A Locally Tokenized Generative Model for Robust Time-Series Watermarking

# A Locally Tokenized Generative Model for Robust Time-Series Watermarking
Source: [https://arxiv.org/html/2608.19727](https://arxiv.org/html/2608.19727)
Geonwoo ShinAffiliation:Nanyang Technological University\[1ex\]\{dongbin413,shin0621,uznhigh,soyeon2,jaewook\}@snu\.ac\.krYujin ChoiSoyeon ParkAffiliation:\[1ex\] Seoul National UniversityJaewook Lee

###### Abstract

Watermarking is a central tool for provenance in generative models, yet its application to multivariate time series remains hindered by reliability failures under post\-editing attacks\. We show that existing detectors, which rely on globally coupled re\-encoding, suffer from bidirectional drift of the null distribution: post\-editing attacks can shift the z\-score of non\-watermarked samples in either direction, invalidating clean\-calibrated thresholds\. We argue that this instability is a property of the re\-encoding, and that reliable detection requires each recovered unit to depend only on a bounded temporal neighborhood\. Guided by this principle, we propose L\-VQVAE, a generative model in which each discrete token is produced from a short contiguous window, and LVQMark, a watermarking method over this token space that combines logit\-bias injection with robust re\-encoding for attack\-time detection\. Experiments on four benchmarks spanning finance, energy, and neuroimaging show that our approach preserves generation quality while stabilizing both detection power and false\-positive behavior under post\-editing attacks\.

11footnotetext:Equal contribution\.22footnotetext:Corresponding author\.## 1Introduction

Reliable provenance verification is essential as generative models increasingly produce high\-quality synthetic data\[[2](https://arxiv.org/html/2608.19727#bib.bib22),[14](https://arxiv.org/html/2608.19727#bib.bib23),[24](https://arxiv.org/html/2608.19727#bib.bib5)\]\. Among existing approaches—provenance metadata, forensic detection, model fingerprinting, and watermarking\[[5](https://arxiv.org/html/2608.19727#bib.bib26),[13](https://arxiv.org/html/2608.19727#bib.bib25),[23](https://arxiv.org/html/2608.19727#bib.bib24)\]—generation\-time watermarking is particularly suited to synthetic time series\[[9](https://arxiv.org/html/2608.19727#bib.bib3),[17](https://arxiv.org/html/2608.19727#bib.bib4)\]: it embeds verification signals during sampling, requires no retraining or external metadata, and remains detectable under downstream transformations\[[19](https://arxiv.org/html/2608.19727#bib.bib10),[21](https://arxiv.org/html/2608.19727#bib.bib11)\]\.

Despite these advances, most watermarking methods assess robustness through detectability of watermarked samples after post\-editing attack, typically reporting true positive rate \(TPR\) at a fixed false positive rate \(FPR\) \(TPR@X%FPR\) calibrated on clean negative samples\[[26](https://arxiv.org/html/2608.19727#bib.bib17),[19](https://arxiv.org/html/2608.19727#bib.bib10),[17](https://arxiv.org/html/2608.19727#bib.bib4),[15](https://arxiv.org/html/2608.19727#bib.bib20)\]\. Yet for provenance verification, false positives are also critical: attacked non\-watermarked samples may be misdetected as watermarked, leading to erroneous attribution and reduced reliability of the provenance guarantee\. While recent image watermarking and forgery\-aware studies discuss such false\-attribution risks\[[12](https://arxiv.org/html/2608.19727#bib.bib9),[1](https://arxiv.org/html/2608.19727#bib.bib8)\], they remain largely unexplored in time\-series watermarking\.

We address this gap by enforcing*locality*in the recovered token representation\. We first introduceL\-VQVAE, a generative model for multivariate time series in which each discrete token is recovered from a bounded temporal neighborhood of the observed signal, rather than through global inversion\. L\-VQVAE comprises a local tokenizer, a global decoder, and an autoregressive transformer, all sharing a single codebook\. We then buildLVQMark, a generation\-time watermarking method designed over this locally recoverable token interface: it embeds a red–green logit bias during autoregressive sampling, where green\-set tokens receive a positive sampling bias at each position, and introduces a robust encoder that maps attacked continuous signals back to their clean token assignments for detection\. Because generation, insertion, and detection are all defined over the same locally recoverable token representation, perturbations affect only a bounded subset of recovered evidence, preserving both detection power and false\-positive control\.

We evaluate LVQMark on four time\-series datasets under varying sequence lengths and post\-editing attacks\. Experiments show that LVQMark preserves high generation quality while achieving robust watermark detection and stable false\-positive behavior on attacked non\-watermarked samples\.

Our main contributions are summarized as follows:

- •We formulate false\-positive reliability in time\-series watermarking as a*re\-encoding stability*problem\. We show that when the re\-encoding map is globally coupled, post\-editing attacks can shift the null distribution of the detection statistic for non\-watermarked samples, invalidating clean\-calibrated thresholds\.
- •We introduce L\-VQVAE, a generative model for multivariate time series in which each token depends only on a short temporal neighborhood, preventing perturbations from inducing global drift in the recovered representation\.
- •We build LVQMark, a generation\-time watermarking method over the L\-VQVAE token space, combining red–green logit\-bias insertion with scheduling modifications tailored to L\-VQVAE and robust re\-encoding for attack\-time detection\.

## 2Watermarking in Time Series and Robustness

##### Generalized detection framework\.

Generation\-time watermarks\[[9](https://arxiv.org/html/2608.19727#bib.bib3),[7](https://arxiv.org/html/2608.19727#bib.bib27),[17](https://arxiv.org/html/2608.19727#bib.bib4)\]share a common statistical template\. Let𝐱∈ℝT×D\\mathbf\{x\}\\in\\mathbb\{R\}^\{T\\times D\}denote an observed sample, let𝒳\\mathcal\{X\}denote the space of recovered units \(e\.g\. a finite codebook index set\), and letΦ⁡\(𝐱\)∈𝒳N\\Phi\(\\mathbf\{x\}\)\\in\\mathcal\{X\}^\{N\}denote the internal representation recovered by the detector\. For each positionn∈\{1,…,N\}n\\in\\\{1,\\dots,N\\\}, a secret keyκ\\kappaspecifies a position\-wise target region𝒯n⊂𝒳\\mathcal\{T\}\_\{n\}\\subset\\mathcal\{X\}\. Under the null hypothesisH0H\_\{0\}, the recovered units\{Φ​\(𝐱\)n\}n=1N\\\{\\Phi\(\\mathbf\{x\}\)\_\{n\}\\\}\_\{n=1\}^\{N\}are independent across positions and each lies in𝒯n\\mathcal\{T\}\_\{n\}with probabilityμ0\\mu\_\{0\}; watermarking biases the generative process so that this event occurs more frequently\. The detector computes the agreement rate and its standardized score

g^\(𝐱\)=1N∑n=1N\[Φ\(𝐱\)n∈𝒯n\],z\(𝐱\)=g^​\(𝐱\)−μ0σ0,σ0=μ0​\(1−μ0\)N,\\hat\{g\}\(\\mathbf\{x\}\)=\\frac\{1\}\{N\}\\sum\_\{n=1\}^\{N\}\\mathbbm\{1\}\\\!\\left\[\\Phi\(\\mathbf\{x\}\)\_\{n\}\\in\\mathcal\{T\}\_\{n\}\\right\],\\qquad z\(\\mathbf\{x\}\)=\\frac\{\\hat\{g\}\(\\mathbf\{x\}\)\-\\mu\_\{0\}\}\{\\sigma\_\{0\}\},\\qquad\\sigma\_\{0\}=\\sqrt\{\\tfrac\{\\mu\_\{0\}\(1\-\\mu\_\{0\}\)\}\{N\}\},\(1\)and declares𝐱\\mathbf\{x\}watermarked wheneverz⁡\(𝐱\)\>ηz\(\\mathbf\{x\}\)\>\\etafor a fixed thresholdη\>0\\eta\>0\. In the balanced setting considered throughout this paper,μ0=1/2\\mu\_\{0\}=1/2, so thatσ0=12​N\\sigma\_\{0\}=\\tfrac\{1\}\{2\\sqrt\{N\}\}\. This formulation subsumes both token\-level generation\-time watermarks for language models, such as KGW\[[9](https://arxiv.org/html/2608.19727#bib.bib3)\], and time\-series methods such as TimeWak\[[17](https://arxiv.org/html/2608.19727#bib.bib4)\]: although these approaches adopt different choices of the recovered representationΦ\\Phiand target regions𝒯n\\mathcal\{T\}\_\{n\}, they share an identical statistical structure\.

##### Red\-green watermarking and time\-series departure\.

KGW\[[9](https://arxiv.org/html/2608.19727#bib.bib3)\]recoversΦ⁡\(𝐱\)\\Phi\(\\mathbf\{x\}\)trivially from the observed token sequence: detection simply reproduces the green listGnG\_\{n\}from the secret seedκ\\kappaand applies Equation \([1](https://arxiv.org/html/2608.19727#S2.E1)\) directly\. Time\-series watermarking\[[17](https://arxiv.org/html/2608.19727#bib.bib4)\]adheres to the same statistical logic but departs in one essential respect: the detector must first re\-encode the continuous signal intoΦ⁡\(𝐱\)\\Phi\(\\mathbf\{x\}\)\. This re\-encoding step is benign under clean conditions, but, as we show next, becomes the primary source of robustness degradation under post\-editing attacks\.

Table 1:Intended interpretation ofzzunder a clean\-calibrated detector\. The validity of this interpretation requires re\-encoding stability ofΦ\\Phiunder the attack family; in its absence, null drift bidirectionally invalidates the threshold\.z≫0z\\gg 0z≈0z\\approx 0z≪0z\\ll 0WatermarkedCorrect detectionMissStatistical anomalyNon\-watermarkedFalse positiveCorrect rejectionStatistical anomaly
##### Re\-encoding stability\.

To formalize this failure mode, we call a re\-encoding mapΦ\\Phi*stable*under an attack familyℱ\\mathcal\{F\}when, for every non\-watermarked𝐱\\mathbf\{x\}and every𝒜∈ℱ\\mathcal\{A\}\\in\\mathcal\{F\}, the distribution ofΦ⁡\(𝒜⁡\(𝐱\)\)\\Phi\(\\mathcal\{A\}\(\\mathbf\{x\}\)\)stays close to that ofΦ⁡\(𝐱\)\\Phi\(\\mathbf\{x\}\), keeping𝔼ℋ0​\[g^​\(𝒜​\(𝐱\)\)\]\\mathbb\{E\}\_\{\\mathcal\{H\}\_\{0\}\}\[\\hat\{g\}\(\\mathcal\{A\}\(\\mathbf\{x\}\)\)\]nearμ0\\mu\_\{0\}\. We refer to violations of this property as*re\-encoding instability*\. Its observable symptom is the drift of𝔼​\[g^​\(𝒜​\(𝐱\)\)\]\\mathbb\{E\}\[\\hat\{g\}\(\\mathcal\{A\}\(\\mathbf\{x\}\)\)\]away fromμ0\\mu\_\{0\}on non\-watermarked samples, which we call*null drift*\. We refer to the property that the clean\-calibrated threshold continues to control the FPR under attack as*false\-positive reliability*\. Under this view, false\-positive reliability is a direct consequence of re\-encoding stability\.

##### Bidirectional null drift under post\-editing attacks\.

Existing methods fail to satisfy this property\. As Figure[1](https://arxiv.org/html/2608.19727#S2.F1)illustrates on a representative method and Table[12](https://arxiv.org/html/2608.19727#A4.T12)confirms across baselines,g^\\hat\{g\}concentrates nearμ0=1/2\\mu\_\{0\}=1/2in the clean setting \(as Equation \([1](https://arxiv.org/html/2608.19727#S2.E1)\) requires\) but drifts away under attack in a method\- and attack\-dependent manner\. Since the drift direction is governed by the interaction betweenΦ\\Phiand𝒜\\mathcal\{A\}rather than by the watermark, attacks can either trigger false positives \(z≫0z\\gg 0\) or induce severe*statistical anomalies*\(z≪0z\\ll 0\), and the clean\-calibrated threshold loses its intended meaning under both regimes of Table[1](https://arxiv.org/html/2608.19727#S2.T1)\.

##### A representation\-level interpretation\.

We attribute null drift toΦ\\Phirather than to the statistic itself: existing methods instantiateΦ\\Phithrough*globally coupled*computations, where each recovered position depends on essentially every time step of𝐱\\mathbf\{x\}, so a localized perturbation propagates to every position\. We address this in Section[3](https://arxiv.org/html/2608.19727#S3)by making each unit ofΦ\\Phidepend only on a bounded temporal neighborhood—a property we call*locality*—confining attacks to a bounded subset of recovered units\.

![Refer to caption](https://arxiv.org/html/2608.19727v1/greenred_visualization_stocks128.png)\(a\)Recovered green/red assignments\.
\(b\)zz\-score distributions\.
Figure 1:Bidirectional drift of the null on*non\-watermarked*samples \(TimeWak\[[17](https://arxiv.org/html/2608.19727#bib.bib4)\], Stocks\)\. Crop and insert push the recovered tokens \(a\) and the resultingzz\-score \(b\) in opposite directions, with insert crossing the clean\-calibrated threshold and yielding an85%85\\%false\-positive rate\.

## 3Proposed Method

Motivated by the observation that globally coupled representations propagate post\-editing attacks beyond the attacked region, we design a generative model with a deliberately*local*internal representation \(L\-VQVAE\) and a watermarking method that exploits this locality \(LVQMark\)\. A schematic is shown in Figure[2](https://arxiv.org/html/2608.19727#S3.F2)\.

### 3\.1L\-VQVAE: Locally Tokenized Generative Model

L\-VQVAE generates multivariate time series through three stages: a local tokenizer encodes each short temporal window into a discrete codebook entry, a global decoder reconstructs a full time series from the resulting token sequence, and an autoregressive transformer models the distribution over token sequences for sampling\.

#### 3\.1\.1Local Tokenization

![Refer to caption](https://arxiv.org/html/2608.19727v1/framework.png)Figure 2:Overview of L\-VQVAE and LVQMark\.\(a\)The local tokenizer encodes each temporal window into a discrete VQ token\.\(b\)The global decoder reconstructs the time series from the token sequence\.\(c\)An autoregressive transformer models the token distribution\.\(d\)Watermark injection via scheduled logit bias with alternating partition and unbiased warm\-up\.\(e\)Robust detection via token re\-encoding, whereEρ∗E\_\{\\rho\}^\{\*\}recovers clean token assignments from the attacked signal for the green\-ratio test\.Let𝐱∈ℝT×D\\mathbf\{x\}\\in\\mathbb\{R\}^\{T\\times D\}denote a multivariate time series withTTtime steps andDDvariables\. The local tokenizer produces a discrete token sequence𝐬=\(s1,…,sN\)∈\{1,…,K\}N\\mathbf\{s\}=\(s\_\{1\},\\dots,s\_\{N\}\)\\in\\\{1,\\dots,K\\\}^\{N\}from𝐱\\mathbf\{x\}in three steps: sliding\-window decomposition, per\-window summarization, and vector quantization against a shared codebook𝒞=\{𝐞k\}k=1K\\mathcal\{C\}=\\\{\\mathbf\{e\}\_\{k\}\\\}\_\{k=1\}^\{K\}\.

##### Sliding\-window decomposition\.

We partition𝐱\\mathbf\{x\}into overlapping local windows with receptive fieldRRand stridess\(withsschosen so that\(T−R\)/s\(T\-R\)/sis an integer\):

𝐰n=𝐱tn\+1:tn\+R∈ℝR×D,tn=\(n−1\)s,n=1,…,N,\\mathbf\{w\}\_\{n\}=\\mathbf\{x\}\_\{t\_\{n\}\+1:\\,t\_\{n\}\+R\}\\in\\mathbb\{R\}^\{R\\times D\},\\qquad t\_\{n\}=\(n\-1\)\\,s,\\qquad n=1,\\dots,N,\(2\)whereN=\(T−R\)/s\+1N=\(T\-R\)/s\+1is the number of windows\. By construction,𝐰n\\mathbf\{w\}\_\{n\}depends only on the time steps within\[tn\+1,tn\+R\]\[t\_\{n\}\+1,\\,t\_\{n\}\+R\], so a temporal post\-editing attack overlaps at most⌈R/s⌉\+1\\lceil R/s\\rceil\+1consecutive windows and can therefore alter at most that many tokens downstream\.

##### Window summarization and quantization\.

Each window is summarized into a single latent vector by a shared cross\-attention encoderEϕE\_\{\\phi\}and then quantized against the codebook\. We linearly project𝐰n\\mathbf\{w\}\_\{n\}to dimensionddand add learnable positional embeddings𝐏∈ℝR×d\\mathbf\{P\}\\in\\mathbb\{R\}^\{R\\times d\}\(shared across windows\) to obtain𝐇n∈ℝR×d\\mathbf\{H\}\_\{n\}\\in\\mathbb\{R\}^\{R\\times d\}\. A single learnable query vector𝐪0∈ℝ1×d\\mathbf\{q\}\_\{0\}\\in\\mathbb\{R\}^\{1\\times d\}, shared across all windows, is then refined by a stack ofLLcross\-attention blocks: forℓ=1,…,L\\ell=1,\\dots,L,

𝐪~n\(ℓ\)\\displaystyle\\tilde\{\\mathbf\{q\}\}^\{\(\\ell\)\}\_\{n\}=LN⁡\(𝐪n\(ℓ−1\)\+CrossAttn⁡\(𝐪n\(ℓ−1\),𝐇n,𝐇n\)\),\\displaystyle=\\mathrm\{LN\}\\\!\\left\(\\mathbf\{q\}^\{\(\\ell\-1\)\}\_\{n\}\+\\mathrm\{CrossAttn\}\(\\mathbf\{q\}^\{\(\\ell\-1\)\}\_\{n\},\\mathbf\{H\}\_\{n\},\\mathbf\{H\}\_\{n\}\)\\right\),\(3\)𝐪n\(ℓ\)\\displaystyle\\mathbf\{q\}^\{\(\\ell\)\}\_\{n\}=LN⁡\(𝐪~n\(ℓ\)\+FFN⁡\(𝐪~n\(ℓ\)\)\),\\displaystyle=\\mathrm\{LN\}\\\!\\left\(\\tilde\{\\mathbf\{q\}\}^\{\(\\ell\)\}\_\{n\}\+\\mathrm\{FFN\}\(\\tilde\{\\mathbf\{q\}\}^\{\(\\ell\)\}\_\{n\}\)\\right\),\(4\)with𝐪n\(0\)=𝐪0\\mathbf\{q\}^\{\(0\)\}\_\{n\}=\\mathbf\{q\}\_\{0\}for allnn\. The output𝐪n\(L\)∈ℝ1×d\\mathbf\{q\}^\{\(L\)\}\_\{n\}\\in\\mathbb\{R\}^\{1\\times d\}is squeezed and linearly projected to obtain the window latentEϕ​\(𝐰n\)∈ℝdcE\_\{\\phi\}\(\\mathbf\{w\}\_\{n\}\)\\in\\mathbb\{R\}^\{d\_\{c\}\}, which is mapped to its nearest codebook entry:

sn=arg⁡mink∈\{1,…,K\}⁡‖Eϕ​\(𝐰n\)−𝐞k‖22,𝐳nq=𝐞sn,s\_\{n\}=\\arg\\min\_\{k\\in\\\{1,\\dots,K\\\}\}\\\|E\_\{\\phi\}\(\\mathbf\{w\}\_\{n\}\)\-\\mathbf\{e\}\_\{k\}\\\|\_\{2\}^\{2\},\\qquad\\mathbf\{z\}^\{q\}\_\{n\}=\\mathbf\{e\}\_\{s\_\{n\}\},\(5\)with gradients propagated through thearg⁡min\\arg\\minby the straight\-through estimator\[[18](https://arxiv.org/html/2608.19727#bib.bib6)\]\. Because keys and values are derived exclusively from𝐰n\\mathbf\{w\}\_\{n\}, any post\-editing attack of𝐱\\mathbf\{x\}that does not overlap𝐰n\\mathbf\{w\}\_\{n\}leavesEϕ​\(𝐰n\)E\_\{\\phi\}\(\\mathbf\{w\}\_\{n\}\)andsns\_\{n\}unchanged\. For brevity, we write𝐳n:=Eϕ​\(𝐰n\)\\mathbf\{z\}\_\{n\}:=E\_\{\\phi\}\(\\mathbf\{w\}\_\{n\}\)for the continuous \(pre\-quantization\) encoding of window𝐰n\\mathbf\{w\}\_\{n\}, and𝐳nq\\mathbf\{z\}^\{q\}\_\{n\}for its quantized counterpart\.

##### Local pretraining\.

Training\(Eϕ,𝒞\)\(E\_\{\\phi\},\\mathcal\{C\}\)jointly with the global decoder from scratch leads to poor codebook utilization: the global decoder can compensate for inaccurate codes by drawing on neighboring tokens, weakening the gradient signal to the codebook and undermining the per\-token locality on which detection\-time recovery relies\. We therefore first pretrain\(Eϕ,𝒞\)\(E\_\{\\phi\},\\mathcal\{C\}\)together with a*local*decoderDψ~locD^\{\\mathrm\{loc\}\}\_\{\\tilde\{\\psi\}\}that reconstructs𝐰n\\mathbf\{w\}\_\{n\}from the single code𝐳nq\\mathbf\{z\}^\{q\}\_\{n\}alone\. The encoder and local decoder are trained by minimizing

ℒVQ=𝔼n​\[‖𝐰n−Dψ~loc​\(𝐳nq\)‖22⏟reconstruction\+β​‖𝐳n−sg⁡\[𝐳nq\]‖22⏟commitment\],\\mathcal\{L\}\_\{\\text\{VQ\}\}=\\mathbb\{E\}\_\{n\}\\\!\\left\[\\,\\underbrace\{\\\|\\mathbf\{w\}\_\{n\}\-D^\{\\mathrm\{loc\}\}\_\{\\tilde\{\\psi\}\}\(\\mathbf\{z\}^\{q\}\_\{n\}\)\\\|\_\{2\}^\{2\}\}\_\{\\text\{reconstruction\}\}\\;\+\\;\\beta\\underbrace\{\\\|\\mathbf\{z\}\_\{n\}\-\\mathrm\{sg\}\[\\mathbf\{z\}^\{q\}\_\{n\}\]\\\|\_\{2\}^\{2\}\}\_\{\\text\{commitment\}\}\\,\\right\],\(6\)wheresg⁡\[⋅\]\\mathrm\{sg\}\[\\cdot\]denotes the stop\-gradient operator and𝐳n=Eϕ​\(𝐰n\)\\mathbf\{z\}\_\{n\}=E\_\{\\phi\}\(\\mathbf\{w\}\_\{n\}\)\. The codebook entries\{𝐞k\}k=1K\\\{\\mathbf\{e\}\_\{k\}\\\}\_\{k=1\}^\{K\}are not updated by gradient descent; instead, each𝐞k\\mathbf\{e\}\_\{k\}is maintained as an exponential moving average of the encoder outputs𝐳n\\mathbf\{z\}\_\{n\}\. Under this local bottleneck, each code must fully describe its window without relying on neighboring context\. After pretraining,Dψ~locD^\{\\mathrm\{loc\}\}\_\{\\tilde\{\\psi\}\}is discarded, and\(Eϕ,𝒞\)\(E\_\{\\phi\},\\mathcal\{C\}\)are frozen for the subsequent training of the global decoder\.

