{"id":"c655208c-21e6-4e2a-a425-6077c9ede5e8","arxiv_id":"2502.08927","paper_version":2,"verdict":"REJECT","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"high","formal_verification":"none","parameter_count":4,"one_line_summary":"The paper claims a two-branch watermarking method that embeds a fixed QR code in a diffusion model's latent process and a dynamic watermark in generated images, enabling source verification.","lead":"This paper proposes a dual watermarking scheme for diffusion models: a fixed QR-code key embedded in the model's latent noise process, plus a dynamic, content-adaptive watermark added by a fine-tuned decoder. A generalist reader might care because it targets IP protection and traceability of AI-generated images, a pressing concern as text-to-image models spread.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The model-level QR watermark branch—the only mechanism for model ownership verification—has no quantitative extraction evaluation; the trigger and blending factor are unspecified, and the central claim is therefore unsupported.","rationale":"The abstract promises 'reliable source verification through watermark classification' and 'model ownership verification,' and those claims depend critically on the model-level QR branch. That branch is evaluated only by example images in Fig. 3, with no quantitative extraction accuracy, no QR decode rate, and no bit-error analysis. The text itself flags that the selection of κ and γκ is an open condition ('should ensure sufficient divergence'), and the undefined symbol in Eq. 5 makes exact reproduction impossible. The dynamic image-branch results in Table 2 and the quality comparisons in Tables 1 and 3 are relevant to the image watermark, but they do not establish that the fixed QR-code watermark can be recovered from the diffusion model and decoded to its metadata. Because this is the branch that connects a generated image to a specific trained model, the gap is load-bearing for the paper's headline contribution. I agree with the reader's weakest_assumption and see no reason to change the REJECT verdict.","tokens_in":6944,"tokens_out":19311,"duration_ms":194820,"concrete_test":"Re-implement the QR branch of Eqs. 2–5 (taking the undefined \\hat{z}_t^w as \\tilde{z}_t^w) with a single QR-code watermark as the watermark dataset, a fixed key κ, and a grid of blending factors γκ (e.g., 0.2, 0.5, 0.8); extract watermarks from at least 100 reverse samples and compute QR decode success and bit-error rate. If no setting gives near-100% decode success, the central source-verification claim fails; if some setting does, the paper still must report that experiment and the omitted κ/γκ choices to support the claim.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim of model ownership verification rests on the QR branch (Eqs. 1–5), but the paper reports no quantitative evidence that this branch works. The extraction description uses an undefined symbol: Eq. 5 evaluates ϵθ at γκ\\hat{z}_t^w + (1−γκ)κ, while the only defined forward state is \\tilde{z}_t^w in Eq. 2; if \\hat{z}_t^w is meant to be \\tilde{z}_t^w, that is never stated. The trigger κ and blending factor γκ are also left unspecified; §3.1 only says they 'should ensure sufficient divergence between the state distribution in the watermark diffusion process and that in the standard diffusion process.' The only support for the QR branch is Fig. 3, row 1, a few extracted images, with no bit-error rate, no QR decode-success count, no false-positive rate, and no baseline comparison. 'The resulting output should be a reconstruction' is an assertion, not a measurement. The dynamic image-branch numbers in Table 2 cannot substitute, because they classify image watermarks rather than recovering the model-specific QR metadata. If the QR branch extracts images that look like QR codes but do not decode to the intended payload, the ownership-verification claim fails regardless of the dynamic-branch results.