发表机构
McMaster University; York University; Duke University（麦斯特大学; 约克大学; 杜克大学）
机构由 AI 辅助整理，请以论文原文为准。AI 中文总结
针对生成表格数据水印在再训练攻击下失效的问题，提出RaMark方法，通过引入放射性，嵌入正弦依赖作为数据分布内在部分，理论证明去水印会降实用性改数据分布，实验表明该方法放射性强，在多种攻击下表现优于七种先进方法。
AI 中文摘要
生成式建模的进展使生成表格数据成为隐私敏感数据共享的实用方案，水印可用于所有权验证。但现有水印方法在再训练攻击下失效，对手重新训练生成模型后，生成的高实用性数据不再携带水印。我们引入放射性（水印在生成模型再训练后仍可检测）并提出RaMark方法，嵌入正弦依赖作为数据分布的内在组成部分。理论表明去除水印会降低实用性并改变数据分布。实验表明RaMark比七种先进方法有更强放射性，在再训练和数据修改攻击下表现更优。
英文摘要
Recent advances in generative modeling have made generated tabular data a practical solution for privacy-sensitive data sharing, where watermarking enables ownership verification. However, existing watermarking methods fundamentally fail under retraining attacks, in which an adversary retrains a generative model on a watermarked dataset and regenerates high-utility data that no longer carries the watermark. We address this challenge by introducing radioactivity, the property that a watermark remains detectable after generative model retraining, and propose RaMark, a radioactive watermarking method that embeds a sinusoidal dependency as an intrinsic component of the data distribution. By coupling the watermark with the underlying distribution, RaMark ensures that any generative model preserving data utility also has to preserve the watermark. We theoretically show that with high probability removing watermark degrades utility and alters data distribution. Extensive experiments on two real-world tabular datasets, under a large-scale ownership verification setting with $10^5$ independent data owners, demonstrate that RaMark achieves substantially stronger radioactivity than seven state-of-the-art methods and consistently outperforms them against both retraining and data modification attacks.
