{"id":"796c523c-03cb-4b18-8227-8c221c7ee8b6","arxiv_id":"2504.12809","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"SADRE removes invisible image watermarks with saliency-guided noise injection plus latent diffusion reconstruction, reporting lower bit-recovery accuracy than JPEG, VAE, and regeneration baselines across six watermarking schemes.","lead":"The paper describes SADRE, a method that removes invisible watermarks from images by injecting saliency-guided noise in a latent space and then reconstructing the image with a diffusion model. If the reported results hold, it is a reminder that current invisible watermarking defenses can be bypassed while keeping image quality high.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The saliency mask M and watermark-strength estimate τ(x_w) are never defined or validated; without them, Eq. 2's targeted noise has no operational target, so SADRE's claimed advantage over regeneration may be just diffusion reconstruction plus tuned noise.","rationale":"The reader's weakest_assumption identifies exactly the most load-bearing gap: the saliency mask M and the watermark-strength estimate τ(x_w) are assumed to be available, but the paper never shows how they are obtained or that they point to watermark-affected regions. This matters because every other component of SADRE (latent diffusion, noise, reconstruction) is a regeneration attack; the only distinguishing element is the region-specific perturbation M ⊙ η. If M is not computed in a way that localizes the watermark, then the method is not 'saliency-aware' in any substantive sense, and the empirical margin over the Regeneration Attack baseline cannot be attributed to the proposed mechanism. The theory sections do not rescue this: Theorem 1, Eq. 7, and Theorem 2 are stated without derivation and take M and τ as inputs, so they assume the same undefined quantities. I agree with the reader that the appropriate verdict is CONDITIONAL, pending a precise specification and validation of M and τ, plus better uncertainty reporting. No verdict change is needed because the existing CONDITIONAL verdict already reflects this concern.","tokens_in":8433,"tokens_out":4030,"duration_ms":43604,"concrete_test":"Download the released code (record the commit hash) and locate the implementation of M and τ(x_w). Re-run the DwtDct and RivaGAN rows of Table 2 under three conditions: (a) M = 1 everywhere, (b) M from a standard saliency estimator (e.g., Grad-CAM or off-the-shelf salient-object detection), and (c) the intended M if one exists. Compare BRA and W_p with the Regeneration Attack baseline. If (a) and (c) differ by less than 0.05 in BRA, or if no M implementation exists, then the saliency component is not load-bearing and the claim of consistent best performance is not attributable to SADRE.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's central empirical claim (Section 4.2) is that SADRE beats JPEG, VAE, and the Regeneration Attack on all six watermarking schemes. The one mechanism that distinguishes SADRE from a plain diffusion-regeneration attack is the saliency-aware perturbation z̃ = z + M ⊙ η (Eq. 2), with noise level σ(x_w) chosen from an estimated watermark strength τ(x_w) (Eq. 3). But the manuscript never specifies how M is computed, how τ(x_w) is estimated, or how either is validated against any of the six watermarking methods. Section 4.1 reports only the noise range (0.05–0.15) and λ_w = 0.1. Without an operational definition of M, the method as described is not reproducible, and the reported gains in BRA/W_p cannot be attributed to saliency guidance. If M is not actually localizing watermark-affected latent regions (e.g., if it is just full-image or a generic image-saliency map), then SADRE's advantage reduces to the effect of adding σ ∈ [0.05, 0.15] noise before diffusion reconstruction, which is not a novel mechanism. The theoretical claims (Theorem 1, Eq. 7, Theorem 2) are asserted without proof and do not fill this gap, since they assume M and τ are given.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes Saliency-Aware Diffusion Reconstruction (SADRE), a pipeline that removes invisible watermarks by mapping a watermarked image into a latent space, injecting noise only into regions selected by a saliency mask, and then reconstructing the image with a reverse diffusion process. The authors claim that SADRE is theoretically grounded via Hölder-continuity assumptions and stability bounds (Theorems 1 and 2), and that it outperforms JPEG compression, VAE reconstruction, and a regeneration attack on six watermarking schemes, reducing bit recovery accuracy to 0.40–0.48 while keeping PSNR above 33 dB.","tokens_in":8764,"tokens_out":3665,"duration_ms":38944,"significance":"If the empirical claims hold, SADRE would be a practically relevant attack for web-content watermark removal, and the paper's breadth across six watermarking schemes is a strength. The authors provide a code link and report a table in which SADRE consistently achieves the lowest BRA and W_p among the four compared attacks, which is a useful baseline for future work. However, the