embeddings. We val- idate the effectiveness of TabWak through theoretical claims and extensive experiments. Evaluation results on five datasets against image-based based watermarking baselines show that TabWak achieves the highest tabular quality measure thanks to its diversity in latent, and resilient detectability with or without attacks.
REPRODUCIBILITY AND ETHIC STATEMENT
To ensure the reproducibility of our research, we have open-sourced the code for the various wa- termarking techniques and the tabular diffusion model, as shown in htttps: htttps://gitutt thub. com/ chaoyitud/ Tabbak Furthermore, all experiments conducted as part of this study utilized pub- licly available datasets.
With the popularity of diffusion models and their applications, embedding watermarks into their generated content is an essential step toward trustworthy and responsible Al technology development and deployment. Our findings of improved watermark detection performance and utility provide novel insights into the research and practice of watermarking for synthetic tables.
ACKNOWLEDGMENTS
This research was partly funded by the SNSF project, Priv-GSyn 200021E 229204, the DEPMAT project (with project number P20-22 / N21022) of the research programme Perspectief which is partly financed by the Dutch Research Council (NWO), by the Spoke "FutureHPC BigData" of the ICSC-Centro Nazionale di Ricerca in "High Performance Computing, Big Data and Quantum Computing", funded by the European Union NextGenerationEU, and by the DYMAN project funded by the European Union European Innovation Council under G.A. 101161930. It is also part of the Partnership Program the Materials innovation institute M2i (www.m2i.nl), We would like express our gratitude all involved in these projects for their support and contributions.
10

---

Published as a conference paper at ICLR 2025
REFERENCES
Bang An, Mucong Ding, Tahseen Rabbani, Aakriti Agrawal, Yuancheng Xu, Chenghao Deng, Sicheng Zhu, Abdirisak Mohamed, Yuxin Wen, Tom Goldstein, et al. Waves: Benchmarking the robustness of image watermarks. In Forty-first International Conference on Machine Learn- ing.
Mauro Barni, Christine I Podilchuk, Franco Bartolini, and Edward J Delp. Watermark embedding: Hiding a signal within a cover image. IEEE Communications magazine, 1928):00--108, 2001.
Barry Becker and Ronny Kohavi. Adult. http://ddoiorg/10.2444///C
UCI Machine Learning Repository, 1996. DOI:
R. Bock. MAGIC Gamma Telescope.
UCI Machine Learning Repository, 2007. DOI:
https://doi.or//1..244444 10441////444444888....
Zalán Borsos, Raphaël Marinier, Damien Vincent, Eugene Kharitonov, Olivier Pietquin, Matt Shar- ifi, Dominik Roblek, Olivier Teboul, David Grangier, Marco Tagliasacchi, et al. Audiolm: language modeling approach to audio generation. JEEE/ACM Transactions on Audio, Speech, and Language Processing, 2023.
George Casella and Roger Berger. Stutistical inference. CRC Press, 2024.
Synthetic Data Metrics. DataCebo, Inc., 10 2023.
URL https://docs .ev.
sdmetrics// Version 0.12.0.
Pierre Fernandez, Guillaume Couairon, Hervé Jégou, Matthijs Douze, and Teddy Furon. The sta- ble signature: Rooting watermarks in latent diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 22466-22477, 2023.
Xu Guo and Yiqiang Chen. Generative ai for synthetic data generation: Methods, challenges and the future. arXiv preprint arXiv:2403.0411 04990, 2024.
Maanak Gupta, CharanKumar Akiri, Kshitiz Aryal, Eli Parker, and Lopamudra Praharaj. From chatgpt to threatgpt: Impact of generative ai in cybersecurity and privacy. IEEE Access, 2023.
Hengzhi He, Peiyu Yu, Junpeng Ren, Ying Nian Wu, and Guang Cheng. Watermarking generative tabular data. arXiv preprint arXiv:2405.1 /4018, 2024.
Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic mod- els. In Hugo Larochelle, Mare' Aurelio Ranzato. Raia Hadsell, can, and Hsuan-Tien Lin (eds.), Advances in Neural Information Processing Sys- Neural Information Processing Systems (NeurIPS), fems 33: Annual Conference http://occeiiin......iiissss.ss. wwtperips...c.p.pe 2020.
Bal-
4cbbcfec854afdde7755 ab101 79ca4b Abstract. -atta pctppp/p/////////aaa...
URL
Scongmin Hong, Kyeonghyun Lee, Suh Yoon Jeon, Hyewon Bae, and Se Young Chun. On exact inversion of dpm-solvers. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 7069-7078. 2024.
Abe Bohan Hou, Jingyu Zhang. Tianxing He, Yichen Wang, Yung-Sung Chuang, Hongwei Wang, Lingfeng Shen, Benjamin Van Durme, Daniel Khashabi, and Yulia Tsvetkov. Sem- stamp: A semantic watermark with paraphrastic robustness for text generation. arXiv preprint arXiv:2310.03991 2023.
Stamatis Karnouskos. Artificial intelligence in digital media: The era of deepfakes. IEEE Transac- tions on Technology and Society, 1(3):138-147, 2020.
John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. A watermark for large language models. In International Conference on Machine Learning, pp- 17061-17084. PMLR, 2023.
Akim Kotelnikov, Dmitry Baranchuk, Ivan Rubachev, and Artem Babenko. Tabddpm: Modelling tabular data with diffusion models. In International Conference on Machine Learning, pp. 17564- 17579. PMLR, 2023.
11

---

Published as a conference paper at ICLR 2025
Rohith Kuditipudi, John Thickstun, Tatsunori Hashimoto, and Percy Liang. Robust distortion-fret -ree watermarks for language models. arXiv preprint arXiv:2307.15593, 2023.
Fan Liu, Zhiyong Cheng, Huilin Chen, Yinwei Wei, Liqiang Nie, and Mohan Kankanhalli. Privacy- preserving synthetic data generation for recommendation systems. In Proceedings of the 45th International ACM SIGIR Conference on Research and Development in Information Retrieval, pp. 1379-1389, 2022.
Nils Lukas and Florian Kerschbaum. {PTW): Pivotal tuning watermarking for (Pre-Trained) image generators. In 32nd USENIX Security Symposium (USENIX Security 23), pp.
2023.
Weili Nie, Brandon Guo, Yujia Huang, Chaowei Xiao, Arash Vahdat, and Animashree Anandkumar. Diffusion models for adversarial purification. In International Conference on Machine Learning, pp. 16805-16827. PMLR, 2022.
OpenAL. Gpt-4 technical report. 2023. URL http::/api..emmaiiccchoooo
CorpusID:
Vamsi K. Potluru, Daniel Borrajo, Andrea Coletta, Niccolò Dalmasso, Yousef El-Laham, Elizabeth Fons, Mohsen Ghassemi, Sriram Gopalakrishnan, Vikesh Gosai, Eleonora Kreačić, Ganapathy Mani, Saheed Obitayo, Deepak Paramanand, Natraj Raman, Mikhail Solonin, Srijan Sood, Svit- lana Vyetrenko, Haibei Zhu, Manuela Veloso, and Tucker Balch. Synthetic data applications in finance, 2024. URL httttps:/a.aii...rrrttt waxxiv.or//aba. 2401 00081
Zhaozhi Qian, Thomas Callender, Bogdan Cebere, Sam M Janes, Neal Navani, and Mihaela van der Schaar. Synthetic data for privacy-preserving clinical risk prediction. Scientific Reports, 14(1): 25676, 2024.
C. Sakar and Yomi Kastro. Online Shoppers Purchasing Intention Dataset. UCI Machine Learning Repository, 2018 DOI: https://6b..org1022444//3333
Marco Schreyer, Timur Sattarov, Bernd Reimer, and Damian Borth. Adversarial learning of deep- fakes in accounting. arXiv preprint arXiv: 1910039/0 2019.
Jiaming Song, Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. In 9th International Conference on Learning Representations, ICLR 2021, Virtual Event, Austria, May 3-7, 2021. OpenReview.net, 2021. URL https::/openreve
net/ / forum?
StIgiarCHLP
Beata Strack, Jonathan P DeShazo, Chris Gennings, Juan I. Olmo, Sebastian Ventura, Krzysztof J Cios, and John N Clore. Impact of hbalc measurement on hospital readmission rates: Analysis of 70,000 clinical database patient records. BioMed research international, 2014, 2014.
Zhensu Sun, Xiaoning Du, Fu Song, and Li Li. Codemark: Imperceptible watermarking for code datasets against neural code completion models. In Proceedings of the 31st ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering, pp. 1561-1572, 2023.
Ruixiang Tang. Qizhang Feng. Ninghao Liu, Fan Yang, and Xia Hu. Did you train on my dataset? towards public dataset protection with clcanlabel backdoor watermarking. ACM SIGKDD Explo- rations Newsletter, 25(1):43 53, 2023.
Umut Topkara, Merean Topkara, and Mikhail J Atallah. The hiding virtues of ambiguity: quantifi- ably resilient watermarking of natural language text through synonym substitutions. In Proceed- ings of the 8th workshop on Multimedia and security, pp. 164-174, 2006.
Yuxin Wen, John Kirchenbauer, Jonas Geiping, and Tom Goldstein. Tree-rings watermarks: In- visible fingerprints for diffusion images. In Thirty- Conference on Neural Information Processing Systems, 2023. URL https: opwnneverev ew net//form? d=75" JJrmubNi
Cheng Xiong, Chuan Qin, Guorui Feng, and Xinpeng Zhang. Flexible and secure watermarking for latent diffusion model. In Proceedings of the 31 ACM International Conference on Multimedia, pp. 1668-1676 2023.
12

