TimeWak: Temporal Chained-Hashing Watermark for Time Series Data
Authors: Zhi Wen Soi
Chaoyi Zhu
Fouad Abiad
Aditya Shankar
Jeroen M. Galjaard
Huijuan Wang
Lydia Y. Chen
Venue: NeurIPS 2025 spotlight ()
Keywords: Watermarking
Time Series
Diffusion Models
Primary area: applications

Abstract: Synthetic time series generated by diffusion models enable sharing privacy-sensitive datasets, such as patients' functional MRI records. Key criteria for synthetic data include high data utility and traceability to verify the data source. Recent watermarking methods embed in homogeneous latent spaces, but state-of-the-art time series generators operate in data space, making latent-based watermarking incompatible. This creates the challenge of watermarking directly in data space while handling feature heterogeneity and temporal dependencies. We propose TimeWak, the first watermarking algorithm for multivariate time series diffusion models. To handle temporal dependence and spatial heterogeneity, TimeWak embeds a temporal chained-hashing watermark directly within the temporal-feature data space. The other unique feature is the $\epsilon$-exact inversion, which addresses the non-uniform reconstruction error distribution across features from inverting the diffusion process to detect watermarks. We derive the error bound of inverting multivariate time series while preserving robust watermark detectability. We extensively evaluate TimeWak on its impact on synthetic data quality, watermark detectability, and robustness under various post-editing attacks, against five datasets and baselines of different temporal lengths. Our results show that TimeWak achieves improvements of 61.96% in context-FID score, and 8.44% in correlational scores against the strongest state-of-the-art baseline, while remaining consistently detectable.

TimeWak: Temporal Chained-Hashing Watermark for Time Series Data
Zhi Wen Soi!.*
Chaoyi Zhu
Fouad Abiad
Aditya Shankar?
Jeroen M. Galjaard
Huijuan Wang*
Lydia Y. C21
University of Neuchâtel
Delft University of Technology
{zhi yiyu chenneenine.ch
2c.zhu-2, f. faabid, a. shankar, m.m. ma.gaaaaard, h. wang))rudellft.n
Abstract
Synthetic time series generated by diffusion models enable sharing privacy- sensitive datasets, such as patients' functional MRI records. Key criteria for syn- thetic data include high data utility and traceability verify the data source. Recent watermarking methods embed homogeneous latent spaces, but state-of-the-art time series generators operate in data space, making latent-based watermarking in- compatible. This creates the challenge of watermarking directly in data space while handling feature heterogeneity and temporal dependencies. We propose TimeWak, the first watermarking algorithm for multivariate time series diffusion models. To handle temporal dependence and spatial heterogeneity, TimeWak embeds tem- poral chained-har -hashnn watermark directly within the temporal-feate feature data space. The other unique feature is the e-exact inversion, which addresses the non-uniform reconstruction error distribution across features from inverting the diffusion process detect watermarks. We derive the error bound of inverting multivariate time series while preserving robust watermark detectability. We extensively evaluate TimeWak its impact on synthetic data quality, watermark detectability, and robustness under various post-editing attacks, against five datasets and baselines of different temporal lengths. Our results show that TimeWak achieves improvements of 51.96% in context-Fil FID score, and 8.44% in correlational scores against the strongest tfate-of-the-ar baseline, while remaining consistently detectable. Our code is available at https::://// : //ggtttuubb.. com s0///oo222 www.siiiiiiiiic//o wet.iiie/////meaak TimeWak
Introduction
Multivariate time series data drive key applications in healthcare [1)] finance (3), and science 25 However, real-world datasets is often restricted privacy regulations, limited availability, and high acquisition costs. To address these issues, synthetic time series generated by models increasingly adopted as practical alternatives 9 25). Among generative techniques, diffasion models (10) have gained prominence for producing high-quality samples, often outperforming the mainstream Generative Adversarial Networks and Variational Autoencoders 6 [2].
Beyond generation quality, traceability is equally critical, as it ensures verifiability and safeguards against misuse [18 [4 In this context, watermarking has become the de-facto approach for tracking and auditing synthetic data [32 [8]. The challenge lies in striking a delicate balance: embedding imperceptible signals that preserve the quality of generated content while remaining detectable, even
'Equal contribution. t CCorresponding author.
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

under post-pren prosessonss [40] Recent works embed watermarks during generation by adding them into the latent space, offering advantages such as generality and lightweight computation [32 41.
However, latent-space watermarks are not always viable, especially since many state-of-the-ar (SOTA) time series generators operate within the data space [26] I 34]. Additionally, latent generators introduce a trade-off in detectability, as diffusion inversion and the encode-decode cycle are inherently lossy and can degrade the watermarks [21].
While generation-time watermarks have proven effective for images 32 and tables
their applicability time series data remains unexplored. Multivariate time series data possess temporal dependencies and heterogeneous features, like gender versus income. The ensuing challenges are twofold: (i) embedding watermarks directly the data space while preserving inter- and variate temporal dependencies of the generated time series, and (ii) ensuring accurate watermark detection despite the lossy nature of diffusion inversion, whilst handling mixed feature types.
We propose Timewak, the first generation-tins watermark for multivariate time series diffusion models, featuring temporal mhained-hashing with e-exact inversion. TimeWak first embeds cyclic watermark patterns, i.e., the positional seeds of Gaussian noises, along the temporal direction. First, we chained-hash the seeds along the temporal axis, then shuffle the seeds across features to maintain temporal correlations while preserving the unique characteristics of each feature. To ensure reliable watermark detection, we introduce an c-exact inversion strategy that makes practical concession in the otherwise exactly invertible diffusion process: the Bi- Bi-Directional Integration Approximation (BDIA) 33). We further provide theoretical guarantees on the resulting inversion error in Appendix C
We evaluate TimeWak against five SOTA watermarking methods on five datasets under varying tempo- ral lengths. TimeWak achieves the best detectability under six post-editing attack configurations with the minimum data quality degradation. Additionally, results show that Timewak preserves temporal and cross-variate dependencies with high quality with near-exact watermark bit reconstruction. To summarize, we list our contributions as follows:
We propose TimeWak, the first generation-ting watermarking scheme for multivariate time series diffusion models, preserving realistic ppatio-tempore dependencies while remaining detectable.
To preserve temporal characteristics and boost robustness against post-proot post-processing operations, we design a temporal chained- haaiing scheme that embeds watermark seeds along the temporal direction, followed by a shuffle across features.
For robust detectability, we propose c-exact inversion by extending BDIA sampling into data space diffusion generator, and provide a theoretical error bound analysis.
Our extensive evaluation shows that TimeWak achieves up 61.96% % better context-FID scores and 8.44% better correlation scores compared to the strongest SOTA watermarking method.
2
Related work
We summarize related works on watermarking diffusion models according to their generating method (post-processing or generation-time generation), and data modality. To the best of our knowledge, our work is the first generation
watermarking scheme for time series diffusion models.
Watermarking diffusion models. Watermarking has become a critical solution for tracing and authenticating machine-genen generated content. Post- Dost-generation techniques embed watermarks after syn- thesis, often degrading the generated data's quality due to direct modifications 5 (88. Alternatively, recent advancements embed watermarks within the training process. Studies such Stable Signa- ture 7 and FixedWM [8] fine-tune diffusion models to embed and extract watermarks. However, these methods modify model parameters, risking overfitting which hurts generalizability.
Watermarking images. Tree-Ring (TR) 29 embeds the watermark during sampling by modifying the initial noise latent vector in the Fourier space. However, it disrupts the Gaussian noise distribution,
reducing the diversity and quality of generated samples. Gaussian Shading (GS) [3 improves robustness by embedding watermarks directly in the latent space using invertible transformations.
However, GS is tailored towards images and requires reversing synthetic samples into the latent space for detection, which is noisy and error-prone process that limits the detection accuracy.
Watermarking tables. TabWak [41] watermarks tabular data in latent space using seeded self-cloning, shuffling with secret key, and valid-bit mechanism. However, it relies latent models and does

---

Watermurk embrdding
Tumpral
clained
Tine aric shafling
Conneann dstritation
BIXA-DDIM danobing
lesting
RM
x2
X0
Watermark detection
Hish vrtiication
Randors crop stock
Bevess surpping
BOLA-DDIM,
Bit Accuracy
uslulliing
91.67%
Figure 1: Overview of TimeWak. First, we assign random seeds at the beginning of each interval. ! Temporally chained-hashing. A, B, and (pink) show seeds being copied from the previous step and the feature order shuffled. @ Shuffling the seeds for each series. Positional indices are highlighted green @ Constructing an initial Gaussian noise. 4 Generating multivariate time series. 2 Reversing the diffusion process. ( Recovering the watermark seed. T Unshuffling the accuracy between the hash and recovered seed.
seeds opposite way they were shuffled. g
not account for temporal dependencies in a time series. Furthermore, its detectability is limited by the invertibility the diffusion process and the lossy conversion to and from latent representations.
TimeWak
We first highlight the unique challenges of watermarking multivariate time series, motivating the design of TimeWak, shown in Figure Then we introduce TimeWak's ' key novelties: (i) temporal chained-hashing the watermark seeds cyclically along the temporal axis; (ii) shuffling the seeds across features, accounting for feature heterogeneity in the time series; and (iii) an adapted BDIA-DDIM sampling method with theoretically bounded e-exact inversion, enhancing robust detectability. Key notations are summarized Appendix A
3.1 Time series diffusion and observations
Time series diffusion. We define time series sample of F' features (variates) and W timesteps as Xo E RW with x denoting the value of feature f timestep w. Unlike image and tabular diffusion, SOTA time series diffusion models operate on the data space, which have heterogeneous features, e.g., income vs. gender, and temporal dependence (26 34]. These time series generators use Denoising Diffiasion Implicit Models (DDIM) [23] to synthesize time series starting from Gaussian noise, X7, by iteratively denoising over steps, i.c., XT, state x at diffusion step - as follows:
Xo. Specifically, DDIM sets the
X: (x t)
x 0:-1
+ - (é)(()(
ar
where a and o, are dimendependent diffusion coefficients, and éD represents the model's noise estimate. DDIM approximates x, follows:
X ot (xx1)((x.
+ orco(xx, ai X -111-(((-( + t, t).
x, 04
at-1
04-1
(2)
However, this approximation introduces errors, producing inconsistencies between the forward and backward processes. It also introduces the following time series-specific watermarking challenges:
Spatial heterogeneity. Watermarks must be embedded directly within the temporal and feature spaces of the data. Features can be very diverse, e.g., gender income distribution, which increases

---

(a) Feature (Energy)
(b) Temporal (Energy)
(c) Feature (MuloCo)
(d) Temporal (MuloCo)
Figure 2: Average reconstruction error distribution across feature indices and timesteps on Diffusion- TS with DDIM and DDIM inversion. Reconstruction error is the signed absolute difference between reconstructed and original values.
the difficulty of detecting watermarks. Specifically, the key detection step inverts the time series back to Gaussian noise. Unfortunately, this inversion process inexact, yielding reconstruction errors during noise-estimation. Figure shows the impact of heterogeneity on the reconstruction errors for the Energy and MuJoCo datasets. Due to spatial heterogeneity, the reconstruction errors across the features vary significantly more than they do along the temporal axis. Existing tabular watermarks [41] implicitly assume uniform distribution across features and compare watermark seeds across features, which prevents reliable watermark verification in multivariate time series.
Temporal dependence. Time series consist of values that are inherently correlated across timesteps. It is critical to preserve such temporal consistencies when generating time series. Consequently, reconstruction errors are not fully independent across timesteps within each sample, as errors at neighbouring timesteps often exhibit stronger correlations than more distant ones. To ensure robustness, solutions must embed the watermark way that respects these temporal dependencies while remaining detectable. This requires designing watermarking strategies that align with the sequential nature of time series diffusion models, invalidating the applicability of existing watermark approaches that neglect the temporal dependence of time series data.
3.2 TimeWak algorithm
To address the challenges of spatial heterogeneity and temporal dependence, we propose TimeWak, a method that enables per-sample watermark detection while mitigating non-uniform reconstruction erros across features and preserving temporal structure. Through structured propagation mechanism, TimeWak enhances the watermark's 's robustness, even in the presence of inversion errors.
Overview. We begin with high-level overview of TimeWak's watermarking pipeline, which consists of four main stages: watermark embedding, time series generation, inversion, and detection. Each stage involves multiple steps that we describe briefly here and explain in detail in the subsequent sections. Following Figure the complete process works follows:
1. Embedding I: generating watermark seeds (s). We first split multivariate time series into intervals along the time axis, then we randomly sample seeds s (with values (0, 1)) at the start of each interval. ① We temporally chain-hash the seeds in cyclic manner across timesteps until the end of the current interval, by applying a unique permutation key at each timestep. Then, we independently shuffle the seeds for each feature using distinct permutation keys.
Embedding II: generating time series from the watermarked seeds (s + xT Xo). i Sampling from a fcature-wise pscudo-random Gaussian distribution based on all the aforementioned seeds, where the seeds determine the sign of the sampled values (s becomes negative). These noise signals are used as input to BDIA variant of a DDIM diffusion model, which then ( used generate a multivariate time series. An attack, such as a random crop attack, may occur at this stage.
becomes positive, s..
3. Detection I: inversion of the time series (Xo + x,). ). ④ The inverse
process is applied to the time series, inverting to Gaussian noise ÅT. Then ④ we reverse-sample each time series to get the seeds (positive values become 1, negative values become 0); we now have the shuffled seed features.
4. Detection I: watermark detection (XT - &). Given shuffled seeded features, we 2 unshuffle the seeds in the opposite way they were shuffled (using the inverse of the permutation keys of

---

step 2), to obtain the retrieved seed features S. We then @ verify the hash of these retrieved seed features by comparing them with the original temporal chained-har -hssh seeds s, for which we compute the bit accuracy between the hashed and recovered versions of each seed.
3.2.1 Chained-hashing watermark seeds (s + XT X()
Existing watermarking methods assign a watermark seed to each feature dimension with L bits, forming a seed matrix of dimensions W x F, denoted as IR W XF where W and F are the respective total timesteps and total features of the time series 32 the ability to leverage temporal dependencies and may introduce inconsistencies across timesteps. To improve the watermark's temporal coherence, we partition the time series data into = [W/H] non-overlapping intervals, each of length H. At the start of each interval, the watermark seed across all features, s - E FRFF, is sampled from discrete uniform distribution 2 ((0, T. - 1 with [ denoting all indices along a dimension.
However, such approaches lack
Within each interval, the watermark seed evolves over timesteps using temporal Chained-hashipg mechanism. Specifically, for all features, the seed at timestep w is recursively derived from the seed at the previous timestep 1, ensuring temporal consistency. Formally, for k = .,..., 1, we initialize the watermark seed as:
",11l ( H (R, s==
if KH +
otherwise,
where k is a cryptographic key controlling the hashing process, H is a deterministic permutation hash function ensuring temporal consistency, and U/ ((0, L. 1})* f is vector of F i.i.d discrete uniform samples over {0, 1...,...,44 L - 1}. The parameter n = [W/ denotes the total integer count of intervals, while k indexes the intervals, ranging from 0 to n 1. While temporal chaining preserves coherence across timesteps by linking each seed to its past, it may lead to repetitive patterns across intervals. To increase diversity, we further permute the seeds along the temporal axis for each feature:
s H <- (s
where nh a permutation function parameterized by the cryptographic key k. This step preserves inter-feature seed correlations while adding generation diversity.
After obtaining the watermark seed, construct an initial Gaussian noise sample follows. First, we draw a variable from the continuous uniform distribution ~ U(0, 1) and use it to generate the noise variable u. diffusion step T as:
+ s "
w XT
Φ-1
(5)
L
where --1(-) is the percent point function (PPF) of the standard Gaussian distribution Φ(-), and sw.f is the watermark seed for feature f at timestep w. Finally, the final time series sample Xy obtained by denoising the initial noise xy with the learned diffusion model.
3.2.2 e- e-Exact inversion (Xo + xT)
Here, we propose a near-lossless inversion procedure by adopting the Bi-directional Integration Approximation (BDIA) technique (36), novel approach to address inconsistencies in DDIM inver- sion [24). We introduce a practical approximation BDIA by removing the assumption known X1. and derive the bound of the inversion error. BDIA improves upon DDIM by jointly leveraging the forward and backward diffusion updates. Specifically, obtaining each x,-1 1 as a linear combination of (x++1, X2, (x,, t)), where čo represents the noise estimator of the diffusion model:
X; bi+1
X = y (Xt+1 - x:) -
(x t)
-)xx + (aix; bieo t)).
(6)
ac+1
0c+1
where 7 E [0, 1). dr and b, are differentiable functions of L with bounded derivatives. Consequently, the inversion process can be directly calculated without approximation follows:
X1-1
(a:x; + bxeo(xe, t)) + X;
bi+1 EØ (xx: t)):
X
(7)
ar-11
a++1
5

---

By design, the introduced symmetry ensures rive-reversible updates, meaning that if x; and X;-1 are known, x can be computed without enror. However, obtaining an exact inversion requires knowing both and Xp, the latter of which is available only as the model's denoised sample in practice.
To address this limitation, equating it to Xo- This seemingly simple estimation effectively enables practical application of BDIA while maintaining reasonable accuracy. To quantify the estimation error, we establish Theorem 3. which demonstrates that the final error remains bounded in terms of the initial estimation e = XI We refer this property as 'e-exact' inversion. We defer our proof of Theorem 3.1 to Appendix
introduce adaptation to BDIA: directly approximate x1 by
Theorem 3.1. Let {x+)inn be the sequence diffusion states governed by the BDIA-DDIM recur-
rence for given dataset, following Equation ( Given the noise estimator ée follows Assumplion | xxprox
Suppose that instead of the exact terminal state X1, an approximation of X1, termed x used with small perturbation given by:
X1
upprax X2 x1
orig
(8)
Let the propagated error at time t be defined as,
8, ||x ||xperrxx x
(9)
Then, for 2 the error is bounded by,
T-1
at ( t=1
b D.
be+1 De a++1
| = lel II
(10)
ac+1
where As quantifies the sensitivity of the noise estimator at timestep t. Assumption (Lipschitz continuity of the noise estimator). There exists a time-dependent constant A, > O and d > 0 such that, for any diffusion state x; encountered during sampling from a given
dataset and any x; apprex satisfying ||x_ x S 5τ, the noise estimator è9 satisfies the Lipschitz condition:
llēg (x(rrrr 1) éØ (x orig t)ll S 4, x appmx
orig
(11)
3.2.3 Watermark detection (Xo Rx $)
To verify the presence of TimeWak's watermark in a generated time series, we first recover the initial noise used in the generative process via diffusion inversion. Given a time series instance we estimate the initial noise žr through inversion. The watermark seed each timestep and feature then recovered by inverting the Gaussian mapping follows:
gw.f = LL (LL:2(65 2(** )},
(12)
where (p-) the cumulative distribution function (CDF) of standard Gaussian distribution. This operation reconstructs the discrete watermark values embedded during sample generation.
Since the watermarking mechanism applies a feature-wise permutation controlled by cryptographic key, the extracted watermark values are initially shuffled across feature dimensions. We restore the original seed assignments along the timesteps using the inverse permutation:
glll < क. (gb1.))
(13)
Beyond feature-space consistency, the extracted watermark sequence should exhibit structured temporal dependencies. Specifically, the watermark seed at each step must follow predefined hash function, given by: Yu + kH +
gr H(K,, w. sm
(14)
To quantify detection confidence, compute the bit accuracy of the extracted watermark sequence, measuring the proportion of correctly recovered bits:
Acc
Σ
Σ f=1
gg.. sg 5
(15)
F
WEW'

