🤖 machine learning

Robust Spectral Watermark for Synthetic Tabular Data

The paper introduces TAB-DRW, an efficient and robust post-editing watermarking scheme that embeds signals in the frequency domain of synthetic tabular data to ensure traceability and resist attacks while preserving data fidelity and supporting mixed feature types.

Original authors: Yizhou Zhao, Xiang Li, Peter Song, Qi Long, Weijie Su

Published 2026-05-12

📖 6 min read🧠 Deep dive

CC BY 4.0

Original authors: Yizhou Zhao, Xiang Li, Peter Song, Qi Long, Weijie Su

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are a chef who has created a delicious, high-quality recipe for a new dish. You want to share this recipe with the world so others can learn from it or cook it themselves. However, you're worried: what if someone takes your recipe, claims they invented it, or uses it to make a harmful version of the dish? You need a way to prove, "This is my recipe," without ruining the taste or changing the ingredients so much that it's no longer the same dish.

This is exactly the problem Tab-Drw solves, but instead of recipes, it deals with synthetic tabular data (like spreadsheets of patient records, financial transactions, or customer info) created by Artificial Intelligence.

Here is how the paper explains this solution, using simple analogies:

1. The Problem: Invisible Ink That Smells

Currently, when AI generates fake data, it's hard to tell if it's real or fake, or who made it. Existing "watermarks" (digital signatures) are like trying to stamp a wet piece of paper:

Too Heavy: Some methods require the AI to run a complex, slow "undo" process to stamp the data, which is computationally expensive (like needing a giant machine just to sign a letter).
Fragile: If someone shuffles the rows, adds a little noise, or deletes a few columns (like someone spilling coffee on your recipe), the watermark disappears.
Incompatible: Some methods only work on numbers, failing when the data has a mix of numbers and categories (like "Age" and "Gender").

2. The Solution: Tab-Drw (The "Frequency Domain" Stamp)

The authors propose Tab-Drw, a lightweight method that acts like a clever, invisible stamp. Here is the step-by-step process:

Step A: The "Smoothie" Transformation (Preprocessing)

First, the data is messy. Some columns are huge numbers (income), others are tiny (age), and some are categories (sex).

The Analogy: Imagine trying to mix a smoothie with whole apples, rocks, and water. It won't blend well.
The Fix: Tab-Drw uses a mathematical tool called Yeo-Johnson Transformation to "blend" everything into a smooth, uniform consistency. It turns all the different scales into a standard "smoothie" where every ingredient is on the same playing field.

Step B: The "Sound Wave" View (Frequency Domain)

Instead of looking at the data as a list of numbers (rows and columns), Tab-Drw looks at it as a sound wave or a musical chord.

The Analogy: If you look at a song as a list of notes, it's hard to hide a secret. But if you look at the sound wave of the song, you can see the "imaginary parts" (the invisible vibrations that make up the sound).
The Trick: The method converts the data into this "sound wave" view using a Discrete Fourier Transform (DFT).

Step C: The "Secret Code" (Embedding)

Now, here is the magic. The system generates a secret, random pattern of 0s and 1s (like a secret code).

The Analogy: Imagine the sound wave has "imaginary vibrations." The system gently nudges these vibrations so they match the secret code.
The "Soft" Touch: It doesn't force a hard change (which would ruin the smoothie). Instead, it uses a "soft" adjustment. If the vibration is already close to the code, it leaves it alone. If it's far off, it gently pulls it closer. This ensures the data still looks and acts exactly like the original.

Step D: The "Reverse Smoothie" (Reconstruction)

Finally, it converts the sound wave back into the original spreadsheet format.

The Result: The spreadsheet looks exactly the same to a human or a computer program. The "watermark" is hidden inside the invisible mathematical structure, not in the visible numbers.

3. How Do You Find the Secret? (Detection)

When someone wants to check if a spreadsheet is watermarked, they don't need the original AI model. They just need the secret key.

