{"id":"2e2fa04d-505e-4948-9ece-8f01a249573b","arxiv_id":"2501.09284","paper_version":2,"verdict":"REJECT","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"high","formal_verification":"none","parameter_count":3,"one_line_summary":"SEAL embeds a secret matrix between LoRA's low-rank factors, then decomposes and hides it in the released weights, but its ownership verification can be gamed by claiming the identity matrix as the passport.","lead":"SEAL is a proposed watermarking scheme that hides a secret matrix inside LoRA fine-tuned model weights so the publisher can later claim ownership. The paper reports no performance loss and strong resistance to removal, obfuscation, and forgery attacks, but the verification procedure can be trivially forged by anyone holding the released weights.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Algorithm 3's ownership verification accepts the trivial forgery (B', A', I, I): the released weights with identity passports reconstruct B'A' exactly and produce a zero fidelity gap.","rationale":"The reader identified exactly the load-bearing weakness. I re-read the paper including Appendix C's attempted defense. That defense targets a different attack: it argues a single post-hoc factorization cannot produce two distinct entangled passports when B and A are full rank. The actual attack uses identical passports, so it is untouched by the appendix. This is not a disagreement with external consensus; it is an internal inconsistency between Algorithm 3 and the claimed robustness against ambiguity attacks. The paper may contain useful components, such as passport-based training without extra loss and extraction-based detection, but the central ownership-verification guarantee as written fails. Because the reviewer's REJECT verdict is already based on this same concern, I recommend no change to the verdict.","tokens_in":24844,"tokens_out":4727,"duration_ms":58307,"concrete_test":"Simulate Algorithm 3 exactly on a released SEAL checkpoint with claimant submission (B, A, C_a, C_b) = (B', A', I, I), using the same task T and threshold epsilon_T as in Table 5. If the reconstruction equality B' I A' = B' A' holds and the fidelity gap is 0 <= epsilon_T, the verifier returns True, proving that ownership is forgeable without any secret knowledge.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Algorithm 3 in §3.6.3 accepts a claimant if (i) B C_a A = B' A' and (ii) |MT(N(B,A,C_a)) - MT(N(B,A,C_b))| <= epsilon_T. The algorithm does not require C_a != C_b, does not require that (B,A) were trained with the secret passports, and does not tie the submitted quadruplet to the concealed C or C_p. Thus any holder of the public weights can submit (B', A', I, I): condition (i) holds exactly, and condition (ii) is zero because both metric evaluations use the same network N(B', A', I). Since all reported epsilon_T values in Table 5 are positive, Algorithm 3 returns True. Appendix C only argues that one factorization cannot yield two distinct passports; it does not address identical passports, and its rank-full assumption is satisfied by the trivial forgery. Even adding a distinctness requirement would not help, because a sufficiently small perturbation of I would keep the gap below epsilon_T by continuity of the task metric. The central ownership and ambiguity-attack claims are therefore internally inconsistent with the stated verification procedure.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes SEAL, a white-box watermarking scheme for LoRA weights. A secret, non-trainable matrix C is inserted between the LoRA factors B and A during fine-tuning, with a second passport Cp alternated during training. After training, C is decomposed and merged into the released weights B' = B C1 and A' = C2 A. Ownership is verified either by extracting C from the released weights (Algorithm 2) or through a fidelity-gap test comparing two submitted passports (Algorithm 3). The paper reports fidelity results on commonsense reasoning, instruction tuning, visual instruction tuning, and text-to-image synthesis, and claims robustness against pruning, fine-tuning, structural obfuscation, and ambiguity attacks.","tokens_in":25092,"tokens_out":9771,"duration_ms":100265,"significance":"A reliable LoRA watermarking scheme with no extra training loss and resistance to ambiguity attacks would be practically valuable, and the paper contains a useful amount of experimental material: multiple base models, several task families, hyperparameter tables, and ablations. The central matrix identities are simple and transparent. However, the paper's own verification algorithm and linear algebra contradict