---

where I[-] is an indicator function that evaluates to 1 if the extracted bit matches the ground- truth watermark, and 8 = [w w * kH + 1} represents the valid timesteps for comparison. By combining diffusion inversion, feature unshuffling, and temporal consistency verification, this detection framework ensures robust identification of watermarked time series samples.
To assess the statistical significance, we compute the Z-score to measure how strongly the observed bit accuracy deviates from the expected accuracy under a null hypothesis, detailed in Appendix [D2
4 Evaluation
4.1 Experiments setup
Datasets. We use five time series datasets to evaluate TimeWak's impact on generation quality, watermark detection accuracy, and robustness towards post-editing operations. These are: Stocks [33]
ETTh (39]. MuJoCo (27], Energy 3. and JMRI [22]. Additional dataset details are in Appendix D.1
Metries. Synthetic data quality: Context-FID score | measures the closeness between the real and synthetic time series distributions using the Fréchet distance (8]. Correlational score [15] measures the cross-correlation error between the real and synthetic multivariates. Discriminative score [33] trains a classifier to distinguish between synthetic and real data, with low scores implying they are indistinguishable. Predictive score [33] measures the downstream task performance by training a sequence model on the synthetic data and evaluating on real data. Watermark detectability: Z-score quantifies the difference in mean values between synthetic data with and without the watermark, with larger positive values indicating better detectability. TPR @ X%FPR measures the True Positive Rate (TPR) at a fixed False Positive Rate (FPR) of X% in detecting watermarked time series. We provide additional details on these metrics in Appendix D.2
Baselines. We compare against three sampling- diffusion watermarks: TR 29
GS 32)
and TabWak [4I). We also compare with TabWak an adaptation of TabWak that transposes the representation and watermarks along the temporal axis instead of feature-wise. We also compare against post-generation watermarking method for time series, Heads Tails Watermark (HTW), which embeds a watermark by slightly adjusting the time series values by assigning a 'heads' or 'tails' based on predefined ratio on the proportion of 'heads' values (28). Detailed implementations of these methods are provided in Appendix D.3 Hardware specifications are detailed in Appendix D.4
4.2 Synthetic data quality and watermark detectability
When evaluating synthetic time series quality, Table [ shows that TimeWak consistently delivers top-tier performance across all metrics, outperforming or comparable to other baselines like HTW and TabWak While HTW sometimes surpasses un-watermarked data, possibly due to subtle perturbations introduced during watermarking that unintentionally bring synthetic samples closer to the ground truth, it fails to offer strong detectability, as reflected in its low Z-scores. In contrast, TimeWak and TabWak T offer far more favorable trade-off between quality and detectability. When benchmarked against TabWak T TimeWak shows substantial gains, achieving up to 61. 1.6%% better Context-FIl FID score on MuloCo and 8.44% better correlation score on fMRL. Moreover, low discrimi- native and predictive scores further emphasize that TimeWak's 's watermarking remains imperceptible and does not degrade downstream utility. This is made possible by its temporal chained-hashing mechanism, which precisely embeds the watermark while preserving both temporal structure and inter- variate relationships. Mcanwhile, traditional image- based watermarking methods such as TR and GS perform poorly across all quality metrics. These methods struggle with time series data because they are optimized for spatial domains. Time series, however, are governed by temporal continuity and feature heterogeneity, thus requiring fundamentally different treatment.
TimeWak achieves significant improvements in detection performance. Using c-exact inversion via BDIA-DDIM, it reconstructs high-fidelity noise estimates &y that closely resemble the ground truth XT. This results consistently higher Z-scores across all datasets, outperforming all baselines, except on the fMRI dataset, where Tab Wak slightly edges out. Unlike GS, which maintains moderate detection at the cost of quality, or TR, which fails on both fronts, TimeWak delivers strong detectability without compromising fidelity.
7

---

Table 1: Results of synthetic time series quality and watermark detectability. No watermarking ("W/O") is included. Quality metrics are for 24-length sequences. Best results are in bold, and second-best are underlined.
Quality Metric
scorr f
Dataset
Method
Context-FID
Correlational
Discriminative
Predictive
24-length
64-length
128-length
W/O
0.258+0047
a.025
a.120
0.038
TR
1.069
0.09] #0007
0.209
0.039
0,43+000
0.40zous
0.08=n10
GS
8,802+2.415
0.052
0.403
+001+
86.07=024
148 10
172.23+100
Stocks
HTW
0.279
0.017
0.122::004
0.037
4,45
7.34
10.39
TabWak
0.292#0064
0.017
0.124400004
0.038
-67.22
16. 14
-10,49
Tah
0.314
0,016
0.132..0002
0.037....0
55.39_u0
88.81
299.39
TimeWak
0.277
0.020
0.120::0a9
0.038
182.10
395.34:1.44
550.05
W/O
0,232s6018
0.086::0023
0.093
a.120
TR
+.
0.187=0017
0.283
0. 0.134-00004
7,84
7,73a0.13
6.18=0.16
GS
4.530
0.433
0.390
0.169
101.07
197.41=210
327.474444
ETTh
HTW
0.24340624
0.077:0005
0.103
101330002222
3,43
5.08
6.84
TabWak Wak
0.25 #0827
0.335
0.085
0. 125
-14.95
-6. 16
-20.57=096
TabWak
0.450#6057
0.1 06
0.09640014
0.120::0.0
109.35
162. 41
235. 1::.03::148
TimeWak
0.237
0.212
0. 0.10040014
1222+0002
134.83:095
236.08=1.
340.36:220
W/O
0.06540011
0.419
0.032
0.008
TR
1.512
1.153
0.261 goo.
0.015
1.38
1.49
2.01
GS
i.548
1.327:006i
0.474
0.014:0000
21.13
10.13:052
39.63-0071
MuloCo
HTW
0,261
0.493
0.413
0.0101000
2.89
3.41 20.6
4.20
TabWak
0.545#6.122
0.975
20.04
0.009
31
1.262006
13.00
T
0.234+0652
0.463:0009
0.123 40.01
0.000::6.001
4.85
14.5
3.91
TimeWak
0.089:0017
0.532
0.044:
0.008
85.
16.45
123.36=143
W/O
0.118
0.007
0.253
TR
1.649
3.870
0.455
0.337
17.29
22.58
GS
1.480
3.83 1:0072
0.494
0.330#0004
51.22
68.6 68.67711.2
45.42=1.06
Energy
HTW
0..m9
1.312
0.253
3.06
4. 4.30
5.422.1
TabWak
0.179
2.724
0.162
0,255
3.26::039
3.86
0.57
TahWak 0.21310004
1.740
0.129:
2,0004
40.82:001
46.68.10.6
26.00:1.12
TimeWak
0.121
1.977
0.14 0.142.
231.28
267.53:220
245.37.22
W/O
0.190
1.952#0087
0.132
0.100
TR
2.474a0341
13.312:20241
1.496
0.1 16146000
6.49
8.25
9.94
GS
0.71400051
14.628=aus2
0.499
0. =0100
420.02=1444
321.52=039
701.90 701.90aa72
IMRI
0.180
1.900
2.140
0.100
4.32.a012
6.802m44
9:43.u007
TabWak 0.326#0002
6.825
0.452
0.1 1220000
84.02=104
204.16:us
47.29
Tab
0.350
2
0,208
0. 0.101 +0,000
464.67=
743,33
1031.96:079
TimeWak
0.199
2. 2.006
0.122:
0.100
379.51
526.81
This strength is further shown in Figure 3] which plots TPR P.. %FPR on 64-length sequences as function of the number of samples. Across all settings, TimeWak consistently outperforms GS and Tab achieving significantly higher TPR values. Notably, Timewak reaches a perfect TPR of 1.0 in all cases, requiring only one sample in three settings and two in the remaining one. This high sensitivity makes TimeWak well-suited for real-world use, where only limited samples may be available. Additional results provided in Appendix E.8
12300.1 S0PPR
1. NETRR
C.
Samples
Number Samples
Samples
Samples
of
(a) Stocks
(b) ETTh
(c) MuJoCo
(d) Energy
(e) MMRI
Figure 3: TPR@0.1 N..@0.1%FFD against number of samples across five datasets under 64-length sequences.
4.3
Robustness against post-editing attacks
To evaluate the robustness, we first design a set of post-editing attacks. Offsetting perturbs the time series by adding a constant offset to each feature based on 5% or 30% of its magnitude, and applied uniformly across all timesteps. Random cropping masks out subregion of the time series by fixed proportion (5% or 30%), along the rows and columns, similar the image domain [2]. The min-max
8

---

Table Results of robustness against post-editing attacks. Average Zcorr on 64-length sequences. including un un-attacked scores from Table |
Best results are in bold, and second-bes are underlined.
Offsct 1
Random Crop T
Min-Max Insertion t
Without Attack
Datasel
Method
5%
30%
5%
30%
5%
30%
TR
0.40
0.35
0.17:10.9
$7.09
76.87.1299
0.99
5,43
GS
148.92. 12
152.81=1.35
164.23::1.44
12.
32.80 32.80
136.73108
77.20
HTW
7.34.004
7.34
7.34
-0.81
-0.921003
6.41
2.72.1115
Stocks
TabWak
16.14
25.74:1104
45.02:1140
40.59
19.71
19. 19.11
30.87
TabWak
=8.81
88.8841005
85.87
30.55
1.7120087
65.2552079
15,
TimeWak
395.34.1.24
375.96.0..
371.04.1.0
78.20 12.3
10.40.10s
296.60
83,74
TR
7.73
7.9620.1
8.83-1.012
27.22.a0.
38.5344
21.8622226
49.85
GS
197 19:14
186.62-2a1
159.041220
105.
105.11:2.0
-3..87
182.03.1.9
105.23
ETTh
HTW
5.08
1,08
5.08
0,54
-1.99
4.47 1144
2.03
TabWak
16
-2.75
4.92
84.37
88,07
4. 4.29
36.83
TabWak 162.44.1111
157.75
131.
70.38
10.79
99.231196
9,01
Timellak
236.08=:13
243.86=1.81
207.90
18.35
2,47
171.51+146
27.78=1122
TR
1,491004
1,46
1.54
7.14
7.171007
1.09
14.83 19,32
GS
10.13=20e
10.35
8.76+475
28.99=0000
10.09:a01
9.35
10.40=1.0
HTW
3.41
3,41
3.41
1.13
-1.322067
3.09
1.67:005
MuJoCo
TabWak 1.261096
0,48
5,48.11.2
-1.75.11.1
-6.651071
-0.57
-0.31
TabWak
45
-3.462099
-0,24=004
-32.20
42,74g1225
34.161990
180.63+
Timellak
16,45
58.90
51,53
49.30
1.85
36.59
10.35
TR
17
16.74=a
15.09:0009
128.26:0.29
148.31-020
37.72+0.0
75.09=0.29
GS
68.67=1.0
63.93+109
54.84-g109
66.3002009
46.29
66.40+1.2
53.06=1
HTW
4.301008
4.30
4.30
0,401.048
-0.601034
3.87
2.03..:48
Energy
TabWak
3.
1..9
9,9420.00
4,21
2.67
TabWak
46.68-20s6
43.10
42.38
1..26
49.34411744
11
-43.152071
TimeWla
267.53.2.00
296.74.2.49
191,63
4.91 1.96
15.73109
195.37.1.97
34.26
TR
8.25
8,22=005
8. 3.102ans
8.24-2005
7.842006
11,452006
23.36:20. 10
GS
321.5220.5
319.93-0m0
312.57:am0
286.0521.15
116.242037
320.52:1166
275.34
HTW
6.80+0.41
6.80=041
6.80+041
4.82+046
-0.70=046
5.95
2.56+041
[MRI
TabWak 204.162082
205.01
215.6421m
154.27
452.61=314
248. 19:
297.10:aa7
TabWak 743.332058
743.16:9.59
742.43:083
636.28
317.24
614.25
224.27108s
TimeWak
595.68+163
601.68-051
601.53+am6
459.66=1.00
112.68=0.55
498.39
189.43+t10 00
insertion attack perturbs the series by randomly replacing proportion of points (5% or 30%) in each feature with random values drawn uniformly between the feature's minimum and maximum values.
Table 2 presents the Z-scores of 64-length watermarked synthetic time series data under these attacks, and averaged over 100 trials. Random cropping at 30% proves especially challenging, with several methods showing negative Z-scores. Nevertheless, TimeWak demonstrates the best overall robustness, consistently outperforming all baselines across most attack scenarios while maintaining high generation quality and accurate watermark detection. In contrast, although HTW has better quality, does poorly under attacks, indicating a struggle in balancing trade-offs between quality and robustness.
Interestingly, TR's detection scores further improve under certain post-processing attacks. In particu- lar, significant gains are observed under random cropping and min-max insertion, likely due to the inherent robustness of watermarking the Fourier domain. However, its overall performance lags be- hind TimeWak. Both TabWak and TabWak show significant degradation under attacks, particularly on MuJoCo and Energy datasets, where detection frequently fails. GS overall demonstrates strong robustness, maintaining detectability under all attacks except for 30% cropping on the ETTh dataset. However, produces low-quality synthetic samples, highlighting the need for time series specific watermark that can navigate the trade-offs between generation quality and watermark robustness.
5 Conclusion
Motivated by the need to ensure the traceability of synthetic time series, we propose TimeWak, the first watermarking algorithm for multivariate time series diffusion models. TimeWak embeds seeds through a temporally chained-hash and feature-wise shuffling in data space, preserving the temporal and feature dependencies and enhancing the watermark detectability. To address non-uniform ervor distribution in the time series diffusion process, we optimize TimeWak for e-exact inversion and provide the bounded error analysis. Compared to multiple SOTA watermarking algorithms, TimeWak

---

balances synthetic data quality, watermark detectability, and robustness against post-editing attacks. Extensive evaluations on five datasets show that TimeWak improves context-FID score by 61.96% and correlational scores by 8.44% against the strongest SOTA baseline, while maintaining strong detectability.
Limitations. While TimeWak does not natively support streaming data, it can be applied to stream- ing scenarios by processing data small, fixed-length windows and watermarking each window independently. However, finer-grained cases, such as watermarking at the per-timestep level, remain unexplored. This represents key limitation of TimeWak and an important direction for future work.
Acknowledgments
This research is partly funded by Priv-GSyn project, 200021E_229204 of Swiss National Science Foundation, the DEPMAT project, P20-22 N21022, of the research programme Perspectief of the Dutch Research Council, and ASM International NV.
References
[1] Juan Miguel Lopez Alcaraz and Nils Strodthoff. Diffusion- time series imputation and forecasting with structured state space models. Trans. Mach. Learn. Res., 2023.
[2] Yihao Ang, Qiang Huang, Yifan Bao, Anthony K. H. Tung, and Zhiyong Huang. Tsgbench: Time series generation benchmark. Proc. VLDB Endow., 17(3):305-315 2023.
[3] Luis Candanedo. Appliances energy prediction. UCI Machine Learning Repository, 2017.
https://dbi... org 10. 24432/C5VC80
[4] Ping Chang. Huayu Li, Stuart Quan, Shuyang Lu, Shu-Fen Wung, Janet Roveda, and Ao Li.
A bransformer-based diffusion probabilistic model for heart rate and blood pressure forecasting in intensive care unit. Comput. Methody Programs Biomed., 246:108060, 2024.
[5] Ingemar Cox, Matthew L. Miller, Jeffrey A. Bloom, Jessica Fridrich, and Ton Kalker. Digital Watermarking and Steganography. Morgan kaufmann, 2007.
[6] Prafulla Dhariwal and Alexander Quinn Nichol. Diffusson models beat gans on image synthesis. In NeurIPS, pages 8780-8794, 2021.
[7] Pierre Fernandez, Guillaume Couairon, Hervé Jégou, Matthijs Douze, and Teddy Furon. The stable signature: Rooting watermarks in latent diffusion models. In ICCV, pages 2023.
[8] Maurice Fréchet. Sur la distance de deux lois probabilité. Annales de I'ISU,, V133):183-198. 1957.
[9] Xu Guo and Yiqiang Chen. Generative Al for synthetic data generation: Methods, challenges and the future. CORR, abs/2403.00419. 2024.
[10] Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. In NeurlPS, 2020.
[11] Paul Jeha, Michael Sohlke-Schneider Pedro Mercado, Shubham Kapoor, Rajbir-Singh Nirwan, Valentin Flunkert, Jan Gasthaus, and Tim Januschowski. PSA-GAN; progressive self attention gans for synthetic time series. In ICLR, 2022.
[12] Marcel Kollovieh, Abdul Fatir Ansari, Michael Schkke-Schneider, Jasper Zschiegner, Hao Wang. and Yuyang Wang. Predict, refine, synthesize: Self-guiding diffusion models for probabilistic time series forecasting. In NeurlPS, 2023.
[13] Hui Li, Yunpeng Cui, Shuo Wang, Juan Liu, Jinyuan Qin, and Yilin Yang. Multivariate financial time-series prediction with certified robustness. IEEE Access, 8: 8:109133-109143 2020.
[14] Yan Li, Xinjiang Lu, Yaqing Wang, and Dejing Dou. Generative time series forecasting with diffusion, denoise, and disentanglement. In NeurlPS, 2022.
10

---

[15] Shujian Liao, Hao Ni, Mare Sabate- Vidales, Lukasz Szpruch, Magnus Wiese, and Baoren Xiao. Conditional sig-wasserstein gans for time series generation. CoRR, abs/2006.05421, 2020.
[16] Haksoo Lim, Minjung Kim, Sewon Park, and Noseong Park. Regular time-series generation using SGM. CoRR, abs/2301.085 2023.
[17] Lequan Lin, Zhengkun Li, Ruikun Li, Xuliang Li, and Junbin Gao. Diffusion models for time-series applications: survey. Frontiers Inf. Technol. Electron. Eng., 25(1):19-41, 2024.
[18] Yugeng Liu, Zheng Li, Michael Backes, Yun Shen, and Yang Zhang. Watermarking diffusion model. CoRR, abs/2305.12504 2023.
[19] Mohammad Amin Morid, Olivia R. Liu Sheng, Kensaku Kawamoto, and Samir E. AbdeIrahman. Learning hidden patterns from patient multivariate time series data using convolutional neural networks: A case study of healthcare cost prediction. J. Biomed. Informatics, 111:103565, 2020.
[20] Kashif Rasul, Calvin Seward, Ingmar Schuster, and Roland Vollgraf. Autoregressive denoising diffusion models for multivariate probabilistic time series forecasting. In ICML, volume 139, pages 8857-8868, 2021.
[21] Aditya Shankar, Hans Brouwer, Rihan Hai, and Lydia Chen. SiloFuse: Cross-silo synthetic data generation with latent tabular diffusion models. In ICDE, pages 110-123, 2024.
[22] Stephen M. Smith, Karla L. Miller, Gholamreza Salimi Khorshidi, Matthew A. Webster, Chris- tian F. Beckmann, Thomas E. Nichols, Joseph D. Ramsey, and Mark William Woolrich. Network modelling methods for FMRL. Neurolmage, 54(2):875-891, 2011.
[23] Jiaming Song. Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. In ICLR, 2021.
[24] Yang Song, Jascha Sohl-Dickstein, Diederik P. Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poole. Score-based generative modeling through stochastic differential equations. In ICLR, 2021.
[25] Namjoon Suh, Yuning Yang, Din- Yin Hsich, Qitong Luan, Shirong Xu, Shixiang Zhu, and Guang Cheng. Timeautodiff: Combining autoencoder and diffusion model for time series tabular data synthesizing. CoRR, ftns/2406.16023, 2024.
[26] Yusuke Tashiro, Jiaming Song, Yang Song, and Stefano Ermon. CSDI: conditional score-based diffusion models for probabilistic time series imputation. In NeurlPS, pages 24804-24816, 2021.
[27] Saran Tunyasuvunakool, Alistair Muldal, Yotam Doron, Siqi Liu, Steven Bohez, Josh Merel, Tom Erez, Timothy P. Lillicrap. Nicolas Heess, and Yuval Tassa. dm_control: Software and tasks for continuous control. Softw. Impacts, 6: 6:0002 2020.
[28] Nicolas van Schaik. Robust watermarking in large language models for time series generation. Master's 's thesis, Delft University of Technology, 2024. record/uuide dwbf::::bbbbdddbbbo 08ba 43d6- 8ec4 0240ec00a2b7
tudelft.... nl/
[29] Yuxin Wen, John Kirchenbauer, Jonas Geiping, and Tom Goldstein. Tree-rings watermarks: Invisible fingerprints for diffusion images. In NeurIPS, 2023.
[30] Haixu Wu, Tengge Hu, Yong Liu, Hang Zhou, Jianmin Wang, and Mingsheng Long. Timesnet: Temporal 2d-variation modeling for general time series analysis. In ICLR, 2023.
[31] Tijin Yan, Hongwei Zhang, Tong Zhou, Yufeng Zhan, and Yuanqing Xia. Scoregrad: Multi- variate probabilistic time series forecasting with continuous energy-based generative models. CoRR, abs/2106. 10121, 2021.
[32] Zijin Yang. Kai Zeng, Kejiang Chen, Han Fang, Weiming Zhang, and Nenghai Yu. Gaussian shading: Provable performance-losee image watermarking for diffusion models. In CVPR, pages 12162-12171, 2024.