significance is currently limited by two gaps: the saliency mask M and watermark-strength estimate τ(x_w) are never operationally defined, and the theoretical results are asserted without proofs. Because these components are the only factors distinguishing SADRE from a generic diffusion-regeneration attack, the central contribution is not yet reproducible or fully supported.","major_comments":[{"comment":"The saliency mask M and the watermark-strength estimate τ(x_w) are introduced as givens, but the manuscript never states how M is computed (e.g., gradient-based saliency, attention map, or a full-image mask) nor how τ(x_w) is estimated for any of the six watermarking schemes. Since Eq. (2) is the only mechanism distinguishing SADRE from a plain diffusion-regeneration attack, this omission makes the method non-reproducible and prevents attribution of the reported gains in Section 4.2 to saliency guidance. The implementation details in Section 4.1 report only the noise range and λ_w, which does not resolve the gap.","section":"Section 3.1, Eqs. (2)-(3)"},{"comment":"The abstract's claim that the framework is 'theoretically grounded with stability guarantees' rests entirely on assertions. Theorem 1, the Type I/II error relation in Eq. (6), the error bound in Eq. (7), and Theorem 2 are stated without proofs or derivations, and no domain of validity is given for parameters such as σ_c, δ, Δ, and Φ. In particular, Φ in Eq. (6) is not defined, and Eq. (7) is subsequently used as the basis for the reconstruction error bound. The authors should either supply complete derivations or explicitly soften the theoretical-guarantees claim.","section":"Sections 3.2-3.3, Theorems 1-2 and Eqs. (4), (6), (7), (9)"},{"comment":"The diffusion component is described only as a '50-step diffusion model with a linear noise schedule'; the architecture, pretraining data, and latent-space specification are not given. Without this information, it is unclear whether SADRE's advantage over the Regeneration Attack of [22] in Table 2 comes from the saliency-guided noise injection or simply from using a different, possibly stronger diffusion backbone. A controlled comparison using the same diffusion backbone with and without the saliency mask is needed to support the central empirical claim in Section 4.2.","section":"Section 4.1-4.2"}],"minor_comments":[{"comment":"The SSIM value of 0.1459 for RivaGAN under JPEG compression appears implausible relative to the neighboring entries and may be a typographical error; also, the identical SSIM values 0.9182 for DwtDct and DwtDctSvd under JPEG deserve a check.","section":"Table 2"},{"comment":"The function Φ in Eq. (6) is never defined; if it denotes the standard normal CDF, this should be stated explicitly, along with the assumptions that justify its use.","section":"Eq. (6)"},{"comment":"The composite metric D in Eq. (8) and the DSSIM term in Eq. (9) rely on a formal definition of DSSIM, but the manuscript only describes it as 'the inverse of SSIM'; the exact formula should be provided.","section":"Eqs. (8)-(9)"},{"comment":"The threat model assumes the adversary can estimate τ(x_w), but this assumption is never validated for any of the six watermarking schemes; a brief discussion or empirical check would strengthen the threat-model section.","section":"Section 2.1"}],"recommendation":"major_revision","confidential_remarks":"The manuscript appears to be a short WWW Companion paper whose central novelty is underspecified in the main text. The code link is a positive signal; if the repository contains the exact computation of M and τ(x_w), the authors should describe those computations in the paper and ideally include an ablation that turns the saliency mask on and off. The lack of proofs for the stated theorems is a serious but fixable issue if the claims are true; if the proofs are not available, the theoretical-guarantees phrasing should be removed. The paper's fit with the WWW conference is acceptable given the web-content watermarking context."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short version: SADRE is a diffusion-based watermark removal attack that reports lower bit-recovery accuracy (BRA) and Wasserstein distance than JPEG, VAE, and a regeneration attack across six watermarking schemes, with PSNR above 33 dB. The table is internally consistent and the method is plausible. But the two components that make it 'saliency-aware' — the mask M and the watermark strength estimate τ(x_w) — are never operationalized, and the theoretical claims are asserted without proof.\n\nWhat's actually new: the combination of saliency-guided noise injection in latent space with a 50-step diffusion reconstruction is a reasonable incremental extension of regeneration attacks. Evaluating on six schemes including Tree-Ring, StegaStamp, and EditGuard is useful, and the reported numbers (BRA 0.40–0.48, W_p 0.080–0.195) are competitive. The threat model is honest: the adversary has no clean image and does not know the embedding mechanism.