🤖 machine learning

A Locally Tokenized Generative Model for Robust Time-Series Watermarking

The paper introduces L-VQVAE and LVQMark, a locally tokenized generative framework that overcomes the instability of existing time-series watermarking under post-editing attacks by ensuring each token depends only on a bounded temporal neighborhood, thereby stabilizing detection reliability across finance, energy, and neuroimaging benchmarks.

Original authors: Dongbin Kim, Geonwoo Shin, Yujin Choi, Soyeon Park, Jaewook Lee

Published 2026-08-21

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Dongbin Kim, Geonwoo Shin, Yujin Choi, Soyeon Park, Jaewook Lee

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

In the modern digital landscape, artificial intelligence has become a masterful forger of reality, capable of generating synthetic data that looks and behaves almost exactly like the real thing. From financial market trends to brain activity scans, these computer-generated sequences are increasingly useful for training other systems and testing theories. However, this power brings a critical problem: how do we know what is real and what is made by a machine? Without a way to verify the origin of a dataset, we risk building our understanding of the world on a foundation of invisible fabrications. To solve this, scientists have developed a method called watermarking, which acts like a hidden signature embedded directly into the data as it is created. This signature is designed to be invisible to the human eye but detectable by a specific key, allowing anyone to prove later that a piece of data was indeed generated by a particular model.

The challenge, however, has been that these digital signatures are surprisingly fragile. In the world of time-series data—where information flows like a river of numbers over time—any small edit, such as cropping out a section or shifting the values slightly, can scramble the hidden signature. Previous attempts to fix this relied on a method that looked at the entire sequence at once to decode the message. Researchers found that this global approach was flawed; when an attacker tampered with just one part of the data, the decoding process would get confused across the entire sequence, causing the detector to either miss the watermark entirely or, worse, falsely accuse innocent, un-watermarked data of being fake. This instability meant that the very tool meant to protect our trust could easily be tricked by simple edits.

A team of researchers at Seoul National University and Nanyang Technological University has now proposed a different way to build these signatures, one that treats the data in small, manageable chunks rather than as a single, tangled whole. They introduced a new system called L-VQVAE, which breaks a long stream of time-series data into short, overlapping windows. Instead of trying to understand the entire history of the data to find a pattern, the system encodes each small window into a discrete symbol, much like turning a sentence into a string of individual words. This design ensures that if an attacker cuts or alters a portion of the data, the confusion is contained within that specific area and does not spread to the rest of the sequence. By keeping the decoding process local, the system prevents small edits from causing a cascade of errors that would otherwise destroy the ability to detect the watermark.

Building on this local structure, the researchers developed a method called LVQMark to actually write and read the watermark. During the creation of the data, the system subtly biases its choices to favor certain symbols over others, creating a statistical pattern that serves as the signature. When it comes time to verify the data, even if it has been attacked, a robust decoder steps in to recover the original symbols from the damaged signal. Because the system only needs to look at a small, bounded neighborhood to understand each part, it can accurately reconstruct the hidden message even when the data has been cropped, shifted, or had random values inserted. The researchers tested this approach on four very different types of data: stock market prices, energy consumption records, electricity usage, and functional magnetic resonance imaging scans of the brain. In every case, the new method successfully identified watermarked data while keeping the false alarm rate low, even when the data was subjected to significant edits.

The results showed that this local approach solved the instability that plagued previous methods. In tests where older systems would either fail to detect the watermark or mistakenly flag clean data as fake, the new system remained steady. For instance, when data was cropped by thirty percent, older detectors often produced massive errors, sometimes accusing clean data of being fake with near certainty. In contrast, the new method kept its detection scores close to zero for clean data, meaning it correctly rejected them, while still clearly identifying the watermarked samples. The researchers also confirmed that this robustness did not come at the cost of quality; the synthetic data generated by their system remained highly realistic and useful for analysis. By anchoring the detection process to small, independent windows, the team has created a more reliable way to prove the origin of synthetic time-series data, ensuring that the digital signatures we rely on for trust can survive the inevitable edits and manipulations of the real world.

Technical Summary: A Locally Tokenized Generative Model for Robust Time-Series Watermarking

Problem Statement

Watermarking is a critical tool for establishing the provenance of synthetic data generated by AI models. While generation-time watermarking has advanced significantly for language models and images, its application to multivariate time series faces a specific reliability failure under post-editing attacks (e.g., cropping, inserting, or offsetting data segments).

The core issue identified in this work is re-encoding instability. Existing time-series watermarking methods rely on a detector that must first re-encode a continuous, potentially attacked signal into an internal discrete representation (tokens) to verify the watermark. The authors demonstrate that when this re-encoding map is globally coupled—meaning the token at any position depends on the entire time series—localized post-editing attacks cause a bidirectional drift in the null distribution of the detection statistic (the z-score).

Consequence: Attacks can shift the z-scores of non-watermarked samples in either direction (positive or negative). A positive shift leads to high False Positive Rates (FPR), causing erroneous attribution of synthetic content. A negative shift creates severe statistical anomalies that invalidate the calibration of the detector. Current benchmarks often report True Positive Rates (TPR) at a fixed FPR calibrated on clean data, failing to account for this drift, which renders the provenance guarantee unreliable under attack.