---

[33] Jinsung Yoon, Daniel Jarrett, and Mihaela van der Schaar. Time-series generative adversarial networks. NeurIPS, pages 5509-5519, 2019.
[34] Xinyu Yuan and Yan Qiao. Diffusion-ts: Interpretable diffusion for general time series genera- tion. In ICLR, 2024.
[35] Zhihan Yue, Yujing Wang, Juanyong Duan, Tianmeng Yang, Congrui Huang, Yunhai Tong, and Bixiong Xu. Ts2vec: Towards universal representation of time series. In AAAI, pages 3980-8987,, 2022.
[36] Guoqiang Zhang, John Lewis, and W. Bastiaan Kleijn. Exact diffusion inversion via bidirec- tional integration approximation. In ECCV (57), volume 15115, pages 19-36, 2024.
[37] Hengrui Zhang. Jiani Zhang, Zhengyuan Shen, Balasubramaniam Srinivasan, Xiao Qin, Christos Faloutsos, Huzefa Rangwala, and George Karypis. Mixed-type tabular data synthesis with score-based diffusion in latent space. In ICLR, 2024.
[38] Kevin Alex Zhang, Lei Xu, Alfredo Inestt-Infante, and Kalyan Veeramachaneni. Robust invisible video watermarking with attention. CoRR, abs/1909.01285, 2019.
[39] Haoyi Zhou, Shanghang Zhang, Jieqi Peng, Shuai Zhang, Jianxin Li, Hui Xiong, and Wancai Zhang. Informer: Beyond efficient transformer for long sequence time-series forecasting. In AAAI, pages
11106-11115, 2021.
[40] Chaoyi Zhu, Jeroen Galjaard, Pin-Yu Chen, and Lydia Y. Chen. Duwak: Dual watermarks in large language models. ACL (Findings), pages 1416-11436, 2024.
[41] Chaoyi Zhu, Jiayi Tang, Jeroen M. Galjaard, Pin- Yu Chen, Robert Birke, Cornelis Bos, and Lydia Y. Chen. Tabwak: A watermark for tabular diffusion models. In ICLR, 2025.
12

---

NeurIPS Paper Checklist
1. Claims
Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Question:
Answer: [Yes]
Justification: The abstract and introduction mention TimeWak's contributions the first generation-time watermarking scheme for multivariate time series diffusion models; using a temporal Seained-hashing scheme to embed watermark seeds, and e-exact inversion to detect the watermarks.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contribu- tions made in the paper and important assumptions and limitations. No NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can expected to generalize to other settings.
is fine to include aspirational goals as motivation as long as it is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification:
The limitations of the work included in Section S
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create separate "Limitations" section their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., the approach was only tested on few datasets or with a few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low images are taken in low lighting. Or a speech-to-texx system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might be used by reviewers grounds for rejection, worse outcome might be that reviewers discover limitations that aren't acknowledged the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an important role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof?
Answer: [Yes]
13

---

The assumptions are detailed in Assumption 1 the verification of assumptions and derivations of proof are provided in Appendix
Justification:
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross-rcferenced.
All assumptions should be clearly stated referenced in the statement of any theorems.
The proofs can either appear the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide short proof sketch to provide intuition.
Inversely, any informal proof provided the core of the paper should be complemented by formal proofs provided in appendix supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main experimental results of the paper the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Answer: [Yes]
Justification: We keep the code for the proposed TimeWak and baselines the following open sourced repository anonymously: https: /anommmous 4open. science/r/Timeet h/mme//aa//// We also provide the experiment scripts and the datasets used in this study, The implementation details can be found in Appendix D
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution a dataset and/or model, the authors should describe the steps taken to make their results reproducible verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is specific model and empirical evaluation, may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data often one good way accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., . the case of large language model), releasing of model checkpoint, other means that are appropriate to the research performed.
While NeurlPS does not require releasing code, the conference does require all submissions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) the contribution primarily new algorithm, the paper should make it clear how to reproduce that algorithm.
(b) the contribution is primarily a new model architecture, the paper should describe the architecture clearly and fully.
(c) If the contribution is be a way to access this model for reproducing the results or a way to reproduce the model (e.g.. with open-source dataset or instructions for how construct the dataset).
model (e.g., a large language model), then there should either
(d) We recognize that reproducibility may be tricky in some cases. in which case authors are welcome describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., registered users), but it should be possible for other researchers have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instructions to faithfully reproduce the main experimental results, described in supplemental material?
14

---

Answer: [Yes]
Justification: We keep the code for the proposed TimeWak and baselines on the following open sourced repository anonymously: htttps://nnonymuus 4open. Tasience/r/Timeen We also provide the experiment scripts and the datasets used in this study, The implementation details be found in Appendix [
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines quides/CooeSubmis isioooiicy for more details.
While we encourage the release of code and data, we understand that this might not be possible, so "No" is an acceptable answer. Papers cannot be rejected simply for including code, unless this is central to the contribution (c.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https://nips cc/
oollliiiiiiiiooooocciccc for more details.
The authors should provide instructions data access and preparation, including how access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended to the paper) is recommended, but including URLS to data and code permitted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyperparameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
The implementation details can be found in Appendix D including details of datasets, evaluation metrics and baselines we used. We keep the code for the proposed TimeWak and baselines the following open sourced repository anonymously: betts://anonyien 4open. wwweeeneeeee///i// We also provide the experiment scripts and the datasets used in this study.
Justification:
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to a level of detail that is necessary to appreciate the results and make sense them.
The full details can be provided either with the code, in appendix, or as supplemental material.
Experiment statistical significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer: [Yes]
Justification: We provide the mean standard deviation for results, providing appropriate measures for variability (see Table Table 2).
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confidence intervals, or statistical significance tests, at least for the experiments that support the main
claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).
15

---

The method for calculating the error bars should be explained (closed form formula, call to library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors). errors is not verified.
It should be clear whether the error bar the standard deviation or the standard error of the mean.
OK to report -ssigma error bars, but one should state it. The authors should preferably report 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that
of range (e.g. negative error rates). error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments compute resources
Question: For each experiment, does the paper provide sufficient information on the computer resources (type of compute workers, memory, time of execution) needed to reproduce the experi- ments?
Answer: [Yes]
Justification: Compute resources mentioned in Section D.4
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU GPU, internal cluster, cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experi- mental runs as well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make into the paper).
Code of ethics
Question:
Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics
Answer: [Yes]
Justification: The paper conforms in every respect to sections 'Potential Harms Caused by the Research Process', 'Societal Impact and Potential Harmful Consequences', and 'Impact Mitigation Measures' in the NeurIPS Code of Ethies.
Guidelines:
The answer NA means that the authors have not reviewed the NeurlPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., if there is special consideration due laws or regulations in their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive socictal impacts and negative socictal impacts the work performed?
Answer: [Yes]
Justification: Multivariate time series important data modality for real-world applications, e.g., health care, science and finance. The traceability of time series generative models is crucial achieve the trustworthy and responsible analysis. Our solution of embedding watermarks on time series yields insights into auditing the use of synthetic time series to help overcome data sharing barriers.
Guidelines:
The answer NA means that there is no societal impact of the work performed.
16

---

If the authors answer NA or No. they should explain why their work has no societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), faimess considerations (e.g., deploy- ment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied par- ticular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility of ML).
11. Safeguards
Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, scraped datasets)?
Answer: [NA]
Justification:
Code is verified by all authors.
Guidelines:
The answer NA means that the paper poses such risks.
Released models that have high risk for misuse or dual-use should released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make a best faith effort.
12. Licenses for existing assets
Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification: Datasets details are in Section and Appendix with appropriate citations for the source(s). The datasets are widely recognized as publicly available and their use complies with standard academic practice.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (e.g.. CC-BY 4.0) should be included for each asset. For scraped data from a particular source (e.g., website). the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, soperswithcode com/ datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
17

---

For existing datasets that are re- re-packaged, both the original license and the license of the derived asset has changed) should be provided.
this information not available online, the authors are encouraged to reach out to the asset's creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [Yes]
Justification:
Assets introduced in the paper, in the form of code, available at the anonymized open-source repository:
4open. science/r//imewaal
Guidelines:
The answer NA means that the paper does release new assets.
Researchers should communicate the details the dataset/code/moddl as part of their sub- missions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL include an anonymized zip file.
14. Crowdsourcing and research with human subjects
For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, well as details about compensation (if any)?
Question:
Answer: [No]
Justification: [NA]
Guidelines:
The answer NA means that the paper does not involve crowdsoureing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribution of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According the NeurIPS Code of Ethics, workers involved in data collection, curation, other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for research with human subjects
Question: Does the paper describe potential risks incurred by study participants. whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based the requirements your country or institution) were obtained?
Answer: [NA]
Justification: [NA]
Guidelines:
The answer NA means that the paper does not involve crowdsoureing nor research with human subjects.
Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, not include any information that would break anonymity (if applica- ble), such as the institution conducting the review.
18

---

16. Declaration of LLM usage
Question: Does the paper describe the usage of LLMs if it is an important, original, or non- standard component of the core methods in this research? Note that if the LLM used only for writing, editing, or formatting purposes and does not impact the core methodology, scientific rigorousness, originality of the research, declaration not required.
Answer: [No]
Justification: The paper uses no LLM for any important, original, or non-standard component of the core method.
Guidelines:
The answer NA means that the core method development in this research does not involve LLMs as any important, original, or non-standard components.
Please refer to our LLM policy (https://neurips. httpr//ss////ooooeeeeeee//////// for what should or should not be described.
19

---

A
Nomenclature
ag
Noise schedule parameter
Be
Variance schedule for noise addition
A
Lipschitz constant for noise estimator sensitivity at time step
Perturbation error in inversion
Scaling factor in BDIA inversion
to
Noise estimator function
Cryptographic key for watermarking
[[-]
Indicator function
gll
Watermark seed across all timesteps at feature Watermark seed across all features at timestep w Watermark seed at timestep w and feature f Generated sequence of length W and F features Noised sequence at timestep T
Xo
XT
x1
opprxx
Approximate diffusion state at step t Diffusion state at step
X
H(K,, w, s s.Hl
Temporal chained hashing function Standard normal distribution
1).
1(0,1)
Continuous uniform distribution between 0 and 1
u(10, 1
Vector in I F with i.i.d. discrete uniform components over (O.... 1} Set valid timesteps for comparison
W
CDF of standard normal distribution
p-1
Inverse CDF of standard normal distribution
Tw
Feature permutation function
Tt
Standard deviation at timestep
ar, b
BDIA parameters for inversion process
F
Number of features
H
Interval length for watermark partitioning
L
Bit length
n
Number of intervals in time window
Total diffusion steps
W
Time window length
B Diffusion and diffusion inversion
B.1
Time series diffusion model
This section covers the necessary background knowledge for time series diffusion models.
Denoising Diffusion Probabilistic Models (DDPMs) powerful generative models, especially for time series synthesis 10, data and then learning invert this process through during the backward step [10] For time series window, one step of forward noise given by:
12 34
As shown in Figure 4 they work by iteratively forward noising
/1 B BBeec
(16)
20

---

Forward process
x0
X1
X2 XT
Backward process
Figure 4: Forward and backward diffusion process. denotes the initial signal window and XT corresponds to the fully diffused version the signal obtained after forward diffusion steps.
In this formulation, x; represents a multivariate time series signal after undergoing steps of noise addition. The term 3, denotes the noise variance step The noise component e; is sampled from normal distribution, (o, I). Using this notation, Xo and X define a noise-free sequence and a fully noised sequence, respectively, for arbitrary window slice, where T is the total number of noise steps. Without iteratively applying Equation (16), an intermediate noising step can be efficiently computed using reparameterization trick [10]
Ox + V1 1 O₁E,
(17)
where de is the cumulative product of noise reduction factors up to step t. expressed as ãg IT'= a== [T- 8,), with 3, being the noise variance timestep s and (0,
The denoising process reverses the noising steps to reconstruct Xo from X2, ideally restoring the original signal. This is achieved by training neural network, co. estimate the noise component at each step. A single reverse step is given by:
1 Voz
Be VI -1-a; (0(2);1) + o.2.
&
(18)
Here, &, and 8, denote the signal estimates at time steps i and - 1, respectively, where x; the final noising step. The term o₁ typically function of 3 to introduce stochasticity in the sampling process, and z ~ NN, [10]. The objective is to iteratively refine the denoised sample so that žg Zo.
B.2 Diffusion models for time series
Diffusion models show great promise in time series tasks, excelling in both forecasting 20
and generation [6 37). Among these, Denoising Diffusion Probabilistic Models (DDPMs) [0
are a leading framework, which progressively denoise samples to reconstruct data from noise 17 and rely stochastic noise addition during sampling [10]. On the other hand, Denoising Diffusion Implicit Models (DDIMs) use a deterministic sampling process that removes noise, enabling faster sampling and fewer steps generate high-quality samples with greater predictability (3). However,
this reduces the model's ability to explore a wide range of outputs. leading to lower diversity and
reduced robustness (i.c., consistency generating diverse and reliable samples) [0 23
Diffusion-TS, which serves as the backbone model TimeWak presented this paper, employs DDPM combined with seasonal-trend decomposition better capture underlying structures and dependencies multivariate time series [4]. It also introduces a Fourier- based loss to optimize reconstruction, improving accuracy by better matching the frequency components lies in the integration of seasonal-trend decomposition with DDPMs, and the use of the Fourier-based loss enhance the model's 's ability to capture complex temporal patterns.
(34] Its innovation
Some diffusion models that synthesize time series data include ScoreGraa 31. SA D. TSD- iff [12), but some also incorporate transformer-ban based elements like TimeGrad 20), CSDI (6) and TDSTF 4 Diffusion-TS (34] effectively addresses weaknesses in these models. Unlike ScoreGrad and TimeGrad which use autoregressive models [I] 20) it avoids error accumulation and slow inference over long horizons by using DDPM, stable diffusion-basse framework. It outperforms
S4 S4 and TSDiff [1 [2] by replacing resource-intensive S4 layers with an efficient latent layer
21

---

that simplifies handling multivariate data. Diffusion-TS handles incomplete datasets better than CSDI [26] by avoiding the need for explicit pairing observed and missing data during training, while being more adaptable and efficient on diverse datasets compared to TDSTF [4], which struggles with real-time forecasting.
B.3 DDIM and DDIM inversion
The Denoising Diffusion Implicit Model (DDIM) [23] offers deterministic diffusion and sampling, extending the traditional Markovian diffuusin process broader class of non-Markovian processes. Given a initial noise vector Xr and a neural network 6a that predicts the noise eo (x(x,,) () at each timestep I, the DDIM sampling step to generate sample x from Xx, is defined
X a1-1
X
v1 0,50 (xx..1)
V +-
ar-1 - oî Eg (Xt, f) + ozEs: (19)
where 01..... QT are computed from a predefined variance schedule, E, ~ ~0 I) denotes standard Gaussian noise independent of and the o, values can be varied to yield different generative processes. Setting o, for all makes the sampling process deterministic:
X + (vi-au-1
04-1 a1-1 Eo (x,,t).
x
(20)
This sampling process ensures the same latent matrix Xo is consistently generated by given noise matrix Xy.
Having large T values (being limited with small steps) allows to cross the timesteps in the backward direction toward increasing noise levels, which gives out deterministic diffusion process from Xg to Xy; this is also known as DDIM inversion:
10tt1 at
+ (VI (VI-aut1
/oot1
X1+1
-
aut1 co (xx,
(21)
at
C Proof
Theorem 3.1. Let (xiTT= be the sequence diffusion states governed by the BDIA-DDIM recur- rence for a given dataset, following Equation (7). Given the noise estimator èg follows Assumption Suppose that instead of the exact terminal state X1, approximation of X1, termed x apprx used with a small perturbation e, given by:
1
X1 upprox X2 X1
orig
(8)
Let the propagated error time be defined as,
8 ||x Xx 22ri111- 11.
(9)
Then,for 2 1, the error is bounded by,
||
s lel
T-1
II
(2)
1 at
b
be+1 D. a++1
(10)
a++1
where A, quantifies the sensitivity of the noise estimator at timestep t.
Proof:
For have:
81 X1
appmex
orie = E.
(22)
For 2, using the recurrence,
X
x1xi + bIč0(x1,11
X1
bz é0 [1, 2)
X2
+
(23)
Subtracting the approximated and original cases and using Assumption
we obtain:
8
bj
b2
6, =
A
(24)
7
22