---

Published as a conference paper at ICLR 2025
Lei Xu, Maria Skoularidou, Alfredo Cuesta-Infante and Kalyan Veeramachaneni. Modeling tabular data using conditional gan. In Advances in Neural Information Processing Systems, 2019.
Zijin Yang, Kai Zeng, Kejiang Chen, Han Fang, Weiming Zhang, and Nenghai Yu. Gaussian shad- ing: Provable performance-lossees. image watermarking for diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 12162-12171, 2024.
I-Cheng Yeh. Default of Credit Card Clients. UCI Machine Learning Repository, 2016. DOI: http://o...orr/1102444//////.//
Ning Yu, Vladislav Skripniuk, Sahar Abdelnabi, and Mario Fritz. Artificial fingerprinting for gen- erative models: Rooting deepfake attribution in training data. In Proceedings of the IEEE/CVF International conference on computer vision, pp. 14448-14457, 2021a.
Ning Yu, Vladislav Skripniuk, Dingfan Chen, Larry Davis, and Mario Fritz. Responsible disclo- sure of generative models using scalable fingerprinting. In International Conference on Learning Representations, 202
Hengrui Zhang. Jiani Zhang, Balasubramaniam Srinivasan, Zhengyuan Shen, Xiao Qin, Christos Faloutsos, Huzefa Rangwala, and George Karypis. Mixed-type tabular data synthesis with score- based diffusion in latent space. In The twelfth International Conference on Learning Representa- tions, 2024.
Yunqing Zhao, Tianyu Pang, Chao Du, Xiao Yang, Ngai-Man Cheung, and Min Lin. A recipe for watermarking diffusion models. arXiv preprint arXiv:2303.10133 2023.
Zilong Zhao, Aditya Kunar, Robert Birke, and Lydia Chen. Ctab-gan gan: Effective table data syn- thesizing. In Asian Conference on Machine Learming, pp. 97-112. PMLR, 2021.
Yihao Zheng, Haocheng Xia, Junyuan Pang. Jinfei Liu, Kui Ren, Lingyang Chu, Yang Cao. and
Li Xiong. Tabularmark: Watermarking tabular datasets for machine learning. arXiv preprint arXiv:2406.1484 14841, 2024.
Chaoyi Zhu, Jeroen Galjaard, Pun-Yu Chen, and Lydia Y. Chen. Duwak: Dual watermarks in large language models. In Lun-Wei Ku, Andre Martins, and Vivek Srikumar (eds.). Findings of the Association for Computational Linguistics, ACL 2024, Bangkok, Thailand and virtual meet- 14416-11466, 1436.. Association for Computational Linguistics, 2024. FNCLLN URL https: http:::://dooooooo http://doio..///1.....1.00 18653//1
ing. August 11-16. 2024, pp. 11416-1 doi:
2024. fi findings-aclll... 678
13

---

Published as a conference paper at ICLR 2025
A
NOMENCLATURE
Tx Pseudo-random permutation applied to the control seed d, indexed by the watermark key n; used shuffle the sequence for embedding.
Control seed used for watermark embedding, containing integer values that define specific segments of the latent space.
d=
Shuffled control seed, generated by applying a pseudo-random permutation d, ensuring row-wise detectability of the watermark.
Zr
Noisy latent variable at the final time step T, from which the tabular data generation starts.
2t
Latent variable time step t, representing intermediate states during the diffusion process. Watermarked latent variable time step T, altered for embedding watermark information.
2T
e(o)
Gaussian noise added during the perturbation process, drawn from (0, o²). Indicator function, used to compare whether conditions are met (returns true, 0 other- wise).
T(-)
Decoder, used to reconstruct tabular data from the latent space.
Encoder, used to map tabular data into the latent space.
((x)
Cumulative distribution function (CDF) of the standard normal distribution, used to partition
latent space into segments.
<(z)
Probability density function (PDF) of the standard normal distribution.
Noise level in the Gaussian noise distribution, controlling the magnitude of perturbations in the watermark detection process.
Asit
Bit accuracy, the proportion bits correctly recovered after noise perturbation, measuring the effectiivnness of the watermark embedding.
Axbit
Valid bit accuracy, refined accuracy measure focusing on extreme values in the bit quence to increase resilience against noise.
F(ZT)
Fourier-transfommed version of the noisy latent code, used for injecting or detecting the watermark.
K Watermark patch applied to the latent space, created through a structured pattern of concen- tric circles or ripples.
r Radius the Tree-Ring watermark, defining the size of the watermark region within the latent space.
Fourier Transform (fft2d) A mathematical transformation used convert the latent noise matrix into frequency space for watermark embedding.
B DIFFUSION AND DIFFUSION INVERSION
B. TABULAR LATENT DIFFUSION MODEL
In this paper, adopt the Tabsyn framework from (Zhang et al. 2024). which combines autoen- coding framework with a diffusion process in the latent space. This architecture efficiently manages the complexity of mixed-type tabular data, which includes both numerical and categorical variables, by encoding them into a unified latent space where the diffusion process operates. Below, we out- line the key components of this architecture. Unlike Tabsyn, which utilizes score-based diffusion process, we employ Denoising Diffusion Probabilistic Model (DDPM) (Ho et al. 2020) for train- ing, and leverage Denoising Diffusion Implicit Models (DDIM) (Song al. 2021 the sampling process.
14

