# RaMark: Radioactive Watermarking for Generated Tabular Data

arXiv: https://arxiv.org/abs/2607.09000 · HTML: https://mlsanity.com/paper/2607.09000/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Placed in Watermarking generated content and models, one of 12 directions in LLM safety and security.
- Builds on 22 of its 79 references that are in the map.
- First posted on arXiv 10 Jul 2026.

## Placed in

- LLM safety and security / [Watermarking generated content and models](https://mlsanity.com/safety/watermarking-generated-content-and-models/)

## Builds on (most cited first, 22 of 22)

- [Diffusion Models Beat GANs on Image Synthesis](https://mlsanity.com/paper/2105.05233/) (2021)
- [Modeling Tabular data using Conditional GAN](https://mlsanity.com/paper/1907.00503/) (2019)
- [OpenML: networked science in machine learning](https://mlsanity.com/paper/1407.7722/) (2014)
- [TabDDPM: Modelling Tabular Data with Diffusion Models](https://mlsanity.com/paper/2209.15421/) (2022)
- [Provable Robust Watermarking for AI-Generated Text](https://mlsanity.com/paper/2306.17439/) (2023)
- [A Survey on Generative Diffusion Model](https://mlsanity.com/paper/2209.02646/) (2022)
- [Mixed-Type Tabular Data Synthesis with Score-based Diffusion in Latent Space](https://mlsanity.com/paper/2310.09656/) (2023)
- [CTAB-GAN: Effective Table Data Synthesizing](https://mlsanity.com/paper/2102.08369/) (2021)
- [CTAB-GAN+: Enhancing Tabular Data Synthesis](https://mlsanity.com/paper/2204.00401/) (2022)
- [Radioactive data: tracing through training](https://mlsanity.com/paper/2002.00937/) (2020)
- [FinDiff: Diffusion Models for Financial Tabular Data Generation](https://mlsanity.com/paper/2309.01472/) (2023)
- [A Comprehensive Survey of Synthetic Tabular Data Generation](https://mlsanity.com/paper/2504.16506/) (2025)
- [Synthetic Data Applications in Finance](https://mlsanity.com/paper/2401.00081/) (2023)
- [Efficient Machine Learning for Big Data: A Review](https://mlsanity.com/paper/1503.05296/) (2015)
- [Privacy-Preserving Synthetic Data Generation for Recommendation Systems](https://mlsanity.com/paper/2209.13133/) (2022)
- [Moderator: Moderating Text-to-Image Diffusion Models through Fine-grained Context-based Policies](https://mlsanity.com/paper/2408.07728/) (2024)
- [TabularMark: Watermarking Tabular Datasets for Machine Learning](https://mlsanity.com/paper/2406.14841/) (2024)
- [TAG-WM: Tamper-Aware Generative Image Watermarking via Diffusion Inversion Sensitivity](https://mlsanity.com/paper/2506.23484/) (2025)
- [Removal Attack and Defense on AI-generated Content Latent-based Watermarking](https://mlsanity.com/paper/2509.11745/) (2025)
- [A Comprehensive Survey of Watermarking Relational Databases Research](https://mlsanity.com/paper/1801.08271/) (2018)
- [Adaptive and Robust Watermark for Generative Tabular Data](https://mlsanity.com/paper/2409.14700/) (2024)
- [Dye4AI: Assuring Data Boundary on Generative AI Services](https://mlsanity.com/paper/2406.14114/) (2024)

## Abstract (arXiv)

Recent advances in generative modeling have made generated tabular data a practical solution for privacy-sensitive data sharing, where watermarking enables ownership verification. However, existing watermarking methods fundamentally fail under retraining attacks, in which an adversary retrains a generative model on a watermarked dataset and regenerates high-utility data that no longer carries the watermark. We address this challenge by introducing radioactivity, the property that a watermark remains detectable after generative model retraining, and propose RaMark, a radioactive watermarking method that embeds a sinusoidal dependency as an intrinsic component of the data distribution. By coupling the watermark with the underlying distribution, RaMark ensures that any generative model preserving data utility also has to preserve the watermark. We theoretically show that with high probability removing watermark degrades utility and alters data distribution. Extensive experiments on two real-world tabular datasets, under a large-scale ownership verification setting with 105 independent data owners, demonstrate that RaMark achieves substantially stronger radioactivity than seven state-of-the-art methods and consistently outperforms them against both retraining and data modification attacks.