Pith. sign in

REVIEW 3 major objections 6 minor 29 references

Observation-Level Watermarking and Detection for Tabular Data

T0 review · 3 major / 6 minor · reviewed 2026-07-14 · grok-4.5

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read STAMP watermarks each tabular row so a single observation can still be detected while the original distribution is preserved.

desk verdict Solid, usable observation-level watermark for mixed tabular data with real single-row detection and clean asymptotics; the discrete case needs the continuous pre-ceiling output kept, and b is free, but the core claims hold. read the letter →

arxiv 2607.10554 v1 pith:WJMDRGEZ submitted 2026-07-12 stat.ME cs.LG

Dongyu Cui , Xuan Bi This is my paper
classification stat.MEcs.LG MSC 62G3062H1268P25
keywords tabulardatawatermarkingobservation-leveldetectiondistribution-invarianttransformationuserattributionempiricalCDFLaplacekeysubsettingrobustness
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Generative AI has made it easy to produce realistic tabular data, but hard to prove who owns a table or whether a value came from a watermarked source. Existing tabular watermarks mostly handle continuous columns, need whole datasets to detect, and do not attribute individual rows. This paper introduces STAMP: insert a secret Laplace key into each coordinate after mapping through a refined empirical CDF (and a chain-rule conditional version for multivariate data), then reverse the map at detection and check whether any stored key lands the result inside [0,1]. The true-positive rate is exactly 1 by construction; the true-negative rate goes to 1 as the noise scale grows (or under mild growth conditions on sample size). Because the transform is distribution-invariant, the watermarked sample converges in law to the original distribution. The same per-row machinery also supports user attribution and works for discrete and mixed types when the continuous pre-ceiling output is kept. Simulations and two real classification datasets show high detection even for a single held-out row, robustness to subsetting, and fidelity competitive with or better than prior methods that cannot handle the univariate or discrete cases.

What carries the argument

STAMP insertion map: map each coordinate (or conditional coordinate) through a refined empirical CDF with exponential tails, add a Laplace key, push through the known convolution CDF G, and invert; detection declares watermarked if the reverse map minus any stored key lands in [0,1] (union over keys, intersection over coordinates and rows).

What would settle it

On a continuous univariate sample of size 500, set b large enough that theory predicts near-perfect true-negative rate, watermark half the sample, then measure empirical true-positive and true-negative rates on single held-out rows; if either rate collapses far below the claimed levels, the central detection claim fails.

Watch

Extended reading notes

Core claim

A single continuous or continualized tabular observation can be watermarked by a secret Laplace key so that the reverse-transformed value minus that key falls in [0,1] if and only if (with probability approaching 1 as the scale grows) the observation carries the watermark, while the watermarked sample converges in distribution to the original law.

Load-bearing premise

For discrete or mixed columns the continuous pre-ceiling output of the insertion step must be available at detection; without it a single discrete coordinate becomes unidentifiable.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper proposes STAMP, a watermark insertion and detection framework for tabular data that handles continuous, discrete, categorical, and mixed variables in both univariate and multivariate settings. Insertion adapts a distribution-invariant transform (refined empirical CDFs with exponential tails plus Laplace keys, applied via the probability chain rule); detection reverses the transform and checks whether reverse-transformed values minus stored keys fall in [0,1], with a union over keys and intersection over coordinates. The authors prove asymptotic distributional fidelity of the watermarked sample (Theorem 1) and that the true-negative rate of detection tends to 1 under growth conditions on the Laplace scale (Lemma 1, Theorem 2, Corollaries), while true-positive rate is identically 1 by construction. Simulations (500 replications) and two real datasets (NHANES Diabetes, Bank Marketing) report high detection rates, competitive fidelity, robustness to subsetting down to a single observation, and a user-attribution extension.

