PK-Free, Blind and Collusion-Resistant Synthetic Tabular Fingerprinting With Diffusion Models

High-quality synthetic tabular data raises severe issues about potential misuse. Existing post-processing database fingerprinting schemes relying on either Primary Key (PK) or original database ( non- blind) cannot work well in PK-free table, and easily suffer from regeneration attack using Diffusion Models (DMs). Integrating watermarking into the generation process of tabular data is an effective solution, such as Tree-Ring (TR) and Tabular Watermarking (TabWak) for latent tabular DMs. But, these schemes only address copyright protection and lack strong liability guarantees (fingerprinting) in case of unauthorized redistribution against collusion attack. Thus, we propose a framework ofPK-free,Blind andCollusion-resistant syntheticTabularFingerprinting (PBC-TabFip) with DMs by readily incorporating with symmetric Tardos codes of arbitrary alphabet sizes. PBC-TabFip solves the problem of deleted or modified PK, and maintains a blind property which does not use original data to extract fingerprint. Based on PBC-TabFip, we actually propose binary TabFip and TabFip+, quaternary TabFip* and TabFip+* schemes, where “+” means using self-cloning. To identify malicious user, we use Bit Matching (BM) and Valid Bit Matching (VBM) mechanisms for our schemes. We theoretically deduce that TabFip with BM obtains the highest expected accuracy of fingerprint bit matching against random noises. In the case of binary fingerprint, we also demonstrate the fragility of TabFip without Tardos codes, resulting in high probability of detecting innocent, and stronger robustness of TabFip with Tardos codes against inversion-based collusion attack using different strategies. Experimentally, comparing our schemes with baselines on two datasets, we show that the quality of synthetic table achieved by TabFip is higher than that achieved by other methods (TR under proportion of same rows$\lesssim$10%); and TabFip with BM achieves higher average detecting rate of correct user against five single-handed post-editing attacks. In a practical scenario, we exhibit that TabFip with Tardos codes identifies at least one of the colluders with 100% probability and without detecting innocent against two types of collusion attack.