{"id":"78f467d8-1f1c-47a7-bd02-479a2dc2c230","arxiv_id":"2505.05088","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"high","formal_verification":"none","parameter_count":6,"one_line_summary":"SSH-Net combines a CNN noise-removal decoder and a sparse Transformer watermark decoder with a shared encoder and gate fusion, claiming SOTA noisy watermark removal, but its self-supervised target is not an unbiased estimator of the clean image.","lead":"A self-supervised hybrid network removes visible watermarks and noise from images without paired clean examples, reporting higher PSNR than prior methods on synthetic benchmarks. The core justification, that re-watermarking an image yields an unbiased clean target, does not follow from the paper's own blending model, so the method's theoretical foundation is unsound.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Sec. 3.1's unbiasedness claim is internally inconsistent: re-watermarking X_w yields E[Y_w|X_w]=(1−β)X_w+βE[W'], not Y, so Eq. (4) trains against a doubly watermarked target and the reported gains are unexplained.","rationale":"The reader's weakest-assumption analysis identifies the same flaw I would: Sec. 3.1's claim E{Y_w|X_w}=Y is the load-bearing step that converts the loss in Eq. (4) into a substitute for clean-image supervision. The paper's own Eq. (1) makes the claim false; re-watermarking X_w produces a doubly watermarked target whose conditional expectation is a faded copy of X_w plus the mean of the new watermark, not Y. I also checked the more charitable Noise2Noise reading: even if the intended condition were E[Y_w|Y]=Y, the sequential construction fails because watermark blending is not a zero-mean corruption. I see no internal argument or ablation in the paper that repairs this gap. The architecture, gating mechanism, and sparse attention are plausible engineering contributions, and the empirical comparisons are reported in detail, but they do not establish the self-supervised claim; without code or a corrected derivation, the experimental tables cannot be interpreted as evidence for the stated method. The lack of error bars and the runtime contradiction in Table 9 are secondary. I therefore keep the reader's REJECT verdict unchanged.","tokens_in":19696,"tokens_out":8053,"duration_ms":78390,"concrete_test":"Reproduce the data-generation rule exactly as written: start from a clean image Y, form X_w via Eq. (1) with a random watermark and opacity, then form Y_w by adding a second random watermark to X_w. For a fixed X_w, compute the empirical mean of Y_w over many random draws and compare it with Y. If the mean differs from Y by roughly the watermark contrast, the unbiasedness claim is refuted. Then train SSH-Net under this exact protocol and evaluate at sigma=0; if the reported 49.38 dB PSNR is not reproduced, the paper's central self-supervision claim is unsupported. Releasing the data-generation code would make this check immediate.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The load-bearing assumption is the self-supervised target construction in Sec. 3.1. The paper asserts that synthesizing Y_w by randomly adding additional watermarks to X_w gives E{Y_w|X_w}=Y, so Eq. (4) can train the network without clean images. This is not compatible with the paper's own blend model, Eq. (1). If X_w = alpha W + (1-alpha)Y and Y_w = beta W' + (1-beta)X_w for a second independent watermark W', then E[Y_w | X_w] = beta E[W'] + (1-beta) X_w, which is a re-watermarked version of the input, not the clean image Y. The equality would require access to Y to cancel the residual watermark. The correct Noise2Noise-style condition would be unbiasedness conditional on the clean image, E[Y_w | Y]=Y, with target corruption independent of input corruption; the sequential construction gives E[Y_w | Y]=(1-beta)(1-alpha)Y+..., also not Y. Because the WNRD and FFU losses in Eq. (18)-(21) compare directly against Y_w, the optimum of the stated objective is a conditional median/mean of a doubly watermarked image. The impressive reported results (e.g., 49.38 dB at sigma=0) are therefore not explainable by the training protocol described; either the implementation generates targets differently than stated, or it relies on undisclosed clean-image supervision. This is the central claim of the paper, so the rejection is warranted.