#### 3\.1\.2Global Decoder and Autoregressive Transformer

Locality is imposed only on the encoding side, which is the sole component re\-executed at detection time and therefore exposed to post\-editing attacks\. Since the decoder and AR Transformer are invoked only during generation, they need not be local and can model long\-range dependencies without compromising robustness\.

##### Global decoder\.

The decoderGψG\_\{\\psi\}maps the full token sequence to a time series in a single forward pass\. Let𝐄∈ℝN×d\\mathbf\{E\}\\in\\mathbb\{R\}^\{N\\times d\}denote the embedded token sequence with positional embeddings, and let𝐐t∈ℝT×d\\mathbf\{Q\}\_\{t\}\\in\\mathbb\{R\}^\{T\\times d\}be a learnable set of time\-step queries\. A stack of cross\-attention blocks updates𝐐t\\mathbf\{Q\}\_\{t\}using𝐄\\mathbf\{E\}as keys and values,

𝐐t←LN⁡\(𝐐t\+CrossAttn⁡\(𝐐t,𝐄,𝐄\)\),𝐐t←LN⁡\(𝐐t\+FFN⁡\(𝐐t\)\),\\mathbf\{Q\}\_\{t\}\\leftarrow\\mathrm\{LN\}\(\\mathbf\{Q\}\_\{t\}\+\\mathrm\{CrossAttn\}\(\\mathbf\{Q\}\_\{t\},\\mathbf\{E\},\\mathbf\{E\}\)\),\\qquad\\mathbf\{Q\}\_\{t\}\\leftarrow\\mathrm\{LN\}\(\\mathbf\{Q\}\_\{t\}\+\\mathrm\{FFN\}\(\\mathbf\{Q\}\_\{t\}\)\),\(7\)and a linear projection yields𝐱^=Gψ​\(𝐬\)∈ℝT×D\\hat\{\\mathbf\{x\}\}=G\_\{\\psi\}\(\\mathbf\{s\}\)\\in\\mathbb\{R\}^\{T\\times D\}\.GψG\_\{\\psi\}is trained withEϕE\_\{\\phi\}and the codebook frozen, underℒdec=‖𝐱−Gψ​\(𝐬⁡\(𝐱\)\)‖22\\mathcal\{L\}\_\{\\text\{dec\}\}=\\\|\\mathbf\{x\}\-G\_\{\\psi\}\(\\mathbf\{s\}\(\\mathbf\{x\}\)\)\\\|\_\{2\}^\{2\}\.

##### Autoregressive Transformer\.

The token sequence is modeled by a decoder\-only autoregressive transformer,pθ​\(𝐬\)=∏n=1Npθ​\(sn∣s<n\)p\_\{\\theta\}\(\\mathbf\{s\}\)=\\prod\_\{n=1\}^\{N\}p\_\{\\theta\}\(s\_\{n\}\\mid s\_\{<n\}\), trained with next\-token cross\-entropy\. Causal self\-attention is restricted to a fixed lookback window, consistent with the locality principle of the tokenizer\. Together, the local tokenizer, the global decoder, and the autoregressive transformer constitute L\-VQVAE as a standalone generative model: sampling frompθp\_\{\\theta\}and decoding throughGψG\_\{\\psi\}produces a synthetic time series without any watermark\.

### 3\.2LVQMark: Watermarking over Local VQ Tokens

LVQMark embeds a watermark into the L\-VQVAE generation process by biasing the autoregressive sampling step, and provides a detection mechanism based on robust re\-encoding\.

#### 3\.2\.1Watermark Injection via Scheduled Logit Bias

##### Logit\-bias watermarking\.

At each autoregressive positionnn, a secret seedκ\\kappapartitions the codebook𝒱=\{1,…,K\}\\mathcal\{V\}=\\\{1,\\dots,K\\\}into a green subsetGn⊆𝒱G\_\{n\}\\subseteq\\mathcal\{V\}and its complementary red subsetRn=𝒱∖GnR\_\{n\}=\\mathcal\{V\}\\setminus G\_\{n\}, with\|Gn\|=\|Rn\|=K/2\|G\_\{n\}\|=\|R\_\{n\}\|=K/2\. Letℓn∈ℝK\\boldsymbol\{\\ell\}\_\{n\}\\in\\mathbb\{R\}^\{K\}denote the logits produced by the autoregressive transformer at positionnn\. A positive biasδ\>0\\delta\>0is added to the logits of green tokens before sampling:

ℓ~n,k=ℓn,k\+δ1\[k∈Gn\],sn∼Categorical\(softmax\(ℓ~n\)\),\\tilde\{\\ell\}\_\{n,k\}=\\ell\_\{n,k\}\+\\delta\\,\\mathbbm\{1\}\[k\\in G\_\{n\}\],\\qquad s\_\{n\}\\sim\\mathrm\{Categorical\}\(\\mathrm\{softmax\}\(\\tilde\{\\boldsymbol\{\\ell\}\}\_\{n\}\)\),\(8\)This adapts the red–green scheme of KGW\[[9](https://arxiv.org/html/2608.19727#bib.bib3)\]\(Section[2](https://arxiv.org/html/2608.19727#S2)\) to the L\-VQVAE codebook\. At detection time, the observed time series is re\-encoded into tokens by the robust encoderEρ⋆E\_\{\\rho\}^\{\\star\}\(Section[3\.2\.2](https://arxiv.org/html/2608.19727#S3.SS2.SSS2)\), the green sets\{Gn\}\\\{G\_\{n\}\\\}are reconstructed from the same seedκ\\kappa, and the green\-ratio test of Section[2](https://arxiv.org/html/2608.19727#S2)is applied with target regions𝒯n=Gn\\mathcal\{T\}\_\{n\}=G\_\{n\}\.

##### Context\-independent partition\.

In KGW for language models, the green setGnG\_\{n\}typically depends on the preceding tokensn−1s\_\{n\-1\}, which diversifies the partition across positions\. We instead fix the partition independently of the recovered token context\. The reason is locality: ifGnG\_\{n\}depended on recovered tokens, a single re\-encoding error at positionnnwould propagate to the partition at positionn\+1n\{\+\}1, coupling re\-encoding instability with watermark scheduling\. A context\-independent rule confines each re\-encoding error to the position where it occurs\.

##### Failure modes of a naïve fixed partition\.

A context\-independent partition interacts with two structural properties of L\-VQVAE token sequences\. First, adjacent windows largely overlap, so the AR Transformer frequently emits runs of the same token; a position\-invariantGnG\_\{n\}then applies\+δ\+\\deltauniformly across the run, driving the green ratio toward11or00regardless of watermark presence \(*bias accumulation*\)\. Second, at the first few autoregressive steps the context is empty and logits are nearly uniform, so a fixedδ\\deltacauses near\-deterministic selection of the same green token, producing a stereotyped prefix that conditions all subsequent steps \(*bias dominance*\)\.

##### Alternating partition\.

To address bias accumulation, we make the partition depend on position parity\. LetG\(0\)⊂𝒱G^\{\(0\)\}\\subset\\mathcal\{V\}be a fixed green set determined by the secret seedκ\\kappa, with\|G\(0\)\|=K/2\|G^\{\(0\)\}\|=K/2, and define

Gn=\{G\(0\),n​even,𝒱∖G\(0\),n​odd,Rn=𝒱∖Gn\.G\_\{n\}=\\begin\{cases\}G^\{\(0\)\},&n\\text\{ even\},\\\\ \\mathcal\{V\}\\setminus G^\{\(0\)\},&n\\text\{ odd\},\\end\{cases\}\\qquad R\_\{n\}=\\mathcal\{V\}\\setminus G\_\{n\}\.\(9\)Under this rule, a tokenkkis biased \(\+δ\+\\delta\) at one parity and unbiased at the other\. Consequently, when the autoregressive model emits a run of identical tokens, the bias is applied at only half of the positions in the run, rather than uniformly across the entire run\. This bounds the contribution of any single token value to the green\-ratio statistic and prevents repeated\-token runs from saturating it toward11or00\. Since the detector reconstructsGnG\_\{n\}from the same seed and parity rule, no detection power is lost\.

##### Unbiased warm\-up\.

To address bias dominance at early steps, we suppress the logit bias for the firstmmpositions \(we usem=3m=3\)\. Combining this with the alternating partition above, the watermarked logits become

ℓ~n,k=ℓn,k\+δ⋅𝟙\[k∈Gn\]⋅𝟙\[n\>m\],sn∼Categorical\(softmax\(ℓ~n\)\),\\tilde\{\\ell\}\_\{n,k\}=\\ell\_\{n,k\}\+\\delta\\cdot\\mathbbm\{1\}\[k\\in G\_\{n\}\]\\cdot\\mathbbm\{1\}\[n\>m\],\\qquad s\_\{n\}\\sim\\mathrm\{Categorical\}\(\\mathrm\{softmax\}\(\\tilde\{\\boldsymbol\{\\ell\}\}\_\{n\}\)\),\(10\)so that positionsn≤mn\\leq mare sampled from the unmodified autoregressive distribution\. The detector excludes these same positions when computing the green\-ratio statistic, so no detection signal is lost: at steps where the autoregressive context is empty,δ\\deltawould have caused near\-deterministic selection of a green token regardless of input, providing no usable evidence for the test\.

#### 3\.2\.2Robust Detection via Token Re\-encoding

Local tokenization confines the effect of a post\-editing attack to a bounded set of tokens, but does not guarantee that those tokens are recovered to their clean codebook entries: the clean encoderEϕE\_\{\\phi\}may reassign perturbed windows to different codes\. We therefore introduce a*robust encoder*Eρ⋆E\_\{\\rho\}^\{\\star\}whose objective is to recover, from an attacked inputA⁡\(𝐱\)A\(\\mathbf\{x\}\), the token assignments thatEϕE\_\{\\phi\}would have produced on𝐱\\mathbf\{x\}\. The two components are complementary: without local tokenization, a globally coupled representation propagates the post\-editing attack to every recovered token, leavingEρ⋆E\_\{\\rho\}^\{\\star\}no stable reference to recover \(Table[5](https://arxiv.org/html/2608.19727#S4.T5)\); withoutEρ⋆E\_\{\\rho\}^\{\\star\}, locally affected tokens remain misclassified\.

Eρ⋆E\_\{\\rho\}^\{\\star\}shares the windowed cross\-attention architecture ofEϕE\_\{\\phi\}but replaces vector quantization with a per\-token classifier over the codebook vocabulary\. It is trained on pairs\(𝐱,A⁡\(𝐱\)\)\(\\mathbf\{x\},A\(\\mathbf\{x\}\)\)with𝐱\\mathbf\{x\}sampled from L\-VQVAE andAAdrawn from a fixed family of attacks \(including the identity\), excluding pairs in whichAAremoves the entire span of some window:

ℒrobust=𝔼𝐱,A​∑n=1NCE⁡\(Eρ⋆​\(A⁡\(𝐱\)\)n,sn​\(𝐱\)\),\\mathcal\{L\}\_\{\\text\{robust\}\}=\\mathbb\{E\}\_\{\\mathbf\{x\},A\}\\sum\_\{n=1\}^\{N\}\\mathrm\{CE\}\\\!\\left\(E\_\{\\rho\}^\{\\star\}\(A\(\\mathbf\{x\}\)\)\_\{n\},\\;s\_\{n\}\(\\mathbf\{x\}\)\\right\),\(11\)wheresn​\(𝐱\)s\_\{n\}\(\\mathbf\{x\}\)are the codes produced by the frozenEϕE\_\{\\phi\}on the clean input\. Joint training over multiple attack types yields a single encoder that recovers clean assignments without specializing to any one perturbation\. At detection time,Eρ⋆E\_\{\\rho\}^\{\\star\}replacesEϕE\_\{\\phi\}in the green\-ratio test of Section[2](https://arxiv.org/html/2608.19727#S2)\.

## 4Experiments

### 4\.1Experimental Setup

##### Datasets and baselines\.

We evaluate LVQMark on four multivariate time\-series datasets: Stocks\[[22](https://arxiv.org/html/2608.19727#bib.bib12)\], ETTh\[[27](https://arxiv.org/html/2608.19727#bib.bib13)\], Energy\[[3](https://arxiv.org/html/2608.19727#bib.bib14)\], and fMRI\[[16](https://arxiv.org/html/2608.19727#bib.bib15)\], allowing us to assess the generality of the proposed method under heterogeneous temporal patterns\. We compare against representative watermarking baselines, including Tree\-Ring \(TR\)\[[19](https://arxiv.org/html/2608.19727#bib.bib10)\], Gaussian Shading \(GS\)\[[21](https://arxiv.org/html/2608.19727#bib.bib11)\], and TimeWak\[[17](https://arxiv.org/html/2608.19727#bib.bib4)\], which cover both context\-independent and context\-dependent watermarking strategies\. To analyze watermarking performance together with backbone choice, we consider diffusion\- and VQ\-based generative backbones: DiffusionTS\[[24](https://arxiv.org/html/2608.19727#bib.bib5)\]for diffusion\-based watermarking methods, and TimeVQVAE\[[10](https://arxiv.org/html/2608.19727#bib.bib2)\]and SDFormer\[[4](https://arxiv.org/html/2608.19727#bib.bib1)\]as VQ\-based generative baselines\. TimeVQVAE uses discrete latent tokens with a transformer prior, while SDFormer is a recent VQ\-based model designed for strong time\-series generation quality\.

##### Attack setting and metrics\.

We evaluate robustness under three post\-editing attacks—offset,crop, andinsertion—at two strengths, 5% and 30%\. The main paper reports results for the stronger 30% setting, while the 5% results are deferred to Appendix[E](https://arxiv.org/html/2608.19727#A5)\. We assess generation quality using Context\-FID\[[8](https://arxiv.org/html/2608.19727#bib.bib18)\], Correlational\[[11](https://arxiv.org/html/2608.19727#bib.bib19)\], Discriminative\[[22](https://arxiv.org/html/2608.19727#bib.bib12)\], and Predictive score\[[22](https://arxiv.org/html/2608.19727#bib.bib12)\]\. For watermark reliability, we treat watermarked samples as the positive class and report TPR@0\.1%FPR, where the threshold is calibrated on clean non\-watermarked samples to yield 0\.1% FPR, and TPR is measured on watermarked samples at test time\. To directly evaluate false\-positive stability under post\-editing attack, we additionally report the empirical FPR onattackednon\-watermarked samples under the same clean\-calibrated detector\.

All reported results are averaged over five runs conducted with fixed random seeds to ensure reproducibility\. Additional details on datasets, preprocessing, attack implementation, metrics, and hyperparameters are deferred to Appendix[B](https://arxiv.org/html/2608.19727#A2)\.

### 4\.2Watermark Detection and Generation Quality

Table 2:Results of synthetic time series watermark detection and quality\. Watermarked \(TPR\) and Non\-watermarked \(FPR, mean z\-score\) detections are evaluated under 30% attacks\. Quality metrics are for 64\-length\. Best results are in bold, and second\-best are underlined\. Z\-scores with\|z\|\>3\.09\|z\|\>3\.09are marked inred\.SettingWatermark \(TPR↑\\uparrow\)Non\-watermarked \(FPR↓\\downarrow\| Z\-score\)Quality Metric \(↓\\downarrow\)DatasetModelMethodOffsetCropInsertOffsetCropInsertC\-FIDCorr\.Disc\.Pred\.StocksDiffusionTSTR0\.001\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}\+0\.21\+0\.211\.00\+69\.43\+69\.431\.00\+8\.11\+8\.111\.520\.070\.150\.04\\mathbf\{0\.04\}GS1\.00\\mathbf\{1\.00\}0\.001\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}−1\.40\-1\.400\.00\\mathbf\{0\.00\}−14\.87\-14\.870\.05\+1\.52\+1\.521\.500\.02¯\\underline\{0\.02\}0\.230\.04\\mathbf\{0\.04\}TimeWak1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}−0\.19\-0\.190\.00\\mathbf\{0\.00\}−4\.32\-4\.320\.05\+1\.35\+1\.350\.290\.01\\mathbf\{0\.01\}0\.130\.04\\mathbf\{0\.04\}SDformerLVQMark0\.000\.010\.000\.00\\mathbf\{0\.00\}−0\.16\-0\.160\.02\+1\.19\+1\.190\.00\\mathbf\{0\.00\}\+0\.31\+0\.310\.08¯\\underline\{0\.08\}0\.01\\mathbf\{0\.01\}0\.01\\mathbf\{0\.01\}0\.04\\mathbf\{0\.04\}L\-VQVAELVQMark1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}−0\.12\-0\.120\.01−0\.05\-0\.050\.01\+0\.35\+0\.350\.07\\mathbf\{0\.07\}0\.02¯\\underline\{0\.02\}0\.06¯\\underline\{0\.06\}0\.04\\mathbf\{0\.04\}ETThDiffusionTSTR1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}\+0\.89\+0\.891\.00\+17\.16\+17\.161\.00\+38\.55\+38\.552\.170\.220\.290\.14¯\\underline\{0\.14\}GS1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}−1\.53\-1\.530\.00\\mathbf\{0\.00\}−5\.44\-5\.440\.00\\mathbf\{0\.00\}−5\.82\-5\.823\.430\.250\.360\.16TimeWak1\.00\\mathbf\{1\.00\}0\.611\.00\\mathbf\{1\.00\}0\.04\+1\.17\+1\.170\.00\\mathbf\{0\.00\}−0\.28\-0\.280\.03\+1\.20\+1\.200\.370\.130\.11¯\\underline\{0\.11\}0\.12\\mathbf\{0\.12\}SDformerLVQMark0\.000\.000\.000\.00\\mathbf\{0\.00\}−0\.94\-0\.940\.02\+0\.09\+0\.090\.00\\mathbf\{0\.00\}−0\.09\-0\.090\.04¯\\underline\{0\.04\}0\.05\\mathbf\{0\.05\}0\.01\\mathbf\{0\.01\}0\.12\\mathbf\{0\.12\}L\-VQVAELVQMark1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.01−0\.12\-0\.120\.00\\mathbf\{0\.00\}−0\.22\-0\.220\.00\\mathbf\{0\.00\}\+0\.35\+0\.350\.03\\mathbf\{0\.03\}0\.06¯\\underline\{0\.06\}0\.01\\mathbf\{0\.01\}0\.12\\mathbf\{0\.12\}EnergyDiffusionTSTR0\.001\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}\+1\.18\+1\.181\.00\+53\.73\+53\.731\.00\+58\.55\+58\.550\.581\.980\.430\.28¯\\underline\{0\.28\}GS1\.00\\mathbf\{1\.00\}0\.381\.00\\mathbf\{1\.00\}1\.00\+14\.51\+14\.510\.00\\mathbf\{0\.00\}\+0\.87\+0\.871\.00\+11\.77\+11\.771\.782\.720\.480\.31TimeWak1\.00\\mathbf\{1\.00\}0\.971\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}−9\.69\-9\.690\.00\\mathbf\{0\.00\}−0\.42\-0\.420\.00\\mathbf\{0\.00\}−1\.57\-1\.570\.14¯\\underline\{0\.14\}1\.520\.14¯\\underline\{0\.14\}0\.25\\mathbf\{0\.25\}SDformerLVQMark1\.00\\mathbf\{1\.00\}0\.020\.580\.00\\mathbf\{0\.00\}−0\.02\-0\.020\.00\\mathbf\{0\.00\}\+0\.34\+0\.340\.00\\mathbf\{0\.00\}\+0\.34\+0\.340\.04\\mathbf\{0\.04\}1\.05¯\\underline\{1\.05\}0\.08\\mathbf\{0\.08\}0\.25\\mathbf\{0\.25\}L\-VQVAELVQMark1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}−0\.06\-0\.060\.00\\mathbf\{0\.00\}−0\.25\-0\.250\.01\+0\.04\+0\.040\.04\\mathbf\{0\.04\}0\.95\\mathbf\{0\.95\}0\.150\.25\\mathbf\{0\.25\}fMRIDiffusionTSTR1\.00\\mathbf\{1\.00\}0\.021\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}\+0\.05\+0\.051\.00\+2\.27\+2\.271\.00\+12\.14\+12\.143\.6312\.830\.400\.14GS1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}−1\.78\-1\.780\.00\\mathbf\{0\.00\}−32\.25\-32\.250\.06−0\.01\-0\.010\.748\.310\.500\.11TimeWak1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}\+0\.08\+0\.080\.00\\mathbf\{0\.00\}−2\.74\-2\.740\.00\\mathbf\{0\.00\}\+0\.18\+0\.180\.45¯\\underline\{0\.45\}1\.870\.25¯\\underline\{0\.25\}0\.10¯\\underline\{0\.10\}SDformerLVQMark0\.250\.020\.040\.00\\mathbf\{0\.00\}\+0\.03\+0\.030\.02\+0\.51\+0\.510\.00\\mathbf\{0\.00\}−0\.40\-0\.400\.13\\mathbf\{0\.13\}1\.19¯\\underline\{1\.19\}0\.12\\mathbf\{0\.12\}0\.09\\mathbf\{0\.09\}L\-VQVAELVQMark1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}−0\.03\-0\.030\.00\\mathbf\{0\.00\}−0\.24\-0\.240\.00\\mathbf\{0\.00\}−0\.17\-0\.170\.13\\mathbf\{0\.13\}1\.14\\mathbf\{1\.14\}0\.270\.09\\mathbf\{0\.09\}

##### Stable false\-positive behavior under post\-editing attacks\.

Table[2](https://arxiv.org/html/2608.19727#S4.T2)reveals two distinct failure modes among existing baselines\.Spurious false positives\.Tree\-Ring under crop produces meanzzvalues of\+69\.4\+69\.4on Stocks,\+17\.2\+17\.2on ETTh, and\+53\.7\+53\.7on Energy, driving the non\-watermarked FPR to1\.001\.00; Gaussian Shading shows the same pattern under offset on Energy \(z=\+14\.5z=\+14\.5, FPR=1\.00=1\.00\)\. The attacked null has drifted past the clean\-calibrated thresholdη\\eta, causing non\-watermarked samples to be systematically misattributed\.Severe negative drift\.Other baselines drift in the opposite direction: Gaussian Shading reachesz=−32\.2z=\-32\.2on fMRI under crop, and TimeWak reachesz=−9\.7z=\-9\.7on Energy under offset\. These scores stay belowη\\etaand yield zero empirical FPR, but the drift magnitude shows the null has been distorted well beyond its nominal scale—calibration here is accidental, not principled\. FPR alone is therefore insufficient: a detector can appear calibrated when drift falls on the negative side while remaining unreliable in absolute terms\. By contrast, L\-VQVAE with LVQMark keeps the mean attackedzzwithin\[−0\.25,\+0\.35\]\[\-0\.25,\+0\.35\]across all twelve \(dataset, attack\) configurations, with FPR≤0\.01\\leq 0\.01and TPR=1\.00=1\.00in eleven of twelve cases\.

##### L\-VQVAE matches state\-of\-the\-art generation quality\.

Table[3](https://arxiv.org/html/2608.19727#S4.T3)shows that L\-VQVAE remains highly competitive in generation quality, achieving the best or second\-best result on most metrics across the four datasets\. By comparison, TimeVQVAE performs substantially worse on several datasets\. TimeVQVAE uses separate pathways to model coarse temporal structure and fine local detail\. Although this helps represent different scales of variation, cross\-variable interactions are handled less explicitly, which may limit generation quality on datasets with strong inter\-variable dependencies, such as Energy and fMRI\.