The Analogy: Imagine you have a special "tuning fork" (the key). You tap the spreadsheet, and if it's watermarked, the tuning fork vibrates in perfect harmony with the secret code hidden inside. If it's not watermarked, the vibration is weak or chaotic.
The "Rank" Trick: To make sure the secret code survives even if someone deletes rows or adds noise, the system generates the code based on the ranking of the data rows (e.g., "This row is the 50th largest"). Rankings are very stable; even if you add a little noise, the 50th largest row is still roughly the 50th largest. This makes the watermark incredibly hard to destroy.

4. Why Is This Better?

The paper claims Tab-Drw wins on four fronts:

Speed: It's fast. It doesn't need the heavy AI model to run again; it just edits the finished data.
Robustness: It survives "attacks." If someone tries to delete rows, shuffle the order, or add random noise (like spilling coffee), the watermark is still detectable.
Versatility: It works on mixed data (numbers and categories) without breaking.
Fidelity: The data remains high-quality. The "smoothie" tastes exactly the same; the secret code is just invisible.

5. The "Privacy" Upgrade

The authors also mention a "Privacy-Enhanced" version.

The Analogy: Imagine you have a deck of cards. Before you stamp them, you shuffle the deck using a secret key. After stamping, you un-shuffle them back to the original order.
Why? This means that even if someone steals the data, they can't figure out the secret code unless they know exactly how you shuffled the deck. This prevents "spoofing" (faking a watermark) and allows different organizations to use different keys on the same type of data without confusing each other.

Summary

Tab-Drw is like a high-tech, invisible stamp for AI-generated spreadsheets. It transforms the data into a "sound wave," hides a secret code in the invisible vibrations, and then transforms it back. The result is a dataset that looks and acts perfectly normal but carries a hidden, unbreakable signature that proves its origin, even if someone tries to tamper with it.

Technical Summary: Robust Spectral Watermark for Synthetic Tabular Data (Tab-Drw)

Problem Statement

The proliferation of generative AI has enabled the creation of high-fidelity synthetic tabular data across critical domains such as healthcare, finance, and public policy. While this facilitates data sharing and model training, it introduces significant risks regarding data provenance, intellectual property rights, and potential misuse (e.g., fraud or biased clinical decision-making). Existing watermarking solutions for synthetic tabular data face three primary limitations:

Computational Cost: Sampling-phase methods often rely on the inverse processes of large diffusion models (e.g., DDIM inversion), which are computationally expensive and prone to reconstruction errors.
Data Type Limitations: Many methods struggle with mixed discrete-continuous data or fail to preserve data utility when applied to heterogeneous features.
Robustness: Current approaches often lack resilience against common post-processing attacks, such as noise addition, discretization, or row/column deletions.

The paper argues that an effective watermarking scheme must simultaneously satisfy four properties: fidelity (preserving data quality), detectability (reliable identification), applicability (supporting mixed-type data and post-generation editing), and robustness (resilience against attacks).

Methodology: Tab-Drw

The authors propose Tab-Drw, a lightweight, post-editing watermarking scheme that embeds signals in the frequency domain without requiring access to the generative model. The method operates through three main stages:

1. Preprocessing and Transformation

To handle heterogeneous tabular data (mixing continuous and discrete features), the method first applies a Yeo-Johnson Transformation (YJT) followed by standardization. This step normalizes feature scales and reduces skewness, mapping the data to a unified real-valued space. Subsequently, a Discrete Fourier Transform (DFT) is applied row-wise to map the standardized data into the frequency domain.

2. Watermark Embedding

The core embedding occurs in the frequency domain. The algorithm identifies "effective entries" (the imaginary parts of the DFT coefficients, excluding the DC component and Nyquist frequency).

Pseudorandom Bit Generation: A novel rank-based pseudorandom bit generation scheme is employed. Instead of storing a massive bit sequence, the method derives bits deterministically for each row based on the row's rank (computed from a secret-key-selected subset of columns). This uses a binary tree structure and Gray code principles to ensure that small perturbations in the data (attacks) do not drastically alter the generated bit sequence.
Signal Alignment: The imaginary parts of the selected DFT entries are adjusted to align their signs with the generated pseudorandom bits. The authors introduce a "soft variant" controlled by hyperparameters $(\gamma, \delta)$ to limit distortion. This allows for a trade-off between watermark strength and data fidelity, modifying only entries with small imaginary magnitudes or shrinking the modification factor.

