{"id":"ae1edd37-757c-4044-a38d-022199f4af3d","arxiv_id":"2505.08234","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"high","formal_verification":"none","parameter_count":2,"one_line_summary":"A semantic inpainting pipeline that regenerates only the background erases TreeRing and other watermarks while keeping foreground objects intact.","lead":"This paper introduces SemanticRegen, an attack that removes invisible watermarks from AI images by captioning, segmenting the main subject, and redrawing only the background. It reports defeating the TreeRing watermark, a result other tested attacks did not achieve, while preserving foreground quality.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"TreeRing 'defeat' rests on an average p-value, which cannot establish per-image watermark removal without the full detection distribution.","rationale":"The reader's weakest_assumption identifies the foreground/background assumption, which is a genuine limitation and is acknowledged by the authors. However, the more load-bearing problem is the statistical basis for the headline TreeRing claim: a single averaged p-value cannot demonstrate watermark removal. Even if the background-only assumption holds perfectly, the reported average p = 0.10 is insufficient evidence because the paper gives no per-image detection outcomes. This is not a matter of disagreement with consensus; it is a correctness risk in the paper's own evaluation protocol. The reader's rationale does mention averaged p-values, missing error bars, and absent code, so there is partial agreement, but the weakest_assumption field points elsewhere. The proposed concrete test would settle whether the central claim is supported: if per-image p-values mostly exceed 0.05 and match unwatermarked controls, the result stands; otherwise it does not. The pipeline itself is a plausible combination of existing components, and the qualitative comparisons are useful, so a conditional verdict remains appropriate rather than outright rejection.","tokens_in":13814,"tokens_out":3494,"duration_ms":38987,"concrete_test":"Re-run the TreeRing evaluation and report the full per-image p-value distribution for SemanticRegen, along with a control distribution from unwatermarked images. Compute the fraction of attacked images with p > 0.05 and the median p-value; then compare this success rate with the detector's false-positive rate on unwatermarked images. If the attacked-image p-values are not statistically indistinguishable from the unwatermarked control (e.g., via a two-sample test or by showing most images exceed 0.05), the headline claim does not follow from an average p = 0.10.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim that SemanticRegen is the only method to defeat TreeRing rests on a single number in Table 1: an average p-value of 0.10 across 1000 prompts, compared with a 0.05 threshold. This is not a valid success criterion for watermark removal. A detection p-value is defined per image; removing the watermark at the 5% level means the detector fails to reject the no-watermark null for that image. A mean of 0.10 is compatible with many images still having p < 0.05 (watermark detected) and a few images having p near 1.0, so the aggregate statistic does not establish that TreeRing is erased on a typical image. The same issue appears in Section 4.3, where 'p > 0.05 indicates successful removal' is applied to averaged values. No per-image statistics, confidence intervals, or false-positive calibration on unwatermarked images are reported, and the code repository is not provided. Since the paper's unique contribution over prior attacks is precisely the TreeRing result, this statistical presentation is load-bearing.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes SemanticRegen, a three-stage, label-free watermark removal attack that (i) captions the input image with BLIP2 using structured VQA prompts, (ii) extracts foreground masks with LangSAM, and (iii) inpaints only the background with Stable Diffusion guided by an LLM-generated prompt. The method is evaluated on 1,000 prompts across four watermarking systems (TreeRing, StegaStamp, StableSig, and DWT/DCT). The paper claims that SemanticRegen is the only method to defeat the TreeRing watermark, reporting an average detection p-value of 0.10 against a success threshold of p > 0.05, and that it reduces bit accuracy below 0.75 for the other three schemes while maintaining masked SSIM (mSSIM) around 0.94. A new metric, mSSIM, is introduced to measure foreground-preservation fidelity.","tokens_in":14029,"tokens_out":8075,"duration_ms":74376,"significance":"If the evaluation were statistically sound, the result would be significant: a semantics-aware background-inpainting attack that defeats a state-of-the-art Fourier-domain watermark like TreeRing while preserving foreground quality would expose a real vulnerability in current watermarking defenses and motivate robustness research. The paper's strengths include a clearly described modular pipeline, the use of off-the-shelf zero-shot components (BLIP2, LangSAM, Stable Diffusion) with no dataset-specific training, and qualitative examples that appear to support the approach. The introduction of mSSIM, despite flaws discussed below, is a reasonable attempt to measure region-specific fidelity. However, the statistical basis for the headline TreeRing claim is currently insufficient, and the quality metric is partly self-referential, so the paper's central claims require substantial additional evidence