Table 3:Results of synthetic time series quality for 64\-length sequences\. Best results are in bold, and second\-best are underlined\.StocksEnergyETThfMRIModelC\-FIDCorr\.Disc\.Pred\.C\-FIDCorr\.Disc\.Pred\.C\-FIDCorr\.Disc\.Pred\.C\-FIDCorr\.Disc\.Pred\.TimeVQVAE0\.4390\.0790\.3680\.0565\.4237\.1890\.4660\.2932\.4320\.2380\.4530\.24418\.64338\.4100\.2750\.255DiffusionTS0\.2940\.0130\.1260\.037¯\\underline\{0\.037\}0\.1431\.5190\.1350\.251¯\\underline\{0\.251\}0\.3700\.1340\.1140\.1170\.4461\.8690\.2530\.100SDformer0\.067¯\\underline\{0\.067\}0\.007\\mathbf\{0\.007\}0\.043¯\\underline\{0\.043\}0\.036\\mathbf\{0\.036\}0\.029\\mathbf\{0\.029\}1\.009¯\\underline\{1\.009\}0\.081\\mathbf\{0\.081\}0\.248\\mathbf\{0\.248\}0\.030¯\\underline\{0\.030\}0\.052\\mathbf\{0\.052\}0\.008\\mathbf\{0\.008\}0\.112\\mathbf\{0\.112\}0\.089\\mathbf\{0\.089\}1\.129¯\\underline\{1\.129\}0\.114\\mathbf\{0\.114\}0\.084¯\\underline\{0\.084\}L\-VQVAE0\.039\\mathbf\{0\.039\}0\.008¯\\underline\{0\.008\}0\.018\\mathbf\{0\.018\}0\.036\\mathbf\{0\.036\}0\.033¯\\underline\{0\.033\}0\.955\\mathbf\{0\.955\}0\.127¯\\underline\{0\.127\}0\.248\\mathbf\{0\.248\}0\.024\\mathbf\{0\.024\}0\.062¯\\underline\{0\.062\}0\.010¯\\underline\{0\.010\}0\.115¯\\underline\{0\.115\}0\.096¯\\underline\{0\.096\}1\.118\\mathbf\{1\.118\}0\.163¯\\underline\{0\.163\}0\.083\\mathbf\{0\.083\}

### 4\.3Component Analysis and Ablations

##### Both scheduling components are necessary\.

We ablate the two scheduling modifications introduced in Section[3\.2\.1](https://arxiv.org/html/2608.19727#S3.SS2.SSS1): the alternating partition and the unbiased warm\-up\. Figure[3](https://arxiv.org/html/2608.19727#S4.F3)shows the per\-position green\-token probability with and without the warm\-up\. Without it, the first few positions are sampled near\-deterministically from the green set, creating a stereotyped prefix that propagates into later steps\. The warm\-up suppresses the bias during positionsn≤mn\\leq m, keeping early tokens close to the unbiased baseline and allowing the autoregressive context to diversify before the watermark signal is introduced\.

\(a\)ETTh\(b\)Energy
Figure 3:Per\-position green\-token probability \(T=64T\{=\}64,δ=10\\delta\{=\}10\)\. Shaded region: warm\-up positions \(n≤3n\\leq 3\) where the logit bias is suppressed\.Table[4](https://arxiv.org/html/2608.19727#S4.T4)quantifies the impact on generation quality\. Removing the warm\-up alone degrades Context\-FID moderately; removing both modifications together leads to further deterioration across most datasets, confirming that the two components address complementary failure modes\.

Table 4:Ablation of watermark scheduling components for 64\-length sequences \(LVQMark\)\.no\-warmup: unbiased warm\-up removed\.no\-alt\-warmup: both alternating partition and unbiased warm\-up removed\. Best results are in bold, and second\-best are underlined\.StocksEnergyETThfMRIVariantC\-FIDCorr\.Disc\.Pred\.C\-FIDCorr\.Disc\.Pred\.C\-FIDCorr\.Disc\.Pred\.C\-FIDCorr\.Disc\.Pred\.no\-alt\-warmup0\.2220\.007\\mathbf\{0\.007\}0\.094¯\\underline\{0\.094\}0\.036\\mathbf\{0\.036\}0\.1141\.0600\.2030\.250¯\\underline\{0\.250\}0\.1720\.0980\.0270\.1190\.3241\.3620\.199¯\\underline\{0\.199\}0\.093no\-warmup0\.194¯\\underline\{0\.194\}0\.0200\.1070\.036\\mathbf\{0\.036\}0\.071¯\\underline\{0\.071\}0\.924\\mathbf\{0\.924\}0\.181¯\\underline\{0\.181\}0\.248\\mathbf\{0\.248\}0\.061¯\\underline\{0\.061\}0\.060\\mathbf\{0\.060\}0\.007\\mathbf\{0\.007\}0\.114\\mathbf\{0\.114\}0\.255¯\\underline\{0\.255\}1\.186¯\\underline\{1\.186\}0\.170\\mathbf\{0\.170\}0\.089¯\\underline\{0\.089\}LVQMark0\.068\\mathbf\{0\.068\}0\.015¯\\underline\{0\.015\}0\.055\\mathbf\{0\.055\}0\.036\\mathbf\{0\.036\}0\.035\\mathbf\{0\.035\}0\.945¯\\underline\{0\.945\}0\.151\\mathbf\{0\.151\}0\.248\\mathbf\{0\.248\}0\.028\\mathbf\{0\.028\}0\.061¯\\underline\{0\.061\}0\.010¯\\underline\{0\.010\}0\.116¯\\underline\{0\.116\}0\.133\\mathbf\{0\.133\}1\.135\\mathbf\{1\.135\}0\.2670\.086\\mathbf\{0\.086\}

Across the four datasets, LVQMark consistently achieves the best or second\-best quality on most metrics\. Removing the unbiased warm\-up alone degrades Context\-FID and Correlational scores moderately, while removing both modifications together leads to further deterioration, particularly on ETTh, Energy, and fMRI\. This incremental pattern confirms that the two modifications address complementary failure modes: the alternating partition mitigates the statistical artifact induced by repeated\-token runs, while the unbiased warm\-up prevents the stereotyped prefix from distorting downstream generation\. We adopt the full configuration as the default in all main experiments\. Additional ablations for other sequence lengths are provided in Appendix[D\.2](https://arxiv.org/html/2608.19727#A4.SS2.SSS0.Px1)\.

##### Robust encoder requires local tokenization\.

Table[5](https://arxiv.org/html/2608.19727#S4.T5)compares SDformer and L\-VQVAE with and without the attack\-augmented robust encoder used in our framework\. The robust encoder is itself effective: paired with L\-VQVAE, it lifts Crop detection from near\-zero to near\-perfect across all datasets while preserving Offset and Insert\. With SDformer, however, gains are uneven—substantial on Energy, marginal on ETTh, absent on Stocks—and on fMRI the encoder actively*degrades*detection, collapsing Offset from1\.001\.00to0\.050\.05and Insert from1\.001\.00to0\.030\.03\. Robust detection thus hinges not on attack\-aware training alone, but on a local representation that supports stable per\-region recovery\. Additional experiments for other sequence lengths are provided in Appendix[D\.1](https://arxiv.org/html/2608.19727#A4.SS1.SSS0.Px1)\.

Table 5:Results of watermark detection under attack for 64\-length sequences\. LVQMark is applied to different variants, and watermark detection performance \(TPR\) is evaluated under 30% attacks\. Best results are in bold, and second\-best are underlined\.StocksEnergyETThfMRIModelTypeOffsetCropInsertOffsetCropInsertOffsetCropInsertOffsetCropInsertSDformerw/o Robust0\.00¯\\underline\{0\.00\}0\.01¯\\underline\{0\.01\}0\.00¯\\underline\{0\.00\}1\.00\\mathbf\{1\.00\}0\.020\.580\.000\.000\.001\.00\\mathbf\{1\.00\}0\.021\.00\\mathbf\{1\.00\}w/ Robust0\.00¯\\underline\{0\.00\}0\.000\.001\.00\\mathbf\{1\.00\}0\.66¯\\underline\{0\.66\}0\.80¯\\underline\{0\.80\}0\.13¯\\underline\{0\.13\}0\.08¯\\underline\{0\.08\}0\.03¯\\underline\{0\.03\}0\.05¯\\underline\{0\.05\}0\.28¯\\underline\{0\.28\}0\.03¯\\underline\{0\.03\}L\-VQVAEw/o Robust1\.00\\mathbf\{1\.00\}0\.001\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.001\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.011\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}w/ Robust1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.98¯\\underline\{0\.98\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}

##### Detectability–quality trade\-off inδ\\delta\.

Figure[4](https://arxiv.org/html/2608.19727#S4.F4)shows how watermark strengthδ\\deltaaffects the trade\-off between watermark detectability and generation quality under our LVQMark, whereδ=0\\delta=0denotes the non\-watermarked baseline\. Asδ\\deltaincreases, watermark evidence becomes substantially stronger across Energy, ETTh, and fMRI, while Context\-FID remains relatively stable at moderate strengths and increases more clearly only at larger values\. This pattern indicates a clear trade\-off: stronger bias improves detectability, but excessive bias can harm sample quality\.

\(a\)Stocks\(b\)Energy\(c\)ETTh\(d\)fMRI
Figure 4:Z\-score and Context\-FID across watermark strengthδ\\deltafor 64\-length

## 5Conclusion and Limitations

In this work, we argued that false\-positive reliability in time\-series watermarking is fundamentally a re\-encoding stability problem\. Under post\-editing attacks, watermark detection must first re\-encode the observed continuous signal into an internal token representation, and when this re\-encoding is globally coupled, post\-editing attacks can distort the recovered evidence far beyond the attacked region\. Motivated by this failure mode, we introduced L\-VQVAE, a generative model in which each token depends only on a short temporal neighborhood, and built LVQMark on top of this locally recoverable interface with robust re\-encoding and generation\-time watermark injection\. Across four datasets, L\-VQVAE with LVQMark preserves competitive generation quality while substantially improving false\-positive stability under post\-editing attacks\.

##### Limitations\.

Our experiments cover four multivariate time\-series datasets and three sequence lengths; extending the evaluation to additional domains and longer horizons is a natural direction for future work\. Robustness is assessed under three representative post\-editing attacks—offset, crop, and insertion—at two strength levels\. Because the robust encoder is a modular component trained independently of the generative model and the detection framework, accommodating new attack types requires only retrainingEρ⋆E\_\{\\rho\}^\{\\star\}on updated augmentation sets, without modifying L\-VQVAE or the watermark schedule\. Finally, the multi\-stage training pipeline involves more steps than single\-stage baselines, though each stage is standard and can be executed independently\.

## References

- \[1\]K\. Arabi, R\. T\. Witter, C\. Hegde, and N\. Cohen\(2025\)Seal: semantic aware image watermarking\.InProceedings of the IEEE/CVF International Conference on Computer Vision,pp\. 16196–16205\.Cited by:[§1](https://arxiv.org/html/2608.19727#S1.p2.1)\.
- \[2\]T\. Brown, B\. Mann, N\. Ryder, M\. Subbiah, J\. D\. Kaplan, P\. Dhariwal, A\. Neelakantan, P\. Shyam, G\. Sastry, A\. Askell,et al\.\(2020\)Language models are few\-shot learners\.Advances in neural information processing systems33,pp\. 1877–1901\.Cited by:[§1](https://arxiv.org/html/2608.19727#S1.p1.1)\.
- \[3\]L\. Candanedo\(2017\)Appliances energy prediction\.UCI Machine Learning Repository10,pp\. C5VC8G\.Cited by:[§4\.1](https://arxiv.org/html/2608.19727#S4.SS1.SSS0.Px1.p1.1)\.
- \[4\]Z\. Chen, S\. Feng, Z\. Zhang, X\. Xiao, X\. Gao, and P\. Zhao\(2024\)Sdformer: similarity\-driven discrete transformer for time series generation\.Advances in Neural Information Processing Systems37,pp\. 132179–132207\.Cited by:[Appendix A](https://arxiv.org/html/2608.19727#A1.SS0.SSS0.Px1.p1.1),[§4\.1](https://arxiv.org/html/2608.19727#S4.SS1.SSS0.Px1.p1.1)\.
- \[5\]P\. England, H\. S\. Malvar, E\. Horvitz, J\. W\. Stokes, C\. Fournet, R\. Burke\-Aguero, A\. Chamayou, S\. Clebsch, M\. Costa, J\. Deutscher,et al\.\(2021\)AMP: authentication of media via provenance\.InProceedings of the 12th ACM Multimedia Systems Conference,pp\. 108–121\.Cited by:[§1](https://arxiv.org/html/2608.19727#S1.p1.1)\.
- \[6\]Z\. Hu, L\. Chen, X\. Wu, Y\. Wu, H\. Zhang, and H\. Huang\(2024\)Unbiased watermark for large language models\.InThe Twelfth International Conference on Learning Representations,External Links:[Link](https://openreview.net/forum?id=uWVC5FVidc)Cited by:[Appendix A](https://arxiv.org/html/2608.19727#A1.SS0.SSS0.Px2.p1.1)\.
- \[7\]M\. Huo, S\. A\. Somayajula, Y\. Liang, R\. Zhang, F\. Koushanfar, and P\. Xie\(2024\)Token\-specific watermarking with enhanced detectability and semantic coherence for large language models\.InProceedings of the 41st International Conference on Machine Learning,pp\. 20746–20767\.Cited by:[Appendix A](https://arxiv.org/html/2608.19727#A1.SS0.SSS0.Px2.p1.1),[§2](https://arxiv.org/html/2608.19727#S2.SS0.SSS0.Px1.p1.1)\.
- \[8\]P\. Jeha, M\. Bohlke\-Schneider, P\. Mercado, S\. Kapoor, R\. S\. Nirwan, V\. Flunkert, J\. Gasthaus, and T\. Januschowski\(2022\)PSA\-gan: progressive self attention gans for synthetic time series\.InThe Tenth International Conference on Learning Representations,Cited by:[§B\.4](https://arxiv.org/html/2608.19727#A2.SS4.SSS0.Px1.p1.1),[§4\.1](https://arxiv.org/html/2608.19727#S4.SS1.SSS0.Px2.p1.1)\.
- \[9\]J\. Kirchenbauer, J\. Geiping, Y\. Wen, J\. Katz, I\. Miers, and T\. Goldstein\(2023\)A watermark for large language models\.InInternational conference on machine learning,pp\. 17061–17084\.Cited by:[Appendix A](https://arxiv.org/html/2608.19727#A1.SS0.SSS0.Px2.p1.1),[§1](https://arxiv.org/html/2608.19727#S1.p1.1),[§2](https://arxiv.org/html/2608.19727#S2.SS0.SSS0.Px1.p1.1),[§2](https://arxiv.org/html/2608.19727#S2.SS0.SSS0.Px1.p1.2),[§2](https://arxiv.org/html/2608.19727#S2.SS0.SSS0.Px2.p1.1),[§3\.2\.1](https://arxiv.org/html/2608.19727#S3.SS2.SSS1.Px1.p1.2)\.
- \[10\]D\. Lee, S\. Malacarne, and E\. Aune\(2023\)Vector quantized time series generation with a bidirectional prior model\.InInternational Conference on Artificial Intelligence and Statistics,pp\. 7665–7693\.Cited by:[Appendix A](https://arxiv.org/html/2608.19727#A1.SS0.SSS0.Px1.p1.1),[§4\.1](https://arxiv.org/html/2608.19727#S4.SS1.SSS0.Px1.p1.1)\.
- \[11\]S\. Liao, H\. Ni, L\. Szpruch, M\. Wiese, M\. Sabate\-Vidales, and B\. Xiao\(2020\)Conditional sig\-wasserstein gans for time series generation\.arXiv preprint arXiv:2006\.05421\.Cited by:[§B\.4](https://arxiv.org/html/2608.19727#A2.SS4.SSS0.Px2.p1.1),[§4\.1](https://arxiv.org/html/2608.19727#S4.SS1.SSS0.Px2.p1.1)\.
- \[12\]A\. Müller, D\. Lukovnikov, J\. Thietke, A\. Fischer, and E\. Quiring\(2025\)Black\-box forgery attacks on semantic watermarks for diffusion models\.InProceedings of the Computer Vision and Pattern Recognition Conference,pp\. 20937–20946\.Cited by:[§1](https://arxiv.org/html/2608.19727#S1.p2.1)\.
- \[13\]J\. Ricker, D\. Lukovnikov, and A\. Fischer\(2024\)Aeroblade: training\-free detection of latent diffusion images using autoencoder reconstruction error\.InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition,pp\. 9130–9140\.Cited by:[§1](https://arxiv.org/html/2608.19727#S1.p1.1)\.
- \[14\]R\. Rombach, A\. Blattmann, D\. Lorenz, P\. Esser, and B\. Ommer\(2022\)High\-resolution image synthesis with latent diffusion models\.InProceedings of the IEEE/CVF conference on computer vision and pattern recognition,pp\. 10684–10695\.Cited by:[§1](https://arxiv.org/html/2608.19727#S1.p1.1)\.
- \[15\]T\. Sander, P\. Fernandez, A\. O\. Durmus, T\. Furon, and M\. Douze\(2025\)Watermark anything with localized messages\.InThe Thirteenth International Conference on Learning Representations,External Links:[Link](https://openreview.net/forum?id=IkZVDzdC8M)Cited by:[§1](https://arxiv.org/html/2608.19727#S1.p2.1)\.
- \[16\]S\. M\. Smith, K\. L\. Miller, G\. Salimi\-Khorshidi, M\. Webster, C\. F\. Beckmann, T\. E\. Nichols, J\. D\. Ramsey, and M\. W\. Woolrich\(2011\)Network modelling methods for fmri\.Neuroimage54\(2\),pp\. 875–891\.Cited by:[§4\.1](https://arxiv.org/html/2608.19727#S4.SS1.SSS0.Px1.p1.1)\.
- \[17\]Z\. W\. Soi, C\. Zhu, F\. Abiad, A\. Shankar, J\. M\. Galjaard, H\. Wang, and L\. Y\. Chen\(2025\)TimeWak: temporal chained\-hashing watermark for time series data\.InThe Thirty\-ninth Annual Conference on Neural Information Processing Systems,External Links:[Link](https://openreview.net/forum?id=akhhwQh6UV)Cited by:[§B\.4](https://arxiv.org/html/2608.19727#A2.SS4.SSS0.Px5.p3.1),[§1](https://arxiv.org/html/2608.19727#S1.p1.1),[§1](https://arxiv.org/html/2608.19727#S1.p2.1),[Figure 1](https://arxiv.org/html/2608.19727#S2.F1),[Figure 1](https://arxiv.org/html/2608.19727#S2.F1.5),[§2](https://arxiv.org/html/2608.19727#S2.SS0.SSS0.Px1.p1.1),[§2](https://arxiv.org/html/2608.19727#S2.SS0.SSS0.Px1.p1.2),[§2](https://arxiv.org/html/2608.19727#S2.SS0.SSS0.Px2.p1.1),[§4\.1](https://arxiv.org/html/2608.19727#S4.SS1.SSS0.Px1.p1.1)\.
- \[18\]A\. Van Den Oord O\. Vinyalset al\.\(2017\)Neural discrete representation learning\.Advances in neural information processing systems30\.Cited by:[Appendix A](https://arxiv.org/html/2608.19727#A1.SS0.SSS0.Px1.p1.1),[§3\.1\.1](https://arxiv.org/html/2608.19727#S3.SS1.SSS1.Px2.p1.3)\.
- \[19\]Y\. Wen, J\. Kirchenbauer, J\. Geiping, and T\. Goldstein\(2023\)Tree\-rings watermarks: invisible fingerprints for diffusion images\.Advances in Neural Information Processing Systems36,pp\. 58047–58063\.Cited by:[§1](https://arxiv.org/html/2608.19727#S1.p1.1),[§1](https://arxiv.org/html/2608.19727#S1.p2.1),[§4\.1](https://arxiv.org/html/2608.19727#S4.SS1.SSS0.Px1.p1.1)\.
- \[20\]Y\. Wu, R\. Chen, G\. Milis, and H\. Huang\(2026\)An ensemble framework for unbiased language model watermarking\.InThe Fourteenth International Conference on Learning Representations,External Links:[Link](https://openreview.net/forum?id=iZ7i2y1YxO)Cited by:[Appendix A](https://arxiv.org/html/2608.19727#A1.SS0.SSS0.Px2.p1.1)\.
- \[21\]Z\. Yang, K\. Zeng, K\. Chen, H\. Fang, W\. Zhang, and N\. Yu\(2024\)Gaussian shading: provable performance\-lossless image watermarking for diffusion models\.InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition,pp\. 12162–12171\.Cited by:[Appendix A](https://arxiv.org/html/2608.19727#A1.SS0.SSS0.Px2.p1.1),[§1](https://arxiv.org/html/2608.19727#S1.p1.1),[§4\.1](https://arxiv.org/html/2608.19727#S4.SS1.SSS0.Px1.p1.1)\.
- \[22\]J\. Yoon, D\. Jarrett, and M\. Van der Schaar\(2019\)Time\-series generative adversarial networks\.Advances in neural information processing systems32\.Cited by:[Appendix A](https://arxiv.org/html/2608.19727#A1.SS0.SSS0.Px2.p1.1),[§B\.4](https://arxiv.org/html/2608.19727#A2.SS4.SSS0.Px3.p2.1),[§B\.4](https://arxiv.org/html/2608.19727#A2.SS4.SSS0.Px4.p2.1),[§4\.1](https://arxiv.org/html/2608.19727#S4.SS1.SSS0.Px1.p1.1),[§4\.1](https://arxiv.org/html/2608.19727#S4.SS1.SSS0.Px2.p1.1)\.
- \[23\]N\. Yu, V\. Skripniuk, S\. Abdelnabi, and M\. Fritz\(2021\)Artificial fingerprinting for generative models: rooting deepfake attribution in training data\.InProceedings of the IEEE/CVF International conference on computer vision,pp\. 14448–14457\.Cited by:[§1](https://arxiv.org/html/2608.19727#S1.p1.1)\.
- \[24\]X\. Yuan and Y\. Qiao\(2024\)Diffusion\-TS: interpretable diffusion for general time series generation\.InThe Twelfth International Conference on Learning Representations,External Links:[Link](https://openreview.net/forum?id=4h1apFjO99)Cited by:[Appendix A](https://arxiv.org/html/2608.19727#A1.SS0.SSS0.Px1.p1.1),[Appendix A](https://arxiv.org/html/2608.19727#A1.SS0.SSS0.Px2.p1.1),[§B\.4](https://arxiv.org/html/2608.19727#A2.SS4.SSS0.Px2.p4.1),[§1](https://arxiv.org/html/2608.19727#S1.p1.1),[§4\.1](https://arxiv.org/html/2608.19727#S4.SS1.SSS0.Px1.p1.1)\.
- \[25\]Z\. Yue, Y\. Wang, J\. Duan, T\. Yang, C\. Huang, Y\. Tong, and B\. Xu\(2022\)Ts2vec: towards universal representation of time series\.InProceedings of the AAAI conference on artificial intelligence,Vol\.36,pp\. 8980–8987\.Cited by:[§B\.4](https://arxiv.org/html/2608.19727#A2.SS4.SSS0.Px1.p2.1),[§B\.4](https://arxiv.org/html/2608.19727#A2.SS4.SSS0.Px1.p3.1)\.
- \[26\]X\. Zhao, P\. V\. Ananth, L\. Li, and Y\. Wang\(2024\)Provable robust watermarking for AI\-generated text\.InThe Twelfth International Conference on Learning Representations,External Links:[Link](https://openreview.net/forum?id=SsmT8aO45L)Cited by:[§1](https://arxiv.org/html/2608.19727#S1.p2.1)\.
- \[27\]H\. Zhou, S\. Zhang, J\. Peng, S\. Zhang, J\. Li, H\. Xiong, and W\. Zhang\(2021\)Informer: beyond efficient transformer for long sequence time\-series forecasting\.InProceedings of the AAAI conference on artificial intelligence,Vol\.35,pp\. 11106–11115\.Cited by:[§4\.1](https://arxiv.org/html/2608.19727#S4.SS1.SSS0.Px1.p1.1)\.