---

Published as a conference paper at ICLR 2025
Autoencoding Framework To capture the structure of tabular data, Variational Autoencoder (VAE) that maps the data into la- tent space through tokenization, encoding, and decoding, The model handles both numerical and cat- egorical columns by tokenizing each type: numerical features are linearly transformed into embed- dings, while categorical features are one-hot encoded and embedded using a lookup table. This unified representation is then passed into Transformer-baat based encoder, which captures inter-column dependencies and outputs latent embeddings z. These sampled via the reparam- eterization trick and decoded back into reconstructed token embeddings. Finally, the detokenizer converts these embeddings back to their original tabular form by applying inverse transformations for numerical columns and softmax for categorical columns, ensuring the output retains the original structure of the data.
des
Autorncoder
Process
Figure 5: The diagram for tabular latent diffusion models.
Diffusion Model In our model, we utilize Denoising Diffusion Probabilistic Model (DDPM) in the latent space for data generation. DDPM gradually corrupts the latent variables by adding Gaussian noise over a series of time steps, resulting 2r, which follows a simple Gaussian distri- bution. During the reverse process, the model learns to denoise these latent variables step-by-step. starting from zT and progressively removing the noise recover the original latent representation 20. This reverse process is parameterized using neural network that predicts the noise at each step, allowing the model to generate new latent variables that are then decoded back into synthetic tabular data. The DDPM approach provides high flexibility and generates diverse samples by learning to capture the complex distribution of the latent space.
More in detail for the model used, the autoencoder module comprises encoder and a decoder, each following a 2-layer Transformer architecture. The hidden dimension the Transformer's feed-forward network (FFN) is perceptron (MIP) with a hidden dimension of 1024. For both the diffusion and sampling processes within the diffusion model, 1000 timesteps used. With these hyperparameters, the latent tabular model consistently generates high-quality synthetic data in the absence of watermarking, achieving similarity metrics above 0.88, discriminability metrics above 0.63, and utility metrics around 0.79 across all datasets. Therefore, the same architecture is employed for all four datasets, while the number training epochs is tuned for each dataset individually.
128. The diffusion model comprises 4-layer multi-layer
B.2 DDIM AND DDIM INVERSION
The diffusion model denoises latent representation of the tabular data from a noise matrix, which can be infused with a watermark and later detected the watemarking pattern. While the architecture is oblivious to the specific choice of autoencoder architecture, the choice of diffusion model requires careful consideration to guarantee deterministic diffusion and sampling processes. Ensuring both deterministic processes allows for accurate recovery of the noise matrix from the synthesized table, thereby enabling sound detection of the watermark.
Among the various diffusion models, Denoising Diffusion Implicit Model (DDIM) (Song et al. 2021) stands out for its ability to facilitate both deterministic diffusion and sampling processes. DDIM extends the classical Markovian diffusion process into broader class of non-Markovian diffusion processes. Within the DDIM framework, given the noise matrix žy the latent space, and neural network eg that predicts the noise en (t,,, z,) at each diffusion time step the generation of
15

---

Published as a conference paper at ICLR 2025
sample 21-1 from 2, during the sampling process is described by the equation:
v1 (t, zx), + / 0:-1 of ea(t, 2t) oter
-t-1 var
V
where ..,,..., QT are computed from predefined variance schedule, er NO denotes stan- dard Gaussian noise independent of 2,, and the values can be varied to yield different generative processes. Specifically, by setting o, to for all l, the sampling process becomes deterministic:
at at- (t-1))
ze + (V - a1-1 11-a--1-
Oz
This deterministic sampling process ensures that a given noise matrix 2T consistently generates the same latent matrix 20- Consequently, when 2o is fed into the decoder D, the resulting table X = (=zo) will also consistently the same.
Notably, in the limit of small steps (large value of T), we can traverse the timesteps in the reverse direction towards increasing levels of noise, yielding deterministic diffusion process from 2y to ær, i.. DDIM inversion:
10+1
Ze + (V1 1 a1+1 - Vaci alt1)eo(t, zc) ag
2(+1
Therefore, given the tabular latent zo E(X) of table X, the noise matrix zT that is used to sample the corresponding table can derived. This latent tabular diffusion model with deterministic sampling and diffusion processes enables the secure watermarking of synthetic tabular data. By embedding the watermark into the noise matrix ær, the watermark remains imperceptible to humans and exerts minimal influence the quality of the synthetic tables. By reversing the tabular data back to the noise matrix, the watermark's ' presence can be smoothly detected by assessing watermarking patterns.
B.3 DECODER INVERSION
The inversion of AutoEncoder in the watermarking process is essential. However, when an inverse transformation needed (e.g., to map generated table back applying the encoder (E) to the table is insufficient due to inherent reconstruction errors. This discrepancy arises because the encoder not the exact inverse of the decoder, meaning that using & for inversion leads imperfect recovery of the latent representation. This results in lower-bound reconstruction error defined as:
latent representation), simply
| (E (X)) - X||-
To overcome this limitation and reduce reconstruction errors, an exact inversion of the decoder is required, ensuring that the latent representation aligns more closely with the original data. Exact inversion can enable more accurate reconstructions, enhancing performance in downstream tasks such editing, manipulation, or generating variations of the original input.
To perform decoder inversion, we use an iterative optimization process based on gradient descent. The goal is to find the latent variable that, when passed through the decoder D, minimizes the reconstruction error between the original table X and the generated output D(zr). The process starts by initializing with the output of the encoder:
Zy E(X).
Then, we iteratively adjust zy by performing gradient descent on the objective function:
X - D(>x)
This optimization updates the latent variable in the direction that reduces the difference between the original table and the decoder's output. The process continues until convergence, i.e., when
16

---

Published as a conference paper at ICLR 2025
further updates 2T longer significantly reduce the error. The gradient descent step can be mathematically expressed as:
2T t- 2r X D(2r)
where vj is the learning rate. Once the process converges, the optimized latent variable æт is returned as the exact inverse representation, yielding a more accurate result than using the encoder alone.
C THEOREMS AND PROOFS
Theorem Let d (0, 1)th be 1-bit string consisting of bits, where each bit follows random Bernoulli distribution, i.e., d, ~ Bernouli(112) for each i E {1....,m).
Let the perturbed Gaussian sampling process as follows:
14 + d2
+
u
((0,1),
where 4- is the inverse cumulative distribution function (CDF) of the standard normal distribution (0, 1), and is uniform random variable.
Let the perturbation noise c²,e² o() be independent Gaussian noise with variance a².
Let the recovered bit strings as di and di after perturbation as:
a = F(2)+ 112,
where F.)) is the empirical cumulative distribution function (CDF) of the perturbed Gaussian noise.
Let the Bit Accuracy, denoted by Aba as the proportion of recovered bits that match between two independent instances of the bit recovery process:
Api
Σ m
1
m
a: dd)
where II()) the indicator function.
We can show that the expected value of the Bit Accuracy, B[Abu], is given by:
E E[Asi =
( 00
1-1
11 +
(-!=)
6(z) dx) + + +b
x
(xx)
dx
where (x), Ø(x) is the CDF and PDF of the standard normal distribution.
Proof: When the string d consists of a single bit, the bit string recovery process simplifies. Specif- ically, the recovered bit d can be written as:
d; {1 0 if + O,
1 if +
where follows the perturbed Gaussian process and ~ o2) is Gaussian noise.
Thus, the expected Bit Aceuracy can interpreted as the probability that the signs of 2! + of and z² + 2s agree, where z/ and 2 are two independent instances of the perturbed Gaussian process. Mathematically, this expressed as:
[Am]] E [P (sign(2) + + sign(z; + +))
The probability that the signs match can be decomposed into two cases:
1) The signs both 2! + cl and x? + c are positive. 2) The signs of both x! + +c and x? + e? are negative.
17

