{"id":"777e71e1-2d43-48f6-8439-67e23f30863e","arxiv_id":"1908.02473","paper_version":2,"verdict":"REJECT","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":2,"one_line_summary":"A separable reversible data hiding scheme for encrypted 3D meshes embeds data in the most significant bits of selected vertex coordinates and reconstructs them from neighboring vertices.","lead":"Researchers propose an encryption-friendly way to hide extra data inside 3D mesh models so a third party can embed messages without seeing the original. The method claims higher capacity than prior schemes, but several equations and reported numbers are inconsistent.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Equations (6) and (7) do not implement the described n-MSB substitution: Eq. (6) weights every bit by 10^m instead of 2^u, and Eq. (7)'s residual modulus 2^{l-(n+1)} drops one too many low bits (undefined at n=l). As written, the lossless-recovery claim has no valid algorithmic basis.","rationale":"The reader's verdict rejects the paper, and I agree with rejection, but for a slightly different primary reason. The coordinate-range assumption is a real scope limitation: Eq. (1) maps v<1 into integers, and meshes with coordinates outside (-1,1) would need normalization that the paper never describes. However, that issue is repairable by adding a normalization step and would not necessarily falsify the core mechanism on the paper's own test set. The equations defining the embedding and recovery are more load-bearing, because the paper's headline promises (perfect recovery, zero error, separable extraction) all depend on the n-MSB substitution being reversible. Eq. (6) and Eq. (7) as printed are not a coherent implementation of that substitution. Eq. (6) cannot reconstruct a binary integer, and Eq. (7) either discards an extra low bit or is undefined for n=l. I verified the arithmetic with a concrete l=8, n=2 example: the printed formula changes the value beyond the replaced MSBs. Since the lost bit is not stored, no prediction from neighboring vertices can restore it, so the 'perfectly recover the original mesh' statement in Section III.B cannot follow from the described algorithm. The Table III vs Table II capacity mismatch (Mushroom/Mannequin) reinforces that the experimental record is unreliable, but the equation-level inconsistency is sufficient on its own. A machine-checked proof or a reference implementation might resolve whether these are typos; without that, the central claim is unsupported as written. The reader's weakest_assumption focused on normalization, so I mark partial agreement, though the reader's rationale also mentions Eq. (7) in passing. Since the reader already returned REJECT, my independent concern leaves the verdict unchanged.","tokens_in":12851,"tokens_out":9759,"duration_ms":105000,"concrete_test":"Take l=8, n=2, v'=0b10101010 (170), s1=1, s2=0. Eq. (7) as printed gives 1*2^7 + 0*2^6 + (170 mod 2^5) = 128+0+10 = 0b10001010, losing the original bit at position 5; the corrected MSB replacement gives 128+0+(170 mod 2^6)=0b10101010. Implement the full encoder/decoder (Eqs. 4-9) on a two-vertex mesh with one embedded vertex, run the printed Eq. (7), and verify whether the recovered mesh equals the quantized original. If it does not, the lossless-recovery claim fails as written.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim requires that after embedding and decryption the original quantized coordinates can be recovered exactly. The embedding equation is the load-bearing mechanism, and it is internally inconsistent. Eq. (6) reconstructs the encrypted integral coordinate as E_{i,j}=sum_{u=0}^{l-1} e_{i,j,u} * 10^m, so every bit position contributes the same weight; this returns a count of ones, not the binary integer defined by Eq. (4). Eq. (9) then XORs bit streams, but if E_{i,j} is not the binary value, the subsequent modular arithmetic in Eq. (7) is applied to the wrong object. Eq. (7) writes v''=s1*2^{l-1}+...+sn*2^{l-n}+v' mod 2^{l-(n+1)}. For n-bit MSB substitution, the untouched portion must be v' mod 2^{l-n}, i.e., the lower l-n bits. The printed exponent l-(n+1) keeps only l-n-1 bits, silently discarding bit position l-n-1. For n=l the exponent is -1, so the formula is not a valid integer modulus. Discarding one bit is not cosmetic: that bit is not stored anywhere, so exact recovery of the quantized coordinate is impossible. This defect is independent of the normalization/coordinate-range issue; it breaks the algorithm even on meshes satisfying |v|<1.