## Appendix ARelated Work

##### Discrete interfaces for time\-series generation\.

Vector Quantization \(VQ\)\[[18](https://arxiv.org/html/2608.19727#bib.bib6)\]provides a discrete interface for continuous signals by mapping encoder outputs to entries in a learned codebook\. The resulting code indices can be decoded back to the signal domain or modeled by a sequence prior\. TimeVQVAE\[[10](https://arxiv.org/html/2608.19727#bib.bib2)\]and SDformer\[[4](https://arxiv.org/html/2608.19727#bib.bib1)\]show that such discrete token\-based generators can be competitive with continuous\-domain time\-series generators\[[24](https://arxiv.org/html/2608.19727#bib.bib5)\]and preserve information useful for downstream classification or forecasting\. However, these representations are not designed for re\-encoding stability, or robustness to post\-processing corruptions\. These properties are essential for watermark detection, where a modified continuous signal must be re\-encoded into a consistent token sequence before the watermark statistic can be computed\.

##### Token\-level generation\-time watermarking\.

Generation\-time watermarking is attractive because it embeds the watermark by steering the sampling process itself, rather than by directly perturbing the generated sample\. This distinction is important because post\-processing\-based watermarking can directly alter generated samples and degrade quality\[[21](https://arxiv.org/html/2608.19727#bib.bib11)\]; in time\-series generation, such perturbations may further distort temporal or cross\-variate dependencies that are central to synthetic\-data utility\[[22](https://arxiv.org/html/2608.19727#bib.bib12),[24](https://arxiv.org/html/2608.19727#bib.bib5)\]\. The red\-green watermarking framework\[[9](https://arxiv.org/html/2608.19727#bib.bib3)\]is a standard template for token\-level generation\-time watermarking in language models\. At each sampling step, it partitions the vocabulary into agreenset and its complementredset using a secret key, and adds a positive logit bias to the tokens in green set\. This alters the sampling distribution, so that generated token sequences contain a detectable statistical bias\. Subsequent methods\[[7](https://arxiv.org/html/2608.19727#bib.bib27),[6](https://arxiv.org/html/2608.19727#bib.bib7),[20](https://arxiv.org/html/2608.19727#bib.bib16)\]refine this mechanism by adapting the bias to token\-level context or by designing unbiased rules that better preserve the original sampling distribution\. We build on this distributional view, but instantiate it for time series over a local VQ token space\. In contrast, our work focuses on detector\-side re\-encoding stability and false\-positive behavior on attacked non\-watermarked samples\.

## Appendix BExperiment Details

### B\.1Implementation Details

Tables[6](https://arxiv.org/html/2608.19727#A2.T6)–[7](https://arxiv.org/html/2608.19727#A2.T7)summarize the hyperparameters used for each model\. All models share the same data splits and preprocessing across datasets for fair comparison\. Regarding the random replacement probability, during AR Transformer training each input token is independently replaced with a random codebook index with probabilitypp, while ground\-truth labels remain unchanged\. This forces the model to predict the next token correctly even under corrupted context, preventing over\-reliance on preceding tokens and improving generalization\. For the standard VQ\-VAE, which attends over the full token history, we setp=0\.3p=0\.3for ETTh and Stocks — datasets with stronger temporal autocorrelation — andp=0\.1p=0\.1for Energy and fMRI\. For Local VQ\-VAE, the AR Transformer restricts attention to a fixed lookback window of 6 tokens, which structurally limits long\-range dependency; accordingly,p=0\.1p=0\.1suffices across all datasets\.

Table 6:L\-VQVAE hyperparameter settings\. Stride 2 is used for windowT=24T\{=\}24; stride 4 forT=64,128T\{=\}64,128\.†\\daggerRobust encoder is trained withcropvar\\textbf\{crop\}\_\{\\text\{var\}\}\.ParameterEnergyETThfMRIStocksEncoder / DecoderFeature sizeDD287506dmodeld\_\{\\text\{model\}\}512512512128Attention heads8884Encoder layers5555Local decoder layers5555Global decoder layers5555Receptive fieldrr4444Stride \(T=24T\{=\}24\)2222Stride \(T=64,128T\{=\}64,128\)4444Codebook sizeKK409651210241024Codebook dim512512512128Commitment weight0\.250\.250\.250\.25Dropout0\.00\.00\.00\.0AR Transformernembdn\_\{\\text\{embd\}\}1024102410241024nheadn\_\{\\text\{head\}\}8888nlayern\_\{\\text\{layer\}\}2222Random replace prob0\.1Lookback6Watermarkδ\\delta10101020TrainingOptimizerAdamW,β=\(0\.9,0\.99\)\\beta\{=\}\(0\.9,\\,0\.99\)Batch size128Learning rate3×10−43\\times 10^\{\-4\}Gradient clip1\.0Pretrain steps \(stage 1\)30,000Decoder steps \(stage 2\)10,000Transformer steps \(stage 3\)30,000Robust Encoder†\\daggerdmodeld\_\{\\text\{model\}\}102410241024256Attention heads1616164Layers3Receptive fieldrr4OptimizerAdamW,β=\(0\.9,0\.99\)\\beta\{=\}\(0\.9,\\,0\.99\)Learning rate1×10−41\\times 10^\{\-4\}Gradient clip1\.0Training steps50,000Val interval5,000Attack augmentation \(robust encoder training\)Clean \(no attack\)\-Offsetfactor∈\{0\.05,0\.30\}\\in\\\{0\.05,\\,0\.30\\\}cropvar\\textbf\{crop\}\_\{\\text\{var\}\}†\\daggerfactor∈\{0\.05,0\.30\}\\in\\\{0\.05,\\,0\.30\\\}Insertionfactor∈\{0\.05,0\.30\}\\in\\\{0\.05,\\,0\.30\\\}Table 7:SDformer hyperparameter settings\.ParameterEnergyETThfMRIStocksEncoder / DecoderFeature sizeDD287506Hidden dim512512512512Residual blocks2222Downsample rate4444EMA decay0\.990\.990\.990\.99Embed loss weight0\.010\.50\.012\.0Quantizer typecosineCodebook sizeKK512512512512Codebook dim512512512256AR Transformernembdn\_\{\\text\{embd\}\}1024102410241024nheadn\_\{\\text\{head\}\}8888nlayern\_\{\\text\{layer\}\}2622Random replace prob0\.10\.30\.10\.3Watermarkδ\\delta10TrainingOptimizerAdamW,β=\(0\.9,0\.99\)\\beta\{=\}\(0\.9,\\,0\.99\)Batch size6412864128Learning rate3×10−43\\times 10^\{\-4\}Gradient clip1\.0VQ\-VAE steps \(stage 1\)50,000Transformer steps \(stage 2\)50,000
### B\.2Dataset Details

We use four multivariate time\-series datasets spanning diverse domains\. All datasets are segmented into overlapping windows of sizeT∈\{24,64,128\}T\\in\\\{24,64,128\\\}with stride 1, yielding a set of fixed\-length samples\. Each sample is normalized per\-variable to\[−1,1\]\[\-1,1\]via MinMax scaling\. The resulting samples split 80%/20% into train and test sets\. Table[8](https://arxiv.org/html/2608.19727#A2.T8)summarizes the dataset statistics\.

Table 8:Details of datasets used in experiments\.Dataset\# Timesteps\# FeaturesSourceStocks3,6856[https://finance\.yahoo\.com](https://finance.yahoo.com/)ETTh17,4207[https://github\.com/zhouhaoyi/ETDataset](https://github.com/zhouhaoyi/ETDataset)Energy19,73528[https://archive\.ics\.uci\.edu](https://archive.ics.uci.edu/)fMRI10,00050[https://www\.fmrib\.ox\.ac\.uk/datasets](https://www.fmrib.ox.ac.uk/datasets)
### B\.3Attack Settings

We evaluate detection robustness under three post\-editing attacks: offset, insert, and crop\. Each attack is applied with strength factorα∈\{0\.05,0\.30\}\\alpha\\in\\\{0\.05,0\.30\\\}\.

Theoffsetattack shifts each variable byα×x¯d\\alpha\\times\\bar\{x\}\_\{d\}, wherex¯d\\bar\{x\}\_\{d\}is the temporal mean of variableddin the sample\. Theinsertattack replaces⌊α​T⌋\\lfloor\\alpha T\\rfloorrandomly selected time steps with uniform random values drawn from the observed range of each variable\. Thecropattack removes a random rectangular region in the\(T,D\)\(T,D\)space, retaining a window of size\(1−α\)​T×\(1−α\)​D\(1\-\\alpha\)T\\times\(1\-\\alpha\)Dat a randomly chosen position\. The removed region is filled with the per\-variable midpoint, defined as\(min\+max\)/2\(\\min\+\\max\)/2computed over the surviving window\. Under standard min\-max normalization followed by rescaling to\[−1,1\]\[\-1,1\], this midpoint reduces to zero, making the fill semantically neutral\. All model families use the same randomly drawn crop window at evaluation time\.

For robust encoder training, we use an additional augmentation,cropvar\\textbf\{crop\}\_\{\\text\{var\}\}, which retains a contiguous block of\(1−α\)​D\(1\-\\alpha\)Dvariables over the full temporal axis and fills the remaining⌊α​D⌋\\lfloor\\alpha D\\rfloorvariables with the per\-variable midpoint\.cropvar\\textbf\{crop\}\_\{\\text\{var\}\}differs fromcropin that it preserves the temporal dimension and perturbs only the variable axis, thereby exposing the encoder to feature\-level corruption without removing local temporal context entirely\.

### B\.4Evaluation Metrics

##### Context\-FID

Context\-FID is an evaluation metric proposed by Jeha et al\.\[[8](https://arxiv.org/html/2608.19727#bib.bib18)\]to measure the distributional gap between real and generated time series\. It can be viewed as a time\-series\-oriented extension of the conventional Fréchet Inception Distance \(FID\), which is widely used in image generation tasks\.

The key difference from image\-based FID lies in the feature representation\. While standard FID extracts image embeddings using an Inception network, Context\-FID employs TS2Vec\[[25](https://arxiv.org/html/2608.19727#bib.bib21)\], a representation model specifically designed for time series\. Since TS2Vec captures temporal characteristics of sequential data, the resulting distance is more suitable for assessing synthetic time series quality\.

Yue et al\.\[[25](https://arxiv.org/html/2608.19727#bib.bib21)\]further observed that generative models achieving lower Context\-FID scores often show stronger downstream forecasting performance\. This suggests that Context\-FID reflects not only superficial similarity but also useful temporal distributional alignment\. Accordingly, a smaller Context\-FID value indicates that the generated time series more closely match the real data distribution\.

##### Correlational score

The correlational score evaluates whether synthetic time series reproduce the inter\-variable dependency patterns observed in real data\. To this end, we first compute the covariance between theii\-th andjj\-th variables over the temporal dimension\. Following\[[11](https://arxiv.org/html/2608.19727#bib.bib19)\], the covariance is defined as:

Covi,j=1W​∑t=1WKit​Kjt−\(1W​∑t=1WKit\)​\(1W​∑t=1WKjt\)\.\\mathrm\{Cov\}\_\{i,j\}=\\frac\{1\}\{W\}\\sum\_\{t=1\}^\{W\}K\_\{i\}^\{t\}K\_\{j\}^\{t\}\-\\left\(\\frac\{1\}\{W\}\\sum\_\{t=1\}^\{W\}K\_\{i\}^\{t\}\\right\)\\left\(\\frac\{1\}\{W\}\\sum\_\{t=1\}^\{W\}K\_\{j\}^\{t\}\\right\)\.
Here,WWis the sequence length, andKitK\_\{i\}^\{t\}andKjtK\_\{j\}^\{t\}denote the values of theii\-th andjj\-th features at time steptt\. The covariance is obtained by subtracting the product of the two feature means from the mean of their element\-wise products\.

After computing covariance matrices for both real and synthetic data, we compare their normalized correlation structures using the following discrepancy measure\[[24](https://arxiv.org/html/2608.19727#bib.bib5)\]:

110​∑i,jd\|Covi,jRCovi,iR​Covj,jR−Covi,jSCovi,iS​Covj,jS\|\.\\frac\{1\}\{10\}\\sum^\{d\}\_\{i,j\}\\left\|\\frac\{\\mathrm\{Cov\}\_\{i,j\}^\{R\}\}\{\\sqrt\{\\mathrm\{Cov\}\_\{i,i\}^\{R\}\\mathrm\{Cov\}\_\{j,j\}^\{R\}\}\}\-\\frac\{\\mathrm\{Cov\}\_\{i,j\}^\{S\}\}\{\\sqrt\{\\mathrm\{Cov\}\_\{i,i\}^\{S\}\\mathrm\{Cov\}\_\{j,j\}^\{S\}\}\}\\right\|\.
In the equation above, superscriptsRRandSSindicate real and synthetic data, respectively, anddddenotes the number of features\. The summation is computed over all feature pairs\. A smaller correlational score means that the synthetic data better preserves the pairwise correlation structure of the real data\.

##### Discriminative score

The discriminative score measures the distinguishability between real and synthetic time series\. Specifically, a classifier is trained to predict whether each sample comes from the real dataset or the generated dataset, and the score is calculated as\|accuracy−0\.5\|\|\\mathrm\{accuracy\}\-0\.5\|\.

If the generated samples are highly realistic, the classifier should not be able to reliably distinguish them from real samples, and its accuracy should approach0\.50\.5\. Therefore, lower discriminative scores indicate better generation quality\. Following the evaluation protocol of TimeGAN\[[22](https://arxiv.org/html/2608.19727#bib.bib12)\], we use a two\-layer GRU classifier for this evaluation\.

##### Predictive score

The predictive score assesses whether generated time series preserve temporal patterns that are useful for forecasting\. Rather than directly measuring visual or statistical similarity, this metric evaluates the utility of generated sequences in a prediction task\.

Following the evaluation protocol of TimeGAN\[[22](https://arxiv.org/html/2608.19727#bib.bib12)\], we use a one\-layer GRU\-based predictor\. We report the mean absolute error \(MAE\) between the predicted values and the ground\-truth values on the test set\. A lower predictive score indicates that the synthetic data better preserves the temporal dynamics required for sequence prediction\.

##### Z\-score

The Z\-score is used to evaluate the detectability of watermarks\. It measures how far the detection statistic of watermarked samples deviates from that of non\-watermarked samples\. This metric is naturally connected to hypothesis testing\. The null hypothesisH0H\_\{0\}assumes that the sample does not contain a watermark generated by the corresponding watermarking method\.

When the Z\-score is close to zero, the watermarked and non\-watermarked samples are statistically difficult to separate\. A sufficiently large positive Z\-score, in contrast, provides evidence againstH0H\_\{0\}and supports the conclusion that a watermark is present\.

We consider methods that produce a scalar per\-sample detection statisticxix\_\{i\}, such as bit accuracy for TimeWak\[[17](https://arxiv.org/html/2608.19727#bib.bib4)\]or green\-list ratio for LVQMark\. For these methods, the Z\-score is computed at the population level via a subsampled\-mean construction\. LetμN​W\\mu\_\{NW\}andσN​W\\sigma\_\{NW\}denote the mean and standard deviation ofxix\_\{i\}over a non\-watermarked, attack\-free reference set generated by the same model\. Following TimeWak\[[17](https://arxiv.org/html/2608.19727#bib.bib4)\], we drawB=100B=100subsamples of sizen=1000n=1000without replacement\. For each replicatebb, we compute

Zb=x¯\(b\)−μN​WσN​W/n\.Z\_\{b\}=\\frac\{\\bar\{x\}^\{\(b\)\}\-\\mu\_\{NW\}\}\{\\sigma\_\{NW\}/\\sqrt\{n\}\}\.
We then reportZ¯=mean⁡\(Zb\)\\overline\{Z\}=\\mathrm\{mean\}\(Z\_\{b\}\),σZ=std⁡\(Zb\)\\sigma\_\{Z\}=\\mathrm\{std\}\(Z\_\{b\}\), and the empirical decision thresholdPr⁡\(Zb\>Φ−1​\(0\.999\)\)≈3\.0902\\Pr\\\!\\left\(Z\_\{b\}\>\\Phi^\{\-1\}\(0\.999\)\\right\)\\approx 3\.0902\.

##### TPR@X%FPR

TPR@X%FPR is the true positive rate at a threshold calibrated to yield an X% false positive rate on clean non\-watermarked samples\. It measures detection power under a fixed false\-positive constraint, which is particularly important in provenance verification, where false positives can lead to incorrect attribution of synthetic content\. In our setting, this metric allows us to compare how reliably different methods detect watermarked samples when they are required to satisfy the same nominal false\-positive budget\.

### B\.5Compute Resources

All experiments were conducted on a server with three GPUs: one NVIDIA H100 PCIe \(80 GB\) and two NVIDIA RTX PRO 6000 Blackwell Server Edition \(96 GB each\), an Intel Xeon Gold 6444Y dual\-socket CPU \(64 logical cores, up to 4\.0 GHz\)\.

## Appendix CEffect of Partition Rules on Robust Detection

Tables[9](https://arxiv.org/html/2608.19727#A3.T9)and[10](https://arxiv.org/html/2608.19727#A3.T10)compare the context\-dependent KGW partition with our context\-independent partition under 5% and 30% attacks, respectively\. Under the KGW rule, the green set at positionnnis determined by the recovered token atn−1n\{\-\}1, so a single re\-encoding error can affect the partition at the next position and propagate a local perturbation beyond the attacked region\. In contrast, our context\-independent partition depends only on the position index and the secret key, eliminating this cross\-position coupling and confining each re\-encoding error to its originating position\. As a result, our partition consistently yields higher watermark Z\-scores across datasets and attack types under both attack strengths\. This shows that the robustness benefit of preserving locality is systematic rather than specific to the stronger 30% setting\. Combined with parity alternation and the bias\-free warm\-up \(Section[3\.2\.1](https://arxiv.org/html/2608.19727#S3.SS2.SSS1)\), the proposed design leads to more stable recovered evidence and stronger overall watermark detectability\.

Table 9:Partition rule comparison\. Z\-scores under 30% attacks\. Best results are in bold\.StocksEnergyETThfMRIPartitionOffsetCropInsert\.OffsetCropInsert\.OffsetCropInsert\.OffsetCropInsert\.KGW14\.965\.382\.7614\.7310\.069\.9810\.518\.147\.2612\.7113\.129\.31Ours15\.39\\mathbf\{15\.39\}16\.19\\mathbf\{16\.19\}9\.16\\mathbf\{9\.16\}17\.30\\mathbf\{17\.30\}13\.77\\mathbf\{13\.77\}13\.14\\mathbf\{13\.14\}17\.10\\mathbf\{17\.10\}16\.09\\mathbf\{16\.09\}13\.31\\mathbf\{13\.31\}14\.55\\mathbf\{14\.55\}16\.72\\mathbf\{16\.72\}11\.88\\mathbf\{11\.88\}

Table 10:Partition rule comparison\. Z\-scores under 5% attacks\. Best results are in bold\.StocksEnergyETThfMRIPartitionOffsetCropInsertOffsetCropInsertOffsetCropInsertOffsetCropInsertKGW12\.958\.628\.4414\.8013\.3014\.2711\.099\.0210\.5512\.7713\.1412\.66Ours19\.51\\mathbf\{19\.51\}15\.80\\mathbf\{15\.80\}16\.37\\mathbf\{16\.37\}17\.35\\mathbf\{17\.35\}15\.74\\mathbf\{15\.74\}16\.98\\mathbf\{16\.98\}17\.65\\mathbf\{17\.65\}16\.53\\mathbf\{16\.53\}17\.80\\mathbf\{17\.80\}14\.68\\mathbf\{14\.68\}15\.19\\mathbf\{15\.19\}14\.49\\mathbf\{14\.49\}

## Appendix DExperimental Results For Other Lengths

This section provides additional results for other sequence lengths \(T=24,128T=24,128\) and complements the main analysis atT=64T=64\. The overall trend is consistent with the main results\.

### D\.1Watermark Detection and Generation Quality

##### False\-positive behavior under post\-editing attacks

Tables[11](https://arxiv.org/html/2608.19727#A4.T11)and[12](https://arxiv.org/html/2608.19727#A4.T12)extend the analysis of bidirectional null shift in Section[4\.2](https://arxiv.org/html/2608.19727#S4.SS2.SSS0.Px1)to other sequence lengths\. Consistent with the main results, the same qualitative pattern persists across other sequence lengths, further supporting that the attacked null remains stable under L\-VQVAE with LVQMark while existing baselines exhibit substantial drift\.

