TimeWak: Temporal Chained-Hashing Watermark for Time Series Data

Thank you for your valuable comments and positive feedback. It's helpful for us to futher improve this work.

Weaknesses

[W1] Tightness of the bound.

[WA1] The parameters are summarized in Appendix A. The error bound in Thm. 3.1 shows how an initial error $\epsilon$ propagates, governed by diffusion parameters ($a_{t}$, $b_{t}$) and the noise estimator's Lipschitz constant ($\Delta_{t}$). The Lipschitz assumption is standard for the neural networks used. Crucially, we empirically validate this assumption in Appendix C (Fig. 5, Lines 559-561). We computed $\Delta_{t}$ on 10,000 samples for four datasets and found it behaves as expected from prior work: it starts large (28-80) but rapidly decreases to <1 as the timestep increases. And we also added an experiments by generating 10,000 samples (length 64) across five datasets, computing $x_0$ (final output) and $x_1$ (one step prior). Results in Table A show consistently small $L_1$ norms between $x_1$ and $x_0$ (avg: 5.1-7.0e-03, max: <0.23), validating our $\epsilon$-exact approximation. These results demonstrate the empirical value of $\epsilon$ in our proof.

Table A: $L_1$ norms between $x_1$ and $x_0$ for 64-length sequences over 10,000 samples.

[W2] Crisp summary of results.

[WA2] Thank you for the suggestion. We will add it in the next version.

Questions

[Q1] Elaborate Figure 2.

[QA1] The detection of our watermark relies on accurate reconstruction through the inverse diffusion process; lower reconstruction error leads to better watermark detection. Figure 2 reveals a critical asymmetry: reconstruction errors vary dramatically across different features (plots a, c), while remaining much more uniform across time (plots b, d). This demonstrates spatial heterogeneity where reconstruction difficulty differs significantly between feature types. This spatial heterogeneity invalidates prior methods like TabWak that rely on feature-wise seed cloning. TabWak assumes that cloned watermark seeds across features will reconstruct identically, enabling detection through seeds comparison. However, the non-uniform reconstruction errors shown in Figure 2 cause cloned seeds to reconstruct differently across features, leading to low bit accuracy and failed detection. This fundamental limitation motivates our temporal chained-hashing approach: instead of comparing seeds across the problematic feature dimension, we chain and verify seeds along the more stable temporal dimension where reconstruction errors are uniform, ensuring reliable watermark detection despite spatial heterogeneity.

[Q2] "time series" written as "timeseries".

[QA2] We will fix it in the next version.

[Q3] Clarify the terms "sampling time" and "real-space".

[QA3] We use "sampling time" to refer to the generation phase of diffusion models, distinct from the signal processing definition of temporal intervals between measurements. To clarify, we will use "generation-time watermarking."

Our "real-space" terminology indicates watermarking in the original time series data rather than in latent representations, analogous to spatial versus frequency domains in Fourier analysis. We will use "data-space watermarking" or "native-space watermarking" in next version.

[Q4] Notation issue in Appendix B.3.

[QA4] Yes, that is a typo, we will fix it in the next version.

[Q5] Clarify the term "self-hash".

[QA5] It should be "chained-hash", which is explained in Section 3.2.1, we will fix it in the next version.

[Q6] Add an emphasis in the beginning of the overview.

[QA6] We will add it in the next version.

[Q7] Clarify $L=2$.

[QA7] This is correct. In the experiments of the main article, we show results in $L=2$. However, other values of $L$ are feasible, such as $L=3$ or $4$. We include these possibilities in our results in Tables 16-18 in Appendix E.7.2. While these show promising results, $L=2$ yields the best results in most cases.

[Q8] Reason behind the specific choice within the inverse Gaussian CDF in eqn(5).