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a dual watermarking framework for diffusion models: (i) a model-level branch that embeds a fixed QR-code watermark into the diffusion model's noise distribution by altering the forward process with a trigger key κ, and (ii) an image-level branch that embeds dynamic, content-adaptive watermarks through a fine-tuned decoder and a learned extractor. The authors report example extraction results, a table of image-statistic differences, classifier accuracy under attacks, and IS/FID comparisons against three baselines. The paper claims reliable source verification and minimal quality impact, and it announces a dataset and an evaluation methodology.","tokens_in":7228,"tokens_out":7623,"duration_ms":77909,"significance":"If fully substantiated, the dual-branch watermarking idea would be a useful contribution to model ownership verification and image traceability, and the proposed statistical evaluation procedure could complement standard distortion metrics. The paper, however, does not currently provide quantitative evidence for the model-level QR branch, which is the only mechanism for ownership verification, and the image-level evaluation is under-specified. The central claims are therefore not yet established, although the approach is plausible and the needed experiments are within reach.","major_comments":[{"comment":"The extraction update in Eq. (5) uses the symbol ^chat{z}_t^w, but this variable is never defined. Equations (1), (2), and (4) introduce ^chat{z}_t and ~tilde{z}_t^w, and the relationship between them is not stated. If ^chat{z}_t^w is intended to be ~tilde{z}_t^w, this must be said explicitly and the reverse iteration must be written with consistent notation. As written, the extraction procedure cannot be reproduced from the equations alone.","section":"§3.1, Eq. (5)"},{"comment":"The model-level QR branch, which is the only mechanism for model ownership verification, is evaluated only by example images. The paper reports no bit-error rate, no QR decode-success count, no false-positive rate over non-watermarked models, and no number of test samples. The statement that the reverse process 'should be a reconstruction of the QR-code watermark' is an assertion, not a measurement, and it cannot support the abstract's claim of reliable source verification.","section":"§3.1 and Fig. 3"},{"comment":"The trigger key κ and the blending factor γ_κ are never specified, and no selection criterion is given beyond saying that they 'should ensure sufficient divergence' between the watermark and standard state distributions. Since the extraction procedure depends directly on these values, the paper should report the chosen values and study their sensitivity; without this, the QR-branch results cannot be reproduced or assessed.","section":"§3.1"},{"comment":"The claim that the average change is 'approximately 5%' is misleading because the individual differences range from 0.00% to 16.67% (Blur Measure), and no sample size, variance, or error bars are reported. A single average does not support the conclusion that watermarking has minimal impact on image quality, especially for the blur statistic, which changes by more than 16%.","section":"§4, Table 1"},{"comment":"The attack results in Table 2 report classification accuracy without the dataset size, the number of test images per attack, error bars, or a description of the classifier, so the numbers cannot be independently interpreted. In Table 3, the reported FID values (for example, 3298.22 for Tree-Ring and 2157.45 for clean images) are far outside typical ranges, and no details are given about the evaluation set, feature space, or number of images; the comparison is therefore not reproducible.","section":"§4, Tables 2 and 3"},{"comment":"The robustness evaluation in Table 2 concerns image-level watermark-presence and watermark-classification accuracy, not the bit-wise recovery of the binary payload in Eq. (7). Since the dynamic branch is intended to embed traceable binary information, the paper needs to report bit-error rates or bit-accuracy under attacks before the traceability claim can be accepted.","section":"§3.2 and §4"}],"minor_comments":[{"comment":"The phrase 'dynamic watermark in generates images' should read 'dynamic watermark in generated images'.","section":"Abstract"},{"comment":"The caption says 'Raw 1' and 'Raw 2' where 'Row 1' and 'Row 2' are clearly intended.","section":"Fig. 3 caption"},{"comment":"Reference [17] is cited for HiDDeN, but [17] is Hsu and Wu (1999). The correct HiDDeN reference is Zhu et al., 'HiDDeN: Hiding Data With Deep Networks', ECCV 2018.","section":"References, item [17]"},{"comment":"The numerical values of λ_cosine, λ_SSIM, and α are not provided, so Eqs. (6) and (7) cannot be reproduced from the manuscript.","section":"§3.2"},{"comment":"The paper states that a dataset of watermarked images is generated and an evaluation methodology is introduced, but no dataset description, link, or release plan is given; this claim needs to be substantiated.","section":"§4"}],"recommendation":"major_revision","confidential_remarks":"The manuscript reads like an early preprint that needs substantial additional experimental work. The central model-level QR branch currently has no quantitative evaluation, and the attack and quality tables are under-specified. The reference error for HiDDeN and the unusual FID values suggest that the experimental section should be carefully checked. Given the overlap with the authors' previous work (Chen et al. [8]) and with related methods such as Stable Signature and Tree-Ring, the novelty statement should also be sharpened in a revision."