{"id":"08cce575-322d-4ab2-b263-5ec1bba31130","arxiv_id":"2505.01007","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"The authors prove that filter frequency components at certain frequencies are nearly unchanged by gradient descent when the layer input is low-frequency, and use these components as a fine-tuning-robust watermark.","lead":"This paper proposes a neural-network watermark that uses frequency components of convolutional filters that are approximately unchanged by fine-tuning. The authors prove a stability theorem under low-frequency inputs and test the scheme on standard image classifiers.","discovery_kind":"first_principles","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Proposition 3.4's approximate invariance is not quantified; at the integer watermark frequencies S' the Dirichlet coefficients in Eq. (7) are O(1), so the claimed zero-gradient guarantee does not cover the implemented watermark.","rationale":"The reader's weakest assumption already identifies the approximation gap at rounded integer frequencies, and my analysis confirms that the gap is not a harmless technicality: the Dirichlet kernel coefficients that should vanish at ideal non-integer frequencies are not small at the integer frequencies S' when u' is a low-frequency component other than DC. This makes the theoretical claim stronger than what is proved, and it is the most load-bearing weakness because the paper's contribution is precisely the claimed invariance. However, the issue is addressable: the authors could either prove a quantitative bound for Proposition 3.4, restrict the claim to the exact DC-only corollary, or reframe the method as an empirical fingerprint with stability measurements. The experiments show promising detection rates, but they do not test the theoretical condition under controlled low-frequency inputs. Since the reader's verdict is already CONDITIONAL and my concern is a sharper version of the same gap, the verdict should remain UNCHANGED.","tokens_in":16260,"tokens_out":11859,"duration_ms":121207,"concrete_test":"Run a synthetic one-step gradient check: fix K=3, M=N=32, choose a 3×3 filter W and a 32×32 input whose DFT is zero except at (0,0) and (1,0) (this satisfies the r=1 low-pass condition), take ∂Loss/∂Y to be a random real matrix, and compute the actual parameter update and the resulting ΔF_W^(11,0), both via autograd and via Eq. (7). Report ∥ΔF_W^(11,0)∥ / (η ∥∂Loss/∂W∥). If the ratio is not ≪1, Proposition 3.4's 'nearly zero' is falsified in the very regime the watermark uses.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim is that specific frequency components F_W^(uv) of the watermark module's filters are stable under fine-tuning. The strict version, Corollary 3.3, holds only for non-integer frequencies u=iM/K, v=jN/K and only when the input to the filter contains the DC component alone. The implemented watermark module uses a low-pass filter with r=1 and extracts components at the rounded integer frequencies S' (Eq. 13, implementation details r=1, K=3). Proposition 3.4 asserts ΔF_W^(uv)≈0 for this case, but no proof or bound is supplied, and the statement is not true as written. The change is ΔF_W^(uv)=−η Σ_{u',v'} A^{uv}_{u'v'} ∂Loss/∂F_Y^(u'v') F_X^(u'v') (Eq. 7). For K=3, M=N=32, the watermark frequency (u,v)=(11,0) has coefficient A^{110}_{10}=D(10)D(0) with |D(10)|=|sin(30π/32)/sin(10π/32)|≈0.235 and D(0)=3, giving magnitude ≈0.70; for u'=M−1 the coefficient magnitude is ≈1.24. The low-pass set Slow_1 includes these u', so nonzero low-frequency input components can produce changes of the same order as the gradient itself. No bound on ∥ΔF_W∥ relative to η∥∂Loss/∂W∥ is proved. Therefore the theoretical guarantee in the abstract—'will not be changed'—is not established for the actual integer frequencies and r=1 setting used in the experiments; only a fingerprint-style similarity is measured.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a neural-network watermarking method whose robustness to fine-tuning is claimed to be theoretically guaranteed. The authors use a frequency-domain reformulation of convolution (Theorem 3.1, due to Tang et al. 2023) to show that, for a convolutional layer whose input contains only the DC component, certain non-integer frequency components of the filter weights are invariant under one gradient-descent step (Corollary 3.3). For the realistic case of low-frequency inputs, they assert an approximate stability at rounded integer frequencies (Proposition 3.4), and they further prove equivariance of those frequency components to weight scaling and