Table 11:Results of synthetic time series watermark detection and quality\. Watermarked \(TPR\) and Non\-watermarked \(FPR, mean z\-score\) detections are evaluated under 30% attacks\. Quality metrics are for 24\-length\. Best results are in bold, and second\-best are underlined\. Z\-scores with\|z\|\>3\.09\|z\|\>3\.09are marked inred\.SettingWatermark \(TPR↑\\uparrow\)Non\-watermarked \(FPR↓\\downarrow\| Z\-score\)Quality Metric \(↓\\downarrow\)DatasetModelMethodOffsetCropInsertOffsetCropInsertC\-FIDCorr\.Disc\.Pred\.StocksDiffusionTSTR0\.001\.00\\mathbf\{1\.00\}0\.000\.00\\mathbf\{0\.00\}\+0\.19\+0\.191\.00\+63\.26\+63\.260\.00\\mathbf\{0\.00\}\+1\.91\+1\.910\.960\.100\.200\.04\\mathbf\{0\.04\}GS1\.00\\mathbf\{1\.00\}0\.451\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}−1\.15\-1\.150\.00\\mathbf\{0\.00\}−6\.32\-6\.320\.00\\mathbf\{0\.00\}\+0\.16\+0\.168\.880\.090\.430\.04\\mathbf\{0\.04\}TimeWak1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}−0\.99\-0\.990\.02\+1\.39\+1\.390\.00\\mathbf\{0\.00\}−1\.77\-1\.770\.330\.02¯\\underline\{0\.02\}0\.160\.04\\mathbf\{0\.04\}SDformerLVQMark0\.130\.810\.220\.00\\mathbf\{0\.00\}\+0\.51\+0\.510\.86\+4\.49\+4\.490\.01\+1\.33\+1\.330\.11¯\\underline\{0\.11\}0\.01\\mathbf\{0\.01\}0\.02\\mathbf\{0\.02\}0\.04\\mathbf\{0\.04\}L\-VQVAELVQMark1\.00\\mathbf\{1\.00\}0\.990\.980\.00\\mathbf\{0\.00\}−0\.25\-0\.250\.04\+1\.10\+1\.100\.02\+0\.38\+0\.380\.07\\mathbf\{0\.07\}0\.01\\mathbf\{0\.01\}0\.11¯\\underline\{0\.11\}0\.04\\mathbf\{0\.04\}ETThDiffusionTSTR1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}\+0\.95\+0\.951\.00\+10\.84\+10\.841\.00\+15\.97\+15\.971\.560\.180\.270\.14¯\\underline\{0\.14\}GS1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\+12\.01\+12\.011\.00\+18\.58\+18\.581\.00\+6\.96\+6\.964\.660\.420\.380\.19TimeWak1\.00\\mathbf\{1\.00\}0\.481\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}−0\.34\-0\.340\.02\+1\.05\+1\.050\.00\\mathbf\{0\.00\}−1\.68\-1\.680\.230\.210\.080\.12\\mathbf\{0\.12\}SDformerLVQMark0\.980\.030\.070\.01\+0\.79\+0\.790\.01\\mathbf\{0\.01\}\+0\.18\+0\.180\.00\\mathbf\{0\.00\}\+0\.70\+0\.700\.13¯\\underline\{0\.13\}0\.08¯\\underline\{0\.08\}0\.04¯\\underline\{0\.04\}0\.12\\mathbf\{0\.12\}L\-VQVAELVQMark1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}\+0\.03\+0\.030\.01\\mathbf\{0\.01\}\+0\.41\+0\.410\.00\\mathbf\{0\.00\}−0\.15\-0\.150\.05\\mathbf\{0\.05\}0\.05\\mathbf\{0\.05\}0\.02\\mathbf\{0\.02\}0\.12\\mathbf\{0\.12\}EnergyDiffusionTSTR0\.001\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}\+0\.43\+0\.431\.00\+39\.25\+39\.251\.00\+26\.77\+26\.770\.432\.660\.410\.30¯\\underline\{0\.30\}GS1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\+13\.17\+13\.171\.00\+65\.49\+65\.491\.00\+14\.31\+14\.311\.583\.370\.490\.33TimeWak1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}\+0\.33\+0\.330\.99\+6\.03\+6\.030\.00\\mathbf\{0\.00\}−1\.22\-1\.220\.09¯\\underline\{0\.09\}1\.530\.14¯\\underline\{0\.14\}0\.25\\mathbf\{0\.25\}SDformerLVQMark1\.00\\mathbf\{1\.00\}0\.761\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}\+0\.29\+0\.290\.07\+1\.48\+1\.480\.00\\mathbf\{0\.00\}\+0\.32\+0\.320\.121\.27¯\\underline\{1\.27\}0\.230\.25\\mathbf\{0\.25\}L\-VQVAELVQMark1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}−0\.16\-0\.160\.00\\mathbf\{0\.00\}−0\.19\-0\.190\.00\\mathbf\{0\.00\}−0\.03\-0\.030\.03\\mathbf\{0\.03\}1\.02\\mathbf\{1\.02\}0\.09\\mathbf\{0\.09\}0\.25\\mathbf\{0\.25\}fMRIDiffusionTSTR0\.040\.000\.000\.00\\mathbf\{0\.00\}\+0\.42\+0\.420\.00\\mathbf\{0\.00\}\+1\.00\+1\.001\.00\+4\.89\+4\.892\.2613\.420\.500\.15GS1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.24\+2\.33\+2\.330\.00\\mathbf\{0\.00\}−2\.26\-2\.260\.00\\mathbf\{0\.00\}−6\.16\-6\.160\.7115\.210\.500\.11¯\\underline\{0\.11\}TimeWak1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}\+0\.19\+0\.190\.22\+2\.39\+2\.390\.00\\mathbf\{0\.00\}\+0\.26\+0\.260\.18\\mathbf\{0\.18\}1\.98¯\\underline\{1\.98\}0\.09\\mathbf\{0\.09\}0\.10\\mathbf\{0\.10\}SDformerLVQMark1\.00\\mathbf\{1\.00\}0\.991\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}\+0\.14\+0\.140\.01−0\.41\-0\.410\.01\+0\.01\+0\.010\.943\.250\.21¯\\underline\{0\.21\}0\.10\\mathbf\{0\.10\}L\-VQVAELVQMark1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}\+0\.11\+0\.110\.02−0\.23\-0\.230\.00\\mathbf\{0\.00\}−0\.05\-0\.050\.20¯\\underline\{0\.20\}1\.92\\mathbf\{1\.92\}0\.230\.10\\mathbf\{0\.10\}

Table 12:Results of synthetic time series watermark detection and quality\. Watermarked \(TPR\) and Non\-watermarked \(FPR, mean z\-score\) detections are evaluated under 30% attacks\. Quality metrics are for 128\-length\. Best results are in bold, and second\-best are underlined\. Z\-scores with\|z\|\>3\.09\|z\|\>3\.09are marked inred\.SettingWatermark \(TPR↑\\uparrow\)Non\-watermarked \(FPR↓\\downarrow\| Z\-score\)Quality Metric \(↓\\downarrow\)DatasetModelMethodOffsetCropInsertOffsetCropInsertC\-FIDCorr\.Disc\.Pred\.StocksDiffusionTSTR0\.001\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}\+0\.30\+0\.301\.00\+84\.66\+84\.661\.00\+20\.60\+20\.603\.050\.090\.240\.04\\mathbf\{0\.04\}GS1\.00\\mathbf\{1\.00\}0\.041\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}−4\.40\-4\.400\.00\\mathbf\{0\.00\}−10\.04\-10\.040\.00\\mathbf\{0\.00\}−5\.22\-5\.222\.630\.04¯\\underline\{0\.04\}0\.190\.04\\mathbf\{0\.04\}TimeWak1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}−0\.16\-0\.160\.00\\mathbf\{0\.00\}−4\.18\-4\.180\.69\+3\.74\+3\.740\.340\.01\\mathbf\{0\.01\}0\.15¯\\underline\{0\.15\}0\.04\\mathbf\{0\.04\}SDformerLVQMark0\.000\.000\.000\.00\\mathbf\{0\.00\}−0\.54\-0\.540\.00\\mathbf\{0\.00\}−0\.89\-0\.890\.00\\mathbf\{0\.00\}−1\.20\-1\.200\.12¯\\underline\{0\.12\}0\.01\\mathbf\{0\.01\}0\.03\\mathbf\{0\.03\}0\.04\\mathbf\{0\.04\}L\-VQVAELVQMark1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}\+0\.09\+0\.090\.00\\mathbf\{0\.00\}−0\.09\-0\.090\.00\\mathbf\{0\.00\}\+0\.23\+0\.230\.08\\mathbf\{0\.08\}0\.01\\mathbf\{0\.01\}0\.180\.04\\mathbf\{0\.04\}ETThDiffusionTSTR0\.001\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}\+1\.52\+1\.521\.00\+12\.19\+12\.191\.00\+36\.77\+36\.772\.520\.260\.300\.13¯\\underline\{0\.13\}GS1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}−6\.09\-6\.090\.00\\mathbf\{0\.00\}−13\.71\-13\.710\.00\\mathbf\{0\.00\}−6\.37\-6\.375\.590\.230\.390\.15TimeWak1\.00\\mathbf\{1\.00\}0\.921\.00\\mathbf\{1\.00\}0\.02\+1\.09\+1\.090\.00\\mathbf\{0\.00\}−1\.63\-1\.630\.00\\mathbf\{0\.00\}\+0\.77\+0\.771\.08¯\\underline\{1\.08\}0\.18¯\\underline\{0\.18\}0\.150\.11\\mathbf\{0\.11\}SDformerLVQMark0\.140\.040\.040\.00\\mathbf\{0\.00\}\+0\.53\+0\.530\.01\+0\.76\+0\.760\.00\\mathbf\{0\.00\}\+1\.01\+1\.010\.04\\mathbf\{0\.04\}0\.05\\mathbf\{0\.05\}0\.03¯\\underline\{0\.03\}0\.11\\mathbf\{0\.11\}L\-VQVAELVQMark1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}−0\.04\-0\.040\.00\\mathbf\{0\.00\}−0\.05\-0\.050\.00\\mathbf\{0\.00\}−0\.30\-0\.300\.04\\mathbf\{0\.04\}0\.05\\mathbf\{0\.05\}0\.02\\mathbf\{0\.02\}0\.11\\mathbf\{0\.11\}EnergyDiffusionTSTR0\.001\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}\+2\.20\+2\.201\.00\+61\.47\+61\.471\.00\+98\.65\+98\.650\.501\.650\.490\.28GS1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\+15\.43\+15\.431\.00\+48\.30\+48\.301\.00\+27\.89\+27\.893\.343\.590\.480\.29TimeWak1\.00\\mathbf\{1\.00\}0\.101\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}−1\.57\-1\.570\.00\\mathbf\{0\.00\}−0\.78\-0\.780\.00\\mathbf\{0\.00\}\+0\.66\+0\.660\.171\.500\.240\.25¯\\underline\{0\.25\}SDformerLVQMark1\.00\\mathbf\{1\.00\}0\.000\.320\.00\\mathbf\{0\.00\}\+0\.06\+0\.060\.00\\mathbf\{0\.00\}−0\.65\-0\.650\.00\\mathbf\{0\.00\}−0\.08\-0\.080\.04¯\\underline\{0\.04\}0\.67\\mathbf\{0\.67\}0\.05\\mathbf\{0\.05\}0\.25¯\\underline\{0\.25\}L\-VQVAELVQMark1\.00\\mathbf\{1\.00\}0\.991\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}−0\.03\-0\.030\.02\+0\.00\+0\.000\.00\\mathbf\{0\.00\}\+0\.13\+0\.130\.03\\mathbf\{0\.03\}0\.74¯\\underline\{0\.74\}0\.19¯\\underline\{0\.19\}0\.24\\mathbf\{0\.24\}fMRIDiffusionTSTR0\.001\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}\+0\.02\+0\.021\.00\+6\.33\+6\.331\.00\+21\.25\+21\.254\.5714\.150\.450\.17GS1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}−0\.70\-0\.700\.00\\mathbf\{0\.00\}−57\.42\-57\.420\.07\+0\.52\+0\.521\.055\.970\.500\.11TimeWak1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}−0\.07\-0\.070\.00\\mathbf\{0\.00\}−3\.03\-3\.030\.00\\mathbf\{0\.00\}−1\.95\-1\.950\.811\.810\.360\.10¯\\underline\{0\.10\}SDformerLVQMark0\.100\.020\.030\.00\\mathbf\{0\.00\}−0\.03\-0\.030\.01−0\.25\-0\.250\.00\\mathbf\{0\.00\}−0\.15\-0\.150\.09\\mathbf\{0\.09\}0\.84\\mathbf\{0\.84\}0\.16¯\\underline\{0\.16\}0\.08\\mathbf\{0\.08\}L\-VQVAELVQMark1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}−0\.09\-0\.090\.00\\mathbf\{0\.00\}\+0\.16\+0\.160\.00\\mathbf\{0\.00\}−0\.01\-0\.010\.13¯\\underline\{0\.13\}0\.90¯\\underline\{0\.90\}0\.06\\mathbf\{0\.06\}0\.08\\mathbf\{0\.08\}

##### Generation quality

Tables[13](https://arxiv.org/html/2608.19727#A4.T13)and[14](https://arxiv.org/html/2608.19727#A4.T14)show the generation quality results for sequence lengths 24 and 128, respectively\. L\-VQVAE remains competitive in quality while improving watermark reliability under attack\.

Table 13:Results of synthetic time series quality for 24\-length sequences\. Best results are in bold, and second\-best are underlined\.StocksEnergyETThfMRIModelC\-FIDCorr\.Disc\.Pred\.C\-FIDCorr\.Disc\.Pred\.C\-FIDCorr\.Disc\.Pred\.C\-FIDCorr\.Disc\.Pred\.TimeVQVAE0\.5070\.0490\.3610\.047¯\\underline\{0\.047\}2\.5276\.6320\.4760\.3834\.4170\.2630\.4150\.19912\.53261\.5990\.4590\.156DiffusionTS0\.3290\.0220\.1600\.037\\mathbf\{0\.037\}0\.0871\.5340\.1370\.253¯\\underline\{0\.253\}0\.2310\.2120\.0780\.1210\.1811\.9760\.085¯\\underline\{0\.085\}0\.100SDformer0\.028\\mathbf\{0\.028\}0\.009\\mathbf\{0\.009\}0\.023\\mathbf\{0\.023\}0\.037\\mathbf\{0\.037\}0\.030¯\\underline\{0\.030\}1\.088¯\\underline\{1\.088\}0\.093¯\\underline\{0\.093\}0\.252\\mathbf\{0\.252\}0\.036¯\\underline\{0\.036\}0\.066¯\\underline\{0\.066\}0\.010\\mathbf\{0\.010\}0\.120¯\\underline\{0\.120\}0\.114¯\\underline\{0\.114\}1\.833\\mathbf\{1\.833\}0\.056\\mathbf\{0\.056\}0\.092\\mathbf\{0\.092\}L\-VQVAE0\.034¯\\underline\{0\.034\}0\.010¯\\underline\{0\.010\}0\.140¯\\underline\{0\.140\}0\.037\\mathbf\{0\.037\}0\.018\\mathbf\{0\.018\}1\.008\\mathbf\{1\.008\}0\.033\\mathbf\{0\.033\}0\.252\\mathbf\{0\.252\}0\.029\\mathbf\{0\.029\}0\.052\\mathbf\{0\.052\}0\.018¯\\underline\{0\.018\}0\.117\\mathbf\{0\.117\}0\.105\\mathbf\{0\.105\}1\.875¯\\underline\{1\.875\}0\.2090\.095¯\\underline\{0\.095\}

Table 14:Results of synthetic time series quality for 128\-length sequences\. Best results are in bold, and second\-best are underlined\.StocksEnergyETThfMRIModelC\-FIDCorr\.Disc\.Pred\.C\-FIDCorr\.Disc\.Pred\.C\-FIDCorr\.Disc\.Pred\.C\-FIDCorr\.Disc\.Pred\.TimeVQVAE0\.2930\.0870\.1350\.0397\.7386\.6310\.4980\.3442\.2050\.2510\.2560\.14330\.67245\.6920\.2500\.149DiffusionTS0\.3440\.014¯\\underline\{0\.014\}0\.1520\.037¯\\underline\{0\.037\}0\.1691\.5050\.2350\.2491\.0750\.1750\.1450\.113¯\\underline\{0\.113\}0\.8101\.8120\.3570\.100SDformer0\.128¯\\underline\{0\.128\}0\.013\\mathbf\{0\.013\}0\.032\\mathbf\{0\.032\}0\.036\\mathbf\{0\.036\}0\.032¯\\underline\{0\.032\}0\.708\\mathbf\{0\.708\}0\.057\\mathbf\{0\.057\}0\.244\\mathbf\{0\.244\}0\.032\\mathbf\{0\.032\}0\.050\\mathbf\{0\.050\}0\.062¯\\underline\{0\.062\}0\.113¯\\underline\{0\.113\}0\.064\\mathbf\{0\.064\}0\.801\\mathbf\{0\.801\}0\.176¯\\underline\{0\.176\}0\.080\\mathbf\{0\.080\}L\-VQVAE0\.038\\mathbf\{0\.038\}0\.013\\mathbf\{0\.013\}0\.035¯\\underline\{0\.035\}0\.036\\mathbf\{0\.036\}0\.031\\mathbf\{0\.031\}0\.733¯\\underline\{0\.733\}0\.155¯\\underline\{0\.155\}0\.246¯\\underline\{0\.246\}0\.039¯\\underline\{0\.039\}0\.052¯\\underline\{0\.052\}0\.025\\mathbf\{0\.025\}0\.107\\mathbf\{0\.107\}0\.096¯\\underline\{0\.096\}0\.895¯\\underline\{0\.895\}0\.054\\mathbf\{0\.054\}0\.082¯\\underline\{0\.082\}

### D\.2Component Analysis and Ablations

##### Effect of watermark scheduling

Tables[15](https://arxiv.org/html/2608.19727#A4.T15)and[16](https://arxiv.org/html/2608.19727#A4.T16)extend the scheduling ablation in Section[4\.3](https://arxiv.org/html/2608.19727#S4.SS3.SSS0.Px1)to other sequence lengths\. We compare the default configuration against variants without unbiased warm\-up \(no\-warmup\) and without both alternating partition and unbiased warm\-up \(no\-alt\-warmup\)\. Overall, the default configuration yields the most consistent quality across datasets, and the degradation is typically larger when both components are removed\. These trends are broadly consistent with the main results at 64\-length\.

Table 15:Ablation of watermark scheduling components for 24\-length sequences \(LVQMark\)\.no\-warmup: unbiased warm\-up removed\.no\-alt\-warmup: both alternating partition and unbiased warm\-up removed\. Best results are in bold, and second\-best are underlined\.StocksEnergyETThfMRIVariantC\-FIDCorr\.Disc\.Pred\.C\-FIDCorr\.Disc\.Pred\.C\-FIDCorr\.Disc\.Pred\.C\-FIDCorr\.Disc\.Pred\.no\-alt\-warmup0\.2110\.0140\.141¯\\underline\{0\.141\}0\.037\\mathbf\{0\.037\}0\.0811\.1720\.1510\.2540\.1800\.1130\.0660\.123¯\\underline\{0\.123\}0\.4192\.3500\.2980\.101no\-warmup0\.160¯\\underline\{0\.160\}0\.013¯\\underline\{0\.013\}0\.2240\.037\\mathbf\{0\.037\}0\.060¯\\underline\{0\.060\}1\.063¯\\underline\{1\.063\}0\.130¯\\underline\{0\.130\}0\.253¯\\underline\{0\.253\}0\.093¯\\underline\{0\.093\}0\.059¯\\underline\{0\.059\}0\.039¯\\underline\{0\.039\}0\.123¯\\underline\{0\.123\}0\.346¯\\underline\{0\.346\}2\.067¯\\underline\{2\.067\}0\.296¯\\underline\{0\.296\}0\.098¯\\underline\{0\.098\}LVQMark0\.074\\mathbf\{0\.074\}0\.007\\mathbf\{0\.007\}0\.110\\mathbf\{0\.110\}0\.037\\mathbf\{0\.037\}0\.028\\mathbf\{0\.028\}1\.022\\mathbf\{1\.022\}0\.090\\mathbf\{0\.090\}0\.252\\mathbf\{0\.252\}0\.046\\mathbf\{0\.046\}0\.048\\mathbf\{0\.048\}0\.021\\mathbf\{0\.021\}0\.117\\mathbf\{0\.117\}0\.200\\mathbf\{0\.200\}1\.920\\mathbf\{1\.920\}0\.229\\mathbf\{0\.229\}0\.097\\mathbf\{0\.097\}

Table 16:Ablation of watermark scheduling components for 128\-length sequences \(LVQMark\)\.no\-warmup: unbiased warm\-up removed\.no\-alt\-warmup: both alternating partition and unbiased warm\-up removed\. Best results are in bold, and second\-best are underlined\.StocksEnergyETThfMRIVariantC\-FIDCorr\.Disc\.Pred\.C\-FIDCorr\.Disc\.Pred\.C\-FIDCorr\.Disc\.Pred\.C\-FIDCorr\.Disc\.Pred\.no\-alt\-warmup0\.1850\.008¯\\underline\{0\.008\}0\.148¯\\underline\{0\.148\}0\.036\\mathbf\{0\.036\}0\.0930\.8690\.2350\.2470\.1660\.0830\.0350\.111¯\\underline\{0\.111\}0\.2571\.0230\.1340\.084¯\\underline\{0\.084\}no\-warmup0\.095¯\\underline\{0\.095\}0\.007\\mathbf\{0\.007\}0\.120\\mathbf\{0\.120\}0\.036\\mathbf\{0\.036\}0\.066¯\\underline\{0\.066\}0\.774¯\\underline\{0\.774\}0\.200¯\\underline\{0\.200\}0\.246¯\\underline\{0\.246\}0\.073¯\\underline\{0\.073\}0\.063¯\\underline\{0\.063\}0\.027¯\\underline\{0\.027\}0\.108\\mathbf\{0\.108\}0\.198¯\\underline\{0\.198\}0\.900¯\\underline\{0\.900\}0\.086¯\\underline\{0\.086\}0\.084¯\\underline\{0\.084\}LVQMark0\.079\\mathbf\{0\.079\}0\.0090\.1790\.036\\mathbf\{0\.036\}0\.033\\mathbf\{0\.033\}0\.740\\mathbf\{0\.740\}0\.190\\mathbf\{0\.190\}0\.244\\mathbf\{0\.244\}0\.042\\mathbf\{0\.042\}0\.050\\mathbf\{0\.050\}0\.021\\mathbf\{0\.021\}0\.108\\mathbf\{0\.108\}0\.127\\mathbf\{0\.127\}0\.896\\mathbf\{0\.896\}0\.060\\mathbf\{0\.060\}0\.082\\mathbf\{0\.082\}

##### Effect of local tokenization on robust detection

Tables[17](https://arxiv.org/html/2608.19727#A4.T17)and[18](https://arxiv.org/html/2608.19727#A4.T18)extend the analysis of Section[4\.3](https://arxiv.org/html/2608.19727#S4.SS3.SSS0.Px2)to other sequence lengths by comparing models with and without robust encoder\. These results show that robust re\-encoding alone is insufficient without a locally recoverable token representation\.

Table 17:Results of watermark detection under attack for 24\-length sequences\. LVQMark is applied to different variants, and watermark detection performance \(TPR\) is evaluated under 30% attacks\. Best results are in bold, and second\-best are underlined\.StocksEnergyETThfMRIModelTypeOffsetCropInsertOffsetCropInsertOffsetCropInsertOffsetCropInsertSDformerw/o Robust0\.13¯\\underline\{0\.13\}0\.81¯\\underline\{0\.81\}0\.221\.00\\mathbf\{1\.00\}0\.76¯\\underline\{0\.76\}1\.00\\mathbf\{1\.00\}0\.98¯\\underline\{0\.98\}0\.030\.071\.00\\mathbf\{1\.00\}0\.99¯\\underline\{0\.99\}1\.00\\mathbf\{1\.00\}w/ Robust0\.070\.200\.081\.00\\mathbf\{1\.00\}0\.681\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.57¯\\underline\{0\.57\}0\.96¯\\underline\{0\.96\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}L\-VQVAEw/o Robust1\.00\\mathbf\{1\.00\}0\.210\.35¯\\underline\{0\.35\}1\.00\\mathbf\{1\.00\}0\.001\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.011\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}w/ Robust1\.00\\mathbf\{1\.00\}0\.99\\mathbf\{0\.99\}0\.98\\mathbf\{0\.98\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}

Table 18:Results of watermark detection under attack for 128\-length sequences\. LVQMark is applied to different variants, and watermark detection performance \(TPR\) is evaluated under 30% attacks\. Best results are in bold, and second\-best are underlined\.StocksEnergyETThfMRIModelTypeOffsetCropInsertOffsetCropInsertOffsetCropInsertOffsetCropInsertSDformerw/o Robust0\.00¯\\underline\{0\.00\}0\.00¯\\underline\{0\.00\}0\.00¯\\underline\{0\.00\}1\.00\\mathbf\{1\.00\}0\.000\.320\.140\.040\.040\.10¯\\underline\{0\.10\}0\.02¯\\underline\{0\.02\}0\.03¯\\underline\{0\.03\}w/ Robust0\.00¯\\underline\{0\.00\}0\.00¯\\underline\{0\.00\}0\.00¯\\underline\{0\.00\}1\.00\\mathbf\{1\.00\}0\.20¯\\underline\{0\.20\}0\.85¯\\underline\{0\.85\}0\.41¯\\underline\{0\.41\}0\.11¯\\underline\{0\.11\}0\.29¯\\underline\{0\.29\}0\.050\.010\.01L\-VQVAEw/o Robust1\.00\\mathbf\{1\.00\}00\.991\.000\.000\.811\.000\.001\.001\.001\.000\.62w/ Robust1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.99\\mathbf\{0\.99\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}

## Appendix EExperimental Results Under Mild Attack

While the main paper reports results under the stronger 30% attack setting, this section provides the corresponding results under milder 5% attacks\. We include the full detection and quality results, the robust\-encoder ablations in order to examine whether the main observations are specific to strong perturbations\. Overall, the results are broadly consistent with the main findings: although the attack\-induced distortion is often smaller than in the 30% setting, the relative pattern across methods remains largely unchanged\.