Significance. Tabular watermarking is under-developed relative to image and text, and existing methods either restrict to continuous data, require multivariate generative models, or operate only at the dataset level. An observation-level scheme with formal asymptotic fidelity and detection guarantees, plus single-observation detectability and user attribution, would be a genuine methodological contribution for authenticity, ownership, and traceability of tabular releases. Strengths include explicit asymptotic theory (Glivenko–Cantelli plus continuous mapping for fidelity; Laplace-tail bounds for detection), a unified continuous/discrete treatment via continualization, extensive Monte Carlo evidence, and two real-data applications. The continuous pre-ceiling design for discrete coordinates and the free scale b are practical caveats, but they do not erase the novelty of the observation-level detection rule if the claims are stated under the conditions the proofs actually use.

major comments (3)
  1. Section 3.1 (paragraph after Algorithm 1) and the discrete detection discussion: for discrete/mixed coordinates the method deliberately returns the continuous pre-ceiling insertion output and requires that continuous version at detection. The single-observation discrete guarantee and the identifiability argument therefore do not apply to the re-discretized values an end user would typically release. The abstract and introduction claim accommodation of discrete data and detection “even when the sample size is as small as one” without this qualification. Please state the continuous-output requirement as an explicit assumption of the discrete claims, and clarify who stores the continuous watermarked values versus the discrete release.
  2. Table 4 and Section 5.2: with the practical scale b=2.5, true-negative rates under single-observation (and small-subset) detection in the logistic mixed-data setting are low (e.g., TN=0.258 for (n,p)=(500,3) with 1 observation; TN=0.092 for (1000,5)). Near-perfect TN is recovered only at much larger b (b=32). The abstract’s claim of reliable single-observation detection therefore depends on a scale that can materially weaken Cor(X,X̃) (Section 5.1.1 and Remark on b). Please either (i) report fidelity/correlation at the b values that achieve high single-obs TN in multivariate mixed settings, or (ii) qualify the single-observation claim by dimension and by the b regime used.
  3. Section 5.2 and Section 6: competing diffusion-based methods (TAB-DRW, TabWak, MUSE) are trained for only 10 epochs (and, in Bank Marketing, STAMP is evaluated on random subsets while competitors train once on the full data). Detection and utility comparisons may understate those methods. A short sensitivity check with longer training, or an explicit statement that the comparison is under a fixed compute budget rather than best-case competitor performance, is needed so that the superiority claims in Tables 4–5 and A1–A2 are not overstated.
minor comments (6)
  1. Algorithm A3 input line: “bF” should be the refined estimator ˆF; same notation slip appears elsewhere in the appendix.
  2. Proof of Corollary 1: typo “ans thus” → “and thus”; also “min(log bn, log n)” construction is fine but a one-line intuition would help readers.
  3. Section 3.1 conditional ˆFj: the two-point construction (nearest neighbor plus one smaller value) is sparse; a brief remark on behavior as p grows, even if only asymptotic, would help.
  4. Table A1: “4,27” should be “4.27”; several appendix tables would benefit from bolding the best method per column for readability.
  5. Remark 2 (no-shuffle correlation detector) is useful but sits somewhat apart from the main shuffled detection theory; a sentence linking it to the main decision rule would improve flow.
  6. References and related work: a short comparison to classical steganography / database watermarking (beyond the five deep/green-list baselines) would situate STAMP for a broader statistical audience.

Circularity Check

1 steps flagged · score 1.0 of 10

No significant circularity in the derivation chain; TP=1 is by intentional inverse construction of the detection map, TN asymptotics and distributional consistency are proved independently, and the sole self-citation (DIP) supplies only the background transformation technique.