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes SSH-Net, a self-supervised hybrid network for removing both visible watermarks and Gaussian noise from images. The claimed novelty is a training scheme that synthesizes a reference watermark-free image Y_w by randomly adding additional watermarks to the already-watermarked image X_w; Sec. 3.1 asserts that this construction makes Y_w an unbiased estimator of the clean image Y, i.e., E[Y_w|X_w] = Y, enabling the empirical risk objective in Eq. (4) to be trained without paired clean data. Architecturally, the method combines a shared CNN encoder, a lightweight CNN denoising decoder (NRD), a Transformer-based watermark-and-noise decoder (WNRD) with sparse self-attention, and a gated feature fusion unit. Experiments on PASCAL VOC benchmarks across multiple noise levels and watermark transparencies report consistent improvements over PSLNet and other baselines, and ablations show the contribution of each architectural component.","tokens_in":19974,"tokens_out":5298,"duration_ms":49362,"significance":"If the self-supervised target construction were valid, the paper would make a useful contribution: the hybrid dual-decoder design, sparse attention, and the broad benchmark comparison are sensible and potentially impactful for practical watermark removal without paired data. However, the central statistical claim is internally inconsistent with the paper's own equations, and the empirical gains are not explained by the described training protocol. The manuscript also provides no code, no error bars, and no machine-checked proofs, so the strength of the empirical claims cannot be independently assessed. The significance rests entirely on the unbiasedness assertion, which fails, and therefore the contribution, as currently stated, cannot be credited.","major_comments":[{"comment":"","section":"Sec. 3.1, Eqs. (1)-(4)"},{"comment":"","section":"Sec. 3.5, Eqs. (17)-(21)"},{"comment":"","section":"Sec. 4.4, Table 10"}],"minor_comments":[{"comment":"There is a duplicated sentence fragment: 'by learning directly from the corrupted image itself. by learning directly from the corrupted image itself.' should be reduced to one occurrence.","section":"Sec. 1"},{"comment":"The word 'nstead' should be 'Instead' in the sentence describing the NAFBlock.","section":"Sec. 3.3"},{"comment":"The module name 'WNRN' appears in the text and should be 'WNRD' for consistency with the rest of the paper.","section":"Sec. 3.4"},{"comment":"The caption contains the typo 'groud-truth'; it should be 'ground-truth'.","section":"Figure 1 caption"},{"comment":"The notation 'top-k (row j)' is unclear because the attention map M has dimensions d_l × d_l and the softmax is applied over one dimension; please specify the exact axis along which the top-k selection is performed and whether the mask is applied before or after the softmax.","section":"Eq. (15)"},{"comment":"The output of the watermark-and-noise decoder is denoted Y_wn in Sec. 3.2 but Y_wm in Eq. (19); please use a single consistent notation.","section":"Sec. 3.2 and Eq. (19)"},{"comment":"The test-set description says 21 PASCAL VOC images are processed with a random watermark and a fixed noise level, yet the total is stated as 252 test images per scenario; the arithmetic (21 × 4 × 3 = 252) is not explained and should be clarified.","section":"Sec. 4.1"}],"recommendation":"reject","confidential_remarks":"The central statistical argument in Sec. 3.1 is internally inconsistent under the paper's own equations, so rejection is appropriate. The architectural components and empirical comparisons are otherwise substantial, and the authors may be able to rework the target-generation scheme or provide a corrected Noise2Noise-style justification in a future submission. I would not recommend inviting a resubmission unless the self-supervised claim is either removed or supported by a target construction that genuinely satisfies E[target|Y] = Y with conditionally independent corruption, along with the missing control experiments."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"I gave this a careful read, and the bottom line is: the architecture is a plausible variant of PSLNet, the experiments are extensive, but the self-supervised justification collapses under the paper's own equations.\n\nWhat's new: a hybrid dual-decoder where a light CNN branch handles denoising and a heavier sparse-Transformer U-Net tackles watermark plus noise, with a shared encoder and a gate fusion. The sparse top-k attention is known from the Transformer literature, but the combination is a sensible engineering choice. The ablation study is well done, and the authors deserve credit for including complexity and runtime tables and for admitting that runtime is higher than PSLNet's even with lower FLOPs.\n\nWhere it falls apart: Sec. 3.1. The paper says that synthesizing Y_w by randomly adding more watermarks to X_w gives E[Y_w|X_w]=Y, so Y_w is an unbiased estimator of the clean image. That is wrong. With the blend model of Eq. (1), X_w = alpha W + (1-alpha)Y, and Y_w = beta W' + (1-beta)X_w for an independent watermark W', we get E[Y_w|X_w] = beta E[W'] + (1-beta)X_w, which is a re-watermarked image, not the clean Y. So the training target in Eq. (4) is a doubly watermarked image, and the impressive numbers, especially 49.38 dB at sigma=0, cannot be explained by the stated protocol. Either the implementation uses a different target construction than described, or there is undisclosed clean-image supervision. This is the central claim of the paper, so the rejection is warranted.