Watermarking Large Language Model-based Time Series Forecasting

Chaoqun Yang; Hongzhi Yin; Nguyen Quoc Viet Hung; Tong Chen; Wei Yuan; Yu Xing

REVIEW 4 major objections 6 minor 44 references

Watermarking Large Language Model-based Time Series Forecasting

T0 review · 4 major / 6 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A post-hoc watermarking scheme called Waltz embeds detectable signals into LLM-generated time-series forecasts by rewiring patch-to-cold-token similarity, preserving forecast quality while surviving model distillation.

desk verdict A plausible post-hoc watermarking method for LLMTS with a genuinely useful cold-token trick, but the z-score detection calibration is underspecified and the distillation claim lacks a clean-output control. read the letter →

arxiv 2507.20762 v1 pith:KSXVUNB7 submitted 2025-07-28 cs.IR

Wei Yuan , Chaoqun Yang , Yu Xing , Tong Chen , Nguyen Quoc Viet Hung , Hongzhi Yin This is my paper

classification cs.IR

keywords timeseriesforecastinglargelanguagemodelsdigitalwatermarkingcoldtokensmodelintellectualpropertyprotectionz-scoredetectiondistillationpost-hoc

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper claims that forecasts produced by large-language-model-based time series models can be watermarked after the fact, without retraining, by nudging a handful of output patches to look unusually similar to a set of "cold" tokens the model rarely uses. The scheme, Waltz, is designed to give model owners a way to prove that a forecast came from their model and to trace unauthorized reuse: the watermark stays detectable even when someone distills a cheaper copy from watermarked outputs. The authors test Waltz on two LLMTS models across seven datasets, reporting high detection accuracy with only a small increase in forecasting error, and both better detectability and lower utility cost than the only existing LLMTS-specific watermark. If the claim holds, providers of commercial forecasting APIs can protect their models from theft and can authenticate generated time series, which also addresses the risk of fabricated financial or weather data.

What carries the argument

The central object is the cold-token watermark book: a set of tokens from the LLM's embedding table that, over a subset of training data, accumulate almost no similarity with any time-series patch embedding. The machinery has four pieces: construction of the book together with the mean and standard deviation of the null similarity distribution; similarity-based location identification, which picks the top-alpha patch-token pairs by cosine similarity so that a small change produces a detectable shift; projected gradient descent with element-wise clipping onto an l-infinity ball of radius eta to solve the constrained optimization; and a training-free z-score detector that uses the maximum similarity over the book with a threshold gamma of 2. The cold-token choice does the load-bearing work, because normal patches are rarely near cold tokens, so even a modest similarity boost lands many standard deviations away from the null distribution.

What would settle it

Take a protected LLMTS model, build the watermark book on its training split, then generate forecasts on a held-out domain or from a distilled model with a different architecture; if the maximum patch-to-cold-token similarity z-scores of clean and watermarked samples no longer separate at threshold 2, with F1 falling toward chance or false positives rising, the claim that Waltz transfers without recalibration is refuted. Concretely, recompute the null mean and standard deviation on the new domain and compare them with the book statistics: drift beyond roughly one standard deviation predicts detector failure.

Watch

Extended reading notes

Core claim

Waltz's proposal is that the alignment statistics between time-series patch embeddings and the LLM's token embeddings provide a watermark channel that requires no retraining and almost no visible change to the forecast. Well-trained LLMTS models contain tokens that rarely align with any time series patch, called "cold tokens"; making a small number of patch embeddings statistically closer to these tokens creates a signal detectable by a z-score test, while the forecast values themselves change imperceptibly. The watermark is embedded by selecting the patch-token pairs with the highest baseline similarity, then running projected gradient descent under a hard noise bound so the perturbation is guaranteed small. Detection compares the maximum patch-to-watermark-book similarity against the mean and standard deviation computed during book construction, flagging samples whose z-score exceeds 2. The authors further claim the watermark survives distillation into a new model trained on watermarked outputs, which is what makes the method useful for tracing stolen models.

Load-bearing premise

Waltz assumes the similarity statistics (the mean and standard deviation) measured once from a slice of the protected model's training data stay valid for every future forecast and for the outputs of any distilled model, so that the fixed z-score threshold of 2 still separates watermarked from clean samples.