---

Published as a conference paper at ICLR 2025
Thus, have: E [Aaa] = E[P (no flip for z!) P (no flip for z;² + IP (flip for 2!)) P (flip for z3)]
Using the Gaussian CDF (xx), this becomes:
[ [
|m (o)))
(1
222 )) + ( |2]
[22 ) ((L1))(1)) dxg dr2,
E [[Abi] =
Φb
where:
(-) is the CDF of the standard normal distribution.
o(x) _e ee==" =2
is the probability density function (PDF) of the standard normal distri-
V2n
bution.
This simplifies to:
( 00
(-aa)
2 + ( - ) 6(z) dx)
1r (-
o(z) dx 2
E [Abi]]
Theorem Let d 20 represent an m-length string, where each element d, is an independent random variable following a categorical distribution over the set {0, 1, 2,3). Specifically, for each E {l,.... m). the random variable d, is distributed according to Cutegorical(yo. pt, P2, p3), with po P1 p2 P3
Define the perturbed Gaussian sampling process as follows:
U1 ds
2, =
U
2(00
where h- the inverse cumulative distribution function (CDF) of the standard normal distribution N00, 1). and u; is uniform random variable.
Let the perturbation noise e¹,è? (o(00²²) be independent Gaussian noise with variance a².
Define the recovered bit strings dł and d; after perturbation as:
d = F(2)++ 1,2,
where F(.) is the empirical cumulative distribution function (CDF) of the perturbed Gaussian noise.
define the Valid Bit Accuracy. denoted Aun as the proportion of recovered bits that match between two independent instances of the bit recovery process:
Em
(dd and di = =
(d) = 3 and de 2 2rr3)
Avbar
Em II ( = 0 or d; =
where I1(-) is the indicator function.
We can show that the expected value of the Bit Accuracy, E[Aybu), is given by
(0.25)
T (0.25)
v1 + r² +
6(x) dx x
4 (0.25)
I
(xx) dx
(0.25)
④ (0.25)
V1 0²
(0.25)
((x) dx
x(x) dx
0
16
0
+ (0.25) VI / o² +
(xx) du
((x) dx
6-1(0 (0.25)
(0.25)
Φ (0.25)
v oZ
T - ((x) dx
((x) de
(0.25)
(0.25)
Φ(-) is the CDF of the standard normal distribution.
18

---

Published as a conference paper at ICLR 2025
Proof:
3
E [Avbi]]
Σ
P(d: = k) k-) EEA d(i
There are eight situations that satisfy the condition of Valid bit accuracy:
1. d. 0, d; 0, or
2. 1, d = 0.
3. d: = 2, d: = =0, d = or
4. d 3, d 0, d. 0 or
5. d. 0, d =3, d 3r
6. = 1, ,,d =3. = 3
7. d. = 2, d 33, 3
8. d 3, d = d. 2 or
Based the symmetric property of the Gaussian distribution, we can easily get that:
P(d, 0, 0, d 0 or 1) P(d, 3, = 3, = 2r 3)
3, 2 or 3) P(d, 1, 0, d. 0 1) P(d, 2, 2,
P(d, = 2, d = 0, d or 1) = P(d, = l, = 3, d = 2 3)
. P(d, = 33 d = 0. 0 or 1) P(d, 0, d 3, d 2r
So, split the problem into 4 situations:
1) P(d) 0 and (d) 0 or df =1 d; -d=00
Given that d, = 0. both 2 (i) and (i) are initially in the 0% - 25% quantile of the standard normal distribution. That is:
(1), (1) ( (0),
where (q) is the inverse cumulative distribution function (CDF) the standard normal distri- bution, corresponding the q-quantile.
After adding independent Gaussian noise of ~ N(O, σ2) and & N(0, o²), the noisy signals (i) + è and (i) + eg distributed ((22 a²) and N1= respectively. Thus, the combined distribution of each signal is:
++( + 2 +
The condition d; implies that the noisy signal x (i) + c falls into the 0% 25% quantile of the NO0,1 1 + 22) distribution. Hence, we need to compute:
P(d = d, = = P (1) + + (0.25) vi+o² x1) [ (0). x- -0225)))
For any specific value 21) = x, after adding noise, the noisy signal xi) + c is distributed as N(2, o2). The conditional probability is:
(1) + < -0.(5)) vI+02 (1) = x) Φ (0.25) VI 0² - x
Therefore, the total probability P(d) 0 d, = is the integral over the 0% 25% quantile:
200225)
④ 1 (0.25)
VI 0²
P(d) = 0 d, = 0) = (-1(0))
+
f (z))
(0.25)
+ (0.25)
+
4
$1x) )d
19

---

Published as a conference paper at ICLR 2025
where (z) is the probability density function (PDF) of 2)(1) in the 0% - -25% quantile:
((x)
(z)(0(()=
40(x)
(0) (())t
1000-0000 (0.25)
with ((x)
_ -== /2 being the standard normal PDE V2=
The condition di or df = means that the noisy signal (1 + falls into either the 0%-00% 25%
or the 25% 50% quantile of the new distribution (00, + o²). The respective probabilities are:
For di 0 (0%-25% quantile):
Φ (0.20.)5)
vI 0² x
P(d = (1) = x))
-For df = 1 (25%-50% quantile):
P(d = x1) = 2) = (0.50) VI 11+8 0² x
$ $-1(0.25
v1 +
0
Thus, the total probability P(dk = or di = d: = =0) is:
(0.25)
② 00.(5)5)
vI + 0²
P = di = 1 =0)
(0)
$
(0.50)
vI 0²
( (0.2()
v
)) f=
0
(0.25)
øl (z)dr
0
The total probability P(d = and (d) integrals:
0 or d = 1) | di = 0) is the product of the two
P(d) 0 and (de = or di = 1) d; 0) =
(0.25)
② (6-1((0)) (0.25) -
((w))de (ro- (0.25)
-
16
+
6 (xx)d
Similarly, we can get
P d = 0 and
{ = 0 or de =1) d. -1)=
- ( oz +
o(z)dr (F
x 6(x dx
16
0
(0.25)
P (d)
0 and
d = 0 or
de =1) d; =2)
(0.25)
b- (0.25) 0² -
((z)dx (1oe 7(0025))
x
16
+
Φb
oxx )z)
P
d = 0 and
d = or di =1) 1 d, =3) =3)=
(0.25)
- (0.25) / 0² +
(1-- 0-1(0.25)
16
o(x)dr)
((I)dr
00
20

