Title: TimeWak: Temporal Chained-Hashing Watermark for Time Series Data
Venue: NeurIPS 2025
Accepted: yes
Keywords: Watermarking

Time Series

Diffusion Models
Abstract: Synthetic time series generated by diffusion models enable sharing privacy-sensitive datasets, such as patients' functional MRI records. Key criteria for synthetic data include high data utility and traceability to verify the data source. Recent watermarking methods embed in homogeneous latent spaces, but state-of-the-art time series generators operate in data space, making latent-based watermarking incompatible. This creates the challenge of watermarking directly in data space while handling feature heterogeneity and temporal dependencies. We propose TimeWak, the first watermarking algorithm for multivariate time series diffusion models. To handle temporal dependence and spatial heterogeneity, TimeWak embeds a temporal chained-hashing watermark directly within the temporal-feature data space. The other unique feature is the $\epsilon$-exact inversion, which addresses the non-uniform reconstruction error distribution across features from inverting the diffusion process to detect watermarks. We derive the error bound of inverting multivariate time series while preserving robust watermark detectability. We extensively evaluate TimeWak on its impact on synthetic data quality, watermark detectability, and robustness under various post-editing attacks, against five datasets and baselines of different temporal lengths. Our results show that TimeWak achieves improvements of 61.96% in context-FID score, and 8.44% in correlational scores against the strongest state-of-the-art baseline, while remaining consistently detectable.


Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe authors prpose TimeWAK. This is a new watermark for time-series data that is made via diffusion generative models. While existing works focus on watermarking in the latent space, TimeWAK performs the watermarking embedding and detection in the ambient space (referred to as 'real/smaple' space in the paper). The paper offers a combination of several novel ideas that improve upon existing mechanisms and aims to close the current gap in diffusion-based watermarking. Those include 'temporal chained hashing', feature-level shuffling of seeds and $\\epsilon$-exact inversion. The authors propose an error bound on the inversion procedure. TimeWAK offers an improvement on the detection-quality tradeoff compared to existing SotA.\n\nSTRENGTHS AND WEAKNESSES:\nI think this is a good contribution to the body of work on watermarking. Here is my assessment of the strengths and weaknesses of the paper: \n\n**Strengths:**\n1. The paper is well written. The concepts are clear and were made rather intuitive. The related works section is very well written, the steps of the method are clear.\n2. The method is novel and aims at the current gap in the literature. novel and interesting tools are developed to close this gap.\n3. Theoretical error bounds are provided for $\\epsilon$-inversion.\n4. The method is rigorously evaluated across several benchmarks and various settings. The authors compare their methods to various existing SotA methods.\n\n**Weakness:**\n1. The provided error bound lacks reasoning - it is not clear how tight it is, what are the roles of the parameters, and most importantly, how reasonable is the Lipschitz assumption compared what what kind of neural nets are actually employed.\n2. A crisp summary of the results and conclusions from them is missing. The results section is dense with information that can be made much easier to navigate.\n\nQUESTIONS:\nBelow are both questions and additional remarks on the paper- \n- Figure 2 aims to demonstrate the heterogenity of the reconstruction errors, but I don't understand how is this implied from the figure. Can the authors elaborate on that?\n- time series is in some parts written as 'timeseries' (e.g. lines 105, 108) which is inconsistent with the rest of the paper.\n- I think the terms 'sampling time' and 'real-space' are not necessarilty the common practice and may be confused with other terms (e.g. from Fourier analysis/signal processing) - I would suggest clarifying them.\n- Appendix B.3 - there are two notations $\\epsilon_{\\theta}(x_t,t)$ and $\\epsilon_{\\theta(x_t,t)}$ which I believe refer to the same term. Can the authors either explain the difference or fix the typo?\n- line 47 ' we self-hash the seeds along the temporal axis...' - is 'self-hash' a common term? can the authors explain it?\n-  In the current state of the paper, I would add an emphasis in the beginning of the overview that this is just an overview in a high level, followed by a deep explanation of each component. Reading through it did not feel clear to me.\n- $S$ is said to be sampled from an $(0,L-1)$ uniform distribution but in this paper $S$ is only a single bit, so $L=2$? I am not sure this a 100% percent clear.\n- What is the reasoning behind the specific choice within the inverse Gaussian CDF in eqn (5)?\n- There is a slight point that is not clear to me. Most of the paper focuses on diffusion in terms of transition from $x_T$ to $x_0$  via $(x_t)$ for various values of $t$, and vice versa, while some parts talk about the pair $(x_0,x_1)$. Does $x_T=x_1$? otherwise, what is the relation between them?\n- Is the bit accuracy (eqn 15) similarly calculated when $s$ is not binary?\n- The statistical metrics that are reported are a little off - $Z$ values that are so big are not a convention ($Z$ around 100 corresponds to a $p$-value of 1e-2174, which is not quite odd) - this should be discussed. \n- The fact that an attack increases the $z$-score of your method (increasing 'separability') is quite odd - can the authors further elaborate on this phenomena?\n\nLIMITATIONS:\nYes.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 4, "ORIGINALITY": 4, "DATE": "2025-06-11"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis work proposes TimeWak, the first sampling-time watermarking scheme for multivariate time series diffusion models. The method introduces a temporal chained-hashing scheme that embeds watermark seeds along the temporal dimension. In addition, it leverages ε-exact inversion to address inconsistencies in DDIM inversion. Experimental results demonstrate the effectiveness of TimeWak on multivariate time series data.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\n\n1.\tThe proposed method effectively tackles the watermarking problem in multivariate time series data, a scenario where existing techniques for watermarking diffusion models or tabular data fall short.\n2.\tThis work conducts an in-depth analysis of watermarking multivariate time series, revealing unique challenges such as spatial heterogeneity and temporal dependence, and design a tailored solution accordingly.\n3.\tTheoretical analysis combined with extensive experimental results demonstrates the effectiveness and robustness of the proposed method for the target task.\n\nWeaknesses:\n\n1.\tAlthough TimeWak is the first sampling-time watermarking scheme for multivariate time series diffusion models, the main components: ε-exact inversion and chained-hashing, conceptually resemble existing techniques used in image and tabular watermarking methods such as TabWak, which raises concerns about the technical novelty and methodological complexity of the proposed approach.\n\n2.\tWhile the authors mention that the method \"can be applied to streaming scenarios,\" it relies on access to the diffusion model’s inversion process, as well as full-sequence segmentation and predefined hash functions. These assumptions make deployment in practical, streaming, or black-box settings quite challenging.\n\n3.\tOn the fMRI dataset, TimeWak performs worse than TabWak in terms of both robustness and detection accuracy, which raises the question of whether the proposed approach might underperform in real-world or specialized domains compared to existing techniques.\n\n4.  The ε-exact inversion assumption relies on the Lipschitz continuity of the noise estimator, which may not hold in practice. The paper does not clearly explain the magnitude of this bound, nor whether it meaningfully impacts detection performance in practice.\n\nQUESTIONS:\n1.\tPlease clarify difference from prior work, particularly in distinguishing its temporal chained-hashing and ε-exact inversion components from existing methods such as TabWak or BDIA-based inversion techniques.\n2.\tThe ε-exact inversion assumption relies on the Lipschitz continuity of the noise estimator, which may not hold in practice—especially for time series data with abrupt transitions, feature scale heterogeneity, or distributional shifts between training and inference. For example, real-world datasets such as medical records may contain mixed feature types (e.g., binary gender and continuous income), or neurological signals like fMRI may include sudden pathological events (e.g., seizure episodes), where small input perturbations can lead to disproportionately large changes in the estimated noise. A discussion or empirical analysis of failure modes under such scenarios would be helpful.\n3.\tOn the fMRI dataset, TabWak⊤ outperforms TimeWak in several Z-score metrics. Could you explain why TimeWak underperforms in this setting? Are there certain types of time series (e.g., low-signal or highly correlated) where your method is less effective?\n\nLIMITATIONS:\nYes", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 3, "CLARITY": 3, "IMPACT": 2, "ORIGINALITY": 2, "DATE": "2025-06-30"}

comments: SUMMARY:
In this work, the authors propose a novel watermarking method for multivariate time series diffusion models. This method embeds watermarks directly in the real space of time series data. It leverages a temporal chained-hashing scheme to recover watermarks robustly and accurately. The approach is evaluated against five strong baselines on five datasets. The results demonstrate the effectiveness.