Editorial extensions

If this is right

Providers of black-box LLMTS APIs can watermark every generated forecast at inference time using only access to the model's encoder and a precomputed watermark book, with no retraining and no modification of the protected model.
Because the noise is constrained by a hard bound, watermarked forecasts have a guaranteed upper limit on utility loss, in contrast to prior methods that visibly distort the output.
The watermark propagates through distillation, so a surrogate model trained on watermarked outputs continues to produce detectable forecasts, enabling tracing of unauthorized model extraction.
The same mechanism can authenticate generated time series segments as coming from a particular model, which would help detect deepfake financial trends or fabricated sensor readings.
The framework's reliance on the shared patch-embedding-plus-LLM architecture means it should transfer across LLMTS models beyond the two tested backbones as long as the encoder and token embedding table are accessible.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

An untested extension is to turn Waltz into a fingerprinting scheme by assigning disjoint cold-token subsets to individual API customers, allowing the provider to identify which user leaked forecasts, provided the subsets remain statistically separable.
The z-score calibration is the likely fragile point: if the protected model is fine-tuned or the data domain shifts after the watermark book is built, the fixed threshold of 2 may no longer separate watermarked from clean samples, so a holdout-domain recalibration test would be a cheap check of the method's real-world portability.
A nonparametric alternative to the fixed z-score threshold, such as calibrating the decision rule on an empirical quantile of the null max-similarity distribution, would remove the normality assumption and likely make Waltz more robust across datasets.
The cold-token effect may be strongest for models whose time-series encoder is trained while the LLM backbone stays frozen, which means the method's effectiveness could vary for LLMTS models that fine-tune the full LLM rather than only the projection layers.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Waltz is a real contribution to a small niche: post-hoc watermarking for LLM-based time series forecasting. The cold-token observation is genuinely useful, and the idea of rewiring patch-token similarity with bounded PGD noise is a sensible way to embed a detectable signal without retraining. If you work on IP protection for forecast models, this is the paper to engage with.

What's actually new: the paper identifies an empirical property—some LLM tokens are consistently dissimilar to time series patch embeddings—and builds the watermark around it. Selecting the most-aligned patch-token pairs for insertion and constraining the perturbation to an l-infinity ball is good engineering. The ablations show each of the three components earns its place. The experiments cover seven datasets and two backbones, and the F1/DeltaMSE numbers are much better than the HTW and FSW baselines.

The soft spots are real but fixable. Equation 10 defines the detector as max(sim(E_ts(ex),B)) minus mu over sigma, with gamma=2. The paper says mu and sigma come from similarity scores computed on a training subset, but it never says whether they standardize individual similarities or the max. If they are per-pair statistics, the max of roughly 16*M near-normal variables follows an extreme-value distribution, so a fixed threshold of 2 will not give the claimed F1. There is no separate false-positive analysis on clean test forecasts. The distillation experiment in Section 5.6 trains DLinear on watermarked outputs but has no control trained on clean outputs, so the post-distillation F1 could be detector bias from shifted null statistics rather than a surviving watermark. Missing error bars and code also weaken the empirical claims.

None of this sinks the central mechanism. The calibration issue is a matter of specification, and the missing control is an experiment to add, not a contradiction. The citation pattern looks fine: HTW and TimeWak are cited and differentiated, and the 'first generic post-hoc' claim is defensible given those baselines.

Bottom line: this deserves a serious referee. I'd recommend the editor send it out with a request for the z-score calibration details, false-positive rates, and the clean-trained distillation control. It's not ready to be accepted as-is, but the core idea is sound and worth developing.

Referee Report

4 major / 6 minor

Summary. The paper proposes Waltz, a post-hoc watermarking framework for LLM-based time series forecasting (LLMTS). The watermark is inserted by perturbing a small number of forecast patches with projected gradient descent so that their patch embeddings become abnormally similar to a precomputed set of "cold" LLM tokens; detection uses a z-score test on the maximum patch-to-book similarity. Experiments on seven datasets with TEMPO and UniTime report high F1 with small MSE loss, and distillation experiments with DLinear suggest the watermark survives retraining on watermarked outputs.