\n\nThe soft spots are serious but not disqualifying. Eq. 2 has no operational target because M is never defined or validated against any watermarking scheme. Section 4.1 only gives the noise range (0.05–0.15) and λ_w = 0.1. If M is just a generic saliency map or a full-image mask, the claimed advantage over plain diffusion plus tuned noise evaporates. Second, Theorem 1, Theorem 2, and Eqs. 6–7 are stated without derivation; the Hölder continuity citation (Mitrea–Taylor) is about metric tensors, not image watermarking, so the theory is decorative as it stands. Third, one cell looks off: RivaGAN under JPEG has SSIM 0.1459 at 32.48 dB, suspiciously low; that needs a check. Fourth, no error bars, no statistical tests, no code commit hash.\n\nThe central empirical claim — SADRE beats the three baselines on these six schemes — is supported by the table as reported, so I don't see a load-bearing flaw that falsifies the experiment. But the gap between narrative and support is real. A serious referee should engage, not desk-reject, and should push for a concrete definition of M, a derivation or removal of the theory, and a runnable code snapshot.\n\nWho gets value: researchers working on watermark robustness or adversarial regeneration attacks. This is a short companion-paper contribution, not a breakthrough, but it is a useful data point if the missing details are filled in. My recommendation: send to peer review with expectation of heavy revision; the method and theory need work, but the empirical direction is worth refereeing.","headline":"A plausible diffusion-based watermark removal attack with a consistent table, but the saliency mask M and watermark strength τ are never defined, and the theory is asserted rather than shown.","tokens_in":9251,"tokens_out":3994,"would_cite":false,"duration_ms":36750,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"SADRE claims that saliency-masked latent noise plus reverse diffusion removes invisible watermarks to near-chance bit recovery while keeping PSNR above 33 dB.","keywords":["invisible watermark removal","diffusion reconstruction","saliency mask","adaptive noise injection","latent space perturbation","generative attack","image fidelity","bit recovery accuracy"],"falsifier":"Run SADRE against a watermarking scheme that spreads its bits across the full latent space, for example over all frequency bands or random coordinates, so no saliency mask can localize them. If bit recovery accuracy stays near 1.0, the paper's assumption that watermark-affected regions are maskable is refuted.","tokens_in":8213,"feed_emoji":"🎯","tokens_out":9092,"duration_ms":79744,"temperature":0.7,"pith_summary":"The paper sets out to show that invisible image watermarks can be removed by a diffusion-based attack that knows nothing about the embedding scheme except roughly where the watermark sits and how strong it is. It proposes SADRE, which maps the watermarked image to a latent space, injects noise only into regions selected by a saliency mask, sizes the noise to the estimated watermark strength, and reconstructs the image by reverse diffusion. Reported results put bit-recovery accuracy between 0.40 and 0.48 across six watermarking schemes, while PSNR stays above 33 dB and SSIM above 0.84. The reason to care is that it changes the threat model for image provenance: a posted image could be stripped of its invisible copyright marker without the attacker ever seeing the original.","feed_headline":"Targeted latent noise strips invisible watermarks while keeping images intact","feed_subtitle":"New attack cuts watermark bit recovery to 0.40-0.48 across six schemes with PSNR above 33 dB.","key_machinery":"The load-bearing object is the masked latent perturbation: a saliency mask $M$ identifies watermark-affected regions of the latent representation $z$, and noise $\\eta$ is added only through the element-wise product $M\\odot\\eta$, with the noise level $\\sigma(x_w)$ chosen from an estimate of watermark strength $\\tau(x_w)$. A reverse diffusion process $A(\\tilde z)$ then restores a high-fidelity image from the perturbed latent. The paper ties this to a localized Hölder continuity condition on the embedding map $\\phi$, so that distortions stay inside the masked regions and the reconstruction error stays bounded with high probability.","core_discovery":"On its own terms, SADRE claims to be a general watermark-removal attack: it beats JPEG compression, VAE-based reconstruction, and a prior regeneration attack on every watermarking scheme tested. The mechanism is targeted perturbation of a latent representation. The embedding function is assumed to satisfy a localized Hölder condition, so the difference between watermarked and clean latents is concentrated where a saliency mask points. Noise is added only in those masked regions, with the noise level chosen to balance detectability and distortion, and a reverse diffusion process reconstructs the image. The paper derives a reconstruction-stability bound, $P[\\|A(\\tilde z)-x\\|\\le \\epsilon]\\ge 1-\\delta$, and reports bit-recovery accuracies of 0.40 for StegaStamp, 0.42 for DwtDctSvd, 0.45 for DwtDct and RivaGAN, 0.47 for Tree-Ring, and 0.48 for EditGuard, with PSNR above 33 dB for every