the core security claims: the fidelity-gap test accepts a trivial forgery from public information, the extraction procedure is not owner-exclusive under the paper's rank assumptions, and the no-degradation claim is contradicted by the paper's own tables. Because these are load-bearing claims of the watermarking scheme, the result as stated is not established.","major_comments":[{"comment":"Algorithm 3 accepts the trivial forgery (B', A', I, I). Any holder of the public weights B' and A' can submit B = B', A = A', Ca = I, Cb = I; the reconstruction check B Ca A = B' A' holds exactly, and the fidelity gap is |M_T(N(B',A',I)) - M_T(N(B',A',I))| = 0, which is no larger than every positive threshold reported in Table 5. Algorithm 3 does not require Ca ≠ Cb, does not require N(B,A,Ca) ≠ N(B,A,Cb), and does not compare the submitted pair to the concealed passport Cp; the verifier only sees the submitted quadruplet. Thus the algorithm proves no knowledge of the secret training and is forgeable without any data, retraining, or knowledge that SEAL was used. Adding a distinctness requirement would not repair the scheme, since a sufficiently small perturbation of Cb = I would keep the fidelity gap below the reported thresholds while preserving the reconstruction check for Ca = I.","section":"§3.6.3, Algorithm 3"},{"comment":"The claim that only the legitimate owner can extract the passport is false under the paper's own rank assumption. If B' and A' have full rank r, then B'† B' = I_r and A' A'† = I_r, so B'†(B' A')A'† = C. Since B' and A' are the publicly released matrices, any verifier or attacker can recover C from public information alone, without knowing the private B, A, or C. This is not a subtle attack: it is the direct identity in Algorithm 2 with the claimant's matrices replaced by the public ones. With C recovered, an attacker can also set B = B', A = C^{-1}A' for invertible C, submit Ca = C and Cb = C + δ, and satisfy the reconstruction check in Algorithm 3 while keeping the fidelity gap small for small δ. The privacy of the passport is therefore not preserved.","section":"§3.5, Algorithm 2"},{"comment":"The claimed 'no performance degradation' is contradicted by the paper's own experiments. In Appendix F.3, Table 9, SEAL averages 63.1 versus LoRA's 66.9 on LLaVA-1.5 visual instruction tuning, with large per-task drops such as VQAv2 75.4 vs 79.1, GQA 58.3 vs 62.9, VisWiz 41.6 vs 47.8, VQAT 52.9 vs 58.2, and MMBench 60.5 vs 66.1. In Table 1, SEAL (Ours) is below LoRA on Mistral-7B-v0.1 (84.84 vs 87.07, with non-overlapping standard deviations) and on Gemma-2B (77.55 vs 78.43). Since the paper itself lists fidelity as a required watermark criterion (§2.3), these results should either change the claim or the method; at minimum, the visual instruction tuning scores cannot be described as 'comparable' in the main text.","section":"Abstract, §4.4"},{"comment":"The security argument in Appendix C does not address the verification procedure that is actually implemented. Appendix C.4 proves only that two distinct passports cannot both exactly reconstruct B' A' from a single rank-full factorization. But Algorithm 3 requires only B Ca A = B' A'; the second passport Cb is constrained solely by the metric gap, so the appendix proves a different, stronger statement than the algorithm enforces. The trivial forgery (B', A', I, I) is outside the scope of Appendix C precisely because it uses identical passports. In addition, the threshold ε_T in §3.6.2 is measured from the owner's own two passports (C, Cp) on the owner's trained network; there is no argument or statistical calibration showing that this threshold bounds the gap for arbitrary submitted quadruplets. The premise that a forger cannot produce two passports with a small fidelity gap is the claim to be proved, not a consequence of the appendix's linear algebra.","section":"Appendix C, §3.6.2"}],"minor_comments":[{"comment":"The manuscript contains numerous typos and grammatical errors, including 'universial' in the contributions list, 'entanglment' in the abstract, 'despicted' in §3.3, 'idntify' in §2.3, 'lacks have access' in §2.3, 'Finetruning' in Table 13, and 'Comparision' in Table 16.","section":"Throughout"},{"comment":"Appendix C.1 argues that an attacker cannot tell that SEAL was used, but §2.3 explicitly adopts Kerckhoffs's principle, under which the adversary knows the watermarking scheme. The indistinguishability argument is therefore inconsistent with the stated threat model and should not be used as a security assumption.","section":"§2.3 and Appendix C.1"},{"comment":"The main-text Table 2 reports only a single 'Acc.' number for