Significance. If the calibration concerns are resolved, the framework is a useful contribution: it is model-agnostic, requires only encoder access, has a hard noise budget, and includes ablation evidence that each component matters. The paper also compares against the only prior LLMTS watermark (HTW) and a signal-based baseline, and reports consistent trends across seven datasets. The main weaknesses are statistical: no false-positive control, no error bars, and an underspecified z-score calibration.

major comments (4)

[Section 4.3, Eq. (10)] The detector standardizes max(sim(E_ts(x), B)) using mu and sigma, which Section 4.2 describes as the mean and standard deviation of similarity scores computed over a subset of the protected model's training data. The paper never states whether mu and sigma are statistics of the per-pair similarity distribution or of the per-sample maximum. Since the detector takes a maximum over roughly 16 patches and M cold tokens per sample, if mu and sigma are per-pair statistics, the test statistic has an extreme-value distribution and a fixed threshold gamma=2 will not produce the reported F1. Please specify the exact statistic used to compute mu and sigma, and report the empirical null distribution and calibration on clean test outputs.
[Section 5.5, Table 1] The F1 evaluation mixes watermarked and clean outputs, but no false-positive rate on clean outputs alone, no confidence intervals, and no run-to-run variance are reported. Since the detection threshold is fixed at gamma=2 with no reported calibration, the F1 numbers could be dominated by threshold effects. Add an explicit false-positive analysis on clean forecasts from the protected model across all datasets, and report the z-score distribution for clean samples.
[Section 5.6, Figure 4] The distillation traceability experiment has no clean-output control. F1 is reported only for outputs of DLinear models trained on watermarked data; there is no DLinear model trained on clean outputs and tested with the same detector. Without that control, the post-distillation F1 could be detector bias caused by a shift in DLinear's output distribution relative to the training-time similarity statistics, rather than evidence that the watermark survived. Please include a DLinear model trained on clean outputs and report its z-score distribution and false-positive rate.
[Section 4.2, Cold Token-based Watermark Book Construction] The construction of B, mu, and sigma requires the protected model to compute accumulated similarities over a subset of its training data, but the paper does not specify the subset size, the aggregation rule for computing mu and sigma (per patch, per pair, or per sample), or whether the same subset is used for all test and detection evaluations. This is load-bearing for the calibration of Eq. (10) and for reproducibility. Please provide the exact protocol, including the number of training samples and the precise definition of the similarity scores entering mu and sigma.

minor comments (6)

[Section 3.1 and Section 4.2] There are several typos and grammatical errors: "E.q. 1" should be "Eq. 1", "fist" should be "first", and "guaranttee" should be "guarantee". Please proofread the manuscript.
[Eq. (7)] In Eq. (7), the condition "if hat_epsilon_i <= eta" should use the absolute value, i.e., "if |hat_epsilon_i| <= eta", to correctly describe element-wise clipping onto the l_infinity ball.
[Section 1 and Section 2.2] The paper claims to be the "first generic, post-hoc watermarking framework" for LLMTS while acknowledging HTW as prior work. Please clarify the precise distinction (generic vs. task-specific, post-hoc vs. training-time) so that the novelty claim is unambiguous.
[Section 5.7, Table 2] The ablation study is presented only on four datasets, with the statement that "similar conclusion can be obtained from other cases" but no supporting evidence. Please report the full ablation table in the appendix or clearly mark the four datasets as a representative subset.
[Section 5.2] The ratio F1/Delta_MSE is reported as a single number, but Delta_MSE can be very small (e.g., 0.004 on ETTh1 for TEMPO), making the ratio sensitive to small absolute changes. Please report Delta_MSE separately and, if possible, provide confidence intervals for the ratio.
[References] Reference [27] (HTW) points to a repository URL without a peer-reviewed publication. If a published version exists, please cite it; otherwise, consider noting that this is a preprint or thesis.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the watermark signal is defined as similarity to cold tokens and detection measures the same statistic, but this is the intended watermark protocol, not a derivation that reduces to its inputs.