STRENGTHS AND WEAKNESSES:
The paper introduces a novel temporal chained-hashing scheme that accounts for both feature heterogeneity and temporal dependencies in time series data. This chaining mechanism, combined with feature permutation, provides strong resilience against inversion errors and post-processing attacks.

However, the approach relies on fixed-length intervals for seed chaining, which may limit its adaptability to time series with irregular event distributions or variable-length sequences—particularly in streaming applications.

Although TimeWak demonstrates superior performance over existing baselines, most of the comparisons involve methods originally designed for image or tabular data (e.g., TabWak, GS). Incorporating evaluations against more recent or time series-specific watermarking techniques would further strengthen the empirical validation.

QUESTIONS:
See the weakness

LIMITATIONS:
Yes
TITLE: Official Review
CLARITY: 3
IMPACT: 3
ORIGINALITY: 3
DATE: 2025-07-07

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper introduces TimeWak, a novel watermarking algorithm designed specifically for multivariate time series generated by diffusion models. Unlike existing approaches that operate in latent space, TimeWak embeds watermarks directly in the real-valued temporal-feature space, addressing the unique challenges of temporal dependencies and feature heterogeneity. The method employs a temporal chained-hashing mechanism combined with feature-wise permutation to maintain temporal consistency and watermark robustness. To improve detectability, the authors introduce an ϵ-exact inversion approach based on a modified bidirectional DDIM process, providing theoretical error bounds for reconstruction. Extensive evaluations across five datasets demonstrate TimeWak's effectiveness in preserving data utility, enhancing watermark detectability, and maintaining robustness under various post-editing attacks.\n\nSTRENGTHS AND WEAKNESSES:\n$\\textbf{Strengths:}$\n\n1 -- The paper addresses a clear and underexplored gap in the field, watermarking of synthetic multivariate time series generated in real space by diffusion models, where latent-space methods fail. This positions the work as a timely and relevant contribution.\n\n2 -- The introduction of temporal chained-hashing combined with feature-wise seed permutation presents a novel watermarking strategy that explicitly accounts for the temporal and heterogeneous nature of time series data. The integration of ϵ-exact inversion using BDIA adds theoretical depth to the detection mechanism.\n\n3 -- The authors conduct extensive empirical analysis across five datasets and multiple post-editing attacks, comparing against both native and adapted state-of-the-art baselines. The results convincingly demonstrate the method’s superior trade-off between watermark detectability and data quality.\n\n$\\textbf{Weaknesses:}$\n\n1 -- Although the paper evaluates robustness against various post-processing operations, it does not provide a formal security analysis or define an adversarial threat model. Critical aspects such as watermark forgery, key leakage, or deliberate evasion by a knowledgeable attacker are not addressed. Given that this is one of the first works on time-series watermarking in diffusion models, evaluating such adversarial robustness is essential to fully establish the method’s practical reliability and trustworthiness.\n\n2 -- While the paper presents a thorough set of experiments, all evaluations are conducted on synthetic datasets using controlled, predefined attacks. The method is not tested in more realistic scenarios, such as when synthetic and real time series are mixed together (as often happens in training or deployment), or when the data is used in downstream tasks involving human interpretation or decision-making. Without such evaluation, it is unclear how well the method would perform in practical, real-world settings.\n\n3 -- As far as I understand, all the datasets used in the experiments are structured, regularly sampled, and relatively clean. There is no evaluation on noisy, sparse, or irregularly sampled time series, which are common in real-world domains like healthcare, IoT, or sensor networks. This raises concerns about how well TimeWak would generalize to such challenging and realistic data conditions.\n\n4 -- The paper does not evaluate how watermarking affects the preservation of key signal characteristics in time series data, such as trends, seasonality, or anomalies. In domains like healthcare or finance, where subtle temporal patterns are crucial for downstream tasks, even minor distortions could impact the reliability of model outputs. Without such analysis, it is unclear whether the method maintains the integrity of information needed for sensitive or high-stakes applications.\n\nQUESTIONS:\nPlease see the weaknesses\n\nLIMITATIONS:\nyes", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 3, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-07-08"}