---

Published as a conference paper at ICLR 2025
The final E [Avbil] can be summarized as: [Avba]
2 d and (d or =1) - =0) +P +P(d = and (df = 0 or d 1) d; =
+ d = 0 and (d: = or di = d: = + d) and (dk or d = d. - =3) 3) /2
(u.25) +
4- (0.25) 1+0
dx
( (0.25) + (3) (<))dr)
(0.25)
(0.25)
((x)dr
x [oo0
x (0.25)
① ( ((x))d
16
4 (0.25) 140 +2
((x)da
x -o-
$ ( p (x)))r)
(0..002)))
(0.25)
1 (5.25)
0
(0.25) 1402
o(z)dr
a (0.00)))
② (=#) ((z)
D IMPLEMENTATION DETAILS
D.I TREE-RING
The Tree-Rine Fine-Ring watermark is specifically designed for images, taking into account the unique char- acteristics image data. In image synthesis, images and it's latent code are typically square, such 256 256 matrix. The Tree-Ring watermark is centrally placed within the image and resembles concentric rings, much like the rings of tree.
In contrast, tabular data usually consists of far more than columns, resulting in tall rectangular shape, such as a 10000 x 40 matrix. We use different shape for Tree-Ring watermark in tabular data, whose shape is more like ripple. For predefined radius representing the outermost circle of the ripple watermark, watermark patch K is generated with the ripple originating from its center using Algorithm The process starts by generating random matrix of the same size as the noisy latent code using Gaussian noise. This matrix undergoes a 2D Fourier transform, with the zero- frequency component shifted to the center, providing the base for the watermark patch. The ripple is then created, where each concentric circle shares the same value, sampled randomly from the transformed base matrix. The radius r determined as 10% of the number of rows of the table in generation.
Algorithm Tree- Embedding Tabular Data
1: Input: Radius r, shape (n, m) of the noise matrix where n is the number of rows and m the dimension of the latent for each row
2: N + (N₂y ~ (0, 1)) 1))ssisn.sism Sijm
I/ Initialize random Gaussian matrix // Apply 2D Fourier transform N and shift the components // Copy K for value sampling in ripple circles
3: K fftshit((f(dd(N)
4: Kump + copy(As K)
5: for < downto do
6:
// From the outermost circle inward Sample random value e for the i-th circle
7: v 4 sample(Kimp)
8: for all (i,5) where ssis 1.....i... m.
3)² (j m )2 < k22 do
9: K(i,j) +
|1 Assign to position (i,j)
end for
11: end for
12:
return K
Return the modified matrix
The watermarking injection and detection phases proceed as follows. In the injection phase, specific matrix elements in the Fourier-transfommed noisy latent code replaced by values from prede- fined watermark patch. Specifically, given the predefined watermark patch K and a binary mask M with values of in the ripple watermark region and 0 elsewhere, the FFT-transformed noise matrix F(zT) of the initial noisy latent code zy is watermarked as follows:
Kiji F(zr)aj)
if M = otherwise
where Maj = { 1, if (i (1-7)) + (j- 72² <
F(zT)is= =
0, otherwise
21

---

Published as a conference paper at ICLR 2025
The watermarked FFT OFF-traanformed noisy latent code is then subjected to inverse fast Fourier transform (IFFT). This process generates a synthetic table with the watermark embedded, produced through the sampling and decoding processes of the diffusion model.
In the detection phase, the synthetic tables are encoded back into the latent space and diffused to the noisy latent code zy. An FFT is applied to this code, and the detection process compares the ground- truth watermark patch K with the watermarked region of the Frunser-tr latent noise matrix F(2r) using the Lı distance. The distance metric defined
Dist
Σ M1
[k. - F(ET)ial
M
D.2 GAUSSIAN SHADDIGG
To adapt Gaussian Shading from the image domain to the tabular data domain, unlike Tree-Ring, which embeds a single watermark across different rows, we embed the watermark per-row basis. This approach benefits row-by-row detection and enhances robustness against row-wise attacks.
constrained to using the control seed d for all rows. Using multiple control seeds would require additional information, such as row indices, to generate different control seeds for each row. This method, however, would not be robust against row-wise attacks, as information like row indices can easily be altered by operations such as row deletion or shuffling.
However,
E EXPERIMENTS DETAILS
E. DATASETS
The overview of the datasets tures online shoppers' purchasing intentions via 12,330 samples featuring 18 mixed-type columns (10 continuous and 8 categorical). The Magic (Bock 2007) dataset simulates the registration of high-energy gamma particles and consists of 19,020 instances with 11 columns (10 continuous and categorical). The Credit (Yeh 2016) dataset provides data the default payments of credit card clients, comprising 30,000 instances with total of 24 mixed-type columns (14 continuous and 10 categorical). The Adult (Becker & Kohavi, 1996) dataset contains information on individuals' annual incomes, consisting of 48,842 instances with 15 mixed-type columns (6 continuous and 9 cat- egorical). Finally, the Diabetes (Strack al.) 2014) dataset contains medical information on Pima Indian female patients aged 21 or older, consisting of 768 instances with 9 columns (8 continuous and categorical).
shown in Table The Shoppers (Sakar & Kastro 2018) cap-
Name
Domain
Rows
# Cat
Num
Task
Target Column
Shoppers
Retail
12,330
8
10
Classification
"Revenue"
Magic
Physics
19,019
10
Classification
"class"
Adult
Social Science
48,842
6
Classification
"class"
Credit
Finance 30,000
11
14
Classification
"default"
Diabetes
Medical
768
1
8
Classification
"Outcome"
Table 3: Properties of selected datasets used in the evaluation. # Rows, # Cat, Num indicate the number of rows, the number of categorical columns, and the number of numerical columns, respectively. # Test indicates the number of samples the test set.
E.2 METRIC
The quality of the synthetic data is evaluated on three aspects: similarity, discriminability, and utility.
Similarity This aspect assesses the statistical similarity between the synthetic data and the original data through the following metrics:
22

---

Published as a conference paper at ICLR 2025
Shape quality: This metric evaluates resemblance by comparing the distribution of each column in the synthetic data with its counterpart in the original data. A similarity score is computed for each column based on the distributions in both datasets. In particular, the complement of the Kolmogorov-Smiron total variation distance for categorical columns, respectively (Dat 2023). The average of these scores across all columns reflects the shape quality of the synthetic table. A higher score indicates greater similarity between the synthetic and original tables.
use statistic for continuous columns and of the
Since columns in the data may or may not relate to each other, this metric assesses how well the synthetic data preserves these relationships. This involves calculating the correlation between every pair of columns in both the synthetic and original datasets and comparing them. A higher trend quality score indicates that the synthetic data accurately represents the inter-column relationships found the original data. The average of these scores across all column pairs is used to represent the trend quality of the synthetic table.
Trend quality:
Discriminability This aspect assesses how difficult it is for machine learning model to distin- guish between synthetic data and original data through the following method:
Logistic Detection: A logistic regression model is trained to differentiate between the two datasets. First, all rows from both the real and synthetic datasets are combined and then split into training and validation sets. The machine learning model trained on the training set and evaluated on the validation sets. The performance of the model is measured based on the averaged complement of ROC AUC score across all validation splits. A higher score indicates that the model can not differentiate between synthetic and real data, suggesting higher in discriminability for the synthetic data, i.e. synthetic data being undistinguishable from real data.
This aspect evaluates the quality of the synthetic data in terms of their performance in downstream machine-learning tasks. This evaluation is conducted using the following method:
Utility
Machine Learning Efficacy (MLE): Following the training-on soahiinggo--yyyee synthetthhhcc and test-on-real setting, each dataset's classification or regression model is trained on the synthetic data and evaluated using the real testing set. The performance of the model is measured by the AUC score for classification tasks and the RMSE for regression tasks. A higher MLE score indicates better machine learning utility of the synthetic data.
Detectability Detectability assesses how well watermarks can be detected in synthetic data. We use two metrics: 7-score and TPR @ XFPR.
Z-score: This metric measures the difference in a watermarking statistic between water- marked and non-watermarked tables. For row-wise watermarks (e.g., Gaussian Shading and TabWak), the metric is the bit accuracy for each row. For Tree-Ring, we calculate the distance between the watermark patch in the Fourier domain. We compute the em- pirical mean and variance of these metrics for watermaarare tables as baseline. For row-wise watermarking, such as Gaussian Shading and TabWak k, we use 500,000 rows to caleulate statistics of watemarerrd rows, assuming the bit accuracy for watermarked rows is higher. For Tree-Ring watermarking, the statistics of non- -onerratrrrreed tables is computed over 1,000 tables per shape, based on the assumption that watermarked tables have smaller distance between watermark patches than non- watermarked ones. In both cases, the Z-score is used for a one-tailed test to reject the null hypothesis that the table is wateraaerr..... The Z-score for table with n rows for row-wise watermarking is calculated as: The Z-score measures the difference between the mean bit accuracy of wa- termarked rows and non non-watermarked rows, normalized by the standard deviation of the non non-watermarked rows, adjusted for the number of watermarked rows. The formula is:
1l w A Nw
Z
o Aua NW
vn
Where:
23