full rationale

Waltz's pipeline is self-contained and empirically evaluated. The cold-token watermark book is constructed from the protected model's training data (Section 4.2), and the z-score detector in Eq. 10 compares test-time patch embeddings against the precomputed statistics mu and sigma. The watermarked samples are produced by a separate PGD optimization procedure (Eqs. 5-6) and then detected on held-out test outputs, so the reported F1 scores are not fitted values: the encoder, cold tokens, and threshold gamma=2 are fixed before detection. The fact that the embedding objective maximizes similarity to cold tokens and the detector measures the same similarity is the standard watermarking contract, not a circular reduction. The paper does not fit any parameter to the test labels, does not rename a known result, and does not rely on load-bearing self-citations: the cited prior work (TEMPO, UniTime, HTW, etc.) is used as external baselines, and the 'cold token' observation is introduced and demonstrated in this paper via Figure 3 rather than imported from the authors' own prior work. No claimed prediction is equivalent by construction to an input, and no uniqueness or ansatz is smuggled in through self-citation. The correct finding is no significant circularity.

Assumptions & free parameters 7 free parameters · 4 assumptions · 1 invented entities

The central claim rests on a small set of unverified domain assumptions about embedding-space geometry and API access, plus several hand-set hyperparameters. No physical entities are postulated; 'cold tokens' are recomputable statistical objects with independent evidence. The main burden is that the z-score null distribution is calibrated on training data and assumed stable.

free parameters (7)

alpha (number of watermarked patches) = 1 (default)
Chosen by hand; controls the number of patch-token pairs rewired; larger values spread noise thinner and lower F1 in Figure 5a.
eta (L-infinity noise budget) = 0.01 (default)
Hard bound on watermark noise; chosen by hand as the balance point in Figure 5b.
gamma (z-score detection threshold) = 2 (default)
Detection cutoff; directly determines false positive rate and F1; no ROC or FPR analysis is reported.
beta (PGD step size) = 0.1 (default)
Optimization hyperparameter for noise generation.
M (size of cold token set) = not reported
The watermark book B has M tokens, but the paper never states M or how the cutoff for 'lowest accumulated similarity' is chosen.
PGD iteration count = not reported
Described only as 'few iteration step'; the number of Adam steps affects how well the similarity target is reached.
size of training subset for cold-token statistics = not reported
Mu and sigma are computed on 'a subset of its training data'; the subset size is not given.

assumptions (4)

domain assumption Patch embeddings of LLMTS models share a vector space with LLM token embeddings, making cosine similarity between them meaningful.
Section 4.1 states intermediate time series representations 'naturally align' with the LLM's token embedding space; the method and its detection statistic depend on this alignment.
domain assumption The time series encoder E_ts is differentiable and exposed to the watermarking party so gradients can be backpropagated into the input noise.
Eq. 3 and Eq. 6 use gradient descent through E_ts; without this access, PGD-based noise optimization cannot be run at the API boundary.
domain assumption The similarity statistics mu and sigma computed from a training subset remain valid for test-time forecasts and for outputs of distilled models.
Eq. 10 uses the same mu and sigma for detection in all experiments, including Figure 4 after distillation; distribution shift would break the z-score calibration.
domain assumption The maximum patch-token similarity is stable enough that a z-score threshold of 2 gives low false positives.
Eq. 10 assumes a usable null distribution for max similarity; the paper does not report false positive rates or an ROC curve.

invented entities (1)

Cold tokens independent evidence
purpose: A set of LLM vocabulary tokens with consistently low similarity to patch embeddings; used as the watermark book and detection reference.
The existence of such tokens is an empirical, recomputable property of the embedding statistics shown in Figure 3, not a hidden physical entity; anyone with the model can recompute the low-similarity token set.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Watermarking Large Language Model-based Time Series Forecasting." pith.science (2026). https://pith.science/paper/KSXVUNB7

