TAB-DRW: Watermarking Synthetic Tabular Data

• The paper introduces TAB-DRW, a post-editing watermarking scheme that embeds signatures into synthetic tabular data without requiring access to generator internals.
• It leverages a pipeline combining Yeo–Johnson normalization, row-wise discrete Fourier transform, and rank-based pseudorandom bit generation to meet fidelity, detectability, applicability, and robustness goals.
• Experimental evaluations show that TAB-DRW preserves data quality and remains effective against deletion, noise, and reordering attacks across diverse mixed-type benchmarks.

Searching arXiv for the specific topic and closely related tabular watermarking work. I’ll look up the named work and adjacent research on arXiv to ground the article. TAB-DRW is a post-editing watermarking scheme for synthetic tabular data that embeds a detectable signature into already-generated tables without requiring access to generator internals. It is designed for mixed discrete-continuous data and operates by normalizing heterogeneous features, applying a row-wise discrete Fourier transform (DFT), modifying selected imaginary-frequency components so that their signs agree with secret pseudorandom bits, and then inverting the transforms. Detection is posed as a hypothesis test on whether the same sign-alignment pattern appears significantly more often than chance. The method is motivated by data provenance and misuse concerns arising from high-fidelity synthetic tabular data in domains such as healthcare, finance, and public policy, and is presented as a model-agnostic, efficient, robust, and mixed-type-compatible alternative to prior watermarking approaches (Zhao et al., 26 Nov 2025).

1. Problem formulation and design goals

TAB-DRW is introduced against a background in which prior tabular watermarking methods do not simultaneously satisfy four desiderata: fidelity, detectability, applicability, and robustness. In the paper’s formulation, fidelity means preserving statistical quality and utility; detectability means reliable private verification; applicability means support for mixed discrete/continuous tables, ideally as a post-processing step; and robustness means resistance to attacks such as deletion, noise, quantization, and reordering (Zhao et al., 26 Nov 2025).

The method is explicitly framed as a post-editing scheme. That distinction is central. Sampling-phase methods such as TabWak and MUSE require modifications to generation pipelines and may involve diffusion-model inversion or sampling, whereas post-editing methods such as GLW and TabularMark are lightweight but have limitations: GLW is described as largely designed for continuous data and fragile to noise, while TabularMark requires storing the original dataset for recovery, which adds memory overhead and is awkward for generative settings (Zhao et al., 26 Nov 2025).

This positioning implies a particular operational model. A generative model first produces a synthetic table; TAB-DRW then watermarks that table externally. A plausible implication is that the method is intended to decouple provenance control from model architecture. The paper reinforces this interpretation by evaluating TAB-DRW with synthetic data produced by TabSyn, TabDDPM, and STaSy rather than tying the watermark to one generator family (Zhao et al., 26 Nov 2025).

2. Frequency-domain watermarking pipeline

The pipeline has four main stages: preprocessing heterogeneous features, applying a row-wise DFT, embedding a watermark by changing selected imaginary parts, and inverting the transforms to release the watermarked table. The appendix also describes a privacy-enhanced variant in which columns are permuted by a secret key before transformation and then unpermuted afterward (Zhao et al., 26 Nov 2025).

The preprocessing stage uses the Yeo–Johnson transformation followed by standardization. For each scalar input $x \in \mathbb{R}$, the Yeo–Johnson transform is defined as

$$\Psi(\lambda, x) = \begin{cases} \frac{(x + 1)^\lambda - 1}{\lambda}, & x \geq 0,\ \lambda \neq 0, \ \ln(x + 1), & x \geq 0,\ \lambda = 0, \ -\frac{(-x + 1)^{2 - \lambda} - 1}{2 - \lambda}, & x < 0,\ \lambda \neq 2, \ -\ln(-x + 1), & x < 0,\ \lambda = 2. \end{cases}$$

The parameter $\lambda$ is selected automatically to reduce skewness and heterogeneity. The transformed columns are then standardized as

$$x'_{i,j} = \frac{\Psi(\lambda_j, x_{i,j}) - \mu_j}{\sigma_j},$$

where $\mu_j$ and $\sigma_j$ are the transformed column mean and standard deviation. The paper emphasizes that the transform is monotone, invertible, works for both positive and negative values, and is useful for making marginal distributions more Gaussian-like (Zhao et al., 26 Nov 2025).