### E\.1Watermark Detection

Tables[19](https://arxiv.org/html/2608.19727#A5.T19)–[21](https://arxiv.org/html/2608.19727#A5.T21)show that the qualitative conclusions of the main paper remain unchanged under the milder 5% attack setting\. Compared with the 30% setting, the attack\-induced distortion is generally smaller in magnitude, but the relative pattern across methods remains largely the same\. Across sequence lengths, L\-VQVAE with LVQMark continues to achieve strong watermark detection on watermarked samples while keeping the false\-positive rate on attacked non\-watermarked samples consistently low\. The corresponding non\-watermarked Z\-scores also remain close to the intended null region, indicating that the detector also stays well calibrated under mild post\-editing attacks\. By contrast, the baseline methods still exhibit post\-editing\-dependent instability, showing that the calibration problem is not limited to severe attacks but can already arise under small perturbations\. Overall, these results suggest that mild attacks reduce, but do not eliminate, the robustness gap observed in the 30% setting\.

Table 19:Results of synthetic time series watermark detection and quality\. Watermarked \(TPR\) and Non\-watermarked \(FPR, mean z\-score\) detections are evaluated under 5% attacks\. Quality metrics are for 24\-length\. Best results are in bold, and second\-best are underlined\. Z\-scores with\|z\|\>3\.09\|z\|\>3\.09are marked inred\.SettingWatermark \(TPR↑\\uparrow\)Non\-watermarked \(FPR↓\\downarrow\| Z\-score\)Quality Metric \(↓\\downarrow\)DatasetModelMethodOffsetCropInsertOffsetCropInsertC\-FIDCorr\.Disc\.Pred\.StocksDiffusionTSTR0\.001\.00\\mathbf\{1\.00\}0\.000\.00\\mathbf\{0\.00\}\+0\.06\+0\.061\.00\+52\.15\+52\.150\.00\\mathbf\{0\.00\}\+0\.41\+0\.410\.960\.100\.200\.04\\mathbf\{0\.04\}GS1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}−0\.27\-0\.271\.00\+22\.14\+22\.140\.43\+2\.88\+2\.888\.880\.090\.430\.04\\mathbf\{0\.04\}TimeWak1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}−0\.20\-0\.201\.00\+9\.36\+9\.360\.00\\mathbf\{0\.00\}\+0\.58\+0\.580\.330\.02¯\\underline\{0\.02\}0\.160\.04\\mathbf\{0\.04\}SDformerLVQMark0\.190\.440\.720\.00\\mathbf\{0\.00\}\+0\.19\+0\.190\.53\+3\.11\+3\.110\.00\\mathbf\{0\.00\}\+0\.22\+0\.220\.11¯\\underline\{0\.11\}0\.01\\mathbf\{0\.01\}0\.02\\mathbf\{0\.02\}0\.04\\mathbf\{0\.04\}L\-VQVAELVQMark1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}\+0\.11\+0\.110\.02\\mathbf\{0\.02\}\+0\.43\+0\.430\.00\\mathbf\{0\.00\}\+0\.09\+0\.090\.07\\mathbf\{0\.07\}0\.01\\mathbf\{0\.01\}0\.11¯\\underline\{0\.11\}0\.04\\mathbf\{0\.04\}ETThDiffusionTSTR1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}\+0\.19\+0\.191\.00\+10\.11\+10\.111\.00\+4\.78\+4\.781\.560\.180\.270\.14¯\\underline\{0\.14\}GS1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.18\+2\.17\+2\.170\.00\\mathbf\{0\.00\}−10\.53\-10\.530\.14\+2\.02\+2\.024\.660\.420\.380\.18TimeWak1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}−0\.26\-0\.260\.00\\mathbf\{0\.00\}\+0\.77\+0\.770\.00\\mathbf\{0\.00\}−0\.34\-0\.340\.230\.210\.080\.12\\mathbf\{0\.12\}SDformerLVQMark1\.00\\mathbf\{1\.00\}0\.011\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}\+0\.15\+0\.150\.00\\mathbf\{0\.00\}\+0\.10\+0\.100\.00\\mathbf\{0\.00\}\+0\.29\+0\.290\.13¯\\underline\{0\.13\}0\.08¯\\underline\{0\.08\}0\.04¯\\underline\{0\.04\}0\.12\\mathbf\{0\.12\}L\-VQVAELVQMark1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}\+0\.28\+0\.280\.00\\mathbf\{0\.00\}\+0\.13\+0\.130\.00\\mathbf\{0\.00\}−0\.14\-0\.140\.05\\mathbf\{0\.05\}0\.05\\mathbf\{0\.05\}0\.02\\mathbf\{0\.02\}0\.12\\mathbf\{0\.12\}EnergyDiffusionTSTR0\.001\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}\+0\.03\+0\.031\.00\+36\.66\+36\.661\.00\+9\.01\+9\.010\.432\.660\.410\.30¯\\underline\{0\.30\}GS1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.59\+3\.33\+3\.331\.00\+43\.84\+43\.840\.48\+3\.17\+3\.171\.583\.370\.490\.33TimeWak1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}−1\.43\-1\.431\.00\+5\.79\+5\.790\.00\\mathbf\{0\.00\}−0\.44\-0\.440\.09¯\\underline\{0\.09\}1\.530\.14¯\\underline\{0\.14\}0\.25\\mathbf\{0\.25\}SDformerLVQMark1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}−0\.22\-0\.220\.00\\mathbf\{0\.00\}\+0\.15\+0\.150\.00\\mathbf\{0\.00\}\+0\.42\+0\.420\.121\.27¯\\underline\{1\.27\}0\.230\.25\\mathbf\{0\.25\}L\-VQVAELVQMark1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}−0\.11\-0\.110\.01−0\.02\-0\.020\.00\\mathbf\{0\.00\}−0\.05\-0\.050\.03\\mathbf\{0\.03\}1\.02\\mathbf\{1\.02\}0\.09\\mathbf\{0\.09\}0\.25\\mathbf\{0\.25\}fMRIDiffusionTSTR1\.00\\mathbf\{1\.00\}0\.000\.000\.00\\mathbf\{0\.00\}\+0\.06\+0\.060\.00\\mathbf\{0\.00\}\+0\.20\+0\.200\.00\\mathbf\{0\.00\}\+0\.70\+0\.702\.2613\.420\.500\.15GS1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}\+0\.58\+0\.580\.20\+2\.37\+2\.370\.00\\mathbf\{0\.00\}−0\.42\-0\.420\.7115\.210\.500\.11¯\\underline\{0\.11\}TimeWak1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}−0\.09\-0\.090\.00\\mathbf\{0\.00\}−1\.07\-1\.070\.00\\mathbf\{0\.00\}−0\.28\-0\.280\.18\\mathbf\{0\.18\}1\.98¯\\underline\{1\.98\}0\.08\\mathbf\{0\.08\}0\.10\\mathbf\{0\.10\}SDformerLVQMark1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}−0\.08\-0\.080\.00\\mathbf\{0\.00\}−0\.36\-0\.360\.00\\mathbf\{0\.00\}−0\.07\-0\.070\.943\.240\.21¯\\underline\{0\.21\}0\.10\\mathbf\{0\.10\}L\-VQVAELVQMark1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}\+0\.07\+0\.070\.00\\mathbf\{0\.00\}−0\.11\-0\.110\.00\\mathbf\{0\.00\}−0\.14\-0\.140\.20¯\\underline\{0\.20\}1\.92\\mathbf\{1\.92\}0\.230\.10\\mathbf\{0\.10\}

Table 20:Results of synthetic time series watermark detection and quality\. Watermarked \(TPR\) and Non\-watermarked \(FPR, mean z\-score\) detections are evaluated under 5% attacks\. Quality metrics are for 64\-length\. Best results are in bold, and second\-best are underlined\. Z\-scores with\|z\|\>3\.09\|z\|\>3\.09are marked inred\.SettingWatermark \(TPR↑\\uparrow\)Non\-watermarked \(FPR↓\\downarrow\| Z\-score\)Quality Metric \(↓\\downarrow\)DatasetModelMethodOffsetCropInsertOffsetCropInsertC\-FIDCorr\.Disc\.Pred\.StocksDiffusionTSTR0\.001\.00\\mathbf\{1\.00\}0\.000\.00\\mathbf\{0\.00\}\+0\.06\+0\.061\.00\+55\.65\+55\.650\.00\\mathbf\{0\.00\}\+2\.06\+2\.061\.520\.070\.150\.04\\mathbf\{0\.04\}GS1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}−0\.35\-0\.350\.00\\mathbf\{0\.00\}−4\.62\-4\.620\.05\+1\.55\+1\.551\.500\.02¯\\underline\{0\.02\}0\.220\.04\\mathbf\{0\.04\}TimeWak1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}−0\.12\-0\.120\.29\+2\.56\+2\.560\.00\\mathbf\{0\.00\}\+0\.11\+0\.110\.290\.01\\mathbf\{0\.01\}0\.130\.04\\mathbf\{0\.04\}SDformerLVQMark0\.010\.030\.010\.00\\mathbf\{0\.00\}−0\.17\-0\.170\.00\\mathbf\{0\.00\}\+0\.58\+0\.580\.01\+0\.32\+0\.320\.08¯\\underline\{0\.08\}0\.01\\mathbf\{0\.01\}0\.01\\mathbf\{0\.01\}0\.04\\mathbf\{0\.04\}L\-VQVAELVQMark1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}−0\.33\-0\.330\.00\\mathbf\{0\.00\}\+0\.08\+0\.080\.00\\mathbf\{0\.00\}\+0\.30\+0\.300\.07\\mathbf\{0\.07\}0\.01\\mathbf\{0\.01\}0\.06¯\\underline\{0\.06\}0\.04\\mathbf\{0\.04\}ETThDiffusionTSTR1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}\+0\.21\+0\.211\.00\+14\.18\+14\.181\.00\+12\.70\+12\.702\.170\.220\.290\.14¯\\underline\{0\.14\}GS1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}−0\.29\-0\.290\.00\\mathbf\{0\.00\}−29\.58\-29\.580\.00\\mathbf\{0\.00\}−1\.60\-1\.603\.430\.250\.360\.16TimeWak1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.01\+0\.19\+0\.190\.90\+4\.08\+4\.080\.00\\mathbf\{0\.00\}\+0\.23\+0\.230\.370\.130\.110\.12\\mathbf\{0\.12\}SDformerLVQMark0\.270\.000\.060\.01\+0\.25\+0\.250\.00\\mathbf\{0\.00\}−0\.27\-0\.270\.00\\mathbf\{0\.00\}−0\.11\-0\.110\.04¯\\underline\{0\.04\}0\.05\\mathbf\{0\.05\}0\.00\\mathbf\{0\.00\}0\.12\\mathbf\{0\.12\}L\-VQVAELVQMark1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}−0\.17\-0\.170\.00\\mathbf\{0\.00\}−0\.07\-0\.070\.01\+0\.22\+0\.220\.03\\mathbf\{0\.03\}0\.06¯\\underline\{0\.06\}0\.01¯\\underline\{0\.01\}0\.12\\mathbf\{0\.12\}EnergyDiffusionTSTR0\.001\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}\+0\.05\+0\.051\.00\+50\.50\+50\.501\.00\+21\.61\+21\.610\.581\.980\.430\.28¯\\underline\{0\.28\}GS1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.07\+1\.21\+1\.211\.00\+11\.15\+11\.150\.37\+2\.71\+2\.711\.782\.720\.480\.31TimeWak1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}−1\.26\-1\.260\.00\\mathbf\{0\.00\}−1\.42\-1\.420\.00\\mathbf\{0\.00\}−0\.84\-0\.840\.14¯\\underline\{0\.14\}1\.520\.14¯\\underline\{0\.14\}0\.25\\mathbf\{0\.25\}SDformerLVQMark1\.00\\mathbf\{1\.00\}0\.461\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}\+0\.06\+0\.060\.00\\mathbf\{0\.00\}\+0\.23\+0\.230\.00\\mathbf\{0\.00\}\+0\.07\+0\.070\.04\\mathbf\{0\.04\}1\.04¯\\underline\{1\.04\}0\.08\\mathbf\{0\.08\}0\.25\\mathbf\{0\.25\}L\-VQVAELVQMark1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}−0\.06\-0\.060\.01\+0\.02\+0\.020\.01\+0\.17\+0\.170\.04\\mathbf\{0\.04\}0\.94\\mathbf\{0\.94\}0\.150\.25\\mathbf\{0\.25\}fMRIDiffusionTSTR1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}\+0\.03\+0\.030\.00\\mathbf\{0\.00\}\+0\.30\+0\.300\.00\\mathbf\{0\.00\}\+2\.25\+2\.253\.6312\.830\.400\.14GS1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}−0\.55\-0\.551\.00\+20\.44\+20\.441\.00\+8\.32\+8\.320\.748\.310\.500\.10¯\\underline\{0\.10\}TimeWak1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}\+0\.09\+0\.090\.13\+1\.96\+1\.960\.01\+0\.60\+0\.600\.45¯\\underline\{0\.45\}1\.870\.25¯\\underline\{0\.25\}0\.10¯\\underline\{0\.10\}SDformerLVQMark0\.240\.290\.240\.00\\mathbf\{0\.00\}\+0\.04\+0\.040\.01\+0\.43\+0\.430\.00\\mathbf\{0\.00\}\+0\.10\+0\.100\.13\\mathbf\{0\.13\}1\.19¯\\underline\{1\.19\}0\.12\\mathbf\{0\.12\}0\.09\\mathbf\{0\.09\}L\-VQVAELVQMark1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}−0\.18\-0\.180\.00\\mathbf\{0\.00\}\+0\.09\+0\.090\.00\\mathbf\{0\.00\}−0\.04\-0\.040\.13\\mathbf\{0\.13\}1\.14\\mathbf\{1\.14\}0\.270\.09\\mathbf\{0\.09\}

Table 21:Results of synthetic time series watermark detection and quality\. Watermarked \(TPR\) and Non\-watermarked \(FPR, mean z\-score\) detections are evaluated under 5% attacks\. Quality metrics are for 128\-length\. Best results are in bold, and second\-best are underlined\. Z\-scores with\|z\|\>3\.09\|z\|\>3\.09are marked inred\.SettingWatermark \(TPR↑\\uparrow\)Non\-watermarked \(FPR↓\\downarrow\| Z\-score\)Quality Metric \(↓\\downarrow\)DatasetModelMethodOffsetCropInsertOffsetCropInsertC\-FIDCorr\.Disc\.Pred\.StocksDiffusionTSTR0\.001\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}\+0\.09\+0\.091\.00\+66\.42\+66\.421\.00\+5\.55\+5\.553\.050\.090\.240\.04\\mathbf\{0\.04\}GS1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}−1\.32\-1\.320\.00\\mathbf\{0\.00\}−3\.91\-3\.910\.00\\mathbf\{0\.00\}−0\.47\-0\.472\.630\.04¯\\underline\{0\.04\}0\.190\.04\\mathbf\{0\.04\}TimeWak1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}−0\.17\-0\.171\.00\+11\.97\+11\.970\.16\+2\.05\+2\.050\.340\.01\\mathbf\{0\.01\}0\.15¯\\underline\{0\.15\}0\.04\\mathbf\{0\.04\}SDformerLVQMark0\.000\.000\.000\.00\\mathbf\{0\.00\}−0\.82\-0\.820\.00\\mathbf\{0\.00\}−0\.22\-0\.220\.00\\mathbf\{0\.00\}−0\.02\-0\.020\.12¯\\underline\{0\.12\}0\.01\\mathbf\{0\.01\}0\.03\\mathbf\{0\.03\}0\.04\\mathbf\{0\.04\}L\-VQVAELVQMark1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}\+0\.02\+0\.020\.00\\mathbf\{0\.00\}\+0\.16\+0\.160\.01\+0\.15\+0\.150\.08\\mathbf\{0\.08\}0\.01\\mathbf\{0\.01\}0\.180\.04\\mathbf\{0\.04\}ETThDiffusionTSTR0\.001\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}\+0\.28\+0\.281\.00\+11\.00\+11\.001\.00\+11\.88\+11\.882\.520\.260\.300\.13¯\\underline\{0\.13\}GS1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}−0\.93\-0\.930\.00\\mathbf\{0\.00\}−13\.63\-13\.630\.00\\mathbf\{0\.00\}−1\.08\-1\.085\.590\.230\.390\.15TimeWak1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}\+0\.03\+0\.030\.02\+0\.94\+0\.940\.00\\mathbf\{0\.00\}\+0\.40\+0\.401\.08¯\\underline\{1\.08\}0\.17¯\\underline\{0\.17\}0\.150\.11\\mathbf\{0\.11\}SDformerLVQMark0\.520\.030\.100\.00\\mathbf\{0\.00\}−0\.07\-0\.070\.03\+1\.19\+1\.190\.00\\mathbf\{0\.00\}\+0\.53\+0\.530\.04\\mathbf\{0\.04\}0\.05\\mathbf\{0\.05\}0\.03¯\\underline\{0\.03\}0\.11\\mathbf\{0\.11\}L\-VQVAELVQMark1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}−0\.10\-0\.100\.00\\mathbf\{0\.00\}\+0\.16\+0\.160\.00\\mathbf\{0\.00\}\+0\.04\+0\.040\.04\\mathbf\{0\.04\}0\.05\\mathbf\{0\.05\}0\.02\\mathbf\{0\.02\}0\.11\\mathbf\{0\.11\}EnergyDiffusionTSTR0\.001\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}\+0\.04\+0\.041\.00\+58\.72\+58\.721\.00\+37\.10\+37\.100\.501\.650\.490\.28GS1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}\+0\.84\+0\.841\.00\+32\.87\+32\.871\.00\+6\.63\+6\.633\.343\.590\.480\.29TimeWak1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}−0\.82\-0\.820\.00\\mathbf\{0\.00\}−1\.89\-1\.890\.00\\mathbf\{0\.00\}\+0\.58\+0\.580\.171\.500\.240\.25¯\\underline\{0\.25\}SDformerLVQMark1\.00\\mathbf\{1\.00\}0\.141\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}−0\.06\-0\.060\.00\\mathbf\{0\.00\}−0\.61\-0\.610\.00\\mathbf\{0\.00\}\+0\.28\+0\.280\.04¯\\underline\{0\.04\}0\.67\\mathbf\{0\.67\}0\.05\\mathbf\{0\.05\}0\.25¯\\underline\{0\.25\}L\-VQVAELVQMark1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}\+0\.15\+0\.150\.00\\mathbf\{0\.00\}−0\.09\-0\.090\.00\\mathbf\{0\.00\}−0\.01\-0\.010\.03\\mathbf\{0\.03\}0\.74¯\\underline\{0\.74\}0\.19¯\\underline\{0\.19\}0\.24\\mathbf\{0\.24\}fMRIDiffusionTSTR0\.000\.001\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}\+0\.02\+0\.020\.00\\mathbf\{0\.00\}\+1\.37\+1\.371\.00\+3\.98\+3\.984\.5714\.150\.450\.17GS1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}\+0\.04\+0\.040\.00\\mathbf\{0\.00\}−38\.23\-38\.230\.29\+2\.54\+2\.541\.055\.970\.500\.11TimeWak1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}−0\.08\-0\.080\.00\\mathbf\{0\.00\}−0\.90\-0\.900\.00\\mathbf\{0\.00\}−0\.47\-0\.470\.811\.810\.360\.10¯\\underline\{0\.10\}SDformerLVQMark0\.100\.120\.110\.00\\mathbf\{0\.00\}\+0\.06\+0\.060\.00\\mathbf\{0\.00\}\+0\.02\+0\.020\.00\\mathbf\{0\.00\}−0\.00\-0\.000\.09\\mathbf\{0\.09\}0\.84\\mathbf\{0\.84\}0\.16¯\\underline\{0\.16\}0\.08\\mathbf\{0\.08\}L\-VQVAELVQMark1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.00\\mathbf\{0\.00\}−0\.10\-0\.100\.00\\mathbf\{0\.00\}\+0\.25\+0\.250\.00\\mathbf\{0\.00\}−0\.03\-0\.030\.13¯\\underline\{0\.13\}0\.90¯\\underline\{0\.90\}0\.06\\mathbf\{0\.06\}0\.08\\mathbf\{0\.08\}

### E\.2Effect of Local Tokenization on Robust Detection

Tables[22](https://arxiv.org/html/2608.19727#A5.T22)–[24](https://arxiv.org/html/2608.19727#A5.T24)further examine whether robust re\-encoding alone is sufficient in the mild\-attack regime\. The results are consistent with the main\-paper ablation: adding a robust encoder can partially improve detection in some settings, but the gains remain limited and inconsistent when the underlying representation is not locally recoverable\. By contrast, when robust re\-encoding is combined with the local tokenization of L\-VQVAE, detection performance remains uniformly strong across datasets, attacks, and sequence lengths\. This again supports our central claim that robust recovery is not solely a matter of attack\-aware training, but depends fundamentally on a representation whose recovered units remain locally stable under perturbation\.