3. Reconstruction and Detection

The modified frequency-domain representation is transformed back to the time domain via the Inverse DFT (IDFT). The data is then inverse-standardized and inverse-YJT transformed. For discrete features, values are rounded to the nearest valid entry; for bounded features, clipping is applied.

Detection involves reversing the preprocessing steps to recover the frequency domain, reconstructing the pseudorandom bits using the secret key and the rank-based mechanism, and calculating a Z-score. This score measures the statistical alignment between the imaginary signs of the suspect data and the reconstructed bits. A high Z-score indicates the presence of the watermark.

Key Contributions

A New Watermarking Scheme: Tab-Drw is a post-editing method that embeds robust signals in the frequency domain. It is computationally efficient, model-agnostic, and supports mixed-type tabular data while preserving high data fidelity.
Rank-Based Pseudorandom Bit Generation: The authors introduce a method to generate secret bits on-the-fly using row-wise rank statistics and a binary tree structure. This eliminates the need for explicit storage of bit sequences and enhances robustness against post-processing attacks by leveraging the stability of rank statistics.
Theoretical Analysis: The paper provides closed-form expressions for the bias (distortion) introduced by the watermark and establishes theoretical lower bounds on the Z-score under additive Gaussian noise, proving the method's detectability even under moderate perturbations.
Empirical Validation: Extensive experiments on five benchmark datasets (Adult, Magic, Shoppers, Default, Drybean) demonstrate that Tab-Drw outperforms existing baselines (both sampling-phase and post-editing) in robustness against various attacks (deletion, noise, discretization, shuffling) while maintaining high data utility.

Experimental Results

Fidelity vs. Detectability: Tab-Drw achieves data fidelity scores comparable to unwatermarked data and existing baselines. It demonstrates a tunable trade-off where increasing the watermark strength (via hyperparameters) improves the Z-score with minimal degradation in utility metrics (Density, Correlation, C2ST, MLE).
Robustness: Under ten types of post-processing attacks (including row/column deletion, Gaussian noise, and quantization), Tab-Drw consistently achieves the highest or second-highest Z-scores. Unlike baselines that fail under noise or deletion, Tab-Drw maintains detectability even when 10-20% of data is altered.
Adaptive Attacks: The method remains robust against adaptive attacks where adversaries attempt to disrupt the ranking process or re-watermark the data with different keys. Even after ten rounds of re-watermarking, the original watermark remains detectable, though data fidelity degrades.
Runtime: Embedding and detection are highly efficient (sub-second for 1K rows on CPU), significantly outperforming sampling-phase methods that require GPU-intensive inversion processes.
Low-Entropy Variables: A case study on categorical variables (e.g., gender) shows that the method is entropy-aware, rarely flipping low-entropy attributes and confining any necessary flips to semantically ambiguous regions near cluster boundaries.

Significance and Claims

The paper claims that Tab-Drw offers a solid foundation for secure data sharing and privacy-preserving generative AI by addressing the critical gap in robust, efficient, and applicable watermarking for tabular data.

The authors emphasize that their approach:

Decouples watermarking from generation: It does not require access to the generative model, making it applicable to any existing or future synthetic dataset.
Balances the four key properties: It successfully achieves high fidelity, strong detectability, broad applicability to mixed data types, and robustness against common attacks simultaneously, a combination not achieved by prior works.
Provides theoretical guarantees: The derivation of distortion bounds and robustness lower bounds offers a principled understanding of the method's behavior under noise.

The authors modestly note that the method is not unconditionally robust against arbitrarily strong transformations (e.g., extreme rank disruption) and that the key space capacity is finite and dependent on table dimensions. They identify future directions such as optimizing the frequency-domain modification strategy, integrating differential privacy, and adapting watermark strength based on feature importance.