After preprocessing, each row $\mathbf{x}_i \in \mathbb{R}^p$ is mapped to the frequency domain via a row-wise DFT. Because the input row is real-valued, the DFT exhibits conjugate symmetry, so only the first half of the spectrum needs to be edited. The paper denotes the number of such effective entries by

$m = \left\lfloor \frac{p-1}{2} \right\rfloor.$

This symmetry is what makes the watermarking step structured and efficient (Zhao et al., 26 Nov 2025).

Embedding is performed by aligning the sign of the imaginary part of each effective frequency coefficient with a pseudorandom bit $\zeta_t \sim \mathrm{Bernoulli}(0.5)$. The simplest hard rule is

$$y_t^{wm} = \Re(y_t) + (2\zeta_t - 1)i \cdot |\Im(y_t)|,$$

with the conjugate entry set accordingly. To improve fidelity, the paper introduces a soft variant parameterized by $$\Psi(\lambda, x) = \begin{cases} \frac{(x + 1)^\lambda - 1}{\lambda}, & x \geq 0,\ \lambda \neq 0, \ \ln(x + 1), & x \geq 0,\ \lambda = 0, \ -\frac{(-x + 1)^{2 - \lambda} - 1}{2 - \lambda}, & x < 0,\ \lambda \neq 2, \ -\ln(-x + 1), & x < 0,\ \lambda = 2. \end{cases}$$0, where $$\Psi(\lambda, x) = \begin{cases} \frac{(x + 1)^\lambda - 1}{\lambda}, & x \geq 0,\ \lambda \neq 0, \ \ln(x + 1), & x \geq 0,\ \lambda = 0, \ -\frac{(-x + 1)^{2 - \lambda} - 1}{2 - \lambda}, & x < 0,\ \lambda \neq 2, \ -\ln(-x + 1), & x < 0,\ \lambda = 2. \end{cases}$$1 controls how many effective frequency entries are eligible and $$\Psi(\lambda, x) = \begin{cases} \frac{(x + 1)^\lambda - 1}{\lambda}, & x \geq 0,\ \lambda \neq 0, \ \ln(x + 1), & x \geq 0,\ \lambda = 0, \ -\frac{(-x + 1)^{2 - \lambda} - 1}{2 - \lambda}, & x < 0,\ \lambda \neq 2, \ -\ln(-x + 1), & x < 0,\ \lambda = 2. \end{cases}$$2 controls how strongly the imaginary part is changed: $$\Psi(\lambda, x) = \begin{cases} \frac{(x + 1)^\lambda - 1}{\lambda}, & x \geq 0,\ \lambda \neq 0, \ \ln(x + 1), & x \geq 0,\ \lambda = 0, \ -\frac{(-x + 1)^{2 - \lambda} - 1}{2 - \lambda}, & x < 0,\ \lambda \neq 2, \ -\ln(-x + 1), & x < 0,\ \lambda = 2. \end{cases}$$3 When $$\Psi(\lambda, x) = \begin{cases} \frac{(x + 1)^\lambda - 1}{\lambda}, & x \geq 0,\ \lambda \neq 0, \ \ln(x + 1), & x \geq 0,\ \lambda = 0, \ -\frac{(-x + 1)^{2 - \lambda} - 1}{2 - \lambda}, & x < 0,\ \lambda \neq 2, \ -\ln(-x + 1), & x < 0,\ \lambda = 2. \end{cases}$$4, this reduces to the hard sign-flip; when $$\Psi(\lambda, x) = \begin{cases} \frac{(x + 1)^\lambda - 1}{\lambda}, & x \geq 0,\ \lambda \neq 0, \ \ln(x + 1), & x \geq 0,\ \lambda = 0, \ -\frac{(-x + 1)^{2 - \lambda} - 1}{2 - \lambda}, & x < 0,\ \lambda \neq 2, \ -\ln(-x + 1), & x < 0,\ \lambda = 2. \end{cases}$$5, it essentially does nothing. The main experiments use $$\Psi(\lambda, x) = \begin{cases} \frac{(x + 1)^\lambda - 1}{\lambda}, & x \geq 0,\ \lambda \neq 0, \ \ln(x + 1), & x \geq 0,\ \lambda = 0, \ -\frac{(-x + 1)^{2 - \lambda} - 1}{2 - \lambda}, & x < 0,\ \lambda \neq 2, \ -\ln(-x + 1), & x < 0,\ \lambda = 2. \end{cases}$$6 (Zhao et al., 26 Nov 2025).