  1. self citation load bearing [Section 2.2 and opening of Section 3]
    "Inspired by the distribution-invariant transformation method [4], we design an insertion method... However, those solutions are not designed for the watermarking purpose, and there is no corresponding detection method to identify the embedded noise in DIP. These motivate the design of the proposed method"

    Citation [4] is prior work by co-author Bi. It supplies the core insertion transform (F^{-1}∘G(F(X)+e)). This is background technique only; the paper’s novel contributions (refined invertible EDF, observation-level detection rule (5)–(8), single-observation and user-attribution guarantees, and all asymptotic detection theorems) are derived independently and do not reduce to the cited result. Flagged solely because author overlap exists; it is not load-bearing for the claimed detection or consistency properties.

full rationale

The load-bearing claims (Theorem 1 asymptotic fidelity of the watermarked sample to F; Lemma 1 / Theorem 2 / Corollaries that the rejection region R has P(R) o1 for unwatermarked data under b o∞ or n/b_n o0 or the weaker tail condition) are established by direct arguments on the refined EDF ˆF, the Laplace key, and the reverse map G^{-1}∘ˆF, all proved in the Appendix from first principles (uniform consistency of ˆF, continuous mapping, Laplace tail bounds, existence of tn). The true-positive event is identically true for watermarked data by construction of the insertion–detection pair (Eqs. 3–4 and 5–8), which is the intended design of a watermark rather than a circular prediction. The only self-citation is Bi & Shen (2023) DIP, used solely as the source of the distribution-invariant transform idea; the paper explicitly notes that DIP supplies no detection procedure, and the refined EDF, single-observation detection rule, user-attribution extension, and all detection-rate theorems are new. No fitted parameter is re-used as a prediction, no uniqueness theorem is imported, and no known empirical pattern is merely renamed. The continuous-output requirement for discrete variables is an explicit design limitation already stated by the authors, not a hidden circularity. Hence the derivation is self-contained; the score of 1 reflects only the minor, non-load-bearing self-citation of background technique.

Assumptions & free parameters 2 free parameters · 5 assumptions · 2 invented entities

Central claims rest on standard probability tools, the DIP-style transform, an ad-hoc but consistent refined EDF with exponential tails, and a free noise scale b chosen for detection–utility trade-off. No new physical entities; the method itself is the invented procedure.

free parameters (2)
  • Laplace scale b = typically 1–2.5 (main), up to 32 for extreme subsetting
    Chosen by trying candidate values (e.g., 1, 2.5, 16, 32) to balance detection rate against correlation with original data; larger b improves TN at cost of fidelity. Appears throughout Sections 3–6 and tables.
  • conditional EDF mass 1/q = O(1/n)
    Set to O(1/n) so the two-point conditional refined EDF remains consistent; exact constant not uniquely determined by theory.
assumptions (5)
  • standard math Glivenko–Cantelli / uniform consistency of the empirical distribution function
    Used to prove ˆF → F and therefore watermarked law → F (Theorem 1 proof).
  • standard math Probability chain rule / sequential conditional CDFs preserve the joint law
    Justifies multivariate insertion (Eqs. 3–4).
  • ad hoc to paper For discrete variables the continuous (pre-ceiling) insertion output is retained and available at detection
    Stated after Algorithm 1; without it single discrete coordinates become non-identifiable.
  • domain assumption Candidate dataset Z is entirely watermarked or entirely unwatermarked (row-level partial watermarking handled separately as attribution)
    Section 3.2; detection rule (8) is an intersection over all rows and variables.
  • ad hoc to paper Exponential tails on the refined EDF make it invertible on the whole real line while remaining close to the EDF
    Construction of ˆF1 and ˆFj in Section 3.1; alternative tails are acknowledged as possible.
invented entities (2)
  • STAMP insertion/detection pair (refined EDF + Laplace key matching) independent evidence
    purpose: Embed and later recover a secret key from individual tabular observations while asymptotically preserving F.
    The concrete procedure, algorithms, and decision regions are introduced here; independent evidence is the asymptotic theorems and the simulation/real-data detection rates.
  • Refined empirical distribution function with exponential tails
    purpose: Provide a continuous, strictly monotone, whole-line invertible estimator usable for both insertion and reverse detection.
    Defined explicitly in Section 3.1 and Figure 1; consistency proved, but the tail form is a design choice of the paper.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Observation-Level Watermarking and Detection for Tabular Data." pith.science (2026). https://pith.science/paper/WJMDRGEZ