---

Thus, defining
01
b2
C2
+
A1
+
A
(25)
7
we bound
|| C2 ||
(26)
Suppose for some t 2 2, there exists a constant C₁ such that
| - C2 |E||-
(27)
For + 1, using the recurrence:
X
0xx; + (x1,) + ( Xt
bet1 20(xi, t +xxx,
X++1
(28)
a1+1
as+1
Taking differences, we obtain
8 δ.-1 azde
bc
bi+1 Or
A
(29)
y
ac+1
a++1
Bounding the terms, we define:
(1-
1 ae
bt
bu+1 Dg
C++1 Ci
+
A
+
(30)
7
ar1
?
ar41
Thus, we conclude:
|| 184+1|1 S C++1lles |E||-
(31)
By induction, obtain:
Cr
II
ag
b A.
bet1 D
(32)
a++1
7
as+1
Thus, the perturbation remains bounded for all T. i.e.
T-1
1 at 1
b A.
bet1
||
s le
II
De
(33)
ac+1
?
a++1
completing the proof.
To further validate Assumption T empirically computed A, across four different datasets, using 10,000 samples from each. Specifically, A, is calculated as the maximum ratio for different t using the L1 norm of the data samples, as illustrated in Figure [5]
We also generate 10,000 samples with 64-length sequences across five datasets, computing the final output Xo and the step prior X1. Results in Table 3 show consistently small I norm between X1 and Xo. with an average 5.1 x 10-3 to 7.0 x 10-3 and maximum of < 0.23, validating our e-exact approximation. These empirically small errors confirm Theorem 3.Iss theoretical bounds and demonstrate reliable watermark detection despite the approximation.
Table 3: L1 norm between x, and x for 64-length sequences over 10,000 samples.
Dataset
Avg. L, (x10-3)
Max. L1
Stocks
7.031
0.082
ETTh
6.776
0.104
MuJoCo
5.146
0.081
Energy
5.687
0.230
fMRI
5.945
0.070
23

---

Energy
Frth
Stocks
60
50
10
0
0.0
0.2
0.4
0.6
0.8
1.0
Progress (t/ max
Figure Ag for different datasets.
D Experiment details
D.1 Datasets
Table 4 shows the details of all datasets used in the experiments.
Table 4: Details of datasets used in experiments.
Dataset
Number of Rows
Number of Features
Source
Stocks ETTh
3,773
17,420
MuJoCo
10,000
14
http::/gtttubbcom//ccmmm///inn control
Energy
19,711
28
https//aachlvv..ssssuuu.d/////ss
IMRI
10,000
50
https//wwww..mmboxxccuuuaaatssss
D.2 Evaluation metrics
Context-FID Jeha et al. introduced the Context-FID score, which is a refined adaptation of the Fréchet Inception Distance (FID) used for evaluating the similarity between real and synthetic time series distributions. Unlike traditional FID, which relies on the Inception model as feature extractor for images. Context-FID uses TS2Vee (35), which is specialized time series embedding model. Yue et al. (35] demonstrated that models with lower Context-FID scores tend to perform well in downstream tasks, revealing strong correlation between Context-FID and the forecasting perfor- mance of generative models. Ultimately, a lower Context-FID score signifies a closer resemblance between real and synthetic distributions.
Correlational We calculates the covariance between the jth and jth features of time series using the following equation [5]]
Covi.i
K
K
K
(34)
where W the total number of time steps, KJ and K are the values of the ith and jth features at time step t, and the summations compute the average product of these values, subtracting the product

---

of their individual means. To assess the correlation between real and synthetic time series, we use the following metric [3
1
Σ 1
d
Cov R
Cov 2.j
(35)
10
Cov Covr,,Cor Cov V (Coof,Coy
where Cov is the covariance between its subscripts ((i, i). (5.5). (2, j)), where and j are the features in the real (denoted by Rt and synthetic (denoted by S) time series data, and is the total number of features, with the summation taken over all feature pairs.
Discriminative The discriminative score is computed as |accuracy - 0.5]. quantifying the model's ability to distinguish between real and synthetic time series. A lower score indicates better per- formance, as it indicates greater difficulty in differentiation, implying a higher degree similar- ity between the two distributions. To ensure consistency, follow the experimental setup of TimeGAN [33 by using a two-layer GRU-based neural network as the classifier.
The predictive score is evaluated using the predicted and actual values on the test data. Again, we use the experimental setup of TimeGAN 33 by using a two-layer GRU-based neural network for sequence prediction.
Predictive
absolute error (MAE) between the
Z-score The Z-score is a statistical measure used to assess watermark detectability by quantifying the deviation between watermarked and non- watermarked samples. facilitates hypothesis testing, where the null hypothesis Hg states that given sample is not watermarked by the corresponding watermarking method. A sufficiently high positive 7-score provides evidence against Ho. suggesting the presence of watermark.
For sample-wise bit accuracy in time series, the Z-score computed as Z Maae w Paoce Nw
where
Tse Nw/
|Ace, w and PAce, Nw are the mean bit accuracy of watermarked and watermarrdrrked samples, respectively, Acc, Nw is the standard deviation of bit accuracy in the wonemaaerdareed samples, and is the number of watermarked samples. Under Ho, the expected difference in means is negligible, resulting in a Z-score close to zero. A large positive Z-score provides statistical evidence for the presence of watermark.
For the Tree-Ring watermarking method, the Z-score is computed in the Fourier domain instead of the sample-wise bit accuracy domain. It measures the deviation in the amplitude spectrum between watermarked and non-watermarked samples, given by Z HJ -Fw where Fw and Fnw denote the Fourier amplitude spectrum of watermarked and non-watermarker samples, respectively, with and representing their mean and standard deviation. Since this method does not rely on per-sample bit accuracy, the test statistic independent of n, and the computation utilizes the opposite tail the distribution.
TPR X FPR This metric measures the True Positive Rate (TPR) at specified False Positive Rate (FPR) of X%, where X% denotes fixed false positive threshold. It reflects the effectiveness of watermark detection by quantifying how reliably watermarked samples are identified under controlled false positive conditions. A higher TPR @ XPF indicates stronger detection performance and greater robustness of the watermarking method.
D.3 Baselines
Tree-Ring We adapt the latent-represennttiion- based Tree-Ring watermark for multivariate time series in the data space. Initially, the Tree-Ring watermark was proposed for images with square dimensions as places the circular ring watermark pattern centrally. However, multivariate time series often have rectangular dimensions with varying numbers of features and timesteps. To accommodate this structure, we apply flexible ring pattern with a predefined radius indicating the outermost circle of the watermark. Finally, we embed and detect the watermark in the Fourier domain.
Gaussian Shading Similar to Tree-Ring, we implement Gaussian Shading from the image domain to multivariate time series by embedding the watermark directly in the data space. To maintain
25

---

coherence and efficiency, we use single control seed across all samples to avoid the need for additional indices for each sample.
Heads Tails Watermark The HTW is post-watermarking technique designed for univariate time series. To extend its applicability, we adapt for multivariate time series by iterating through each variate in the generated synthetic sample. During evaluation, the watermarked time series reversed, and processing each series independently. short, we treat each variate as a single series.
Wab Tab was originally designed for the tabular data domain, where it operates effectively the latent space. We extend its application to multivariate time series the data space. However, tabular data primarily captures feature dependencies, while time series data inherently relies on both feature and temporal dependencies. Therefore, we implement another version called TabWak by transposing the watermarking direction onto the temporal axis. Similarly, we evaluate the watermark detectability on a sample by sample basis.
D.4 Training and sampling
All code implementations are done in PyToorch (version 2.3.1) using single NVIDIA GeForce RTX 2080 Graphics Card coupled with an Intel(R) Xeon(R) Platinum 8562Y+ CPU for all experiments. Dataset splits are 80% for training and 20% for testing.
training and sampling time for all datasets across window of sizes 24, 64 and 128. We train time series diffusion model following the Diffusion-TS settings [34]] and generate 10,000 watermarked synthetic samples using TimeWak for each sampling run.
Table 5: Details of training and sampling time.
Dataset
Window Size
Training Time (~~ min.)
Sampling Time (~~ min.)
24
6.1
0.4
Stocks
64
2.1
128
8.0
4.6
24
11.6
0.4
ETTh
64
12.7
2,4
128
13.7
5.2
24
9.7
0.7
MuJoCo
64
9.9
4.9
128
10.6
12.6
24
23.5
1.4
Energy
64
24.2
10.5
128
24.3
23.0
24
16.8
1.8
fMRI
64
17.5
13.5
128
18.1
28.5
26

---

E
Additional experimental results
E.1
Quality performance
Table 6 shows the quality of symthetic time series generated in 64 and 128 window sizes. TimeWak remains stable across all datasets and even comparable to the quality of non-watermarked samples.
Table 6: Results of synthetic time series quality. No watermarking ( ('W/O') is included.
64 64-Jength_
128- 128-lengeh
Dataset
Method
Context-FID
Correlational
Discriminaive
Predictive
Context FID
Correlational
Discriminative
Predictive
WWO
D.444-011c
0.030120
0.104gn0:
8.037
0.536.a1e 1M
0.020aa001
1414210
0.0377.0000
TR
LS81=6220
0.102ea.02
0.206=003s
0.038=2001
3.555=0006
0.130em225
0. 0,27640000
=.041
GS
L.643:012
0,01 sares
0.252
0.042:ca00
2.647
0.025
0.1 1.166m
0.040
Stocks
0.426_ooms
0.02611000
_.037_2100
6.622.a00:
TabWak
0.242 ooses
0.01 Lotes
0.141 jnami
0.037 Lcree
0.394 pac4
0.009) Lundo
0.150
0.037 Lo
TabWak
0 0:284:tom1
s.005
0.099
0.037
=.367
0.010
0.1 0.1294
0.037
TinoNak
Look
0.017
0.092
0.316
0.140
WVO
0 0038
0.070ea.0
0.106#na09
0.115
L006
0.098=a022
0. 1666:001
0.111
TR
2 224:0aa
0.217
0.284
0.131 =0:0
a.4
0.270
0 0.284
0.138
0.154
0.162:9000
ETTh
HTW
0.372 oour
L.0e
0.118
0.116 1.116
1.119_aae
0.091 Lu004
0.165 Lioato
0.1 0.120
Tab
D. 0059
0.346
0,17620839
0. 0.122:0000
19951
0.266-2058
O 248:20017
0.1 1228
Lones
1.095
0
0.129
1.143
0.112
Timeliak
0.2 0.297=000
0.133-20
0.097
0.1 15
1.000=:.000
0.1 0.135
0.17 17140007
0.1 0.110s9.00 oce
W/O
D. 1033=000
0,023409.5
0.007 =0000
0. 0717000011
0 0,290am:22
0.05
0,005
2.627:6220
GS
7 7,162.1 1.20
1.034
0.447
0.01 Lome
g.797g1226
1.335
0.44_paam
0.007 see
MuloCo
HTW
D D.316:000
0.334
0,248
0.01 =:000
0.451
0 0.30920044
0 05255a004
0,009
TahWak
0.671
0.137
2.007
366
0.589
0.175
0.006
TabWak
0.238_ come
0.339
0.087
0.006
a.275
0.333
0.084.1a2
0.006..00e
TineWak
D. 0.108g00m
0003882000
0.007
0. 1555
0.3 0,316
0.046:1000
0.005
W/O
TR
0.902 Jomn
Losss
0.427 Loors
0.307 1oc0e
1.195
2.303 susse
0.498 Loon
0.287 Loc
GS
2.205 n.
3,277
0.479cus:
0.310 :0:0:
3.680
4.233
0.474:10a
0.250 ooe
Energy
HTW
1.0451079
0,135100
0.251
0.135
(1822.10
0.249
TabWak
0.168=0021
1.81 550300
0.136a02
0.25 =2:000
0,201 =0000
2.001 #0.400
0. 1665500777
0.250
TabWak
1.321
0,138
0,252 me
0,274
1,211 an
0. 36-1007
0.249
0.143=0019
0,219s9.00
W/O
0.435=o0s
1.899
0.268
0. 0.1000
0.859=91e4
1,823
209
0.100 000
TR
3 3.358:n.a
13,699
0.41
0,141
5.39 2000
13.000
0 0.434
0.149
0.756_0006
0.500
D.
0.106..
IMRI
HTW
0.413=om7
1.822e0.11 II.
0.338
0. 1.100==0000
0811=9001
1.757=0055
0 0.063:20044
0.100=a.000
TabWak
0.65::0157
6.532an ise
0.24220332
D. 108000000
1.114g0
5.967
0. 15355n218
0.11 10
TabWak
0.554_
10
0
D. 0.100_come
0.919_ammt
1.807
0.2651100
0.100.4000
TineWak
0.441=005
1,78650.00
0.3142004
0. 0.100::0000
0.855
1,704an000
0.298:1227
0.100s0:00
27

---

E.2
Post-editing attacks
Table 7 show the detectability results several post-editing attacks on 24 and 128 window sizes, respectively.
Table 7: Results of robustness against post-editing attacks. Average Z-score 24-length sequences, including un-attacked scores from Table Best results are in bold, and second-best are underlined.
Offsct
Random Crop
Min-Max Insertion
Without Attack
Dataset
Method
30%
5%
30%
5%
30%
TR
0.43+a044
0.41
0.26=000
=1101
76.69
0.18=005
0.81
GS
86.07-674
85.74=071
84.38+067
-3..00
3.08
8
57.07
HTW
4,45::0o2
4.45
4.45=0.22
-0,30
-0.40
3,96
1.80
Stocks
Tab
-67.2 177.22+117
-66.62=1.35
-75.89=1.10
-137
1337.99
-72.71
-70.1 1E114
-89. 89.22
5..39_0.86
55.59.1074
04.76
9.32.10.4
7.431077
45.69
21.191035
TineWak
182.10
181.8:004
180.
62.29
9.33+104
155.72:0.1
16.86
TR
7.84
7.94
8. 0..03
26.95 10.32
34.36.
28. 28.72.0050
GS
101.07:117
99.45
105,70
98,99:1.2
2.10
98.78
73.67
HTW
3.43=a033
3.43=0033
3.43=0.83
0.38
-1.08
3.09
1.54=20.6
ETTh
TabWak
-7.92.1977
1..00
-11.7611.31
8,65
-7.951093
21.70.008
109.35-an91
110.22+0a5
1...34
50.64
1.06
80.98-1087
21.83:005
TimeWak
134.831005
130.50
118.65::140
35.30
5.99
101.53
20.77
TR
1.38
1.34::003
1.22-20.3
5.31
5.65
2.42
5.53
GS
21.13
23.95
27.15
23.06
-10.38
22. 22.891
22.89
HTW
2.89
2.89
2.89
0.85
-0.47.10.0
2.65
1.51
MuloCo
TabWak 31.30-1.07
31.59.00.
39.05-+108
38.80
25.04
31.60
28.70
TabWak 4.85
6.277109
0.74
-15.92.00.8
-5..1521.00
110.95
.4..08:1..7
TimeWak
85.69_1.0
7..78
49.48
48.03
11.46
74.94.111
38.87
TR
9.51
9.30:a010
8.77
1 110.47:9.23
12..09
17.65.1915
35.69
GS
51,22200.0
50.27
47.31 1n09
11.65 1.072
38.7011.34
48. 80
39 80
HTW
3.0622
3.06:2036
3.06:0.36
0.5622035
-0.13:2023
2.36
10.1
Energy
TabWak 3.26:2089
0.52
3.27-2063
3.54
2.20
-2.0820.9
TabWak 40.82-0.81
38.47-8071
40.20=aa2
33.8
-7.47+1.50
31.89+089
5.37=20.8
TimeWak
231.28::1455
228.22
185.48
-9. -9,20g996
-1.5421.
189.15
56.39
TR
6.49
6,43200s
6. 22.00
5.42.00.5
4,40100s
5.54
1.37
GS
420.02+1144
416.83+143
10:18.27
360.27+114
171.38+116
386. 10=1.54
245.44=1128
HTW 4.32:202
4.32g032
4.32=0.32
2.92:2.37
20.39
3.8620.66
1.78
EMRI
TabWak 84.02-1.04
83.55=1.08
78. 78.94=116
78.63
27.05
76.49+1.17
50.55
TabWak 464.67=n..0
464.04=n.4
458.81
400.47:20022
202..57=1.4
403.49:0.06
168.64-075
TimeWak
379.
378.95
37..99
277.644:0..8
77.74
32..13
133.68=0.55
28

---

Table 8: Results of robustness against post-editing attacks. Average Z-score on 128-length sequences, including un-attacked scores from Table Best results are in bold, and second-best are underlined.
Offset
Random Crop t
Min-Max Insertion
1
Without Attack
Dataset
Method
5%
30%
5%
30%
5%
30%
TR
10
0.05 to
0.02ga
93.62.4w
119.45
6.87.402
23. 23.98
172.23=108
167.39
145.89
13.22
-2.23
144.05+09
64. 64.79-101
HTW
10.39
10.39
10.39
-1.30
-1.42+0.3
9.05
3,76
Stocks
TabWak
-10.4991.76
49 29.9
36.78..115
29.44
70.32
9.261114
33.81
TabWak
129.39:n090
131.70=a99
129.83.+1.08
7.70=1.04
14.86
80.70
15.70=0.57
TimeNak
550.05=115
535.16::96
$25.09
83.81
15.42
385.68#2.4
85.38-1.37
6.1810016
6.142016
6,08
24.37
36. 26
23.02.0.s
=5.97
GS
327.47=4444
322.35
296.89
189.84:29k
8.49
296.61:411
172.81
ETTh
6.84s:222
2.84+#22
6.84+2221
0.79=1.90
12.94
6.00+2.16
2.59 1.54
TabWak
-20.57=096
112.36
-3.56.1.91
37.32+2.4
78.54:3.0
-7.75
22.65
TabWak
235.03
227.57
194.842116
101 64
23.82:144
155.782124
23.70=001
TimeWak
340.36::206
333.66:193
276.99+201
107. 107.52
7.13
244.68+122
44.75=1.21
TR
1.31=004
0.33
1.50
6.93
6.08
10.52
25.61 =3.21
39.63-107
38.07 2988
32.10
37.224aw
10.6
31.58-1116
MuJoCo
HTW
4,2021.37
4,20
4,20g133
1.73-1.16
-2.13gam
3.78
2.02:090
TabWak
-3.00=104
-5.68
-3.91
-8.02=1m7
16.29
-0,31
2.90
TabWak
3.91
1,10
9.07
3.36
24.65
25 56.56.0000
41.50-1.0
TimeWak
123.36:1443
139.07::1.4
111.27
12.44:2101
71,22
7.262009
22.58+0.19
21.92:0.88
20.13
167.48
207.75-0.99
68 48400022
148.79:050
GS
45.42
43.41 1000
30.53
61:60:MM
67.39=1.1
44.20
43.13-1.18
HTW
5.42.10
5,42
5,42.110
0.24_
-1.11
4,8620M
2.47
Energy
TabWak
0.5720.8
-21.0620996
-28.01
-25.6
-10.44-076
-0.07:00m
-7.15=006
TabWak
26.00
33.08
19.25
9.30=1.14
10.84
24.21
33.38-006
TimeWak
245.37
307.31
183,59.1.4
9.57
2048
171.81
21.44=1.10
TR
0.94:204
9,93
9,88
10.47=0.05
8.96:
16.62
39.21=001
701.90=0.72
701.47
699.01
621.08=108 188
13
667.14+249
528.66:282
HTW
9.43
9.43
9,43
6.75=0067
-1.09
8.241006
3,45
IMRI
TabWak 47.29
43.52.00M
24.95
-57.42
71.03:2225
78.43:1487
0.17ax00
TabWak 1031.96::479
1031.53-4.7
1030.14=a.72
889. 089
183.15
801.16:aaa
229. +15
TimeWak
526.81
834.78
834.62+1.4
632, 107
160.62:1102
651.80+1.1
216.50an9
29

