TimeWak: Temporal Chained-Hashing Watermark for Time Series Data

TL;DR

TimeWak is a novel watermarking method designed for multivariate time series generated by diffusion models, enabling data source verification without compromising data utility or privacy.

Contribution

It introduces the first data-space watermarking algorithm for time series diffusion models, handling temporal dependencies and feature heterogeneity with a novel chained-hashing approach.

Findings

Achieves 61.96% improvement in context-FID score.

Improves correlational scores by 8.44%.

Maintains high detectability under various attacks.

Abstract

Synthetic time series generated by diffusion models enable sharing privacy-sensitive datasets, such as patients' functional MRI records. Key criteria for synthetic data include high data utility and traceability to verify the data source. Recent watermarking methods embed in homogeneous latent spaces, but state-of-the-art time series generators operate in data space, making latent-based watermarking incompatible. This creates the challenge of watermarking directly in data space while handling feature heterogeneity and temporal dependencies. We propose TimeWak, the first watermarking algorithm for multivariate time series diffusion models. To handle temporal dependence and spatial heterogeneity, TimeWak embeds a temporal chained-hashing watermark directly within the temporal-feature data space. The other unique feature is the $\epsilon$-exact inversion, which addresses the non-uniform reconstruction error distribution across features from inverting the diffusion process to detect watermarks. We derive the error bound of inverting multivariate time series while preserving robust watermark detectability. We extensively evaluate TimeWak on its impact on synthetic data quality, watermark detectability, and robustness under various post-editing attacks, against five datasets and baselines of different temporal lengths. Our results show that TimeWak achieves improvements of 61.96% in context-FID score, and 8.44% in correlational scores against the strongest state-of-the-art baseline, while remaining consistently detectable.