MUSE: Model-Agnostic Tabular Watermarking via Multi-Sample Selection
Authors: Liancheng Fang
Aiwei Liu
Henry Peng Zou
Yankai Chen
Hengrui Zhang
Zhongfen Deng
Philip S. Yu
Venue: ICLR 2026 Poster (2026)
Keywords: Watermark
Tabular Generative Model
Primary area: alignment, fairness, safety, privacy, and societal considerations

Abstract: We introduce MUSE, a novel watermarking paradigm for tabular generative models. Existing approaches often exploit DDIM invertibility to watermark tabular diffusion models, but tabular diffusion models suffer from poor invertibility, leading to degraded performance. To overcome this limitation, we leverage the computational efficiency of tabular generative models and propose a multi-sample selection paradigm, where watermarks are embedded by generating multiple candidate samples and selecting one according to a specialized scoring function.
    The key advantages of MUSE include (1) Model-agnostic: compatible with any tabular generative model that supports repeated sampling; (2) Flexible: offers flexible designs to navigate the trade-off between generation quality, detectability, and robustness; (3) Calibratable: theoretical analysis provides principled calibration of watermarking strength, ensuring minimal distortion to the original data distribution.
    Extensive experiments on five datasets demonstrate that MUSE substantially outperforms existing methods. Notably, it reduces the distortion rates by 84-88% for fidelity metrics compared with the best performing baselines, while achieving 1.0 TPR@0.1%FPR detection rate.

Published as a conference paper at ICLR 2026
MUSE: MODEL-AGNOSTIC TABULAR WATERMARK- ING VIA MULTI-SAMPLE SELECTION
Liancheng Fang', Aiwei Liu Linrr Peng Zou', Yankai Chen²*, ...ngrui Zhang', Zhongfen Dengh1, -1, Philip S. Yu'
University of Illinois Chicago, 2 Tsinghua University," 3 MMBZUA,, McGill University
ABSTRACT
We introduce MUSE, novel watermarking paradigm for tabular generative models. Existing approaches often exploit DDIM invertibility to watermark tabular diffusion models, but tabular diffusion models suffer from poor invertibility, leading degraded performance. To overcome this limitation, we leverage the computational efficiency of tabular generative models and propose multi-sample selection paradigm, where watermarks are embedded by generating multiple candidate samples and selecting one according specialized scoring function. The key advantages of MUSE include (I) Model-agnostic: compatible with any tabular generative model that supports repeated sampling, (2) Flexible: offers flexible designs to navigate the trade-off between generation quality, detectability, and robustness; (3) Calibratable: theoretical analysis provides principled calibration of watermarking strength, ensuring minimal distortion to the original data distribution. Extensive experiments on four datasets demonstrate that MUSE substantially outperforms existing methods. Notably, it reduces the distortion rates by 84 88% for fidelity metrics compared with the best performing baselines, while achieving 1.0 TPR 1P.1 FFRR detection rate. Code is publicly available at this URL.
INTRODUCTION
The rapid development of tabular generative models (Kotelnikov et al., 2023; Gulati and Roysdon, 2024; Castellon et al., 2023; Zhang al., 2024c; Shi et al., 2024; Fang al., 2025; Zhang et al., 2025) has significantly advanced synthetic data generation capabilities for structured information. These breakthroughs have enabled the creation of high-quality synthetic tables for applications in privacy preservation, data augmentation, and missing value imputation (Zhang et al., 2024b; Hernandez al., 2022; Fonseca and Bacao, 2023; Assefa et al., 2020). However, this advancement concurrently raises serious concerns about potential misuse, including data poisoning (Padhi et al., 2021) and financial fraud (Cartella et al., 2021). To address these risks, watermarking has emerged as a pivotal technique. By embedding imperceptible yet robust signatures into synthetic data, watermarking facilitates traceability, ownership verification, and misuse detection (Liu et al., 2024b).
Earlier works on tabular data watermarking utilize edit-based watermarking (Zheng et al., 2024; He et al., 2024), embedding signals by modifying table values. However, this approach has a fundamental limitation with tabular data: direct value alterations, especially in columns with discrete categorical data, can easily corrupt information or render entries invalid. For instance, such edits might introduce non-existent categories (Gu et al., 2024; Lin et al., 2021) or push values across critical decision boundaries (Ngo et al., 2024), significantly compromising data integrity. Recently, generative watermarking has emerged as an alternative approach for tabular data, drawing from successful techniques in diffusion models for images and videos (Wu et al., 2025; Yang et al., 2024; Wen et al., 2023; Hu et al., 2025). This approach leverages the reversibility of DDIM samplers (Song al., 2020a) by initializing generation with patterned Gaussian noise and, during watermark detection, assessing its correlation with the noise reconstructed through the inverse process. TabWak (Zhu et al., 2025) applies this concept to tabular diffusion models (Zhang et al., 2024c; Kotelnikov et al., 2023; Lee et al., 2023; Kim et al., 2022). Unlike edit-based watermarking, generative watermarking maintains better generation quality since the watermark is embedded within noise patterns that closely resemble Gaussian distributions, minimizing impact on the generated content.
+Corresponding author. Work done prior to Amazon.

---

Published as a conference paper at ICLR 2026
However, watermarking tabular diffusion mod- els is significantly more challenging than for im- age and video diffusion models. This stems from
Inversion Acc. (%)
Generation GFLOPs
10"
80-
10"
the substantially lower accuracy of DDIM in- verse processes in tabular diffusion models, shown in Figure (left). When using the same Gaussian shading algorithm (Yang al., 2024), tabular modality exhibits the lowest reversibility accuracy. This challenge arises because tabu- lar diffusion models incorporate multiple addi- tional algorithmic components that are difficult to reverse, such as quantile normalization (Ama- ratunga and Cabrera, 2001) and Variational Au- toencoders (VAEs) (Kingma and Welling, 2013) used in TabSyn (Zhang et al., 2024c). During watermark detection, the entire data processing pipeline must be inverted to recover the water- mark signal, but this process accumulates errors as precisely reversing each step is often difficult or impossible. Key challenges in the inversion process include: (1) inverting quantile normalization is inherently problematic as this transformation is non-injective; (2) VAE decoder inversion relies on optimization methods without guarantees of per- fect implementation. Due to limitations tabular DDIM inversion accuracy. watermark detectability becomes highly dependent model implementation, severely restricting its application scope and practical utility (see Section for more details).
60
10"
40
10'
20
10"
Tabular
Video
Image
Tabular
Video
Image
Figure I: Left: Tabular diffusion models exhibit the lowest inversion accuracy (bit accuracy) when compared to video and image diffusion models. Right: Tabular diffusion models require much fewer generation GFLOPs than video and image diffusion models. Models used: TabSyn (Zhang et al., 2024c) (tabular), Stable Diffusion (Rombach al., 2022; Blattmann et al., 2023) (image/video).
This paper introduces MUSE, a model-agnostic watermarking paradigm for tabular data that operates without relying on the invertibility of diffusion models. A key insight enabling our approach that tabular data generation demands significantly less computation than image video generation, as shown in Figure (right). This computational efficiency makes a multi-sample selection process practical: MUSE leverages this by generating multiple candidate samples for each data row and embedding the watermark by selecting one candidate based on a keyed watermark scoring function, which is calculated using values from specific columns. We present MUSE as a general paradigm and introduce two specific implementations that navigate the crucial trade-off between data fidelity and watermark detectabllity/rrouutness (1) Joint-Vector (JV) hashing, tailored for minimal distortion (distribution-Pp iristribution-preeeevinn and (2) Per-Column (PC) hashing, designed for maximal robustness and detectability. We ground this paradigm rigorous theoretical analysis, providing precise method to calibrate detectability and establishing conditions for distortion-fre. watermarking. Validated across diverse datasets, MUSE demonstrates high watermark detectability and strong robustness against. attacks while maintaining the underlying model's generation quality.
Our Contributions. We summarize the main contributions of this paper as follows:
We propose tabular watermarking via multi-sample selection (MUSE), a novel generative water- marking paradigm for tabular data that completely avoids the inversion of generative and data processing pipelines, ensuring broad compatibility with any tabular generative model.
We demonstrate the flexibility of the MUSE paradigm, showing how different score function designs enable controllable trade-off between generation quality, detectability, and robustness.
We provide theoretical analysis of MUSE, establishing its detectability for precise strength calibra- tion and identifying the conditions for achieving distribution Distribution-pprservinng watermarking.
Extensive experiments across multiple tabular datasets validate MUSE's superior performance in generation quality, watermark detectability, and robustness against various tabular-specifie attacks.
PRELIMINARIES
Tabular Generative Models. A tabular dataset with N rows and M columns consists i.i.d. samples (x,) drawn from unknown joint distribution Puau (x), where each x; R M (or mixed- type space) represents a data row with M features. A tabular generative model aims to learn a parameterized distribution po px(x) ) Paaa (x) to generate realistic samples.
2

---

Published as a conference paper at ICLR 2026
Unwatermarked Samples
Selected Value
Seod
Score
9
870
1st
60
1st
011001
Eq. (2,3)
Watermarked Sample
2
5th
Col. Selection
79
Hash Function
110110
Bernulli
arginax
m
870
1st
3
128
3th
$ 3.2.2
2
101111
4
8
400
9th
50
001011
Watermark Key
Figure 2: An overview of the MUSE watermark generation process. MUSE operates by generating multiple samples and selecting the highest-scoring sample (ties are broken randomly). The selected row is appended to the watermarked table, while others are discarded.
Watermark for Tabular Generative Models. Tabular watermark involves main functions. (1)
Generate: Given a secret watermark key k this function produces watermarked table. Similar to standard generation, each row of this table sampled i.i.d., but from a distribution p(x. k)) (2) Detect: Provided with table and a specific key k, this function examines the table to determine if it carries the watermark associated with that particular key.
Threat Model. We consider the following watermarking protocol between three parties: the tabular data provider, the user, and the detector. (1) The tabular data provider shares a watermark key & and certain metadata related to the data distribution (e.g.. the maximum and minimum values of each column) with the detector. (2) The user asks the tabular data provider to generate a table T. (3) The user publishes table T". which can either be an (edited version of the) original table T or independent table. (4) The detector determines whether the table T' watermarked or not.)
METHOD
In this section, introduce MUSE, general paradigm for watermarking tabular data generators. We begin by outlining the paradigm's 's high-level architecture for generation and detection (Section 3.1). We then detail its components: the scoring function (Section 3.2), which can be instantiated with different designs to balance trade-offs between detectability and distortion.
3.1 WATERMARK GENERATION AND DETECTION PARADIGM
We define the overall generation and detection process of our MUSE method in this section. The generation of each watermarked row can be decomposed into the following two steps:
Generation. The generation of each watermarked row is achieved through two-phase process:
Sample Candidates. Generate a set m candidate rows by i.i.d. sampling from the model's distribution p(x).
2. Select the Highest-Scoring Candidate. Apply watermark scoring function s²(-) to each candidate x; using watermark key and select the highest-scoring candidate (ties are broken randomly) the watermarked row. We will detail the watermark scoring function in Section 3.2,
To produce a watermarked table with N rows, we repeat the above process N times. practice, selection procedure can be fully parallelized across the N groups since each group contains i.i.d. samples. The watermark generation process is illustrated in Figure and Algorithm
The generation process naturally creates statistical artifact. By consistently selecting the highest-scoring sample, we ensure that a watermarked table will exhibit a significantly higher average score than unwatermarked one. To detect the watermark, formalize this intuition as follows: given a (watermarked or unwatermarked) table consists of rows: T == (XI,...,Xx) XN), we compute the detection statistic:
Detection.
S(T)
Su (x,))
N
table is flagged as watermarked if its mean score S(T) surpasses a predefined threshold derived from the expected score of not-watermrrked data. The formal statistical test is detailed in Appendix F.4.
3

---

Published as a conference paper at ICLR 2026
3.2 WATERMARK SCORING FUNCTION
Our watermark scoring function, (-), has two components: a score generation design, described in Section 3.2.1, and column selection implementation, detailed in Section 3.2.2.
3.2. SCORE GENERATION DESIGNS
Let π (x) be selection function that selects a subset of columns from a sample (we will detail the design of the selection function in Section 3.2.2), with J being the set of selected column indices.
We present two designs for generating score from this selection and the watermark key k.
Vector (JV) Hashing: Hashes the entire vector of selected values as a concatenated vector. = H ( (x)),.)) R)),
* (x) = f(h).
(2)
Per-Column (PC) Hashing: Hashes each selected column value independently then aggregates.
h; [xi, k) (iE J),
PC 8k (x)
f(h.).
SEJ
In both designs, f is a pseudorandom function (PRF) whose output bit follows Bernoulli(O.5) distribution. Intuitively, by placing equal probability mass on the two extreme values (0 and 1), this distribution provides maximal separation between binary signals (watermarked vs. -on-watermarke). This intuition is rigorously established in Theorem 4.1.
Robustness and Distortion Trade-off. The choice between JV and PC hashing represents fun- damental trade-off between robustness against attacks and the preservation of the original data distribution (low distortion). The JV design excels at minimizing distortion. By hashing concate- nated vector of column values, it operates in vast input space, making hash collisions rare and thus preserving the data's 's statistical properties. However, this "all-or-nothing" approach is fragile; single modification to any of the selected columns can alter the entire hash, compromising the watermark signal for that sample. In contrast, the PC design prioritizes robustness. It embeds the watermark signal independently across multiple columns, ensuring that the overall signal can survive partial data deletion or modification. This resilience comes the cost of a higher potential for distortion, as the smaller input space of individual columns can lead to more frequent hash collisions and more concentrated statistical bias. We empirically validate this trade-off in our experiments (Section 5).
3.2.2 COLUMN SELECTION IMPLEMENTATION
Adaptive Selection for JV Hashing. The selection strategy for Joint-Vector (JV) hashing must address two critical vulnerabilities. First, the design's "all-or-nothing" nature makes it fragile: any modification to selected value invalidates the entire watermark, which necessitates the use of sparse selection (a small number of columns) to minimize the attack surface. However, simply choosing fixed sparse set of columns creates a predictable target for adversaries, who could nullify the watermark by altering just those few features. To overcome both challenges, we propose strategy that fulfils both requirements. This achieved by selecting columns based on their quantile rank, which measures value's 's position relative to the empirical distribution of the training data. For each row x and each column index j. we compute its rank r E [0, 1]:
03 Umin..
U - Umin.j
where for a numerical column, By equals the j-th column value of x: By := x= and Umin.j. Umax. are pre-computed min and max values from the training data. For categorical column, 1/ is its ordinal index. Finally, for each sample x, we take its per-column ranks rj, sort them within the row, and select the columns whose positions match fixed quantile set Q.
Full Selection for PC Hashing. contrast to the JV design, the Per-Column (PC) approach is inherently robust, it aggregates watermark signals embedded independently across each column. This design ensures that modifications to a subser of columns do not corrupt the entire watermark. The overall signal's strength and resilience scale directly with the number of columns used. Therefore, to maximize robustness, the ideal strategy is to select all available columns. For this design, we configure (x))= x to simply use all features, setting the index set to J = (1,.... M).
4