weight permutations. The proposed architecture is a parallel watermark module consisting of a low-pass filter followed by convolutional filters; the watermark is the set of frequency components of those filters at the integer frequencies S′, and detection is based on cosine-similarity matching with a threshold. Experiments on AlexNet and ResNet-18 over several datasets report 100% watermark detection rates after fine-tuning, weight scaling, and weight permutation, plus an ablation for an overwriting-defense loss.","tokens_in":16572,"tokens_out":6033,"duration_ms":61126,"significance":"The idealized invariance statement in Corollary 3.3 is clean, and the equivariance proofs for weight scaling and weight permutation are straightforward and correct. If the central claim were established for the actually implemented integer-frequency watermark, the work would be a meaningful step toward theoretically grounded fine-tuning-resistant watermarks. The empirical results are preliminary, however: they lack negative controls, statistical variation, and a quantitative bridge between the idealized theorem and the implemented scheme. The paper also does not provide code or release details, which limits reproducibility. Nevertheless, the underlying frequency-domain idea is interesting and potentially useful.","major_comments":[{"comment":"The transition from the strict invariance of Corollary 3.3 to the approximate statement of Proposition 3.4 is the load-bearing step, and it is not justified. Corollary 3.3 gives ΔF_W^(uv)=0 only for non-integer frequencies u=iM/K, whereas the implemented watermark uses the rounded integer frequencies S′. In Eq. (7), the coefficient A^{uv}_{u′v′} is a product of Dirichlet kernels. For example, with M=N=32, K=3, (u,v)=(11,0), and a low-frequency input component at (u′,v′)=(1,0) ∈ Slow_1, |A^{110}_{10}|≈0.70, so the update ΔF_W^(uv) is not negligible relative to η·∂Loss/∂W. Thus the statement \"ΔF_W^(uv)≈0\" is not a consequence of the preceding derivation and needs a quantitative bound. Without such a bound, the abstract's claim that the watermark components \"will not be changed by gradient descent\" is not established for the system that is actually built and tested.","section":"§3.2, Proposition 3.4 and Eq. (7)"},{"comment":"Theorem 3.1, on which the entire proof rests, is stated only for convolution with circular padding and stride 1. The implementation sections (§3.5 and §3.6) and the architecture description in §3.3 do not specify the padding mode used in the watermark module's convolutional filters or in the low-pass filtering operation. If the implementation uses zero padding, same padding, or any other mode, Eq. (5) is invalid and the invariance guarantee does not apply to the experiments. The authors should state the exact padding and stride used and, ideally, verify that the reported results remain valid under the assumptions of Theorem 3.1.","section":"§3.1 and §3.6"},{"comment":"The overwriting-attack defense is evaluated against a partial perturbation rather than a true overwrite. The paper says \"we do not completely overwrite the parameters but add random noise\" and the loss in Eq. (15) uses W+ϵ, with ϵ having 0.5 times the l2-norm of W. The claim that overwriting the watermark will significantly hurt classification performance is therefore tested only for this specific perturbation model. A full overwrite could produce different behavior. The authors should either justify that this partial perturbation is an adequate model of an overwriting attack or evaluate the defense under complete parameter replacement.","section":"§3.5, Eq. (15)"},{"comment":"The watermark detection rate DR is reported only for pairs consisting of the original watermarked network and its fine-tuned version. No negative controls are provided, such as DR between the watermarked network and an independently trained network, or between two unrelated watermarked networks. With the threshold τ=0.995, a DR of 100% is not interpretable without knowing the null distribution of cosine similarities. I request a false-positive analysis or a baseline comparison to support the claim that the matching procedure can actually identify the origin of a suspicious network.","section":"§3.4, Eq. (14) and Table 2"}],"minor_comments":[{"comment":"There is a notational mismatch between the main text and the proof: Eq. (7) uses A^{uv}_{u′v′}, while the proof introduces A^{u′v′}_{uv}. Please align the notation.","section":"Appendix A.1"},{"comment":"The definition of S′ in the caption, \"u=3i or v=3j; i,j∈{1,2}\", is ambiguous because the