Pith. sign in

REVIEW 3 major objections 6 minor 2 cited by

MUSE: Model-Agnostic Tabular Watermarking via Multi-Sample Selection

T0 review · 3 major / 6 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper claims MUSE embeds a tabular watermark by generating m candidate rows per row and keeping the one with the highest secret-key hash score, without any inversion of the generative model.

desk verdict A pragmatic, well-executed tabular watermarking method whose empirical results are strong, but the theoretical FPR calibration is mislabeled and unsupported for the actual z-test. read the letter →

arxiv 2505.24267 v1 pith:56SPFVZ2 submitted 2025-05-30 cs.CR

Liancheng Fang , Aiwei Liu , Henry Peng Zou , Yankai Chen , Hengrui Zhang , Zhongfen Deng , Philip S. Yu This is my paper
classification cs.CR
keywords tabulardatawatermarkinggenerativemodelmulti-sampleselectionfalsepositiveratecalibrationmodel-agnostichash-basedscoringsyntheticprovenance
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that synthetic tabular data can be watermarked by oversampling rather than by inverting a generative model. For each row the watermarker draws $m$ candidate rows from the generator and publishes only the one whose secret-key hash score is highest, so the watermark lives in the selection, not in altered values or latent noise. Because no inversion is involved, the method is claimed to work with any tabular generator that supports repeated sampling, including diffusion, autoregressive, and masked models. The paper derives a false-positive bound $\exp(-\frac{N}{2}(0.5-0.5^m)^2)$ and a formula for choosing $m$, and reports perfect detection at $0.1\%$ false-positive rate with much lower distribution distortion than inversion-based watermarks.

What carries the argument

The load-bearing device is the max-of-$m$ selection statistic. For a fixed key $k$, a hash over the values of three adaptively chosen columns seeds a Bernoulli(0.5) score; generating $m$ candidates and keeping the maximum turns the expected score from $0.5$ into $1-0.5^m$. Hoeffding's inequality on the difference between watermarked and unwatermarked table means yields the FPR bound $\exp(-\frac{N}{2}(0.5-0.5^m)^2)$, and Equation (7) inverts that bound to calibrate $m$ from table size $N$ and target FPR $\alpha$. Adaptive column selection based on empirical quantile ranks and repeated-column masking keep the hash inputs diverse so the scores behave like fair coin flips.

What would settle it

Compute the empirical mean of $s_k(x_i)$ over a large unwatermarked table for a fixed key $k$; if it visibly differs from $0.5$, then the detection gap shrinks and the FPR bound in Theorem 3.3 no longer holds. Directly measuring the FPR at the calibrated $m$ on many unwatermarked tables would settle whether the guarantee is met.

Watch

Extended reading notes

Core claim

The central claim is that a tabular watermark can be made model-agnostic and nearly distortion-free by replacing inversion with multi-sample selection. Given a secret key $k$, MUSE computes a deterministic score $s_k(x)\sim\text{Bernoulli}(0.5)$ from a hash of $k$ and values in three adaptively selected columns, draws $m$ candidate rows per table row, and keeps the candidate with the maximum score. A watermarked table therefore has mean score $1-0.5^m$ instead of $0.5$, and Hoeffding's inequality gives the FPR bound in Theorem 3.3; Equation (7) then picks the smallest $m$ that meets a target FPR. In experiments on six datasets, this yields $1.0$ TPR at $0.1\%$ FPR while reducing fidelity distortion by $81\text{--}89\%$ relative to inversion-based baselines, and it remains effective across diffusion, autoregressive, and masked tabular generators.

Load-bearing premise

The false-positive guarantee assumes that, for a fixed secret key, the score of any row is as unpredictable as a fair coin flip, even though the implementation uses a deterministic hash and never checks that the hash is balanced on the actual data.

