Research map / Time series / Anomaly detection

A Locally Tokenized Generative Model for Robust Time-Series Watermarking

NeurIPS 2026 · Time series › Anomaly detection · approach: Multivariate anomaly detection · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes L-VQVAE, a locally tokenized VQ generative model for multivariate time series, and LVQMark, a logit-bias watermark with robust re-encoding, to stabilize false-positive behavior under post-editing attacks.

Problem

Watermark detectors for generated multivariate time series rely on globally coupled re-encoding, so post-editing attacks shift the null distribution of the detection z-score for non-watermarked samples, breaking clean-calibrated thresholds and causing false positives or anomalies.

Approach

Make each discrete token depend only on a bounded temporal window (local tokenizer sharing one codebook with a global decoder and AR transformer), then watermark via red-green logit bias with parity-alternating partitions and unbiased warm-up, and detect using a robust encoder trained with attack augmentation to recover clean token assignments.

Key results

• L-VQVAE with LVQMark keeps mean attacked non-watermarked z-score within [-0.25, +0.35] across all twelve dataset-attack configurations at 30% strength, with FPR <= 0.01 and TPR = 1.00 in eleven of twelve cases.
• Tree-Ring under crop yields mean z of +69.4 on Stocks and FPR 1.00, showing spurious false positives for globally coupled baselines.
• Robust encoder lifts L-VQVAE Crop detection from near 0 to 1.00 across datasets while preserving Offset and Insert detection.

Surprising findings

• Robust encoder degrades SDformer detection on fMRI, collapsing Offset from 1.00 to 0.05 and Insert from 1.00 to 0.03, suggesting attack-aware training alone is insufficient without local tokenization.
• Low FPR alone can mask bidirectional null drift: negative-side drift (e.g., Gaussian Shading z=-32.2 on fMRI) yields zero FPR while distorting the null.

Limitations

• Evaluation limited to four multivariate time-series datasets and three sequence lengths.
• Robustness assessed only under three post-editing attacks (offset, crop, insertion) at two strengths.
• Multi-stage training pipeline is more complex than single-stage baselines.

Experimental setup

Datasets: Stocks ETTh Energy fMRI

Benchmarks: Stocks ETTh Energy fMRI

Metrics: TPR FPR on attacked non-watermarked samples z-score Context-FID Correlational score Discriminative score Predictive score

Baselines: Tree-Ring Gaussian Shading TimeWak DiffusionTS TimeVQVAE SDformer

Builds on: KGW TimeWak TimeVQVAE SDformer VQ-VAE

Closest papers by meaning

• Watermarking Autoregressive Image Generation (NeurIPS 2025 · similarity 0.89)
• TimeWak: Temporal Chained-Hashing Watermark for Time Series Data (NeurIPS 2025 · similarity 0.88)
• Watermarks in the Sand: Impossibility of Strong Watermarking for Language Models (ICML 2024 · similarity 0.88)
• Robust Watermarking Using Generative Priors Against Image Editing: From Benchmarking to Advances (ICLR 2025 · similarity 0.87)
• Watermarking Makes Language Models Radioactive (NeurIPS 2024 · similarity 0.87)
• BitMark: Watermarking Bitwise Autoregressive Image Generative Models (NeurIPS 2025 · similarity 0.87)