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: the two-branch design—fixed QR key injected into the latent diffusion process plus dynamic image watermark—is genuinely new as a combination. The dynamic-branch pipeline (fine-tuned decoder, HiDDeN-style extractor, adaptive shape/color via cosine + SSIM) is a sensible extension of Stable Signature, and Table 2's attack-robustness numbers are directionally interesting. Also, they generated a watermarked-image dataset and proposed a statistical evaluation protocol, which is useful.\n\nThe soft spots are not tiny. The model-level QR branch is the only mechanism for model ownership verification, and the paper never reports a single quantitative extraction result: no bit error rate, no decode-success count, no false-positive rate, no baseline. The extraction equation (Eq. 5) uses \\hat{z}_t^w without defining it; the closest defined state is \\tilde{z}_t^w in Eq. 2. The trigger κ and blending factor γκ are unspecified, with only a hand-wavy \"should ensure sufficient divergence.\" So the central claim—that you can verify the source model—is unsupported by measurement. \"The resulting output should be a reconstruction\" is an assertion, not evidence. Also, the model-level watermark is trained in by construction: extraction under the same key partly verifies the training objective. That may be inherent to watermarking, but it raises the bar for showing extraction actually works, and they don't meet it.\n\nThe image-branch numbers have their own issues. The attack classification percentages in Table 2 have no sample sizes or error bars, and the statistics table's \"average about 5%\" hides a 16.7% change in the blur metric. The IS/FID comparison in Table 3 is strange: FID values of 2800–3500 are not plausible for a Stable Diffusion model, suggesting a nonstandard computation that the paper never explains. The dynamic watermark objective (Eq. 6) is coherent—minimize cosine similarity, maximize SSIM—but the text doesn't specify how λcosine and λSSIM were chosen.\n\nIn short: the packaging is new, the execution is under-evidenced. The model-ownership claim fails as stated. I'd send this to a serious referee, because the topic is timely and the dynamic branch might be salvageable, but I'd expect a reject verdict unless the authors add real QR extraction metrics and fix the notation.\n\nRecommendation: engage with it as a submission, but treat the central claim as unproven.","headline":"Novel dual watermarking design whose model-ownership branch has no quantitative extraction evidence; dynamic branch has some results but lacks error bars and uses an oddly scaled FID.","tokens_in":7735,"tokens_out":2959,"would_cite":false,"duration_ms":31490,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A diffusion model can carry a fixed QR-code watermark in its learned noise distribution and a content-adaptive dynamic watermark in every generated image, enabling source verification through watermark classification.","keywords":["diffusion models","latent diffusion","QR-code watermark","dynamic image watermark","model ownership verification","image quality metrics","watermark robustness","generated image traceability"],"falsifier":"Take a fine-tuned model from the paper's setup, generate a sizable set of images, and count how many extracted QR codes actually decode under the attack conditions in Table 2, including cases where a wrong key or wrong blending factor is supplied. If most extracted QR codes fail to decode, or if a random key decodes just as often, the example images in the paper do not establish model identification.","tokens_in":6717,"feed_emoji":"🖼️","tokens_out":10119,"duration_ms":91060,"temperature":0.7,"pith_summary":"The paper tries to establish that watermarking can protect diffusion-generated images without visibly degrading them: a fixed QR-code watermark is woven into the model's noise-generation process to identify the model, and a second, dynamic watermark is embedded into every generated image to trace it. The dynamic part matters because it changes shape and colour with each image, which the authors argue makes it harder to remove while keeping quality loss around five percent on a battery of image statistics. If the claim holds, a model owner can verify ownership by retrieving the QR code, and