Editorial extensions

If this is right

  • Any tabular generator that can sample repeatedly—diffusion, autoregressive, masked, or even a pre-existing table—can be watermarked without changing model internals.
  • A provider can compute $m$ from $N$ and a target FPR, so watermark strength is calibrated instead of heuristic.
  • Detection is just averaging hash scores over rows, so it is fast enough for large published tables.
  • The watermark survives row shuffling, row deletion, cell deletion, and value alteration at high attack strengths; column deletion is the reported vulnerability.
  • Watermarked tables keep downstream utility close to unwatermarked generations, with fidelity gaps near the unwatermarked model's own noise.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Because the watermark lives entirely in which sample is released, the method should transfer to any cheap repeated-sampling setting with independently sampled outputs, such as other synthetic structured data, provided the scoring hash is balanced on that data.
  • The paper does not analyze privacy: releasing the max-scoring of $m$ samples changes the sampling distribution slightly, so the interaction with differential privacy of the generator is an open question.
  • A practical safeguard would be an empirical calibration step: before trusting Equation (7), measure the score mean on unwatermarked data for the chosen key and reject keys that are visibly unbalanced.
  • An adversary aware of the adaptive column-selection rule knows that deleting selected columns destroys the signal, which the paper already identifies as the weakest attack.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper proposes MUSE, a watermarking method for tabular generative models. Instead of relying on DDIM inversion, MUSE generates m candidate rows from the model, computes a key-dependent hash-based score on selected columns for each candidate, and selects the highest-scoring row. Repeating this over N rows embeds a watermark that is detected by comparing the mean score, or a one-tailed z-test, against the unwatermarked expectation. The authors provide a theoretical analysis (Lemma 3.1, Lemma 3.2, Theorem 3.3) claiming precise calibration of the false positive rate via the choice of m, and support the method with experiments on six tabular datasets, reporting near-perfect TPR@0.1%FPR, low fidelity distortion relative to TabWak, robustness to several attacks, and applicability across three model families.

Significance. The high-level idea is attractive and the empirical work is substantial: MUSE is model-agnostic, avoids the computationally costly and error-prone inversion pipeline, and appears from Tables 1 and 2 to preserve data quality much better than inversion-based baselines while retaining very high detectability. The paper also ships a public implementation and includes component-wise ablations (Section 4.3) and attack curves (Figure 4). If the advertised FPR calibration were correct, the method would be a practical and easily deployable contribution to tabular data watermarking. However, the theoretical guarantee as stated does not currently support the abstract's claim of 'precise calibration': the bound proved is not on the false positive rate of the actual detection test, and the Bernoulli(0.5) assumption on the fixed-key hash scores is unverified. The empirical detection numbers do not resolve this issue because they are not reported as unwatermarked false positive rates under the same protocol. The central empirical findings are plausible, but the paper's main formal claim needs to be reworked before publication.