@misc{pith2026250720762,
  author       = {Pith},
  title        = {Pith review of: Watermarking Large Language Model-based Time Series Forecasting},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/KSXVUNB7}},
  note         = {Machine review of arXiv:2507.20762}
}

read the original abstract

Large Language Model-based Time Series Forecasting (LLMTS) has shown remarkable promise in handling complex and diverse temporal data, representing a significant step toward foundation models for time series analysis. However, this emerging paradigm introduces two critical challenges. First, the substantial commercial potential and resource-intensive development raise urgent concerns about intellectual property (IP) protection. Second, their powerful time series forecasting capabilities may be misused to produce misleading or fabricated deepfake time series data. To address these concerns, we explore watermarking the outputs of LLMTS models, that is, embedding imperceptible signals into the generated time series data that remain detectable by specialized algorithms. We propose a novel post-hoc watermarking framework, Waltz, which is broadly compatible with existing LLMTS models. Waltz is inspired by the empirical observation that time series patch embeddings are rarely aligned with a specific set of LLM tokens, which we term ``cold tokens''. Leveraging this insight, Waltz embeds watermarks by rewiring the similarity statistics between patch embeddings and cold token embeddings, and detects watermarks using similarity z-scores. To minimize potential side effects, we introduce a similarity-based embedding position identification strategy and employ projected gradient descent to constrain the watermark noise within a defined boundary. Extensive experiments using two popular LLMTS models across seven benchmark datasets demonstrate that Waltz achieves high watermark detection accuracy with minimal impact on the quality of the generated time series.

Figures

Figures reproduced from arXiv: 2507.20762 by the authors.

**Figure 2.** The general LLMTS framework and the overview of our LLMTS watermark framework. [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗

**Figure 3.** Proof-of-Concepts: The distribution of natural lan [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗

Figures from the paper (3 more)

**Figure 4.** Figure 4: The traceability of watermark after knowledge distillation. [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]

**Figure 5.** Figure 5: Hyper parameter analysis for the number of water [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]

**Figure 6.** Figure 6: Case study for watermarked outputs. 6 CONCLUSION In this paper, we propose an effective watermarking framework, Waltz, designed to protect the intellectual property of LLMTS and prevent misuse of their generated outputs. Waltz embeds watermarks by rewiring the alignme…

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

44 extracted references · 26 canonical work pages

[1]

Gran Badshah, Siau-Chuin Liew, Jasni Mohd Zain, and Mushtaq Ali. 2016. Wa- termark compression in medical image watermarking using Lempel-Ziv-Welch (LZW) lossless compression technique. Journal of digital imaging 29 (2016), 216–225

work page 2016
[2]

Defu Cao, Furong Jia, Sercan O Arik, Tomas Pfister, Yixiang Zheng, Wen Ye, and Yan Liu. 2024. TEMPO: Prompt-based Generative Pre-trained Transformer for Time Series Forecasting. In The Twelfth International Conference on Learning Representations

work page 2024
[3]

Ingemar Cox, Matthew Miller, Jeffrey Bloom, and Chris Honsinger. 2002. Digital watermarking. Journal of Electronic Imaging 11, 3 (2002), 414–414

work page 2002
[4]

Ingemar J Cox, Joe Kilian, F Thomson Leighton, and Talal Shamoon. 1997. Secure spread spectrum watermarking for multimedia. IEEE transactions on image processing 6, 12 (1997), 1673–1687

work page 1997
[5]

Xi Fang, Weijie Xu, Fiona Anting Tan, Jiani Zhang, Ziqing Hu, Yanjun Qi, Scott Nickleach, Diego Socolinsky, Srinivasan Sengamedu, and Christos Faloutsos

work page
[6]

Nate Gruver, Marc Finzi, Shikai Qiu, and Andrew G Wilson. 2023. Large language models are zero-shot time series forecasters. Advances in Neural Information Processing Systems 36 (2023), 19622–19635

2023
[7]

Furong Jia, Kevin Wang, Yixiang Zheng, Defu Cao, and Yan Liu. 2024. Gpt4mts: Prompt-based large language model for multimodal time-series forecasting. In Proceedings of the AAAI Conference on Artificial Intelligence, Vol. 38. 23343–23351

2024
[8]

Ming Jin, Huan Yee Koh, Qingsong Wen, Daniele Zambon, Cesare Alippi, Geof- frey I Webb, Irwin King, and Shirui Pan. 2024. A survey on graph neural networks for time series: Forecasting, classification, imputation, and anomaly detection. IEEE Transactions on Pattern Analysis and Machine Intelligence (2024)

work page 2024

Show all 44 references

[9]