[QA8] The core intuition behind Equation (5) is to control Gaussian noise generation for watermarking while preserving the original $\mathcal{N}(0,1)$ distribution that diffusion models expect. Instead of generating completely random noise, we guide the sampling process: the watermark seed $s^{w,f}$ determines which "region" of the Gaussian distribution we sample from, while still maintaining overall Gaussian properties. The inverse CDF $\Phi^{-1}(u + s^{w,f}/L)$ partitions the distribution into $L$ equal-probability bins, ensuring each watermark bit steers noise generation toward specific quantile ranges without changing the fundamental distribution shape.

This approach preserves generation quality because the noise remains genuinely Gaussian; we're simply controlling which part of the distribution each sample comes from based on our watermark. During detection, we reverse this process by checking which quantile bin the recovered noise falls into, revealing the original watermark seed. Alternative approaches like directly adding watermark signals to noise would visibly distort the Gaussian distribution and degrade sample quality, while our method maintains the statistical properties diffusion models rely on for high-quality generation.

[Q9] Clarify the notation $(x_0, x_1)$.

[QA9] We appreciate this clarification request about our notation. In standard diffusion models, $x_0$ and $x_1$ are distinct states in the forward diffusion process: $x_0$ represents the clean data (generated time series), while $x_1$ is the result after one forward diffusion step with small noise added and is different from $x_T$. $x_T$ represents the fully diffused state, approximating pure noise, after all $T$ forward steps are completed.

The confusion arises in our $\epsilon$-exact inversion discussion (Section 3.2.2 and Theorem 3.1). Standard BDIA inversion requires knowing both $x_0$ and $x_1$ to compute exact reverse steps, but in practice we only observe the final generated sample $x_0$. Our key approximation is setting $x_1^{approx} = x_0$ instead of storing the true $x_1$, introducing error $\epsilon = x_1^{orig} - x_0$. This approximation enables practical watermark detection without requiring the intermediate diffusion state $x_1$, though it introduces bounded reconstruction error that our theorem quantifies. We will clarify this notation distinction between the true diffusion state $x_1$ and our practical approximation $x_1^{approx} = x_0$ in the revision.

[Q10] Clarify the calculation of bit accuracy eqn(15) when $s$ is not binary.

[QA10] Yes, Equation (15) can be applied identically for non-binary watermarks. The bit accuracy formula $\text{Acc} = \frac{1}{|W^{\*}|F} \sum_{w \in W^*} \sum_{f=1}^{F} \mathbb{I}[\hat{s}^{w,f} = s^{w,f}]$ compares recovered seeds $\hat{s}^{w,f}$ with ground truth seeds $s^{w,f}$ regardless of the size $L$. When $L > 2$ (non-binary), each seed takes values in $\\{0, 1, ..., L-1\\}$, and the indicator function $\mathbb{I}[\cdot]$ evaluates to 1 only when the recovered value exactly matches the original value. For this setting, the expected bit accuracy for time series without watermark is $1/L$.

However, for our experiments in Tables 16-18 in Appendix E.7.2 with $L=3$ and $4$, we employed the valid bit mechanism from TabWak [1], which focuses on the tail regions of the distribution for superior noise resilience. This mechanism specifically targets extreme quantiles when calculating bit accuracy to detect whether values have flipped to the opposite side of the Gaussian distribution. For example, with $L=4$, we focus exclusively on bits 0 and 3, which correspond to the 0-25% and 75%-100% quantiles in the Gaussian distribution. We then verify whether the sign for these tail values has flipped, which enhances watermark detectability. We will provide a more detailed explanation of this mechanism in the next version.

[Q11] Z-score values too big.

[QA11] These extremely high Z-scores (ranging from ~50 to >500) are actually not uncommon in watermarking literature like TabWak [1] and represent a desirable outcome indicating strong watermark detectability. The large values arise from our evaluation setup using 1,000 samples (as same as TabWak), where the Z-score formula $Z = \frac{\mu_{Acc,W} - \mu_{Acc,NW}}{\sigma_{Acc,NW}/\sqrt{n}}$ amplifies differences by $\sqrt{1,000} \approx 31.6$. When watermarked samples achieve ~90% bit accuracy versus ~50% for non-watermarked samples, this creates substantial differences that, combined with moderate sample size, produce Z-scores in the hundreds.