---

E.3
Reconstruction attack
We implement the reconstruction attack using the original diffusion model. Specifically, we first applied the q-sampling process up to half of the total diffusion steps (i.e.. midpoint timestep). and then performed reverse sampling starting from this midpoint. The results obtained from this approach are presented in Table 9 We observe that although the Z-score decreases, our watermark remains detectable.
Table 9: Results of synthetic time series quality and watermark detectability. Comparing TimeWak and TimeWak under reconstruction attack. Quality metrics and Z-score are for 24-length sequences.
Dataset
Method
Context-FID J Correlational J
Discriminative J
Predictive J
Z-score f
TimeWak
0.277.10019
0.020
0. 00
0.038
182.10
Stocks
TineWak recom
4.570.1.502
0.001
0.003
1..017
179.41
TimeMlak
0.237=t0017
0.212++004
0. 00
0.122+0.00
134.83==095
ETTh
TimeWak recm
1.743=20.22
0.138+00012
0.290
0.158
82.1142.58
TimeWak
4.089
0.532+0.137
0.044
0.008
85,69+1.08
MuJoCo
TimeWak recon
0.925+00047
0.622+0.06
0.261 +0000
0.008
81.97+1.33
TimeWak
0..01
1.977
0. 1:.000
0.204
231.28:1::45
Energy
TimeWak recon
4.158
6.678
0, 20046
0.263
39.994.2.03
TimeWak
0.199
2.006110:53
0. 120.0000003
0.100
379.51
IMRI
TimeWak recom
0.595
2.374+0.105
0.102+0.000
457.90=0.81
E.4 BDIA-DDIM on other baselines
The baselines in main experiments
not evaluated with BDIA-DDIM. This is because BDIA-DDIM tends to degrade data quality compared to standard DDIM, representing trade-off for achieving lower inversion error. For many baselines, such Tree-Ring and Gaussian Shading, the generated quality is already poor. Applying BDIA-DDIM in these cases might improve detectability but would further deteriorate quality, making the results less meaningful. And for WabWak, include results with BDIA-DDIM applied to both TabWak and TabWak in Table While BDIA-DDIM improves detectability for both variants, it comes at the cost of further quality degradation compared to the original results in Table []] In contrast, TimeWak maintains stable performance across both quality metries and Z-score, highlighting its robustness.
Table 10: Results of synthetic time series quality and watermark detectability. All results are applied with BDIA-DDIM. Quality metrics are for 24-length sequences.
Quality Metric
7-score t
Dataset
Method
Context-FID
Correlational
Discriminative
Predictive
24-length
64-length
128-length
Tab
0.267:0042
0.017:3014
0.12246029
0.039
43.10
92.562037
89.18
Stocks
Tab
0.273
0.011
0.1 1.115
0.08710000
117.12
170.41:044
267.27
TimeWak
0.277#0019
0.020
0. +00090
0.038
182. 10=e75
395,34 1
$50.05
Tab Wak
0.431
0.436
0.133
0.134
1.73+076
16.261098
31.59=0.57
ETTh
Wak
0.454
0.132.000x
10.004
0.119
149.16
220.72.004
315.344:1 1616
TimeWak 0.23740017
0,212
0.1 0.10040004
0. 0.12220002
134,83
236.08=1.a
340.36:220
Tab
0.489
0.958
0 20.56
0.010#0.04
13.97
20.52+005
4.23==093
MuJoCo
TabWak
0.270+6024
0.378
0.1 28
0.008
68.322114
93.55
228. 10
TineWak
0.089#0017
0.532e0137
0.04440021
0.008
85.69=108
56.45
123.36:14
TabWak
0.08
2.915
0.166100012
0.255
3.10ga68
-9.67
-18.642071
Energy
Tah
0. 19090
1.648 188
0.137 10.0r9
0.265
246.86
258 45
302.7% 78
TineWak
0.121 40010
1,977
0.142:40.08
0.254
231.28
245.37+2
Tab Wak
0.319#0019
6.772e0.22
0.4844a0.07
0.110
17.
268 088.672
-94.33
IMRI
TabWak
0.3174602
2.185
0.218
0. 2.100
471.86::04s
739.39:am
1014.93::0.4
TimeWak
0.199
2.006#0053
0.12240003
0. 0.100=ocoo
379,51
595.68=1.0
526.81=12.12
30

---

E,5 Watermarked dataset on downstream tasks
We implement time series forecasting and imputation as the downstream tasks, iee, taking either the real, synthetic, or watermarked synthetic data to build a diffusion model that can predict the future or missing values of time series. We compared the mean squared error (MSE) between the predicted and actual values and summarized the results in Table 11 Table The results indicate that training on watermarked synthetic data has a minimal impact on forecasting and imputation performance compared to training on non non-watermarked synthetic data.
Table 11: Results of 64-length time series forecasting that trains real and synthetic data (Synthwyo and Synthrimevar) and tests on real data with 24 timesteps forecast horizon. MSE values x10-8
Dataset
Training Data
MSE
Real
2.119
Stocks
Synthw/o
2.022
SynthTinoiaa
2.014
Real
6.678
ETTh
Synthw/o
8.541
Synthrinewak
8.655
Real
1.312
MuJoCo
Synthwyo
1.615
Synthrsmowak
1.741
Real
12.715
Energy
Synthw/o
13.480
Synthyımewax
13.717
Real
36.423
fMRI
Synthw/o 67.796
Synthramewak
67.944
Table 12: Results 64-length time series imputation that trains on real and synthetic data (Synthwyo and Synth and tests on real data with 70% missing ratio. MSE values x x10 -3
Dataset
Training Data
MSE
Real
1,020
Stocks
Synthw/o
0.855
SynthrinoWak
0.858
Real
1.526
ETTh
Synthw/o
1.842
Synthrsnewax
1.963
Real
0.101
MuJoCo
Synthw/o
0.364
SynthrıneWak
0.387
Real
7.926
Energy
Synthw/o
8.258
Synthrimewak
8.279
Real
27.439
fMRI
Synthw/o 45.412
Synthrinewax
47.349
31

---

E.6 Ablation study
To assess the effectiveness of the TimeWak, we compare its full version with three distinct variants outlined in Table [3] Table presents the quality of the watermarked time series data for sequences of length 24, and the detectability of the watermarks across lengths of 24, 64 and 128. TimeWak demonstrates a comparable quality performance and high detectability.
Table 13: List of methods, including TimeWak, to be compared.
Method
Watermarking Direction
Sampling
SpatDDIM SpatBDIA
Spatial
DDIM
Spatial
BDIA-DDIM
TempDDIM
Temporal
DDIM
TimeWak
Temporal
BDIA-DDIM
Table 14: Results of synthetic time series quality and watermark detectability, Quality metrics are for 24-length sequences. All methods are originally found in Table 13 Best results are in bold, and second-bes, are underlined.
Quality Metric
7-score
Dataset
Method
Context-FID
Correlational
Discriminative
Predictive
24-1ength
64-Jength
128-length
SpaDDDM
0.233
0.012:00s
0.127:001
0.037:ams
11.06
0.18
-1.03
Stocks
TempDDIM
SpaBBIA
0.277
10824
0.013aums
m.124
2.124gam
0.038
0.037.amm
126.97.14
25. 1440.
43.24
170.13
58. 88:892
TimeWak
0.277=0019
0.020:a003
0.120:a.099
0.038:am.0
182.10
395.34:1.4
550.05=111
SpaDDIM
0.249 socan
0.04
0.014
0.124g0m:
10.80
11.13:03:
2.29:009
SpatBDIA
0.24612015
D. 150
0.098 g001
0. 0.123go007
28. 11
40.67
47.73 47.73
ETTh
TempDDIM
0,249
0,097+0010
0.121
63,784097
102. 06
152. 12263
TimeWak
0.237
0.212
0.102
0.122
134,83:a99
236.08:1.3
340.36:20
SpaDDIM
0.001
0.476=000
0.062
0.008=amm
4.62+091
15.42=005
7.12
MuJoCo
TempDDIM
SpatBDIA
0.098
0.090a00
0.450=2007
0.491 aators
2.059
an
0.007
2.008
21.85+044
11.75a094
-0.88
18.02
25.42.000
-2.58
TimeWak
0.089:0017
0.532:0015
0.044
0.008=amm
85.69
56.45=126
123.36:144
SpaDDIM
0.135
1.814
0.142#0.013
0.253=0.00
1.55
6.75
-0.70
Energy
TempDDIM
SpatBDIA
0.110:0019
0.1 114220007
1.724
2,104
D. 20.4
0. 0.142=0002
0.253
0,254=am2
52.861055
1.72=002
63.56
3.642a90
2.24
81.4621.11
TimeWak
0.121
a.977
0.142 a0.0s
0.254zam
231.28::.45
267.53:240
245.37
SpaIDDIM
0.198
2.014=0006
0.139:0.000
0.101
90.69
61.12=037
81.31
SpaIBIA
0.188
n.974
0.124:0000
76.48.16.9
93.74=0.:
75.93
IMRI
TempDDIM
0.193
2.097=0006
0.143
0,101
381.15
617.91:435
828.89
TimeWak
0.199
2.006:0.06
0.122::0.83
0.100:a.00
379.51
595.68
526.81 11311
32

---

E.7 Challenging time series datasets
We evaluate TimeWak on additional and more challenging real-worfh datasets, (1) the ILI dataset, which records influenza- like illness cases in the United States, and (ii) the Weather dataset, which sparse and noisy. Both datasets are standard benchmarks and are used in TimesNet [30]. Results run on these datasets are shown in Table 15 where TimeWak achieves robust watermark detectability while preserving the quality of the synthetic data.
Table 15:
Results of synthetic time series quality and watermark detectability for 64-length sequences. No watermarking ('W/0') is included. Best results in bold, and second-best are underlined.
Dataset
Method
Context-FID
Correlational
Discriminative J
Predictive
Z-score 1
W/O
0,41 10.000
0.0031
0.147:+0.02
0.028
TR
1.530
0. 2.149 #0.05
0.286
0.035+0000
5.09=n06
GS
0.734+10.00
0. 1..00
0.397:10054
0.030
78.18:
Illness
HTW
0.439
2.0041
0.217:10060
0.032
7.37
TabWak
0.239
0.070
0.
0.027:10.01
-2.06=2uxM
TabWak
0.295
0.071 100035
0.1 4.1411
0.028
21.26:21.18
TimeWak
0.240
0.006
0..014
0.028
1.1003
W/O
0.647:20074
1.429
0.175=t0011
0,002-10.000
TR
3.38 +00.577
2.518 &.0.09
0..08
0.002::0.000
0.40=
GS
4.495
2. 1..14
0.446:10.008
0.002::0.000
15.36
Weather
HTW
0.712:+0.062
1.463:200098
1..001
0.002:10.000
4.82=0083
TabWak
10.00K
1.577 16.168
0.200
0.002::0.0m
-1.233=11000
TabWak
0.588
1.369 +0.099
0.108
0.002::4.0m
39.58
TimeWak
0.717+0.071
0.901:
0.1 1..84400007
0.002:10.000
205.53:1.8
E.8 TPR@0.1 FPR performance
Figure we present the TPR @0. 1FFP metric against the number samples across five datasets under 24, 64 and 128 window sizes. In most cases, TimeWak consistently outperforms other baselines, such as Gaussian Shading and Tab Wak T by achieving significantly higher TPR values. Notably, TimeWak reaches perfect 1.0 TPR @ 0.1.1 %FPR in the majority of scenarios, with 7 cases requiring only a single sample and 4 cases needing just samples, demonstrating its strong detectability with minimal data requirements.
Stocks
ETTh
MuJoCo
Energy
fMRI
Trgg0. 1ea
24-1ength
Samples
of Sumples
of Sumpias
of Sumplas
of Sumples
IV880. 188PPR
IP JSEFFR E E
64-1ength
Stmppes
Samples
Samples
Samples
Samples
12900.110 1881F.
T.R PPRgO..1EEE ISSERR
128- length
Te Stmppes
Samples
Sampless
Samples
Samples
Figure 6: TPR@0.1 1&FPR against the number of samples across five datasets under different window sizes.
OPRRO.1&FPR
33

---

E.9 TPR@0.1 %PPR on mixed dataset
We construct a mixed dataset containing equal proportions (1/3 each) of real data, synthetic data without watermarks, and synthetic data with watermarks, totaling 100 trials with window length of 64. We evaluate TPR @0.1 1FFR with 1, 10, and 20 samples per record, as shown Table T6 For comparison, we select the methods with the best detectability: GS and TabWak". The results demonstrate that TimeWak achieves 99 100% true positive rates this mixed data setting when the number of samples is 20. But GS completely fails to detect watermarks in the MuloCo dataset with 0% TPR across all sample sizes, while TabWak fails on both MuJoCo with 0% TPR and Energy datasets with 0 to 1% TPR.
Table 16: Results of TPR @0. 1FFPR on mixed dataset when the number of samples is 1, 10, and 20.
Dataset
Method
1
10 f
20 f
GS
0.33
0.87
0.99
Stocks
TabWak T
0.13
0.47
0.68
TimeWak
0.22
0.96
0.99
GS
0.43
0.98
1.0
ETTh
TabWak
0.49
0.91
0.99
TimeWak
0.38
0.92
1.0
GS
0.0
0.0
0.0
MuJoCo
TabWak T
0.0
0.0
0.0
TimeWak
0.34
0.84
0.99
GS
0.42
1.0
1.0
Energy
TabWak
0.01
0.0
0.0
TimeWak
0.32
0.97
1.0
GS
0.4
0.98
1.0
fMRI
TabWak T
0.31
1.0
1.0
TimeWak
0.26
0.97
1.0
34

---

E.10 Preservation of key signal characteristics in watermarked time series data
To assess the preservation of key signal characteristics, we add 4 additional metrics from TSG- Bench [2]: Marginal Distribution Difference (MDD), AutoCorrelation Difference (ACD), Skewness Difference (SD), and Kurtosis Difference (KD). These measures are designed to capture inter-series correlations and temporal dependencies, thereby evaluating how well the generated time series preserves the original characteristics. For all these metrics, the lower the score, the hetter. shown in Table 17 TimeWak consistently achieves scores very close to the non non-watermarked (W/O) baseline across all datasets, indicating minimal distortion introduced by the watermark.
Table 17:
Results of Marginal Distribution Difference (MDD), AutoCorrelation Difference (ACD), Skewness Difference (SD), and Kurtosis Difference (KD) for 64-length sequences.
Dataset
Method
MDD 4
ACD
SD
KD +
W/O
0.491
0.044
0.473
1.522
TR
0.881
0.445
0.759
4.408
GS
1.063
0.444
0.727
4.889
Stocks
HTW
0.491
0.044
0.473
1.522
TabWak
0.470
0.078
0.180
0.544
TabWak
0.478
0.098
0.060
0.852
TimeWak
0.431
0.068
0.103
0.295
W/O
0.176
0.421
0.255
1.359
TR
0.546
1.128
0.633
3.474
GS
0.712
1.581
0.723
2.725
ETTh
HTW
0.384
0.459
0,276
1.468
TabWak
0.211
0.532
0.245
1.422
TabWak
0.183
0.753
0.141
0.707
TimeWak
0.184
0.511
0.197
1.109
W/O
0.379
0.225
0.062
0.306
TR
1.296
1.494
0.426
1.555
GS
1.500
1.550
0.533
1.221
MuJoCo
HTW
0.941
0.434
0.076
0.287
TabWak
0.420
0,262
0.087
0.311
Wab
0.521
0.532
0.084
0.351
TimeWak
0.394
0.300
0.069
0.340
W/O
0.188
0.157
0.112
0.703
TR
0.558
0.606
0.355
1.681
GS
0.660
0.958
0.373
1.015
Energy
HTW
0.363
0.148
0.108
0.701
TabWak
0.235
0.270
0.126
0.618
TabWak
0.263
0.336
0.112
0.682
TimeWak
0.215
0,241
0.111
0.601
W/O
0.099
0.153
0.041
0.128
TR
0.447
1.356
0.066
0.428
GS
0.818
1.435
0.096
0.174
fMRI
HTW
0.452
0.151
0.048
0.133
Tab
0.126
0.159
0.043
0.138
TabWak
0.127
0,261
0.040
0.114
TimeWak
0.120
0.148
0.040
0.132
35

---

E.11
Hyperparameter evaluation
E.11.1
Intervals
Interval, also referred to as H, is one of the key hyperparameterss in our approach. Based on our experiments in Table 18 (24-length), Table [
and Table 20 (12--ength), found that setting H = 2 yields the best results across most datasets. For instance, consider the Stocks dataset, which consists of 6 features and 24 time steps. When H = 8, the number of bit templates that can be generated is 2(3x6), whereas for H = 2, the number of bit templates increases significantly to ((12x)), A lower I value allows for the generation of a greater number of bit combinations, leading to a more diverse seed distribution. However, as shown Table 20 for datasets such as fMRI, tuning H can enhance detectability while preserving the quality of the synthetic data. This could be attributed to the inherently noisy nature of the fMRI dataset, where adjusting H helps balance detectability and data fidelity.
Table 18: Results of synthetic time series quality and watermark detectability with different intervals on TimeWak. Quality metrics and Z-score are for 24-length sequences.
Dataset
Interval
Context- FID
Correlational
Discriminative
Predictive J
Z-score t
2
0.277
0.020
0. 0.120=0.399
0.038=00000
182.10
Stocks
4
0.419
0.006
0.162::0.22
0.039=0.000
202,45
8
1.006
0.013
0.197
0.041=0.000
216.56:1143
2
0.237-10011
0.2
0.102:=0014
0.122
134.83-2095
ETTh
4
0..03
0.435=20047
0.113=2018
0.130
166.50+1.27
0.925+0.140
0.576=00022
0.150=0014
0.135
167.54+1.36
2
0.089
135
0.044=00021
0.008=00001
85,69#1.08
MuJoCo
4
0.148
0.739
0.087
0.007
71.95
0.322710.00
1.1799t0.66
0.177:0001
0.0091.0002
76.90:11.29
2
0.121 10:016
1.977=0750
0..42
0.254
231.28
Energy
086
3.315
10111
0.2542.0000
266.77+11.99
8
0..63=0.093
5.402
0.184
0.255 =0.000
279.40+11.0
0.109
2.006
0.122
0.100
379.51
fMRI
4
0.191 1:0003
2.117:00124
0.125:00.044
0.101 1:0000
464.70.10.2
8
0.004
2.354
0.171 #0043
0.103
506.95
Table 19: Results of synthetic time series quality and watermark detectability with different intervals on TimeWak. Quality metrics and Z-score are for 64-length sequences.
Dataset
Interval
Context-FID |
Correlational
Discriminative
Predictive J
Z-score t
2
0.387
0.017
0.092=0001
0.037=0.000
395.34+1.4
Stocks
4
0.4666a0.09
0.00
0.077
0.037=0.000
397.68+131
8
1.053
0.017=0013
0.155
0.037
406.56+1.77
2
0.297+0.0s
0.1
0.097-2015
0.115
236.08:1.6
ETTh
0.514
0.335=0000
0.098=0001
0.119
272.70+1.79
8
0,911 10.048
0.540=00000
0.147=00.5
0.123
268. 148.14
2
0..084
0.413
0.038=0021
0.007
56.45
MuJoCo
00.004
0.522
0.08
10.00220002
58.75
8
0.338
0.7
0.059
0.007
68,29
0..03
1.662=0228
0.145=0019
0,251 100.000
267.53++2.0
Energy
4
+..017
2.760
0.150=0011
0.252=00000
289.07+22.7
8
0.407 +0.087
4.285 0.229
0.170=0002
0.252=0.000
345,97+3348
0,441 10.0ss
0.786=2003
0.3142204
0. 2000000000
595.68+1.45
IMRI
4
0.425 +00027
1.834=0.112
0.273-2076
0. 10000.0000
749. 10:1100
8
0.469
1.823
0.294=0.41
0. 0.100=0..00
817.23+1.20
36