@misc{pith2026260710554,
  author       = {Pith},
  title        = {Pith review of: Observation-Level Watermarking and Detection for Tabular Data},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/WJMDRGEZ}},
  note         = {Machine review of arXiv:2607.10554}
}
read the original abstract

With the development of generative AI, watermarking techniques have been widely used to detect the authenticity of AI-generated data and protect the rights of users and creators. While it is already well applied in data types including imaging and text data, watermarking tabular data is still under-explored. Existing methods primarily focus on numerical data, leaving discrete, categorical, and mixed data less studied. In this work, we propose STAMP (Single-observation Tabular Attribution and Marking Procedure), a novel framework for watermarking tabular data that can accommodate and preserve a wide range of distributions. We also develop a corresponding detection mechanism, which can reliably identify watermarks even when the sample size is as small as one. We establish theoretical guarantees for asymptotic consistency and detection accuracy. Finally, through extensive simulation studies and two real-data applications, we demonstrate that the proposed method is effective and robust to subsetting, while maintaining data fidelity and a high detection rate.

Figures

Figures reproduced from arXiv: 2607.10554 by the authors.

Figure 1
Figure 1. Illustration of the proposed refined empirical distribution function in the one-dimensional [PITH_FULL_IMAGE:figures/full_fig_p010_1.png] view at source ↗

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

29 extracted references · 1 canonical work pages

  1. [1]

    Watermarking of large language models

    Scott Aaronson. Watermarking of large language models. https://simons.berkeley.edu/talks/scott-aaronson-ut-austin-openai-2023-08-17, August 2023

    2023

  2. [2]

    Optimal spread spectrum watermark embedding via a multistep feasibility formulation.IEEE Transactions on Image Processing, 18(2):371–387, 2009

    H Oktay Altun, Adem Orsdemir, Gaurav Sharma, and Mark F Bocko. Optimal spread spectrum watermark embedding via a multistep feasibility formulation.IEEE Transactions on Image Processing, 18(2):371–387, 2009

    2009

  3. [3]

    Natural language watermarking: Design, analysis, and a proof-of-concept implementation

    Mikhail J Atallah, Victor Raskin, Michael Crogan, Christian Hempelmann, Florian Kerschbaum, Dina Mohamed, and Sanket Naik. Natural language watermarking: Design, analysis, and a proof-of-concept implementation. InInternational Workshop on Information Hiding, pages 185–200. Springer, 2001

    2001

  4. [4]

    Distribution-invariant differential privacy.Journal of Economet- rics, 235(2):444–453, 2023

    Xuan Bi and Xiaotong Shen. Distribution-invariant differential privacy.Journal of Economet- rics, 235(2):444–453, 2023

    2023

  5. [5]

    Differential privacy

    Cynthia Dwork. Differential privacy. In Michele Bugliesi, Bart Preneel, Vladimiro Sassone, and Ingo Wegener, editors,Automata, Languages and Programming, pages 1–12, Berlin, Heidelberg, 2006. Springer Berlin Heidelberg

    2006

  6. [6]

    MUSE: Model-agnostic tabular watermarking via multi-sample selection

    Liancheng Fang, Aiwei Liu, Henry Peng Zou, Yankai Chen, Hengrui Zhang, Zhongfen Deng, and Philip S Yu. MUSE: Model-agnostic tabular watermarking via multi-sample selection. arXiv:2505.24267, 2025

    arXiv 2025

  7. [7]

    An undetectable watermark for generative image models

    Samuel Gunn, Xuandong Zhao, and Dawn Song. An undetectable watermark for generative image models. InInternational Conference on Learning Representations, volume 2025, pages 6612–6637, 2025

    2025

  8. [8]

    Watermarking generative tabular data.arXiv:2405.14018, 2024

    Hengzhi He, Peiyu Yu, Junpeng Ren, Ying Nian Wu, and Guang Cheng. Watermarking generative tabular data.arXiv:2405.14018, 2024. 50

    arXiv 2024

Show all 29 references
  1. [9]