[Q12] Explain the increase in Z-score after the attack on TimeWak.

[QA12] We acknowledge that this counter-intuitive phenomenon appears for some baselines in Table 2. However, we want to clarify that for our proposed method, TimeWak, the Z-score consistently decreases as the attack strength increases across almost all scenarios, which is the expected behavior. The increase in Z-score is primarily observed for less robust methods like Tree-Ring and Gaussian Shading. We hypothesize this is an artifact of how the Z-score is calculated and the nature of these non-native watermarking schemes. The Z-score measures the statistical deviation of an attacked, watermarked sample relative to clean, non-watermarked data. For methods not designed for time series, a strong attack can drastically alter the data's statistical properties in a way that, while destroying the original watermark, makes the data even more different from the clean distribution.

References

[1] Zhu, Chaoyi, et al. "TabWak: A Watermark for Tabular Diffusion Models." ICLR, 2025.

Thank you for your valuable comments.

Weaknesses and Questions

[W1/Q1] Clarify differences from prior works (TabWak or BDIA).

[WA1/QA1] Thanks for pointing this out. The main differences are as follows:

• With TabWak:

  First, they operate in different spaces. TabWak is designed for the latent space, where reconstruction error is dominated by the autoencoder. In contrast, TimeWak operates directly in the real data space, where error stems from the diffusion inversion process itself. This critical difference motivates our use of a modified Bi-directional Integration Approximation (BDIA), which is specifically designed to minimize this diffusion inversion error and significantly improves detectability, as validated by our ablation study in Appendix E.5 (Table 12).

  Second, the original TabWak employs a self-cloning mechanism which copies half of the watermark seed, a method that perturbs the initial noise distribution. In contrast, our temporal chained-hashing mechanism is designed to better preserve the statistical properties of the initial noise, resulting in higher-quality synthetic data.

  Finally, TabWak verifies the watermark along the feature axis. Our analysis reveals that reconstruction error is unevenly distributed across features, which compromises detection reliability. By performing our chained-hashing along the more stable time axis, TimeWak directly mitigates the impact of this uneven error distribution, leading to demonstrably better watermark detectability.

• With BDIA:

  Standard BDIA assumes exact knowledge of $x_1$, which is unavailable in practical watermark detection. Our $\epsilon$-exact adaptation approximates $x_1 \approx x_0$, introducing controlled error bounds that standard BDIA cannot handle. Theorem 3.1 provides theoretical guarantees for this approximation. Our contribution quantifies how approximation errors propagate through the inversion process, enabling reliable watermark detection despite imperfect inversion.

  We generated 10,000 samples (length 64) across five datasets, computing $x_0$ and $x_1$. Results in Table A show consistently small $L_1$ norms between $x_1$ and $x_0$ (avg: 5.1-7.0e-03, max: <0.23), validating our $\epsilon$-exact approximation. These empirically small errors confirm Theorem 3.1's theoretical bounds and demonstrate reliable watermark detection despite the approximation.

Table A: $L_1$ norms between $x_1$ and $x_0$ for 64-length sequences over 10,000 samples.

[W2] Practicality in streaming/black-box settings.

[WA2] We acknowledge this limitation in the paper (Lines 308-311). While the current implementation uses fixed-length windows for simplicity, the core temporal chained-hashing mechanism is adaptable. For streaming data applications, it can be readily deployed using a sliding-window approach, where a fixed-length model generates watermarks for each temporal window. To evaluate the practical feasibility of real-time deployment, we measured the watermark detection overhead using a single NVIDIA L40S GPU and Intel(R) Xeon(R) Platinum 8562Y+ CPU. Table B presents the computational overhead for watermark detection across different datasets and configurations. The results demonstrate that detection overhead remains consistently low, ranging from approximately 1.5 to 7.5 seconds depending on the dataset complexity and batch size. We consider this overhead acceptable for streaming scenarios, particularly given the security benefits provided by the watermarking system. Adapting the hashing mechanism to handle variable-length sequences without padding represents a promising direction for future research that could further enhance the method's applicability to diverse real-world scenarios.