a platform can classify an image as watermarked and identify its source even after rotation, blurring, compression, cropping, or flipping. The paper also contributes a watermarked dataset and an 11-statistic methodology for quantifying the statistical impact of watermarking.","feed_headline":"Dual watermarks trace diffusion images to their source","feed_subtitle":"A fixed QR code rides in the model's noise; a dynamic mark adapts to each image, keeping quality loss near 5%.","key_machinery":"The load-bearing mechanism is the watermark diffusion process, an extension of the usual latent diffusion forward pass in which the noisy state $z_t$ is replaced by $\\hat z_t = \\gamma_\\kappa z_t + (1-\\gamma_\\kappa)\\kappa$, with $\\kappa$ the QR-code retrieval key and $\\gamma_\\kappa$ a blending factor. Joint training with $L_{\\mathrm{WDP}} = \\gamma_\\epsilon \\|\\epsilon - \\epsilon_\\theta(z_t,t)\\|^2 + \\|\\epsilon_w - \\epsilon_\\theta(\\hat z_t^w,t)\\|^2$ makes one denoiser serve both standard image generation and watermark-state generation, and the reverse update (Eq. 5) reconstructs the QR code when the key is supplied. The dynamic watermark branch supplies the second half: a decoder fine-tuned with a pre-trained extractor embeds a binary message controlled by a condition vector $e_i$, and the objective in Eq. 6 balances feature-space cosine similarity against pixel-space SSIM so the embedded mark is content-adaptive and visually subtle.","core_discovery":"The paper's central claim is that a single diffusion model can carry two independent watermarks that serve different purposes. The first is a fixed QR code whose retrieval key $\\kappa$ is mixed into every noisy latent state by $\\hat z_t = \\gamma_\\kappa z_t + (1-\\gamma_\\kappa)\\kappa$ during fine-tuning, so the denoiser learns a joint latent space; at sampling time, anyone holding $\\kappa$ and the blending factor $\\gamma_\\kappa$ can run the standard reverse update and recover the QR code, identifying the model. The second is a dynamic image watermark delivered by a fine-tuned decoder conditioned on a watermark-selection vector $e_i$; the watermark's shape and color are adjusted to the content by minimising cosine similarity in feature space and maximising SSIM in pixel space (Eq. 6), while a pre-trained extractor recovers the binary message. The evidence is classification accuracy above 93 percent across seven attack conditions, image statistics showing about 5 percent average shift, and generation-quality scores that beat three prior methods.","pith_inferences":["Because the paper reports classifier accuracy but no bit-error or decode rates for the QR code, a natural extension is to measure how many watermark bits survive each attack, which would let owners set error-correction margins for the QR payload.","The fine-tuned decoder suggests an attack surface the paper does not test: an adversary who distills or further fine-tunes the decoder might erase the dynamic watermark, so distillation-resistance would be a direct stress test of the claim.","The condition vector $e_i$ that selects which watermark to embed could be assigned per user or per prompt, turning model-level identification into per-account attribution; the current experiments only evaluate classification, not unique user tracing.","The 11-statistic procedure is a reusable quality budget: it could assess perceptibility of other watermarking schemes or common image edits before running human studies, since it tracks texture, edge, and frequency shifts together."],"forward_implications":["A model owner can demonstrate ownership by supplying the retrieval key and blending factor during sampling and recovering the QR code, without changing the images ordinary users generate.","Generated images can be traced to their source model through watermark classification even after rotation, blurring, texture reduction, compression, cropping, and flipping, with the lowest reported classification accuracy around 93.9 percent.","The dynamic watermark couples feature-space orthogonality with pixel-space fidelity, so varying the mark per image does not have to push quality loss above the roughly 5 percent average shift reported on 11 image statistics.","Compared with three prior watermarking methods on the same base model, the proposed approach reports the best Inception Score and Fréchet Inception Distance, moving generated-image quality closer to clean images.","The released watermarked-image dataset and the 11-statistic evaluation method give a concrete benchmark for auditing how much any blind watermarking scheme changes the statistical properties of generated