How do you tell if witness data has been tampered with?
Quoting from BIP141:


  The commitment is recorded in a scriptPubKey of the coinbase transaction.


and


  A witness root hash is calculated with all those wtxid as leaves, in a way similar to the hashMerkleRoot in the block header.


Indeed, the witness merkle root seems to be computed in a similar way than the hash merkle root, since it calls the same function.

I guess you can just check if the witness data has been tampered with by just computing the witness root hash yourself and checking that it matches the stored one.