Ming Jin, Shiyu Wang, Lintao Ma, Zhixuan Chu, James Y Zhang, Xiaoming Shi, Pin-Yu Chen, Yuxuan Liang, Yuan-Fang Li, Shirui Pan, et al. 2024. Time-LLM: Time Series Forecasting by Reprogramming Large Language Models. In The Twelfth International Conference on Learning Representations

2024
[10]

Ming Jin, Yifan Zhang, Wei Chen, Kexin Zhang, Yuxuan Liang, Bin Yang, Jindong Wang, Shirui Pan, and Qingsong Wen. 2024. Position: What can large language models tell us about time series analysis. In Forty-first International Conference on Machine Learning

2024
[11]

John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. 2023. A watermark for large language models. In International Conference on Machine Learning . PMLR, 17061–17084

2023
[12]

Yaxuan Kong, Yiyuan Yang, Yoontae Hwang, Wenjie Du, Stefan Zohren, Zhangyang Wang, Ming Jin, and Qingsong Wen. 2025. Time-mqa: Time se- ries multi-task question answering with context enhancement. arXiv preprint arXiv:2503.01875 (2025)

2025 arXiv
[13]

Guokun Lai, Wei-Cheng Chang, Yiming Yang, and Hanxiao Liu. 2018. Modeling long-and short-term temporal patterns with deep neural networks. In The 41st international ACM SIGIR conference on research & development in information retrieval. 95–104

2018
[14]

Yuqing Liang, Jiancheng Xiao, Wensheng Gan, and Philip S Yu. 2024. Wa- termarking techniques for large language models: A survey. arXiv preprint arXiv:2409.00089 (2024)

2024 arXiv
[15]

Bryan Lim and Stefan Zohren. 2021. Time-series forecasting with deep learning: a survey. Philosophical Transactions of the Royal Society A 379, 2194 (2021), 20200209

2021
[16]

Aiwei Liu, Leyi Pan, Yijian Lu, Jingjing Li, Xuming Hu, Xi Zhang, Lijie Wen, Irwin King, Hui Xiong, and Philip Yu. 2024. A survey of text watermarking in the era of large language models. Comput. Surveys 57, 2 (2024), 1–36

2024
[17]

Haoxin Liu, Shangqing Xu, Zhiyuan Zhao, Lingkai Kong, Harshavardhan Prab- hakar Kamarthi, Aditya Sasanur, Megha Sharma, Jiaming Cui, Qingsong Wen, Chao Zhang, et al. 2024. Time-mmd: Multi-domain multimodal dataset for time series analysis. Advances in Neural Information Proces...

2024
[18]

Minhao Liu, Ailing Zeng, Muxi Chen, Zhijian Xu, Qiuxia Lai, Lingna Ma, and Qiang Xu. 2022. Scinet: Time series modeling and forecasting with sample convolution and interaction. Advances in Neural Information Processing Systems 35 (2022), 5816–5828

2022
[19]

Xu Liu, Junfeng Hu, Yuan Li, Shizhe Diao, Yuxuan Liang, Bryan Hooi, and Roger Zimmermann. 2024. Unitime: A language-empowered unified model for cross- domain time series forecasting. In Proceedings of the ACM Web Conference 2024 . 4095–4106

2024
[20]

Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. 2017. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083 (2017)

2017 arXiv
[21]

Bonan Min, Hayley Ross, Elior Sulem, Amir Pouran Ben Veyseh, Thien Huu Nguyen, Oscar Sainz, Eneko Agirre, Ilana Heintz, and Dan Roth. 2023. Recent advances in natural language processing via large pre-trained language models: A survey. Comput. Surveys 56, 2 (2023), 1–40

2023
[22]

Yuqi Nie, Nam H Nguyen, Phanwadee Sinthong, and Jayant Kalagnanam. [n.d.]. A Time Series is Worth 64 Words: Long-term Forecasting with Transformers. In The Eleventh International Conference on Learning Representations
[23]