content."],"supporting_citations":[{"why":"Supplies the base latent diffusion model whose learned noise distribution is modified to carry the QR watermark.","marker":"[24]"},{"why":"Shows that fine-tuning a latent decoder with a watermark extractor can embed watermarks, the strategy the dynamic branch extends.","marker":"[12]"},{"why":"One of the three prior watermarking methods the generation-quality comparison in Table 3 must beat.","marker":"[27]"},{"why":"A second baseline in the IS/FID comparison, representing a recent diffusion watermarking approach.","marker":"[8]"},{"why":"Third baseline in the IS/FID comparison, used to benchmark image-generation quality loss.","marker":"[19]"},{"why":"Provides the encoder-extractor formulation that the watermark extractor training builds on.","marker":"[17]"},{"why":"Supplies the sensitivity coefficients used to select the 11 image statistics that measure watermarking impact.","marker":"[7]"},{"why":"Defines the Inception Score used to compare generation quality of watermarked versus clean images.","marker":"[25]"},{"why":"Defines the Fréchet Inception Distance used to compare distribution-level quality against clean images and prior methods.","marker":"[16]"}],"fun_headline_variants":["Two watermarks, one diffusion model, full traceability","Fixed and dynamic watermarks tag AI images","Diffusion model carries dual watermarks for tracing","93% accuracy: dual watermarks trace AI images","Dual watermark system secures diffusion model output"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The model-level branch assumes that a single fixed key blended into every latent diffusion step creates a common latent space from which the ordinary reverse process reliably recovers the QR watermark, yet the paper gives no extraction-rate or bit-error measurements and leaves the choice of the key and blending factor unspecified.","fun_headline_variants_meta":{"raw":{"variants":["Two watermarks, one diffusion model, full traceability","Fixed and dynamic watermarks tag AI images","Diffusion model carries dual watermarks for tracing","93% accuracy: dual watermarks trace AI images","Dual watermark system secures diffusion model output"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000175,"raw_usage":{"total_tokens":1306,"prompt_tokens":984,"completion_tokens":322,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":600,"completion_tokens_details":{"reasoning_tokens":249}},"tokens_in":600,"tokens_out":322,"duration_ms":2995,"temperature":1.0,"reasoning_tokens":249,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-07T23:10:49.337660+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take a fine-tuned model from the paper's setup, generate a sizable set of images, and count how many extracted QR codes actually decode under the attack conditions in Table 2, including cases where a wrong key or wrong blending factor is supplied. If most extracted QR codes fail to decode, or if a random key decodes just as often, the example images in the paper do not establish model identification.","supporting_citations":[{"cited_title":"High-resolution image syn- thesis with latent diffusion models","cited_arxiv_id":null,"evidence_quote":"Supplies the base latent diffusion model whose learned noise distribution is modified to carry the QR watermark."},{"cited_title":"The stable signature: Rooting watermarks in latent diffusion models","cited_arxiv_id":null,"evidence_quote":"Shows that fine-tuning a latent decoder with a watermark extractor can embed watermarks, the strategy the dynamic branch extends."},{"cited_title":"A simplified and robust dct-based watermarking algorithm","cited_arxiv_id":null,"evidence_quote":"Third baseline in the IS/FID comparison, used to benchmark image-generation quality loss."},{"cited_title":"Hidden digital watermarks in images","cited_arxiv_id":null,"evidence_quote":"Provides the encoder-extractor formulation that the watermark extractor training builds on."},{"cited_title":"A statistical image realism score for deepfake detection","cited_arxiv_id":null,"evidence_quote":"Supplies the sensitivity coefficients used to select the 11 image statistics that measure watermarking impact."},{"cited_title":"Improved techniques for training gans","cited_arxiv_id":null,"evidence_quote":"Defines the Inception Score used to compare generation quality of watermarked versus clean images."},{"cited_title":"Gans trained by a two time-scale update rule converge to a local nash equilib- rium","cited_arxiv_id":null,"evidence_quote":"Defines the Fréchet Inception Distance used to compare distribution-level quality against clean images and prior methods."}],"review_version":1}