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a separable reversible data hiding in encrypted domain (RDH-ED) method for 3D meshes. Vertex coordinates are scaled to integers, vertices are split into an 'embedded' set and a 'reference' set, prediction-error-free embedded vertices are identified, the mesh is encrypted with a stream cipher, and additional data are embedded by substituting the n most significant bits (MSBs) of encrypted coordinates. Three recipient cases are considered: data extraction with only the data-hiding key, mesh recovery with only the encryption key, and joint extraction/recovery with both keys. The paper reports embedding rates up to 18.12 bpv on the Elephant mesh, zero extraction error, and claims higher embedding capacity and better recovered-mesh quality than prior methods [20], [21].","tokens_in":13207,"tokens_out":7477,"duration_ms":74663,"significance":"If correct, the scheme would be a useful extension of MSB-prediction-based RDH-ED from images to 3D meshes, with an attractive separable design and high reported capacities. The paper has some strengths: capacity figures appear to be measured rather than fitted, dense-mesh results are reported, and the comparison with prior work is explicitly attempted. However, the central embedding and recovery equations as written are internally inconsistent, the preprocessing is only specified for a narrow coordinate range with no signed-integer handling, and the reported comparison tables are mutually inconsistent. These issues strike at the paper's main claims of reversibility, error-free extraction, and improved performance, so the contributions cannot be accepted in their current form.","major_comments":[{"comment":"Equation (6) defines E_{i,j} = sum_{u=0}^{l-1} e_{i,j,u} × 10^m, which weights every bit identically and therefore reconstructs neither the binary integer from Eq. (4) nor the encrypted coordinate. The bit positions must be weighted by powers of 2 (2^u), not by 10^m. As written, Eq. (6) returns 10^m times the number of 1-bits, so the subsequent XOR decryption in Eq. (9) and the modular arithmetic in Eq. (7) operate on the wrong quantity. This invalidates the encryption-to-embedding-to-recovery pipeline.","section":"Section II.C, Eq. (6)"},{"comment":"Equation (7) writes v'' = s1·2^{l-1} + ... + sn·2^{l-n} + v' mod 2^{l-(n+1)}. For n-MSB substitution, the untouched lower part of v' should be v' mod 2^{l-n}; the printed modulus 2^{l-(n+1)} discards bit position l-n-1, which is not stored anywhere, making exact recovery of the original coordinate impossible. The expression is also undefined for n=l, since the exponent becomes -1. This is a load-bearing defect in the reversibility claim because the lost bit is not recoverable by any subsequent prediction step.","section":"Section II.D, Eq. (7)"},{"comment":"Equation (8), s_k = v''/2^{l-k}, does not extract the k-th embedded bit. If division is integer division, the right-hand side gives the k-bit value formed by the top k MSBs; if it is real division, the result is generally non-integer. No floor, rounding, or modulo operation is specified, so the extraction rule does not correctly recover the individual bits s_k. Error-free extraction is therefore not established by the stated formula.","section":"Section II.E, Eq. (8)"},{"comment":"The preprocessing assumes each vertex coordinate satisfies |v_{i,j}| < 1 and states that the integer value is between 0 and 2^m, but the paper's own example uses negative coordinates: v = (-0.202018, -0.0740184, 0.288808) with m=4, giving integer coordinates (-2020, -7400, 2888). This contradicts Eq. (1), since floor(-0.202018 × 10^4) = floor(-2020.18) = -2021, not -2020, and negative integers are outside the stated range [0, 2^m]. No normalization or signed-integer representation is specified for Eq. (4)'s bit decomposition, so the entire integer mapping is undefined for the negative coordinates that are common in real 3D meshes.","section":"Section II.A, Eqs. (1)-(4)"},{"comment":"The text in Section III.A reports maximum embedding rates of 16.72 bpv for Mushroom and 13.66 bpv for Mannequin, which matches Table II. Table III, however, lists 13.66 bpv for Muchroom and 16.20 bpv for Mannequin. These swapped or inconsistent values undermine the comparison with [20] and [21] and the paper's headline capacity claims.","section":"Section III.A and Table III"},{"comment":"The SNR formula in Eq. (13) is non-standard: the numerator is the power of the original coordinates about their mean, while the denominator is the power of the modified coordinates about the original mean. The standard SNR