---

Published as a conference paper at ICLR 2026
Remark 3.1 (Modification of All Columns). For datasets consisting of purely numerical columns, adversary may inject small perturbations across all entries simultaneously. To mitigate the sensitivity of hashing to such noise, a preprocessing step f (e.g.. quantization) can be applied prior to hashing, ensuring that f(x)) Ri f(x + )) for a small noise term 6. See Appendix E.2 for a complete discussion. Remark 3.2 (Watermark Security). JV hashing selects a sparse subset of columns based on a fixed quantile set, which introduces potential vulnerability: if the quantile set leaked, adversary can identify the watermark satrrmark-carryinng columns and scrub the watermark. In contrast, PV hashing is inherently more resilient since the watermark signal is spread across all columns. A simple way to improve the security of JV hashing is by applying a keyed pseudorandom permutation (PRP) TT to the column indices before quantile selection (x + TR (x)). Under this design. the watermark-cant carryinn columns are indexed by the secret key k. and identifying them becomes computationally equivalent to breaking the underlying PRP. We further provide empirical evidence showing that recovering the quantile set is non-trivial in practice; See Appendix E.3 for a complete discussion.
4 ANALYSIS
In this section, we provide a theoretical analysis of the detectability and distributtin-pprservinn properties of the MUSE paradigm.
4.1 CALIBRATING THE NUMBER OF REPEATED SAMPLES
Given the detection statistic Equation (1), we will show how the detectability MUSE depends on (1) the number of watermarked samples N and (2) the number of repeated samples m.
Theorem 4.1 (Watermark Calibration Guarantees). Denote a watermarked table as Twm and an unwatermarked table as Tno-wm. each consisting of N rows. Lel x ~ p(x) be a random vari- able drawn from the data distribution, and let X1...., Xm be i.i.d. samples from p(x). De- fine Puo-wm = Ex==px) [sk (x)] as the expected score of an unwatermarked sample, and define pwm Exx=p(x) [maxie[m] 8u (x:) the expected score of a watermarked sample obtained via m repeated samples. Suppose the scoring function satisfies sx(-) E [0, 1]. we have:
1. The False Positive Rate (FPR) of the watermark detection is upper bounded:
N (p
Pno-wm) )2
Pr (S(Tno-wm) > S(Twm)) S exp
(5)
2
2. The RHS of the bound minimized when (x(x) follows a (ernoulli(0.5) distribution.
3. Under this optimal distribution, let N >> 8log(1/a) aa) then to ensure the FPR does not exceed target threshold a, it suffices to set the number of repeated samples m as:
m max (2, logo.5 0.5 - (0.5-22hg)) 22og(1/a))
(6)
Theorem 4.1 enables MUSE calibrate the number of repeated samples m to achieve target false positive rate with theoretical guarantees. This allows the method embed just enough water- marking signal to ensure the desired detectability. Intuitively, since no redundant watermarking signal embedded, the impact of water- marking on the generation quality is minimal. In Figure 3, we plot m as function table size for various target FPRs, based on Equation (6) (omitting the ceiling operation for clarity). We observe that m quickly saturates as increases. For instance, to achieve a 0.01% % FPR, m suffices when N 2 300, and even for N 100, m = 4 is emough. In the rest of the paper, MUSE's m is set by Equation (6) unless otherwise specified.
0.01
0.001
Q
0.0001
3.0
2.5
2.0
100
200
300
400
500
N
Figure 3: m vs. N under dif- ferent values (smoothed).
4.2 DISTRIBUTION PRREIIONNNNEEEEEVIIIIOON
An effective watermarking algorithm must not compromise the quality of the generated data, a re- quirement formalized in domains like image (Gunn et al., 2024) and text generation (Kuditipudi et al.,
5

---

Published as a conference paper at ICLR 2026
Algorithm 1 MUSE Watermark Generation
1: Input: watermark key k, generative model p(x), False Positive Rate a, number of target watermarked samples N
2: Output: watermarked table Twm
3: Compute the number of repeated samples m. based on and a via Equation (6) Calibration.
4: Get m N i.i.d. samples from p(x) and divide them into N groups: (G.)
5: Initialize a list T Turm to store the watermarked table
6: for i 1 N do
P Fully parallelizable.
7: X1,..., + 9:
8: fort ( m) do
9: Select columns for with strategy in Section 3.2.2
Column selection. Score generation.
Compute the score for x2 with strategy Section 3.2.1 to get 8 11: end for
12: i < arg max,g(1,...mm)) St
> Selection of the highest-scoring sample.
Append x; to T um
14:
end for
15:
return Twm
2023). For tabular data generation, we adapt this requirement by demanding that the watermarking process preserves the original data distribution, which formalize follows:
Definition 4.2 -Multi-Sample DistribttionPPreervationn) Denote the space of watermark keys as IC and the original data distribution Pdata (x). Let (X1,- (X1..... ; XN) be sequence of N samples generated consecutively by a watermarking algorithm I' using the same key k ~ Unif The algorithm I' is multi-sample distribution-preseevvii if for any N >> 0, it satisfies:
Preservation).
Pk--Uni((E) (x............ xN)
II Pduaa (2:)-
Our algorithm attains the multi-sample distribution-presee call Repeated Column Masking. The key idea is to cache the history of column values that have previously been selected for watermark embedding. When processing a new sample, its candidate column value has already been used for watermarking, the algorithm skips embedding that sample. This safeguard prevents systematic bias from repeated column reuse across samples. The design is inspired by the repeated key masking technique in LLM watermarking, which ensures sequence-level distribution- prreutrrnnn--eeeiiinn guarantees (Hu et al., 2023; Dathathri et al., 2024). Formally, we have:
property through a mechanism we
Theorem 4.3. Let column masking, satisfies multi-sample instribution-presevvvi
2. The watermarking process in Algorithm 1, augmented with repeated as defined in Definition 4.2.
Remark 4.4. While the repeated column masking mechanism ensures distribution periioonn-eeeeeinng.. it introduces a practical trade-off. By design, this mechanism chooses to skip the watermarking process when repeated column values are detected, which in weakens the watermark's detectability. We empirically validate this trade-off our ablation studies (Section 5.4).
5
EXPERIMENTS
In this section, we provide comprehensive empirical evaluation of MUSE. We aim to answer the following research questions. Q1: Detectability v.s. Distribution Preservation (Section 5.2): Can MUSE achieve strong detectability while preserving the distribution of the generated data? Q2: Robustness (Section 5.3): How resilient is the watermark to range of post-processing attacks, such as row/column deletion or value perturbation? Q3: Component-wise Analysis (Section 5.4); How does MUSE perform under different design choices of its components?
5.1 SETUP
Datasets. We consider four real-world tabular datasets containing both numerical and categorical attributes: Adult, De fault, Shoppers, and Bei jiijing and two datasets with only numerical attributes: California and Letter. Detailed dataset statistics provided in Appendix F.2.
Evaluation Protocols. (1) Detectability: To evaluate the detectability of the watermark, we report the area under the curve (AUC) of the receiver operating characteristic (ROC) curve, and the True

---

Published as a conference paper at ICLR 2026
Table 1: Watermark generation quality and detectability, indicates best performance, indicates second-bes -bst performance. t indicates higher is better, + indicates lower is better. The performance gain is computed with respect to the best performing baseline.
Watermark Generation Quality
Watermark Detectability
Dataset
Method
Num. Training Rows
100
500
Marg. (f)
Corr. (*)
C2ST (1)
MLE Gap (L)
AUC
Té01 AUC
T
w/o WM
0.994
0.984
0.996
0.017
0.919
0.870
0.676
0.046
0.590
0.004
0.774
0.171
GS
0.751
0.619
0.058
0.084
1.000
1,000
1,000
1,000
Adult
TabWak
0.955
0,885
0.769
0.048
0.844
0.089
0.990
0.592
TabWak
0.933
0.879
0.713
0,085
0.999
0.942
1,000
1,000
MUSE-JV
0.979 (=78.85)
0.963
0.883 (=50.2%)
0.017
1,000
1,000
1,000
1.000
MUSE-PC
0.953
(-30 556)
2+40 47%
0.790 075)
0.018
9%;
1,000
1.000
1,000
w/o WM
0.990
0.934
0,979
0,000
TR
0.895
0.888
0.564
0.161
0.579
0.001
0.848
0.034
GS
0.701
0.678
0.059
0,182
1,000
1,000
1,0000
1,000
Default
TabWak
0.911
0.902
0.568
0.896
0.071
0.997
0.611
Wak
0.906
1.894
0.550
0,176
0.965
0.218
1.000
0.995
SE-JE-V
0,983
0.925
(12)
0.963 (196.195)
0.002
(99877%
1.000
1,000
1,000
1,000
MUSE-PC
0.960
(:5 0%%)
0 920 2456 37))
0. 866 (+72.098)
0.003 (458 19%
1,000
1.000
1.000
w/o WM
0.985
0.974
0.974
0.017
0.888
0,880
0.501
0.575
0.001
0.830
0.058
GS
0.729
0.6888
0.061
0.154
1,000
1,000
1,0000
1,000
Shoppers
TabWak
0.903
0.548
0.860
0.106
0.990
0.353
TabWak
0.897
0.879
0.525
0,384
0.742
0.002
0.981
0.185
ML SE-JV
0,982 (600.55))
0.974 (4200.005)
0.950
(194,49))
0.015 (680.5%)
1,000
1.000
1,000
1,000
MUSE-PC
0.962
(77.00%)
0.947
(100 35)
0.871
(678.85)
0.025
(107 .7%
1,000
1,000
1.000
1.000
w/o WM
0.977
0.958
0.934
0,199
0.914
0.873
0.577
0.000
0.548
0.007
GS
0.656
0.529
0.097
0.715
1.000
1,000
1,000
1,000
Reijing
TabWak
0.923
0.871
0.792
0.375
0.925
0.096
0.999
0.978
TahWak
0.917
0,860
0.761
0,403
0.996
0.734
1.000
1.000
ML SE-JV
0.972 (400.55))
0.955
0.926
0.209
1,000
1,000
1.000
1.000
MUSE-PC
(57)
we2 155
0.898
(770)77))
0.213 1-1x 25::
1,000
Adult
Defsnlt
Shoppets
Beiling
12 1
notadadee (1)
potuttelc (1)
stalissic (1)
s-saaiiiic (1)
roba Fiielity (1)
Fidcity (1)
Fidelity (1)
Data Frielity (1)
10
m
14
MUSE-PC
MUSEJJV
Figure 4: The tradeoff between average z-statistic and data fidelity (computed as average of Marg.. Corr., C2ST and MI.)) under different number of repeated sample m.
Positive Rate when the False Positive Rate is at 0.1%. 1%, denoted TPR@0. PFFRR. (2) Distribution
Preservation: To evaluate the distribution distribution-preeeriing ability of the watermarked data, we follow standard fidelity and utility metrics used in tabular data generation (Zhang et al., 2024c; Kotelnikov et al., 2023): we report Marginal distribution (Marg.). Pair-wise column correlation (Corr., Classifier- Two-Sample-Ti
(C2ST), and Machine Learning Efficiency (MLE). For MLE, we report the gap between the downstream task performance of the generated data and the real test set (MLE Gap). We refer the readers to Section F.3 for more detailed definition of each evaluation metric. (3) Robustness: We evaluate the robustness of the watermarked data against five representative post- processing attacks. In addition, we also consider an adaptive adversary who tries reverse-engineer the watermark scheme. Detailed description will be presented in Section 5.3.
Baselines and Implementation Details. We compare our method with TabWak (Zhu et al., 2025) and its improved variant TabWak*, the only existing generative watermarking approach for tabular data, using their official implementations. We also include two image watermarking methods, TreeRing (Wen et al., 2023) and Gaussian Shading (Yang et al., 2024), auxiliary baselines (see Appendix F.5 for detailed implementation). For completeness, we also include two edit- based methods: TabularMark (Zheng et al., 2024) and WGTD (He et al., 2024), with detailed results in Section C.2. All experiments use TabSyn (Zhang et al., 2024c) as the tabular generative model trained with the official codebase. Notably, the official Wab implementation bypasses quantile
7

