{"id":"1a066959-8c6b-4462-bbbd-7dba02a978a3","arxiv_id":"2505.06379","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"NCorr-FP embeds fingerprints into mixed-type tabular data by sampling replacement values from local neighbourhoods, preserving distributions and correlations while allowing blind detection with majority voting.","lead":"This paper presents NCorr-FP, a method that hides recipient-specific fingerprints inside structured tables by replacing selected values with similar values from nearby rows. The authors report that the marks are hard to spot statistically, survive heavy row and column deletion, and still allow tracing the leaker.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Vertical-subsetting robustness does not follow from Algorithm 3: detection computes s1 mod v on the reduced attribute count, so the detector addresses different columns than were marked.","rationale":"The reader's weakest assumption identifies exactly the same load-bearing concern: the attribute-index computation in Algorithm 3 depends on the current attribute count, and vertical subsetting changes that count. My reading of the full algorithm confirms that no column-remapping mechanism is described anywhere in Sections V-B, VI-D, or VII-D. This is the single most serious issue because the abstract and introduction explicitly advertise robustness to 70% attribute deletion as a headline result, and the reported Figure 10b numbers cannot be derived from the pseudocode as written. The concern is not about disagreement with consensus or about novelty; it is an internal consistency question between the embedding and detection procedures. The available open-source code could settle it, which is why the verdict should remain conditional rather than being hardened to reject: the implementation may contain an undocumented mapping that makes the result correct, but that mapping would need to be added to the algorithm description. Other side issues, such as the lack of a direct comparison with Ji et al. or the use of aggregate fidelity means, are secondary and do not threaten the central claim as directly as the vertical subsetting gap.","tokens_in":19604,"tokens_out":5230,"duration_ms":59130,"concrete_test":"Run the released open-source implementation (github.com/sbaresearch/data-fingerprinting) on Adult Census with the Figure 10b vertical subsetting setup: v = 14, delete 10 columns so v' = 4, and instrument Algorithm 3 to log, for every surviving selected record, the attribute index computed at embedding time versus detection time. If any index differs, the published algorithm cannot reproduce the claimed 100% DC. Separately, check whether the detection code receives the original attribute count or a column-name mapping; if it does, that handling is absent from Algorithm 3 and must be specified for the claim to hold.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's headline claim of 100% detection confidence under removal of up to 70% of attributes is not derivable from the published algorithm. In Algorithm 1 (embedding), line 4, the marked attribute is i = s1 mod v, where v is the original attribute count. In Algorithm 3 (detection), line 6 uses the same formula, but the input is the fingerprinted database R' after vertical subsetting, so v is now the reduced number of surviving attributes. Unless the detector is given the original v and an explicit mapping from original column indices to surviving columns — which the paper does not state and which blind detection would seem to preclude — the detector will generally examine a different attribute than the embedder marked. Additionally, the correlated groups C, computed on the original schema, cannot be reconstructed if some of their member columns have been deleted. The paper reports perfect DC in Figure 10b with only 30% of columns remaining, yet no remapping, schema-alignment step, or alternative handling is described in Section V-B or in the robustness discussion. This is the load-bearing gap in the central claim because it affects whether the vertical-robustness result is produced by the stated algorithm at all, not merely whether the result is numerically weaker than reported.