visual instruction tuning, while the appendix Table 9 gives the per-benchmark breakdown. Because the fidelity claim is central, the detailed breakdown or a clearly labeled summary should appear with the main claim rather than only in the appendix.","section":"Table 2 and Table 9"},{"comment":"The appendix reports SEAL's visual instruction tuning accuracy as 63.1, but the main text states that SEAL is 'comparable' to LoRA. This wording should be corrected to reflect the measured gap.","section":"Appendix F.3, Table 9"}],"recommendation":"reject","confidential_remarks":"The core verification procedure accepts a trivial public-information forgery, the extraction identity is available from the released weights under the paper's own rank assumptions, and the fidelity claims are contradicted by the paper's tables. These are foundational problems with the scheme as stated, and I do not see a path to acceptance within the scope of a revision."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Thanks for sharing the Pith report. I read the paper and the appended stress-test note. The stress-test holds up: Algorithm 3 in §3.6.3 accepts (B', A', I, I) as a valid ownership claim. The reconstruction check B I A' = B'A' holds exactly, and the fidelity gap between the two submitted passports is zero because both metric evaluations run the same network N(B', A', I). All reported epsilon_T values in Table 5 are positive (0.3–3.7), so the verifier returns True. That's not a subtle attack; it's the public weights plus an identity matrix. Appendix C argues that a single factorization cannot yield two distinct passports, but it does not address identical passports, and even a distinctness requirement would fail by continuity: a tiny perturbation of I keeps the gap below any positive threshold. So the central robustness claim collapses as stated.\n\nThe paper does have a genuinely new mechanism. Prior passport methods didn't target LoRA's two-factor release; SEAL's trick of inserting a non-trainable passport matrix between B and A and then SVD-decomposing it into the released B', A' is a real adaptation, and the experimental scope is broad: commonsense reasoning across five model sizes, instruction tuning, LLaVA, and DreamBooth. The extraction idea (B† B' A' A†) is algebraically clean under the full-rank assumption. That part is honest and well-described.\n\nThe soft spots beyond the forgery: fidelity. The abstract says 'no performance degradation,' but Table 1 shows Gemma-2B SEAL at 77.55 vs LoRA 78.43 and Mistral-7B at 84.84 vs 87.07, and Table 9 shows LLaVA average 63.1 vs 66.9 for LoRA. Those are real gaps on the authors' own numbers. The extraction significance test also lacks a standard-LoRA negative control; rejecting the null against a random matrix doesn't show the passport is present, since a structured baseline might behave the same. And epsilon_T being measured from the owner's own two passports gives the threshold a circular flavor, though that's secondary to the forgery.\n\nWho's this for? People working on PEFT watermarking might find the decomposition trick worth building on, but the scheme as written is not usable. It deserves a serious referee because the idea is relevant and the flaw is specific and fixable in principle, but as it stands the security claim fails.","headline":"SEAL's verification accepts a trivial identity-passport forgery, so the central security claim fails—but the SVD-decomposition trick is a real, if modest, contribution.","tokens_in":25608,"tokens_out":2636,"would_cite":false,"duration_ms":25833,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"SEAL embeds a fixed secret matrix between the two LoRA factors, creating a hidden passport that proves ownership either by extraction or by a two-passport fidelity check.","keywords":["white-box watermarking","Low-Rank Adaptation","LoRA","passport verification","fidelity gap","ownership protection","parameter-efficient fine-tuning","attack resistance"],"falsifier":"Run Algorithm 3 with the trivial claimant tuple $(B', A', I, I)$: the reconstruction check passes because $B' I A' = B' A'$, and the fidelity gap between $N(B', A', I)$ and itself is zero, which is below any threshold $\\epsilon_T$. If the verifier returns True, then a publicly known forgery succeeds with no secret knowledge; if the verifier rejects this input, the paper needs to state the additional restriction that rules it out.","tokens_in":24661,"feed_emoji":"🔐","tokens_out":11970,"duration_ms":110361,"temperature":0.7,"pith_summary":"SEAL is a white-box watermarking scheme for Low-Rank Adaptation (LoRA) weights, meaning the ownership mark is verified from