major comments (3)
  1. [Section 3.4, Lemma 3.1, Appendix C.4] The quantity bounded in Eq. (5), Pr(S(T_no-wm) > S(T_wm)), is not the false positive rate of the watermark detection test used in the paper. The detector in Appendix C.4 is a one-tailed z-test on the count of score-1 rows under H0, and its FPR is controlled by the critical value z_alpha; Eq. (5) instead bounds the probability that an unwatermarked table outscores a watermarked table, which is a miss/ordering probability for a paired comparison. Consequently, Eq. (6) and the calibration formula Eq. (7) do not, as written, guarantee an FPR below alpha. The authors should re-derive the result for the actual test: specify a decision rule (e.g., reject when the test statistic exceeds a threshold), and bound Pr(reject | H0) and ideally Pr(accept | H1) under the true null and alternative distributions.
  2. [Section 3.2, Eqs. (1)-(2); Theorem 3.3] Theorem 3.3 assumes that s_k(x) ~ Bernoulli(0.5) for a fixed key k when x is drawn from the data distribution, but this is not established. In the implementation, H is a deterministic hash, so for a fixed k the score of a given row is fixed; the paper does not prove that P_{x~p}[H(pi(x),k)=1] is close to 0.5 on the actual support of the generative model. If the hash is imbalanced for the chosen key, the null mean under H0 is not 0.5, the z-test in Appendix C.4 is miscentered, and the detection gap in Eq. (6) becomes E[max_j s_k(x_j)] - mu rather than 0.5 - 0.5^m. The large z-statistics in Table 2 do not distinguish a genuine watermark from a shifted null, since the reported z-statistic is computed assuming mu = 0.5. The repeated column masking heuristic in Section 3.3 is not incorporated into Theorem 3.3. To fix this, the authors should either prove a balance property for the hash over the data distribution for every key (e.g., via a universal family and an explicit key-selection procedure), or add an empirical calibration step that measures the null distribution for the chosen key and reports unwatermarked FPRs.
  3. [Section 4.3, 'Distortion-Free Watermarking'] The claim that the repeated column masking procedure makes the selected row 'effectively random' and thereby approximately unbiased is not formally justified. Choosing the maximum of m hash-based scores still induces a conditional bias on the selected row through the selected columns, and masking only skips previously seen values; it does not remove the dependence between the score and the row value. Since Section 3.1 advertises MUSE as 'distribution-preserving' and Section 4.3 uses this argument to explain the improved fidelity numbers, the authors should either prove an unbiasedness statement under explicit conditions or explicitly present the distortion-free behavior as an empirical property rather than a theoretical guarantee.
minor comments (6)
  1. [Appendix D, Eq. (14)] In the proof of Lemma 3.1, S(T_no-wm) and S(T_wm) are defined as sums of N i.i.d. scores, whereas Eq. (4) defines S(T) as the mean score; align the notation to avoid a factor-of-N inconsistency in the presentation.
  2. [Algorithm 1] The algorithm splits the table into N/m groups, but N/m may not be an integer for the m computed from Eq. (7); specify how the final partial group is handled.
  3. [Eq. (2)] The notation 'f ~ Bernoulli(0.5)' is confusing because f is described as a mapping from hash h to a score; clarify whether f is a deterministic pseudorandom function whose output distribution over the input distribution is meant, rather than a random variable drawn per row.
  4. [Section 3.3 and Section 3.4] The adaptive column selection in Eq. (3) requires access to the training data T or its empirical marginal distributions, but the threat model in Section 2 only states that the provider shares the key with the detector; state explicitly what auxiliary information (e.g., training data or a fitted quantile function) the detector needs to compute pi(x) for a submitted table.
  5. [Table 1] The column header 'Num. Training Rows 100 500' is misleading; these are the sizes of the generated/watermarked tables N, not training rows, and should be relabeled (e.g., 'Table size N').
  6. [Figure 5] The statement that MUSE's generation time is lower than the inversion baselines 'despite using multi-sample generation (m=2)' should be accompanied by the caveat that generation time scales linearly with m, so the comparison depends on the operating point chosen by Eq. (7).

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: Theorem 3.3's FPR bound is a parameter-free Hoeffding derivation conditional on a stated Bernoulli(0.5) hash-balance assumption; the unverified fixed-key hash balance and the mislabeled FPR quantity are correctness risks, not circular reductions.

full rationale

The derivation chain is not circular. The central claim, Theorem 3.3 Eq. (6), upper-bounds Pr(S(Tno-wm) > S(Twm)) by exp(-N/2 (0.5 - 0.5^m)^2). This follows by Hoeffding's inequality (Lemma 3.1) together with the exact expectation E[max of m i.i.d. Bernoulli(0.5) draws] = 1 - 0.5^m; neither step uses a fitted constant, and m in Eq. (7) is computed from N and the target alpha rather than tuned to match the reported TPR@0.1%FPR values. The closest candidate for circularity would be the claim that the Bernoulli(0.5) hypothesis of Theorem 3.3 is guaranteed by the Eq. (2) construction, making the 'prediction' a restatement of the definition. That is not what the paper shows: Eq. (2) defines a deterministic hash-seeded score, while the theorem hypothesizes s_k(x) ~ Bernoulli(0.5) over the data distribution for a fixed key, which is strictly stronger and unproven, with no balance test or key-selection mechanism supplied. The gap runs opposite to circularity: the construction under-delivers relative to the theorem's hypothesis rather than trivially satisfying it. An imbalanced hash on the actual data support would shift the null mean away from 0.5, so m from Eq. (7) would not deliver the advertised 0.1% FPR; this is a soundness gap, not an equivalence by construction. Likewise, Eq. (5) bounds the probability that an unwatermarked mean exceeds a watermarked mean, which is not the threshold-based FPR used in the detection protocol, and the z-test in Appendix C.4 assumes the very Binomial(N, 0.5) null that the theorem merely hypothesizes; these are mislabeling and proof-gap issues rather than circular reductions. Self-citations (TabSyn [Zhang et al., 2024c], TabGen-ICL [Fang et al., 2025], the survey [Liu et al., 2024], TabDAR [Zhang et al., 2024a]) appear only as testbed models, baselines, or background; none carries the load of the FPR derivation, no uniqueness theorem is imported from the authors, and no ansatz is smuggled via citation. The 1.0 TPR@0.1%FPR and Table 2 z-statistics are empirical measurements of the implemented scheme, not outputs of the theorem. The paper is therefore close to self-contained, with the main weaknesses being unverified modeling assumptions rather than circularity.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