---

Table 20: Results of synthetic time series quality and watermark detectability with different intervals on TimeWak. Quality metrics and Z-score are for 128-length sequences.
Datasct
Interval
Context-FID +
Correlational
Discriminative
Predictive +
Z-score 1
2
0.316200M
0.021+
0. 0..40
0.037=00000
550.05
Stocks
4
0.410 104
0.019+0am7
0.140
0.037
571.5441..22
8
1.132
0.035
0.217:0019
0.038
59..41
2
1.090=0.100
4.105
0.174-10.007
0.1 0.100
340.36:a2.06
ETTh
4
1. 10
0.333+t0054
0.173++002
1.11422oos
374.69
8
1. 1.83820.009
0.497:10044
0.17340021
0.1 16220003
392.83
2
00006
0.316:+0.022
0.046++0.300
0.005
123.36
MuloCo
4
0..02
0,410+00057
0,083++0011
0.006:20.000
8
0.330=20077
0.685+00055
0. 0.002
0.006:20.002
170.77
2
0. 0.027
1.687=t0.28
0. +.00
0.249
245.37
Energy
4
0.261 #0,025
3.246:10345
0.1 1.1114:0.000
0.250
354.38
8
0.506
4.550
0. 0.147::0.00
0.25 0.251::00 =00000
395.20
2
0.855=20072
1. 1.704
0.228
0. n.100
526.8 13.122
IMRI
4
0.
1. 1..00
0.348
0.100
1022.29 29
0.866 8
1. 40.050
0.345
0.100
1097.78
E.11.2 Bits
We perform an empirical validation of the expected bit accuracy using simulations. Specifically, we set the synthetic time series data size 24 time steps (window length) and 10 features, and evaluate the watermarking and detection pipeline using TimeWak. this experiment, we intentionally omit both the forward diffusion and reverse (inversion) diffusion processes to focus solely the effect of noise during reconstruction. Instead, we simulate the reconstruction noise directly by adding noise to the clean initial noise.
generate initial samples using our watermarking method and simulate reconstruction error by adding noise with feature-specific means sampled from (0, and a shared variance This results a noise distribution of (Nu o)) per feature, where fy (0,5). We then apply watermark detection to the perturbed samples and compute the average bit accuracy.
We run the simulation using 100,000 samples, grouped into trials of 2,000 samples each. This process is repeated across 50 independent rounds to compute the average bit accuracy. Figure 7 shows the results we get. We observe that larger L leads higher bit accuracy, indicating better detectability. In addition, we evaluate a "transposed" version of TimeWak, denoted as Timewak where the chained hash is applied along the feature dimension instead of the time axis. We find that the bit accuracy of this variant remains close to 0.5 and is significantly lower than that of the original TimeWak. This simulation further validates the importance of applying the watermark along the time axis, rather than across features, to ensure reliable detection.
Additionally, we present the values of bit-length L used across different experiments in Table 21 For bit-lengths greater than 2, we applied the valid bit mechanism from [41]. In general, a larger L tends improve watermark detectability. This because, during bit accuracy calculation, larger places more emphasis on the tail bits, which are less likely to be affected by reconstruction errors or noise. However, increasing also leads to lower sample quality, as it involves modifying more of the initial noise, making it deviate further from a standard Gaussian distribution. Our results show this trade-off holds across most scenarios, with the exception of the Stocks dataset.
37

---

L=2
0.9
L-3
L-1
TimeWak
TimeWak'
Average Bit Accuracy
0.7
0.5
3
4
0
Figure 7: Average bit accuracy of different bit-length L.
Table 21: Results of synthetic time series quality and watermark detectability with different bits TimeWak. Quality metries and Z-score are for 24-length sequences.
Dataset
Bit
Context-FID |
Correlational
Discriminative &
Predictive |
Z-score 1
0.277=0011
0.020#0018
0.120=0.039
0.038
182, 10=0.3
Stocks
3
10.09
0.024:00119
0.000
0.038
194.87
0.328=0.110
0.023
0.155+0.027
0.038
182.58-0.33
2
0.207
0.212+0.043
0.102+00014
0.122++0.00
134.83=0.55
ETTh
3
0,21 1 10.000
0.206
10.003
0.124
162.25
4
0.238
0.225
0.095
0.004
149.74=0.66
2
0.089
0.532
0.044
0.008
85.69
MuJoCo
0.092+0.022
0.520=0.105
0.054+00014
0.008
73.09
0.099 4
0.504
0.056
0.007
6..67
2
0. 1.0016
1.977
0.142
0.254
231.28
Energy
3
0.121 :0.014
1.799
0.156=00023
0.254
268.24=1.69
0.1143.0.00
1.721 103477
0.155
0.254-10.000
269.83
2
0.199
2.006+0.053
0.122++0033
0.100++0.000
379.51
IMRI
3
0.0000
1.987-0007
0. 1..03
0.101 10.0000
456.02
4
0.183
2.032+0.030
0.111
0.101++.000
440.88
38

---

Table 22: Results of synthetic time series quality and watermark detectability with different bits on TimeWak. Quality metries and Z-score are 64-length sequences.
Dataset
Bit
ContexI-FID + Correlational
Discriminative +
Predictive +
Z-score 1
0.387
0.017
0.092
0.037
395.34=1.24
Stocks
3
1..02
0.004
0.121:0.00
0,037
334.15 0049
4
0.251 +0.05
0.014
0.095
0.037++0000
309.59=0.39
2
0.297 10.00
0.133
0.097
0.115 100003
236.08 1.63
ETTh
3
0.349
0.182200:36
0.
+0.003
249.67=1A1
4
0.365 10031
0.185
0.102
0.11310.007
261.13=1.20
2
0.108 10014
0.413 10,062
0.038
0,007 100001
56.45 1.26
MuJoCo
0.136+00012
0.4
0.073+0018
0.007=+0.00
84.07=148
0.126
0.381
0.036:10.330
0.007 ::0001
96.73
0. 09.01
1.66240.296
0.145
=000000
267.53
Energy
3
1..027
10.44
0.16510.00
0.25 1 110.000
323.04
0. 0.143
1.460+0.554
0.152+00023
0.25 +000000
322.38-2.25
2
0.44 +0.035
1.786+00043
0.3 0.314
0.100=+0.000
595.68-1.03
fMRI
3
10.024
10.024
1..02
0.216:10175
0.100.10.000
724.69
4
0.440=0.027
1.783+00033
0.256=00100
0. 0.100=#0.000
712.67=0.99
Table 23: Results of synthetic time series quality and watermark detectability with different bits TimeWak. Quality metrics and Z-score are for 128-length sequences.
Dataset
Bit
Context-FID 4
Correlational +
Discriminative +
Predictive 4
Z-score f
2
0.316
0.021 10.24
0. 1..009
0.037 1.0000
550.05 1.18
Stocks
3
1.050
0.019
0. 1...0000
0.007
459,23
0.0017 4
0.017=0.200
0.134:1.000
0.037=00000
427.53=1023
2
1.090
0.135
0.174410.07
0.110.20.009
340.36-12.06
ETTh
3
1.111 100137
0..41
0.103
0.118=00.006
352,26=1163
4
1. 13.
0.233
(). 166
0.1
362.55
2
0.155
0.316=0.022
0,046#t0.030
0.005
123,36
MuJoCo
3
0..17
0.062410011
0.005
183,47
4
0.150
0.349
0.051
0.006=00.00
174,45
2
0.148
1.687
0. 10.0070
0.049
245.37
Energy
3
0.230+0003
1.15420:446
0. 06.
0.049
380.35
4
0.167
1.700
0.168
0.249 =0.001
389.26
2
0.855
1.70420000
0.298
0.100 00000000000
526.8 13.12
fMRI
3
0.819
0.0
0.374
0.100
986.17
4
0.028
1.71320020
0.336
0.100 00000000000
967.53-10096
39

---

E.12 Watermark detection overhead
To evaluate the practical feasibility of real-time deployment, we measure the watermark detection overhead for TimeWak using a single NVIDIA L40S GPU and Intel(R) Xeon(R) Platinum 8562Y++ CPU. Table224 presentss the computational overhead for watermark detection across different datasets and configurations. The results demonstrate that detection overhead remains consistently low, ranging from approximately 1.5 to seconds depending on the dataset complexity and batch size. We consider this overhead acceptable for streaming scenarios, particularly given the security benefits provided by the watermarking system. Adapting the hashing mechanism to handle variable-length sequences without padding represents promising direction for future research that could further enhance the method's applicability to diverse real-world scenarios.
Table 24: Watermark detection overhead in seconds for TimeWak when the batch size is and 100.
Dataset
Window Size
100)
24
1.58
2.09
Stocks
64
1.50
2.27
128
1.55
2.59
24
1.72
2.23
ETTh
64
1.64
2.41
128
1.63
2.62
2.96
3.84
MuJoCo
64
2.90
4.25
128
2.90
4.49
24
3.89
5,22
Energy
64
3.88
5.73
128
3.89
6.58
24
4.69
6.31
IMRI
4.75
7.00
128
4.81
7.47
40

---

Synthetic samples
Figures show synthetic time series generated unconditionally by Diffusion-TS with/without watermark embedding. Each figure corresponds to one of the following datasets: Stocks, ETTh, MuloCo, Energy, and fMRI. Within each figure, the columns represent the following algorithms: no watermark, TimeWak, TabWak, Gaussian Shading, and Tree-Ring watermarks. Up to 4 features are randomly selected from each dataset.
Without Watermarking
TimeWak
Tree-Ting
26
23
04
120
Figure 8: Non-watermarked (leftmost column) and watermarked (remaining columns) time series generated by TimeWak, TabWak, Gaussian Shading, and Tree-Ring watermarking for the Stocks dataset.
Without Watermarking
TimeWak
TabWask
Gaussian Sheding
Tree-Ring
24
13
15
15
23
2
lingth
04
120geh
185
Figure 9: Non-watermarked (leftmost column) and watermarked (remaining columns) time series generated by TimeWak, TabWak, Gaussian Shading, and Tree-Ring watermarking for the ETTh dataset.
Without Watermarking
TimeWak
TabWakk
Goussion Shading
Tree-Ring
lougts
leapth
120 longth
42
14
14
137
12
54
137
54
120
Figure 10: wontwaaermrreed (leftmost column) and watermarked (remaining columns) time series
generated by TimeWak, TabWak, Gaussian Shading, and Tree-Ring watermarking for the MuloCo dataset.
41

---

Without Watermarking
TimeWak
TabWakk
Goussion Shading
Tree-Ring
longtt
64lcpp
120 Longgt...
84
137
54
137
51
120
127
Figure 11: Non- aoderatermarked (leftmost column) and watermarked (remaining columns) time series generated by TimeWak, TabWak, Gaussian Shading, and Tree-Ring watermarking for the Energy dataset.
Without Watermarking
TimeWak
TabMak
Goussion Shading
Tree-Ring
20
leleaghh
120 lmngt
150
155
45
41
17
41
100
125
Figure 12: Non- -oneraaterrreed (leftmost column) and watermarked (remaining columns) time series generated by TimeWak, TabWak, Gaussian Shading, and Tree-Ring watermarking for the fMRI dataset.
42


