{"id":"2f04558b-865f-4ec4-abb6-509c32e8e624","arxiv_id":"2411.11688","paper_version":3,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"ConceptWM binds a watermark to a specific visual concept in diffusion model outputs and adds adversarial noise that degrades models fine-tuned on those watermarked images.","lead":"This paper presents ConceptWM, a way to embed a hidden marker only into images a diffusion model generates for a specific concept, so those images can be traced back to the model and become hard to reuse for unauthorized fine-tuning. The method also adds a subtle error signal that degrades the quality of any new model trained on the watermarked images.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Table 4's concept-protection claim lacks a no-watermark control and the 21.7% metric is undefined; fine-tuning on tiny concept sets may itself cause the reported degradation.","rationale":"The reader's weakest-assumption analysis identifies the same load-bearing point: the adversarial-defense result in Table 4 has no no-watermark control, and the headline 21.7% degradation metric is never defined. I read the paper in good faith and acknowledge real supporting evidence: the method is concretely specified, the tracing experiments in Tables 1–3 compare against four baselines across many attacks and inference settings, and the open-source code link provides a basis for reproducibility. Those parts support the tripartite-correlation and tracing claims, at least at the level reported. The soft spot is specifically the concept-protection claim, which is the paper's claimed critical advantage over prior watermarking methods. The concern is not that the authors are dishonest; it is that the reported PIQE/NIQE/CLIP/FID numbers in Table 4 could plausibly be reproduced by ordinary fine-tuning on a handful of images. Because the paper provides no clean-fine-tuned baseline and no metric definition, the manuscript as written does not let a reader distinguish the effect of the adversarial watermark from the effect of the personalization procedure itself. This is fixable experimentally, so conditional acceptance is the right verdict rather than rejection. My recommendation is unchanged from the reader's conditional verdict.","tokens_in":13368,"tokens_out":3736,"duration_ms":36954,"concrete_test":"Replicate Table 4 with two arms per condition: (i) ConceptWM-watermarked Stable Diffusion fine-tuned on watermarked concept images; (ii) the identical DreamBooth/LoRA/Textual Inversion recipe fine-tuned on clean concept images from the same concept set, with no watermark and no adversarial perturbation. Generate at least 500 images per arm with the same prompts, and report PIQE, NIQE, CLIP, and FID over at least 5 seeds. Also state the exact computation of the claimed 21.7% number (e.g., mean relative CLIP drop against the Table 1 'None' CLIP of 0.367). If the clean-fine-tuned control has CLIP and FID statistically indistinguishable from the ConceptWM arm, the concept-protection claim collapses.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central protective claim—that ConceptWM forces a 21.7% FID/CLIP degradation in downstream fine-tuned models and thereby mitigates model misuse—rests on the assumption that the degradation seen in Table 4 is caused by the adversarial watermark φ generated by PGD against a one-step DreamBooth surrogate (Eqs. 5–6), and not by ordinary personalization artifacts. This assumption is not testable from the reported data. The paper never defines the 21.7% metric, never reports a no-watermark control (fine-tuning the same DreamBooth/LoRA/Textual Inversion recipes on clean concept images without any watermark), and gives no error bars or number of runs. Without such a control, values like PIQE 63.18, NIQE 6.87, CLIP 0.287, and FID 87.21 for the v2.1→v1.4 mismatch cannot be attributed to the adversarial mechanism: fine-tuning a diffusion model on 5–8 images is itself known to reduce fidelity and can produce large FID increases even in the absence of any watermark. The one capability the paper claims is absent from other methods—proactive resistance to fine-tuning—is therefore not currently established. The tracing and robustness claims are less affected, since Tables 1–3 include baselines and absolute bit-accuracy numbers, though they also lack error bars.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes ConceptWM, a concept-level watermarking framework for Stable Diffusion. It combines a fidelity-preserving latent watermark module (FLW), an imperceptible adversarial perturbation injection module (IAPI), and alternating DreamBooth/watermark training. The goal is to establish a tripartite correlation among a watermark bit sequence, a visual concept, and a textual concept, enabling single-stage concept tracing and proactive defense against personalization fine-tuning. Experiments compare ConceptWM with DwtDctSvd, RivaGAN, Stable Signature, and Tree-Ring under image distortions and inference variations, and test the adversarial watermark's transfer to DreamBooth, LoRA, and Textual Inversion fine-tuning under model-version mismatch.","tokens_in":13681,"tokens_out":6663,"duration_ms":58198,"significance":"If the central claims hold, the paper would make a useful advance over image-level watermarking by supporting concept-level tracing and a proactive defense against fine-tuning-based watermark removal. The robustness evaluation across samplers, guidance scales, VAE versions, and eight distortion types is a genuine strength, and the authors provide an anonymous code link. However, the