MUSE introduces no fitted constants: m is derived from a target FPR, n and masking are design choices. The main burden is the idealization that a fixed-key hash score behaves as an independent Bernoulli(0.5) over the data distribution, and the mislabeled FPR bound. No new physical entities are postulated.

free parameters (4)
  • number of selected columns (n) = 3
    Hand-chosen in all main experiments; the ablation in Section 4.3 views n=3 as a balanced trade-off, not a fitted value.
  • candidate count (m) = 2 for N=500, 4 for N=100 (Figure 3)
    Computed from Equation (7) using a target FPR, so it is not fitted to data; listed because it is a tunable watermark-strength knob.
  • significance level alpha = not explicitly reported; experiments report TPR@0.1%FPR, implying alpha=0.001
    The calibration in Eq (7) requires a user-chosen alpha; the paper does not state which alpha was used to set m in each experiment.
  • repeated column masking = enabled in main experiments
    A design choice from Section 4.3 that trades detection strength for fidelity; not fitted, but it is an extra mechanism the central quality claims depend on.
assumptions (5)
  • domain assumption For a fixed key, hash-seeded scores s_k(x) are independent Bernoulli(0.5) random variables across rows and candidates
    Needed for Theorem 3.3's mean gap 0.5-0.5^m; the implementation makes scores deterministic for fixed k, so this is an idealization without a fixed-key concentration proof.
  • ad hoc to paper The misordering probability Pr(S(T_no-wm)>S(T_wm)) is the false positive rate of detection
    Lemma 3.1 and Eq (7) use this quantity as 'FPR', but the actual detector is a one-tailed z-test (Appendix C.4), so the bound does not control the test's FPR.
  • domain assumption Candidate rows are i.i.d. draws from the generative model's distribution p(x)
    Standard generative-model assumption invoked in Lemma 3.1 and Section 3.1; required for the max-of-m order statistic calculation.
  • domain assumption H is balanced on the tabular data support for each fixed key, so P_x(s_k(x)=1) approximately equals 0.5
    Without this, the unwatermarked mean score may deviate from 0.5 and the calibrated m loses its guarantee.
  • ad hoc to paper Repeated column masking makes the selected row distribution approximately unbiased
    Backs the 'distortion-free' discussion in Section 3.1/4.3; no proof is provided, and Table 2 shows residual distortion even with masking.

how reviews work

0 comments
Cite this review

Pith. "Pith review of MUSE: Model-Agnostic Tabular Watermarking via Multi-Sample Selection." pith.science (2026). https://pith.science/paper/56SPFVZ2

@misc{pith2026250524267,
  author       = {Pith},
  title        = {Pith review of: MUSE: Model-Agnostic Tabular Watermarking via Multi-Sample Selection},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/56SPFVZ2}},
  note         = {Machine review of arXiv:2505.24267}
}
read the original abstract

We introduce MUSE, a watermarking algorithm for tabular generative models. Previous approaches typically leverage DDIM invertibility to watermark tabular diffusion models, but tabular diffusion models exhibit significantly poorer invertibility compared to other modalities, compromising performance. Simultaneously, tabular diffusion models require substantially less computation than other modalities, enabling a multi-sample selection approach to tabular generative model watermarking. MUSE embeds watermarks by generating multiple candidate samples and selecting one based on a specialized scoring function, without relying on model invertibility. Our theoretical analysis establishes the relationship between watermark detectability, candidate count, and dataset size, allowing precise calibration of watermarking strength. Extensive experiments demonstrate that MUSE achieves state-of-the-art watermark detectability and robustness against various attacks while maintaining data quality, and remains compatible with any tabular generative model supporting repeated sampling, effectively addressing key challenges in tabular data watermarking. Specifically, it reduces the distortion rates on fidelity metrics by 81-89%, while achieving a 1.0 TPR@0.1%FPR detection rate. Implementation of MUSE can be found at https://github.com/fangliancheng/MUSE.

Figures

Figures reproduced from arXiv: 2505.24267 by the authors.