And TimeWak is designed for the standard "white-box" watermarking scenario where the entity generating the data also embeds the watermark for auditing and tracking purposes. In this setting, the model is fully accessible. The literature distinguishes this from "black-box" watermarking, where the watermark must be detected with only query access to the model. We acknowledge that a black-box detection scenario is a much more challenging problem that is out of the scope of this work.

Table B: Watermark detection overhead in seconds for TimeWak.

[W3/Q3] Explain TimeWak underperforms TabWak$^\top$ on fMRI dataset.

[WA3/QA3] For the fMRI dataset, increasing the interval length $H$ in TimeWak leads to higher Z-score while preserving the quality of the synthetic data and improving robustness, as shown in Tables C (full results in Table 14 in Appendix E.7.1) and D. This highlights that TimeWak can, in fact, perform exceptionally well on the fMRI dataset, especially when compared to other baselines.

Table C: Results of synthetic time series quality and watermark detectability for 64-length sequences. TimeWak is applied with interval length $H=8$.

Table D: Results of robustness against post-editing attacks for 64-length sequences. TimeWak is applied with interval length $H=8$.

To further evaluate TimeWak, we added two additional and more challenging real-world datasets: (i) the ILI dataset, which records influenza-like illness cases in the United States, and (ii) the Weather dataset, which is sparse and noisy. Both datasets are standard benchmarks used in TimesNet [8]. As shown in Table E, TimeWak demonstrates strong performance on these challenging datasets.

Table E: Results of synthetic time series quality and watermark detectability for 64-length sequences.

[W4/Q2] $\epsilon$-Exact inversion: Lipschitz continuity assumption.

[WA4/QA2] Thanks for point this point. This is a common assumption in the theoretical analysis of diffusion models/neural networks. Recent works have extensively studied the smoothness properties of diffusion models, providing theoretical guarantees for their stability and convergence under such assumptions [1-7]. While its validity in practice is an area of active research, we empirically validated this assumption in Appendix C (Figure 5, Lines 559-561), showing the Lipschitz constant is well-behaved for the models used. In this figure, we empirically computed $\Delta_{t}$ (Lipschitz constant) across four different datasets, using 10,000 samples from each. Specifically, $\Delta_{t}$ is calculated as the maximum ratio for different $t$ using the $L_1$ norm of the data samples. At the first timestep, the constant is relatively large, ranging from 28-80 for the four different datasets, and then the constant decreases to a value smaller than 1 as the timestep increases, which is also according to the observation from existing work [7].

Paper Formatting Concerns

[PFC1] Typo on line 34 "offerring".

[PFCA1] Thank you for pointing this out. We will fix it in the next version.

References

[1] Liang, Yingyu, et al. "Unraveling the smoothness properties of diffusion models: A gaussian mixture perspective." arXiv:2405.16418, 2024.

[2] Mooney, Connor, et al. "Global well-posedness and convergence analysis of score-based generative models via sharp Lipschitz estimates." ICLR, 2025.

[3] Conforti, Giovanni, Alain Durmus, and Marta Gentiloni Silveri. "KL convergence guarantees for score diffusion models under minimal data assumptions." SIAM Journal on Mathematics of Data Science 7.1 (2025): 86-109.

[4] Lim, Jae Hyun, et al. "Score-based diffusion models in function space." arXiv:2302.07400, 2023.

[5] Chen, Sitan, et al. "Sampling is as easy as learning the score: theory for diffusion models with minimal data assumptions." ICLR, 2023.

