RaMark: Radioactive Watermarking for Generated Tabular Data

2026-07-09

AI Summary

This work addresses the vulnerability of existing watermarking methods to model retraining by introducing a novel “radioactive” watermarking mechanism. The proposed approach uniquely embeds sinusoidal dependencies directly into the data distribution itself, creating an intrinsic coupling between the watermark and the data semantics: any generative model that preserves data utility must inherently retain the watermark, while attempts to remove it inevitably distort the underlying distribution and degrade utility. Combining generative modeling with statistical hypothesis testing, the method enables robust ownership verification. Empirical evaluations on two real-world tabular datasets demonstrate that, even in large-scale scenarios involving up to 100,000 data owners, the technique significantly outperforms seven state-of-the-art baselines under both model retraining and data modification attacks, consistently achieving high detection rates.

Abstract

Recent advances in generative modeling have made generated tabular data a practical solution for privacy-sensitive data sharing, where watermarking enables ownership verification. However, existing watermarking methods fundamentally fail under retraining attacks, in which an adversary retrains a generative model on a watermarked dataset and regenerates high-utility data that no longer carries the watermark. We address this challenge by introducing radioactivity, the property that a watermark remains detectable after generative model retraining, and propose RaMark, a radioactive watermarking method that embeds a sinusoidal dependency as an intrinsic component of the data distribution. By coupling the watermark with the underlying distribution, RaMark ensures that any generative model preserving data utility also has to preserve the watermark. We theoretically show that with high probability removing watermark degrades utility and alters data distribution. Extensive experiments on two real-world tabular datasets, under a large-scale ownership verification setting with $10^5$ independent data owners, demonstrate that RaMark achieves substantially stronger radioactivity than seven state-of-the-art methods and consistently outperforms them against both retraining and data modification attacks.

Problem

• watermarking
• retraining attacks
• generative modeling
• tabular data
• ownership verification

Innovation

• radioactive watermarking
• generative tabular data
• retraining attack
• sinusoidal dependency
• ownership verification