Figure 1
Figure 1. Left: Tabular diffusion models exhibit the lowest inversion accuracy (bit accuracy) when compared to video and image diffusion models. Right: Tabular diffusion models require much fewer generation GFLOPs than video and image diffusion models. Models used: TabSyn [Zhang et al., 2024c] (tabular), Stable Diffusion [Rombach et al., 2022, Blattmann et al., 2023] (image/video). The rapid development of tabular generative … view at source ↗
Figure 2
Figure 2. An overview of the MUSE watermark generation process. MUSE operates by generating multiple samples and selecting the highest-scoring sample (ties are broken randomly). The selected row is appended to the watermarked table, while others are discarded. 2 Preliminaries Tabular Generative Models. A tabular dataset with N rows and M columns consists of i.i.d. samples (xi) N i=1 drawn from an unknown joint distribution p(… view at source ↗
Figure 3
Figure 3. m vs. N under differ￾ent α values (smoothed). Theorem 3.3 enables MUSE to calibrate the number of repeated samples m to achieve a target false positive rate with theoretical guarantees. This allows the method to embed just enough wa￾termarking signal to ensure the desired detectability. Intuitively, since no redundant watermarking signal is embedded, the impact of watermarking on the generation quality is minimal. I… view at source ↗
Figures from the paper (5 more)
Figure 4
Figure 4. Figure 4: Detection performance of watermarking methods against different types of tabular data [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]
Figure 5
Figure 5. Figure 5: Watermark generation and detection time of MUSE and inversion-based baselines. Computation Time. We compare the effective watermarking time (generation + detection) of MUSE with baselines that rely on DDIM inver￾sion. We generate 10K watermarked rows of the Adult datas…
Figure 7
Figure 7. Figure 7: Pipeline of Inversion-based Watermarking. [PITH_FULL_IMAGE:figures/full_fig_p017_7.png]
Figure 8
Figure 8. Figure 8: Error Accumulation and Detection Performance Across Inversion Stages of TabWak. The [PITH_FULL_IMAGE:figures/full_fig_p018_8.png]
Figure 6
Figure 6. Figure 6: Detection performance of MUSE vs. TabWak/TabWak* against different types of tabular data attacks across varying attack intensities. From top to bottom: Beijing, Default, Magic, News and Shoppers. 25 [PITH_FULL_IMAGE:figures/full_fig_p025_6.png]

Discussion (0). Sign in to comment.

Forward citations

Cited by 2 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. RaMark: Radioactive Watermarking for Generated Tabular Data

    cs.CR 2026-07 conditional novelty 7.0 of 10

    A sinusoidal dependency embedded as part of the tabular distribution remains detectable after generative retraining and data-modification attacks while utility is preserved.

  2. Observation-Level Watermarking and Detection for Tabular Data

    stat.ME 2026-07 conditional novelty 6.5 of 10

    STAMP embeds Laplace keys via refined empirical CDFs so watermarked tabular rows keep the original law asymptotically and remain detectable from a single observation.

Reference graph

Works this paper leans on

43 extracted references · 19 canonical work pages · cited by 2 Pith papers

  1. [1]

    Watermarking gpt outputs

    Scott Aaronson and Hendrik Kirchner. Watermarking gpt outputs. https://www.scottaaronson.com/talks/watermark.ppt, 2022. Presentation

    work page 2022

  2. [2]

    Generating synthetic data in finance: opportunities, challenges and pitfalls

    Samuel A Assefa, Danial Dervovic, Mahmoud Mahfouz, Robert E Tillman, Prashant Reddy, and Manuela Veloso. Generating synthetic data in finance: opportunities, challenges and pitfalls. In Proceedings of the First ACM International Conference on AI in Finance, pages 1--8, 2020

    work page 2020

  3. [3]

    Stable video diffusion: Scaling latent video diffusion models to large datasets

    Andreas Blattmann, Tim Dockhorn, Sumith Kulal, Daniel Mendelevitch, Maciej Kilian, Dominik Lorenz, Yam Levi, Zion English, Vikram Voleti, Adam Letts, et al. Stable video diffusion: Scaling latent video diffusion models to large datasets. arXiv preprint arXiv:2311.15127, 2023

    arXiv 2023

  4. [4]

    Adversarial attacks for tabular data: Application to fraud detection and imbalanced data