Reviews:
[{"review_id": "oWc1HMAVwI", "reviewer": "Reviewer_j3Fa", "summary": "This paper introduces TimeWak, a novel watermarking algorithm designed specifically for multivariate time series generated by diffusion models. Unlike existing approaches that operate in latent space, TimeWak embeds watermarks directly in the real-valued temporal-feature space, addressing the unique challenges of temporal dependencies and feature heterogeneity. The method employs a temporal chained-hashing mechanism combined with feature-wise permutation to maintain temporal consistency and watermark robustness. To improve detectability, the authors introduce an ϵ-exact inversion approach based on a modified bidirectional DDIM process, providing theoretical error bounds for reconstruction. Extensive evaluations across five datasets demonstrate TimeWak's effectiveness in preserving data utility, enhancing watermark detectability, and maintaining robustness under various post-editing attacks.", "questions": "Please see the weaknesses", "limitations": "yes", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "$\\textbf{Strengths:}$\n\n1 -- The paper addresses a clear and underexplored gap in the field, watermarking of synthetic multivariate time series generated in real space by diffusion models, where latent-space methods fail. This positions the work as a timely and relevant contribution.\n\n2 -- The introduction of temporal chained-hashing combined with feature-wise seed permutation presents a novel watermarking strategy that explicitly accounts for the temporal and heterogeneous nature of time series data. The integration of ϵ-exact inversion using BDIA adds theoretical depth to the detection mechanism.\n\n3 -- The authors conduct extensive empirical analysis across five datasets and multiple post-editing attacks, comparing against both native and adapted state-of-the-art baselines. The results convincingly demonstrate the method’s superior trade-off between watermark detectability and data quality.\n\n$\\textbf{Weaknesses:}$\n\n1 -- Although the paper evaluates robustness against various post-processing operations, it does not provide a formal security analysis or define an adversarial threat model. Critical aspects such as watermark forgery, key leakage, or deliberate evasion by a knowledgeable attacker are not addressed. Given that this is one of the first works on time-series watermarking in diffusion models, evaluating such adversarial robustness is essential to fully establish the method’s practical reliability and trustworthiness.\n\n2 -- While the paper presents a thorough set of experiments, all evaluations are conducted on synthetic datasets using controlled, predefined attacks. The method is not tested in more realistic scenarios, such as when synthetic and real time series are mixed together (as often happens in training or deployment), or when the data is used in downstream tasks involving human interpretation or decision-making. Without such evaluation, it is unclear how well the method would perform in practical, real-world settings.\n\n3 -- As far as I understand, all the datasets used in the experiments are structured, regularly sampled, and relatively clean. There is no evaluation on noisy, sparse, or irregularly sampled time series, which are common in real-world domains like healthcare, IoT, or sensor networks. This raises concerns about how well TimeWak would generalize to such challenging and realistic data conditions.\n\n4 -- The paper does not evaluate how watermarking affects the preservation of key signal characteristics in time series data, such as trends, seasonality, or anomalies. In domains like healthcare or finance, where subtle temporal patterns are crucial for downstream tasks, even minor distortions could impact the reliability of model outputs. Without such analysis, it is unclear whether the method maintains the integrity of information needed for sensitive or high-stakes applications.", "was_revised": true, "final_justification": "The rebuttal addressed my main concerns through substantial new experiments: (i) robustness against a knowledgeable adversary via a DiffPure-based reconstruction attack, (ii) strong performance in realistic mixed-data scenarios, (iii) negligible impact on downstream forecasting and imputation tasks, (iv) resilience on challenging noisy/sparse datasets, and (v) preservation of key temporal characteristics. The only remaining gap is the absence of a formal threat model and human-in-the-loop evaluation, which I consider suitable for future work. Given the strengthened empirical evidence and practical relevance, I recommend acceptance.", "rebuttal": "Thank you for your valuable comments and positive feedback.\n\n### Weaknesses\n**[W1] Lack of formal security analysis.**\n\n[WA1] Thank you for raising this important point. We agree that conducting a formal security analysis against knowledgeable adversaries is a crucial next step for this research. In this paper, we also implemented and evaluated a reconstruction attack in Appendix E.2.2 based on the DiffPure [1]. In this attack scenario, we assume the adversary has direct access to the diffusion model and attempts to use it to perform reconstruction-based watermark removal. As demonstrated in Table 8, our watermarking scheme maintains robust performance even under this adversarial setting.\n\n**[W2] Test on more realistic scenarios, or when the data is used in downstream tasks.**\n\n[WA2] To address your concerns, we conducted the following additional experiments:\n1) True positive rate evaluation in a mixed data setting\n2) Evaluation on more downstream tasks\n\nWe constructed a mixed dataset containing equal proportions (1/3 each) of real data, synthetic data without watermarks, and synthetic data with watermarks, totaling 100 trials with a window length of 64. We evaluated TPR\\@0.1% FPR with 1, 10, and 20 samples per record, as shown in Table A. For comparison, we selected the methods with the best detectability: GS and TabWak$^\\top$. The results demonstrate that TimeWak achieves 99-100% true positive rates in this mixed data setting when the number of samples is 20. But GS completely fails to detect watermarks in the MuJoCo dataset (0% TPR across all sample sizes), while TabWak$^\\top$ fails on both MuJoCo (0% TPR) and Energy datasets (0-1% TPR).\n\n*Table A: Results of TPR\\@0.1% FPR on mixed dataset when number of samples are 1, 10, and 20.*\nDataset|Method|1 (↑)|10 (↑)|20 (↑)\n---|---|---|---|---\nStocks|GS|**0.33**|0.87|**0.99**\n||TabWak$^\\top$|0.13|0.47|0.68\n||TimeWak|0.22|**0.96**|**0.99**\nETTh|GS|0.43|**0.98**|**1.0**\n||TabWak$^\\top$|**0.49**|0.91|0.99\n||TimeWak|0.38|0.92|**1.0**\nMuJoCo|GS|0.0|0.0|0.0\n||TabWak$^\\top$|0.0|0.0|0.0\n||TimeWak|**0.34**|**0.84**|**0.99**\nEnergy|GS|**0.42**|**1.0**|**1.0**\n||TabWak$^\\top$|0.01|0.0|0.0\n||TimeWak|0.32|0.97|**1.0**\nfMRI|GS|**0.4**|0.98|**1.0**\n||TabWak$^\\top$|0.31|**1.0**|**1.0**\n||TimeWak|0.26|0.97|**1.0**\n\nDue to time limitations, we are unable to evaluate downstream tasks that involve human interpretation or decision-making. For instance, in a time series classification task, models are typically trained on labeled datasets. While our approach can generate large amounts of watermarked synthetic time series data, the corresponding labels for these synthetic sequences are not available, making it infeasible to use them directly for training in such tasks. Hence, for the downstream tasks evaluation, we assessed the utility of watermarked synthetic data on real-world forecasting and imputation tasks. Models were trained on different data types (real, synthetic without watermark, and synthetic with TimeWak watermark) and tested on real data.\n\nTables B and C show that synthetic data with our watermark achieves comparable MSE performance to non-watermarked synthetic data in both forecasting and imputation tasks, demonstrating that our watermarking method preserves data utility.\n\n*Table B: Results of time series forecasting that train on real and synthetic data and test on real data with a 24 timesteps forecast horizon. MSE values ($×10^{-3}$).*\nDataset|Training Data|MSE $×10^{-3}$ (↓)\n---|---|---\nStocks|Real|2.119\n||Synth$_{\\mathrm{W/O}}$|2.022\n||Synth$_{\\mathrm{TimeWak}}$|2.014\nETTh|Real|6.678\n||Synth$_{\\mathrm{W/O}}$|8.541\n||Synth$_{\\mathrm{TimeWak}}$|8.655\nMuJoCo|Real|1.312\n||Synth$_{\\mathrm{W/O}}$|1.615\n||Synth$_{\\mathrm{TimeWak}}$|1.741\nEnergy|Real|12.715\n||Synth$_{\\mathrm{W/O}}$|13.480\n||Synth$_{\\mathrm{TimeWak}}$|13.717\nfMRI|Real|36.423\n||Synth$_{\\mathrm{W/O}}$|67.796\n||Synth$_{\\mathrm{TimeWak}}$|67.944\n\n*Table C: Results of time series imputation that train on real and synthetic data and test on real data with 70% missing ratio. MSE values ($×10^{-3}$).*\nDataset|Training Data|MSE $×10^{-3}$ (↓)\n---|---|---\nStocks|Real|1.020\n||Synth$_{\\mathrm{W/O}}$|0.855\n||Synth$_{\\mathrm{TimeWak}}$|0.858\nETTh|Real|1.526\n||Synth$_{\\mathrm{W/O}}$|1.842\n||Synth$_{\\mathrm{TimeWak}}$|1.963\nMuJoCo|Real|0.101\n||Synth$_{\\mathrm{W/O}}$|0.364\n||Synth$_{\\mathrm{TimeWak}}$|0.387\nEnergy|Real|7.926\n||Synth$_{\\mathrm{W/O}}$|8.258\n||Synth$_{\\mathrm{TimeWak}}$|8.279\nfMRI|Real|27.439\n||Synth$_{\\mathrm{W/O}}$|45.412\n||Synth$_{\\mathrm{TimeWak}}$|47.349\n\n**[W3] Evaluate on challenging time series datasets.**\n\n[WA3] We initially considered the fMRI dataset as a realistic dataset, as it is high-dimensional, noisy, and has complex temporal dependencies. However, as you raise a valid point on realistic conditions, we evaluate TimeWak on 2 additional and more challenging real-world datasets, (i) the ILI dataset, which records influenza-like illness cases in the United States, and (ii) the Weather dataset, which is sparse and noisy. Both datasets are standard benchmarks, and are used in TimesNet [2]. Results run on these datasets are shown in Table D, where TimeWak achieves robust watermark detectability while preserving the quality of the synthetic data.\n\n*Table D: Results of synthetic time series quality and watermark detectability for 64-length sequences.*\nDataset|Method|Context-FID (↓)|Correlational (↓)|Discriminative (↓)|Predictive (↓)|Z-score (↑)\n---|---|---|---|---|---|---\nILI|W/O|0.411|0.073|0.147|0.028|-\n||TR|1.530|0.149|0.286|0.035|5.09\n||GS|0.734|0.159|0.397|0.030|78.18\n||HTW|0.439|**0.069**|0.217|0.032|7.37\n||TabWak|**0.239**|0.070|0.131|**0.027**|-2.06\n||TabWak$^\\top$|0.295|0.071|0.114|0.028|21.26\n||TimeWak|0.240|0.076|**0.111**|0.028|**151.03**\nWeather|W/O|0.647|1.429|0.175|0.002|-\n||TR|3.381|2.518|0.388|**0.002**|0.40\n||GS|4.495|2.194|0.446|**0.002**|15.36\n||HTW|0.712|1.463|0.190|**0.002**|4.82\n||TabWak|0.751|1.571|0.200|**0.002**|-1.23\n||TabWak$^\\top$|**0.588**|1.369|**0.178**|**0.002**|39.58\n||TimeWak|0.717|**0.951**|0.184|**0.002**|**205.53**\n\n**[W4] Evaluate how watermarking affects the preservation of key signal characteristics in time series data.**\n\n[WA4] Thanks for pointing this out. To assess the preservation of key signal characteristics, we added 4 additional metrics from TSGBench [3]: Marginal Distribution Difference (MDD), AutoCorrelation Difference (ACD), Skewness Difference (SD), and Kurtosis Difference (KD). These measures are designed to capture inter-series correlations and temporal dependencies, thereby evaluating how well the generated time series preserves the original characteristics. For all these metrics, the lower the score, the better. As shown in Table E, TimeWak consistently achieves scores very close to the non-watermarked (W/O) baseline across all datasets, indicating minimal distortion introduced by the watermark.\n\n*Table E: Results of 4 additional metrics for 64-length sequences.*\nDataset|Method|MDD (↓)|ACD (↓)|SD (↓)|KD (↓)\n---|---|---|---|---|---\nStocks|W/O|0.491|0.044|0.473|1.522\n||TR|0.881|0.445|0.759|4.408\n||GS|1.063|0.444|0.727|4.889\n||HTW|0.491|**0.044**|0.473|1.522\n||TabWak|0.470|0.078|0.180|0.544\n||TabWak$^\\top$|0.478|0.098|**0.060**|0.852\n||TimeWak|**0.431**|0.068|0.103|**0.295**\nETTh|W/O|0.176|0.421|0.255|1.359\n||TR|0.546|1.128|0.633|3.474\n||GS|0.712|1.581|0.723|2.725\n||HTW|0.384|**0.459**|0.276|1.468\n||TabWak|0.211|0.532|0.245|1.422\n||TabWak$^\\top$|**0.183**|0.753|**0.141**|**0.707**\n||TimeWak|0.184|0.511|0.197|1.109\nMuJoCo|W/O|0.379|0.225|0.062|0.306\n||TR|1.296|1.494|0.426|1.555\n||GS|1.500|1.550|0.533|1.221\n||HTW|0.941|0.434|0.076|**0.287**\n||TabWak|0.420|**0.262**|0.087|0.311\n||TabWak$^\\top$|0.521|0.532|0.084|0.351\n||TimeWak|**0.394**|0.300|**0.069**|0.340\nEnergy|W/O|0.188|0.157|0.112|0.703\n||TR|0.558|0.606|0.355|1.681\n||GS|0.660|0.958|0.373|1.015\n||HTW|0.363|**0.148**|**0.108**|0.701\n||TabWak|0.235|0.270|0.126|0.618\n||TabWak$^\\top$|0.263|0.336|0.112|0.682\n||TimeWak|**0.215**|0.241|0.111|**0.601**\nfMRI|W/O|0.099|0.153|0.041|0.128\n||TR|0.447|1.356|0.066|0.428\n||GS|0.818|1.435|0.096|0.174\n||HTW|0.452|0.151|0.048|0.133\n||TabWak|0.126|0.159|0.043|0.138\n||TabWak$^\\top$|0.127|0.261|**0.040**|**0.114**\n||TimeWak|**0.120**|**0.148**|**0.040**|0.132\n\n\n### References\n[1] Nie, Weili, et al. \"Diffusion models for adversarial purification.\" ICML, 2022.\n\n[2] Wu, Haixu, et al. \"TimesNet: Temporal 2D-Variation Modeling for General Time Series Analysis.\" ICLR, 2023.\n\n[3] Ang, Yihao, et al. \"TSGBench: Time Series Generation Benchmark.\" Proc. VLDB Endow. 17, 3 (2023), 305–318."}, {"review_id": "TWX0Vts2gX", "reviewer": "Reviewer_gwg6", "summary": "In this work, the authors propose a novel watermarking method for multivariate time series diffusion models. This method embeds watermarks directly in the real space of time series data. It leverages a temporal chained-hashing scheme to recover watermarks robustly and accurately. The approach is evaluated against five strong baselines on five datasets. The results demonstrate the effectiveness.", "questions": "See the weakness", "limitations": "Yes", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "The paper introduces a novel temporal chained-hashing scheme that accounts for both feature heterogeneity and temporal dependencies in time series data. This chaining mechanism, combined with feature permutation, provides strong resilience against inversion errors and post-processing attacks.\n\nHowever, the approach relies on fixed-length intervals for seed chaining, which may limit its adaptability to time series with irregular event distributions or variable-length sequences—particularly in streaming applications.\n\nAlthough TimeWak demonstrates superior performance over existing baselines, most of the comparisons involve methods originally designed for image or tabular data (e.g., TabWak, GS). Incorporating evaluations against more recent or time series-specific watermarking techniques would further strengthen the empirical validation.", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your valuable comments and positive feedback.\n\n### Weaknesses\n\n**[W1] Rely on fixed-length intervals during seed chaining.**\n\n[WA1] We acknowledge this limitation in the paper (Lines 308-311). While the current implementation uses fixed-length windows for simplicity, the core mechanism of temporal chained hashing is inherently adaptable. For streaming data applications, it can be readily deployed using a sliding-window approach, where a model generating fixed-length output sequences embeds watermarks for each temporal window. To evaluate the practical feasibility of real-time deployment, we measured the watermark detection overhead using a single NVIDIA L40S GPU and Intel(R) Xeon(R) Platinum 8562Y+ CPU. Table A presents the computational overhead for watermark detection across different datasets and configurations. The results demonstrate that detection overhead remains consistently low, ranging from approximately 1.5 to 7.5 seconds depending on the dataset complexity and batch size. We consider this overhead acceptable for streaming scenarios, particularly given the security benefits provided by the watermarking system. Adapting the hashing mechanism to handle variable-length sequences without padding represents a promising direction for future research that could further enhance the method's applicability to diverse real-world scenarios.\n\n*Table A: Watermark detection overhead in seconds for TimeWak.*\nDataset|Window Size| Batch Size = 1 (sec.)|Batch Size = 100 (sec.)\n---|---|---|---\nStocks|24|1.58|2.09\n||64|1.50|2.27\n||128|1.55|2.59\nETTh|24|1.72|2.23\n||64|1.64|2.41\n||128|1.63|2.62\nMuJoCo|24|2.96|3.84\n||64|2.90|4.25\n||128|2.90|4.49\nEnergy|24|3.89|5.22\n||64|3.88|5.73\n||128|3.89|6.58\nfMRI|24|4.69|6.31\n||64|4.75|7.00\n||128|4.81|7.47\n\n**[W2] Compare with more recent or time series-specific watermarking methods.**\n\n[WA2] This is a valid point. We felt it was a necessary choice, as TimeWak's novelty is being the first time series generation watermarking scheme for diffusion models operating in data space, meaning there are no direct baselines for time series diffusion models. To make the evaluation more fair, we devised a two-part comparison strategy:\n\n1. Against State-of-the-Art Watermarking Methods: We adapted the most prominent and recent watermarking methods from other domains. Tree-Ring [1] and Gaussian Shading [2] are state-of-the-art for image diffusion models, while TabWak [3] is the leading method for tabular data. By creating a stronger, time series-specific version of TabWak (TabWak$^\\top$), we ensured the most rigorous comparison possible against the closest existing paradigms.\n\n2. Against Time Series-Specific Methods: We also compared TimeWak against Heads-Tails Watermark (HTW) [4], a post-processing watermarking method designed specifically for time series. Our results consistently show that TimeWak provides significantly higher watermark detectability and robustness against attacks (Tables 1 & 2 in the paper) compared to HTW.\n\nThis comprehensive comparison demonstrates that TimeWak performs better than SotA watermarking methods adapted from other modalities and post-processing time series-specific watermarking methods.\n\n### References\n[1] Wen, Yuxin, et al. \"Tree-Rings Watermarks: Invisible Fingerprints for Diffusion Images.\" NeurIPS, 2023.\n\n[2] Yang, Zijin, et al. \"Gaussian Shading: Provable Performance-Lossless Image Watermarking for Diffusion Models.\" CVPR, 2024.\n\n[3] Zhu, Chaoyi, et al. \"TabWak: A Watermark for Tabular Diffusion Models.\" ICLR, 2025.\n\n[4] N.J.I. van Schaik. \"Robust Watermarking in Large Language Models for Time Series Generation.\" Thesis, Delft University of Technology, 2024."}, {"review_id": "CForHZdC1g", "reviewer": "Reviewer_U6K7", "summary": "This work proposes TimeWak, the first sampling-time watermarking scheme for multivariate time series diffusion models. The method introduces a temporal chained-hashing scheme that embeds watermark seeds along the temporal dimension. In addition, it leverages ε-exact inversion to address inconsistencies in DDIM inversion. Experimental results demonstrate the effectiveness of TimeWak on multivariate time series data.", "questions": "1.\tPlease clarify difference from prior work, particularly in distinguishing its temporal chained-hashing and ε-exact inversion components from existing methods such as TabWak or BDIA-based inversion techniques.\n2.\tThe ε-exact inversion assumption relies on the Lipschitz continuity of the noise estimator, which may not hold in practice—especially for time series data with abrupt transitions, feature scale heterogeneity, or distributional shifts between training and inference. For example, real-world datasets such as medical records may contain mixed feature types (e.g., binary gender and continuous income), or neurological signals like fMRI may include sudden pathological events (e.g., seizure episodes), where small input perturbations can lead to disproportionately large changes in the estimated noise. A discussion or empirical analysis of failure modes under such scenarios would be helpful.\n3.\tOn the fMRI dataset, TabWak⊤ outperforms TimeWak in several Z-score metrics. Could you explain why TimeWak underperforms in this setting? Are there certain types of time series (e.g., low-signal or highly correlated) where your method is less effective?", "limitations": "Yes", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 2, "originality": 2, "strengths_and_weaknesses": "Strengths:\n\n1.\tThe proposed method effectively tackles the watermarking problem in multivariate time series data, a scenario where existing techniques for watermarking diffusion models or tabular data fall short.\n2.\tThis work conducts an in-depth analysis of watermarking multivariate time series, revealing unique challenges such as spatial heterogeneity and temporal dependence, and design a tailored solution accordingly.\n3.\tTheoretical analysis combined with extensive experimental results demonstrates the effectiveness and robustness of the proposed method for the target task.\n\nWeaknesses:\n\n1.\tAlthough TimeWak is the first sampling-time watermarking scheme for multivariate time series diffusion models, the main components: ε-exact inversion and chained-hashing, conceptually resemble existing techniques used in image and tabular watermarking methods such as TabWak, which raises concerns about the technical novelty and methodological complexity of the proposed approach.\n\n2.\tWhile the authors mention that the method \"can be applied to streaming scenarios,\" it relies on access to the diffusion model’s inversion process, as well as full-sequence segmentation and predefined hash functions. These assumptions make deployment in practical, streaming, or black-box settings quite challenging.\n\n3.\tOn the fMRI dataset, TimeWak performs worse than TabWak in terms of both robustness and detection accuracy, which raises the question of whether the proposed approach might underperform in real-world or specialized domains compared to existing techniques.\n\n4.  The ε-exact inversion assumption relies on the Lipschitz continuity of the noise estimator, which may not hold in practice. The paper does not clearly explain the magnitude of this bound, nor whether it meaningfully impacts detection performance in practice.", "was_revised": true, "final_justification": "After carefully reading the authors’ rebuttal and the other reviewers’ comments, I find that the authors have addressed my questions and largely alleviated my concerns. Based on this, I will raise my rating.", "rebuttal": "Thank you for your valuable comments.\n\n### Weaknesses and Questions\n**[W1/Q1] Clarify differences from prior works (TabWak or BDIA).**\n\n[WA1/QA1] Thanks for pointing this out. The main differences are as follows:\n\n- With TabWak:\n\n    First, they operate in different spaces. TabWak is designed for the latent space, where reconstruction error is dominated by the autoencoder. In contrast, TimeWak operates directly in the real data space, where error stems from the diffusion inversion process itself. This critical difference motivates our use of a modified Bi-directional Integration Approximation (BDIA), which is specifically designed to minimize this diffusion inversion error and significantly improves detectability, as validated by our ablation study in Appendix E.5 (Table 12).\n\n    Second, the original TabWak employs a self-cloning mechanism which copies half of the watermark seed, a method that perturbs the initial noise distribution. In contrast, our temporal chained-hashing mechanism is designed to better preserve the statistical properties of the initial noise, resulting in higher-quality synthetic data.\n\n    Finally, TabWak verifies the watermark along the feature axis. Our analysis reveals that reconstruction error is unevenly distributed across features, which compromises detection reliability. By performing our chained-hashing along the more stable time axis, TimeWak directly mitigates the impact of this uneven error distribution, leading to demonstrably better watermark detectability.