{"id":"d69665dc-867b-4620-81d7-dee0bdec8b39","arxiv_id":"2411.10898","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"A distribution-level watermark for categorical data, embedded by secret hashing and detected by inverting the hash mixture and comparing total variation distance to the original distribution.","lead":"Researchers propose a method to hide a secret marker inside synthetic categorical data by replacing some values with outputs of a secret hash function. The marker can survive data regeneration and is verified by reversing the replacement and comparing the resulting distribution to the original.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Detection needs the unwatermarked synthetic distribution D, but the protocol retains only Tori; substituting Tori makes the test statistic measure synthesis error, not the watermark.","rationale":"The paper's central claim is that verification is possible by comparing inverse-decoded data with the original distribution. For that claim to hold, the verifier must have access to the correct pre-watermark distribution D. The stated retention policy (only Tori) makes this impossible: Tori is the distribution the synthesizer was trained on, not the distribution that was watermarked. Even a perfect inverse cannot undo generation error, so any comparison against Dori absorbs dTV(D, Dori). This is not a peripheral implementation detail; it changes the statistical interpretation of the test. The experiments never test the stated protocol; they always compare against D because they simulate D directly. A concrete regenerated-data experiment with a separate Tori would settle whether the method works under its own assumptions. The reader's verdict of CONDITIONAL remains appropriate: the mathematical core may be salvageable, but the operational protocol must be fixed and tested before the central claim can be accepted. The reader's weakest_assumption (support mismatch) is a valid second concern; my concern is more fundamental because it holds even with identical support.","tokens_in":15872,"tokens_out":6164,"duration_ms":66230,"concrete_test":"Re-run Simulation 4 in the true owner setting: let Tori be a private table; train TabSyn on Tori to obtain synthesizer distribution D; sample an unwatermarked synthetic table T from D; watermark to obtain T_hat_secret; then discard T and use only Tori as reference. Run Algorithm 4 separately on (a) a fresh watermarked sample and (b) a fresh unwatermarked sample from the synthesizer. Report dTV(Dinv, Dori) and p-values for both. If case (b) produces p-values as small as case (a), the detector cannot distinguish watermark from synthesis error when Tori substitutes for D; if (b) is well-calibrated while (a) is significant, the concern is resolved.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central detection claim (Algorithm 4 and Section 3.1) is not implementable with the data the protocol says the owner keeps. Section 3.1 states the owner 'only needs T when inserting the watermark and Tori during detection' and 'only retains Tori and a list of secrets.' Algorithm 4's inputs are only T' and Tori, yet its step 4 says 'Use T', T, and M_secret_D to build Vec_secret(D') and Vec_secret(D)' — T is not an input and is not retained. If the intended T is Tori, the detector compares Dinv to Dori, not to D. But the watermark is inserted into D, the synthesizer's distribution; Dori is only an approximation of D via the synthesizer. The inverse operator recovers D (the pre-watermark synthetic distribution), so dTV(Dinv, Dori) conflates watermark signal with synthesizer fidelity. In every experiment, the authors simulate a known D and compare against it — e.g., Tables 2–4 compute dTV(Dinv, D), and Simulation 4 reports dTV between Dinv and D after TabSyn regeneration. No experiment runs the actual owner-only-Tori setting. The headline claim that verification is possible from Tori alone is therefore unsupported, independent of the support-mismatch assumption.