---

Published as a conference paper at ICLR 2026
Shunfile
Alteration
Gaussian
Cell Deletion
Row Delction
Column Deletion
TPRI19FPR
0.75
0.75
0.75
0.75
0.75
0.50
0.50
0.00
0.00
050
0.30
0.25
0.25-
0.25
0.25
0.25
0.26
0.00
0.00
0. 0.2 0.4 0.5 0.8 1.0
0.0 0.2 0.d 0.6 U.s 100
0.0 0.4 ou 0.8 10
0U0 0.2 0.4 0.5 d8 1.0
1. 0.2 o.d 0.6 08 1.0 Attack Strength
0.0 0.2 0.4 au 0.8
Attack Strength
Streegtth
Atlack Strength
Attack Strength
Attack Strength
MUSE-JV
MUSE.PC
TabWak
TabWak"
Figure 5: Detection performance of watermarking methods against different types of tabular data attacks across varying attack intensities. The results are averaged over all datasets.
normalization inversion, assuming access to ground-truth data unavailable at detection time, which may favor its performance (see Section D.2 for more discussion). Generation quality is evaluated across ten repetitions, and we report the averaged results.
5.2 DETECTABILITY AND DISTRIBUTION PRESERVATION
We address the first question: whether the watermarking method achieves high watermark detectability while introducing minimal distortion to the generated data. Based on experiments results in Table 1, our obervations are summarized as follows:
(1) Regarding generation quality, both MUSE variants consistently outperform the baselines across all datasets. The MUSE-JV variant is particularly effective, reducing distortion rates on fidelity metrics (Marg.. Corr., C2ST) by 84 88% compared to the best performing baselines. In contrast, all inversion-based methods suffer from significant data distortion. We attribute this to the error accumulation inherent in their recovery process:
watermark be detected after noisy inversion, the initial signal must be excessively strong, which inherently leads to large distortion. (2) In terms of detectability, both variants of MUSE achieve perfect detection performance across all datasets, as measured by both AUC and T@ IEF While GS also achieves strong detection scores, this comes at the cost of significantly higher distortion across all fidelity metrics. (3) The JV variant achieves better fidelity metrics than the PC variant. We will show in the next section that the PC variant more robust to post-processing detectability (z-stat) and data fidelity (computed as the average of Marg., Corr., C2ST, and MLE). Consistent with the theoretical analysis in Theorem 4.1, increasing m in both MUSE variants leads to stronger detectability but degrades data fidelity. The results also demonstrate that, for fixed m. PC hashing generally yields higher detectability than V-hashing (with the exception of the Shoppers dataset m E (2, 4}), albeit at the cost of lower data fidelity. This empirically validates the design principles behind these two hashing strategies.
attacks. In Figure 4, we visualize the tradeoff between
5.3 ROBUSTNESS AGAINST ATTACKS
post-processing. Attacks. We evaluate robustness against six common transformations in tabular data: row shuffling. row deletion. column deletion, cell deletion, value alteration, and Gaussian perturbation. Attacks are applied at perturbation levels from 0.0 to 1.0 in 0.2 increments. Deletion- based attacks replace a fraction of rows, columns, or cells with unwatermarked samples from the same generative model. Value alteration perturbs numerical entries by multiplying them with scalars from (0.8, 1.2), while row shuffling permutes a subset of rows. For the Gaussian perturbation attack, each numeric value is perturbed by zero-mean noise whose standard deviation is the perturbation level times the magnitude of that value. We benchmark the detectability of MUSE-JV and MUSE-PC against Wak and TakWak* all mixed-type datasets 55=500, m=2), and additionally assess the robustness of MUSE-PC under Gaussian perturbation on the two numerical-only datasets. As shown in Figure and Appendix E.2, MUSE-JV matches or surpasses Tab and TabWak* in five of six post-pree pss-processsig attacks, while the PC variant achieves the strongest robustness across all settings. The superior resilience of the PC design, contrasted with the higher fidelity of the JV design, illustrates the fundamental trade-off between robustness and distortion. The capability to select the desired point on the tradeoff spectrum underscores the inherent flexibility of our framework.
Adaptive Attacks. We assess the robustness of MUSE against adaptive adversaries attempting to reverse-engineer the watermark. Specifically, we focus on spoofing attacks (Sadasivan et al., 2023),
8

---

Published as a conference paper at ICLR 2026
Table Component-wise ablation study of MUSE. All experiments are conducted on the Adult dataset (with 15 columns). For detectability, we report the z-statistic (defined in Section F.4). Each color block indicates a different component of the method. indicates higher better.
Hashing
Model
PRE.
Mask
Num. Col.
z-stat.
Marg-t
Corr.
C2ST
JV
TabSyn
Bernouli
No
7.348
0,979
0.963
0.883
JV
TabDAR
Bernoulii
No
7.270
0,977
0.958
0.880
IV
DP-TBART
Bernuuli
No
3
7.544
0.951
0.931
0.759
IV
TabSyn TabSyn
Bernouli
No
3
7.348
0.979
0.963
0.883
JV
Uniform
No
5.012
0,964
0.940
0.808
PC
TabSyn
Bernuuli
No
15
20.001
0,953
0.925
0.790
PC
TabSyn
Uniform
No
15
-11.164
0.937
0.912
0.788
IV
TabSyn TabSyn
Bernoulii
No
3
7.348
0.979
0.963
0.883
JV
Bernoulli
Yes
3
4.819
0.985
0.973
0.940
PC
TabSyn
Bernoulii
No
3
16.505
0.958
0.937
0.826
PC
TabSyn
Bernuuli
Yes
19.998
0,950
0.929
0.797
PC
TabSyn
Bernuuli
No
15
20.001
0.953
0.925
0.790
Mare
C2ST
Adult
Defonh
0311
0:30
0350
0.25
0.90
MURECRS
Sluropers
AUC
MUME-R
NUNBUY
MI0E 1V
8916
5000 3301
0.30
daa50
do3
oddedd
dede
200
55
200
16.65
da.
Figure 7: Impact of the number of watermarked rows N on detectabil- ity, which increases monotonically as more rows are watermarked.
Figure 6: Sensitivity results for different hash families. Error bars denote standard deviation over the key space. MUSE remains insensitive to both hash functions and key space.
where the attacker's s goal is to produce sam- ples that can be falsely claimed as water- marked, without knowing the secret keys
Table 2: Adaptive attack results.
100 Rows
500 Rows
of the watermark. Instead of develop- ing bespoke, scheme-specific spoofing at- tacks (Jovanović et al., 2024), adopt a general distillation-based spoofing frame- work (Sander al., 2024; Gu et al., 2023): an adversary trains strong generative model (e.g., TabSyn) directly on the watermarked data, attempting to absorb and reproduce its statistical structure. The spoofing attack is successful if the generated samples from the trained model are detected as watermarked. The results in Table 2 demonstrate that the adversarial model largely fails to replicate the watermark. On three of the four datasets (Adult, Default, and Be Beijing), its generated output is statistically indistinguishable from clean data (AUC & 0.5 and T@0.1%F x 0.00). While faint signal is detected on the Shoppers dataset, the watermark is severely degraded. This failure of a powerful generative model to passively Iearn the watermark' 's patterns provides strong evidence for MUSE's resilience against reverse-engineeriig attacks.
Dataset
AUC
T@0.1%F
AUC
T@0.1%F
Adult
0.465
0.01
0.566
0.02
Default
0.599
0.01
0.708
0.02
Shoppers
0.683
0.03
0.866
0.41
Beijing
0.470
0.00
0.581
0.05
5.4 ABLATION STUDY AND FURTHER ANALYSIS
We perform component-wise ablation to evaluate the contribution of each design choice in our watermarking framework. All experiments are conducted on the Adult dataset, and we generate watermarked tables with N- 100 rows unless otherwise noted. For detectability, report the

---

Published as a conference paper at ICLR 2026
stattisttic, which quantifies how many standard deviations the observed detection score deviates from its null expectation (no watermark). The exact formulas for JV and PC are given in Section F.4.
Impact of Score Function. We compare two scoring distributions: (1) a Bernoulli distribution with mean 0.5, and (2) a uniform distribution over [0, 1]. For both the JV and PC hashing designs, the Bernoulli score consistently achieves superior detectability, shown in Table 3. This result is consistent with our theoretical analysis in Lemma G.2, which identifies Bernoulli(0.5) as the optimal scoring distribution for our detection formulation.
Impact of the Number of Selected Columns. For the PC design, the number of selected columns presents trade-off between detectability and data quality. As shown in Table 3, using more columns boosts detectability by strengthening the aggregated watermark signal. However, this also raises the potential for distortion, as more frequent hash collisions on small column value spaces can introduce concentrated statistical bias.
Impact of Repeated Column Masking. The repeated column masking mechanism designed to enforce the formal distribution-presss quality. To quantify its impact, we ablate this component for both our JV and PC designs. As shown in Table 3, enabling masking improves data fidelity at the cost of reduction in detectability.
property of our watermark, thereby maintaining high data
AgnstcA Applicability. While our main experiments use a diffusion model (Zhang et al., 2024c), MUSE is model-agnostic framework. To validate this, we apply it to two other diverse generative paradigms: an autoregressive model (DP-TBART (Castellon et al., 2023)) and a masked generative model (TabDAR (Zhang et al., 2024a)), As shown in Table 3, MUSE consistently achieves high detectability and data fidelity across all three model families, confirming its broad applicability.
Computation Time. We compare the effective watermarking time (generation + detection) of MUSE with baselines that rely on DDIM inver- sion. We generate 10K watermarked rows of the Adult dataset. As shown in Figure 8, MUSE achieves significantly lower detection time by avoiding the costly inversion process. Notably, its generation time is also lower than that of the baselines, despite using multi- multi-sample generation (m = 2). This efficiency arises from MUSE's compatibility with fast score-based diffusion mod- els (Zhang et al., 2024c; Karras al., 2022), which require only 50 sampling steps. Conversely, the inversion-basee baselines must use a much slower 1,000-step process for both generation and detection (Zhu al., 2025).
TR
Generation
TabWak
Detection
TabWak
MUSE
20
40
60
80
100
Time
Figure 8: Watermark generation and detection time of MUSE and inversion based baselines.
Sensitivity analysis on hash function and key. We evaluate MUSE on the Adult dataset (N=500, m=2) across five hash families (SHA-256, SHA3-256, BLAKE2s, SHAKE-256, MD5) and 13 randomly sampled keys with bit-lengths from 32 to 128 bits, measuring detectability (AUC, TPR @0. 1 1&FRR and fidelity (Marg.. Corr., C2ST, MLE). As shown in Figure 6, detectability re- mains perfect (AUC=1.0) across all configurations and fidelity variance is negligible (std = 0.01), confirming that MUSE robust to the choice of hash function and secret key.
CONCLUSION
We propose MUSE, a model-agnostic watermarking method that embeds signals via malti- selection, eliminating the need for inversion. MUSE achieves strong detectability with minimal distribution shift and scales across diverse generative models. Extensive experiments demonstrate its superiority over existing methods in both generation quality and watermark detectability. As synthetic tabular data becomes increasingly adopted in high-stakes domains, MUSE offers a practical and generalizable safeguard for data provenance, ownership verification, and misuse detection.
ACKNOWLEDGMENT
This work is supported in part by NSF under grants II1-2166758, and POSE-2346158.
10

---

Published as a conference paper at ICLR 2026
REFERENCES
Scott Aaronson and Hendrik Kirchner. scottaarenson wwt.ccot/aaaaeeeeeca wwwaaaaaaaaeaaaeeeaea /ttp///wwaaaaaa...mmmm ppt, 2022. Presentation.
Watermarking gpt outputs.
https: /www.
Dhammika Amaratunga and Javier Cabrera. Analysis of data from viral dna microchips. Jour- nal of the American Statistical Association, 96:1 1170, 2001. URL https: /appi.
semant remanticscholas org/ ott./oorpusD:1111111
Samuel A Assefa, Danial Dervovic, Mahmoud Mahfouz, Robert Tillman, Prashant Reddy, and Manuela Veloso. Generating synthetic data in finance: opportunities, challenges and pitfalls. In Proceedings of the First ACM International Conference on Al in Finance, pages 1-8, 2020.
Dara Bahri and John Wieting. A watermark for black-box language models. arXiv preprint arXiv:2410.02099 02.99, 2024.
Andreas Blattmann, Tim Dockhorn, Sumith Kulal, Daniel Mendelevitch, Maciej Kilian, Dominik Lorenz, Yam Levi, Zion English, Vikram Voleti, Adam Letts, et al. Stable video diffusion: Scaling latent video diffusion models to large datasets. arXiv preprint arXiv:2311.15127, 2023.
Francesco Cartella, Orlando Anunciacao, Yuki Funabiki, Daisuke Yamaguchi, Toru Akishita, and Olivier Elshocht. Adversarial attacks for tabular data: Application to fraud detection and imbal- anced data. arXiv preprint 10Xi::2001.00300 2021.
Rodrigo Castellon, Achintya Gopal, Brian Bloniarz, and David Rosenberg. Dp-tbart: A transformer- based autoregressive model for differentially private tabular data generation. arXiv preprint arXiv:2307.10430, 2023.
Miranda Christ, Sam Gunn, and Or Zamir. Undetectable watermarks for language models. In The Thirty Seventh Annual Conference on Learning Theory, pages 1125-1139, 139. PMLR, 2024.
Sumanth Dathathri, Abigail See, Sumedh Ghaisas, Po-Sen Huang, Rob McAdam, Johannes Welbl, Vandana Bachani, Alex Kaskasoli, Robert Stanforth, Tatiana Matejovicova, Jamie Hayes, Nidhi Vyas, Majd AI Merey, Jonah Brown-Cohen, Rudy Bunel, Borja Balle, Taylan Cemgil. Zahra Ahmed, Kitty Stacpoole, Ilia Shumailov, Ciprian Baetu, Sven Gowal, Demis Hassabis, and Pushmeet Kohli. Scalable watermarking for identifying large language model outputs. Nature, doi: 10.1038/s41586- 024-08025-4 URL 1038/ 441186666-88 08025-4.
634(8035):818 823, Oct 2024. ISSN 1476-4687.
https://dol org/10 1tt//1101100000
Prafulla Dhariwal and Alexander Nichol. Diffusion models beat gans image synthesis. Advances in neural information processing systems, 34:8780-8794, 2021.
Liancheng Fang, Aiwei Liu, Hengrui Zhang, Henry Peng Zou, Weizhi Zhang, and Philip S. Yu. TABGEN-ICI: Residual-aware in-context example selection for tabular data generation. In Findings of the Association for Computational Linguistics: ACL 2025, pages 20027-20041, Vienna, Austria, July 2025. Association for Computational Linguistics. ISBN 979-8-89176-256--5
Joao Fonseca and Fernando Bacao. Tabular and latent space synthetic data generation: a literature review. Journal of Big Data, 10(1):115, 2023.
Eva Giboulot and Teddy Furon. Watermax: breaking the Ilm watermark detectability-rrouuteesss quality trade-off. arXiv preprint arXiv:2403.04806, 2024.
Bochao Gu, Hengzhi He, and Guang Cheng. Watermarking generative categorical data. arXiv preprint arXiv:2411.10898 2024.
Chenchen Gu, Xiang Lisa Li, Percy Liang, and Tatsunori Hashimoto. On the learnability of water- marks for language models. arXiv preprint arXiv:23/2.04469, 2023.
Manbir Gulati and Paul Roysdon. Tabmt: Generating tabular data with masked transformers. Advances in Neural Information Processing Systems, 36, 2024.
Sam Gunn, Xuandong Zhao, and Dawn Song. An undetectable watermark for generative image models. arXiv preprint 1rX77:2410.07366, 2024.