[6] Han, Yinbin, Meisam Razaviyayn, and Renyuan Xu. "Neural network-based score estimation in diffusion models: Optimization and generalization." ICLR, 2024.

[7] Yang, Zhantao, et al. "Lipschitz singularities in diffusion models." ICLR, 2024.

[8] Wu, Haixu, et al. "TimesNet: Temporal 2D-Variation Modeling for General Time Series Analysis." ICLR, 2023.

Thank you for your valuable comments and positive feedback.

Weaknesses

[W1] Rely on fixed-length intervals during seed chaining.

[WA1] We acknowledge this limitation in the paper (Lines 308-311). While the current implementation uses fixed-length windows for simplicity, the core mechanism of temporal chained hashing is inherently adaptable. For streaming data applications, it can be readily deployed using a sliding-window approach, where a model generating fixed-length output sequences embeds watermarks for each temporal window. To evaluate the practical feasibility of real-time deployment, we measured the watermark detection overhead using a single NVIDIA L40S GPU and Intel(R) Xeon(R) Platinum 8562Y+ CPU. Table A presents the computational overhead for watermark detection across different datasets and configurations. The results demonstrate that detection overhead remains consistently low, ranging from approximately 1.5 to 7.5 seconds depending on the dataset complexity and batch size. We consider this overhead acceptable for streaming scenarios, particularly given the security benefits provided by the watermarking system. Adapting the hashing mechanism to handle variable-length sequences without padding represents a promising direction for future research that could further enhance the method's applicability to diverse real-world scenarios.

Table A: Watermark detection overhead in seconds for TimeWak.

[W2] Compare with more recent or time series-specific watermarking methods.

[WA2] This is a valid point. We felt it was a necessary choice, as TimeWak's novelty is being the first time series generation watermarking scheme for diffusion models operating in data space, meaning there are no direct baselines for time series diffusion models. To make the evaluation more fair, we devised a two-part comparison strategy:

1. Against State-of-the-Art Watermarking Methods: We adapted the most prominent and recent watermarking methods from other domains. Tree-Ring [1] and Gaussian Shading [2] are state-of-the-art for image diffusion models, while TabWak [3] is the leading method for tabular data. By creating a stronger, time series-specific version of TabWak (TabWak$^\top$), we ensured the most rigorous comparison possible against the closest existing paradigms.

2. Against Time Series-Specific Methods: We also compared TimeWak against Heads-Tails Watermark (HTW) [4], a post-processing watermarking method designed specifically for time series. Our results consistently show that TimeWak provides significantly higher watermark detectability and robustness against attacks (Tables 1 & 2 in the paper) compared to HTW.

This comprehensive comparison demonstrates that TimeWak performs better than SotA watermarking methods adapted from other modalities and post-processing time series-specific watermarking methods.

References

[1] Wen, Yuxin, et al. "Tree-Rings Watermarks: Invisible Fingerprints for Diffusion Images." NeurIPS, 2023.

[2] Yang, Zijin, et al. "Gaussian Shading: Provable Performance-Lossless Image Watermarking for Diffusion Models." CVPR, 2024.

[3] Zhu, Chaoyi, et al. "TabWak: A Watermark for Tabular Diffusion Models." ICLR, 2025.

[4] N.J.I. van Schaik. "Robust Watermarking in Large Language Models for Time Series Generation." Thesis, Delft University of Technology, 2024.

Thank you for your valuable comments and positive feedback.

Weaknesses

[W1] Lack of formal security analysis.

[WA1] Thank you for raising this important point. We agree that conducting a formal security analysis against knowledgeable adversaries is a crucial next step for this research. In this paper, we also implemented and evaluated a reconstruction attack in Appendix E.2.2 based on the DiffPure [1]. In this attack scenario, we assume the adversary has direct access to the diffusion model and attempts to use it to perform reconstruction-based watermark removal. As demonstrated in Table 8, our watermarking scheme maintains robust performance even under this adversarial setting.