\n\n- With BDIA:\n\n    Standard BDIA assumes exact knowledge of $x_1$, which is unavailable in practical watermark detection. Our $\\epsilon$-exact adaptation approximates $x_1 \\approx x_0$, introducing controlled error bounds that standard BDIA cannot handle. Theorem 3.1 provides theoretical guarantees for this approximation. Our contribution quantifies how approximation errors propagate through the inversion process, enabling reliable watermark detection despite imperfect inversion.\n\n    We generated 10,000 samples (length 64) across five datasets, computing $x_0$ and $x_1$. Results in Table A show consistently small $L_1$ norms between $x_1$ and $x_0$ (avg: 5.1-7.0e-03, max: <0.23), validating our $\\epsilon$-exact approximation. These empirically small errors confirm Theorem 3.1's theoretical bounds and demonstrate reliable watermark detection despite the approximation.\n\n*Table A: $L_1$ norms between $x_1$ and $x_0$ for 64-length sequences over 10,000 samples.*\nDataset|Avg. $L_1$|Max. $L_1$\n---|---|---\nStocks|7.031e-03|0.082\nETTh|6.776e-03|0.104\nMuJoCo|5.146e-03|0.081\nEnergy|5.687e-03|0.230\nfMRI|5.945e-03|0.070\n\n\n**[W2] Practicality in streaming/black-box settings.**\n\n[WA2] We acknowledge this limitation in the paper (Lines 308-311). While the current implementation uses fixed-length windows for simplicity, the core temporal chained-hashing mechanism is adaptable. For streaming data applications, it can be readily deployed using a sliding-window approach, where a fixed-length model generates watermarks for each temporal window. To evaluate the practical feasibility of real-time deployment, we measured the watermark detection overhead using a single NVIDIA L40S GPU and Intel(R) Xeon(R) Platinum 8562Y+ CPU. Table B presents the computational overhead for watermark detection across different datasets and configurations. The results demonstrate that detection overhead remains consistently low, ranging from approximately 1.5 to 7.5 seconds depending on the dataset complexity and batch size. We consider this overhead acceptable for streaming scenarios, particularly given the security benefits provided by the watermarking system. Adapting the hashing mechanism to handle variable-length sequences without padding represents a promising direction for future research that could further enhance the method's applicability to diverse real-world scenarios.\n\nAnd TimeWak is designed for the standard \"white-box\" watermarking scenario where the entity generating the data also embeds the watermark for auditing and tracking purposes. In this setting, the model is fully accessible. The literature distinguishes this from \"black-box\" watermarking, where the watermark must be detected with only query access to the model. We acknowledge that a black-box detection scenario is a much more challenging problem that is out of the scope of this work.\n\n*Table B: Watermark detection overhead in seconds for TimeWak.*\nDataset|Window Size|Batch Size = 1 (sec.)|Batch Size = 100 (sec.)\n---|---|---|---\nStocks|24|1.58|2.09\n||64|1.50|2.27\n||128|1.55|2.59\nETTh|24|1.72|2.23\n||64|1.64|2.41\n||128|1.63|2.62\nMuJoCo|24|2.96|3.84\n||64|2.90|4.25\n||128|2.90|4.49\nEnergy|24|3.89|5.22\n||64|3.88|5.73\n||128|3.89|6.58\nfMRI|24|4.69|6.31\n||64|4.75|7.00\n||128|4.81|7.47\n\n\n**[W3/Q3] Explain TimeWak underperforms TabWak$^\\top$ on fMRI dataset.**\n\n[WA3/QA3] For the fMRI dataset, increasing the interval length $H$ in TimeWak leads to higher Z-score while preserving the quality of the synthetic data and improving robustness, as shown in Tables C (full results in Table 14 in Appendix E.7.1) and D. This highlights that TimeWak can, in fact, perform exceptionally well on the fMRI dataset, especially when compared to other baselines.\n\n*Table C: Results of synthetic time series quality and watermark detectability for 64-length sequences. TimeWak is applied with interval length $H=8$.*\nMethod|Context-FID (↓)|Correlational (↓)|Discriminative (↓)|Predictive (↓)|Z-score (↑)\n---|---|---|---|---|---\nTabWak$^\\top$|0.554|1.955|0.331|**0.100**|743.33\nTimeWak|**0.469**|**1.823**|**0.294**|**0.100**|**817.23**\n\n*Table D: Results of robustness against post-editing attacks for 64-length sequences. TimeWak is applied with interval length $H=8$.*\nMethod|Offset 5% (↑)|Offset 30% (↑)|Random Crop 5% (↑)|Random Crop 30% (↑)|Min-Max Insertion 5% (↑)|Min-Max Insertion 30% (↑)\n---|---|---|---|---|---|---\nTabWak$^\\top$|743.16|742.43|**636.28**|**317.24**|614.25|224.27\nTimeWak|**803.01**|**801.83**|610.02|151.69|**663.14**|**249.69**\n\nTo further evaluate TimeWak, we added two additional and more challenging real-world datasets: (i) the ILI dataset, which records influenza-like illness cases in the United States, and (ii) the Weather dataset, which is sparse and noisy. Both datasets are standard benchmarks used in TimesNet [8]. As shown in Table E, TimeWak demonstrates strong performance on these challenging datasets.\n\n*Table E: Results of synthetic time series quality and watermark detectability for 64-length sequences.*\nDataset|Method|Context-FID (↓)|Correlational (↓)|Discriminative (↓)|Predictive (↓)|Z-score (↑)\n---|---|---|---|---|---|---\nILI|W/O|0.411|0.073|0.147|0.028|-\n||TR|1.530|0.149|0.286|0.035|5.09\n||GS|0.734|0.159|0.397|0.030|78.18\n||HTW|0.439|**0.069**|0.217|0.032|7.37\n||TabWak|**0.239**|0.070|0.131|**0.027**|-2.06\n||TabWak$^\\top$|0.295|0.071|0.114|0.028|21.26\n||TimeWak|0.240|0.076|**0.111**|0.028|**151.03**\nWeather|W/O|0.647|1.429|0.175|0.002|-\n||TR|3.381|2.518|0.388|**0.002**|0.40\n||GS|4.495|2.194|0.446|**0.002**|15.36\n||HTW|0.712|1.463|0.190|**0.002**|4.82\n||TabWak|0.751|1.571|0.200|**0.002**|-1.23\n||TabWak$^\\top$|**0.588**|1.369|**0.178**|**0.002**|39.58\n||TimeWak|0.717|**0.951**|0.184|**0.002**|**205.53**\n\n\n**[W4/Q2] $\\epsilon$-Exact inversion: Lipschitz continuity assumption.**\n\n[WA4/QA2] Thanks for point this point. This is a common assumption in the theoretical analysis of diffusion models/neural networks. Recent works have extensively studied the smoothness properties of diffusion models, providing theoretical guarantees for their stability and convergence under such assumptions [1-7]. While its validity in practice is an area of active research, we empirically validated this assumption in Appendix C (Figure 5, Lines 559-561), showing the Lipschitz constant is well-behaved for the models used.  In this figure, we empirically computed $\\Delta_{t}$ (Lipschitz constant) across four different datasets, using 10,000 samples from each. Specifically,  $\\Delta_{t}$ is calculated as the maximum ratio for different $t$ using the $L_1$ norm of the data samples.  At the first timestep, the constant is relatively large, ranging from 28-80 for the four different datasets, and then the constant decreases to a value smaller than 1 as the timestep increases, which is also according to the observation from existing work [7]. \n\n### Paper Formatting Concerns\n**[PFC1] Typo on line 34 \"offerring\".**\n\n[PFCA1] Thank you for pointing this out. We will fix it in the next version.\n\n### References\n[1] Liang, Yingyu, et al. \"Unraveling the smoothness properties of diffusion models: A gaussian mixture perspective.\" arXiv:2405.16418, 2024.\n\n[2] Mooney, Connor, et al. \"Global well-posedness and convergence analysis of score-based generative models via sharp Lipschitz estimates.\" ICLR, 2025.\n\n[3] Conforti, Giovanni, Alain Durmus, and Marta Gentiloni Silveri. \"KL convergence guarantees for score diffusion models under minimal data assumptions.\" SIAM Journal on Mathematics of Data Science 7.1 (2025): 86-109.\n\n[4] Lim, Jae Hyun, et al. \"Score-based diffusion models in function space.\" arXiv:2302.07400, 2023.\n\n[5] Chen, Sitan, et al. \"Sampling is as easy as learning the score: theory for diffusion models with minimal data assumptions.\" ICLR, 2023.\n\n[6] Han, Yinbin, Meisam Razaviyayn, and Renyuan Xu. \"Neural network-based score estimation in diffusion models: Optimization and generalization.\" ICLR, 2024.\n\n[7] Yang, Zhantao, et al. \"Lipschitz singularities in diffusion models.\" ICLR, 2024.\n\n[8] Wu, Haixu, et al. \"TimesNet: Temporal 2D-Variation Modeling for General Time Series Analysis.\" ICLR, 2023."}, {"review_id": "gag3IOnzeH", "reviewer": "Reviewer_zoPw", "summary": "The authors prpose TimeWAK. This is a new watermark for time-series data that is made via diffusion generative models. While existing works focus on watermarking in the latent space, TimeWAK performs the watermarking embedding and detection in the ambient space (referred to as 'real/smaple' space in the paper). The paper offers a combination of several novel ideas that improve upon existing mechanisms and aims to close the current gap in diffusion-based watermarking. Those include 'temporal chained hashing', feature-level shuffling of seeds and $\\epsilon$-exact inversion. The authors propose an error bound on the inversion procedure. TimeWAK offers an improvement on the detection-quality tradeoff compared to existing SotA.", "questions": "Below are both questions and additional remarks on the paper- \n- Figure 2 aims to demonstrate the heterogenity of the reconstruction errors, but I don't understand how is this implied from the figure. Can the authors elaborate on that?\n- time series is in some parts written as 'timeseries' (e.g. lines 105, 108) which is inconsistent with the rest of the paper.\n- I think the terms 'sampling time' and 'real-space' are not necessarilty the common practice and may be confused with other terms (e.g. from Fourier analysis/signal processing) - I would suggest clarifying them.\n- Appendix B.3 - there are two notations $\\epsilon_{\\theta}(x_t,t)$ and $\\epsilon_{\\theta(x_t,t)}$ which I believe refer to the same term. Can the authors either explain the difference or fix the typo?\n- line 47 ' we self-hash the seeds along the temporal axis...' - is 'self-hash' a common term? can the authors explain it?\n-  In the current state of the paper, I would add an emphasis in the beginning of the overview that this is just an overview in a high level, followed by a deep explanation of each component. Reading through it did not feel clear to me.\n- $S$ is said to be sampled from an $(0,L-1)$ uniform distribution but in this paper $S$ is only a single bit, so $L=2$? I am not sure this a 100% percent clear.\n- What is the reasoning behind the specific choice within the inverse Gaussian CDF in eqn (5)?\n- There is a slight point that is not clear to me. Most of the paper focuses on diffusion in terms of transition from $x_T$ to $x_0$  via $(x_t)$ for various values of $t$, and vice versa, while some parts talk about the pair $(x_0,x_1)$. Does $x_T=x_1$? otherwise, what is the relation between them?\n- Is the bit accuracy (eqn 15) similarly calculated when $s$ is not binary?\n- The statistical metrics that are reported are a little off - $Z$ values that are so big are not a convention ($Z$ around 100 corresponds to a $p$-value of 1e-2174, which is not quite odd) - this should be discussed. \n- The fact that an attack increases the $z$-score of your method (increasing 'separability') is quite odd - can the authors further elaborate on this phenomena?", "limitations": "Yes.", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 4, "originality": 4, "strengths_and_weaknesses": "I think this is a good contribution to the body of work on watermarking. Here is my assessment of the strengths and weaknesses of the paper: \n\n**Strengths:**\n1. The paper is well written. The concepts are clear and were made rather intuitive. The related works section is very well written, the steps of the method are clear.\n2. The method is novel and aims at the current gap in the literature. novel and interesting tools are developed to close this gap.\n3. Theoretical error bounds are provided for $\\epsilon$-inversion.\n4. The method is rigorously evaluated across several benchmarks and various settings. The authors compare their methods to various existing SotA methods.\n\n**Weakness:**\n1. The provided error bound lacks reasoning - it is not clear how tight it is, what are the roles of the parameters, and most importantly, how reasonable is the Lipschitz assumption compared what what kind of neural nets are actually employed.\n2. A crisp summary of the results and conclusions from them is missing. The results section is dense with information that can be made much easier to navigate.", "was_revised": true, "final_justification": "I find this to be a good work and highly relevant. I have engaged in discussion with the authors and feel that my concerns were clarified. Following our discussion and after reading the other reviews, I have decided to keep my score.", "rebuttal": "Thank you for your valuable comments and positive feedback. It's helpful for us to futher improve this work.\n\n### Weaknesses\n**[W1] Tightness of the bound.**\n\n[WA1] The parameters are summarized in Appendix A. The error bound in Thm. 3.1 shows how an initial error $\\epsilon$ propagates, governed by diffusion parameters ($a_{t}$, $b_{t}$) and the noise estimator's Lipschitz constant ($\\Delta_{t}$). The Lipschitz assumption is standard for the neural networks used. Crucially, we empirically validate this assumption in Appendix C (Fig. 5, Lines 559-561). We computed $\\Delta_{t}$ on 10,000 samples for four datasets and found it behaves as expected from prior work: it starts large (28-80) but rapidly decreases to <1 as the timestep increases. And we also added an experiments by generating 10,000 samples (length 64) across five datasets, computing $x_0$ (final output) and $x_1$ (one step prior). Results in Table A show consistently small $L_1$ norms between $x_1$ and $x_0$ (avg: 5.1-7.0e-03, max: <0.23), validating our $\\epsilon$-exact approximation. These results demonstrate the empirical value of $\\epsilon$ in our proof.\n\n*Table A: $L_1$ norms between $x_1$ and $x_0$ for 64-length sequences over 10,000 samples.*\nDataset|Avg. $L_1$|Max. $L_1$\n---|---|---\nStocks|7.031e-03|0.082\nETTh|6.776e-03|0.104\nMuJoCo|5.146e-03|0.081\nEnergy|5.687e-03|0.230\nfMRI|5.945e-03|0.070\n\n**[W2] Crisp summary of results.**\n\n[WA2] Thank you for the suggestion. We will add it in the next version.\n\n### Questions\n**[Q1] Elaborate Figure 2.**\n\n[QA1] The detection of our watermark relies on accurate reconstruction through the inverse diffusion process; lower reconstruction error leads to better watermark detection. Figure 2 reveals a critical asymmetry: reconstruction errors vary dramatically across different features (plots a, c), while remaining much more uniform across time (plots b, d). This demonstrates spatial heterogeneity where reconstruction difficulty differs significantly between feature types. This spatial heterogeneity invalidates prior methods like TabWak that rely on feature-wise seed cloning. TabWak assumes that cloned watermark seeds across features will reconstruct identically, enabling detection through seeds comparison. However, the non-uniform reconstruction errors shown in Figure 2 cause cloned seeds to reconstruct differently across features, leading to low bit accuracy and failed detection. This fundamental limitation motivates our temporal chained-hashing approach: instead of comparing seeds across the problematic feature dimension, we chain and verify seeds along the more stable temporal dimension where reconstruction errors are uniform, ensuring reliable watermark detection despite spatial heterogeneity.\n\n**[Q2] \"time series\" written as \"timeseries\".**\n\n[QA2] We will fix it in the next version.\n\n**[Q3] Clarify the terms \"sampling time\" and \"real-space\".**\n\n[QA3] We use \"sampling time\" to refer to the generation phase of diffusion models, distinct from the signal processing definition of temporal intervals between measurements. To clarify, we will use \"generation-time watermarking.\"\n\nOur \"real-space\" terminology indicates watermarking in the original time series data rather than in latent representations, analogous to spatial versus frequency domains in Fourier analysis. We will use \"data-space watermarking\" or \"native-space watermarking\" in next version.\n\n**[Q4] Notation issue in Appendix B.3.**\n\n[QA4] Yes, that is a typo, we will fix it in the next version.\n\n**[Q5] Clarify the term \"self-hash\".**\n\n[QA5] It should be \"chained-hash\", which is explained in Section 3.2.1, we will fix it in the next version.\n\n**[Q6] Add an emphasis in the beginning of the overview.**\n\n[QA6] We will add it in the next version.\n\n**[Q7] Clarify $L=2$.**\n\n[QA7] This is correct. In the experiments of the main article, we show results in $L=2$. However, other values of $L$ are feasible, such as $L=3$ or $4$. We include these possibilities in our results in Tables 16-18 in Appendix E.7.2. While these show promising results, $L=2$ yields the best results in most cases.\n\n**[Q8] Reason behind the specific choice within the inverse Gaussian CDF in eqn(5).**\n\n[QA8] The core intuition behind Equation (5) is to control Gaussian noise generation for watermarking while preserving the original $\\mathcal{N}(0,1)$ distribution that diffusion models expect. Instead of generating completely random noise, we guide the sampling process: the watermark seed $s^{w,f}$ determines which \"region\" of the Gaussian distribution we sample from, while still maintaining overall Gaussian properties. The inverse CDF $\\Phi^{-1}(u + s^{w,f}/L)$ partitions the distribution into $L$ equal-probability bins, ensuring each watermark bit steers noise generation toward specific quantile ranges without changing the fundamental distribution shape.\n\nThis approach preserves generation quality because the noise remains genuinely Gaussian; we're simply controlling which part of the distribution each sample comes from based on our watermark. During detection, we reverse this process by checking which quantile bin the recovered noise falls into, revealing the original watermark seed. Alternative approaches like directly adding watermark signals to noise would visibly distort the Gaussian distribution and degrade sample quality, while our method maintains the statistical properties diffusion models rely on for high-quality generation.\n\n**[Q9] Clarify the notation $(x_0, x_1)$.**\n\n[QA9] We appreciate this clarification request about our notation. In standard diffusion models, $x_0$ and $x_1$ are distinct states in the forward diffusion process: $x_0$ represents the clean data (generated time series), while $x_1$ is the result after one forward diffusion step with small noise added and is different from $x_T$. $x_T$ represents the fully diffused state, approximating pure noise, after all $T$ forward steps are completed.\n\nThe confusion arises in our $\\epsilon$-exact inversion discussion (Section 3.2.2 and Theorem 3.1). Standard BDIA inversion requires knowing both $x_0$ and $x_1$ to compute exact reverse steps, but in practice we only observe the final generated sample $x_0$. Our key approximation is setting $x_1^{approx} = x_0$ instead of storing the true $x_1$, introducing error $\\epsilon = x_1^{orig} - x_0$. This approximation enables practical watermark detection without requiring the intermediate diffusion state $x_1$, though it introduces bounded reconstruction error that our theorem quantifies. We will clarify this notation distinction between the true diffusion state $x_1$ and our practical approximation $x_1^{approx} = x_0$ in the revision.\n\n**[Q10] Clarify the calculation of bit accuracy eqn(15) when $s$ is not binary.**\n\n[QA10] Yes, Equation (15) can be applied identically for non-binary watermarks. The bit accuracy formula $\\text{Acc} = \\frac{1}{|W^{\\*}|F} \\sum_{w \\in W^*} \\sum_{f=1}^{F} \\mathbb{I}[\\hat{s}^{w,f} = s^{w,f}]$ compares recovered seeds $\\hat{s}^{w,f}$ with ground truth seeds $s^{w,f}$ regardless of the size $L$. When $L > 2$ (non-binary), each seed takes values in $\\\\{0, 1, ..., L-1\\\\}$, and the indicator function $\\mathbb{I}[\\cdot]$ evaluates to 1 only when the recovered value exactly matches the original value. For this setting, the expected bit accuracy for time series without watermark is $1/L$.\n\nHowever, for our experiments in Tables 16-18 in Appendix E.7.2 with $L=3$ and $4$, we employed the valid bit mechanism from TabWak [1], which focuses on the tail regions of the distribution for superior noise resilience. This mechanism specifically targets extreme quantiles when calculating bit accuracy to detect whether values have flipped to the opposite side of the Gaussian distribution. For example, with $L=4$, we focus exclusively on bits 0 and 3, which correspond to the 0-25% and 75%-100% quantiles in the Gaussian distribution. We then verify whether the sign for these tail values has flipped, which enhances watermark detectability. We will provide a more detailed explanation of this mechanism in the next version.\n\n**[Q11] Z-score values too big.**\n\n[QA11] These extremely high Z-scores (ranging from ~50 to >500) are actually not uncommon in watermarking literature like TabWak [1] and represent a desirable outcome indicating strong watermark detectability. The large values arise from our evaluation setup using 1,000 samples (as same as TabWak), where the Z-score formula $Z = \\frac{\\mu_{Acc,W} - \\mu_{Acc,NW}}{\\sigma_{Acc,NW}/\\sqrt{n}}$ amplifies differences by $\\sqrt{1,000} \\approx 31.6$. When watermarked samples achieve ~90% bit accuracy versus ~50% for non-watermarked samples, this creates substantial differences that, combined with moderate sample size, produce Z-scores in the hundreds.\n\n**[Q12] Explain the increase in Z-score after the attack on TimeWak.**\n\n[QA12] We acknowledge that this counter-intuitive phenomenon appears for some baselines in Table 2. However, we want to clarify that for our proposed method, TimeWak, the Z-score consistently decreases as the attack strength increases across almost all scenarios, which is the expected behavior. The increase in Z-score is primarily observed for less robust methods like Tree-Ring and Gaussian Shading. We hypothesize this is an artifact of how the Z-score is calculated and the nature of these non-native watermarking schemes. The Z-score measures the statistical deviation of an *attacked, watermarked* sample relative to *clean, non-watermarked* data. For methods not designed for time series, a strong attack can drastically alter the data's statistical properties in a way that, while destroying the original watermark, makes the data even *more* different from the clean distribution.\n\n### References\n[1] Zhu, Chaoyi, et al. \"TabWak: A Watermark for Tabular Diffusion Models.\" ICLR, 2025."}]

Author rebuttal:

Meta-review: This paper proposes the first watermarking method for multivariate time series data generated by diffusion models in real space. This is a relevant contribution in watermarking methods that fills a gap in the scenarios where latent diffusion models fail. It introduces several key components including temporal chained-hashing and feature permutation to handle temporal dependence and spatial heterogeneity, and also provides theoretical error bounds for reconstruction. Extensive experiments on both synthetic and real-data mixed datasets demonstrate its efficacy and superiority again baselines in their respective settings.

Almost all concerns from reviewers were addressed properly with additional experiments and clarification during rebuttal. The authors also acknowledge a limitation of the absence of a formal threat model and human-in-the-loop evaluation, which reviewers agree it could be left for future work. As a result, all reviewers agree this work is worth acceptance at NeurIPS.
Decision: Accept (spotlight)