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a distribution-level watermarking scheme for categorical synthetic data. A data owner with original table Tori and a synthesizer S that generates tables T with distribution D splits each row into X and Y components. During insertion, each Y value is replaced with probability pw by M_Y^{-1}(Hash_secret(X)), producing a watermarked distribution. Detection applies an inverse algorithm to a suspicious table T' to recover an estimate Dinv of the pre-watermark distribution, and then tests whether Dinv is close to the original distribution using total variation distance. The paper presents a bound on the induced distribution shift, an informal security argument based on one-way hashes, and simulations reporting true and false positive rates. Two extensions are proposed: a sparse-column method for high-dimensional categorical spaces and a pseudorandom mapping variant that preserves marginal distributions.","tokens_in":16122,"tokens_out":5148,"duration_ms":55059,"significance":"If the scheme worked as stated, it would fill a real gap: most categorical watermarking methods are designed for static tables and do not survive regeneration by a synthesizer. The core insertion-inverse algebra is simple and likely correct under the ideal assumptions that the synthesizer exactly preserves the support of Y and that the owner has access to the unwatermarked synthetic distribution D. The paper also correctly identifies the usefulness of distribution-level verification and provides a bound that is plausible. However, the detection protocol as written is not implementable with the data the protocol says the owner retains, the support-mismatch assumption is untested and load-bearing, and the hypothesis-testing pseudocode is internally inconsistent. These issues mean that the central claim of reliable verification in the generative-data setting is not established by the current manuscript.","major_comments":[{"comment":"The detection procedure requires the unwatermarked synthetic distribution D, but the protocol explicitly states that the owner retains only Tori and the secret list. Algorithm 4 step 4 says 'Use T', T, and M_secret_D to build Vec_secret(D') and Vec_secret(D)' without T being an input or retained. If T is understood as Tori, then the comparison becomes dTV(Dinv, Dori), which conflates the watermark signal with the synthesizer's fidelity error; the insertion-inverse recovers D, not Dori. None of the experiments test the owner-only-Tori setting; instead, Tables 2-4 compare Dinv with the known simulation distribution D, and Simulation 4 compares against D as well. The paper's headline claim of verification from Tori alone is therefore unsupported.","section":"Section 3.1 and Algorithm 4"},{"comment":"The inverse decoder applies the mapping M_Y and M_Y^{-1} constructed from Tori,y to all samples in Ty, requiring Y and Yori to have identical support. The paper states this assumption but does not test it. Real synthesizers often drop rare categories or produce new combinations, and Simulation 4 with TabSyn does not report whether the support of Ty was preserved. If the support changes, the hash-decoding formula cannot be applied to all samples, so the detector is undefined on those rows. The claimed suitability for modern generative models is therefore conditional on an untested, restrictive assumption.","section":"Section 3.2, 3.3"},{"comment":"The hypothesis-testing part of Algorithm 4 is internally inconsistent. Line 6 computes d = dTV(D, D') rather than dTV(Dinv, D), even though the surrounding text and Section 3.3 say the comparison is between D and Dinv. Similarly, line 11 computes dsam = dTV(Dsam, D') instead of dTV(Dsam,inv, D'), so the null distribution of the test statistic is not defined. The p-value calculation and the reported FPR results therefore do not correspond to the stated procedure, making the empirical significance claims unverifiable from the algorithm as written.","section":"Algorithm 4, Section 3.3"},{"comment":"The insertion-inverse formula divides by (1 - pw) and can produce negative probabilities when the empirical conditional probability Pr(Y' = y | X = x) is smaller than pw for the hashed category (or when sample noise makes the numerator negative). The paper does not specify how negative entries are handled (e.g., clipping, renormalization) before computing total variation distance. Without such a rule, the algorithm is not well-defined for finite samples, and the small reported dTV values cannot be reproduced from the given description.","section":"Algorithm 3, Section 3.3"}],"minor_comments":[{"comment":"In the proof of Theorem 3.1, the line 'dTV(Y, \\hat{Y})' should be 'dTV(D, \\hat{D})' since the statement concerns the joint distribution D. Also, the definitions of p_i and q_i are imprecise about the role of M_secret_D(D); clarify that the events are over the random draw from the distribution.","section":"Section 3.4, Theorem 3.1"},{"comment":"The text says 'X = [X1, X2], where X1 and X2, and X3 are identical and independently distributions'; this appears to be a typo, since X3 is not part of X in that simulation. Please correct the description of the simulated