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The manuscript proposes NCorr-FP, a fingerprinting scheme for structured tabular data that embeds recipient-specific bits by replacing selected attribute values with values sampled from high- or low-density regions of the neighbourhood of similar records, where neighbourhoods are built using correlated attribute groups. Detection reverses the embedding by regenerating pseudo-random positions from the owner's secret key and record primary keys, classifying observed values by density, and applying majority voting; Tardos codes are used for collusion accusation. The authors evaluate the method on the Adult Census dataset across effectiveness (vote error rate, detection confidence, false accusation confidence), fidelity (Hellinger distance, KL divergence, correlation maps), utility (four classifiers), and robustness (horizontal/vertical subsetting, flipping, cluster-flipping, collusion). They report 100% detection confidence under removal of up to 80% of records or 70% of attributes, negligible fidelity loss, and precise collusion detection for small collusions.","tokens_in":19810,"tokens_out":5014,"duration_ms":55811,"significance":"If the results hold, NCorr-FP would be a useful addition to the database fingerprinting literature: it targets mixed-type tabular data, aims to preserve joint distributions and correlations, and is evaluated under a broad attack model. The open-source code release, the explicit parameter guidance in Table VIII, and the attacker-cost analysis are concrete strengths, and the horizontal-deletion and flipping robustness claims are plausible because they follow from high bit redundancy and low per-vote error. However, the vertical-subsetting robustness claim, which is part of the paper's headline contribution, is not derivable from the algorithms as written because detection and embedding use different attribute counts after columns are removed. That load-bearing gap must be resolved before the published vertical-robustness numbers can be accepted.","major_comments":[{"comment":"The reported vertical-subsetting robustness does not follow from the stated algorithms. In Algorithm 1, line 4, the marked attribute is i = s1 mod v, where v is the original attribute count. In Algorithm 3, line 6, the same formula is applied to the fingerprinted database after vertical subsetting, whose attribute count is no longer v. Unless the detector is explicitly given the original v and a mapping from surviving column positions to original column positions—neither of which is stated, and both of which would sit uneasily with the claimed blind setting—the detector will generally examine a different attribute than the embedder marked. The same schema-alignment problem affects the correlated groups C: they are defined on the original attribute set, and if member columns are deleted they cannot be reconstructed on the attacked schema. The paper must either specify the schema-alignment and group-reconstruction mechanism used to produce Figure 10b or re-run the vertical-subsetting experiments under the stated blind, schema-mismatched protocol and report the resulting detection confidence.","section":"Section V-B, Algorithm 3 (line 6) vs. Algorithm 1 (line 4); Fig. 10b"},{"comment":"Even if the attribute-index mismatch were fixed, the detection procedure still presupposes that the neighbourhood construction used in embedding can be reproduced after vertical subsetting. Algorithm 2 builds neighbourhoods from the values of the correlated group C, but after column deletion some members of a group are missing, so select_neighbours cannot be executed as written on the reduced schema. The paper does not describe how the detector handles partially deleted correlated groups or whether it falls back to a different similarity definition. This is not a cosmetic issue: the reported 100% detection confidence under 70% attribute removal depends on the detector being able to reconstruct, for each surviving marked attribute, a neighbourhood comparable to the one used at embedding time.","section":"Section V-B, Algorithm 3 (lines 9-10); Section VII-D"}],"minor_comments":[{"comment":"There are several typos, including 'embeddeding' in the abstract, 'requriements' in Section II, 'hihg-density' in Table I, 'accross' in Section IV, 'distibution' in Table I, and 'approx' in Section VII-D; a proofreading pass is needed.","section":"Abstract and Section I"},{"comment":"The caption reads 'N=20', but Table I defines N as a neighbourhood, whereas Figure 4 appears to use N as the number of recipients; please rename one of these to avoid ambiguity.","section":"Figure 4 caption"},{"comment":"Line 11 contains the typo 'LDphi′' instead of 'LD′ϕ', and the indentation of lines 16-17 relative to the if/else on lines 12-15 is ambiguous; the pseudocode should make explicit that the fingerprint bit is computed for both branches.","section":"Algorithm 3"},{"comment":"The baseline 'random fingerprinting' used in Table II and Figure 8 is not described or cited; please specify the baseline algorithm and parameters so the fidelity comparison is reproducible.","section":"Section VI-B and Table II"},{"comment":"The symbol ν in the lower bound 1 − 1/(νγ) is not defined in Table I or in the text; please define it or replace it with an explicitly named quantity.","section":"Equation (9)"}],"recommendation":"major_revision","confidential_remarks":null},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: NCorr-FP is a solid, incremental extension of the authors' earlier neighbourhood-based fingerprinting for categorical data to mixed-type data, with a credible evaluation on Adult Census. The thing to know: the headline claim of 100% detection confidence under 70% attribute removal does not follow from the algorithm as written.