same \"or\" appears in the formal definition in Eq. (9). Please clarify whether the set is the union of the two conditions and add parentheses to make the quantifier explicit.","section":"Figure 4 caption"},{"comment":"There are several typographical errors, including \"convlutional\", \"bis terms\", and \"permuated\". A careful proofread is needed.","section":"General"},{"comment":"The heatmaps of E_d[‖ΔF_Wd^(uv)‖] have no colorbars, so it is not possible to judge whether the changes are small in an absolute sense. Please add colorbars and, ideally, report numerical values for the watermark frequencies.","section":"Figure 5"},{"comment":"The term \"keep relatively stable\" and the symbol \"≈\" are not defined. A formal statement should specify the norm, the dependence on the learning rate η, and the Lipschitz or kernel bound used.","section":"§3.2, Proposition 3.4"}],"recommendation":"major_revision","confidential_remarks":"The paper's core derivation relies on Theorem 3.1 from the authors' own prior work (Tang et al., 2023). This is acceptable if properly credited, but the novelty relative to that prior frequency-domain reformulation should be made explicit. The main gap is the unquantified passage from the strict non-integer-frequency invariance to the implemented integer-frequency watermark; until that gap is closed or the claims are weakened, I would not support acceptance. The empirical section is also too thin for a venue with strong evaluation requirements."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short version: there is a real theoretical observation here, but the central claim as stated is not the claim the paper proves. The exact zero-gradient result holds only for non-integer frequencies and DC-only input; the implemented integer-frequency version is covered only by an unquantified “approximately zero”. The stress-test note is right: for K=3, r=1, the Dirichlet factors at the rounded frequencies in S′ are O(1), so Proposition 3.4 is not established by the preceding math. That does not kill the paper—the empirical frequency heatmaps do show stability, and the idea of a fine-tuning-stable fingerprint is worth taking seriously—but it means the paper needs substantial revision before the invariance claim can be trusted.\n\nWhat is genuinely new: Corollary 3.3, the invariant components under DC-only input, is a clean extension of the self-cited frequency-domain convolution theorem from Tang et al. 2023, and it is proven carefully in the appendix. The scaling and permutation equivariance results are trivial consequences of linearity, but it is fine to state them. The overwriting-attack loss is a sensible idea, though underspecified.\n\nSoft spots, in rough order of importance. First, the abstract says specific frequency components “will not be changed” by gradient descent; the proof supports that only for idealized non-integer frequencies and DC-only input. The practical scheme uses rounded integers and r=1, and no bound on the approximation is provided. This is the load-bearing gap. Second, the method is closer to fingerprinting than to watermarking in the usual sense: nothing in training explicitly encodes a chosen owner message into the frequency components; the scheme extracts whatever stable components emerge and checks cosine similarity at threshold 0.995. A false-positive or control-network experiment is missing. Third, the experiments are preliminary: no baselines, no comparison to prior watermarking methods, no error bars, no code. Detection rates of 100% under scaling and permutation are unsurprising given the equivariance proofs, and the fine-tuning evidence is mostly a heatmap plus two sparse rows. Fourth, the padding mode is asserted in Theorem 3.1 but never confirmed for the actual implementation, and the noise scale in the overwriting loss has free parameters with no sensitivity analysis.\n\nThe citation pattern is acceptable. Theorem 3.1 is self-cited but published, the dependence is explicit, and the invariance corollary is new enough.