distribution.","section":"Section 4.2, Simulation 1"},{"comment":"Line 7 of the XYExtractor algorithm says 'Enumerate each combination of ydim columns in Ttx' but this should be 'in Tty', since the β combinations are for the Y side.","section":"Algorithm 5, Section 5.1"},{"comment":"The total variation distance is defined correctly, but the statement that 'D and Dinv share the same support' should be justified; if the support of the suspicious distribution differs from that of the original, additional handling is needed, which relates to the support-mismatch issue raised above.","section":"Section 3.3, Definition 3.1"}],"recommendation":"major_revision","confidential_remarks":"The stress-test concern about Algorithm 4's use of the unretained table T is valid and is the load-bearing issue. The paper is not ready for acceptance, but the insertion-inverse idea is promising and the gap seems fixable by changing the protocol to retain the unwatermarked synthetic table (or its empirical distribution) and re-running the experiments in that setting, or by reworking the detection to use Tori and demonstrating that the watermark signal dominates synthesis error. The hypothesis-testing pseudocode also needs a careful rewrite. I recommend major revision rather than rejection, as the core algebra appears sound under ideal conditions."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short version: this is worth reading if you work on provenance for synthetic tabular data, but treat it as a promising draft, not as a working detection scheme. The genuinely new bit is the categorical adaptation of distribution-level watermarking: split columns into X and Y, replace Y with M_Y^{-1}(Hash_secret(X)) with probability pw, and invert the conditional-probability algebra to recover D. That insertion-inverse logic is correct in the ideal case, and the TV bound dTV(D,ˆD) ≤ pw is right. The true-positive simulations show the inverse recovers D with small TV, which is what you would expect from an exact algebraic inverse, and the TabSyn experiment is a reasonable first look at regeneration. The related work is fine; the paper situates itself honestly against the continuous tabular methods and static-table categorical methods.\n\nThe soft spot is in the detector, and it is load-bearing. Algorithm 4 takes (T', Tori; ...) as inputs, but step 4 says to build Vec_secret(D') and Vec_secret(D) using T', T, and the mapping. T is not passed, and Section 3.1 says the owner retains only Tori and the secrets. If you substitute Tori for T, the comparison becomes dTV(Dinv, Dori), which conflates watermark signal with synthesis fidelity; none of the experiments actually run that owner-only setting. There is also a likely typo in step 6, which computes dTV(D, D') instead of dTV(Dinv, D), and the p-value loop in step 11 compares Dsam before inversion to D', not inverse-decoded Dsam,inv against D. Algorithm 3 also uses the original X marginal rather than X' in places. These are fixable, but they need fixing.\n\nThe other big caveat is the support assumption in Section 3.2: the synthesizer must neither create nor delete categories in Y. The paper states this plainly, but never tests what happens when a real synthesizer collapses a rare category, which is common for categorical tabular data. There are no code or baselines, and the FPR is tuned after the fact.\n\nBottom line: the core idea is sound and the paper is honest about its assumptions, but it does not yet establish the claimed verification procedure from Tori alone. I would send it to peer review with a request to fix the detector, rerun the owner-only protocol, and test support mismatch. The method is incomplete, not dead.","headline":"A clean distribution-level insertion/inverse idea for categorical data, but the detector as written needs the unwatermarked synthetic distribution the owner is told not to keep, so the headline verification claim is not yet supported.","tokens_in":16624,"tokens_out":5817,"would_cite":false,"duration_ms":58282,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper argues that generative categorical data can be watermarked at the distribution level: replacing a row's Y value with a secret-hash-derived value with probability p_w embeds a verifiable signal that survives regeneration by a…","keywords":["distribution-level watermarking","categorical data","generative tabular data","total variation distance","hypothesis testing","synthetic data provenance","secret-key hash watermark"],"falsifier":"Run any tabular synthesizer on a watermarked table and then either add a new category to a $Y$ column or delete all rows