\n\nSmaller issues: no error bars, code not available despite the promise, and the efficiency selling point is undercut by the 4x slower runtime and 2.3x more parameters than PSLNet. At alpha=1.0 in Table 2, SSH-Net is actually worse than PSLNet.\n\nWho this is for: someone working on self-supervised restoration would want to see whether the architecture can be re-derived with a valid target. It deserves a serious referee because the experimental evidence is detailed and the architecture, if paired with a correct training scheme, could be useful. But as submitted, the internal inconsistency is fatal to the main claim. I'd send it to review, but the likely outcome is major revision at best.","headline":"Plausible architecture, extensive experiments, but the self-supervised target construction contradicts the paper's own blend equation; the PSNR gains are unexplained.","tokens_in":20601,"tokens_out":3877,"would_cite":false,"duration_ms":35821,"reading_group":"maybe","serious_thinker":"no","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Watermark removal can be learned from the watermarked image alone, without paired clean examples, by treating randomly re-watermarked copies as the training target.","keywords":["self-supervised learning","visible watermark removal","image restoration","image denoising","vision transformer","sparse self-attention","noisy image watermark removal"],"falsifier":"Take one watermarked image $X_w$ whose clean original $Y$ and watermark $W$ are known; generate many random targets $Y_w$ by the paper's recipe and average them. If the average is not $Y$ but instead equals $\\alpha W+(1-\\alpha)X_w$ averaged, differing from $Y$ whenever the watermark mean is nonzero, the unbiasedness claim is disproved. A second check is to train SSH-Net on synthetic paired data where $Y$ is known and compare its predictions against a model trained directly on the true $Y$ targets.","tokens_in":19355,"feed_emoji":"🖼️","tokens_out":6942,"duration_ms":64313,"temperature":0.7,"pith_summary":"SSH-Net claims that visible watermark removal from noisy images can be trained without paired clean images. The paper synthesizes a reference image by randomly adding more watermarks to an already-watermarked input, asserts that this random target is an unbiased estimate of the clean image in expectation, and trains the network against that target. If correct, the method removes the main practical obstacle to watermark removal: real-world images seldom come with clean counterparts. The paper reports that the resulting hybrid CNN-Transformer network exceeds previous methods on standard noisy-watermark benchmarks while using fewer FLOPs.","feed_headline":"Self-supervised net strips watermarks and noise without clean pairs","feed_subtitle":"The network synthesizes its own clean-looking targets by re-watermarking the input, then removes both degradations.","key_machinery":"The load-bearing object is the synthesized target $Y_w$, formed by re-watermarking the input $X_w$, together with the asserted identity $\\mathbb{E}\\{Y_w|X_w\\}=Y$ that converts it into a usable training signal. The architecture's second engine is the Sparse Transformer U-Net, whose top-$k$ sparse self-attention retains only the largest entries of the transposed attention map so that localized watermark patterns can be captured without quadratic spatial cost. The shared encoder and gate mechanism then coordinate the two decoders: the gate uses the watermark-removal features to modulate and damp the denoising features before fusion.","core_discovery":"The central claim is that the self-supervised objective in Eq. (4), which minimizes loss between the network output and a synthesized, still-watermarked target $Y_w$, converges to the same solution as supervised training against the true clean image $Y$. The paper argues from the composition model $X_w(p)=\\alpha(p)W(p)+(1-\\alpha(p))Y(p)$ that randomly adding extra watermarks to $X_w$ produces targets drawn from the same corruption distribution, giving $\\mathbb{E}\\{Y_w|X_w\\}=Y$; this unbiasedness is what lets the synthesized targets stand in for ground truth. Around that idea, SSH-Net decomposes the task into a lightweight CNN noise-removal decoder, a Transformer-based decoder that removes watermarks and noise together using sparse self-attention, a shared encoder, and a gated feature-fusion unit, and reports that this design beats previous self-supervised and supervised baselines on PSNR, SSIM, and LPIPS at several noise levels and watermark