Zijie Pan, Yushan Jiang, Sahil Garg, Anderson Schneider, Yuriy Nevmyvaka, and Dongjin Song. 2024. S2 IP-LLM: Semantic Space Informed Prompt Learning with LLM for Time Series Forecasting. In Forty-first International Conference on Machine Learning

2024
[24]

Wenjun Peng, Jingwei Yi, Fangzhao Wu, Shangxi Wu, Bin Bin Zhu, Lingjuan Lyu, Binxing Jiao, Tong Xu, Guangzhong Sun, and Xing Xie. 2023. Are You Copying My Model? Protecting the Copyright of Large Language Models for EaaS via Backdoor Watermark. In Proceedings of the 61st Annua...

2023
[25]

Xubin Ren, Jiabin Tang, Dawei Yin, Nitesh Chawla, and Chao Huang. 2024. A survey of large language models for graphs. In Proceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining . 6616–6626. Conference acronym ’XX, June 03–05, 2018, Woodstock, NY Yuan et al

2024
[26]

Zhi Wen Soi, Chaoyi Zhu, Fouad Abiad, Aditya Shankar, Jeroen M Galjaard, Huijuan Wang, and Lydia Y Chen. 2025. TimeWak: Temporal Chained-Hashing Watermark for Time Series Data. arXiv preprint arXiv:2506.06407 (2025)

2025
[27]

Nicolas van Schaik. 2025. Robust watermarking in large language models for time series generation. https://repository.tudelft.nl/record/uuid:dbbf9d34-08ba- 43d6-8ec4-0240ec00a2b7 (2025)

2025
[28]

Wenbo Wan, Jun Wang, Yunming Zhang, Jing Li, Hui Yu, and Jiande Sun. 2022. A comprehensive survey on robust image watermarking. Neurocomputing 488 (2022), 226–247

2022
[29]

Xinlei Wang, Maike Feng, Jing Qiu, Jinjin Gu, and Junhua Zhao. 2024. From news to forecast: Integrating event analysis in llm-based time series forecasting with reflection. Advances in Neural Information Processing Systems 37 (2024), 58118–58153

2024
[30]

Yuxuan Wang, Haixu Wu, Jiaxiang Dong, Yong Liu, Mingsheng Long, and Jianmin Wang. 2024. Deep time series models: A comprehensive survey and benchmark. arXiv preprint arXiv:2407.13278 (2024)

2024 arXiv
[31]

Qingsong Wen, Tian Zhou, Chaoli Zhang, Weiqi Chen, Ziqing Ma, Junchi Yan, and Liang Sun. 2023. Transformers in time series: a survey. In Proceedings of the Thirty-Second International Joint Conference on Artificial Intelligence . 6778–6786

2023
[32]

Yuxin Wen, John Kirchenbauer, Jonas Geiping, and Tom Goldstein. 2023. Tree- ring watermarks: Fingerprints for diffusion images that are invisible and robust. arXiv preprint arXiv:2305.20030 (2023)

2023 arXiv
[33]

Zijin Yang, Kai Zeng, Kejiang Chen, Han Fang, Weiming Zhang, and Nenghai Yu
[34]

Ailing Zeng, Muxi Chen, Lei Zhang, and Qiang Xu. 2023. Are transformers effective for time series forecasting?. In Proceedings of the AAAI conference on artificial intelligence, Vol. 37. 11121–11128

2023
[35]

In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition

Gaussian shading: Provable performance-lossless image watermarking for diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 12162–12171
[36]

Ruisi Zhang, Shehzeen Samarah Hussain, Paarth Neekhara, and Farinaz Koushan- far. 2024. REMARK-LLM: A robust and efficient watermarking framework for generative large language models. In 33rd USENIX Security Symposium (USENIX Security 24). 1813–1830

2024
[37]

Jie Zhang, Dongdong Chen, Jing Liao, Han Fang, Weiming Zhang, Wenbo Zhou, Hao Cui, and Nenghai Yu. 2020. Model watermarking for image processing networks. In Proceedings of the AAAI conference on artificial intelligence , Vol. 34. 12805–12812

2020
[38]

