RaMark: Radioactive Watermarking for Generated Tabular Data
For practitioners needing to verify ownership of generated tabular data, RaMark solves the problem of watermark removal via retraining attacks, which existing methods fail to address.
RaMark introduces a radioactive watermarking method for generated tabular data that remains detectable even after an adversary retrains a generative model on watermarked data. Experiments on two real-world datasets with 10^5 data owners show it outperforms seven state-of-the-art methods against retraining and data modification attacks.
Recent advances in generative modeling have made generated tabular data a practical solution for privacy-sensitive data sharing, where watermarking enables ownership verification. However, existing watermarking methods fundamentally fail under retraining attacks, in which an adversary retrains a generative model on a watermarked dataset and regenerates high-utility data that no longer carries the watermark. We address this challenge by introducing radioactivity, the property that a watermark remains detectable after generative model retraining, and propose RaMark, a radioactive watermarking method that embeds a sinusoidal dependency as an intrinsic component of the data distribution. By coupling the watermark with the underlying distribution, RaMark ensures that any generative model preserving data utility also has to preserve the watermark. We theoretically show that with high probability removing watermark degrades utility and alters data distribution. Extensive experiments on two real-world tabular datasets, under a large-scale ownership verification setting with $10^5$ independent data owners, demonstrate that RaMark achieves substantially stronger radioactivity than seven state-of-the-art methods and consistently outperforms them against both retraining and data modification attacks.