After editing, the algorithm applies the inverse DFT, inverse standardization, and inverse Yeo–Johnson transform, then rounds discrete variables to valid values and clips bounded variables. The paper notes that this matters because tabular data includes integer and categorical attributes, and it reports that rounding and clipping have only a mild effect on detectability for most datasets (Zhao et al., 26 Nov 2025).

3. Rank-based pseudorandom bit generation and verification

A central contribution of TAB-DRW is its row-wise pseudorandom bit generation mechanism, which avoids storing per-row watermark bits. The stated design goals are robustness and memory efficiency: small post-processing perturbations should not change the bits too much, and the scheme should avoid a large lookup table of random bits (Zhao et al., 26 Nov 2025).

The procedure begins by selecting a secret subset of columns $$\Psi(\lambda, x) = \begin{cases} \frac{(x + 1)^\lambda - 1}{\lambda}, & x \geq 0,\ \lambda \neq 0, \ \ln(x + 1), & x \geq 0,\ \lambda = 0, \ -\frac{(-x + 1)^{2 - \lambda} - 1}{2 - \lambda}, & x < 0,\ \lambda \neq 2, \ -\ln(-x + 1), & x < 0,\ \lambda = 2. \end{cases}$$7 using a secret key $$\Psi(\lambda, x) = \begin{cases} \frac{(x + 1)^\lambda - 1}{\lambda}, & x \geq 0,\ \lambda \neq 0, \ \ln(x + 1), & x \geq 0,\ \lambda = 0, \ -\frac{(-x + 1)^{2 - \lambda} - 1}{2 - \lambda}, & x < 0,\ \lambda \neq 2, \ -\ln(-x + 1), & x < 0,\ \lambda = 2. \end{cases}$$8. For each row, it computes a score

$$\Psi(\lambda, x) = \begin{cases} \frac{(x + 1)^\lambda - 1}{\lambda}, & x \geq 0,\ \lambda \neq 0, \ \ln(x + 1), & x \geq 0,\ \lambda = 0, \ -\frac{(-x + 1)^{2 - \lambda} - 1}{2 - \lambda}, & x < 0,\ \lambda \neq 2, \ -\ln(-x + 1), & x < 0,\ \lambda = 2. \end{cases}$$9

ranks the row among all rows according to that score, and normalizes the rank as

$\lambda$0

The interval $\lambda$1 is then partitioned into

$\lambda$2

equal bins. The paper describes an implicit binary tree of depth $\lambda$3, with a bit-pair assignment at each node, so that traversing from root to leaf yields a pseudorandom sequence (Zhao et al., 26 Nov 2025).