    Francesco Cartella, Orlando Anunciacao, Yuki Funabiki, Daisuke Yamaguchi, Toru Akishita, and Olivier Elshocht. Adversarial attacks for tabular data: Application to fraud detection and imbalanced data. arXiv preprint arXiv:2101.08030, 2021

    arXiv 2021

  5. [5]

    DP-TBART: A Transformer-based Autoregressive Model for Differentially Private Tabular Data Generation

    Rodrigo Castellon, Achintya Gopal, Brian Bloniarz, and David Rosenberg. Dp-tbart: A transformer-based autoregressive model for differentially private tabular data generation. arXiv preprint arXiv:2307.10430, 2023

    work page Pith review arXiv 2023

  6. [6]

    Undetectable watermarks for language models

    Miranda Christ, Sam Gunn, and Or Zamir. Undetectable watermarks for language models. In The Thirty Seventh Annual Conference on Learning Theory, pages 1125--1139. PMLR, 2024

    work page 2024

  7. [7]

    Scalable watermarking for identifying large language model outputs

    Sumanth Dathathri, Abigail See, Sumedh Ghaisas, Po-Sen Huang, Rob McAdam, Johannes Welbl, Vandana Bachani, Alex Kaskasoli, Robert Stanforth, Tatiana Matejovicova, Jamie Hayes, Nidhi Vyas, Majd Al Merey, Jonah Brown-Cohen, Rudy Bunel, Borja Balle, Taylan Cemgil, Zahra Ahmed, Kitty Stacpoole, Ilia Shumailov, Ciprian Baetu, Sven Gowal, Demis Hassabis, and Pu...

    2024

  8. [8]

    Diffusion models beat gans on image synthesis

    Prafulla Dhariwal and Alexander Nichol. Diffusion models beat gans on image synthesis. Advances in neural information processing systems, 34: 0 8780--8794, 2021

    2021

Show all 43 references
  1. [9]

    Tabgen-icl: Residual-aware in-context example selection for tabular data generation

    Liancheng Fang, Aiwei Liu, Hengrui Zhang, Henry Peng Zou, Weizhi Zhang, and Philip S Yu. Tabgen-icl: Residual-aware in-context example selection for tabular data generation. arXiv preprint arXiv:2502.16414, 2025

    2025 arXiv

  2. [10]

    Tabular and latent space synthetic data generation: a literature review

    Joao Fonseca and Fernando Bacao. Tabular and latent space synthetic data generation: a literature review. Journal of Big Data, 10 0 (1): 0 115, 2023

    2023

  3. [11]

    Watermax: breaking the llm watermark detectability-robustness-quality trade-off

    Eva Giboulot and Teddy Furon. Watermax: breaking the llm watermark detectability-robustness-quality trade-off. arXiv preprint arXiv:2403.04808, 2024

    2024 arXiv

  4. [12]

    Tabmt: Generating tabular data with masked transformers

    Manbir Gulati and Paul Roysdon. Tabmt: Generating tabular data with masked transformers. Advances in Neural Information Processing Systems, 36, 2024

    2024

  5. [13]

    Watermarking generative tabular data

    Hengzhi He, Peiyu Yu, Junpeng Ren, Ying Nian Wu, and Guang Cheng. Watermarking generative tabular data. arXiv preprint arXiv:2405.14018, 2024

    2024 arXiv

  6. [14]

    Synthetic data generation for tabular health records: A systematic review

    Mikel Hernandez, Gorka Epelde, Ane Alberdi, Rodrigo Cilla, and Debbie Rankin. Synthetic data generation for tabular health records: A systematic review. Neurocomputing, 493: 0 28--45, 2022

    2022

  7. [15]

    On exact inversion of dpm-solvers

    Seongmin Hong, Kyeonghyun Lee, Suh Yoon Jeon, Hyewon Bae, and Se Young Chun. On exact inversion of dpm-solvers. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 7069--7078, 2024

    2024

  8. [17]

    Unbiased watermark for large language models

    Zhengmian Hu, Lichang Chen, Xidong Wu, Yihan Wu, Hongyang Zhang, and Heng Huang. Unbiased watermark for large language models. arXiv preprint arXiv:2310.10669, 2023

    2023 arXiv

  9. [18]

    Robin: Robust and invisible watermarks for diffusion models with adversarial optimization

    Huayang Huang, Yu Wu, and Qian Wang. Robin: Robust and invisible watermarks for diffusion models with adversarial optimization. Advances in Neural Information Processing Systems, 37: 0 3937--3963, 2024