\n\nWhat's new: they add Gaussian-KDE density regions to handle continuous attributes, add correlation groups to guide neighbourhood selection, and integrate Tardos codes for collusion. The embedding logic — sample replacement values from similar records' attribute values — is genuinely from their 2020 categorical paper, so the novelty is modest but real. The open-source code is a plus, and the evaluation is fairly thorough: VER, DC, FAC, Hellinger/KL, pairwise histograms, correlation changes, four classifiers, and attacks including cluster-flipping tailored to the scheme. Horizontal deletion robustness and utility results are plausible; low per-vote error plus high redundancy explains those numbers.\n\nSoft spots in proportion: the vertical-subsetting result is the load-bearing gap. In Algorithm 1 the marked attribute is i = s1 mod v with the original v; in Algorithm 3 the detector uses the same formula on the attacked database, so v is now the reduced attribute count. Points to different columns. Correlated groups C can't be reconstructed if member columns are gone. The paper reports perfect DC with 30% of columns remaining and never explains a remapping or schema-alignment step. Either the claim is wrong, or there is unstated machinery; the authors need to clarify.\n\nTwo smaller issues: the headline fidelity numbers are aggregate means; per-attribute Hellinger distances for capital-gain and capital-loss at high embedding ratio are an order of magnitude larger than the reported average. That's not fatal, but \"minute\" overstates it. And the paper never compares against Ji et al.'s correlation-preserving scheme, which is the obvious state of the art; a baseline would strengthen the fidelity claims. Also, the density percentile phi is a free parameter and its value in the experiments isn't reported, which hurts reproducibility.\n\nBottom line: this is a useful paper for people working on database watermarking/fingerprinting, and it deserves peer review — the core idea and evaluation are sound enough. But the vertical-robustness claim needs to be either fixed or scaled back before I'd trust the headline. I'd send it to a serious referee, with the vertical issue as the main question.","headline":"Solid incremental extension of the authors' own categorical fingerprinting to mixed-type data, but the headline vertical-subsetting robustness claim doesn't follow from the algorithm as written.","tokens_in":20363,"tokens_out":4704,"would_cite":false,"duration_ms":43255,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"NCorr-FP embeds recipient-specific fingerprints by sampling replacements from the local density of similar records, yielding 100% detection confidence even after 80% record or 70% attribute deletion.","keywords":["data fingerprinting","database watermarking","correlation preservation","blind detection","collusion-resistant codes","neighbourhood sampling","data fidelity"],"falsifier":"Run the detection algorithm on a fingerprinted copy from which one column has been removed, without any special column-remapping logic; because the algorithm computes the attribute as $s_1 \\bmod v$ on the reduced column count, the marks that used the deleted column would be read from the wrong attribute and detection confidence should fall toward chance unless an explicit remapping exists. This is directly testable with the paper's released implementation.","tokens_in":19362,"feed_emoji":"🔐","tokens_out":7651,"duration_ms":74839,"temperature":0.7,"pith_summary":"The paper introduces NCorr-FP, a data fingerprinting method that embeds a recipient-specific bit string into structured tabular data by making small, locally plausible value changes. The central claim is that by picking replacement values from the low- or high-density parts of the distribution among similar records, the fingerprint is both statistically invisible and recoverable without the original data. On the Adult dataset, the method reports 100% detection