\n\nWho should read it: people working on neural-network IP protection and frequency-domain analysis of CNNs. It deserves a serious referee—the core idea is original and the idealized theorem is correct—but I would not accept it as is. The authors need to either prove a quantitative bound for Proposition 3.4, add control and baseline experiments, and either reframe the method as fingerprinting or describe an actual embedding mechanism. Recommendation: major revision.","headline":"A real but overstated invariance result: the idealized proof is clean, the implemented watermark is not covered by it, and the paper needs revision before the headline claim is credible.","tokens_in":17124,"tokens_out":2593,"would_cite":false,"duration_ms":28495,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":["68T07"],"pacs":[],"model":"deepseek-v4-flash","headline":"Specific frequency components of a convolutional filter are provably untouched by fine-tuning, so they can identify a stolen network.","keywords":["neural network watermarking","fine-tuning robustness","frequency-domain convolution","revised discrete Fourier transform","gradient descent invariance","weight scaling","weight permutation","ownership verification"],"falsifier":"Feed the watermark branch an input containing only a non-low frequency component, say frequency $(1,0)$ on an $M=N=9$ grid with a $3\\times3$ filter, and fine-tune: the formula in Theorem 3.2 predicts a nonzero $\\Delta F_W^{(uv)}$ at the marked frequency $(3,0)$ because $\\sin(3\\cdot 2\\pi/9)$ is nonzero, so observing an unchanged mark under these conditions would falsify the claimed mechanism.","tokens_in":15993,"feed_emoji":"🔐","tokens_out":9018,"duration_ms":82393,"temperature":0.7,"pith_summary":"This paper tries to establish that certain frequency components of a convolutional filter are not changed by gradient descent, provided the filter's input contains only low-frequency content. If true, those components can serve as a watermark that survives fine-tuning, weight scaling, and weight permutations—attacks that normally erase embedded ownership marks. The paper builds a watermark module that low-pass filters its input, encodes the mark into the stable frequency components, and detects ownership through cosine similarity. The first-principles derivation rewrites convolution as a frequency-domain product and exposes frequencies at which the gradient kernel vanishes exactly.","feed_headline":"Frequencies a filter won't change in fine-tuning become a watermark","feed_subtitle":"Gradient descent can't touch certain Fourier coefficients of a convolutional layer, so a stolen network keeps its mark.","key_machinery":"The load-bearing object is the revised discrete Fourier transform $T_{uv}(W)$, which extracts from each $K\\times K$ filter channel the coefficient $Q^{(c)}_{uv}=\\sum_{t,s} W^{(c)}_{ts} e^{i(ut/M+vs/N)2\\pi}$. Theorem 3.1 rewrites convolution with circular padding as $F_Y^{(uv)}=F_W^{(uv)}\\cdot F_X^{(uv)}+\\delta_{uv}MNb$, turning a gradient step into a weighted sum over frequency pairs. The kernel $A^{uv}_{u'v'}$ has exact zeros when $K(u-u')/M$ is an integer, and those zeros are what freeze the selected frequency components. The watermark module is a parallel branch containing a low-pass filter $\\Lambda$ followed by $D$ convolutional filters, so the invariance applies to its filters without forcing the backbone to be bandlimited.","core_discovery":"The central claim is that for a convolutional layer with circular padding and stride one, a single gradient-descent step changes the revised-DFT component $F_W^{(uv)}$ by $\\Delta F_W^{(uv)} = -\\eta \\sum_{u',v'} A^{uv}_{u'v'} \\, \\frac{\\partial Loss}{\\partial F_Y^{(u'v')}} \\cdot \\overline{F_X^{(u'v')}}$, where $A^{uv}_{u'v'}$ contains the Dirichlet-type factor $\\frac{\\sin(K(u-u')\\pi/M)}{\\sin((u-u')\\pi/M)} \\frac{\\sin(K(v-v')\\pi/N)}{\\sin((v-v')\\pi/N)}$. When the input feature contains only the zero frequency, every term except $u'=v'=0$ drops out, and at frequencies $u=iM/K$ or $v=jN/K$ the numerator $\\sin(i\\pi)$ is zero, so $\\Delta F_W^{(uv)}=0$ exactly. For realistic low-frequency input and integer frequencies near those points, the change is approximately zero; the paper collects these frequencies into the set $S'$ used as the watermark. The paper also proves scaling equivariance, $F_{W^*}^{(uv)}=aF_W^{(uv)}$, and permutation equivariance, so neither attack changes the mark's direction. Detection compares normalized cosine similarity of the extracted complex vectors, and the reported experiments detect fine-tuned, scaled, and permuted networks at 100%.","pith_inferences":["The exact invariance in Corollary 3.3 holds at non-integer frequencies $u=iM/K$, while the practical watermark uses rounded integers; measuring the residual change at rounded versus exact frequencies would quantify how much slop enters before real data are considered.","Because the watermark lives in an auxiliary parallel module, the proof does not yet protect filters in the backbone itself; extending the low-pass condition to ordinary first-layer convolutions could make the marker intrinsic rather