Table 22:Results of watermark detection under attack for 24\-length sequences\. LVQMark is applied to different variants, and watermark detection performance \(TPR\) is evaluated under 5% attacks\. Best results are in bold, and second\-best are underlined\.StocksEnergyETThfMRIModelTypeOffsetCropInsertOffsetCropInsertOffsetCropInsertOffsetCropInsertSDformerw/o Robust0\.19¯\\underline\{0\.19\}0\.440\.721\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.011\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}w/ Robust0\.080\.570\.241\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}L\-VQVAEw/o Robust1\.00\\mathbf\{1\.00\}0\.78¯\\underline\{0\.78\}0\.86¯\\underline\{0\.86\}1\.00\\mathbf\{1\.00\}0\.76¯\\underline\{0\.76\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.90¯\\underline\{0\.90\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}w/ Robust1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}

Table 23:Results of watermark detection under attack for 64\-length sequences\. LVQMark is applied to different variants, and watermark detection performance \(TPR\) is evaluated under 5% attacks\. Best results are in bold, and second\-best are underlined\.StocksEnergyETThfMRIModelTypeOffsetCropInsertOffsetCropInsertOffsetCropInsertOffsetCropInsertSDformerw/o Robust0\.01¯\\underline\{0\.01\}0\.03¯\\underline\{0\.03\}0\.01¯\\underline\{0\.01\}1\.00\\mathbf\{1\.00\}0\.461\.00\\mathbf\{1\.00\}0\.27¯\\underline\{0\.27\}0\.000\.060\.24¯\\underline\{0\.24\}0\.29¯\\underline\{0\.29\}0\.24¯\\underline\{0\.24\}w/ Robust0\.000\.000\.001\.00\\mathbf\{1\.00\}0\.95¯\\underline\{0\.95\}1\.00\\mathbf\{1\.00\}0\.140\.090\.10¯\\underline\{0\.10\}0\.040\.120\.10L\-VQVAEw/o Robust1\.00\\mathbf\{1\.00\}0\.001\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.031\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.93¯\\underline\{0\.93\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}w/ Robust1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}

Table 24:Results of watermark detection under attack for 128\-length sequences\. LVQMark is applied to different variants, and watermark detection performance \(TPR\) is evaluated under 5% attacks\. Best results are in bold, and second\-best are underlined\.StocksEnergyETThfMRIModelTypeOffsetCropInsertOffsetCropInsertOffsetCropInsertOffsetCropInsertSDformerw/o Robust0\.00¯\\underline\{0\.00\}0\.000\.00¯\\underline\{0\.00\}1\.00\\mathbf\{1\.00\}0\.141\.00\\mathbf\{1\.00\}0\.52¯\\underline\{0\.52\}0\.030\.100\.10¯\\underline\{0\.10\}0\.12¯\\underline\{0\.12\}0\.11¯\\underline\{0\.11\}w/ Robust0\.00¯\\underline\{0\.00\}0\.000\.00¯\\underline\{0\.00\}1\.00\\mathbf\{1\.00\}0\.85¯\\underline\{0\.85\}1\.00\\mathbf\{1\.00\}0\.340\.310\.35¯\\underline\{0\.35\}0\.060\.040\.02L\-VQVAEw/o Robust1\.00\\mathbf\{1\.00\}0\.94¯\\underline\{0\.94\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.021\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}0\.50¯\\underline\{0\.50\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}w/ Robust1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}1\.00\\mathbf\{1\.00\}

## Appendix FDetailed Watermark Detection and Quality Statistics

Tables[25](https://arxiv.org/html/2608.19727#A6.T25)–[27](https://arxiv.org/html/2608.19727#A6.T27)complement the main results by reporting both the mean and the standard deviation of the detection and quality metrics\. For detection, the reported standard deviations summarize the spread of sample\-level Z\-scores under each setting, showing how tightly the detection statistics concentrate around their mean values\. For quality, the reported standard deviations reflect variability across the same five\-run protocol used in the main experiments\. These additional statistics support the same qualitative conclusions as the mean\-only results\. In particular, L\-VQVAE with LVQMark keeps the non\-watermarked Z\-scores centered near the intended null region across attacks and sequence lengths, while the corresponding standard deviations remain moderate, indicating stable calibration at the sample level rather than a mean obtained from offsetting extreme cases\. At the same time, the watermark Z\-scores remain clearly positive and well separated from zero, showing that strong detectability is preserved together with null stability\. By contrast, several baselines continue to exhibit large mean shifts on attacked non\-watermarked samples, and these shifts are typically much larger in magnitude than their corresponding standard deviations, indicating that the observed null drift is systematic rather than attributable to a small subset of atypical samples\. Taken together, these results reinforce the main finding of the paper: the advantage of L\-VQVAE with LVQMark lies not only in achieving favorable mean performance, but also in maintaining a more stable and interpretable detection behavior under attack\.

Table 25:Results of synthetic time series watermark detection and quality\. Watermark and Non\-watermarked detections \(Z\-score\) are evaluated under 30% attacks\. Detection and quality metrics \(mean±\\pmstd\) are for 24\-length\.SettingWatermark \(Z\-score↑\\uparrow\)Non\-watermarked \(Z\-score\)Quality Metric \(↓\\downarrow\)DatasetModelMethodOffsetCropInsertOffsetCropInsertC\-FIDCorr\.Disc\.Pred\.StocksDiffusionTSTR0\.59±0\.030\.59\_\{\\pm 0\.03\}51\.54±0\.6651\.54\_\{\\pm 0\.66\}0\.22±0\.040\.22\_\{\\pm 0\.04\}0\.19±0\.030\.19\_\{\\pm 0\.03\}63\.26±0\.6963\.26\_\{\\pm 0\.69\}1\.91±0\.091\.91\_\{\\pm 0\.09\}0\.96±0\.150\.96\_\{\\pm 0\.15\}0\.10±0\.010\.10\_\{\\pm 0\.01\}0\.20±0\.020\.20\_\{\\pm 0\.02\}0\.04±0\.000\.04\_\{\\pm 0\.00\}GS85\.77±0\.8085\.77\_\{\\pm 0\.80\}3\.11±0\.673\.11\_\{\\pm 0\.67\}52\.58±0\.8052\.58\_\{\\pm 0\.80\}−1\.15±1\.22\-1\.15\_\{\\pm 1\.22\}−6\.32±0\.69\-6\.32\_\{\\pm 0\.69\}0\.16±0\.810\.16\_\{\\pm 0\.81\}8\.88±0\.628\.88\_\{\\pm 0\.62\}0\.09±0\.010\.09\_\{\\pm 0\.01\}0\.43±0\.010\.43\_\{\\pm 0\.01\}0\.04±0\.000\.04\_\{\\pm 0\.00\}TimeWak180\.18±0\.86180\.18\_\{\\pm 0\.86\}11\.24±0\.9411\.24\_\{\\pm 0\.94\}56\.48±1\.1356\.48\_\{\\pm 1\.13\}−0\.99±0\.99\-0\.99\_\{\\pm 0\.99\}1\.39±0\.861\.39\_\{\\pm 0\.86\}−1\.77±1\.03\-1\.77\_\{\\pm 1\.03\}0\.33±0\.030\.33\_\{\\pm 0\.03\}0\.02±0\.010\.02\_\{\\pm 0\.01\}0\.16±0\.020\.16\_\{\\pm 0\.02\}0\.04±0\.000\.04\_\{\\pm 0\.00\}SDformerLVQMark2\.14±0\.962\.14\_\{\\pm 0\.96\}4\.21±1\.194\.21\_\{\\pm 1\.19\}2\.39±0\.942\.39\_\{\\pm 0\.94\}0\.51±0\.910\.51\_\{\\pm 0\.91\}4\.49±1\.284\.49\_\{\\pm 1\.28\}1\.33±0\.821\.33\_\{\\pm 0\.82\}0\.11±0\.020\.11\_\{\\pm 0\.02\}0\.01±0\.000\.01\_\{\\pm 0\.00\}0\.02±0\.020\.02\_\{\\pm 0\.02\}0\.04±0\.000\.04\_\{\\pm 0\.00\}L\-VQVAELVQMark11\.16±1\.1211\.16\_\{\\pm 1\.12\}6\.97±1\.406\.97\_\{\\pm 1\.40\}5\.45±0\.885\.45\_\{\\pm 0\.88\}−0\.25±0\.85\-0\.25\_\{\\pm 0\.85\}1\.10±1\.211\.10\_\{\\pm 1\.21\}0\.38±1\.180\.38\_\{\\pm 1\.18\}0\.07±0\.010\.07\_\{\\pm 0\.01\}0\.01±0\.010\.01\_\{\\pm 0\.01\}0\.11±0\.090\.11\_\{\\pm 0\.09\}0\.04±0\.000\.04\_\{\\pm 0\.00\}ETThDiffusionTSTR3\.70±0\.103\.70\_\{\\pm 0\.10\}11\.62±0\.2511\.62\_\{\\pm 0\.25\}18\.23±0\.3218\.23\_\{\\pm 0\.32\}0\.95±0\.040\.95\_\{\\pm 0\.04\}10\.84±0\.2210\.84\_\{\\pm 0\.22\}15\.97±0\.2815\.97\_\{\\pm 0\.28\}1\.56±0\.161\.56\_\{\\pm 0\.16\}0\.18±0\.020\.18\_\{\\pm 0\.02\}0\.27±0\.010\.27\_\{\\pm 0\.01\}0\.14±0\.000\.14\_\{\\pm 0\.00\}GS53\.08±1\.1453\.08\_\{\\pm 1\.14\}23\.49±1\.0023\.49\_\{\\pm 1\.00\}36\.63±1\.0036\.63\_\{\\pm 1\.00\}12\.01±0\.7912\.01\_\{\\pm 0\.79\}18\.58±1\.1118\.58\_\{\\pm 1\.11\}6\.96±0\.946\.96\_\{\\pm 0\.94\}4\.66±0\.474\.66\_\{\\pm 0\.47\}0\.42±0\.020\.42\_\{\\pm 0\.02\}0\.38±0\.020\.38\_\{\\pm 0\.02\}0\.18±0\.010\.18\_\{\\pm 0\.01\}TimeWak115\.86±0\.96115\.86\_\{\\pm 0\.96\}3\.07±0\.973\.07\_\{\\pm 0\.97\}19\.44±1\.0619\.44\_\{\\pm 1\.06\}−0\.34±0\.97\-0\.34\_\{\\pm 0\.97\}1\.05±0\.961\.05\_\{\\pm 0\.96\}−1\.68±1\.00\-1\.68\_\{\\pm 1\.00\}0\.23±0\.010\.23\_\{\\pm 0\.01\}0\.21±0\.040\.21\_\{\\pm 0\.04\}0\.08±0\.030\.08\_\{\\pm 0\.03\}0\.12±0\.000\.12\_\{\\pm 0\.00\}SDformerLVQMark5\.15±0\.945\.15\_\{\\pm 0\.94\}0\.50±1\.260\.50\_\{\\pm 1\.26\}1\.82±0\.891\.82\_\{\\pm 0\.89\}0\.79±0\.960\.79\_\{\\pm 0\.96\}0\.18±1\.220\.18\_\{\\pm 1\.22\}0\.70±0\.850\.70\_\{\\pm 0\.85\}0\.13±0\.020\.13\_\{\\pm 0\.02\}0\.08±0\.030\.08\_\{\\pm 0\.03\}0\.04±0\.020\.04\_\{\\pm 0\.02\}0\.12±0\.000\.12\_\{\\pm 0\.00\}L\-VQVAELVQMark20\.66±1\.1220\.66\_\{\\pm 1\.12\}17\.01±1\.2417\.01\_\{\\pm 1\.24\}13\.48±0\.9513\.48\_\{\\pm 0\.95\}0\.03±1\.100\.03\_\{\\pm 1\.10\}0\.41±1\.450\.41\_\{\\pm 1\.45\}−0\.15±1\.01\-0\.15\_\{\\pm 1\.01\}0\.05±0\.000\.05\_\{\\pm 0\.00\}0\.05±0\.010\.05\_\{\\pm 0\.01\}0\.02±0\.010\.02\_\{\\pm 0\.01\}0\.12±0\.000\.12\_\{\\pm 0\.00\}EnergyDiffusionTSTR0\.84±0\.030\.84\_\{\\pm 0\.03\}37\.42±0\.2537\.42\_\{\\pm 0\.25\}26\.12±0\.1626\.12\_\{\\pm 0\.16\}0\.43±0\.030\.43\_\{\\pm 0\.03\}39\.25±0\.3239\.25\_\{\\pm 0\.32\}26\.77±0\.1626\.77\_\{\\pm 0\.16\}0\.43±0\.030\.43\_\{\\pm 0\.03\}2\.66±0\.302\.66\_\{\\pm 0\.30\}0\.41±0\.010\.41\_\{\\pm 0\.01\}0\.30±0\.000\.30\_\{\\pm 0\.00\}GS53\.58±1\.0053\.58\_\{\\pm 1\.00\}75\.56±1\.2475\.56\_\{\\pm 1\.24\}49\.04±1\.0749\.04\_\{\\pm 1\.07\}13\.17±1\.1913\.17\_\{\\pm 1\.19\}65\.49±1\.3665\.49\_\{\\pm 1\.36\}14\.31±1\.1414\.31\_\{\\pm 1\.14\}1\.58±0\.061\.58\_\{\\pm 0\.06\}3\.37±0\.133\.37\_\{\\pm 0\.13\}0\.49±0\.000\.49\_\{\\pm 0\.00\}0\.33±0\.000\.33\_\{\\pm 0\.00\}TimeWak192\.68±1\.64192\.68\_\{\\pm 1\.64\}10\.87±0\.8910\.87\_\{\\pm 0\.89\}55\.08±1\.0855\.08\_\{\\pm 1\.08\}0\.33±0\.940\.33\_\{\\pm 0\.94\}6\.03±1\.076\.03\_\{\\pm 1\.07\}−1\.22±1\.01\-1\.22\_\{\\pm 1\.01\}0\.09±0\.010\.09\_\{\\pm 0\.01\}1\.53±0\.191\.53\_\{\\pm 0\.19\}0\.14±0\.020\.14\_\{\\pm 0\.02\}0\.25±0\.000\.25\_\{\\pm 0\.00\}SDformerLVQMark24\.84±0\.8424\.84\_\{\\pm 0\.84\}3\.99±1\.273\.99\_\{\\pm 1\.27\}14\.32±0\.9014\.32\_\{\\pm 0\.90\}0\.29±1\.020\.29\_\{\\pm 1\.02\}1\.48±0\.991\.48\_\{\\pm 0\.99\}0\.32±0\.950\.32\_\{\\pm 0\.95\}0\.12±0\.000\.12\_\{\\pm 0\.00\}1\.27±0\.131\.27\_\{\\pm 0\.13\}0\.23±0\.010\.23\_\{\\pm 0\.01\}0\.25±0\.000\.25\_\{\\pm 0\.00\}L\-VQVAELVQMark28\.18±1\.0928\.18\_\{\\pm 1\.09\}21\.94±1\.1921\.94\_\{\\pm 1\.19\}21\.55±1\.0021\.55\_\{\\pm 1\.00\}−0\.16±0\.97\-0\.16\_\{\\pm 0\.97\}−0\.19±1\.21\-0\.19\_\{\\pm 1\.21\}−0\.03±0\.99\-0\.03\_\{\\pm 0\.99\}0\.03±0\.000\.03\_\{\\pm 0\.00\}1\.02±0\.101\.02\_\{\\pm 0\.10\}0\.09±0\.010\.09\_\{\\pm 0\.01\}0\.25±0\.000\.25\_\{\\pm 0\.00\}fMRIDiffusionTSTR2\.99±0\.062\.99\_\{\\pm 0\.06\}2\.47±0\.052\.47\_\{\\pm 0\.05\}1\.74±0\.071\.74\_\{\\pm 0\.07\}0\.42±0\.030\.42\_\{\\pm 0\.03\}0\.55±0\.040\.55\_\{\\pm 0\.04\}4\.89±0\.044\.89\_\{\\pm 0\.04\}2\.26±0\.102\.26\_\{\\pm 0\.10\}13\.42±0\.1413\.42\_\{\\pm 0\.14\}0\.50±0\.000\.50\_\{\\pm 0\.00\}0\.15±0\.000\.15\_\{\\pm 0\.00\}GS418\.07±1\.19418\.07\_\{\\pm 1\.19\}173\.30±0\.84173\.30\_\{\\pm 0\.84\}262\.45±1\.32262\.45\_\{\\pm 1\.32\}2\.33±0\.882\.33\_\{\\pm 0\.88\}−3\.89±0\.87\-3\.89\_\{\\pm 0\.87\}−6\.16±1\.01\-6\.16\_\{\\pm 1\.01\}0\.71±0\.050\.71\_\{\\pm 0\.05\}15\.21±0\.0615\.21\_\{\\pm 0\.06\}0\.50±0\.000\.50\_\{\\pm 0\.00\}0\.11±0\.000\.11\_\{\\pm 0\.00\}TimeWak380\.87±0\.92380\.87\_\{\\pm 0\.92\}77\.01±0\.9277\.01\_\{\\pm 0\.92\}134\.32±0\.87134\.32\_\{\\pm 0\.87\}0\.19±1\.070\.19\_\{\\pm 1\.07\}2\.39±0\.912\.39\_\{\\pm 0\.91\}0\.26±1\.040\.26\_\{\\pm 1\.04\}0\.18±0\.010\.18\_\{\\pm 0\.01\}1\.98±0\.071\.98\_\{\\pm 0\.07\}0\.08±0\.020\.08\_\{\\pm 0\.02\}0\.10±0\.000\.10\_\{\\pm 0\.00\}SDformerLVQMark22\.63±0\.9522\.63\_\{\\pm 0\.95\}6\.01±1\.236\.01\_\{\\pm 1\.23\}9\.43±0\.979\.43\_\{\\pm 0\.97\}0\.14±0\.980\.14\_\{\\pm 0\.98\}−0\.41±1\.22\-0\.41\_\{\\pm 1\.22\}0\.01±0\.910\.01\_\{\\pm 0\.91\}0\.94±0\.070\.94\_\{\\pm 0\.07\}3\.24±0\.153\.24\_\{\\pm 0\.15\}0\.21±0\.030\.21\_\{\\pm 0\.03\}0\.10±0\.000\.10\_\{\\pm 0\.00\}L\-VQVAELVQMark20\.28±0\.9120\.28\_\{\\pm 0\.91\}24\.23±1\.3224\.23\_\{\\pm 1\.32\}17\.16±0\.9617\.16\_\{\\pm 0\.96\}0\.11±0\.910\.11\_\{\\pm 0\.91\}−0\.23±1\.32\-0\.23\_\{\\pm 1\.32\}−0\.05±1\.02\-0\.05\_\{\\pm 1\.02\}0\.20±0\.010\.20\_\{\\pm 0\.01\}1\.92±0\.031\.92\_\{\\pm 0\.03\}0\.23±0\.010\.23\_\{\\pm 0\.01\}0\.10±0\.000\.10\_\{\\pm 0\.00\}