most distinctive claim—that ConceptWM forces a 21.7% FID/CLIP degradation in fine-tuned models—is not currently established because the metric is undefined and no no-watermark control is provided. Several numerical claims are also not reproducible from the reported tables, so the contribution is only partially supported.","major_comments":[{"comment":"The central claim that ConceptWM \"sustains a 21.7% FID/CLIP degradation under adversarial fine-tuning\" is not supported by the reported data. The 21.7% figure is never defined; the only way I can reconstruct it from Table 4 is the relative CLIP drop from 0.367 (Table 1, \"None\") to 0.287 (Table 4, v2.1→v1.4), but the text does not say this. More importantly, Table 4 contains no no-watermark control condition: fine-tuning the same DreamBooth/LoRA/Textual Inversion recipes on clean concept images without ConceptWM is not reported. Because personalization with 5–8 images can itself substantially degrade FID and quality metrics, the PIQE/NIQE/CLIP/FID values in Table 4 cannot be attributed to the adversarial watermark. The manuscript should define the degradation metric, add the control, and report run counts and error bars.","section":"Concept Protection Evaluation / Table 4 / Abstract"},{"comment":"The surrogate model used for PGD is described as trained on \"clean referenced images XB\", but Eq. (5) defines θ* = argmin_θ Σ_{x∈XA} L_ft(θ, xi), i.e., over XA. Since θ* is exactly the model used in Eq. (6) to compute the adversarial perturbation, the notation must be aligned with the description. If XA and XB are indeed different, the current equation trains the surrogate on the wrong set; if they are the same, the text should say so. This matters because the transferability of φ to independently fine-tuned target models is the load-bearing assumption for the defense claim.","section":"Imperceptible Adversarial Perturbation Injection, Eqs. (5)–(6)"},{"comment":"The claimed detection improvements are not reproducible from the reported tables. The abstract states a 6.3%–19.3% detection-accuracy improvement over baselines, and the text says \"our method outperforms the best baseline by around 6.3%\" in the discussion of Table 2. However, Table 2 average bit accuracy is 91.34 for ConceptWM versus 86.59 for RivaGAN (a 4.75-percentage-point gap) and 83.31 for Stable Signature; no column in Table 2 yields a 6.3% margin. In Table 1 the FLW variant has clean BitAcc 95.68, lower than DwtDctSvd (99.98) and StableSig (98.49). Additionally, the abstract claims evaluation on \"COCO and StableDiffusionDB\", but the experiments section only mentions COCO for FID and reports no StableDiffusionDB results. Please specify how the margins are computed and provide the missing dataset results.","section":"Abstract / Table 1 / Table 2"}],"minor_comments":[{"comment":"The paragraph \"Prompt Mismatching\" says the results are shown in Table 3, but Table 3 contains inference steps, samplers, guidance scales, generation size, and VAE results; the prompt-mismatch bit-accuracy numbers appear only in Figure 3. Please correct the cross-reference and report prompt-condition results in a proper table.","section":"Ablation Studies / Prompt Mismatching"},{"comment":"Equation (2) introduces weighting coefficients λ and μ, but their values are never reported. Please add them to the training configurations for reproducibility.","section":"Fidelity-preserving Latent Watermark, Eq. (2)"},{"comment":"The text writes \"FPR of 10e-5\" and the Table 1 caption uses \"10−5\"; the intended value is 10^{-5}, and the notation should be unified.","section":"Evaluation Metrics / Table 1 caption"},{"comment":"The text reports a \"CLIP difference of 0.02\" relative to the original model, but Table 1 gives FLW CLIP 0.365 versus \"None\" 0.367, a difference of 0.002; please correct the value.","section":"Watermarked Diffusion Model Fidelity"},{"comment":"There are numerous typos, including \"celibrities\", \"misue\", \"Adcersarial\", \"extrect\", \"huaman\", and \"componets\"; a careful proofread is needed.","section":"Throughout"},{"comment":"No error bars or repeated-run statistics are reported for any table. At least for the headline claims (watermark bit accuracy and the fine-tuning degradation numbers), please report variance across seeds or runs.","section":"Tables 1–5"}],"recommendation":"major_revision","confidential_remarks":"The tracing and robustness parts of the paper are reasonably executed, but the proactive-defense claim is the main differentiator and it is currently under-supported. The missing no-watermark control and undefined 21.7% metric are straightforward to fix, so major revision is appropriate rather than rejection. I would also ask the editor to verify that the anonymous code link is live and that the dataset splits and evaluation protocol can reproduce the reported numbers, since the 6.3% margin is not reproducible from the text."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nYou should know two things about this paper. The good: it is the first to frame watermarking at the concept level, binding a bit sequence to a visual concept and its textual prompt, and it does this with a single-stage decoder that avoids separate concept detection. The tracing results in Tables 1–3 are consistent and reasonably strong: bit accuracy stays above 0.9 across eight image distortions, and the method beats four baselines by ~6.3% on average. That part is credible.