Zihuai Zhao, Wenqi Fan, Jiatong Li, Yunqing Liu, Xiaowei Mei, Yiqi Wang, Zhen Wen, Fei Wang, Xiangyu Zhao, Jiliang Tang, et al. 2024. Recommender systems in the era of large language models (llms). IEEE Transactions on Knowledge and Data Engineering (2024)

2024
[39]

Xiyuan Zhang, Ranak Roy Chowdhury, Rajesh K Gupta, and Jingbo Shang. 2024. Large language models for time series: a survey. InProceedings of the Thirty-Third International Joint Conference on Artificial Intelligence . 8335–8343

2024
[40]

Haoyi Zhou, Shanghang Zhang, Jieqi Peng, Shuai Zhang, Jianxin Li, Hui Xiong, and Wancai Zhang. 2021. Informer: Beyond efficient transformer for long se- quence time-series forecasting. In Proceedings of the AAAI conference on artificial intelligence, Vol. 35. 11106–11115

2021
[41]

Siru Zhong, Weilin Ruan, Ming Jin, Huan Li, Qingsong Wen, and Yuxuan Liang
[44]

vocabulary

Tian Zhou, Peisong Niu, Liang Sun, Rong Jin, et al . 2023. One fits all: Power general time series analysis by pretrained lm. Advances in neural information processing systems 36 (2023), 43322–43355. A MORE RELATED WORK In this section, we briefly review the literature on two ...

2023
[2024]

arXiv preprint arXiv:2402.17944 (2024)

Large Language Models (LLMs) on Tabular Data: Prediction, Generation, and Understanding–A Survey. arXiv preprint arXiv:2402.17944 (2024)

2024 arXiv
[2025]

arXiv preprint arXiv:2502.04395 (2025)

Time-VLM: Exploring Multimodal Vision-Language Models for Augmented Time Series Forecasting. arXiv preprint arXiv:2502.04395 (2025)

2025 arXiv

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.

[1] [1]

Gran Badshah, Siau-Chuin Liew, Jasni Mohd Zain, and Mushtaq Ali. 2016. Wa- termark compression in medical image watermarking using Lempel-Ziv-Welch (LZW) lossless compression technique. Journal of digital imaging 29 (2016), 216–225

work page 2016

[2] [2]

Defu Cao, Furong Jia, Sercan O Arik, Tomas Pfister, Yixiang Zheng, Wen Ye, and Yan Liu. 2024. TEMPO: Prompt-based Generative Pre-trained Transformer for Time Series Forecasting. In The Twelfth International Conference on Learning Representations

work page 2024

[3] [3]

Ingemar Cox, Matthew Miller, Jeffrey Bloom, and Chris Honsinger. 2002. Digital watermarking. Journal of Electronic Imaging 11, 3 (2002), 414–414

work page 2002

[4] [4]

Ingemar J Cox, Joe Kilian, F Thomson Leighton, and Talal Shamoon. 1997. Secure spread spectrum watermarking for multimedia. IEEE transactions on image processing 6, 12 (1997), 1673–1687

work page 1997

[5] [5]

Xi Fang, Weijie Xu, Fiona Anting Tan, Jiani Zhang, Ziqing Hu, Yanjun Qi, Scott Nickleach, Diego Socolinsky, Srinivasan Sengamedu, and Christos Faloutsos

work page

[6] [6]

Nate Gruver, Marc Finzi, Shikai Qiu, and Andrew G Wilson. 2023. Large language models are zero-shot time series forecasters. Advances in Neural Information Processing Systems 36 (2023), 19622–19635

2023

[7] [7]

Furong Jia, Kevin Wang, Yixiang Zheng, Defu Cao, and Yan Liu. 2024. Gpt4mts: Prompt-based large language model for multimodal time-series forecasting. In Proceedings of the AAAI Conference on Artificial Intelligence, Vol. 38. 23343–23351

2024

[8] [8]

Ming Jin, Huan Yee Koh, Qingsong Wen, Daniele Zambon, Cesare Alippi, Geof- frey I Webb, Irwin King, and Shirui Pan. 2024. A survey on graph neural networks for time series: Forecasting, classification, imputation, and anomaly detection. IEEE Transactions on Pattern Analysis and Machine Intelligence (2024)

work page 2024