    2024

  10. [19]

    Elucidating the design space of diffusion-based generative models

    Tero Karras, Miika Aittala, Timo Aila, and Samuli Laine. Elucidating the design space of diffusion-based generative models. Advances in neural information processing systems, 35: 0 26565--26577, 2022

    2022

  11. [20]

    Auto-encoding variational bayes

    Diederik P Kingma and Max Welling. Auto-encoding variational bayes. arXiv preprint arXiv:1312.6114, 2013

    2013 arXiv

  12. [21]

    A watermark for large language models

    John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. A watermark for large language models. In International Conference on Machine Learning, pages 17061--17084. PMLR, 2023

    2023

  13. [22]

    Tabddpm: Modelling tabular data with diffusion models

    Akim Kotelnikov, Dmitry Baranchuk, Ivan Rubachev, and Artem Babenko. Tabddpm: Modelling tabular data with diffusion models. In International Conference on Machine Learning, pages 17564--17579. PMLR, 2023

    2023

  14. [23]

    Robust distortion-free watermarks for language models

    Rohith Kuditipudi, John Thickstun, Tatsunori Hashimoto, and Percy Liang. Robust distortion-free watermarks for language models. arXiv preprint arXiv:2307.15593, 2023

    2023 arXiv

  15. [24]

    A semantic invariant robust watermark for large language models

    Aiwei Liu, Leyi Pan, Xuming Hu, Shiao Meng, and Lijie Wen. A semantic invariant robust watermark for large language models. ArXiv, abs/2310.06356, 2023

    2023 arXiv

  16. [25]

    A survey of text watermarking in the era of large language models

    Aiwei Liu, Leyi Pan, Yijian Lu, Jingjing Li, Xuming Hu, Xi Zhang, Lijie Wen, Irwin King, Hui Xiong, and Philip Yu. A survey of text watermarking in the era of large language models. ACM Computing Surveys, 57 0 (2): 0 1--36, 2024

    2024

  17. [26]

    Tabular transformers for modeling multivariate time series

    Inkit Padhi, Yair Schiff, Igor Melnyk, Mattia Rigotti, Youssef Mroueh, Pierre Dognin, Jerret Ross, Ravi Nair, and Erik Altman. Tabular transformers for modeling multivariate time series. In ICASSP 2021-2021 IEEE International Conference on Acoustics, Speech and Signal Processi...

    2021

  18. [27]

    Markllm: An open-source toolkit for llm watermarking

    Leyi Pan, Aiwei Liu, Zhiwei He, Zitian Gao, Xuandong Zhao, Yijian Lu, Binglin Zhou, Shuliang Liu, Xuming Hu, Lijie Wen, et al. Markllm: An open-source toolkit for llm watermarking. arXiv preprint arXiv:2405.10051, 2024

    2024 arXiv

  19. [28]

    Effective real image editing with accelerated iterative diffusion inversion

    Zhihong Pan, Riccardo Gherardi, Xiufeng Xie, and Stephen Huang. Effective real image editing with accelerated iterative diffusion inversion. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 15912--15921, 2023

    2023

  20. [29]

    High-resolution image synthesis with latent diffusion models

    Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bj \"o rn Ommer. High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 10684--10695, 2022

    2022

  21. [30]

    Tabdiff: a unified diffusion model for multi-modal tabular data generation

    Juntong Shi, Minkai Xu, Harper Hua, Hengrui Zhang, Stefano Ermon, and Jure Leskovec. Tabdiff: a unified diffusion model for multi-modal tabular data generation. In NeurIPS 2024 Third Table Representation Learning Workshop, 2024

    2024

  22. [31]

    Denoising diffusion implicit models

    Jiaming Song, Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. arXiv preprint arXiv:2010.02502, 2020

    2010 arXiv

  23. [32]

    Tree-ring watermarks: Fingerprints for diffusion images that are invisible and robust

    Yuxin Wen, John Kirchenbauer, Jonas Geiping, and Tom Goldstein. Tree-ring watermarks: Fingerprints for diffusion images that are invisible and robust. arXiv preprint arXiv:2305.20030, 2023

    2023 arXiv

  24. [33]

    Quantile normalization -- Wikipedia , the free encyclopedia

    Wikipedia contributors . Quantile normalization -- Wikipedia , the free encyclopedia. https://en.wikipedia.org/wiki/Quantile_normalization, 2025. Accessed: 2025-05-11