Table 26:Results of synthetic time series watermark detection and quality\. Watermark and Non\-watermarked detections \(Z\-score\) are evaluated under 30% attacks\. Detection and quality metrics \(mean±\\pmstd\) are for 64\-length\.SettingWatermark \(Z\-score↑\\uparrow\)Non\-watermarked \(Z\-score\)Quality Metric \(↓\\downarrow\)DatasetModelMethodOffsetCropInsertOffsetCropInsertC\-FIDCorr\.Disc\.Pred\.StocksDiffusionTSTR0\.88±0\.030\.88\_\{\\pm 0\.03\}56\.36±0\.8456\.36\_\{\\pm 0\.84\}4\.60±0\.174\.60\_\{\\pm 0\.17\}0\.21±0\.030\.21\_\{\\pm 0\.03\}69\.43±0\.7769\.43\_\{\\pm 0\.77\}8\.11±0\.218\.11\_\{\\pm 0\.21\}1\.52±0\.111\.52\_\{\\pm 0\.11\}0\.07±0\.020\.07\_\{\\pm 0\.02\}0\.15±0\.050\.15\_\{\\pm 0\.05\}0\.04±0\.000\.04\_\{\\pm 0\.00\}GS143\.09±1\.43143\.09\_\{\\pm 1\.43\}−14\.28±0\.94\-14\.28\_\{\\pm 0\.94\}64\.00±0\.8064\.00\_\{\\pm 0\.80\}−1\.40±0\.78\-1\.40\_\{\\pm 0\.78\}−14\.87±0\.92\-14\.87\_\{\\pm 0\.92\}1\.52±1\.011\.52\_\{\\pm 1\.01\}1\.50±0\.321\.50\_\{\\pm 0\.32\}0\.02±0\.010\.02\_\{\\pm 0\.01\}0\.22±0\.030\.22\_\{\\pm 0\.03\}0\.04±0\.000\.04\_\{\\pm 0\.00\}TimeWak335\.49±0\.81335\.49\_\{\\pm 0\.81\}16\.23±0\.9216\.23\_\{\\pm 0\.92\}79\.44±1\.2879\.44\_\{\\pm 1\.28\}−0\.19±0\.95\-0\.19\_\{\\pm 0\.95\}−4\.32±0\.91\-4\.32\_\{\\pm 0\.91\}1\.35±0\.911\.35\_\{\\pm 0\.91\}0\.29±0\.030\.29\_\{\\pm 0\.03\}0\.01±0\.000\.01\_\{\\pm 0\.00\}0\.13±0\.030\.13\_\{\\pm 0\.03\}0\.04±0\.000\.04\_\{\\pm 0\.00\}SDformerLVQMark0\.59±0\.810\.59\_\{\\pm 0\.81\}0\.99±0\.870\.99\_\{\\pm 0\.87\}0\.42±0\.930\.42\_\{\\pm 0\.93\}−0\.16±0\.89\-0\.16\_\{\\pm 0\.89\}1\.19±1\.051\.19\_\{\\pm 1\.05\}0\.31±1\.040\.31\_\{\\pm 1\.04\}0\.08±0\.010\.08\_\{\\pm 0\.01\}0\.01±0\.000\.01\_\{\\pm 0\.00\}0\.01±0\.010\.01\_\{\\pm 0\.01\}0\.04±0\.000\.04\_\{\\pm 0\.00\}L\-VQVAELVQMark15\.21±1\.0515\.21\_\{\\pm 1\.05\}28\.43±1\.3328\.43\_\{\\pm 1\.33\}8\.23±0\.858\.23\_\{\\pm 0\.85\}−0\.12±0\.95\-0\.12\_\{\\pm 0\.95\}−0\.05±1\.28\-0\.05\_\{\\pm 1\.28\}0\.32±1\.060\.32\_\{\\pm 1\.06\}0\.07±0\.010\.07\_\{\\pm 0\.01\}0\.01±0\.010\.01\_\{\\pm 0\.01\}0\.06±0\.020\.06\_\{\\pm 0\.02\}0\.04±0\.000\.04\_\{\\pm 0\.00\}ETThDiffusionTSTR4\.69±0\.094\.69\_\{\\pm 0\.09\}17\.54±0\.2917\.54\_\{\\pm 0\.29\}39\.34±0\.5239\.34\_\{\\pm 0\.52\}0\.89±0\.040\.89\_\{\\pm 0\.04\}17\.16±0\.2717\.16\_\{\\pm 0\.27\}38\.55±0\.6038\.55\_\{\\pm 0\.60\}2\.17±0\.102\.17\_\{\\pm 0\.10\}0\.22±0\.010\.22\_\{\\pm 0\.01\}0\.29±0\.010\.29\_\{\\pm 0\.01\}0\.14±0\.000\.14\_\{\\pm 0\.00\}GS160\.44±2\.50160\.44\_\{\\pm 2\.50\}56\.44±1\.6756\.44\_\{\\pm 1\.67\}127\.53±1\.28127\.53\_\{\\pm 1\.28\}−1\.53±0\.85\-1\.53\_\{\\pm 0\.85\}−5\.44±1\.43\-5\.44\_\{\\pm 1\.43\}−5\.82±1\.42\-5\.82\_\{\\pm 1\.42\}3\.43±0\.243\.43\_\{\\pm 0\.24\}0\.25±0\.020\.25\_\{\\pm 0\.02\}0\.36±0\.010\.36\_\{\\pm 0\.01\}0\.16±0\.000\.16\_\{\\pm 0\.00\}TimeWak194\.83±1\.53194\.83\_\{\\pm 1\.53\}3\.42±0\.813\.42\_\{\\pm 0\.81\}25\.92±1\.1325\.92\_\{\\pm 1\.13\}1\.17±1\.001\.17\_\{\\pm 1\.00\}−0\.28±0\.85\-0\.28\_\{\\pm 0\.85\}1\.20±0\.881\.20\_\{\\pm 0\.88\}0\.37±0\.020\.37\_\{\\pm 0\.02\}0\.13±0\.010\.13\_\{\\pm 0\.01\}0\.11±0\.000\.11\_\{\\pm 0\.00\}0\.12±0\.000\.12\_\{\\pm 0\.00\}SDformerLVQMark−0\.16±0\.92\-0\.16\_\{\\pm 0\.92\}0\.03±1\.160\.03\_\{\\pm 1\.16\}0\.07±0\.970\.07\_\{\\pm 0\.97\}−0\.94±0\.83\-0\.94\_\{\\pm 0\.83\}0\.09±1\.170\.09\_\{\\pm 1\.17\}−0\.09±0\.98\-0\.09\_\{\\pm 0\.98\}0\.04±0\.000\.04\_\{\\pm 0\.00\}0\.05±0\.020\.05\_\{\\pm 0\.02\}0\.00±0\.010\.00\_\{\\pm 0\.01\}0\.12±0\.010\.12\_\{\\pm 0\.01\}L\-VQVAELVQMark16\.81±0\.9916\.81\_\{\\pm 0\.99\}17\.48±1\.1317\.48\_\{\\pm 1\.13\}14\.46±0\.9714\.46\_\{\\pm 0\.97\}−0\.12±1\.06\-0\.12\_\{\\pm 1\.06\}−0\.22±1\.08\-0\.22\_\{\\pm 1\.08\}0\.35±0\.840\.35\_\{\\pm 0\.84\}0\.03±0\.000\.03\_\{\\pm 0\.00\}0\.06±0\.030\.06\_\{\\pm 0\.03\}0\.01±0\.010\.01\_\{\\pm 0\.01\}0\.12±0\.010\.12\_\{\\pm 0\.01\}EnergyDiffusionTSTR2\.14±0\.042\.14\_\{\\pm 0\.04\}48\.74±0\.3448\.74\_\{\\pm 0\.34\}58\.22±0\.2858\.22\_\{\\pm 0\.28\}1\.18±0\.041\.18\_\{\\pm 0\.04\}53\.73±0\.3853\.73\_\{\\pm 0\.38\}58\.55±0\.2958\.55\_\{\\pm 0\.29\}0\.58±0\.040\.58\_\{\\pm 0\.04\}1\.98±0\.091\.98\_\{\\pm 0\.09\}0\.43±0\.020\.43\_\{\\pm 0\.02\}0\.28±0\.000\.28\_\{\\pm 0\.00\}GS31\.04±0\.8831\.04\_\{\\pm 0\.88\}2\.78±1\.062\.78\_\{\\pm 1\.06\}37\.14±1\.3837\.14\_\{\\pm 1\.38\}14\.51±0\.8614\.51\_\{\\pm 0\.86\}0\.87±1\.080\.87\_\{\\pm 1\.08\}11\.77±1\.1811\.77\_\{\\pm 1\.18\}1\.78±0\.141\.78\_\{\\pm 0\.14\}2\.72±0\.152\.72\_\{\\pm 0\.15\}0\.48±0\.010\.48\_\{\\pm 0\.01\}0\.31±0\.000\.31\_\{\\pm 0\.00\}TimeWak167\.49±2\.09167\.49\_\{\\pm 2\.09\}5\.02±0\.935\.02\_\{\\pm 0\.93\}28\.04±1\.0128\.04\_\{\\pm 1\.01\}−9\.69±0\.82\-9\.69\_\{\\pm 0\.82\}−0\.42±0\.93\-0\.42\_\{\\pm 0\.93\}−1\.57±0\.98\-1\.57\_\{\\pm 0\.98\}0\.14±0\.010\.14\_\{\\pm 0\.01\}1\.52±0\.241\.52\_\{\\pm 0\.24\}0\.14±0\.010\.14\_\{\\pm 0\.01\}0\.25±0\.000\.25\_\{\\pm 0\.00\}SDformerLVQMark7\.41±0\.987\.41\_\{\\pm 0\.98\}1\.14±0\.871\.14\_\{\\pm 0\.87\}3\.29±0\.883\.29\_\{\\pm 0\.88\}−0\.02±1\.10\-0\.02\_\{\\pm 1\.10\}0\.34±0\.870\.34\_\{\\pm 0\.87\}0\.34±0\.900\.34\_\{\\pm 0\.90\}0\.04±0\.000\.04\_\{\\pm 0\.00\}1\.04±0\.151\.04\_\{\\pm 0\.15\}0\.08±0\.020\.08\_\{\\pm 0\.02\}0\.25±0\.000\.25\_\{\\pm 0\.00\}L\-VQVAELVQMark15\.24±1\.1615\.24\_\{\\pm 1\.16\}13\.22±1\.1213\.22\_\{\\pm 1\.12\}11\.31±1\.0211\.31\_\{\\pm 1\.02\}−0\.06±1\.09\-0\.06\_\{\\pm 1\.09\}−0\.25±1\.14\-0\.25\_\{\\pm 1\.14\}0\.04±1\.070\.04\_\{\\pm 1\.07\}0\.04±0\.000\.04\_\{\\pm 0\.00\}0\.94±0\.340\.94\_\{\\pm 0\.34\}0\.15±0\.010\.15\_\{\\pm 0\.01\}0\.25±0\.000\.25\_\{\\pm 0\.00\}fMRIDiffusionTSTR5\.25±0\.055\.25\_\{\\pm 0\.05\}3\.36±0\.063\.36\_\{\\pm 0\.06\}20\.02±0\.1120\.02\_\{\\pm 0\.11\}0\.05±0\.030\.05\_\{\\pm 0\.03\}2\.27±0\.042\.27\_\{\\pm 0\.04\}12\.14±0\.0512\.14\_\{\\pm 0\.05\}3\.63±0\.413\.63\_\{\\pm 0\.41\}12\.83±0\.0812\.83\_\{\\pm 0\.08\}0\.40±0\.170\.40\_\{\\pm 0\.17\}0\.14±0\.000\.14\_\{\\pm 0\.00\}GS543\.72±1\.11543\.72\_\{\\pm 1\.11\}275\.99±1\.72275\.99\_\{\\pm 1\.72\}421\.92±3\.12421\.92\_\{\\pm 3\.12\}−1\.78±0\.91\-1\.78\_\{\\pm 0\.91\}−38\.77±1\.70\-38\.77\_\{\\pm 1\.70\}−0\.01±2\.12\-0\.01\_\{\\pm 2\.12\}0\.74±0\.050\.74\_\{\\pm 0\.05\}8\.31±0\.038\.31\_\{\\pm 0\.03\}0\.50±0\.000\.50\_\{\\pm 0\.00\}0\.10±0\.000\.10\_\{\\pm 0\.00\}TimeWak574\.43±0\.98574\.43\_\{\\pm 0\.98\}84\.45±0\.9884\.45\_\{\\pm 0\.98\}185\.86±0\.95185\.86\_\{\\pm 0\.95\}0\.08±0\.970\.08\_\{\\pm 0\.97\}−2\.74±0\.99\-2\.74\_\{\\pm 0\.99\}0\.18±0\.900\.18\_\{\\pm 0\.90\}0\.45±0\.010\.45\_\{\\pm 0\.01\}1\.87±0\.051\.87\_\{\\pm 0\.05\}0\.25±0\.110\.25\_\{\\pm 0\.11\}0\.10±0\.000\.10\_\{\\pm 0\.00\}SDformerLVQMark2\.39±0\.972\.39\_\{\\pm 0\.97\}1\.13±1\.091\.13\_\{\\pm 1\.09\}1\.48±0\.951\.48\_\{\\pm 0\.95\}0\.03±0\.860\.03\_\{\\pm 0\.86\}0\.51±1\.160\.51\_\{\\pm 1\.16\}−0\.40±0\.85\-0\.40\_\{\\pm 0\.85\}0\.13±0\.010\.13\_\{\\pm 0\.01\}1\.19±0\.041\.19\_\{\\pm 0\.04\}0\.12±0\.020\.12\_\{\\pm 0\.02\}0\.09±0\.000\.09\_\{\\pm 0\.00\}L\-VQVAELVQMark12\.90±0\.8812\.90\_\{\\pm 0\.88\}15\.19±1\.2315\.19\_\{\\pm 1\.23\}10\.45±0\.9710\.45\_\{\\pm 0\.97\}−0\.03±0\.99\-0\.03\_\{\\pm 0\.99\}−0\.24±1\.15\-0\.24\_\{\\pm 1\.15\}−0\.17±0\.99\-0\.17\_\{\\pm 0\.99\}0\.13±0\.000\.13\_\{\\pm 0\.00\}1\.14±0\.061\.14\_\{\\pm 0\.06\}0\.27±0\.110\.27\_\{\\pm 0\.11\}0\.09±0\.000\.09\_\{\\pm 0\.00\}

Table 27:Results of synthetic time series watermark detection and quality\. Watermark and Non\-watermarked detections \(Z\-score\) are evaluated under 30% attacks\. Detection and quality metrics \(mean±\\pmstd\) are for 128\-length\.SettingWatermark \(Z\-score↑\\uparrow\)Non\-watermarked \(Z\-score\)Quality Metric \(↓\\downarrow\)DatasetModelMethodOffsetCropInsertOffsetCropInsertC\-FIDCorr\.Disc\.Pred\.StocksDiffusionTSTR0\.96±0\.030\.96\_\{\\pm 0\.03\}60\.85±0\.6860\.85\_\{\\pm 0\.68\}19\.13±0\.3919\.13\_\{\\pm 0\.39\}0\.30±0\.030\.30\_\{\\pm 0\.03\}84\.66±0\.6584\.66\_\{\\pm 0\.65\}20\.60±0\.4320\.60\_\{\\pm 0\.43\}3\.05±0\.783\.05\_\{\\pm 0\.78\}0\.09±0\.010\.09\_\{\\pm 0\.01\}0\.24±0\.050\.24\_\{\\pm 0\.05\}0\.04±0\.000\.04\_\{\\pm 0\.00\}GS158\.85±1\.94158\.85\_\{\\pm 1\.94\}1\.08±0\.951\.08\_\{\\pm 0\.95\}56\.98±0\.9556\.98\_\{\\pm 0\.95\}−4\.40±1\.00\-4\.40\_\{\\pm 1\.00\}−10\.04±0\.81\-10\.04\_\{\\pm 0\.81\}−5\.22±1\.01\-5\.22\_\{\\pm 1\.01\}2\.63±0\.162\.63\_\{\\pm 0\.16\}0\.04±0\.020\.04\_\{\\pm 0\.02\}0\.19±0\.030\.19\_\{\\pm 0\.03\}0\.04±0\.000\.04\_\{\\pm 0\.00\}TimeWak466\.00±1\.19466\.00\_\{\\pm 1\.19\}10\.37±1\.0110\.37\_\{\\pm 1\.01\}76\.52±1\.2976\.52\_\{\\pm 1\.29\}−0\.16±0\.90\-0\.16\_\{\\pm 0\.90\}−4\.18±0\.93\-4\.18\_\{\\pm 0\.93\}3\.74±1\.033\.74\_\{\\pm 1\.03\}0\.34±0\.080\.34\_\{\\pm 0\.08\}0\.01±0\.000\.01\_\{\\pm 0\.00\}0\.15±0\.040\.15\_\{\\pm 0\.04\}0\.04±0\.000\.04\_\{\\pm 0\.00\}SDformerLVQMark−0\.57±0\.94\-0\.57\_\{\\pm 0\.94\}−0\.77±0\.66\-0\.77\_\{\\pm 0\.66\}−0\.78±0\.95\-0\.78\_\{\\pm 0\.95\}−0\.54±0\.87\-0\.54\_\{\\pm 0\.87\}−0\.89±0\.98\-0\.89\_\{\\pm 0\.98\}−1\.20±1\.10\-1\.20\_\{\\pm 1\.10\}0\.12±0\.010\.12\_\{\\pm 0\.01\}0\.01±0\.010\.01\_\{\\pm 0\.01\}0\.03±0\.030\.03\_\{\\pm 0\.03\}0\.04±0\.000\.04\_\{\\pm 0\.00\}L\-VQVAELVQMark19\.79±1\.5119\.79\_\{\\pm 1\.51\}13\.17±1\.6413\.17\_\{\\pm 1\.64\}13\.82±1\.2013\.82\_\{\\pm 1\.20\}0\.09±0\.920\.09\_\{\\pm 0\.92\}−0\.09±1\.24\-0\.09\_\{\\pm 1\.24\}0\.23±0\.960\.23\_\{\\pm 0\.96\}0\.08±0\.010\.08\_\{\\pm 0\.01\}0\.01±0\.010\.01\_\{\\pm 0\.01\}0\.18±0\.120\.18\_\{\\pm 0\.12\}0\.04±0\.000\.04\_\{\\pm 0\.00\}ETThDiffusionTSTR0\.61±0\.040\.61\_\{\\pm 0\.04\}10\.99±0\.2310\.99\_\{\\pm 0\.23\}35\.91±0\.4635\.91\_\{\\pm 0\.46\}1\.52±0\.041\.52\_\{\\pm 0\.04\}12\.19±0\.2312\.19\_\{\\pm 0\.23\}36\.77±0\.3836\.77\_\{\\pm 0\.38\}2\.52±0\.122\.52\_\{\\pm 0\.12\}0\.26±0\.010\.26\_\{\\pm 0\.01\}0\.30±0\.010\.30\_\{\\pm 0\.01\}0\.13±0\.000\.13\_\{\\pm 0\.00\}GS229\.36±2\.44229\.36\_\{\\pm 2\.44\}51\.50±1\.1551\.50\_\{\\pm 1\.15\}155\.83±1\.52155\.83\_\{\\pm 1\.52\}−6\.09±0\.98\-6\.09\_\{\\pm 0\.98\}−13\.71±0\.85\-13\.71\_\{\\pm 0\.85\}−6\.37±1\.18\-6\.37\_\{\\pm 1\.18\}5\.59±0\.365\.59\_\{\\pm 0\.36\}0\.23±0\.010\.23\_\{\\pm 0\.01\}0\.39±0\.000\.39\_\{\\pm 0\.00\}0\.15±0\.000\.15\_\{\\pm 0\.00\}TimeWak257\.53±2\.12257\.53\_\{\\pm 2\.12\}4\.62±1\.034\.62\_\{\\pm 1\.03\}40\.33±0\.9840\.33\_\{\\pm 0\.98\}1\.09±0\.911\.09\_\{\\pm 0\.91\}−1\.63±0\.86\-1\.63\_\{\\pm 0\.86\}0\.77±0\.970\.77\_\{\\pm 0\.97\}1\.08±0\.081\.08\_\{\\pm 0\.08\}0\.17±0\.020\.17\_\{\\pm 0\.02\}0\.15±0\.010\.15\_\{\\pm 0\.01\}0\.11±0\.000\.11\_\{\\pm 0\.00\}SDformerLVQMark2\.01±1\.012\.01\_\{\\pm 1\.01\}1\.12±1\.151\.12\_\{\\pm 1\.15\}1\.43±0\.851\.43\_\{\\pm 0\.85\}0\.53±0\.850\.53\_\{\\pm 0\.85\}0\.76±1\.110\.76\_\{\\pm 1\.11\}1\.01±0\.871\.01\_\{\\pm 0\.87\}0\.04±0\.000\.04\_\{\\pm 0\.00\}0\.05±0\.030\.05\_\{\\pm 0\.03\}0\.03±0\.010\.03\_\{\\pm 0\.01\}0\.11±0\.010\.11\_\{\\pm 0\.01\}L\-VQVAELVQMark13\.82±0\.9313\.82\_\{\\pm 0\.93\}13\.76±1\.0713\.76\_\{\\pm 1\.07\}11\.98±1\.0211\.98\_\{\\pm 1\.02\}−0\.04±0\.81\-0\.04\_\{\\pm 0\.81\}−0\.05±1\.09\-0\.05\_\{\\pm 1\.09\}−0\.30±0\.83\-0\.30\_\{\\pm 0\.83\}0\.04±0\.000\.04\_\{\\pm 0\.00\}0\.05±0\.010\.05\_\{\\pm 0\.01\}0\.02±0\.010\.02\_\{\\pm 0\.01\}0\.11±0\.010\.11\_\{\\pm 0\.01\}EnergyDiffusionTSTR2\.34±0\.042\.34\_\{\\pm 0\.04\}56\.95±0\.3456\.95\_\{\\pm 0\.34\}95\.70±0\.3595\.70\_\{\\pm 0\.35\}2\.20±0\.032\.20\_\{\\pm 0\.03\}61\.47±0\.3961\.47\_\{\\pm 0\.39\}98\.65±0\.3798\.65\_\{\\pm 0\.37\}0\.50±0\.050\.50\_\{\\pm 0\.05\}1\.65±0\.191\.65\_\{\\pm 0\.19\}0\.49±0\.000\.49\_\{\\pm 0\.00\}0\.28±0\.000\.28\_\{\\pm 0\.00\}GS56\.04±0\.7856\.04\_\{\\pm 0\.78\}61\.55±1\.0561\.55\_\{\\pm 1\.05\}65\.92±1\.1365\.92\_\{\\pm 1\.13\}15\.43±1\.0915\.43\_\{\\pm 1\.09\}48\.30±0\.9848\.30\_\{\\pm 0\.98\}27\.89±1\.3227\.89\_\{\\pm 1\.32\}3\.34±0\.253\.34\_\{\\pm 0\.25\}3\.59±0\.123\.59\_\{\\pm 0\.12\}0\.48±0\.010\.48\_\{\\pm 0\.01\}0\.29±0\.010\.29\_\{\\pm 0\.01\}TimeWak172\.41±1\.57172\.41\_\{\\pm 1\.57\}1\.82±0\.901\.82\_\{\\pm 0\.90\}18\.91±0\.9618\.91\_\{\\pm 0\.96\}−1\.57±0\.89\-1\.57\_\{\\pm 0\.89\}−0\.78±0\.88\-0\.78\_\{\\pm 0\.88\}0\.66±0\.860\.66\_\{\\pm 0\.86\}0\.17±0\.010\.17\_\{\\pm 0\.01\}1\.50±0\.251\.50\_\{\\pm 0\.25\}0\.24±0\.100\.24\_\{\\pm 0\.10\}0\.25±0\.000\.25\_\{\\pm 0\.00\}SDformerLVQMark7\.48±1\.037\.48\_\{\\pm 1\.03\}−0\.29±0\.86\-0\.29\_\{\\pm 0\.86\}2\.74±0\.892\.74\_\{\\pm 0\.89\}0\.06±0\.960\.06\_\{\\pm 0\.96\}−0\.65±0\.69\-0\.65\_\{\\pm 0\.69\}−0\.08±0\.90\-0\.08\_\{\\pm 0\.90\}0\.04±0\.000\.04\_\{\\pm 0\.00\}0\.67±0\.190\.67\_\{\\pm 0\.19\}0\.05±0\.010\.05\_\{\\pm 0\.01\}0\.25±0\.000\.25\_\{\\pm 0\.00\}L\-VQVAELVQMark8\.48±1\.018\.48\_\{\\pm 1\.01\}6\.16±1\.266\.16\_\{\\pm 1\.26\}6\.57±1\.086\.57\_\{\\pm 1\.08\}−0\.03±1\.02\-0\.03\_\{\\pm 1\.02\}0\.00±1\.260\.00\_\{\\pm 1\.26\}0\.13±0\.820\.13\_\{\\pm 0\.82\}0\.03±0\.000\.03\_\{\\pm 0\.00\}0\.74±0\.220\.74\_\{\\pm 0\.22\}0\.19±0\.020\.19\_\{\\pm 0\.02\}0\.24±0\.000\.24\_\{\\pm 0\.00\}fMRIDiffusionTSTR0\.22±0\.040\.22\_\{\\pm 0\.04\}4\.73±0\.054\.73\_\{\\pm 0\.05\}25\.33±0\.1225\.33\_\{\\pm 0\.12\}0\.02±0\.020\.02\_\{\\pm 0\.02\}6\.33±0\.046\.33\_\{\\pm 0\.04\}21\.25±0\.0621\.25\_\{\\pm 0\.06\}4\.57±0\.514\.57\_\{\\pm 0\.51\}14\.15±0\.0514\.15\_\{\\pm 0\.05\}0\.45±0\.090\.45\_\{\\pm 0\.09\}0\.17±0\.000\.17\_\{\\pm 0\.00\}GS801\.62±0\.81801\.62\_\{\\pm 0\.81\}148\.15±1\.57148\.15\_\{\\pm 1\.57\}499\.87±2\.71499\.87\_\{\\pm 2\.71\}−0\.70±0\.97\-0\.70\_\{\\pm 0\.97\}−57\.42±0\.88\-57\.42\_\{\\pm 0\.88\}0\.52±1\.780\.52\_\{\\pm 1\.78\}1\.05±0\.061\.05\_\{\\pm 0\.06\}5\.97±0\.055\.97\_\{\\pm 0\.05\}0\.50±0\.000\.50\_\{\\pm 0\.00\}0\.11±0\.000\.11\_\{\\pm 0\.00\}TimeWak739\.70±1\.24739\.70\_\{\\pm 1\.24\}97\.66±0\.9897\.66\_\{\\pm 0\.98\}204\.66±0\.96204\.66\_\{\\pm 0\.96\}−0\.07±0\.96\-0\.07\_\{\\pm 0\.96\}−3\.03±0\.95\-3\.03\_\{\\pm 0\.95\}−1\.95±1\.00\-1\.95\_\{\\pm 1\.00\}0\.81±0\.040\.81\_\{\\pm 0\.04\}1\.81±0\.031\.81\_\{\\pm 0\.03\}0\.36±0\.100\.36\_\{\\pm 0\.10\}0\.10±0\.000\.10\_\{\\pm 0\.00\}SDformerLVQMark1\.95±0\.941\.95\_\{\\pm 0\.94\}0\.73±1\.150\.73\_\{\\pm 1\.15\}0\.93±0\.900\.93\_\{\\pm 0\.90\}−0\.03±0\.88\-0\.03\_\{\\pm 0\.88\}−0\.25±1\.11\-0\.25\_\{\\pm 1\.11\}−0\.15±0\.86\-0\.15\_\{\\pm 0\.86\}0\.09±0\.010\.09\_\{\\pm 0\.01\}0\.84±0\.030\.84\_\{\\pm 0\.03\}0\.16±0\.030\.16\_\{\\pm 0\.03\}0\.08±0\.000\.08\_\{\\pm 0\.00\}L\-VQVAELVQMark10\.47±0\.9710\.47\_\{\\pm 0\.97\}10\.75±1\.2510\.75\_\{\\pm 1\.25\}8\.05±0\.968\.05\_\{\\pm 0\.96\}−0\.09±0\.87\-0\.09\_\{\\pm 0\.87\}0\.16±1\.240\.16\_\{\\pm 1\.24\}−0\.01±0\.96\-0\.01\_\{\\pm 0\.96\}0\.13±0\.010\.13\_\{\\pm 0\.01\}0\.90±0\.020\.90\_\{\\pm 0\.02\}0\.06±0\.050\.06\_\{\\pm 0\.05\}0\.08±0\.000\.08\_\{\\pm 0\.00\}

## Appendix GVisualization of Generation Results

We provide qualitative visualizations of generation\-time watermarked time series data on Stocks, ETTh, Energy, and fMRI for 64\-length sequences\. Figures[5](https://arxiv.org/html/2608.19727#A7.F5)\-[8](https://arxiv.org/html/2608.19727#A7.F8)compare original samples with LVQMark generations\. The left column shows original samples, while the middle and right columns show watermarked generations produced with LVQMark and non\-watermarked generations produced without watermarking, respectively\.

Each row corresponds to a different channel, with five representative samples shown in each column\. The generated samples capture dataset\-specific temporal patterns, and the watermarked samples remain qualitatively similar to the non\-watermarked ones, suggesting that LVQMark does not introduce noticeable qualitative degradation\. This observation is also consistent with the low Context\-FID values reported in Table[2](https://arxiv.org/html/2608.19727#S4.T2)\.

\(a\)Original\(b\)Watermarked\(c\)Non\-watermarked
Figure 5:Visualization of original and generated samples on the Stocks dataset with length 64\.\(a\)Original\(b\)Watermarked\(c\)Non\-watermarked
Figure 6:Visualization of original and generated samples on the ETTh dataset with length 64\.\(a\)Original\(b\)Watermarked\(c\)Non\-watermarked
Figure 7:Visualization of original and generated samples on the Energy dataset with length 64\.\(a\)Original\(b\)Watermarked\(c\)Non\-watermarked
Figure 8:Visualization of original and generated samples on the fMRI dataset with length 64\.