of its least common category before running the detector; the paper's simulations include no such support mismatch, and the inverse mapping is only defined on the original support.","tokens_in":15673,"feed_emoji":"🔒","tokens_out":8214,"duration_ms":84340,"temperature":0.7,"pith_summary":"Generative models can learn a categorical table's distribution and emit new tables that are statistically similar but different in their specific rows, so row-level watermarks do not survive. The authors argue that watermarking should therefore act on the distribution itself: split the columns into $X$ and $Y$, and with probability $p_w$ replace each $Y$ value by a secret-hash-derived value computed from the matching $X$ value. Detection applies an inverse of that insertion and compares the recovered distribution with the original using total variation distance. If a synthesizer regenerates data from the watermarked distribution, the mark is still present and detectable without knowing which rows were modified. The paper proves the watermark-induced distribution shift is at most $p_w$ and demonstrates detection in simulations, including after regeneration by a tabular synthesizer.","feed_headline":"Distribution-level watermark survives regeneration by synthesizers","feed_subtitle":"Secret hash swaps one column block at a small rate; inverse decoding plus total variation distance reveals copies.","key_machinery":"The load-bearing object is the pair of injective category-to-integer mappings $M_Y$ and $M_Y^{-1}$, built from the original table's $Y$ columns, together with a secret-keyed one-way hash $\\mathrm{Hash}^{\\mathrm{secret}}_{\\#(Y)}$. The insertion algorithm replaces each row's $Y$ value with $M_Y^{-1}(\\mathrm{Hash}^{\\mathrm{secret}}_{\\#(Y)}(X))$ with probability $p_w$. The detection machinery is the insertion inverse: for each $x$, if the hash of $x$ equals the observed $Y$ code, the recovered conditional probability is $(\\Pr(\\hat Y=y\\mid X=x)-p_w)/(1-p_w)$; otherwise it is $\\Pr(\\hat Y=y\\mid X=x)/(1-p_w)$. This reconstruction, together with the marginal of $X$, yields the estimated joint distribution $D_{\\mathrm{inv}}$. The final hypothesis test samples candidate distributions from a prior (a Dirichlet distribution in the experiments), applies the same inverse to each, and rejects the null that the suspicious table is unwatermarked when its total variation distance to the original is small.","core_discovery":"The central claim is that a watermark can be embedded in a categorical distribution rather than in specific rows. Let the table be split column-wise into $X$ and $Y$, with an injective map $M_Y$ sending each category of $Y$ to an integer. With independent probability $p_w$, the inserter replaces a row's $Y$ entry by $M_Y^{-1}(\\mathrm{Hash}^{\\mathrm{secret}}_{\\#(Y)}(X))$, where the hash maps the $X$ part to one of the $\\#(Y)$ category codes. The watermarked distribution $\\hat Y$ is therefore a mixture of the original $Y$ and the hash-decoded distribution, with weights $1-p_w$ and $p_w$. The insertion inverse recovers the original conditional law of $Y$ given $X$ by subtracting $p_w$ and dividing by $1-p_w$ when the hash hits the observed $Y$ value, and dividing by $1-p_w$ otherwise; rebuilding the joint distribution gives $D_{\\mathrm{inv}}$. The detector then compares $D_{\\mathrm{inv}}$ with the original $D$ using total variation distance and calibrates the comparison by sampling tables from a prior, reporting a $p$-value against the null that the suspicious table is not watermarked. In the simulations reported, the $p$-values are zero and $d_{\\mathrm{TV}}(D_{\\mathrm{inv}},D)$ stays small, while Theorem 3.1 bounds the utility cost by $d_{\\mathrm{TV}}(D,\\hat D)\\le p_w$.","pith_inferences":["Because the mark lives in the conditional law of $Y$ given $X$, any post-processing that preserves that conditional law should preserve detectability, while any processing that smooths or flattens the conditionals will erode it even if the marginals are untouched. (Editorial inference.)","If real synthesizers sometimes add or drop categories, a natural extension is to reserve an 'other' bucket in $M_Y$ and run the inverse only on rows whose $Y$ value lies in the original support; the paper does not test this regime. (Editorial inference.)","The sparse-column method suggests a broader design principle: watermark only low-cardinality, high-mutual-information columns to keep the inverse estimator stable, and automatic selection of such columns is an obvious next step. (Editorial inference.)"],"forward_implications":["If a buyer trains a new