---

Published as a conference paper at ICLR 2026
Hengzhi He, Peiyu Yu, Junpeng Ren, Ying Nian Wu, and Guang Cheng. Watermarking generative tabular data. arXiv preprint arXiv:2405. 14018, 2024.
Mikel Hernandez, Gorka Epelde, Ane Alberdi, Rodrigo Cilla, and Debbie Rankin. Synthetic data generation for tabular health records: systematic review. Nearocomputing, 493:28 45, 2022.
Seongmin Hong, Kyeonghyun Lee, Suh Yoon Jeon, Hyewon Bae, and Se Young Chun. On exact inversion of dpm-solvers. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 7069-7078, 2024.
Runyi Hu, Jie Zhang, Yiming Li, Jiwei Li, Qing Guo, Han Qiu, and Tianwei Zhang. Videoshield: Regulating diffusion- based video generation models via watermarking. arXiv preprint arXiv:2501. 14195, 2025.
Zhengmian Hu, Lichang Chen, Xidong Wu, Yihan Wu, Hongyang Zhang, and Heng Huang. Unbiased watermark for large language models. arXiv preprint arXiv:2310. 2023.
Huayang Huang, Yu Wu, and Qian Wang. Robin: Robust and invisible watermarks for diffusion models with adversarial optimization. Advances in Neural Information Processing Systems, 37: 3937-3963, 2024.
Nikola Jovanović, Robin Staab, and Martin Vechev. Watermark stealing in large language models. arXiv preprint arXiv:2402.19300 2024.
Tero Karras, Miika Aittala, Timo Aila, and Samuli Laine. Elucidating the design space of diffusiinn- based generative models. Advances in neural information processing systems, 35:26565-26577, 2022.
Jayoung Kim, Chaejeong Lee, and Noseong Park. Stasy: Score-based tabular data synthesis. arXiv preprint arXiv:2210.0400 04018, 2022.
Diederik P Kingma and Max Welling. Auto-encoding variational bayes. arXiv preprint arXiv:1312.6114, 2013.
John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. A watermark for large language models. In International Conference on Machine Learning, pages 17061-17084. PMLR, 2023a.
John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. A watermark for large language models. In International Conference on Machine Learning, pages 17061-17084. PMLR, 2023b.
Akim Kotelnikov, Dmitry Baranchuk, Ivan Rubachev, and Artem Babenko. Tabddpm: Modelling tabular data with diffusion models. In International Conference on Machine Learning, pages 17564-17579. PMLR, 2023.
Rohith Kuditipudi, John Thickstun, Tatsunori Hashimoto, and Percy Liang. Robust distortion-free watermarks for language models. arXiv preprint arXiv:2307.155%. 2023.
Chaejeong Lee, Jayoung Kim, and Noseong Park. Codi: Co-evolving contrastive diffusion models for mixed-type tabular synthesis. In International Conference on Machine Learning, pages 18940- 18956. PMLR, 2023.
Chia-Chen Lin, Thai Son Nguyen, and Chinchen Chang. Lrw-crdb: Lossless robust watermarking scheme for categorical relational databases. Symmetry, 13:2191, 2021. URL https://app.
semant i cschol ar. org. Cttp//oruussti TD: 244412746.
Aiwei Liu, Leyi Pan, Xuming Hu, Shiao Meng, and Lijie Wen. A semantic invariant robust watermark for large language models. ArXiv, abs/2310.06356, 2023.
Aiwei Liu, Sheng Guan, Yiming Liu, Leyi Pan, Yifei Zhang, Liancheng Fang, Lijie Wen, Philip S Yu, and Xuming Hu. Can watermarked 1mm be identified by users via crafted prompts? arXiv preprint 1000:24100.0366. 2024a.
12

---

Published as a conference paper at ICLR 2026
Aiwei Liu, Leyi Pan, Yijian Lu, Jingjing Li, Xuming Hu, Xi Zhang, Lijie Wen, Irwin King, Hui Xiong, and Philip Yu. A survey of text watermarking in the era of large language models. ACM Computing Surveys, 57(2):1-36, 2024b.
Dung Daniel Ngo, Daniel Scott, Saheed Obitayo, Vamsi K Potluru, and Manuela Veloso. Adaptive and robust watermark for generative tabular data. arXiv preprint arXiv:2409. 2024.
Inkit Padhi, Yair Schiff, Igor Melnyk, Mattia Rigotti, Youssef Mrouch, Pierre Dognin, Jerret Ross, Ravi Nair, and Erik Altman. Tabular transformers for modeling multivariate time series. In ICASSP 2021-2021 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 3565-3561 IEEE, 2021.
Leyi Pan, Aiwei Liu, Zhiwei He, Zitian Gao, Xuandong Zhao, Yijian Lu, Binglin Zhou, Shuliang Liu, Xuming Hu, Lijie Wen, et al. Markllm: An open-source toolkit for IIm watermarking. arXiv preprint arXiv:2405. 10051, 2024.
Zhihong Pan, Riccardo Gherardi, Xiufeng Xie, and Stephen Huang. Effective real image editing with accelerated iterative diffusion inversion. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 15912-15921, 2023.
Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. High- resolution image synthesis with latent diffusson models. In Proceedings of the IEEE/CVF confer- ence on computer vision and pattern recognition, pages 10684-10695, 2022.
Vinu Sankar Sadasivan, Aounon Kumar, Sriram Balasubramanian, Wenxiao Wang, and Soheil Feizi. Can ai- ai-generated text be reliably detected? arXiv preprint arXiv:2303. 2023.
Tom Sander, Pierre Fernandez, Alain Durmus, Matthijs Douze, and Teddy Furon. Watermarking makes language models radioactive. Advances in Neural Information Processing Systems, 37: 21079 21113, 2024.
Juntong Shi, Minkai Xu, Harper Hua, Hengrui Zhang, Stefano Ermon, and Jure Leskovec. Tabdiff: unified diffusion model for multi-modal tabular data generation. In NeurIPS 2024 Third Table Representation Learning Workshop, 2024.
Jamming Song, Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. arXiv preprint arXiv:2010.02502 2020a.
Jiaming Song, Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. arXiv preprint arXiv:2010.02502. 2020b.
Yuxin Wen, John Kirchenbauer, Jonas Geiping, and Tom Goldstein. Tree-ring watermarks: Fin- gerprints for diffusion images that are invisible and robust. arXiv preprint arXiv:2305.20030. 2023.
Wikipedia contributors. Quantile normalization Wikipedia, the free encyclopedia. https: //en. wikipedia wttpee/ia...gg//kk///eeeaae http://ooaaniieeeeemmaaaaaaaaaaa wwweeeommmlaaaiiioo..oo 2025, Accessed: 2025-05-
11.
Junchao Wu, Shu Yang, Runzhe Zhan, Yulin Yuan, Lidia Sam Chao, and Derek Fai Wong A survey -lmgenneateed text detection: Necessity, methods, and future directions. Computational Linguistics, pages 1-66, 2025.
Zijin Yang, Kai Zeng, Kejiang Chen, Han Fang, Weiming Zhang, and Nenghai Yu. Gaussian shading: Provable snrformance-lossslee image watermarking for diffusion models. In Proceedings of the IEFF/CVF Conference Computer Vision and Pattern Recognition, pages 12162-12171. 2024.
Hengrui Zhang, Liancheng Fang. Qitian Wu, and Philip S Yu. Diffusion-nested auto-regressive
synthesis of heterogeneous tabular data, arXiv preprint arXiv:2410.2/523, 2024a.
Hengrui Zhang, Liancheng Fang, and Philip S Yu. Unleashing the potential of diffusion models for incomplete data imputation. arXiv preprint arXiv:2405.20663 2024b.
13

---

Published as a conference paper at ICLR 2026
Hengrui Zhang, Jiani Zhang, Balasubramaniam Srinivasan, Zhengyuan Shen, Xiao Qin, Chris- tos Faloutsos, Huzefa Rangwala, and George Karypis. Mixed-typp type tabular data synthesis with score-based diffusion in latent space. In The twelfth International Conference Learning Repre- sentations, 2024c.
Hengrui Zhang, Liancheng Fang, Qitian Wu, and Philip S. Yu. TabNAT: A continuous-disceete joint generative framework for tabular data. Aarti Singh, Maryam Fazel, Daniel Hsu, Simon Lacoste- Julien, Felix Berkenkamp. Tegan Mabaraj, Kiri Wagstaff, and Jerry Zhu, editors, Proceedings of the 42nd International Conference on Machine Learning, volume 267 of Proceedings of Machine Learning Research, pages 11858-74881 PMLR, 13-19 Jul 2025.
Xuandong Zhao, Prabhanjan Ananth, Lei Li, and Yu- Xiang Wang. Provable robust watermarking for ai ai-generated text. arXiv preprint arXiv:2306. /7439, 2023a.
Xuandong Zhao, Prabhanjan Ananth, Lei Li, and Yu-Xiang Wang. Provable robust watermarking for ai-generated text. arXiv preprint arXiv:2306. 17200066774333 17439, 2023b.
Yihao Zheng, Haocheng Xia, Junyuan Pang, Jinfei Liu, Kui Ren, Lingyang Chu, Yang Cao, and Li Xiong. Tabularmark: Watermarking tabular datasets for machine learning. In Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, pages 3570-3584, 2024.
Chaoyi Zhu, Jiayi Tang, Jeroen M. Galjaard, Pin-Yu Chen, Robert Birke, Coreelis Bos, and Lydia Y. Chen. Tabwak: A watermark for tabular diffusion models. The Thirteenth International Conference on Learning Representations, 2025. URL https:t///// /ttpss//ppereeeew.coo net forumm? Ad=7lpur4y8gs.
14

---

Published as a conference paper at ICLR 2026
APPENDIX
The Use of Large Language Models (LLMs)
16
B Related Work
16
C Additional Experiments Results
17
C.I Omitted Results on Robustness
17
C.2 Omitted Results on Edit-based Watermarking
17
C,3 Visualization of statistical signal
19
D Further Analysis of the Inversion- Based Watermarking
19
D.1 Pipeline of Inversion-based Watermarking
20
D.2 Inversion of (Inverse) Quantile Transformation
20
D.3 Inversion of VAE decoder
20
D.4 DDIM Inversion...
20
D.5 Error Accumulation
E
Further Analysis on Robustness
22
E.1
Column permutation attack
E.2
Global perturbation
22
E.3
Watermark stealing
23
F
Experimental Details
25
F.1
Hardware Specification
25
F2
Dataset Statistics
25
E3
Fidelity Metrics
25
F.3.1
Marginal Distribution
26
F3.2
Correlation .....
26
F33.3
Classifier Two-Sample Test (C2ST)
27
F33.4
Machine Learning Efficiency (MLE)
27
F4
Watermark Detection Metrics
27
F55
Implementation Details of Image Watermark Baselines
28
G
Ommited Proofs in Section 3
29
Technical Lemmas
32
15