Methodology

The proposed solution, LVQMark, is built upon a novel generative architecture called L-VQVAE (Locally Tokenized Vector Quantized Variational Autoencoder). The approach enforces locality in the token representation to contain the effects of attacks.

1. L-VQVAE: Locally Tokenized Generative Model

Unlike standard VQ-VAEs where token recovery might involve global context, L-VQVAE ensures each discrete token is recovered from a bounded temporal neighborhood.

Local Tokenizer: The input time series is partitioned into overlapping sliding windows. A shared encoder processes each window independently to produce a latent vector, which is then quantized against a shared codebook. Because the encoding of a specific window depends only on the data within that window, a post-editing attack affects only the tokens corresponding to the overlapping windows, preventing global propagation of errors.
Local Pretraining: To ensure the codebook entries fully describe their local windows without relying on neighboring context (which would weaken the locality guarantee), the encoder and codebook are first pretrained with a local decoder that reconstructs the window from a single token.
Global Decoder & AR Transformer: The global decoder reconstructs the full time series from the token sequence, and an autoregressive (AR) transformer models the token distribution. These components are invoked only during generation and do not need to be local, allowing them to model long-range dependencies.

2. LVQMark: Watermarking over Local Tokens

LVQMark embeds the watermark during the autoregressive sampling process and detects it via robust re-encoding.

Watermark Injection: It adapts the "red-green" logit-bias scheme (similar to KGW for LLMs). At each sampling step, a secret key partitions the codebook into green and red sets. A positive bias is added to the logits of green tokens.
- Alternating Partition: To prevent "bias accumulation" (where runs of identical tokens skew the statistic), the green/red partition alternates based on position parity (even/odd).
- Unbiased Warm-up: The first few sampling steps are unbiased to prevent "bias dominance," where the lack of context leads to deterministic selection of a single green token.
Robust Detection: At detection time, the observed (potentially attacked) signal is re-encoded using a Robust Encoder ( $E^*_\rho$ $E_{ρ}^{*}$ ).
- This encoder is trained to map attacked signals back to the clean token assignments that the original local tokenizer would have produced.
- Crucially, because the underlying representation is local, the robust encoder only needs to recover a bounded subset of tokens, avoiding the instability of global re-encoding.

Key Contributions

Formulation of False-Positive Reliability: The authors identify that false-positive reliability in time-series watermarking is fundamentally a re-encoding stability problem. They show that globally coupled re-encoding maps cause the null distribution to drift under attack, invalidating clean-calibrated thresholds.
L-VQVAE Architecture: Introduction of a generative model where each token depends only on a short temporal neighborhood. This design prevents localized perturbations from inducing global drift in the recovered representation.
LVQMark Framework: A complete watermarking pipeline combining:
- Logit-bias injection with scheduling modifications (alternating partition and warm-up) tailored to the local token space.
- A robust encoder trained to recover clean token assignments from attacked signals.
- A detection mechanism that leverages the locality of the representation to maintain stable false-positive behavior.

Experimental Results

The method was evaluated on four multivariate time-series datasets (Stocks, ETTh, Energy, fMRI) under three types of post-editing attacks (offset, crop, insert) at varying strengths (5% and 30%).

False-Positive Stability: Existing baselines (Tree-Ring, Gaussian Shading, TimeWak) exhibited significant bidirectional drift. For instance, under a 30% crop attack on the Stocks dataset, Tree-Ring produced a mean z-score of +69.4, resulting in a 100% False Positive Rate. In contrast, L-VQVAE with LVQMark maintained mean z-scores within a narrow range (e.g., [-0.25, +0.35]) across all datasets and attacks, keeping the FPR consistently low ( $\le$ 0.01).
Detection Power: LVQMark achieved near-perfect True Positive Rates (TPR $\approx$ 1.00) on watermarked samples under attack, whereas baselines often suffered from degraded detection or required trade-offs.
Generation Quality: L-VQVAE achieved competitive or state-of-the-art generation quality (measured by Context-FID, Correlational, Discriminative, and Predictive scores), matching or exceeding baselines like SDFormer and DiffusionTS.
Ablation Studies:
- Removing the local tokenization (using SDformer with a robust encoder) failed to provide consistent robustness, confirming that robust re-encoding alone is insufficient without a locally recoverable representation.
- Removing the scheduling components (alternating partition and warm-up) degraded generation quality and detection stability, confirming their necessity for preventing statistical artifacts.

Significance and Claims

The paper argues that the primary barrier to robust time-series watermarking is not the watermarking scheme itself, but the instability of the detector's re-encoding process under post-editing attacks. By enforcing locality in the token representation, the authors demonstrate that it is possible to:

Stabilize the null distribution: Preventing the bidirectional drift that leads to erroneous provenance attribution.
Maintain detection power: Ensuring watermarked samples remain detectable even after significant editing.
Preserve generation quality: Achieving high-fidelity synthetic data without compromising the watermarking mechanism.

The authors conclude that their approach provides a principled solution to the false-positive reliability problem, offering a more trustworthy mechanism for verifying the provenance of synthetic time-series data in the presence of adversarial or accidental modifications. They note that while the evaluation covers specific datasets and attack types, the modular nature of the robust encoder allows for adaptation to new attack types without retraining the generative model.