before publication.","major_comments":[{"comment":"The headline claim that SemanticRegen defeats the TreeRing watermark is supported only by an average p-value of 0.10 across 1,000 images, with a success threshold of p > 0.05. Because detection p-values are defined per image, an average above the threshold does not imply that the watermark is removed on a typical image; for example, a distribution with 80% of images at p = 0.01 and 20% at p = 0.46 would yield the same mean. Report the full p-value distribution, the fraction of images exceeding the 0.05 threshold, confidence intervals for the mean, and the calibration of the detector on unwatermarked images. Without these, the paper's primary contribution relative to prior attacks is not established.","section":"Section 4.1, Table 1"},{"comment":"The bit-accuracy success criterion is also applied to averaged values. The paper states that <24/32 indicates successful removal, and Table 1 reports average bit accuracies (e.g., 0.70 for StegaStamp). An average below 0.75 does not guarantee that most images are below the threshold, and no per-image distributions or error bars are given. Moreover, several baselines (Distortion 0.68, Rinse4x-Diff60 0.69) also satisfy the average criterion for StegaStamp, so the paper should clarify what specific advantage SemanticRegen offers for these watermarks beyond the TreeRing case.","section":"Section 4.3, Table 1"},{"comment":"The proposed mSSIM metric is computed using the same segmentation mask M that the attack pipeline generates and uses for inpainting. Because SemanticRegen explicitly preserves the foreground region, mSSIM largely measures similarity in pixels that the attack leaves untouched, and it does not penalize background degradation where watermark removal occurs. The paper should validate mSSIM against human perception, report global SSIM/PSNR for all compared methods (Table 3 only covers SemanticRegen), and analyze the sensitivity of mSSIM to the choice of mask.","section":"Section 3.4, Eq. (1)"},{"comment":"The paper repeatedly assumes that watermark information resides in the background, yet it does not provide any analysis supporting this for the tested schemes, particularly TreeRing, which embeds a ring in the Fourier domain of the entire image. The stated limiting condition in Section 1 ('clear, separable backgrounds') and the Key Assumptions in Section 3.1 narrow the claim to a subset of images, but no ablation or spatial analysis of the watermark signal is given. Provide evidence of where the watermark energy is localized, or discuss why background-only regeneration is sufficient for global watermarks.","section":"Sections 3.1 and 3.2"}],"minor_comments":[{"comment":"The phrase 'embedsemanticsignals' should be 'embed semantic signals' (missing space).","section":"Abstract"},{"comment":"The sentence 'In addition, we assess the accuracy of the bit for other watermarking methods, where a value <24/32 indicates successful removal' is duplicated verbatim in the same paragraph; one occurrence should be removed.","section":"Section 4.3"},{"comment":"The meaning of 'Image (Original)' and 'Image (Masked)' is unclear; clarify whether these are pre- and post-attack images or masked versions, and describe how the values are computed.","section":"Table 3 caption"},{"comment":"The notation 'M∈{0,1} {3,256,256}' is malformed; use proper mathematical notation such as M∈{0,1}^{3×256×256} (and likewise for the image tensors).","section":"Section 3.4"},{"comment":"Reference [10] lists 'Anonymous Authors', reference [20] uses 'John Doe and Jane Smith', and reference [48] does not describe the MiniChat-MA model used in Section 3.3; these citations must be replaced with real and relevant sources.","section":"References"},{"comment":"The phrase 'outperforming alternative methods' is imprecise for p-values; since a higher p-value indicates better removal (failing to reject the no-watermark null), the text should say 'surpassing the success threshold' rather than 'outperforming'.","section":"Section 4.1"}],"recommendation":"major_revision","confidential_remarks":"The core attack idea is plausible and potentially publishable, but the statistical presentation of the TreeRing claim is the central selling point and it is currently invalid as stated. The manuscript also shows signs of hasty drafting: placeholder references, duplicated text, and inconsistent numbers (e.g., abstract reports mSSIM 0.94±0.01 while Table 2 reports 0.95 for TreeRing). These issues are fixable with a careful revision, including full detection distributions, per-image statistics, a more thorough validation of mSSIM, and a clearer discussion of the attack's assumptions. I recommend major revision rather than rejection because the contribution, if properly supported, would be of interest to the journal's readership."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nThe thing to know: SemanticRegen is a genuinely new attack design—VQA captions, zero-shot segmentation, background-only inpainting—and the mSSIM metric is a sensible addition for foreground fidelity. But the paper's headline result, that it defeats TreeRing, does not hold up as reported. The evidence is a single average p-value of 0.10 across 1,000 images. For watermark removal, the p-value is per image; the average being above 0.05 is compatible with most images still being detected. No per-image distribution, no confidence intervals, no false-positive calibration on unwatermarked images. That is not a minor weakness; it is the load-bearing evidence for the paper's unique contribution.