uses the introduced error (e.g., sum (g_i - v_i)^2) in the denominator. As written, the metric conflates signal power with noise power and can be artificially inflated by a uniform offset or scaling. Since SNR is used as a quality comparison in Table III and Fig. 6, this definition needs to be justified or replaced.","section":"Section III.B, Eq. (13)"}],"minor_comments":[{"comment":"The text states that Elephant reaches 18.12 bpv when m=5 and n=18, but Table II shows that the value 18.12 appears at n=19 (columns 17, 18, and 19 read 17.29, 17.92, and 18.12, respectively). Please correct the reported operating point.","section":"Section III.A and Table II"},{"comment":"The text says 'the recipient with encryption key Ke can prefectly recover the original mesh,' but Case 2 in Section II.E describes the result as a 'high-quality recovered mesh,' not an exact recovery. These statements should be reconciled; exact recovery in Case 2 would require justification beyond MSB prediction.","section":"Section III.B"},{"comment":"There are numerous typos and naming inconsistencies: 'atart-of-the-art', 'shouws', 'descibe', 'prefectly', 'Muchroom' vs. 'Mushroom', 'Mannequim' in Fig. 7(a), and 'compasision'. The authors should perform a careful proofreading pass.","section":"Throughout"},{"comment":"The range condition 'l≤k≤n' after Eq. (7) should presumably be '1≤k≤n'; otherwise the summation indices are inconsistent with the usage of s_k as embedded data bits.","section":"Section II.D, Eq. (7)"},{"comment":"The notation 'l≤i≤N' in Eq. (4) should be '1≤i≤N'; as written, the index range excludes the first vertex.","section":"Section II.C, Eq. (4)"}],"recommendation":"reject","confidential_remarks":null},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The genuinely new thing here is applying Puteaux–Puech style multi-MSB prediction to 3D mesh topology, via an embedded/reference vertex partition, with separable data extraction and mesh recovery. That is a real combination not in the prior art, and the measured rates (up to 18.12 bpv on Elephant) would be a meaningful step up from the two existing encrypted-mesh schemes. The paper is worth reading for that idea alone.\n\nThe soft spots are serious and they are all in the formal core. Eq. (6) reconstructs the encrypted integer as a sum of bits each weighted by 10^m, which returns a count of ones, not the binary integer from Eq. (4). Eq. (7) uses mod 2^{l-(n+1)} for n-MSB substitution, which keeps l-n-1 low bits instead of l-n, silently discarding a bit that is not stored anywhere. Eq. (8) extracts the top-k bits as an integer, not the k-th bit. These are exactly the load-bearing operations for the paper's central claim of perfect recovery and error-free extraction. As printed, the algorithm does not work. My strong suspicion is that these are typesetting slips rather than deep flaws: the prose and the worked example describe the intended mechanism clearly, and the fix for each equation is obvious. But the preprint does not currently support its headline claims.\n\nThere are also smaller issues: Table III swaps the Mushroom and Mannequin capacity numbers relative to Table II (16.72/13.66 vs 13.66/16.20), the SNR definition in Eq. (13) is non-standard, and the preprocessing quietly assumes every coordinate satisfies |v|<1, which is not true of many real meshes—a normalization step is needed and not described. The experiments themselves look like real measurements, not fitted to a target, so I do not see circularity.\n\nThe paper deserves a serious referee, not a desk reject. The niche is small, but the contribution is a plausible first separable encrypted-mesh RDH scheme with real capacity gains. I would send it to review with an expectation of major revision: fix the equations, reconcile the tables, state the coordinate-range assumption, and re-run to confirm the numbers. If the authors fix the formal parts, this is likely publishable. For now, treat the specific capacity and lossless claims as unverified.","headline":"First separable multi-MSB RDH-ED for 3D meshes with a genuinely new vertex-partition idea, but the printed equations do not support the lossless-recovery claim as written.","tokens_in":13739,"tokens_out":2992,"would_cite":false,"duration_ms":34222,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A reversible data-hiding scheme for encrypted 3D meshes embeds up to 18.12 bits per vertex and recovers the quantized original exactly, with zero extraction error.","keywords":["reversible data hiding","encrypted domain","3D mesh models","Multi-MSB prediction","ring