confidence after deleting up to 80% of records or 70% of attributes, near-zero distribution distortion, and at most a 1.6% drop in downstream classification accuracy. If true, this gives data owners a way to trace leaks without sacrificing the usability or statistical fidelity of the shared data.","feed_headline":"Fingerprint survives 80% record deletion intact","feed_subtitle":"Local density sampling hides recipient marks while preserving correlations and machine-learning utility.","key_machinery":"The load-bearing object is the neighbourhood-constrained density split. Given a record $r$ and a target attribute $A_i$, the algorithm computes a neighbourhood $N$ of records most similar to $r$ using a distance metric over a precomputed correlated-attribute group $C$; it then estimates the distribution of $A_i$ values inside $N$ (Gaussian KDE for continuous attributes, frequency counts for categorical attributes), separates it by percentile $\\phi$ into high-density $HD_\\phi$ and low-density $LD_\\phi$ regions, and samples the replacement from one of these regions according to the mark bit. The same split is rebuilt during detection, which is why no original data is needed; the redundancy of each fingerprint bit, $\\omega \\approx n/(L\\gamma)$, converts per-position classification errors into a reliable majority vote.","core_discovery":"The discovery is the embedding–detection loop itself. For each record selected by a pseudorandom generator seeded with the owner's key and the record's primary key, an attribute, a fingerprint bit, and a mask bit are chosen; the mark bit $m = x \\oplus f$ decides whether the new value is sampled from the high-density or low-density region of the target attribute's distribution among $k$ nearest neighbours. Detection repeats the same positions without access to the original data, classifies the observed value into the high- or low-density region, recovers $m$, and retrieves $f = m \\oplus x$; all votes for each fingerprint bit are then majority-decided. The paper argues that this makes every modification look like a natural value for that record, preserving marginal distributions and correlations, while the redundancy of embedding each bit many times makes the fingerprint robust to deletion and flipping attacks.","pith_inferences":["The density-split trick should be tested beyond Adult: on high-dimensional, sparse, or highly skewed data, kNN neighbourhoods and KDE estimates behave differently, so the same redundancy rule may not transfer unchanged.","The reported vertical-subsetting robustness implies the detector must cope with a shrunken attribute count; since detection computes the attribute as $s_1 \\bmod v$ on the modified database, a direct replication of the 70% column-deletion result with the released implementation would show whether there is an undocumented remapping or whether the result depends on the Adult column order.","Because detection only recovers the mark bit and not the original value, the scheme is a natural fit for incremental data updates: new records can be marked and later checked as long as the owner keeps the same key and parameter set.","The $\\omega \\geq 16$ rule gives a ready-made design target: for a fixed dataset size it upper-bounds fingerprint length relative to embedding ratio, which directly translates into the trade-off between collusion tracing power and single-copy robustness."],"forward_implications":["With redundancy at least $\\omega \\geq 16$, fingerprints are extracted with 100% confidence from just 20% of records and 30% of columns, i.e. after 80% horizontal and 70% vertical subsetting.","Robustness against value flipping is controlled by embedding ratio: with $1/\\gamma = 0.13$ the fingerprint stays above 95% confidence for up to 25% flipped values, and with $1/\\gamma = 0.5$ for up to 40% flipped values.","Fidelity and utility degrade slowly with embedding strength: the worst observed Hellinger distance is 0.0225, KL divergence is below $6 \\times 10^{-3}$, and classification accuracy loss is at most 1.6% across four classifiers.","Colluding recipients can be traced with perfect precision for small coalitions and precision at least 0.88 for up to 10 colluders when using longer Tardos fingerprints; recall is lower for larger collusions.","The recommended parameter rule is to choose the largest fingerprint length $L$ that still satisfies $\\omega \\geq 16$, use a high embedding ratio near 1, and keep the neighbourhood size $k$ at or below 1% of the dataset."],"supporting_citations":[{"why":"Defines the five requirements (effectiveness, fidelity, utility, robustness, blindness) that frame the system model and the