than add-on.","The same frequency-domain gradient decomposition suggests a broader search principle: any parameter whose gradient kernel is zero on the support of the input spectrum is a fine-tuning invariant, so the construction may generalize beyond the specific set $S'$.","Detection relies on cosine similarity of complex vectors, which discards magnitude; a testable extension is whether replacing this metric with a learned or weighted comparator would preserve the paper's theoretical guarantees."],"forward_implications":["Fine-tuning the backbone or the watermark branch leaves the marked frequency components nearly unchanged, so ownership can be verified after a stolen network has been fine-tuned.","A global weight-scaling attack rescales every marked component by the same factor, and cosine-similarity detection is insensitive to that rescaling.","A filter-permutation attack only reorders the same set of frequency components, so the watermark remains detectable after matching filters.","Overwriting the watermark is made costly: training with the attack loss sends an overwritten network's outputs to a pseudo category, sharply lowering its accuracy.","Unlike certified methods that only bound watermark loss within a parameter-distance ball, this approach aims at an exact invariant of the gradient update itself."],"supporting_citations":[{"why":"Supplies the frequency-domain reformulation of convolution used as Theorem 3.1.","marker":"[Tang et al., 2023]"},{"why":"Provides the complex gradient calculus used to compute updates of the revised-DFT components.","marker":"[Kreutz-Delgado, 2009]"},{"why":"Defines circular padding, the convolution mode the invariance theorem assumes.","marker":"[Jain, 1989]"},{"why":"Earlier invariant-based watermark for scaling and permutation that this work extends to fine-tuning.","marker":"[Zeng et al., 2023]"},{"why":"Certified watermark approach based on parameter-distance bounds, the alternative the paper contrasts with an exact invariant.","marker":"[Bansal et al., 2022]"}],"fun_headline_variants":["Fine-tuning can't erase a watermark hidden in filter frequencies","Fourier watermark survives fine-tuning and scaling attacks","The Fourier secret that resists fine-tuning","Gradient descent can't touch these filter frequencies","A watermark that survives fine-tuning via Fourier"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The guarantee rests on the input to the watermark module's convolution being exactly bandlimited to the low-frequency set after the low-pass filter, together with circular padding and stride one; in real images, and because the marked frequencies are rounded integers, the invariance is approximate rather than exact.","fun_headline_variants_meta":{"raw":{"variants":["Fine-tuning can't erase a watermark hidden in filter frequencies","Fourier watermark survives fine-tuning and scaling attacks","The Fourier secret that resists fine-tuning","Gradient descent can't touch these filter frequencies","A watermark that survives fine-tuning via Fourier"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000742,"raw_usage":{"total_tokens":3319,"prompt_tokens":965,"completion_tokens":2354,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":581,"completion_tokens_details":{"reasoning_tokens":2296}},"tokens_in":581,"tokens_out":2354,"duration_ms":16323,"temperature":1.0,"reasoning_tokens":2296,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-16T04:29:47.611801+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Feed the watermark branch an input containing only a non-low frequency component, say frequency $(1,0)$ on an $M=N=9$ grid with a $3\\times3$ filter, and fine-tune: the formula in Theorem 3.2 predicts a nonzero $\\Delta F_W^{(uv)}$ at the marked frequency $(3,0)$ because $\\sin(3\\cdot 2\\pi/9)$ is nonzero, so observing an unchanged mark under these conditions would falsify the claimed mechanism.","supporting_citations":[{"cited_title":"Defects of convolutional decoder networks in frequency representation","cited_arxiv_id":null,"evidence_quote":"Supplies the frequency-domain reformulation of convolution used as Theorem 3.1."},{"cited_title":"Fundamentals of digital image processing","cited_arxiv_id":null,"evidence_quote":"Defines circular padding, the convolution mode the invariance theorem assumes."},{"cited_title":"Certified neural network watermarks with randomized smoothing","cited_arxiv_id":null,"evidence_quote":"Certified watermark approach based on parameter-distance bounds, the alternative the paper contrasts with an exact invariant."}],"review_version":1}