---

Published as a conference paper at ICLR 2026
A THE USE OF LARGE LANGUAGE MODELS (LLMS)
In the preparation of this manuscript, we utilized Large Language Model (LLM) as assistive tool. The primary applications of the LLM were for polishing the writing, including improving grammar, clarity, and conciseness of the text. Additionally, the LLM was used to generate process.
boilerplate code for setting up and running experiments, which helped accelerate the implementation
The LLM did not contribute to the core research ideation, the development of the proposed method- ology, the analysis of the results, or the scientific conclusions presented in this paper. All content, including the final text and experimental code, was reviewed, edited, and validated by the authors, who take full responsibility for the accuracy and integrity of this work.
B RELATED WORK
Generative Watermarking, Generative watermarking embeds watermark signals during the gener- ation process, typically by manipulating the generation randomness through pseudorandom seeds. This approach has proven effective and efficient for watermarking in image, video, and large language model (LLM) generation. In image and video generation, where diffusion- de facto standard, watermarking methods inject structured signals into the noise vector in latent space (Wen et al., 2023; Yang et al., 2024; Huang et al., 2024). Detection involves inverting the diffusion sampling process (Dhariwal and Nichol, 2021; Hong al., 2024; Pan al., 2023) to recover the original noise vector and verify the presence of the embedded watermark. For LLMs, generative watermarking methods fall into two categories: (1) Watermarking during logits generation, which embeds signals by manipulating the model's s output logits distribution (Kirchenbauer et al., 2023a; Zhao et al., 2023a; Hu et al., 2023; Dathathri et al., 2024; Giboulot and Furon, 2024; Liu et al., 2023; 2024a); and (2) Watermarking during token sampling, which preserves the logits distribution but replaces the stochastic token sampling process (e.g., multinomial sampling) with a pseudorandom procedure seeded for watermarking (Aaronson and Kirchner, 2022; Kuditipudi et al., 2023; Christ et al., 2024). In this sense, sampling- based watermarking is conceptually similar to inversion-base watermarking used in diffusion models. We refer the reader to (Liu et al., 2024b; Pan et al., 2024) for a comprehensive survey of watermarking for L.Ms.. Bahri and Wieting (2024), SynthID (Dathathri et al., 2024), and WaterMax (Giboulot and Furon, 2024) similarly explore watermarking via repeated candidate sampling. However, the distinct nature of tabular data necessitates a fundamentally differ- ent technical approach compared to text. First, the generative structures differ: text watermarking poxxt-tkkenprrdiccti
models are the
operates on conditional 1D distribution context for hashing (Kirchenbauer et al., 2023b). In contrast, tabular models generate full rows i..d. from multi-dimensional unconditional distribution (Kotelnikov et al., 2023; Zhang et al., 2024c;a), lacking the sequential history required for prefix-based hashing. While context-independent methods like Unigram (Zhao al., 2023b) eliminate prefix reliance. applying their fixed Green-Red vocabulary split to tables introduces severe distributional distortion by permanently banning a subset of values across all columns. Second, the threat models diverge significantly: while text methods target token-level edits (insertion, substitution), tabular watermarking must withstand attacks unique to its data structure, such as row/column shuffling, row/column/cell deletion, and numerical value perturbation.
relying on a prefix window of
Watermarking for Tabular Data Traditional tabular watermarking techniques are edit-based, in- jecting signals by modifying existing data values. WGTD (He et al., 2024) embeds watermarks by altering the fractional parts of continuous values using a green list of intervals, but it is inapplicable to categorical-oni column using pseudorandom domain partitioning, but relies on access to the original table for detec- tion, limiting its robustness in adversarial settings. Another significant drawback of such methods is the potential to distort the original data distribution or violate inherent constraints. To overcome this, TabWak (Zhu et al., 2025) introduced the first generative watermarking approach for tabular data. Analogous to inversion- based watermarks in diffusion models, TabWak embeds detectable patterns into the noise vector within the latent space. It also employs self-clone and shuffling technique to minimize distortion to the data distribution. While Tab avoids post-hoc editing, its reliance on inverting both the sampling process (e.g., DDIM (Song al., 2020b)) and preprocessing steps (e.g..
data. TabularMark (Zheng et al., 2024) perturbs values in sclected numerical
16

---

Published as a conference paper at ICLR 2026
Table 4: Watermark generation quality and detectability, indicates best performance,
indicates second-best performance. For clarity, only our method is highlighted in detection.
Watermark Generation Quality
Watermark Defectability
Datasel
Method
Num. Training Rows
100
500
Marg.zt
Corc:
C2ST1
MLE Gap),
AUC
T@0.1%F
AUC
T@0.1% %
who WM
0.994
0.984
0.996
0.017
TabularMark
0.983
0.949
0.987
0.021
1,000
1.000
1.000
1,000
Adult
WGTD
0.987
0.972
0.978
0.019
1.000
1.000
1.000
1.000
MUSE-JV
0.979
0.963
0.883
0.017
1,000
1.000
1.000
1.000
w/o WM
0.977
0.958
0.934
0.199
TabularMark
0.935
0.789
0.941
0.528
1.000
1.000
1.000
1.000
Beijing
WGTD
0.964
0.948
1,000
1.000
1.000
MUSE-JV
0.972
0.955
0.926
0.209
1,000
1.000
1.000
1,000
wfo WM
0.990
0.934
0.979
0.000
TabularMark
0.987
0.939
0.961
0.004
1,000
1.000
1,000
1,000
Default
WGTD
0.989
0.913
0.919
0.000
1,000
1.000
1.000
1,000
MUSE-JV
0.983
0.925
0.963
0.002
1,000
1.000
1,000
1,000
w/o WM
0.985
0.974
0.974
0.017
TahularMark
0.974
0.930
0.975
0.013
1,000
1.000
1,000
1.000
Shoppers
WGTD
0.964
0.944
0.887
0.008
1.000
1.000
1.000
1.000
MUSE-JV
0.982
0.974
0.015
1,000
1.000
1,000
quantile normalization (Wikipedia contributors, 2025)) can introduce reconstruction errors. These errors will in turn impair the watermark's 's detectabilitty
C ADDITIONAL EXPERIMENTS RESULTS
C.I OMITTED RESULTS ON ROBUSTNESS
We present the omitted robustness results Figure 9, where MUSE is compared against TabWak and T the Adult, Bei jiijing Default, and Shoppers datasets. Overall, MUSE demonstrates stronger robustness under cell deletion and row deletion attacks, while achieving com- parable performance alteration and column deletion attacks. Both MUSE and Tab WabbaakaabbWa Wak remain resilient to shuffle attacks, due to embedding watermarks at the individual row level. Notably, observe that TabWak and Tab &ak exhibit instability on certain datasets, such as Shoppers and Bei jing, where detection performance fluctuates-fistt decreasing and then increasing- attack intensity increases. We hypothesize that this behavior stems from the inherent instability of the VAE inversion process.
C.2 OMITTED RESULTS ON EDIT-BASED WATERMARKING
We compare our method against two representative edit-based watermarking baselines, which embed watermarks by directly altering table entries. Since the official implementations of these methods are publicly available, we reimplement them based on the descriptions in their original papers. We first outline their core methodologies and our reimplementation details, then present the comparative results Table Our reproduced codes are provided in the supplementary material. Below are the detailed implementations of the baselines.
WGTD (He et al., 2024). WGTD embeds watermarks by modifying the fractional part continuous data points, replacing them with values from a predefined green list. Consequently, it is limited to continuous data and cannot be applied tables containing only categorical features.
The watermarking process in WGTD involves three main steps: (i) dividing the interval [0. 1] into 2m equal sub-intervals to form m pairs of consecutive intervals: (ii) randomly selecting one interval from each pair to construct set of m "green list" intervals; and (iii) replacing the fractional part of each data point with a value sampled from the nearest green list interval, if the original does not already fall within statistical properties of the modified distribution to reliably identify the presence a watermark. For reproducibility, we adopt the original hyperparameter setting with 5 green list intervals.
Detection is performed via sypotheess--esting framework that exploits the
17

---

Published as conference paper at ICLR 2026
Shuffile
Alteration
Gamasian
Cell deletion
deletion
Column deletion
IPRO19FPP
0.75
0.75
0.60
0.50
0.5
0.50
0.00
0.50
0.26
0.25
0.25
0.25
0.25
0.26
0.00
010 0.2 0.4 0.6 088 1.0
0.0 0.2 0.4 (le 0.8 10
(6 0.4 0.5 oz 1.0
0.0 (2 0.4 out 0.8.8 1.0
0.0 0.2 du ou L.
00 0.2 0.4 au 0.8 L. Attack Strength
Attack Strength
Attuck Strength
Strength
Strongth
Strength
MUSE-JV
MUSE-TC
TabWak
TabWak"
Shuffle
Alteration
Gaussian
Cell deletion
Row deletion
Column deletion
1.00
1.00
1.00
1.00
1.00
1.00
TPR419FPR
0.75
0.75
0.35
0.25
0.00
0.00
0.00
0.00
0.00
0.00
00
0.4 0.00000
Attack Strength
Attack Strength
Attack Strength
Attack Strength
A Attakk Strength
Attack Strength
MUSE-JV
MUSE-PC
TabWak
TabWak"
Shuffle
Alteration
Gauseian
Cell deletion
Row deletion
Columa deletion
1.00
1.00
1,00
1:00
1.07
1.00
1PR01REPR (1)
0.70
0.70
0.70
0.75
0.70
0.76
0.25
0.25
0.00
0.00
0.2
04 Attack Strength
Attack Strength
Attuck Strength
Attack Strength
Attuck Strength
Attack Strength
MUSE-JV
MUSE-PC
Tab
TabWak"
Shuffle
Alteration
Gaussian
Cell deletion
Row deletion
Column deletion
TPRE1KFPR (1)
1.00
1.00
1.00
1:00
1.00
1.00
0.75
0.75
075-
0.75
0.75
0.76
0.50
0.00
0000
0.4
0
o's Astack Strength
044 Attack Strength
Attack Strength
Attack Strongth
Astack Strength
Attack Strength
MUSE-JV
MUSE-PC
TabWak
TabWak"
Figure 9: Detection performance of MUSE vs. Tab against different types of tabular data attacks across varying attack intensities. From top bottom: Adult, Beijing, Default and Shoppers.
TabularMark (Zheng et al., 2024). TabularMark embeds watermarks by perturbing specific cells in the data. It first pick selected attribute/column embed the watermark, then it generate pesudorandom partition of fixed range into multiple unit domains, and label them with red and green domains, and finally perturb the selected column with random number from the green domain. In our implementation, number unit domains & = 500, the perturbation range controlled by 25, and configure n. as 10% of the total number of rows.
choose the first numerical column the selected attribute, and set the
During detection, TabularMark leverages the original unwatermarked table to reverse the perturbations and verify whether the restored differences fall within the green domain. However, this approach assumes access to the original unwatermarked table, which often impractical, especially in scenarios where the watermarked table can be modified by adversaries.
18

---

Published as a conference paper at ICLR 2026
Discussions. As demonstrated in Table both WGTD and TabularMark exhibit strong detection performance across all datasets. Furthermore, their generation quality is generally comparable to that of MUSE. However, notable observation is the significant performance degradation measured by the MLE metric for both WGTD and TabularMark on the Be j ji dataset (highlighted in bold). We hypothesize that this performance drop stems from the post-editing process, which may introduce substantial artifacts into the data. These artifacts, in turn, could negatively impact the performance of downstream machine learning tasks.
C.3 VISUALIZATION OF STATISTICAL SIGNAL
Intuitively, our method embeds watermarks by biasing the score distribution towards high score values. In this section, we provide visualizations that directly illustrate the statistical signal introduced by our watermark in both the JV and PC hashing variants.
JV-hashing. For JV hashing, each row-level score is a PRF following Bernulli(0.5). We plot the empirical probability mass function (PMF) of these scores for both watermarked and unwatermarked tables Figure 10. As expected, the unwatermarked data yields an approximately symmetric distribution over {0. 1). while watermarked tables exhibit clear shift of probability mass toward larger score values due to multi-sample selection.
PC-hashing. For PC hashing, the row-level score is the sum of per-column Bernoulli bits, taking values in {0, ...: n where n is the number columns. We visualize the empirical PMF over the normalized score (defined in Equation (3)) in Figure 11. Again, unwatermarked tables show the expected symmetric distribution, while watermarked tables exhibit a rightward shift in mass, reflecting the watermark signal.
1.0
watermak
0.5
0.25
0.0
0.5
1.0
normalized Score
Figure 10: Probability mass function of JV detection score for both watermarked and un- watermarked table. Watermarked table biases the score distribution toward values with larger scores.
Figure 11: Probability mass function of PC detec- tion score for both watermarked and unwatermarked table. Watermarked table biases the score distribu- tion toward values with larger scores.
D FURTHER ANALYSIS OF THE INVERSION-BASED WATERMARKING
We first introduce the overall pipeline of inversion-basee watermarking in Figure 12. The difficulty lies in the inversion of three components, in sequential order: (1) inverse Quantile Transformation (IQT) $D.2, (2) the VAE decoder $D.3, and (3) the DDIM sampling process $D.4. Finally, we analyze the error accumulation and detection performance across the inversion stages in $D.5.
19

---

Published as a conference paper at ICLR 2026
D.1
PIPELINE OF INVERSION-BASEE BASED WATERMARKING
Watermark Generation
Noise vector (Watermarked)
Diffusion Sampling
VAE
Tabular
IQT
Decoder
Data
Compare
Attack
Watermark Detection
Noise vector (Recoverd)
DDIM Inversion
Inverse VAE Decoder
Tabular
Inverse IQT
Data
The watermark signal is embedded in the noise vector in the latent space, a watermarked table is subsequently generated. Bottom: To detect the watermark signal, we need to reverse the entire pipeline. IQT stands for the inverse map of Quantile Transformation.
Figure 12:
Pipeline of Inversion-based Watermarking. Top:
D.2 INVERSION OF (INVERSE) QUANTILE TRANSFORMATION
The Quantile Transformation (Wikipedia contributors, 2025) widely used (Zhang et al., 2024c;a; Shi et al., 2024; Kotelnikov et al., 2023) data preprocessing step in tabular data synthesis. It regularizes the data distribution to a standard normal distribution. The Quantile Transformation can be implemented as follows:
1) Estimate the empirical cumulative distribution function (CDF) of the features.
2) Map to uniform distribution with the estimated CDF.
3) Map to standard normal distribution with inverse transform sampling: Φ (n), where & is the CDF of the standard normal distribution.
Note that in the second step, only the ordering of the data is preserved, and the exact values are preserved, making the map non-injective, therefore, the inverse of the Quantile Transformation is inherently error-prone. Based on the official codebase, TabWak (Zhu et al., 2025) bypasses the inversion of quantile normalization by caching the original data during watermarking, this is infeasible in practical scenarios where the ground truth is unavailable. To study the impact of the inversion error of the Quantile Transformation, we apply the original Quantile Transformation to the sampled tabular data to invert the inverse quantile transformation.
D.3 INVERSION OF VAE DECODER
Denote the VAE decoder as fe. and the VAE decoder output as x = fo(z). To get from x, (Zhu et al., 2025) employs gradient-based optimization to approximate the inverse of the VAE decoder. Specifically, we can parametrize the unknown with trainable parameters, and optimize the following objective with standard gradient descent:
z = arg min |x - fo(z)l13
where z is inilitaized as ((foxx)), and g(-) is VAE encoder. However, there is guarantee that the above optimization will converge to the true z, and we observed that the optimization process is unstable (sometimes produces NaN) for tabular data and introduces significant error in the inversion process.
D.4 DDIM INVERSION
The DDIM diffusion forward process is defined as:
q(x; xx-1) = -xxx /1 - -,x
where Xo is the original data, x, is the data at time I, and 3, is the variance of the noise at step I. Based on the above definition, can write X, as:
X4 V + v1 O46,
(Forward process)
20