    Algorithmically effective differentially private synthetic data

    Yiyun He, Roman Vershynin, and Yizhe Zhu. Algorithmically effective differentially private synthetic data. InAnnual Conference on Learning Theory, pages 3941–3968, 2023

    2023

  2. [10]

    Dct-domain watermarking techniques for still images: Detector performance analysis and a new structure.IEEE Transactions on Image Processing, 9(1):55–68, 2000

    Juan R Hernandez, Martin Amado, and Fernando Perez-Gonzalez. Dct-domain watermarking techniques for still images: Detector performance analysis and a new structure.IEEE Transactions on Image Processing, 9(1):55–68, 2000

    2000

  3. [11]

    Unbiased watermark for large language models

    Zhengmian Hu, Lichang Chen, Xidong Wu, Yihan Wu, Hongyang Zhang, and Heng Huang. Unbiased watermark for large language models. InInternational Conference on Learning Representations, volume 2024, pages 45408–45436, 2024

    2024

  4. [12]

    A watermark for large language models

    John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. A watermark for large language models. InInternational Conference on Machine Learning, pages 17061–17084. PMLR, 2023

    2023

  5. [13]

    A statistical framework of watermarks for large language models: Pivot, detection efficiency and optimal rules.The Annals of Statistics, 53(1):322–351, 2025

    Xiang Li, Feng Ruan, Huiyuan Wang, Qi Long, and Weijie J Su. A statistical framework of watermarks for large language models: Pivot, detection efficiency and optimal rules.The Annals of Statistics, 53(1):322–351, 2025

    2025

  6. [14]

    Wasa: Watermark-based source attribution for large language model-generated data

    Xinyang Lu, Jingtan Wang, Zitong Zhao, Zhongxiang Dai, Chuan-Sheng Foo, See Kiong Ng, and Bryan Kian Hsiang Low. Wasa: Watermark-based source attribution for large language model-generated data. InFindings of the Association for Computational Linguistics: ACL 2025, pages 23791...

    2025

  7. [15]

    A data-driven approach to predict the success of bank telemarketing.Decision Support Systems, 62:22–31, 2014

    S´ergio Moro, Paulo Cortez, and Paulo Rita. A data-driven approach to predict the success of bank telemarketing.Decision Support Systems, 62:22–31, 2014

    2014

  8. [16]

    Black-box forgery attacks on semantic watermarks for diffusion models

    Andreas M¨ uller, Denis Lukovnikov, Jonas Thietke, Asja Fischer, and Erwin Quiring. Black-box forgery attacks on semantic watermarks for diffusion models. InProceedings of the Computer Vision and Pattern Recognition Conference, pages 20937–20946, 2025. 51

    2025

  9. [17]

    National Health and Nutrition Health Survey 2013-2014 (NHANES) Age Prediction Subset

    NCHS. National Health and Nutrition Health Survey 2013-2014 (NHANES) Age Prediction Subset. UCI Machine Learning Repository, 2019. DOI: https://doi.org/10.24432/C5BS66

    2013 doi

  10. [18]

    Adaptive and robust watermark for generative tabular data.arXiv:2409.14700, 2024

    Dung Daniel Ngo, Archan Ray, Akshay Seshadri, Daniel Scott, Saheed Obitayo, Niraj Kumar, Vamsi K Potluru, Marco Pistoia, and Manuela Veloso. Adaptive and robust watermark for generative tabular data.arXiv:2409.14700, 2024

    2024 arXiv

  11. [19]

    Unispach: A text-based data hiding method using unicode space characters.Journal of Systems and Software, 85(5):1075–1082, 2012

    Lip Yee Por, KokSheik Wong, and Kok Onn Chee. Unispach: A text-based data hiding method using unicode space characters.Journal of Systems and Software, 85(5):1075–1082, 2012