scheme.","pith_inferences":["The paper never validates that the saliency mask actually isolates watermark-affected latents; a natural test is to scramble the mask and check whether the bit-recovery improvement disappears. If random masks work as well, the saliency mechanism is not the cause.","A watermarking scheme that spreads its message uniformly across the latent space, rather than concentrating it in maskable regions, would be the natural countermeasure to try next; this is not tested in the paper.","The stability theorem depends on a Hölder constant and a critical noise threshold; one practical extension is to measure reconstruction error as the injected noise passes that threshold, to see whether the bound is tight."],"forward_implications":["A web adversary who can estimate watermark strength can strip invisible watermarks from posted images without access to the clean original.","Watermarking schemes whose only defense is embedding invisibility are not enough: the attack is reported to work across six different embedding designs.","After one SADRE pass, bit recovery accuracy drops to 0.40-0.48 for the tested schemes, so provenance tracing through these watermarks becomes unreliable.","Because PSNR stays above 33 dB and SSIM above 0.84, the attacked images remain visually usable, which is what makes the attack practical for real web content."],"supporting_citations":[{"why":"Supplies the regeneration-attack baseline that SADRE is compared against and motivates the claim that generative models can remove invisible watermarks.","marker":"[22]"},{"why":"Supplies the denoising autoencoder baseline labeled VAE in the attack comparison table.","marker":"[18]"},{"why":"Supplies the MS-COCO subset of 1,000 test images used in all evaluations.","marker":"[9]"},{"why":"One of the watermarking schemes attacked; SADRE reports lowering its bit-recovery accuracy to 0.45.","marker":"[1]"},{"why":"One of the watermarking schemes attacked; SADRE reports lowering its bit-recovery accuracy to 0.42.","marker":"[12]"},{"why":"One of the watermarking schemes attacked; SADRE reports lowering its bit-recovery accuracy to 0.45.","marker":"[20]"},{"why":"One of the watermarking schemes attacked; SADRE reports lowering its bit-recovery accuracy to 0.47.","marker":"[19]"},{"why":"One of the watermarking schemes attacked; SADRE reports lowering its bit-recovery accuracy to 0.40.","marker":"[17]"},{"why":"One of the watermarking schemes attacked; SADRE reports lowering its bit-recovery accuracy to 0.48.","marker":"[21]"},{"why":"Supplies the Hölder continuity background used for the localized stability assumption in the reconstruction bound.","marker":"[11]"}],"fun_headline_variants":["Saliency-guided noise slashes watermark recovery to ~0.40-0.48","Diffusion attack drops watermark bit recovery to near-chance levels","SADRE: Saliency-aware diffusion strips watermarks with PSNR >33 dB","Invisible watermarks ripped out by saliency-targeted diffusion noise"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The whole attack depends on the saliency mask actually marking the regions where the watermark lives and on the adversary being able to estimate the watermark's strength; if either fails, the targeted noise has no principled target.","fun_headline_variants_meta":{"raw":{"variants":["Saliency-guided noise slashes watermark recovery to ~0.40-0.48","Diffusion attack drops watermark bit recovery to near-chance levels","SADRE: Saliency-aware diffusion strips watermarks with PSNR >33 dB","Invisible watermarks ripped out by saliency-targeted diffusion noise"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.00093,"raw_usage":{"total_tokens":3985,"prompt_tokens":953,"completion_tokens":3032,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":569,"completion_tokens_details":{"reasoning_tokens":2949}},"tokens_in":569,"tokens_out":3032,"duration_ms":24424,"temperature":1.0,"reasoning_tokens":2949,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-16T12:21:17.046977+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run SADRE against a watermarking scheme that spreads its bits across the full latent space, for example over all frequency bands or random coordinates, so no saliency mask can localize them. If bit recovery accuracy stays near 1.0, the paper's assumption that watermark-affected regions are maskable is refuted.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the MS-COCO subset of 1,000 test images used in all evaluations."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"One of the watermarking schemes attacked; SADRE reports lowering its bit-recovery accuracy to 0.42."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"One of the watermarking schemes attacked; SADRE reports lowering its bit-recovery accuracy to 0.47."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"One of the watermarking schemes attacked; SADRE reports lowering its bit-recovery accuracy to 0.40."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the Hölder continuity background used for the localized stability assumption in the reconstruction bound."}],"review_version":1}