---

Published as a conference paper at ICLR 2026
where -o Bi), e~ (N0,I).
Starting from Xy, we sample xT-1 Xo recursively according to the following process:
x = (x+ /1 (x),)))))) /v
(Reverse process)
X V /1 (x
where (x(X,, 8) is noise predicted by a neural network.
The DDIM inversion process is defined as the inverse of the DDIM reverse process. Specifically, starting from Xo, our goal is to recover the original noise vector xy in the latent space. We introduce the basic DDIM inversion process proposed in (Dhariwal and Nichol, 2021), which is widely adopted in inversion-based watermark methods (Wen et al., 2023; Yang et al., 2024; Zhu et al., 2025; Hu et al., 2025).
We can obtain the inverse of the DDIM forward process by replacing the - subscript with (++ in Equation (Reverse process), but x, approximate the unknown X,+22
X++1 x + VI- (x-100(x)
Due to the approximation X Rs X the inversion process generally demands a finer discretization of the time steps. For instance, inversion- based watermarking methods (Wen et al., 2023; Zhu et al., 2025) typically adopt 1000 steps, whereas diffusion models optimized for fast inference (Karras al., 2022; Zhang al., 2024c) often operate with a coarser discretization of T 50 steps.
Advanced Inversion Methods. To address the inexactness of the above inversion process, recent works (Hong et al., 2024; Pan et al., 2023) have proposed more accurate inversion methods based on iterative optimization. However, empirically found that those methods still suffer from inversion error due to already noisy input from the previous steps (VAE decoder and Quantile Transformation).
TPR@ 1%FPR
0.07 0.24
1.00
DDIM
Detectability
VAE Decoder
Inverse Quantile
IQ IQ
DDIM
VAE DDIM
DDIM
Error
0.00
0.25
0.50
0.75
1.00
1.25
1.50
1.75
2.00
Cumulative Error
Figure 13: Error Accumulation and Detection Performance Across Inversion Stages of TabWak. The l error is computed between the estimated and ground truth noise vectors in latent space.
D.5 ERROR ACCUMULATION
In Figure 13, we analyze the error accumulated at each inversion stage and its impact on detection performance using the Adult dataset. Specifically, compute the TPR @ 1 1%FPR over 100 watermarked tables, each with 100 rows. The top bar chart shows detection performance when progressively inverting different parts of the pipeline. From left to right:
When invert the entire pipeline (IQ - VAE - DDIM), the detection performance drops to 0.07 TPR @ |FPR.
When we provide the ground-trun -ruth IQ and only invert the VAE decoder and DDIM, the performance improves to 0.24 TPR @ F%PP.
When both the ground-truth and VAE decoder outputs are provided (i.e., only DDIM is inverted), detection reaches a perfect 1.0 TPR @ 1%FPR
The bottom bar chart reports the L error between the estimated and ground truth noise vectors the latent space. From left right, the bars correspond to:
21

---

Published as a conference paper at ICLR 2026
Inverting only DDIM (given the ground-truth VAE output),
Inverting both the VAE decoder and DDIM (given the ground-truth IQ), and
Inverting the full pipeline (IQ + VAE - DDIM).
This comparison highlights how errors accumulate through the inversion stages and directly affect watermark detectability.
E FURTHER ANALYSIS ON ROBUSTNESS
E. COLUMN PERMUTATION ATTACK
In primary robustness evaluation (Section 5.3), aligned with prior literature (Zhu al., 2025) by not explicitly modeling column permutation attacks. This decision relied on the practical assumption that original column ordering is easily recoverable via column headers statistical properties. However, to evaluate the resilience of our methods under a stricter threat model where column alignment is impossible headers stripped, we analyze the impact of column permutation below. We demonstrate that MUSE-PC is naturally robust to this attack, while MUSE-JV can be adapted achieve permutation robustness with minimal performance trade-offs.
MUSE-PC.
This variant exhibits inherent invariance to column permutation. Since the watermark summation over all feature columns, the calculation is
detection score for row is calculated commutative. Consequently, the spatial arrangement of the columns does not influence the final aggregate score, rendering column permutation attacks ineffective.
MUSE-JV. The standard implementation of MUSE-JV relies on pre-computed per-column statistics (see Equation (4)) determine quantile ranks. A full column permutation disrupts the mapping between columns and their stored statistics. To mitigate this, we can apply simple modification: estimating the min/max values directly from the target synthetic table rather than relying on pre-stored metadata. This adaptation decouples the detector from specific column indices. While estimating statistics from the sample introduces a potential approximation error compared to the injector's ground truth, experiments indicate that this deviation is negligible for detection purposes. To validate this, we conducted an experiment where both injection and detection utilized min/max estimates derived from 10,000 independently generated samples. As shown in Table 5, the proposed adaptation maintains high detectability across all datasets.
Dataset
AUC
T@R R 0.1
Adult
1.000
1.000
Default
0.997
0.809
Shoppers
1.000
1,000
Beijing
1.000
1.000
Table 5: Detection performance under estimated max/min.
E.2 GLOBAL PERTURBATION
In this section, we extend our evaluation datasets consisting exclusively of numerical columns. We analyze the performance of MUSE-PC compared baselines under threat model where all entries are subject to noise, distinct from the subset perturbation model discussed the main text.
The original design of MUSE-PC targets threat model where an adversary perturbs subset of values with arbitrary strength, while other values remain unchanged. In that regime, robustness is achieved by spreading the watermark signal across all columns. However, in a scenario where every entry is perturbed by small noise (c.g., Gaussian noise), directly computing the score on raw continuous features be sensitive to these ubiquitous minor shifts.
Normalization. To address this, we introduce a lightweight normalization step prior to computing the score. We apply transformation f such that f(x ~ f(x + 2) when is small perturbation. This ensures the downstream score remains stable even if all entries receive noise.
Specifically, we instantiate as quantization in the log domain. The process is follows:
22

---

Published as a conference paper at ICLR 2026
Table 6: Watermark generation quality and detectability on fully numerical datasets, indicates best performance, indicates second-best performance. For clarity, only our method is highlighted in detection.
Watermark Generation Quality
Watermark Detectability
Dataset
Method
Marg.t
Corr:t
C2ST
MLE
AUCT
T@1 Ft
D0-wm
0.992
0,992
0.995
0.994
TabWak
0.905
0.937
0.783
0.787
0.871
0.39
California
Tab
0.891
0,930
0.753
0.934
0.976
0.53
MUSE-PC
0.933
0.964
0.851
0.994
1.000
1.00
no-wm
0.975
0.980
0.980
0.992
TabWak 0.928
0,938
0.685
0.926
0.999
0,90
Letter
Fak 0.922
0.930
0.607
0.919
1.000
1.00
MUSE-PC
0.928
0.964
0.740
0.990
1.000
1.00
1) Map each numerical value to its logarithmic scale.
2) Assign the value one of a fixed number of bins (denoted bin_num)
This logarithmic transformation makes the bin widths adaptive: larger magnitude values ((x))) are assigned wider bins. This aligns with the intuition that larger values can tolerate larger absolute per- turbations without altering their semantic meaning or watermark bin assignment. This preprocessing does not alter the fundamental sampling scoring procedure of MUSE-PC.
Robustness to Global Perturbation. We evaluate the robustness of MUSE-PC augmented with a quantisation step prior to score computation under global perturbations, instantiated as Gaussian noise applied to every entry in fully numerical datasets. We set the number of bins to 32, N = 500, m 2, and compare the detectability of MUSE-PC against TabWak and TabWak*. As shown in Figure 14, MUSE-PC consistently outperforms both baselines across all attack strengths on both datasets. It is worth noting that although Tab Wak/TabWak demonstrates relatively strong robustness on the Let ter dataset, its performance deteriorates substantially on Cali lolnfo..a.. We hypothesize that this variability stems from the inherent instability of reversing the entire sampling pipeline, which TabWak relies on for detection.
Distortion and Detectability Performance. While the normalization step renders MUSE-PC robust to global perturbations, evaluating its potential impact on distortion remains critical. With the number of bins fixed 32, results Table demonstrate that MUSE-PC consistently outperforms TabWak and Tab in terms of both distortion and detectability.
Ablation Study on Number of Bins. this section, we examine the impact of the bin count, b E [16, 32, 64, 128, 256), on the data quality and robustness of MUSE-PC. As shown in Figure 15, Figure 16, and Figure 17, the number of bins introduces a fundamental trade-off: coarser binning enhances robustness at the cost of slightly increased distortion, while finer binning favors fidelity but reduces robustness. Notably, choosing 32 sufficient to surpass the robustness of Tab Wak. Furthermore, even under coarse quantization (b 16), MUSE-PC preserves higher data quality than TabWak.
E.3 WATERMARK STEALING
In this section, we consider the watermark stealing problem, where an adversary attempts reverse engineer the watermark. We adopt the standard setting under Kerckhoffss' principle: the adversary has full knowledge of the watermarking algorithm, but does not know the secret key.
Two levels of reverse-engineeringg. It is useful to distinguish between two goals an attacker may pursue:
Spoofing attack (easier). The adversary trains generative model to approximate the water- marked data distribution Pwm. with the goal of generating new samples that pass the detector, without necessarily recovering the secret key.
Parameter-recoveryy attack (harder). The adversary attempts to deduce the secret parameters of the scheme- sppeificcllc.ic............. the secret key k and/or the exact configuration of the quantile-
23

---

Published as a conference paper at ICLR 2026
California
Letter
1.00
1.00
TPR@1 %FPR (1)
0.75
0.75
Shate Quaille
2.14
0.50
0.25
0.25
0.00
0.00
0.0
0.2
0.4
830
Attack Strength
Attack Strength
Namber Blr
MUSE-PC
TabWak
TabWak
Figure 15: Impact of bin number on data quality. Finer discretiza- tion leads to better data quality.
Figure 14:
Detection performance under Gaussian perturba- attack intensities. MUSE-PC (with number of bin=32) achieves the best robustness.
tion attack across varying
To%
0.8
T8%
0.
Bin Stumber
22 Bin Rumber
Attack Strength
Lie
Attack Strungth
256
3.0
Figure 16: Impact of bin number robustness Gaussian perturbation: California dataset. Gaussian perturbation: Letter dataset.
Figure 17: Impact of bin number robustness
rank mapping (e.g., which columns and quantile levels are selected and hashed). A successful parameter-recovery attack constitutes total break: once the mechanism (known under Kerck- hoffs' principle) and the key are both recovered, the adversary can scrub or spoof the watermark will.
Parameter recovery is strictly harder than spoofing: if an attacker could recover the key and quantile configuration, they could trivially simulate the watermarking process and thus succeed at spoofing. The converse does not hold: in general, solving the cryptographic task key recovery. This mirrors observations in prior watermarking work, where key-recovery attacks are typically bespoke and non-trivial to construct (Jovanovié al., 2024).
can statistically approximate distribution without
Quantile ranks as hard parameter-recovery target. For the sake of simplicity, our JV hashing fixed quantile set (e.g., - {0, 0.5, 1} corresponding
scheme presented in the main minimum, median, and maximum) to select a sparse subset of columns for watermark embedding. Under Kerckhoffs' principle, an attacker would know the fixed quantile set and thus be able to compute which columns are used for watermarking for each sample. We provide a simple security enhancement: applying keyed pseudorandom permutation (PRP) Ty over the column indices before column selection. Specifically, for each row we first apply the permutation x + IT& (x), and then compute the quantile ranks and select the aiminumm/median/maane order. Under this construction, the set of titeermark-carryiin columns is entirely determined by the secret key k, and recovering it is computationally equivalent to inverting the underlying PRP. In other words, reverse-engee errerseengineriigg the quantile-rank configuration becomes full-fledged parameter- recovery attack on a cryptographic primitive, which is significantly harder than merely mimicking the watermark's statistical footprint.
positions in this permuted
24