    2025

  25. [34]

    A survey on llm-generated text detection: Necessity, methods, and future directions

    Junchao Wu, Shu Yang, Runzhe Zhan, Yulin Yuan, Lidia Sam Chao, and Derek Fai Wong. A survey on llm-generated text detection: Necessity, methods, and future directions. Computational Linguistics, pages 1--66, 2025

    2025

  26. [35]

    Gaussian shading: Provable performance-lossless image watermarking for diffusion models

    Zijin Yang, Kai Zeng, Kejiang Chen, Han Fang, Weiming Zhang, and Nenghai Yu. Gaussian shading: Provable performance-lossless image watermarking for diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 12162--12171, 2024

    2024

  27. [36]

    Diffusion-nested auto-regressive synthesis of heterogeneous tabular data

    Hengrui Zhang, Liancheng Fang, Qitian Wu, and Philip S Yu. Diffusion-nested auto-regressive synthesis of heterogeneous tabular data. arXiv preprint arXiv:2410.21523, 2024 a

    2024 arXiv

  28. [37]

    Unleashing the potential of diffusion models for incomplete data imputation

    Hengrui Zhang, Liancheng Fang, and Philip S Yu. Unleashing the potential of diffusion models for incomplete data imputation. arXiv preprint arXiv:2405.20690, 2024 b

    2024 arXiv

  29. [38]

    Mixed-type tabular data synthesis with score-based diffusion in latent space

    Hengrui Zhang, Jiani Zhang, Balasubramaniam Srinivasan, Zhengyuan Shen, Xiao Qin, Christos Faloutsos, Huzefa Rangwala, and George Karypis. Mixed-type tabular data synthesis with score-based diffusion in latent space. In The twelfth International Conference on Learning Represen...

    2024

  30. [39]

    Provable robust watermarking for ai-generated text

    Xuandong Zhao, Prabhanjan Ananth, Lei Li, and Yu-Xiang Wang. Provable robust watermarking for ai-generated text. arXiv preprint arXiv:2306.17439, 2023

    2023 arXiv

  31. [40]

    Tabularmark: Watermarking tabular datasets for machine learning

    Yihao Zheng, Haocheng Xia, Junyuan Pang, Jinfei Liu, Kui Ren, Lingyang Chu, Yang Cao, and Li Xiong. Tabularmark: Watermarking tabular datasets for machine learning. In Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, pages 3570--3584, 2024

    2024

  32. [41]

    Galjaard, Pin-Yu Chen, Robert Birke, Cornelis Bos, and Lydia Y

    Chaoyi Zhu, Jiayi Tang, Jeroen M. Galjaard, Pin-Yu Chen, Robert Birke, Cornelis Bos, and Lydia Y. Chen. Tabwak: A watermark for tabular diffusion models. In The Thirteenth International Conference on Learning Representations, 2025. URL https://openreview.net/forum?id=71pur4y8gs

    2025

  33. [42]

    @esa (Ref

    \@ifxundefined[1] #1\@undefined \@firstoftwo \@secondoftwo \@ifnum[1] #1 \@firstoftwo \@secondoftwo \@ifx[1] #1 \@firstoftwo \@secondoftwo [2] @ #1 \@temptokena #2 #1 @ \@temptokena \@ifclassloaded agu2001 natbib The agu2001 class already includes natbib coding, so you should ...

  34. [43]

    \@lbibitem[] @bibitem@first@sw\@secondoftwo \@lbibitem[#1]#2 \@extra@b@citeb \@ifundefined br@#2\@extra@b@citeb \@namedef br@#2 \@nameuse br@#2\@extra@b@citeb \@ifundefined b@#2\@extra@b@citeb @num @parse #2 @tmp #1 NAT@b@open@#2 NAT@b@shut@#2 \@ifnum @merge>\@ne @bibitem@firs...

  35. [44]

    @open @close @open @close and [1] URL: #1 \@ifundefined chapter * \@mkboth \@ifxundefined @sectionbib * \@mkboth * \@mkboth\@gobbletwo \@ifclassloaded amsart * \@ifclassloaded amsbook * \@ifxundefined @heading @heading NAT@ctr thebibliography [1] @ \@biblabel @NAT@ctr \@bibset...

    2025 arXiv

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.