\n\nThe bad: the advertised “critical capability” — sustaining a 21.7% FID/CLIP degradation under adversarial fine-tuning — is not actually established. The 21.7% number is never defined. Table 4 reports PIQE, NIQE, CLIP, and FID for fine-tuned models under several settings, but there is no no-watermark control. Fine-tuning DreamBooth on 5–8 images degrades output quality by itself, and the Table 4 values (FID 66–87, CLIP 0.27–0.31) could be largely or entirely artifacts of small-set personalization rather than the adversarial watermark. Without a clean reference model fine-tuned on the same concept images without any watermark, you cannot attribute that degradation to ConceptWM. Also, the abstract claims COCO and StableDiffusionDB, but the experiments use CelebA-HQ and WikiArt, and no error bars appear anywhere. These are fixable, but they are not minor.\n\nThe concept-specific tracing idea is real, and the variation experiments over samplers, guidance, and VAEs are a decent start. The loss design and the FLW module are sensible, if not heavily analyzed. But the headline contribution is proactive resistance to fine-tuning, and that is under-supported as written. If I were covering this area, I would want a control, a defined degradation metric, and significance testing before accepting the claim. I would still send it to review — the idea deserves referee time and the authors can probably fix the evaluation. But I would not cite it for the protection claim in its current form.\n\nFor your reading group, it is a useful case study in how missing controls undermine a security claim. Otherwise, wait for the revision.","headline":"Concept-specific tracing is a real step forward; the fine-tuning-resistance headline needs a control and a defined metric.","tokens_in":14189,"tokens_out":2609,"would_cite":false,"duration_ms":24806,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper claims that a single latent watermark can both identify the visual concept in a generated image and trace which diffusion model made it, and that embedding an adversarial perturbation alongside the watermark degrades images…","keywords":["concept watermarking","diffusion models","latent watermarking","adversarial perturbation","DreamBooth","model tracing","copyright protection","Stable Diffusion"],"falsifier":"Fine-tune a fresh Stable Diffusion model with DreamBooth on ConceptWM-generated concept images, without using the surrogate model or the optimization recipe, and compare FID and perceptual quality against a no-watermark control trained on the same concept images; if the control and the ConceptWM-trained model produce similarly high-quality concept images, the central protection claim is refuted.","tokens_in":13169,"feed_emoji":"🖼️","tokens_out":5873,"duration_ms":49842,"temperature":0.7,"pith_summary":"The paper proposes ConceptWM, a lightweight concept watermarking framework for diffusion models. It tries to establish that a watermark bit sequence, a visual concept, and a textual pseudo-word can be bound together during model fine-tuning, so one watermark check identifies both the concept and the source model. It further claims that an imperceptible adversarial perturbation embedded with the watermark prevents attackers from using generated concept images to fine-tune their own diffusion models: outputs from such fine-tuned models are severely degraded. If true, this would replace the two-stage pipeline of concept detection followed by model tracing with a single-step verification, giving creators a direct way to trace and protect specific visual concepts.","feed_headline":"One watermark traces the concept and the source model","feed_subtitle":"ConceptWM binds bit codes to visual concepts, beating watermark baselines by up to 19.3 percent.","key_machinery":"The framework has three components. Fidelity-preserving Latent Watermarking (FLW) embeds an image-dependent watermark in latent space using a combination layer plus LPIPS and peak-pixel-difference losses, making the watermark learnable by the U-Net and visually imperceptible. Imperceptible Adversarial Perturbation Injection (IAPI) trains a surrogate model with one-step DreamBooth on clean reference images and runs PGD to craft a perturbation $\\varphi$ that maximizes the conditional generation loss, so the perturbation transfers its damaging effect to independently fine-tuned models. Efficient Concept Watermark Training (ECWT) alternates DreamBooth concept learning with watermark learning on the difference between watermarked and non-watermarked predictions, allowing the U-Net to learn the concept and the adversarial watermark together. The load-bearing mechanism is the latent fusion layer combined with the PGD-computed perturbation that survives fine-tuning and model-version changes.","core_discovery":"The central claim is that concept-level tracing and concept-level protection can be achieved in a single watermarking pass rather than by combining image watermarking with separate concept detection. ConceptWM establishes a tripartite correlation: a chosen bit sequence (the watermark), a visual concept (for example, a particular person or artistic style), and a textual concept (a pseudo-word used in prompts). During generation, the watermarked U-Net produces concept images whose latent codes contain both the watermark and a small adversarial perturbation. Experiments report bit accuracy around 0.93 to 0.96, robustness across eight image distortions with average bit accuracy of 91.34 percent, and a 6.3 to 19.3 percent detection-accuracy improvement over baseline watermarking methods. The paper also reports that fine-tuning a Stable Diffusion model on ConceptWM images with DreamBooth, LoRA, or