synthesizer on a watermarked table, tables regenerated from it remain detectable, provided the synthesizer preserves the conditional distribution of $Y$ given $X$.","Any attack that only reorders rows or deletes random rows leaves the distribution, and therefore the watermark, intact.","The owner can tune $p_w$ to trade utility against detectability, since Theorem 3.1 guarantees the total variation distance between the watermarked and unwatermarked distributions is at most $p_w$.","Even a white-box adversary who knows the algorithm cannot remove the mark without guessing the secret hash outputs; the paper estimates the probability of guessing all of them as about $1/(\\#(Y)^{\\#(X)})$.","The pseudorandom mapping variant preserves the marginal distributions of both $X$ and $Y$, perturbing only their dependence, which suits buyers who need the marginal law of $Y$ unchanged."],"supporting_citations":[{"why":"Supplies the secret-keyed hash-based watermark template adapted here to categorical rows.","marker":"[17]"},{"why":"Introduces distribution-level watermarking for continuous tabular data, the line of work this paper extends to the categorical setting.","marker":"[19]"},{"why":"Another distribution-level tabular watermarking scheme that motivates the distribution-level detection requirement.","marker":"[20]"},{"why":"The synthesizer used in Simulation 4 to show the watermark survives regeneration into a new table.","marker":"[10]"},{"why":"The classic primary-key database watermarking baseline that motivated the need for distribution-level methods.","marker":"[23]"},{"why":"Inspires the pseudorandom mapping variant that preserves the marginal distribution of Y while watermarking the dependence.","marker":"[28]"}],"fun_headline_variants":["Watermark hidden in categorical distribution, not rows","Distribution-level hash watermark resists data regen","Secret column hash leaves trace in categorical law","TV-distance detector finds watermark after synthesis","Inverse decoding lifts watermark from categorical data"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The synthetic distribution $Y$ must have exactly the same category support as the original $Y$; if a synthesizer creates a new category or deletes an existing one, the inverse decoder cannot be applied to every row and the detection formula no longer holds.","fun_headline_variants_meta":{"raw":{"variants":["Watermark hidden in categorical distribution, not rows","Distribution-level hash watermark resists data regen","Secret column hash leaves trace in categorical law","TV-distance detector finds watermark after synthesis","Inverse decoding lifts watermark from categorical data"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000363,"raw_usage":{"total_tokens":1983,"prompt_tokens":1000,"completion_tokens":983,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":616,"completion_tokens_details":{"reasoning_tokens":916}},"tokens_in":616,"tokens_out":983,"duration_ms":8204,"temperature":1.0,"reasoning_tokens":916,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T19:10:23.852918+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run any tabular synthesizer on a watermarked table and then either add a new category to a $Y$ column or delete all rows of its least common category before running the detector; the paper's simulations include no such support mismatch, and the inverse mapping is only defined on the original support.","supporting_citations":[{"cited_title":"A watermark for large language models,","cited_arxiv_id":null,"evidence_quote":"Supplies the secret-keyed hash-based watermark template adapted here to categorical rows."},{"cited_title":"TabularMark: Watermarking Tabular Datasets for Machine Learning","cited_arxiv_id":"2406.14841","evidence_quote":"Another distribution-level tabular watermarking scheme that motivates the distribution-level detection requirement."},{"cited_title":"Mixed-type tabular data synthesis with score-based diffusion in latent space,","cited_arxiv_id":null,"evidence_quote":"The synthesizer used in Simulation 4 to show the watermark survives regeneration into a new table."},{"cited_title":"Watermarking relational databases,","cited_arxiv_id":null,"evidence_quote":"The classic primary-key database watermarking baseline that motivated the need for distribution-level methods."},{"cited_title":"GumbelSoft: Diversified language model watermarking via the GumbelMax-trick,","cited_arxiv_id":null,"evidence_quote":"Inspires the pseudorandom mapping variant that preserves the marginal distribution of Y while watermarking the dependence."}],"review_version":1}