    2012

  12. [20]

    Stegastamp: Invisible hyperlinks in physical photographs

    Matthew Tancik, Ben Mildenhall, and Ren Ng. Stegastamp: Invisible hyperlinks in physical photographs. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), June 2020

    2020

  13. [21]

    Perceptive self-supervised learning network for noisy image watermark removal.IEEE Transactions on Circuits and Systems for Video Technology, 34(8):7069–7079, 2024

    Chunwei Tian, Menghua Zheng, Bo Li, Yanning Zhang, Shichao Zhang, and David Zhang. Perceptive self-supervised learning network for noisy image watermark removal.IEEE Transactions on Circuits and Systems for Video Technology, 34(8):7069–7079, 2024

    2024

  14. [22]

    Robust blind image watermarking based on interest points.Virtual Reality & Intelligent Hardware, 6(4):308–322, 2024

    Zizhuo Wang, Kun Hu, Zixuan Hu, Shuo Yang, Xingjun Wang, et al. Robust blind image watermarking based on interest points.Virtual Reality & Intelligent Hardware, 6(4):308–322, 2024

    2024

  15. [23]

    Raw: A robust and agile plug-and-play watermark framework for ai-generated images with provable guarantees.Advances in Neural Information Processing Systems, 37:132077–132105, 2024

    Xun Xian, Ganghua Wang, Xuan Bi, Jayanth Srinivasa, Ashish Kundu, Mingyi Hong, and Jie Ding. Raw: A robust and agile plug-and-play watermark framework for ai-generated images with provable guarantees.Advances in Neural Information Processing Systems, 37:132077–132105, 2024

    2024

  16. [24]

    Watermarking text generated by black-box language models.arXiv:2305.08883, 2023

    Xi Yang, Kejiang Chen, Weiming Zhang, Chang Liu, Yuang Qi, Jie Zhang, Han Fang, and Nenghai Yu. Watermarking text generated by black-box language models.arXiv:2305.08883, 2023. 52

    2023 arXiv

  17. [25]

    Personamark: Personalized llm watermarking for model protection and user attribution.arXiv:2409.09739, 2024

    Yuehan Zhang, Peizhuo Lv, Yinpeng Liu, Yongqiang Ma, Wei Lu, Xiaofeng Wang, Xiaozhong Liu, and Jiawei Liu. Personamark: Personalized llm watermarking for model protection and user attribution.arXiv:2409.09739, 2024

    2024 arXiv

  18. [26]

    TAB-DRW: A DFT-based robust watermark for generative tabular data.arXiv:2511.21600, 2025

    Yizhou Zhao, Xiang Li, Peter Song, Qi Long, and Weijie Su. TAB-DRW: A DFT-based robust watermark for generative tabular data.arXiv:2511.21600, 2025

    2025 arXiv

  19. [27]

    Tabularmark: Watermarking tabular datasets for machine learning

    Yihao Zheng, Haocheng Xia, Junyuan Pang, Jinfei Liu, Kui Ren, Lingyang Chu, Yang Cao, and Li Xiong. Tabularmark: Watermarking tabular datasets for machine learning. InProceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, pages 3570–3584, 2024

    2024

  20. [28]

    Tabwak: A watermark for tabular diffusion models

    Chaoyi Zhu, Jiayi Tang, Jeroen M Galjaard, Pin-Yu Chen, Robert Birke, Cornelis Bos, Lydia Y Chen, et al. Tabwak: A watermark for tabular diffusion models. InInternational Conference on Learning Representations, pages 1–28. OpenReview. net, 2025

    2025

  21. [29]

    Hidden: Hiding data with deep networks

    Jiren Zhu, Russell Kaplan, Justin Johnson, and Li Fei-Fei. Hidden: Hiding data with deep networks. InProceedings of the European Conference on Computer Vision (ECCV), September 2018. 53

    2018

Pith tools

Reviewed July 14, 2026 · model on record in the stance chip above.