opacities.","pith_inferences":["If the unbiasedness equality fails for real watermarks, which typically have nonzero mean and spatially structured transmittance, the method likely learns a watermark-to-watermark mapping rather than true removal; a direct check would compare predictions against known ground truth on synthetic data.","The same re-corrupt-the-input target recipe could be tried on other structured artifacts with a known blend model, such as subtitles, timestamps, logos, or semi-transparent overlays, where supervised pairs are equally scarce.","The gating behavior the paper visualizes could be turned into a per-pixel confidence map that flags where the model is uncertain, potentially useful for downstream tasks like detecting whether a watermark was present.","The top-$k$ sparsity choice assumes watermark attention is localized; measuring whether attention actually concentrates inside watermark regions would tell whether the inductive bias matches watermark structure."],"forward_implications":["Training watermark-removal models no longer requires paired clean images; any watermarked collection, including images scraped from the web, can supply its own training targets.","The dual-task split means the simpler denoising path can be made lightweight while the harder watermark path carries the transformer cost, a design choice that transfers to other degradation pairs.","Because the sparse attention keeps only top-$k$ attention entries, computation stays low for high-resolution inputs, making the approach more practical for real deployment.","The reported results imply that a single model can handle blind transparency and blind noise ranges simultaneously, removing the need to know the watermark strength or noise level at test time."],"supporting_citations":[{"why":"Supplies the Noise2Noise principle that networks can train on corrupted targets when the corruption is zero-mean, which is the basis for treating $Y_w$ as ground truth.","marker":"Lehtinen et al. [2018]"},{"why":"Provides the PSLNet baseline, the dataset construction, and the mixed structure-plus-texture loss that SSH-Net builds on and compares against.","marker":"Tian et al. [2024b]"},{"why":"Earlier self-supervised denoising-and-watermark-removal network whose synthesized-reference scheme the paper also draws on.","marker":"Tian et al. [2024a]"},{"why":"Supplies the transposed channel-wise attention (MDTA) and feed-forward network design that the Sparse Transformer Block adapts with top-$k$ masking.","marker":"Zamir et al. [2022]"},{"why":"Supplies the NAFBlock, the simplified convolutional block used in the shared encoder and the noise-removal decoder.","marker":"Chen et al. [2022]"}],"fun_headline_variants":["Self-supervised hybrid net strips watermarks and noise","No clean pairs: SSH-Net erases watermarks and noise","Self-supervised targets let SSH-Net erase watermarks and noise","SSH-Net synthesizes its own clean targets to remove watermarks and noise"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that a target made by randomly adding more watermarks to the already-watermarked input is, on average, exactly the clean image; if that expectation is wrong, the whole self-supervised training signal is wrong.","fun_headline_variants_meta":{"raw":{"variants":["Self-supervised hybrid net strips watermarks and noise","No clean pairs: SSH-Net erases watermarks and noise","Self-supervised targets let SSH-Net erase watermarks and noise","SSH-Net synthesizes its own clean targets to remove watermarks and noise"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.001264,"raw_usage":{"total_tokens":5173,"prompt_tokens":938,"completion_tokens":4235,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":554,"completion_tokens_details":{"reasoning_tokens":4160}},"tokens_in":554,"tokens_out":4235,"duration_ms":27369,"temperature":1.0,"reasoning_tokens":4160,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T23:13:28.180065+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take one watermarked image $X_w$ whose clean original $Y$ and watermark $W$ are known; generate many random targets $Y_w$ by the paper's recipe and average them. If the average is not $Y$ but instead equals $\\alpha W+(1-\\alpha)X_w$ averaged, differing from $Y$ whenever the watermark mean is nonzero, the unbiasedness claim is disproved. A second check is to train SSH-Net on synthetic paired data where $Y$ is known and compare its predictions against a model trained directly on the true $Y$ targets.","supporting_citations":[{"cited_title":"Noise2noise: Learning image restoration without clean data","cited_arxiv_id":null,"evidence_quote":"Supplies the Noise2Noise principle that networks can train on corrupted targets when the corruption is zero-mean, which is the basis for treating $Y_w$ as ground truth."}],"review_version":1}