---

Published as a conference paper at ICLR 2025
log 101 pevalae)
-6
vollo(
1og1 0.053
7.score
Figure 6: Relationship between Z-score and the logarithmic p-value for a one-tailed test. The red dashed line indicates the significance threshold p 0.05, or lo -133)
Ama the mean bit accuracy of the watermarked rows,
- MA Nw is the mean bit accuracy of the non-wand won-raatrmarked rows,
Nw is the standard deviation of the bit accuracy in the non-watermarked rows,
is the number of watermarked rows.
For the Tree-Ring method, the Z-score is computed based on the distance between the watermarked and wateraaermarked data rather than row-wise accuracy. Since it's not wise, there no dependence on n. Additionally, the Z-score is computed using the opposite tail of the distribution. The formula is:
Diistoow
PDistw
Z
Diisty
Where:
MDistw is the mean distance of the watermarked data,
HDistww is the mean distance of the oon-watermarked data,
Distow is the standard deviation of the distance for the -on-waterarrked data.
The relationship between Z-score and the logarithmic p-value is shown in Figure
TPR XFPR: This metric evaluates the True Positive Rate (TPR) at a given False Positive
Rate (XFPR), where X is predefined percentage. It provides insight into the watermark detection capability by measuring how often a watermarked table is correctly identified at different levels of false positives. A higher TPR @ XFPR indicates better detection performance.
F ADDITIONAL RESULTS
F.I DISTRIBUTION OF LATENTS FOR DIFFERENT WATERMARKS
Figure 7 Pillustrates latent code matrices of size (1000 x 40) generated by Tree-Ring, Gaussian Shad- ing, and TabWak. Upon observation, the latent codes produced by our method closely resemble Gaussian distribution, whereas Tree-Ring and Gaussian Shading exhibit distinct patterns that are easily recognizable first glance. The reduced distortion the Gaussian distribution explains why our method achieves superior data quality.
F.2 WATERMARKING NUMERICAL COLUMNS ONLY
Figure X presents TPR 1% FPR versus row count across four datasets. When applying the water- mark only to numerical columns, the performance drops for the three watermarks. However,
24

---

Published as a conference paper at ICLR 2025
(a) Gaussian Noise
(b) Tree-Ring
(c) Gaussian Shading
(d) Ours
Figure 7: Examples of latent codes sampled from standard Gaussian noise and various watermarking methods
method still demonstrates strong robustness, achieving 100% TPR@ 1% FPR within 200 rows in out of 12 cases.
Shopper
Magic
Adult
Credit
Column Del.
it 5 t 8
TPRUS 1Es9INN77 8
8 8
Naxteer Ross
Nootor 3ores
Narberof RoaK
Nambor BRows
Cell Del.
TPRASTATTT
60
190
Noise
Nanber Rova
Natto Stree
Nazberot Rowa
Namber Bf
Figure 8: T 1% FPR versus count in four datasets under various attacks, with the watermark applied only to the numeric columns Cell and Noise attacks are set at 20% strength; Column Deletion involves three columns.
F.3 POST-PROCESSING WATERMARKS
The reason we did not include post-processing watermarks in the primary evaluation is that such methods, like the one described in (He et al. 2024), can only be embedded into continuous values by strategically adjusting these values to fall within chosen range. However, the applicability of this approach limited in tabular data, which often contains many integers and categorical values.
Additionally, post-processing watermarks are highly susceptible to common operations in tabular data processing, such as rounding, which can easily remove the watermark.
Since our dataset contains many integer columns, we preprocess the data by converting numbers into scientific notation. The method from (He et al. 2024)) then applied to the coefficients of the scientific notation. Below are the results of comparing the post-processing method under different types of attacks. The results show that the post processng method is particularly vulnerable to Gaussian noise, where it fails maintain the watermark.
25

---

Published as a conference paper at ICLR 2025
Attacks
Dataset
Row Deletion
Column Deletion
Cell Deletion
Gaussian Noise
Shuflling
5%
10%
20%
enl
2col
col
5%
10%
20%
5%
10%
20%
Shoppers
65.3
63.5
59.9
67.1
67.1
67.1
63.3
60.0
53.3
0.1
0.0
0.0
67.1
Magic
38.4
37.3
35.3
39.3
39.1
39.3
37.3
35.2
31.9
0.0
0.1
0.0
39.4
Adult
68.9
67.1
63.2
70.7
70.7
70.7
67.0
63.3
56.3
0.0
0.0
0.6
70.7
Credit
62.2
60.5
57.2
63.8
63.7
63.7
61.2
58.2
51.4
0.0
0.0
0.0
63.8
Diabetes
56.3
54.8
51.6
57.8
57.8
57.8
54.7
51.9
45.9
0.0
0.0
0.0
57.8
Table The robustness of post-processing watermark (He al. Average Z-score on 5K rows.
2024 against post-editing attacks:
F.4
LATENT-SPACE ATTACKS
In this subsection, we evaluate the robustness of various watermarking methods under latent-space manipulation attacks.
F.4.1 REGENERATION ATTACK
The Regeneration Attack mimics the approach outlined in DittPure (Nie et al. 2022). This attack maps the watermarked table into the latent space using the decoder inversion method, generating 2 Subsequently, DDIM inversion transforms it into 2 which serves as the initial latent for reconstructing the tabular data. The results in Table 5 reveal the impact of this attack on watermark detectability.
Sampling-basse methods, including Tree-Ring, Gaussian Shading, and our method, retain their de- tectability under most of the regeneration process. However, Tree-Ring fails for the Adult dataset, demonstrating limitation in its robustness. On the other hand, the post- post-processing watermark is entirely eliminated during regeneration, evidenced by Z-score of 0 across all datasets.
These findings underscore the vulnerability of post-processing watermarks to latent-space transfor- mations, emphasizing the need for embedding mechanisms that are resilient to such attacks.
Dataset
TR
GS
Ours
Ours
He et al. 2024
Shoppers
4.73
22.30
11.02
35.10
0.00
Magic
4.85
36.53
13.68
25.09
0.21
Adult
0.54
46.42
42.08
30.50
0.01
Credit
5.34
84.06
10.86
22.13
0.07
Diabctes
6.29
55.76
5.82
7.04
0.03
Table 5: Robustness of different watermarking methods against the regeneration attack: Average Z-score on 5K rows.
F.4.2 EMBEDDING ATTACK
The Embedding Attack, inspired by WAVES (An et al.), introduces adversarial perturbations numerical components of the watermarked table. Utilizing our encoder E, which maps the tabular data (Xnam,
to a latent representation, this attack generates perturbed data Xade that aims to shift the latent representation of the adversarial table away from that of the original watermarked table X Xnam- This objective formulated as:
max | (Xxade
numm Xear) - ((Xnum: Xeat)ll2
X Xude
subject the constraint:
X-dy
-X
S <
In this formulation, e is the perturbation budget, set to 0.2 in our experiments, ensuring that the modifications remain bounded while significantly impacting the latent representation.
26