The algorithmic mapping is explicit. For $\lambda$4, one computes

$\lambda$5

and appends a bit pair depending on $\lambda$6: append $\lambda$7 if $\lambda$8 or $\lambda$9, otherwise append $$x'_{i,j} = \frac{\Psi(\lambda_j, x_{i,j}) - \mu_j}{\sigma_j},$$0, then truncate to the first $$x'_{i,j} = \frac{\Psi(\lambda_j, x_{i,j}) - \mu_j}{\sigma_j},$$1 bits. The paper interprets this as similar to a 2-Gray code: adjacent bins differ by only one bit pair, so slight rank shifts change the recovered bit sequence only mildly. A plausible implication is that the robustness mechanism is located not only in frequency-domain embedding but also in the combinatorics of key-conditioned bit recovery (Zhao et al., 26 Nov 2025).

Verification is formulated as a hypothesis test

$$x'_{i,j} = \frac{\Psi(\lambda_j, x_{i,j}) - \mu_j}{\sigma_j},$$2

Given a suspect table, the verifier applies the same preprocessing, computes the DFT row-wise, regenerates the pseudorandom bits using the secret key, and counts how many effective entries have the correct sign alignment. For row $$x'_{i,j} = \frac{\Psi(\lambda_j, x_{i,j}) - \mu_j}{\sigma_j},$$3,

$$x'_{i,j} = \frac{\Psi(\lambda_j, x_{i,j}) - \mu_j}{\sigma_j},$$4

The table-level test statistic is

$$x'_{i,j} = \frac{\Psi(\lambda_j, x_{i,j}) - \mu_j}{\sigma_j},$$5

where under the no-watermark null,

$$x'_{i,j} = \frac{\Psi(\lambda_j, x_{i,j}) - \mu_j}{\sigma_j},$$6

so that asymptotically $$x'_{i,j} = \frac{\Psi(\lambda_j, x_{i,j}) - \mu_j}{\sigma_j},$$7. A table is declared watermarked if

$$x'_{i,j} = \frac{\Psi(\lambda_j, x_{i,j}) - \mu_j}{\sigma_j},$$8

The experiments calibrate thresholds by Monte Carlo simulation on unwatermarked synthetic tables (Zhao et al., 26 Nov 2025).

4. Distortion, robustness, and privacy-enhanced variants

TAB-DRW includes an analytic treatment of watermark-induced distortion. If $$x'_{i,j} = \frac{\Psi(\lambda_j, x_{i,j}) - \mu_j}{\sigma_j},$$9 denotes the set of modified effective frequencies, the entry-wise perturbation is written as

$\mu_j$0

with

$\mu_j$1

and

$\mu_j$2

From this, the paper derives three stated consequences: column means are preserved,

$\mu_j$3

correlation changes are bounded,

$\mu_j$4

and the distributional shift is bounded in Wasserstein-2,

$\mu_j$5

These expressions formalize the fidelity–strength tradeoff: larger watermarking strength implies more distortion (Zhao et al., 26 Nov 2025).

The paper also provides a robustness analysis under Gaussian noise and then extends it to $\mu_j$6-sub-Gaussian rows. Under i.i.d. Gaussian rows $\mu_j$7 with additive noise $\mu_j$8, the DFT of the noise preserves Gaussianity in the imaginary part of effective frequencies: $\mu_j$9 A lower bound is then derived: $\sigma_j$0 The corresponding sample-complexity lower bound for achieving power $\sigma_j$1 at level $\sigma_j$2 is

$\sigma_j$3

The key message identified in the paper is that larger $\sigma_j$4 increases signal, larger noise $\sigma_j$5 decreases detectability, and changing $\sigma_j$6 alters robustness through the shrinking of imaginary amplitudes (Zhao et al., 26 Nov 2025).

The privacy-enhanced TAB-DRW variant permutes columns by a secret key before watermark embedding and reverses the permutation afterward. The paper presents this as useful in multi-key settings, where a watermark embedded with one key should not be detectable with another, and states that the effective key space is very large, roughly $\sigma_j$7 due to column permutations. It also reports that detectability and fidelity are stable across several random keys (Zhao et al., 26 Nov 2025).