Textual Inversion yields strongly degraded images, with PIQE up to 63.18 and FID up to 87.21 in the reported settings.","pith_inferences":["If the transferability result holds, the same latent watermark could carry attribution metadata while the adversarial component raises the cost of unauthorized fine-tuning; combining these two functions in one perturbation is a natural extension the paper does not explore.","An adaptive attacker who knows about the watermark could fine-tune on images after JPEG or VAE compression or with a larger noise budget; testing ConceptWM against such an adaptive adversary is a direct next step beyond the paper's current attack set.","The reported 21.7 percent FID/CLIP degradation is asserted without a defined metric; specifying it as a relative change against a no-watermark fine-tuned control would make the claim directly falsifiable.","The concept binding is demonstrated for DreamBooth-style subject and style concepts; extending the same tripartite binding to multi-concept LoRA or Textual Inversion is the paper's stated future direction and would show whether the mechanism scales beyond single-concept fine-tuning."],"forward_implications":["Concept-level tracing becomes one step: a watermark decoder on any generated image returns both the concept identity and the model or user ID, skipping separate concept detection.","The adversarial watermark transfers across Stable Diffusion versions (v1.4 and v2.1) and across personalization methods (DreamBooth, LoRA, and Textual Inversion), so a single watermarked release can degrade several fine-tuning pipelines.","Because the watermark is embedded in latent space with a learned distortion layer, it withstands image processing, geometric, VAE-compression, and diffusion-reconstruction attacks better than the compared baselines.","The framework requires only a few reference images and localized fine-tuning, so it can be applied per concept without retraining the whole generator."],"supporting_citations":[{"why":"Supplies the DreamBooth fine-tuning loss that ConceptWM alternates with watermark training; the central concept-learning method.","marker":"Ruiz et al. 2023"},{"why":"Defines Textual Inversion, the textual pseudo-word personalization method used to build the text-concept side and tested as an attack.","marker":"Gal et al. 2022"},{"why":"Defines LoRA, one of the personalization fine-tuning methods that the adversarial watermark is tested against.","marker":"Hu et al. 2021"},{"why":"Provides Projected Gradient Descent, the optimization used inside Imperceptible Adversarial Perturbation Injection to craft the perturbation.","marker":"Madry 2017"},{"why":"Stable Signature is a VAE-based watermark baseline that ConceptWM compares against on fidelity, bit accuracy, and true positive rate.","marker":"Fernandez et al. 2023"},{"why":"Tree-Ring is a latent-based zero-bit watermark baseline used in the true-positive-rate comparisons.","marker":"Wen et al. 2024"},{"why":"DwtDctSvd is a post-processing watermark baseline in the robustness and fidelity comparisons.","marker":"Cox et al. 2007"},{"why":"RivaGAN is a post-processing watermark baseline in the robustness and fidelity comparisons.","marker":"Zhang et al. 2019"},{"why":"Supplies the learned VAE-compression attack used to test watermark robustness.","marker":"Cheng et al. 2020"},{"why":"Supplies the diffusion-based reconstruction attack used to test whether the watermark survives regeneration.","marker":"Zhao et al. 2023a"}],"fun_headline_variants":["ConceptWM ties visual concepts to watermark IDs","One watermark identifies concept and source model","Single watermark for concept and model tracing","Concept watermarking beats baselines by 19%","Watermark visual ideas to trace model misuse"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The adversarial protection stands or falls on whether a perturbation computed against a surrogate model trained on clean reference images still degrades the outputs of independently fine-tuned diffusion models; the paper does not report a no-watermark control or a definition of the 21.7 percent degradation figure.","fun_headline_variants_meta":{"raw":{"variants":["ConceptWM ties visual concepts to watermark IDs","One watermark identifies concept and source model","Single watermark for concept and model tracing","Concept watermarking beats baselines by 19%","Watermark visual ideas to trace model misuse"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000289,"raw_usage":{"total_tokens":1713,"prompt_tokens":986,"completion_tokens":727,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":602,"completion_tokens_details":{"reasoning_tokens":661}},"tokens_in":602,"tokens_out":727,"duration_ms":7314,"temperature":1.0,"reasoning_tokens":661,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T18:14:05.302110+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Fine-tune a fresh Stable Diffusion model with DreamBooth on ConceptWM-generated concept images, without using the surrogate model or the optimization recipe, and compare FID and perceptual quality against a no-watermark control trained on the same concept images; if the control and the ConceptWM-trained model produce similarly high-quality concept images, the central protection claim is refuted.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"DwtDctSvd is a post-processing watermark baseline in the robustness and fidelity comparisons."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the learned VAE-compression attack used to test watermark robustness."}],"review_version":1}