---

Published as a conference paper at ICLR 2026
Empirical Evidence. Our analysis is supported empirically by the Adaptive Adversary experiments presented in Section 5.3. We simulated a distillation attack reee--repreeeengeeeeeeee the easier "Spoofing" threat-where a powerful generative model (TabSyn) attempted to learn the watermarked distribution. As shown in Figure 4, the adversary failed to distinguish or approximate the watermark signal (achieving AUC 0.5). Since the adversary failed at the easier task of statistical approximation (Spoofing), we conclude that they statistically cannot succeed at the strictly harder task of Parameter Recovery.
F EXPERIMENTAL DETAILS
F.1 HARDWARE SPECIFICATION
We use a single hardware for all experiments. The hardware specifications are as follows:
GPU: NVIDIA RTX 4090
CPU: Intel 14900K
F.2 DATASET STATISTICS
The dataset used in this paper could be automatically downloaded using the script in the provided code. We use tabular datasets from UCT Machine Learning Repository' or Kaggle": Adult', Default Shoppers', Beijing', California", and Letter', which contain different numbers of numerical and categorical features. The statistics of the datasets are presented Table
Table 7: Dataset statistics.
Dataset
# Rows
Continuous
Discrete
Target
Train
Test
Task
Adult
32, 561
22, 792
16, 281
Classification
Default
30, 000
14
10
1
27,000 000
3, 3,000
Classification
Shoppers
12, 330
10
1
11, 098
1,232
Classification
Beijing
43, 824
39, 441
4, 4,383
Regression
California
20, 640
1
18, 390
2, 220
Classification
Letter
20, 000
16
1
18, 000
2, 2,00
Classification
In Table 7, # Rows refers to the total records in each dataset, while # Continuous and # Discrete denote the count of numerical and categorical features, respectively. The # Target column indicates whether the prediction task involves a continuous (regression) or discrete (classification) target variable. All datasets except Adult are partitioned into training and testing sets using a 9:1 ratio, with splits generated using fixed random seed for reproducibility. The Adult dataset uses its predefined official testing set. For evaluating Machine Learning Efficiency (MLE), the training data is further subdivided into training and validation subsets with 8:1 ratio, ensuring consistent evaluation protocols across experiments.
F.3 FIDELITY METRICS
The fidelity metries used in this paper (Marginal, Correlation, C2ST and MLE) are standard metrics in the field of tabualr data synthesis. Here is reference;
Marginal: Appendix E.3.1 in (Zhang et al., 2024c).
hhttps:/www.kkgghtt com
intention+datasser
25

---

Published as a conference paper at ICLR 2026
Correlation: Appendix E.3.2 in (Zhang et al., 2024c).
C2ST: Appendix F:3 in (Zhang et al., 2024c).
MLE: Appendix E,4 (Zhang et al., 2024c).
Below a summary of how these metrics work.
F.3.1 MARGINAL DISTRIBUTION
The Marginal metric assesses how well the marginal distribution of each column is preserved in the symthetic data. For continuous columns, we use the Kolmogorov-Smirnov Test (KST); for categorical columns, we use the Total Variation Distance (TVD).
Kolmogorov-Smirnov Test (KST) Given two continuous distributions pr(x) and (x(xx) (real and synthetic, respectively), the KST measures the maximum discrepancy between their cumulative distribution functions (CDFs):
KST = sup (F,)) - Fx(x)),
(8)
where (x) and (1) denote the CDFs of pr (2) and (x)):
F(x) = p(z) dr.
(9)
Total Variation Distance (TVD) TVD measures the difference between the categorical distributions of real and synthetic data. Let Ω be the set of possible categories column. Then:
TVD
Σ R(w) -(w)) S(w))
(10)
wEN
where R(-) and S(-) denote the empirical probabilities in real and synthetic data, respectively.
F.3.2 CORRELATION
The Correlation metric evaluates whether pairwise relationships between columns are preserved.
Pearson Correlation Coefficient For two continuous columns z and y, the Pearson correlation
coefficient is defined as:
Cov(x,
Pz.y
(11)
where Cov(-) is the covariance and a denotes standard deviation. We evaluate the preservation of correlation by computing the mean absolute difference between correlations in real and synthetic data:
Pearson Score 2 E. (
p²(xz) v)
(12)
where n and 1s denote correlations in real and synthetic data. The score scaled by ensure lies in [0, 1]. Lower values indicate better alignment.
Contingency Similarity For categorical columns A and B, compute the Total Variation Distance between their contingency tables:
Contingency Score Σ
Σ
Ra, - Sa,9
(13)
A BEB
where Ra,g and Sa,9 are the joint frequencies of (a, .9) in the real and synthetic data, respectively.
26

---

Published as a conference paper at ICLR 2026
F.3.3 CLASSIFIER TWO-SAMPLE TEST (C2ST)
C2ST evaluates how distinguishable the synthetic data from real data. If classifier can eas- ily separate the two, the synthetic data poorly approximates the real distribution. We adopt the implementation provided by the SDMetrics library."
F.3.4 MACHINE LEARNING EFFICIENCY (MLE)
MLE evaluates the utility of synthetic data for downstream machine learning tasks. Each dataset split into training and testing subsets using real data. Generative models are trained on the real training set, and synthetic dataset of equal size is sampled.
For both real and synthetic data, use the following protocol:
Split the training set into train/validation with an 8:1 ratio.
Train a classificr/regressor on the train split.
Tune hyperparameters based on validation performance.
Retrain the model on the full training set using the optimal hyperparameters.
Evaluate on the real test set.
This process is repeated over 20 random train/validation splits. Final scores (AUC for classification task or RMSE for regression task) are averaged over the trials for both real and synthetic training data. In our experiments, report the MLE Gap, which is the difference between the MLE score of the (unwatermarked) real data and the MLE score of the synthetic data.
F.4 WATERMARK DETECTION METRICS
For watermark detection metrics, we primarily use the area under the curve (AUC) of the receiver operating characteristic (ROC) curve: AUC, and the True Positive Rate (TPR) at given False Positive Rate (FPR): TPR@x%FPR.
z-statistic In addition, we can formalize statistical test for watermark detection. We formulate this as a hypothesis testing problem:
Ho The table watermarked.
vs. H1 The table watermarked.
Recall the definition of our detection statistic in Equation (1): given (watermarked or unwater- marked) table T that consists of N rows: T == (Xi,..., XN), we compute the detection statistic:
S(T) N 5k (x;)
For the Joint- Vector (JV) hashing design, where each row is assigned a single score, the form of the test statistic depends on the score's distribution under the null hypothesis Hg. If the row score follows Burnulli(0.5), we denote the total count of rows with score of 1 as [W] Under Ho- [W| follows a binomial distribution with mean μ N/2 and variance x² N/4. Finally, since
W = > 1= (x;) = N S(T), thus the z-statistic is computed as:
S(T) N/2
(JV hash)
NN/4
For the Per-Column (PC) design, this framework must be adapted, the score for each row, 8i. the average of scores from M individual columns (see Equation (3)): 81 sx() 1/ Σド= Cij.
https: : /ccc/. sdv. http//mmerrcccoo /wt.r/eriiire ieserics//e cos/ettriccsee http://trrrcii-nbttaaa
detect on- single-table
27

---

Published as a conference paper at ICLR 2026
where Cij is the score assigned to the value at i-th row, j-th column. If Ctj i.i.d and follows Bernulli(0.5), we have that Σi=1 8x(x;) follows binomial distribution with mean μ M-N and variance x² N-M yielding a statistic as follows:
N S(T) N-M
2
(JV hash)
N-M
Estimating the statistic under Ho via Monte Carlo. While directly assuming certain distributions under null hypotheses like above standard in L.M watermarking (Kirchenbauer et al., 2023b; Zhao al., 2023a; Giboulot and Furon, 2024), they can be inaccurate when the table contains low-entropy columns (e.g., binary attributes). In such cases, the exact distribution of row-level hash outputs under Hg may deviate from the idealized Bernoulli model.
One way to address this problem is to estimate the mean and variance the detection statistic under Hu using Monte Carlo simulation, which is also used in TabWak (Zhu et al., 2025).
Specifically, we first sample K unwatermarked tables with rows, denoted as Tau T Denote 9; as N S(Thw) then compute:
me
Anw: the empirical mean of sk]
Trw: the empirical standard derivation of {81,..., 8K}.
Then the one-sided z-statistic can be computed as:
2 N S(T) inw
Onw
where s is the test statistic computed on the suspect table. Unlike TabWak (Zhu al., 2025), no additional 1/ I/vN scaling is required because d,w is estimated directly from the full statistic N- STT).. whose variance already incorporates the dependence on N.
Detection threshold. Given the estimated (or assumed) null distribution of our detection statistic, we next define a threshold for deciding whether table is watermarked. Let and do denote the mean and standard deviation of the statistic under Ho. obtained either analytically (e.g., assuming Bernoulli or binomial model) or empirically via Monte Carlo simulation as described above. For suspect table T, the corresponding z-score
T(S( - 140
(14)
do
To control the false- calse-positvve rate at user-specified significance level we compute the critical value 2a such that
Pr(Z > 2n Ho) = -~ 7~,11
(15)
and declare the table as watermarked whenever z > Za. Equivalently, this induces threshold on the normalized statistic S(T):
40 +
S(T)
2a
(16)
N
N
When the theoretical Bernoull((0.5) assumption holds (e.g., JV-hash), we have Ho = N/2 and oo /N/4, which recovers the familiar closed-form thresholds used in prior work. When Monte Carlo estimation is used instead, the same decision rule applies but with empirical estimates (Prws &nw). enabling the threshold to automatically adapt to low-entropy or skewed tabular datasets.
F.5 IMPLEMENTATION DETAILS OF IMAGE WATERMARK BASELINES
In this work, we also benchmark our method against established watermarking techniques originally designed for visual generative models: Rine-Ring Watermark (Wen et al., 2023) and Gaussian Shading (Yang et al., 2024). To apply these image-based methods to the tabular domain, we strictly follow the adaptation strategies proposed in TabWak (Zhu et al., 2025). We include brief description of these strategies below for completeness; for full algorithmic details, we refer readers to Appendix D of Wak.
28

---

Published as a conference paper at ICLR 2026
Tree-Ring Watermark. This method embeds the watermark into the initial noise vector of the diffusion process by transforming it into the frequency domain. Importantly, this method treats the full table (m rows and columns) single latent image for the watermark. While standard image models typically process square inputs, where standard centralized ring patterns are embedded in the latent. Tabular datasets are characterized by a high aspect ratio, where the number of rows (m) significantly exceeds the number of columns (71). To address this geometric discrepancy, we embed tppll-shaped pattern across the Fourier space, However, it worth noting that treating the full table as single unit makes this method inherently vulnerable to row shuffling attacks: simply permuting the rows destroys the global spatial pattern, thereby severely compromising detectability.
Gaussian Shading. Unlike the Tree-Ring watermark, Gaussian Shading is applied at the individual row level. This approach treats each tabular row as distinet entity, similar to how watermarking is applied to individual images. Crucially, we maintain a fixed control seed across the entire dataset. If we were to assign unique seed to each row index, a simple row shuffling attack would decouple the data from its corresponding seed, making verification impossible. By enforcing constant seed, ensure that the watermark remains detectable even if the rows are arbitrarily permuted.
Discussion. The key distinction between watermarking techniques for tabular data and those for images lies in the application setting. Tabular watermarking typically operates on an entire table-s a batch of i..d. samples samples-where each contributes to the aggregate 2-score and collectively boosts detectability. In contrast, image watermarking generally requires detecting a watermark from a single generated instance. For example, shown in Theorem 4.1, achieving target detectability of FPR = 0.01 % under MUSE requires batch size of N = 100 and m = 4 repeated samples per instance. Applied images, this would require roughly 400 forward passes of image generator to watermark a batch of 100 images, making the method impractical for standard single-image watermarking scenarios. That said, specialized applications where images are naturally generated and verified in batches, MUSE could still offer a viable and effective watermarking strategy.
G OMMITED PROOFS IN SECTION 3
Recall that for a table T (wateramarked or unwatermarked) with N rows: x XN, we define the watermark detection score as
N N (x,)..
S(T)
(17)
where sy (xx) is the score of the ë-th sample, ls is the fixed watermark key.
Theorem 4.1 (Watermark Calibration Guarantees). Denote a watermarked table as T Twm and an unwatermarked table as Tno-wm. each consisting of rows. Let x ~ p(x) be a random vari- able drawn from the data distribution, and let X1....,Xm be i.i.d. samples from p(x). De- fine Puo-wm = Exxppxx) [xx) as the expected score of an unwatermarked sample, and define Wmm = Exx-p(x) [maxse[m]] 8n (x:)) as the expected score of a watermarked sample obtained via m repeated samples. Suppose the scoring function satisfies st(()) E [0, 1}. we have:
The False Positive Rate (FPR) of the watermark detection is upper bounded:
Pr (S(Tno-wm) > S(Twm)) I exp (- N
(-N- (m (ao-wm)
2
(5)
2
2. The RHS of the bound is minimized when sx(x)) a (ernoulli(0.5) distribution.
3. Under this optimal distribution, let N 8log(L/a), then to ensure the FPR does not exceed target threshold a, it suffices to set the number of repeated samples m as:
m max 2, logo.s
/ 2log(1/m)
0.5 -
(6)
N
Proof. The proof of each statement is provided in Lemma G.I, Lemma G.2, and Theorem G.3, respectively.
29