prediction","integer mapping","separable recovery","embedding capacity"],"falsifier":"Run the proposed preprocessing with m=4 on a mesh that contains a vertex coordinate of 7.0, for example a cube of side 7. The mapped integer is 70000, which is larger than $2^{16}-1$, the 16-bit length that Eq. (3) assigns for m=4; Eq. (7) then truncates the coordinate's high bits, and no ring-prediction can restore the original value, contradicting the paper's zero-error and exact-recovery claims.","tokens_in":12657,"feed_emoji":"🔐","tokens_out":8511,"duration_ms":82589,"temperature":0.7,"pith_summary":"The paper proposes a reversible data-hiding method that operates directly on encrypted 3D mesh models, an extension of a technique that has mostly been developed for images. The core idea is to map the mesh's floating-point vertex coordinates to fixed-width integers, encrypt the resulting bitstream, and then embed the hidden message by overwriting the upper (most significant) bits of carefully chosen vertices. Because the upper bits of a vertex's coordinates can be predicted from the coordinates of its topological neighbors, the message can be extracted without error while the quantized original geometry is reconstructed exactly. On four standard test meshes the reported embedding rates reach 13.66 to 18.12 bits per vertex, compared with 0.34 to 6.00 for earlier encrypted-mesh schemes, and the paper reports zero data-extraction error on all tested models, including dense meshes.","feed_headline":"Encrypted 3D meshes carry 18.12 hidden bits per vertex","feed_subtitle":"A separable scheme lets cloud services embed payloads in ciphertext while the owner recovers the exact original mesh.","key_machinery":"The load-bearing object is the Multi-MSB prediction rule operating over topological rings. After integer mapping $\\bar{v}_{i,j} = \\lfloor v_{i,j} \\times 10^m \\rfloor$ (Eq. 1) fixes each coordinate to an $l$-bit integer, the sender counts, from MSB down to LSB, whether the majority of an embedded vertex's neighboring reference vertices share the same bit value; the length $L$ is the largest prefix of bits for which this holds on all axes. Data embedding replaces those $n \\leq L$ MSBs of the embedded vertex's coordinates with payload bits (Eq. 7), and recovery uses the same ring-prediction to regenerate them. This converts spatial smoothness of the mesh geometry into a bit-substitution channel that survives stream-cipher encryption.","core_discovery":"The central claim is that the most significant bits of mesh vertex coordinates carry reliable, encryption-invariant redundancy that can be harvested for reversible data hiding. The method splits vertices into an \"embedded\" set and a \"reference\" set, computes, for each embedded vertex, the maximum number of MSBs that can be guessed by a majority vote over the corresponding bits of its adjacent reference vertices, and then encrypts the whole mesh with a stream cipher. Payload bits are substituted into those predictable MSBs, and the data-hiding key alone reads them back from the ciphertext without any reference to the original geometry. A recipient with only the encryption key predicts the removed MSBs from the surrounding vertices and recovers the integer-mapped mesh exactly, which the paper calls \"perfectly\" recovering the original mesh; the original floating-point coordinates are recovered to the precision m chosen in the integer-mapping step.","pith_inferences":["The same majority-vote MSB prediction could be applied to ordered point clouds or to meshes with a spatial-index-based neighbor definition, not only to triangular faces; the paper's experiments stop at standard triangle meshes.","The scheme fixes one embedding length L for the whole mesh, so a single vertex with a poorly predictable MSB caps the payload for every embedded vertex; an adaptive per-vertex length selection would likely push the average rate closer to the per-mesh maximum.","The \"perfect recovery\" guarantee is relative to the integer-mapped, precision-m quantized mesh, not to the original floating-point coordinates; the choice of m is therefore a real lossy parameter hidden inside the reversible pipeline.","The bit-length table in Eq. (3) is derived from a normalization assumption that coordinates lie in (-1,1); for meshes in other ranges the bit length must be recomputed, and the paper's capacity figures cannot be assumed to transfer."],"forward_implications":["Encrypted 3D content can be annotated or watermarked by an untrusted data hider without the hider ever seeing the plaintext geometry.","Payload