evaluation.","marker":"[1]"},{"why":"Supplies the Tardos collusion-resistant fingerprint codes and the accusation-score procedure used for traitor tracing.","marker":"[2]"},{"why":"Establishes the public-system and white-box attacker assumptions used in the threat model.","marker":"[3]"},{"why":"Foundational random-LSB relational watermarking scheme that serves as a fidelity baseline for comparison.","marker":"[6]"},{"why":"Provides earlier relational fingerprinting schemes and hash-based fingerprints used as baselines for detection confidence and false-accusation behavior.","marker":"[7]"},{"why":"Prior correlation-preserving fingerprinting approach based on optimal mass transport, which NCorr-FP extends and against which the Adult dataset evaluation setup is drawn.","marker":"[13]"},{"why":"The categorical-data neighbourhood fingerprinting method that NCorr-FP generalizes to mixed-type attributes and blind detection.","marker":"[14]"}],"fun_headline_variants":["Fingerprint survives 80% deletion, keeps correlations","Local-density embedding hides marks, resists collusion","Correlation-preserving fingerprinting thwarts deletion attacks","Neighbourhood-based fingerprinting preserves data fidelity"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The whole scheme rests on the detector being able to reconstruct the same pseudo-random positions that the embedder used; if deleting columns shifts the attribute index to a different column, the reported robustness to 70% attribute deletion does not follow from the detection algorithm as described.","fun_headline_variants_meta":{"raw":{"variants":["Fingerprint survives 80% deletion, keeps correlations","Local-density embedding hides marks, resists collusion","Correlation-preserving fingerprinting thwarts deletion attacks","Neighbourhood-based fingerprinting preserves data fidelity"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000296,"raw_usage":{"total_tokens":1697,"prompt_tokens":904,"completion_tokens":793,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":520,"completion_tokens_details":{"reasoning_tokens":730}},"tokens_in":520,"tokens_out":793,"duration_ms":7794,"temperature":1.0,"reasoning_tokens":730,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T22:44:43.321192+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the detection algorithm on a fingerprinted copy from which one column has been removed, without any special column-remapping logic; because the algorithm computes the attribute as $s_1 \\bmod v$ on the reduced column count, the marks that used the deleted column would be read from the wrong attribute and detection confidence should fall toward chance unless an explicit remapping exists. This is directly testable with the paper's released implementation.","supporting_citations":[{"cited_title":"Comparative Analysis of Relational Database Watermarking Techniques: An Empirical Study,","cited_arxiv_id":null,"evidence_quote":"Defines the five requirements (effectiveness, fidelity, utility, robustness, blindness) that frame the system model and the evaluation."},{"cited_title":"Optimal probabilistic fingerprint codes,","cited_arxiv_id":null,"evidence_quote":"Supplies the Tardos collusion-resistant fingerprint codes and the accusation-score procedure used for traitor tracing."},{"cited_title":"Watermarking Techniques for Relational Databases: Survey, Classification and Comparison,","cited_arxiv_id":null,"evidence_quote":"Establishes the public-system and white-box attacker assumptions used in the threat model."},{"cited_title":"Watermarking relational data: framework, algorithms and analysis,","cited_arxiv_id":null,"evidence_quote":"Foundational random-LSB relational watermarking scheme that serves as a fidelity baseline for comparison."},{"cited_title":"Fingerprinting relational databases: schemes and specialties,","cited_arxiv_id":null,"evidence_quote":"Provides earlier relational fingerprinting schemes and hash-based fingerprints used as baselines for detection confidence and false-accusation behavior."},{"cited_title":"Towards Robust Fingerprinting of Relational Databases by Mitigating Correlation Attacks,","cited_arxiv_id":null,"evidence_quote":"Prior correlation-preserving fingerprinting approach based on optimal mass transport, which NCorr-FP extends and against which the Adult dataset evaluation setup is drawn."},{"cited_title":"A Correlation-Preserving Fingerprinting Technique for Categorical Data in Relational Databases,","cited_arxiv_id":null,"evidence_quote":"The categorical-data neighbourhood fingerprinting method that NCorr-FP generalizes to mixed-type attributes and blind detection."}],"review_version":1}