5. Experimental evaluation and empirical behavior

The experimental study uses five benchmark mixed-type tabular datasets: Adult, Magic, Shoppers, Default, and Drybean. The main generator is TabSyn, with DDIM sampling in the reproduced setup for fairness, and TAB-DRW is also evaluated on TabDDPM and STaSy to demonstrate model-agnostic behavior (Zhao et al., 26 Nov 2025).

The baselines are GLW, TabularMark, TabWak$\sigma_j$8, and MUSE. Fidelity is evaluated with Density, Corr, C2ST, and MLE, with MLE defined through downstream utility via XGBoost. Watermark detectability is evaluated with Z-score and FPR/TPR at a fixed threshold $\sigma_j$9, typically $\mathbf{x}_i \in \mathbb{R}^p$0. The attack suite contains ten post-processing scenarios: row deletion, column deletion, cell deletion, Gaussian noise, categorical noise, adaptive noise, truncation, quantization, resampling, and shuffling. The paper additionally studies stronger versions of some attacks (Zhao et al., 26 Nov 2025).

The main empirical findings are organized around fidelity, detectability, and robustness. In fidelity, TAB-DRW is reported to preserve quality well: degradation is typically small and is comparable to or near the best baselines. In detectability, it achieves strong Z-scores and is described as best or among the best on several datasets, especially on mixed-type or discrete-heavy settings where purely continuous methods struggle. In robustness, it remains detectable under deletion, noise, quantization, resampling, and shuffling, often ranking first or second across attack types, and can still achieve high TPR at low FPR with relatively few rows (Zhao et al., 26 Nov 2025).

The paper attributes this robustness to three design choices: the watermark lives in the frequency domain, row-wise bit generation is rank-based and stable, and the tree/Gray-code-like design reduces sensitivity to small shifts. It also reports that a case study on low-cardinality categorical variables such as gender shows that flips are rare and usually semantically plausible. Runtime is described as efficient: embedding and detection are much faster than sampling-phase methods like TabWak, detection is CPU-friendly, and no model access is needed for post-editing use (Zhao et al., 26 Nov 2025).

6. Position within tabular data research and open questions

TAB-DRW sits at the intersection of synthetic tabular data generation and provenance control. Its experimental protocol assumes the existence of high-fidelity generators such as TabSyn, TabDDPM, and STaSy (Zhao et al., 26 Nov 2025). This broader setting is consistent with recent generative work on heterogeneous tables, including diffusion-nested autoregressive synthesis. For example, TabDAR factorizes a table row into conditional distributions, uses a masked bidirectional Transformer to support arbitrary generation order, nests a conditional diffusion model for continuous columns, and is evaluated on ten real-world datasets spanning continuous-only, discrete-only, and heterogeneous regimes (Zhang et al., 2024). This suggests that watermarking and synthesis are becoming increasingly decoupled modules in tabular-data pipelines.

Within watermarking specifically, TAB-DRW is best understood as a model-agnostic post-editing alternative to both sampling-phase watermarking and lighter but less robust post-editing methods. The paper’s contribution is not merely the use of the DFT; it is the combination of Yeo–Johnson normalization, imaginary-sign encoding, rank-based pseudorandom bit generation without storage overhead, and a hypothesis-test detector. A plausible implication is that the method treats watermark recovery as a statistical signal-detection problem rather than as exact record-level recovery (Zhao et al., 26 Nov 2025).

The paper also identifies several open directions. These include finding a provably optimal modification strategy in the DFT domain, combining watermarking with differential privacy or membership privacy protections, and adaptively allocating watermark strength by feature importance or downstream task sensitivity. It notes practical caveats as well: stronger watermarking increases distortion, row-order dependence means heavy shuffling attacks matter, and the theoretical analysis is idealized in transformed space and does not fully model every practical refitting effect, although the experiments suggest the approximation is sound (Zhao et al., 26 Nov 2025).