capacities on the order of 14–19 bits per vertex are high enough to embed meaningful metadata, such as provenance, integrity hashes, or access-control tags, inside ciphertext for large meshes.","Zero extraction error eliminates the error-correcting overhead that earlier LSB-based encrypted-mesh methods needed, so the recovered payload is directly usable.","Separability of extraction and recovery means a cloud service can provide data management on encrypted models, while only the model owner can recover the geometry, a division of trust that matches privacy-preserving storage workflows."],"supporting_citations":[{"why":"Baseline inseparable RDH-ED for meshes using LSB flipping; provides the low-capacity, high-error comparison the paper claims to improve on.","marker":"[20]"},{"why":"Baseline homomorphic-encryption RDH-ED for meshes; provides the 6 bpv capacity and non-separable comparison the paper claims to outperform.","marker":"[21]"},{"why":"MSB prediction-based reversible data hiding in encrypted images; supplies the MSB-substitution and prediction strategy adapted to mesh coordinates.","marker":"[13]"},{"why":"Geometry-compression recommendation that justifies the lossy integer mapping and the choice of precision m in Eq. (1).","marker":"[22]"},{"why":"Introduces the separable RDH-ED paradigm for images, with extraction and recovery under different keys, which the paper extends to 3D meshes.","marker":"[10]"}],"fun_headline_variants":["Encrypted 3D meshes hide 18 bits per vertex reversibly","3D meshes: embed data in ciphertext, recover exactly","Hidden bits ride encrypted 3D meshes reversibly","3D mesh encryption: reversible hidden data at high capacity"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The scheme assumes all vertex coordinates are smaller than 1 in absolute value so that the integer-mapping step in Eq. (1) always produces values that fit the bit-length table in Eq. (3); meshes with larger coordinates would overflow that bit-length assignment and break both embedding and recovery.","fun_headline_variants_meta":{"raw":{"variants":["Encrypted 3D meshes hide 18 bits per vertex reversibly","3D meshes: embed data in ciphertext, recover exactly","Hidden bits ride encrypted 3D meshes reversibly","3D mesh encryption: reversible hidden data at high capacity"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000871,"raw_usage":{"total_tokens":3784,"prompt_tokens":968,"completion_tokens":2816,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":584,"completion_tokens_details":{"reasoning_tokens":2743}},"tokens_in":584,"tokens_out":2816,"duration_ms":22328,"temperature":1.0,"reasoning_tokens":2743,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-14T14:43:11.968297+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the proposed preprocessing with m=4 on a mesh that contains a vertex coordinate of 7.0, for example a cube of side 7. The mapped integer is 70000, which is larger than $2^{16}-1$, the 16-bit length that Eq. (3) assigns for m=4; Eq. (7) then truncates the coordinate's high bits, and no ring-prediction can restore the original value, contradicting the paper's zero-error and exact-recovery claims.","supporting_citations":[{"cited_title":"IEEE Transactions on Multimedia 20(1), 5567 (2017)","cited_arxiv_id":null,"evidence_quote":"Baseline inseparable RDH-ED for meshes using LSB flipping; provides the low-capacity, high-error comparison the paper claims to improve on."},{"cited_title":"Arabian Journal for Science and Engineering 43(12), 81458157 (2018)","cited_arxiv_id":null,"evidence_quote":"Baseline homomorphic-encryption RDH-ED for meshes; provides the 6 bpv capacity and non-separable comparison the paper claims to outperform."},{"cited_title":"IEEE Transac- tions on Information Forensics and Security 13(7), 16701681 (2018)","cited_arxiv_id":null,"evidence_quote":"MSB prediction-based reversible data hiding in encrypted images; supplies the MSB-substitution and prediction strategy adapted to mesh coordinates."},{"cited_title":"In: Proceedings of the 22nd annual conference on Computer graphics and interactive techniques","cited_arxiv_id":null,"evidence_quote":"Geometry-compression recommendation that justifies the lossy integer mapping and the choice of precision m in Eq. (1)."},{"cited_title":"IEEE transactions on information forensics and security 7(2), 826832 (2011)","cited_arxiv_id":null,"evidence_quote":"Introduces the separable RDH-ED paradigm for images, with extraction and recovery under different keys, which the paper extends to 3D meshes."}],"review_version":1}