[W2] Test on more realistic scenarios, or when the data is used in downstream tasks.

[WA2] To address your concerns, we conducted the following additional experiments:

1. True positive rate evaluation in a mixed data setting
2. Evaluation on more downstream tasks

We constructed a mixed dataset containing equal proportions (1/3 each) of real data, synthetic data without watermarks, and synthetic data with watermarks, totaling 100 trials with a window length of 64. We evaluated TPR@0.1% FPR with 1, 10, and 20 samples per record, as shown in Table A. For comparison, we selected the methods with the best detectability: GS and TabWak$^\top$. The results demonstrate that TimeWak achieves 99-100% true positive rates in this mixed data setting when the number of samples is 20. But GS completely fails to detect watermarks in the MuJoCo dataset (0% TPR across all sample sizes), while TabWak$^\top$ fails on both MuJoCo (0% TPR) and Energy datasets (0-1% TPR).

Table A: Results of TPR@0.1% FPR on mixed dataset when number of samples are 1, 10, and 20.

Due to time limitations, we are unable to evaluate downstream tasks that involve human interpretation or decision-making. For instance, in a time series classification task, models are typically trained on labeled datasets. While our approach can generate large amounts of watermarked synthetic time series data, the corresponding labels for these synthetic sequences are not available, making it infeasible to use them directly for training in such tasks. Hence, for the downstream tasks evaluation, we assessed the utility of watermarked synthetic data on real-world forecasting and imputation tasks. Models were trained on different data types (real, synthetic without watermark, and synthetic with TimeWak watermark) and tested on real data.

Tables B and C show that synthetic data with our watermark achieves comparable MSE performance to non-watermarked synthetic data in both forecasting and imputation tasks, demonstrating that our watermarking method preserves data utility.

Table B: Results of time series forecasting that train on real and synthetic data and test on real data with a 24 timesteps forecast horizon. MSE values ($×10^{-3}$).

Table C: Results of time series imputation that train on real and synthetic data and test on real data with 70% missing ratio. MSE values ($×10^{-3}$).

[W3] Evaluate on challenging time series datasets.

[WA3] We initially considered the fMRI dataset as a realistic dataset, as it is high-dimensional, noisy, and has complex temporal dependencies. However, as you raise a valid point on realistic conditions, we evaluate TimeWak on 2 additional and more challenging real-world datasets, (i) the ILI dataset, which records influenza-like illness cases in the United States, and (ii) the Weather dataset, which is sparse and noisy. Both datasets are standard benchmarks, and are used in TimesNet [2]. Results run on these datasets are shown in Table D, where TimeWak achieves robust watermark detectability while preserving the quality of the synthetic data.

Table D: Results of synthetic time series quality and watermark detectability for 64-length sequences.

[W4] Evaluate how watermarking affects the preservation of key signal characteristics in time series data.

[WA4] Thanks for pointing this out. To assess the preservation of key signal characteristics, we added 4 additional metrics from TSGBench [3]: Marginal Distribution Difference (MDD), AutoCorrelation Difference (ACD), Skewness Difference (SD), and Kurtosis Difference (KD). These measures are designed to capture inter-series correlations and temporal dependencies, thereby evaluating how well the generated time series preserves the original characteristics. For all these metrics, the lower the score, the better. As shown in Table E, TimeWak consistently achieves scores very close to the non-watermarked (W/O) baseline across all datasets, indicating minimal distortion introduced by the watermark.

Table E: Results of 4 additional metrics for 64-length sequences.

References

[1] Nie, Weili, et al. "Diffusion models for adversarial purification." ICML, 2022.

[2] Wu, Haixu, et al. "TimesNet: Temporal 2D-Variation Modeling for General Time Series Analysis." ICLR, 2023.

[3] Ang, Yihao, et al. "TSGBench: Time Series Generation Benchmark." Proc. VLDB Endow. 17, 3 (2023), 305–318.