---

Published as a conference paper at ICLR 2025
The results in Table highhlight the effectiveness of this attack. Our method with the valid bit mech- anism (Ours*) and Gaussian Shading demonstrate notable resilience, maintaining high Z-scores across most datasets. In contrast, the post-esssssingg watermarking method is rendered ineffective, with Z-scores consistently approaching 0, signifying the complete destruction of the watermark.
This attack demonstrates the importance of designing embedding mechanisms that withstand adversarial manipulations, ensuring the integrity and detectability of watermarks even under such challenging conditions.
Dataset
TR
GS
Ours
Ours
He ef al. 2024)
Shoppers
0.31
22.49
0.00
28.69
0.00
Magic
0.33
36.54
8.41
21.61
0.08
Adult
0.00
56.29
0.08
27.00
0.06
Credit
0.04
79.43
0.00
11.12
0.00
Diabctes
1.27
48.28
2.90
7,42
0.00
Table 6: Robustness of different watermarking methods against the embedding attack: Average Z- score on 5K rows.
F.4.3 ADAPTIVE ATTACK ON TAIL VALUES IN LATENTS
To further challenge the watermarking methods, propose Adaptive Attack that targets the tail values the latent space. This attack aims to minimize the contribution of outlier latent values (&r) while adhering to perturbation constraint (e 0.2). The optimization objective is formulated as:
min |Man 2r|12*
where the tail mask Mai is determined by the interquartile range of žy, defined as:
{1
if [ < Q0.25(2T) or [r] > Q0.75(2r),
Maal []]
0
otherwise.
The attack is subject to the constraint:
X
adv num
XXnum
|
In this framework, दτ represents the initial latent estimated using DDIM inversion applied to the encoder output of the perturbed tabular data. This approach ensures that the perturbations selectively target the tail values while maintaining bounded distortions to the original data.
The results of this attack, presented in Table demonstrate that method (Ours*) remains resilient under both Embedding and Adaptive Attacks, retaining Z-scores above 20 in most datasets. In contrast, the Adaptive Attack significantly reduces watermark robustness for weaker methods, such as Gaussian Shading, especially in datasets like Magic and Diabetes.
These findings highlight the importance designing watermarking methods that leverage intrin- sic latent-space properties to withstand targeted perturbations and ensure robust detectability under challenging conditions.
Dataset
W/O Attack
Embedding Attack
Adaptive Attack
Shoppers
34.52
28.69
24.61
Magic
25,30
21.61
7.43
Adult
28.45
27.00
26.03
Credit
22.91
11.12
14.48
Diabetes
7.86
7.42
2.15
Table 7: Robustness of Tab against embedding and adaptive attacks: Average Z-score on 5K rows.
27

---

Published as a conference paper at ICLR 2025
F.5 HYPERPARAMETER EVALUATION FOR VALID BIT MECHANISM
Below are the experiments conducted to evaluate the hyperparameter settings of our method with the valid bit mechanism. We introduce new setting for / = 3, where the standard normal distribution is divided into three quantiles. In this setting, we focus on the two tails: values < (0.333)33) and values 4- 100000000000 (0.667). The aim is investigate whether the signs of the tail values differ in detecting self-cloning.
Tables and provide results for generative quality and robustness, respectively.
Datasets Shoppers
Shape
Trend
Logistic
MLE
W/O
0.922
0.907
0.635
0.871
3
0.908
0.893
0.567
0.879
0,914 4
0.906
0,580
0.867
Magic
W/O
0.917
0.939
0.710
0.906
3
0,903
0,936
0.736
0.893
0.927
0.705
0.876
Adult
W/O
0,933
0.887
0,876
0.927
0.867
0.636
0.871
4
0.931
0.884
0.645
0.874
Credit
W/O
0.930
0.905
0.741
0.743
3
0.927
0.897
0.713
0.741
4
0.922
0.892
0.677
0.744
Diabetes
WO
0.873
0.743
0.748
0.803
3
0.832
0.735
0.728
0.789
4
0,849
0.733
0.694
0.801
Table 8: Synthetic Table Quality: Comparison of hyperparameters / 3 and ( = 4. 'W/O' refers to data without watermark.
From Table 8 observe that the quality results for 3 and | 4 close to each other. / 3 achieves better performance in 10 out of 20 cases in the table (across different datasets and metries).
Attacks
Dataset
Row Deletion
Column Deletion
Cell Deletion
Caussian Noise
Shuflling
10%
20%
3
5%
10%
20%
10%
20%
Shoppers
29.00
28.33
26.57
29.82
30.10
31.49
28.55
27.92
26.52
24.49
28.03
39.11
29.79
33.58
32.69
30.98
34.50
34.33
37.38
34.40
34.63
33.36
27.60
29.84
39.90
34.51
Magic
20.60
20.09
18.99
26.39
29.02
28.82
22.31
23.39
24.17
21.35
21.19
20.92
21.20
24.78
23.98
22.61
32.38
32.33
37.80
26.92
28.13
30.17
25.51
25.12
25.06
25.39
Adult
31.18
30.37
28.64
32.21
31.70
28.74
31.76
29.95
28.25
37.34
54.67
69.21
32.01
27.78
26.83
25.43
28.45
24.92
27.57
29.29
30.07
29.86
32.53
48.66
64.
28.42
Credit
19.03
18.62
17.54
24.33
27.19
27.39
23.89
24.27
29.44
20.56
20.55
25.25
19.57
22.11
21.65
20.29
27.31
32.71
34.98
26.65
30.31
36.24
23.18
24.31
27.17
22.88
Dlabetes
3.62
5.29
9.97
13.14
13.94
6.89
7.07
6.60
3.13
4.23
4.11
3.73
7.76
7.63
7.11
4.98
10.94
12.74
4.76
4.41
3.61
6.56
6.73
3.83
7.91
Table 9: Robustness of Different Settings of TabWak Against Post-Editing Attacks: Average Z--
Score on 5K Rows.
From Table 9 we observe that / 4 consistently achieves higher Z-scores than / = 3 in the Shoppers, Magic, and Credit datasets. In the Adult dataset, = 3 performs better in 11 out of 13 cases, and in the Diabetes dataset, = 3 wins in 7 out of 13 cases.
The better robustness of tails, making them more resistant to noise and distortion. However, increasing excessively may reduce robustness, as smaller quantile ranges introduce higher variance despite higher average bit accuracy. Excessively large values could also disrupt the initial latent distributions by imposing stricter constraints on self-cloning.
can be attributed to valid bit values being closer to the distribution
28