the weights themselves rather than from model outputs. The paper claims that inserting a fixed, non-trainable secret matrix $C$ between the two trainable LoRA factors $B$ and $A$ during fine-tuning entangles the learned weights with that matrix, and that after training $C$ can be factored into the released matrices so the public checkpoint looks like an ordinary LoRA adapter. Ownership is then verified either by extracting $C$ using the owner's private matrices or by a third-party fidelity check that two co-trained passports give nearly the same task performance. If the scheme works as claimed, anyone sharing a lightweight adapter could later prove provenance without degrading the host task and without any extra watermark loss. The paper reports no performance loss on commonsense reasoning, instruction tuning, and text-to-image synthesis, and reports that pruning, fine-tuning, structural obfuscation, and passport-forgery attacks leave the watermark detectable.","feed_headline":"A hidden matrix inside LoRA weights can prove who owns them","feed_subtitle":"Training a secret passport matrix into low-rank adapters verifies ownership without hurting task accuracy.","key_machinery":"The load-bearing object is the non-trainable passport matrix $C \\in \\mathbb{R}^{r \\times r}$ inserted between the LoRA factors, together with the decomposition function $f(C) = (C_1, C_2)$ satisfying $C_1 C_2 = C$; the default is SVD, giving $B' = B U_C \\sqrt{\\Sigma_C}$ and $A' = \\sqrt{\\Sigma_C} V_C^T A$. This one matrix does two jobs. During training it reorients every gradient by $C^T$ on each side of the chain rule, which is what makes $B$ and $A$ depend on the passport; the paper calls this entanglement, meaning the adapted layer produces correct host-task outputs when the passport is present. After training, the same matrix is split and absorbed into $B'$ and $A'$, hiding the secret inside an ordinary-looking LoRA checkpoint. The second passport $C_p$ supplies the verifier's reference: a small fidelity gap between $C$ and $C_p$ on the host task is taken as evidence that both were co-trained with the same $B$ and $A$.","core_discovery":"The paper claims that Low-Rank Adaptation weights can be watermarked by training the update as $W' = W + BCA$ instead of $W' = W + BA$, where $C \\in \\mathbb{R}^{r \\times r}$ is a fixed secret matrix, and by hiding $C$ before the checkpoint is shared. During training the algorithm alternates between $C$ and a second private passport $C_p$, so both matrices are entangled with $B$ and $A$: the constant matrix shapes both forward outputs and gradient flow, and after training neither factor can be cleanly separated from it without breaking the adapter. The release step uses a decomposition $f(C) = (C_1, C_2)$ with $C_1 C_2 = C$; with the default SVD choice the owner publishes $B' = B C_1$ and $A' = C_2 A$, so $B' A' = B C A$ and the distributed weights are structurally indistinguishable from standard LoRA. For verification, the owner can extract the passport as $C_{\\mathrm{ext}} = B^\\dagger B' A' A^\\dagger$ under a full-rank assumption on $B$ and $A$, while a third-party verifier checks the fidelity gap $\\Delta = |M_T(N(B,A,C)) - M_T(N(B,A,C_p))|$ between the two passports and accepts ownership when $\\Delta$ stays below the task-specific threshold $\\epsilon_T$. The experiments assert that SEAL matches or exceeds standard LoRA on the host tasks and that removal, obfuscation, and ambiguity attacks cannot destroy the watermark without destroying the model.","pith_inferences":["The security of the fidelity-gap check ultimately rests on an unproven hardness claim: no one can find two passports with a small fidelity gap without co-training. A useful stress test would measure how many fine-tuning steps on public data it takes for a randomly chosen second passport to pass the threshold.","The watermark's hiding capacity grows with the rank $r$, while the paper's own rank ablation shows task accuracy drops as $r$ shrinks; the trade-off between passport strength and adapter quality is worth plotting explicitly.","The appendix's multi-passport sketch suggests a broader use: different passports could gate different behaviors of the same adapter, turning the watermark into a licensing switch or a multi-task selector, although the paper does not develop that direction."],"forward_implications":["Released SEAL weights are indistinguishable in shape and format from ordinary LoRA weights, so the watermark does not advertise itself.","Pruning or fine-tuning the adapter away destroys the host task before the passport becomes undetectable, because the secret is spread across many singular