\n\nWhat is actually new: the three-stage pipeline is a plausible combination of known building blocks, and the authors are honest that it works best on images with clear, separable foreground/background—that assumption is stated in Section 3.1. Compared against four watermarking schemes with 1,000 prompts, the bit-accuracy reductions for StegaStamp and StableSig are plausible. The mSSIM idea of measuring quality only over foreground regions is useful; the numbers show a meaningful improvement over baselines (0.94–0.95 vs 0.84–0.86).\n\nThe soft spots, in order of severity. First, the TreeRing claim as discussed. The fix is straightforward: report the fraction of images with p > 0.05, or a histogram, plus error bars. Second, the evaluation lacks reproducibility: no code, no data, no random seeds, no details on which prompts were used. That is fixable but currently blocks verification. Third, the references are sloppy—at least one placeholder author names and a citation for MiniChat-MA pointing to a legal-policy paper. That erodes confidence in the related-work discussion. Fourth, mSSIM partially uses the same mask that guides the attack, so it is not fully independent; this is a minor point given the attack itself is the thing being evaluated, but worth stating.\n\nWho this is for: anyone working on watermark robustness or generative-AI provenance. The attack idea deserves serious referee time; the statistical presentation does not. I would recommend conditional acceptance or major revision, not rejection. If the authors supply per-image detection statistics and release code, the TreeRing result has a real chance of surviving.","headline":"A clever attack pipeline with a load-bearing statistical gap: the TreeRing claim rests on an average p-value, not per-image detection rates.","tokens_in":14531,"tokens_out":2014,"would_cite":false,"duration_ms":19151,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Semantic background repainting erases four invisible watermarks.","keywords":["invisible watermarks","semantic watermark removal","diffusion inpainting","vision-language model","zero-shot segmentation","TreeRing watermark","masked SSIM","generative AI provenance"],"falsifier":"Run SemanticRegen on a set of watermarked images whose TreeRing watermark was embedded in the foreground object or spread across the entire image; if the average TreeRing $p$-value drops below $0.05$, or if any of the other three schemes' bit accuracy rises above $0.75$, the paper's claim that SemanticRegen removes these watermarks is falsified.","tokens_in":13656,"feed_emoji":"🖼️","tokens_out":10625,"duration_ms":95721,"temperature":0.7,"pith_summary":"This paper argues that invisible and semantic image watermarks, even those designed to survive cropping, resizing, and compression, can be removed by an adaptive adversary that understands what the image means. The proposed attack, SemanticRegen, first asks a vision-language model what the important object and background are, cuts out the foreground with text-guided segmentation, and then regenerates only the background with a diffusion model. The paper reports that this erases all four watermarks it tests: TreeRing is defeated at an average $p = 0.10$, above the $0.05$ threshold, and StegaStamp, StableSig, and DWT/DCT watermarks drop below $0.75$ bit accuracy. A careful reader would care because this shows that a class of watermarking defenses can be bypassed without destroying the content, and it introduces a foreground-focused metric, masked SSIM, for judging such attacks.","feed_headline":"Background repainting erases four invisible watermarks","feed_subtitle":"Regenerating only the scenery beats TreeRing and three others while keeping foregrounds nearly intact.","key_machinery":"The load-bearing mechanism is partial regeneration: instead of transforming the whole image, SemanticRegen identifies the meaningful foreground with a text-guided segmentation mask and uses a diffusion inpainting model to recreate only the background, conditioned on a caption produced by a vision-language model. This concentrates the removal operation on the region where the paper assumes the watermark signal lives, preserving the objects a human viewer would notice. The paper introduces masked SSIM (mSSIM), the structural similarity computed only inside the foreground mask, as the metric that makes this foreground preservation visible.","core_discovery":"On its own terms, the paper's central claim is that semantic background regeneration removes current invisible watermarks while preserving apparent meaning. In experiments over 1,000 prompts, SemanticRegen is the only method tested that defeats TreeRing, with an average $p$-value of $0.10$ (success threshold $p > 0.05$), and it lowers the bit accuracy of StegaStamp, StableSig, and invisible DWT/DCT watermarks below $0.75$. The same attack keeps masked SSIM around $0.94$, meaning the foreground regions that carry the image's meaning are nearly unchanged, and it outperforms prior diffusion-based removers in masked SSIM. The paper presents this as evidence of a gap between current watermarking defenses and semantics-aware adversaries.","pith_inferences":["Beyond the paper's experiments, the same pipeline could be pointed at any semantically separable image region, so future watermarking schemes that hide signals in a particular texture or style component would face the same attack surface.","A natural experiment the paper does not run is to invert the