Reviews:
[{"review_id": "Hhh8Ovct8e", "reviewer": "Reviewer_w73M", "summary": "The paper proposes the first sampling-phase watermarking method for tabular diffusion models. It also proposes a valid bit mechanism to enhance the robustness. Theoretical guarantee is provided for row-level diversity and detection. Extensive experiments show the effectiveness of the method.", "questions": "Please see the Weaknesses part.", "limitations": "", "rating": 8, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The paper proposes the first sampling-phase watermarking method for tabular diffusion models.\n\n2. To enhance the robustness, the paper proposes a valid bit mechanism.\n\n3. The paper shows theoretical guarantee for the proposed method.\n\n4. Extensive experiments validate the effectivenss and robustness of the proposed method.", "weaknesses": "There is one main concern.\n\nWill the purification methods in image-domain be effective for the watermark in tabular diffusion models? For example, if DiffPure is used to purify the latent, will the watermark still be effective?", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "SGf2nQT2yl", "reviewer": "Reviewer_7YMM", "summary": "This paper introduces TABWAK, a novel approach to watermarking tabular generative models. To counter the application-specific attacks on tabular data, namely row shuffling, deletion, and recording, the author proposes a row-wise embedding method. To avoid loss of data diversity, the author proposed self-cloning and shuffling techniques in the latent space of the diffusion model. Through VAE and ddim inversion, the author can track the original latent used for the generation which will then be unshuffled to retrieve user identity.", "questions": "1. I'm not an expert on watermarking tabular data and the field seems relatively new. In the introduction section, the author mentioned that \"it is paramount to ensure its traceability and auditability to avoid harm and misusages\" I wonder if the author could enlighten me on the potential cases of misusages and harm. I believe it will also be beneficial for the author to include this in the introduction for a broader audience. \n\n2. Again, since I'm not an expert on tabular data generation, and this method relies on the dimensionality of latent space. What is the key capacity for this method? More specifically, what does m equal in your experiments? I assume this is a data and model-dependent hyperparameter that is fixed in your experiment since no retraining is needed, and it heavily affects the practicability of your method since it will affect the upper bound of your key capacity. A brief explanatory note on this could be beneficial.", "limitations": "", "rating": 8, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "This paper is well-written and easy to follow, the experiment results are thorough, and informative. The idea the author proposed in the paper is novel and interesting.", "weaknesses": "The attacks considered in this paper (e.g. row shuffling, deletion, etc) are somewhat basic and limited. The author could benefit from testing on more sophisticated attack methodologies for example adversarial attacks, where the attacker maximizes the distance in VAE or DDIM latent space while constraining the l2 norm of the perturbation to tabular data. However, I'm unfamiliar with the attack and misusage cases of tabular data, so a justification of the potential attack cases may also be helpful.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "CpnNotny58", "reviewer": "Reviewer_CBoB", "summary": "This manuscript introduces a novel watermarking method for tabular diffusion models, claiming to be the first to embed invisible signatures that control Gaussian latent codes for synthesizing table rows. Image-based watermarking methods are unsuitable as they impair row-wise watermark detection, row diversity, and robustness against tabular-specific attacks like row deletion and shuffling. To address this, the authors propose a self-cloning plus shuffling mechanism and a valid bit mechanism to enhance watermark robustness and table quality. Extensive experiments on five datasets demonstrate the method's effectiveness compared to SOTA diffusion watermarking approaches.", "questions": "* How do the authors plan to enhance the novelty of their work by incorporating more innovative contributions specific to tabular diffusion models, rather than relying on previous achievements? Could they explore further applications or unique features of tabular data to better distinguish this approach?\n\n* Could the authors provide theoretical or experimental comparisons between the \"valid bit mechanism\" and alternative approaches, such as information repetition, to clarify its effectiveness and superiority?\n\n* Given that the current experimental results show the proposed method’s performance is not consistently superior to previous watermarking methods, can the authors provide additional data or a more detailed explanation of these outcomes? How do they address this limitation to demonstrate the proposed method's advantages more clearly?", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "* This manuscript makes a valuable first attempt at watermarking tabular diffusion models by embedding invisible signatures that control Gaussian latent code sampling to synthesize table rows via a diffusion backbone. \n\n* The authors effectively identify key differences between tabular and other diffusion models, recognizing the unique distortions that tables face. They design a self-cloning plus shuffling mechanism and a valid bit mechanism to enhance both the quality of watermarked tables and the robustness of the embedded watermark, demonstrating a strong understanding of the practical demands of tabular diffusion models.\n\n* To validate their method, the authors provide both thorough theoretical support and a substantial set of experiments, underscoring the rigor of their approach, which is commendable.\n\n* The manuscript is well-written, with a clear explanation of the authors’ thought process and design steps, facilitating readers' understanding of this work.", "weaknesses": "* The watermarking method for tabular diffusion models in this manuscript appears to rely heavily on the previous diffusion model watermarking approach [1]. While some new components and adaptations address the specific needs of tabular data, the novelty could be further emphasized by exploring unique features and applications of table data in greater depth. Expanding on these aspects would enhance the distinctiveness of the contribution.\n\n* In designing the \"valid bit mechanism,\" the authors focus on extrema values at the ends of the distribution, which is logical but may underutilize the central parts of the distribution. To validate this choice, theoretical proof or empirical evidence is needed to show that this approach outperforms one that also uses centered values for repeated information, as repetition might improve robustness.\n\n* The experimental results are not fully satisfactory. For instance, in Table 2, **the robustness of the proposed method falls short of [1] across four out of five datasets.** The explanations for this gap are limited and may not fully justify the proposed method's advantages. Additional experimental data should be provided to demonstrate the method’s superiority, or the authors should offer a more comprehensive analysis of the results, clarifying how the proposed method remains advantageous despite the observed performance gap.\n   \n[1]. Gaussian shading: Provable performance-lossless image watermarking for diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 12162–12171, 2024.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "ONv2D0MNLs", "reviewer": "Reviewer_jg7M", "summary": "In this paper, the authors propose a novel watermarking method for tabular diffusion models. As the first sampling-phase watermark for tabular data, this method controls the initial seed of the latent diffusion model using symmetric seeds, with bitwise accuracy between two halves applied at the detection phase. Additionally, the initial noise for each row varies to ensure a diverse generation. In experiments, the authors show the proposed method is robust against various attacks.", "questions": "- The proposed method is very good for Shoppers, but Gaussian Shading has way higher z-scores in other datasets. Do the authors have any idea why it's the case? Also, I guess you can sacrifice the generation quality to make the detectability much better.\n- I think the proposed method is very interesting. Do the authors know if a similar method can be applied to images?", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "- The paper is well-written and easy to follow and understand.\n- The method is very interesting. Although it is kind of inspired by the previous work, the new design like self-cloning is very interesting and insightful.\n- The results are very promising. The method can achieve really good generation quality while the detectability is also good.\n- The paper has a very solid evaluation. Especially, the authors use 4 quality metrics to thoroughly show the diversity and usefulness of the generated data.", "weaknesses": "- I think my main concern is the usefulness of tabular data watermarking. I can see for images or texts, we need to detect if they are AI-generated to prevent spreading misinformation, but I don't see tabular data can bring much harm like other modalities.\n- In terms of detectability, the proposed method underperforms the Gaussian Shading baseline by a lot in most of the datasets. \n- It will be very helpful to include other tabular watermark baselines even though they are not sampling-phase methods.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "AFuexGxOR0", "reviewer": "Reviewer_hNPH", "summary": "This paper introduces a watermarking technique designed specifically for tabular diffusion models. The innovation lies in its row-wise watermarking approach that embeds signatures within the Gaussian latent codes used during the sampling process. Authors employ two mechanisms: a self-cloning plus shuffling technique that maintains row diversity while enabling row-level detection, and a valid-bit mechanism that leverages distribution tails for robust watermark detection. The method is tested across multiple datasets and demonstrates good performance in maintaining data utility while achieving reliable watermark detection.", "questions": "1. How does TabWak's performance change with different architectures of the backbone diffusion model? The current evaluation uses a specific TabSyn architecture, would the method's effectiveness be maintained with other tabular diffusion model architectures?\n\n2. Given that the valid-bit mechanism focuses on the tail of the distribution for improved robustness, could this create vulnerabilities to targeted attacks that specifically manipulate these tail values? Have you considered or evaluated such potential attacks?", "limitations": "", "rating": 8, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "The paper addresses an important gap in watermarking tabular data generated by diffusion models, which is becoming increasingly relevant as synthetic data adoption grows. Authors cleverly design self-cloning and shuffling mechanism to handle the challenges of tabular data, particularly the need for row-wise detection and inter-row diversity. And also provides solid theoretical analysis of bit accuracy expectations under Gaussian noise, both with and without the valid-bit mechanism. The experimental evaluation is thorough, covering multiple datasets, metrics, and attack scenarios.", "weaknesses": "1. Although the paper compares against adapted image watermarking techniques, it doesn't compare against existing tabular data watermarking methods that operate in post-processing (mentioned in Related Works, e.g., He et al., 2024). This comparison would help understand the relative advantages of embedding watermarks during sampling versus post-processing.\n2. While the paper presents results with specific parameter choices (e.g., l=4 for quantiles), there's limited discussion about parameter sensitivity and how different choices might affect the trade-off between data quality and watermark robustness. \n3. Although the paper mentions privacy protection as a use case for synthetic data, it doesn't analyze potential privacy implications of the watermarking scheme itself, such as whether the watermark could leak information about the training data or model architecture.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Spotlight)