directions instead of a few bits.","A claimant must reproduce the released product $B' A'$ and show a small fidelity gap between two passports; the paper argues that a single rank-preserving factorization cannot yield two distinct passports that both pass, so the second passport must come from the original training.","Because the passport sits inside the multiplicative core, SEAL carries over to LoRA variants such as DoRA and to generalized bilinear operators like Kronecker or Hadamard products, given a suitable decomposition of $C$.","The owner-side extraction check is not safe for third-party arbitration, a limitation the paper states explicitly; verification in contested settings must rely on the fidelity-gap procedure."],"supporting_citations":[{"why":"Defines the LoRA update $W' = W + BA$ that SEAL modifies by inserting the passport $C$; it supplies the object under protection.","marker":"(Hu et al., 2022)"},{"why":"Introduces passport-based verification and the ambiguity-attack threat that SEAL's two-passport fidelity check is built to resist.","marker":"(Fan et al., 2019)"},{"why":"Provides the prior passport-aware normalization scheme whose trainable passport and extra loss SEAL explicitly contrasts with.","marker":"(Zhang et al., 2020)"},{"why":"Establishes the fidelity and robustness evaluation criteria and the weight-based embedding and extraction paradigm SEAL extends to LoRA.","marker":"(Uchida et al., 2017)"},{"why":"Shows that structural obfuscation can neutralize extraction-based verification, which motivates SEAL's fidelity-gap verification for third parties.","marker":"(Yan et al., 2023)"},{"why":"Documents effective ambiguity attacks against passport-based DNN protection, the attack class SEAL's two-passport scheme targets.","marker":"(Chen et al., 2023)"}],"fun_headline_variants":["LoRA weights get a hidden passport that proves ownership","Watermark LoRA by hiding a secret matrix in the weights","Entangled watermark inside LoRA proves who owns the model","Secret matrix entangled in LoRA: a white-box watermark"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The scheme assumes that no one can produce two different passport matrices that both keep the adapter's task performance nearly identical unless those passports were co-trained with the secret, and this hardness is asserted rather than proven.","fun_headline_variants_meta":{"raw":{"variants":["LoRA weights get a hidden passport that proves ownership","Watermark LoRA by hiding a secret matrix in the weights","Entangled watermark inside LoRA proves who owns the model","Secret matrix entangled in LoRA: a white-box watermark"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000577,"raw_usage":{"total_tokens":2778,"prompt_tokens":1057,"completion_tokens":1721,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":673,"completion_tokens_details":{"reasoning_tokens":1663}},"tokens_in":673,"tokens_out":1721,"duration_ms":10673,"temperature":1.0,"reasoning_tokens":1663,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-10T20:06:48.984904+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run Algorithm 3 with the trivial claimant tuple $(B', A', I, I)$: the reconstruction check passes because $B' I A' = B' A'$, and the fidelity gap between $N(B', A', I)$ and itself is zero, which is below any threshold $\\epsilon_T$. If the verifier returns True, then a publicly known forgery succeeds with no secret knowledge; if the verifier rejects this input, the paper needs to state the additional restriction that rules it out.","supporting_citations":[{"cited_title":"W., and Chan, C","cited_arxiv_id":null,"evidence_quote":"Introduces passport-based verification and the ambiguity-attack threat that SEAL's two-passport fidelity check is built to resist."},{"cited_title":"Passport-aware normalization for deep model protection","cited_arxiv_id":null,"evidence_quote":"Provides the prior passport-aware normalization scheme whose trainable passport and extra loss SEAL explicitly contrasts with."},{"cited_title":"Rethinking white-box watermarks on deep learning models under neural structural obfuscation","cited_arxiv_id":null,"evidence_quote":"Shows that structural obfuscation can neutralize extraction-based verification, which motivates SEAL's fidelity-gap verification for third parties."},{"cited_title":"Effective ambiguity attack against passport-based dnn intellectual property protection schemes through fully connected layer substitution","cited_arxiv_id":null,"evidence_quote":"Documents effective ambiguity attacks against passport-based DNN protection, the attack class SEAL's two-passport scheme targets."}],"review_version":1}