mask and regenerate only the foreground; the change in detector confidence would reveal where each watermark actually stores its signal.","The results indirectly suggest a cheap diagnostic for watermark robustness: measure how much background-only regeneration shifts the detector's output, which would give a label-free robustness score before committing to a full adversarial benchmark."],"forward_implications":["TreeRing and similar semantic watermarks cannot be considered robust solely because they survive cropping, resizing, and compression; an adversary with semantic understanding can bypass them without harming perceived content.","A watermark that is removed by background regeneration can be made more durable by coupling the signal to the foreground mask, for instance by embedding across the whole image rather than in low-salience regions.","mSSIM provides a practical quality measure for attacks that intentionally alter non-salient regions, letting researchers compare removal methods on the regions that matter for human meaning.","Because SemanticRegen is label-free, the same attack can be deployed against any future watermarking scheme without retraining or access to the watermark decoder."],"supporting_citations":[{"why":"The TreeRing scheme is the primary semantic watermark target, and its p-value detection threshold defines successful removal.","marker":"[45]"},{"why":"The StegaStamp neural-network watermark is a second target, and its bit accuracy is the removal metric.","marker":"[42]"},{"why":"The Stable Signature latent-diffusion watermark is a third target evaluated by bit accuracy.","marker":"[22]"},{"why":"The combined DWT/DCT method supplies the classical frequency-domain watermark target.","marker":"[2]"},{"why":"This work provides the invisible watermark target plus the diffusion-based removal baseline that SemanticRegen is compared against.","marker":"[49]"},{"why":"The captioning model gives the vision-language descriptions that drive the segmentation and inpainting prompts.","marker":"[30]"},{"why":"The segmentation model turns the text prompt into the foreground/background mask that restricts regeneration to the background.","marker":"[32]"},{"why":"The inpainting model reconstructs the masked background, the step that actually removes the watermark.","marker":"[38]"}],"fun_headline_variants":["Semantic background repaint erases four watermarks","Partial regeneration beats TreeRing and strips three more","Regenerating backgrounds defeats four watermark schemes","Background-only regen removes invisible watermarks","Inpainting only the background erases watermarks"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The attack's load-bearing premise is that the watermark lives in the background rather than in the foreground object; if a watermark is spread across the whole image or embedded in the salient object, regenerating the background will not remove it.","fun_headline_variants_meta":{"raw":{"variants":["Semantic background repaint erases four watermarks","Partial regeneration beats TreeRing and strips three more","Regenerating backgrounds defeats four watermark schemes","Background-only regen removes invisible watermarks","Inpainting only the background erases watermarks"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.001134,"raw_usage":{"total_tokens":4728,"prompt_tokens":983,"completion_tokens":3745,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":599,"completion_tokens_details":{"reasoning_tokens":3684}},"tokens_in":599,"tokens_out":3745,"duration_ms":26151,"temperature":1.0,"reasoning_tokens":3684,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T22:00:21.749441+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run SemanticRegen on a set of watermarked images whose TreeRing watermark was embedded in the foreground object or spread across the entire image; if the average TreeRing $p$-value drops below $0.05$, or if any of the other three schemes' bit accuracy rises above $0.75$, the paper's claim that SemanticRegen removes these watermarks is falsified.","supporting_citations":[{"cited_title":"Tree-ring wa- termarks: Fingerprints for diffusion images that are invisible and robust, 2023","cited_arxiv_id":null,"evidence_quote":"The TreeRing scheme is the primary semantic watermark target, and its p-value detection threshold defines successful removal."},{"cited_title":"Stegastamp: Invisible hyperlinks in physical photographs","cited_arxiv_id":null,"evidence_quote":"The StegaStamp neural-network watermark is a second target, and its bit accuracy is the removal metric."},{"cited_title":"The stable signature: Rooting watermarks in latent diffusion models, 2023","cited_arxiv_id":null,"evidence_quote":"The Stable Signature latent-diffusion watermark is a third target evaluated by bit accuracy."},{"cited_title":"Invisible image water- marks are provably removable using generative ai, 2023","cited_arxiv_id":null,"evidence_quote":"This work provides the invisible watermark target plus the diffusion-based removal baseline that SemanticRegen is compared against."},{"cited_title":"lang-segment-anything, 2023","cited_arxiv_id":null,"evidence_quote":"The segmentation model turns the text prompt into the foreground/background mask that restricts regeneration to the background."},{"cited_title":"High-resolution image synthesis with latent diffusion models","cited_arxiv_id":null,"evidence_quote":"The inpainting model reconstructs the masked background, the step that actually removes the watermark."}],"review_version":1}