---

Published as a conference paper at ICLR 2026
Lemma G.1. Denote watermarked table Twm and unwatermarked table as Tno-wm- each consisting of N rows. Let x ~ p(x) be a random variable drawn from the data distribution, and let ......... X.m.
..m be ii.d. samples from p(x). Define Mno-wn wm [x=p(x)) (xxxx)))(xxx))))))))))))))))(( the expected score of an unwatermarked sample, and define p Exxc-p(x) [m]] 8 sx(x:)) the expected score of watermarked sample obtained via m repeated samples. Suppose the scoring function satisfies sx(+) E [0, 11, then the False Positive Rate (FPR) of the watermark detection satisfies:
Pr (S((no-wml) S(Twm)) exp (- Nuu
Muo- win )2
(18)
Proof. Let (T Ei= c2 denote the sum of N i.i.d. scores from the unwatermarked table, where each C; = sx(x;) for x; ~ p(x), and similarly let S(Twm) = > of denote the sum of N i..dd scores from the watermarked table, where each c/ max {Sk (sI(X.),......... (2 (Xim) with
Xij ~ p(x).
Define the expected values:
Pno-wm E[c,]; Pwm E(c]]-
We are interested in bounding the false positive rate:
Pr(S(Tno nm) S(Twm)) Pr Σ (c - c)) -))=))
Let W. = c/. Since 8n (x) E [0, 1I. we have [0. 1] and cj E [0, 1]. E [-11,1] Moreover,
[[w;] = Mno-wm 1m =: ō. where 6 pm - Mno-wm
E
We apply Hoeffding's inequality to the sum of w;'s:
N
N wil
2N
Pr
wi
> = Pr
Σ W; E
I exp N8
4N
1=1
Plug in the definition of 6, we have:
2282
N Np
Pno-wm )2
(TTooT)) S(Twm)) exp
exp
2
2
which proves the result.
Lemma G.2 (Optimal Scoring Distribution). Let sx(x) be any random variable supported [0. 1]
with mean 0.5, the right-hand-side of Equation (18) is minimized when sx(x) follows Bernoulli distribution.
Proof. Let $1...., sm be i.i.d. copies of a random variable s (x) [x) = 0.5. Define:
E [0, 1] with fixed mean
p E (x)) 0.5, Umax := E[max(s1, ...., sm
Let A := Mmax aa be the gap between the expected maximum score over m repetitions and the mean score. The upper bound in Equation (18) is:
NA² 2
Pr(Sno.wm > Swm) S exp
2
minimizing the FPR corresponds to maximizing A under the constraint that E[s (x)) 0.5 and 8k (x) E 1].
We now show that A is maximized when $ (x) Bernolli(0.5).
30

---

Published as a conference paper at ICLR 2026
Step 1: Write Maax and j integrals over the CDE. Let F be the cumulative distribution
function (CDF) of (x)... Then the CDF of max($1...... 8m) ) is (x)). By the tail integration formula, we can compute the expected maximum
Pmax L// Pr(max(s1, ...
18)) Pr(max())......mm)
x)
1 (1 --((x)))
Similarly, we have: μ So (1- F(x)) dr.
Therefore, the gap A can be written as:
Pmax p [ [F(x) [())")]da
Step 2: Leverage the concavity. By Lemma H.1, the integrand F(x) (m is concave in F(x). By Lemma H.2, the integral is maximized when F(x)) is the CDF of a Bernoulli distribution with mean μ 0.5.
Therefore, among all s (x) E [o, 1] with E[s (x)) = 0.5, the Bernoulli(0.5) distribution maximizes A, which minimizes the upper bound the FPR. Hence, the lemma holds.
Theorem G.3 (Minimum Watermarking Signal). Under the same assumptions in Lemma G. suppose the scoring function (x(x) is instantiated as a hash-seeded pseudorandom function such that sy (x) Bernoulli(O.5). Then the FPR upper-bounded by:
N
Pr (S(Tno-wm) S(Twm)) S exp
(0.5 (0.5-0.5h)
(19)
To ensure the FPR does not exceed a target threshold a, it suffices to set the number of repeated samples m as:
max 2, Iogos
/ 225-222oog11 2log(1/a) (2log/
)):
(20)
where [.] denotes the ceiling function. This expression is valid when N > 8 8log(1/a).
Proof.
When 88 (x) ~ (0.5). we have:
Pno-wm [[(x(x(]] = 0.5, a Efmmax(s,...... 8m)] 0.5
Plug into the FPR bound Equation (22), we have:
N ( (0.5 (0.5- (0.5-0.5m)3
Pr (S((no-wm)) S(Tw)) S exp
which completes the proof.
Theorem 4.3. Let m = 2. The watermarking process in Algorithm 1, augmented with repeated
column masking, satisfies multi-sample distribution-preseevvin defined in Definition 4.2.
Proof. Suppose NI. K are generated consecutively from Algorithm I with the same watermark
key k and data distribution pxx). Assume the repeated column masking is enabled. Denote W S
(1..., K) denote the index set where the repeated column masking is triggered. Then we have:
K
P
xx)
II
P(;;
x23)
i=1
IP(2;
PiX: xxc)
sEW
fgW
31

---

Published as a conference paper at ICLR 2026
Due to the deployment of repeated column masking, when repeated column values are detected, Algorithm defaults to skipping the watermarking process. Therefore, for O, we have:
II P(x xxt) NEW
II p(x,) JE
For ④ there will be repeated column values used for seed generation. Note the dependency between current sample x; and previous samples x2j are only on the watermark key k and selected column values T(x) (recall compute hash function lik,, (x)) seed score function). There- fore, when the selected columns contain no repeated values, due to the property of the hash function, we have X; independent of Xzs. Therefore, have:
II P( Rct) II P( ((K, k@W
= II p(x.)
(by Lemma H.3)
kgW
Finally, we combine the above results, have:
K
P
xx)
Il 1=1
p(x,)
which completes the proof.
H TECHNICAL LEMMAS
Lemma H.1. For any integer m 2 2, the function f(x) x= is concave on the interval [0, 1].
Proof. To prove that f(x) = x xm is concave on [0, 1], we show that its second derivative is non-positive this interval.
Compute the first derivative:
(()x) (rr
- (x-
--- =1 mm m-
dr
Compute the second derivative:
d
f"(x)
(1 m- -m((m 1)x dx
Observe that for all x E [0, 1] and m 2 2: m(m - 1) > 0 and m22 0.
Therefore,
("(x) =mm(m 1) m- < for all [0,
Hence, f(x) is concave on [0,
Lemma H.2. Let Φ: [0, + IR be concave function, and let F the cumulative distribution
function (CDF) of random variable supported [0, 1] with fixed mean μ (0, 1). Then the integral
f o ((F()))
0
if < 0
is maximized when F(z)
i0 <
< 1, i.e. the CDF of Bernoulli distribution with
if 1
mean μ.
32

---

Published as a conference paper at ICLR 2026
Proof. Step 1: Rewrite the Mean Constraint
By the tail integration formula, the mean constraint for the random variable X with CDF F(x) supported on [0, 1] is:
(()-(())dd F(x)) = n.
Rearranging this equation gives the integral of F(x):
L F(x() dr 1
(21)
Step 2: Upper Bound the Integral
The function [0. 1] + concave. The CDF F(x) takes values in [0, 1] for E [0, 1], so (x)())) is well-defined. We can apply Jensen's inequality for integrals, which for concave function á and an integrable function g(x) on an interval (a, b] states:
1
/ o((())) do s
1 (aaa g(x) slx)da)
Plug a =0, (..(()) = F()). Jensen's inequality then becomes:
L. (F(()) do S ((a))do)
Substituting Equation (21) into the right hand side, we have:
Jo (FF())) de 6(1 - 1))
(22)
Step Verify F(x) achieves the upper bound
It is straightforward to verify that F(x)) satisfies the mean constraint. Next, we will show that F(x) achieves the upper bound Φ01 - p)) For æ E [0, 1), F(x) = 11 μ.. Therefore, we have:
Jf (((()) ( 6(1 10-1-0 1) dr = o( p)).
We have shown that F(x) satisfies the mean constraint and achieves the upper bound Φ(1 14), which completes the proof.
The following proof adapts the single-token distortion free analysis from (Dathathri et al., 2024) to our single-sample setting. The core ideas and structure the proof remain the same, with modifications primarily to the notation.
Lemma H.3 (Single Sample Distortion-free), Assume m = 2. for any data distribution p()). it holds that, under the randomness of the watermark key the watermarked data distribution is the same as the original data distribution:
P Peo-Unit(C) (T(, x) -x())
(23)
Proof. By definition of the watermarking mechanism with m 2, for any sample x can write
PA-UDi (T(p, k)) x)
(n-if((())
p(x)
Σ
p(x) +2
Σ
p(x)
(x)
(xX
Eni
p(x)
Σ p(x)
1 100()))=((())
+ 21 ox (x))
XEE
33

---

Published as a conference paper at ICLR 2026
where (x) is the score function sample x with key k.
Next observe that for any fixed x, under Unif(K) we have:
Uni(ki((
[1)6(0)))))=)1())) + 21 (x)<((())) (nit()) (xx + Uni(k))( (x)00)))))) + Unitk)) (1x0)))))(())
Uni(())))) [1]
Substituting back, we obtain
U (T k) x) p(x) p(x).
Thus, the watermarked distribution coincides with the original distribution, proving the claim.
34


Reviews:
[{"review_id": "JqQVqBDWI0", "reviewer": "Reviewer_yLPz", "summary": "The paper proposes MUSE, a model-agnostic watermarking framework for tabular generative models that eliminates the need for fragile DDIM inversion used in prior methods such as TabWak[1]. MUSE performs multi-sample selection. It samples multiple candidates ad selects the one with the highest key-dependent watermark score. Two watermarking scoring functions are introduced, one is JV Hashing, which hashes for low-distortion fidelity, the other is PC hashing, used for strong robustness. Theoretical analysis provides calibration of the false positive rate and provable distribution preservation.\n\n\n[1] Zhu, C., Tang, J., Galjaard, J. M., Chen, P. Y., Birke, R., Bos, C., & Chen, L. Y. (2025, January). TabWak: A Watermark for Tabular Diffusion Models. In ICLR.", "questions": "1. The field of tabular data watermarking is relatively new. Some baselines (Tree-Ring, Gaussian Shading) are from image watermarking. Could the author explain how these two methods are used in the tabular diffusion model?\n2. The detector relies on a simple mean-score threshold; it’s unclear how well this scales to more complex scenarios (e.g., mixed distributions, partial key leakage, or federated settings).", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "1. The approach departs from the inversion-based paradigm dominant in diffusion watermarking, meaning MUSE is compatible with any generative model that supports repeated sampling, including diffusion, autoregressive, and masked models.\n2. Theoretical analysis on the detectability and distribution-preservation is provided. Though I didn't take a thorough look to the proof.", "weaknesses": "1. The choice of pseudorandom function $f$ and hash function $H$ is abstracted away but critical to real-world detectability and security. The paper doesn't provide implementation sensitivity analyses, e.g., whether certain hash or key spaces degrade performance.\n2. No ablation on hyperparameters $m$ beyond theory. While theorem 4.1 gives calibration, the experiments mostly fix $m=2$. There is no systematic analysis of how varying $m$ or $N$ affects trade-offs between computation, detectability, and fidelity.\n3. The paper demonstrates quantitative performance but provides little visualization of what kind of statistical signal the watermark introduces in the tabular domain.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "30scPGyMuj", "reviewer": "Reviewer_UNgJ", "summary": "The paper introduces a novel approach to watermarking synthetic tabular data agnostic to the underlying generative model while maintaining high fidelity and robustness to attacks. Experiments are shown on a wide variety of datasets and generators to showcase the efficacy of the approach.", "questions": "(1) If the dataset is complete categorical and say binary, would it pose a problem to the approach? More generally, can this be applied to video or image watermarking and what differs?\n(2) The quantile rank is proposed but is deterministic which may make it vulnerable to attackers. Would selection by randomizing according to the rank help?\n(3) How does the approach  work with respect to permutation attacks where the column order is completely randomized?", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "(a) The watermarking approach is agnostic to the generative model and simply uses multiple samples and picks the highest scoring one, with the scoring function appropriately chosen. \n(b) Theoretical results are shown for detectability for a certain false positive rate of the watermarking approach and shown to be between 2 and 4 for a couple hundred samples@0.01. \n(c) Watermarking both at a single (few) column-level and full set of columns are provided trading off robustness versus distortion trade-off. \n(d) The computation time of generation and detection is better than the previous state-of-the-art approaches.", "weaknesses": "(i) The quantile rank is proposed as a method to thwart adversaries but it is unclear if this can not be reverse engineered by adversaries. \n(ii) Similarly, the question of breaking the current approach for watermarking is not fully addressed in the paper.\n(iii) The complexity of having both categorical and continuous features in the dataset is not discussed in detail.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "HXbsqKjuM4", "reviewer": "Reviewer_6Ns1", "summary": "The paper proposes a tabular watermark method that assigns a pseudorandom score to each row of the table based on the hash of selected column values and a secret key. During watermark insertion, the model repeatedly samples multiple candidate rows to select the one with the highest score. During detection, the average score of a given table is compared against a threshold to determine whether the table contains the watermark.", "questions": "NA", "limitations": "", "rating": 2, "confidence": 5, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "1. The paper is generally well written and easy to follow.\n2. The method 's detectability and fidelity guarantee are supported by mathematical theorems (Theorem 4.1 and Theorem 4.3).\n3. The method is also supported by experiments in real world dataset (Adult, Default, Shoppers and Beijing).", "weaknesses": "1. The idea seems not novel. https://arxiv.org/abs/2410.02099 and https://arxiv.org/pdf/2403.04808 have almost the same idea as your work though they focus on watermarking large language models. \n\n2. The paper does not consider additive noise attacks in its perturbation experiments. However, such attacks are an important robustness benchmark that has been widely considered in many prior works cited by the authors (https://dl.acm.org/doi/10.1145/3658644.3690373; https://openreview.net/forum?id=71pur4y8gs)\n\n3. It is unclear how to determine a predefined threshold for the detection. From Theorem 4.1, we can see the False Positive Rate control depends on the gap between  the expected score of an unwatermarked sample and the expected score of a watermarked sample obtained via repeated samples. However, in practice this gap is usually unknown since the unwatermarked sample is not necessary from the detector. Also, it does not make sense to consider the \"optimal distribution\" in Theorem 4.1 since this is in fact the best case. However in practice the unwatermarked table does not always have such nice property.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)