{"id":"c44fb36d-b080-406c-97cf-e1998f009304","arxiv_id":"2506.03170","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"Using BCH error-correcting codes on top of a learned weight-modulated fingerprint, PALADIN reports perfect bit-level attribution accuracy on tested attacks while flagging corrupt fingerprints.","lead":"PALADIN adds error-correcting codes to a diffusion-model fingerprinting method, reporting 100% bit accuracy for user attribution across several image post-processing attacks. The paper claims this makes generative model attribution accurate enough for real-world deployment, but the actual error rate remains nonzero and flagged cases are excluded.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The 100% attribution claim assumes every extracted 63-bit codeword has ≤4 errors; nonzero FER and the absence of per-codeword error and miscorrection counts leave that assumption unverified.","rationale":"The BCH-plus-flagging idea is a sensible and plausibly effective engineering improvement over WOUAF, and the reported image-quality gains are directionally credible. However, the paper's headline contribution is the unconditional-sounding claim of 100% user attribution accuracy, and that claim requires a guarantee that no decoded codeword falls outside the BCH correction radius, or that every such case is flagged rather than miscorrected. The paper provides only aggregate bit accuracy and FER values, rounded to four decimals, with no raw counts, no error bars, no code, and no per-codeword error distribution. The reader's weakest assumption identifies exactly this gap, and I agree with it; the nonzero FER makes the gap sharper, because FER itself demonstrates that attribution is not happening for every fingerprint. The proposed test is a direct, inexpensive way to settle the question: if all error counts are within the BCH radius and zero miscorrections occur, the central claim is supported; otherwise the claim must be weakened to 100% accuracy on successfully decoded fingerprints with an explicit flag rate. Since the underlying method may still be valuable, a conditional verdict is appropriate, pending release of the per-codeword data and a clear flag/miscorrection breakdown.","tokens_in":7644,"tokens_out":7374,"duration_ms":86158,"concrete_test":"Run PALADIN's trained decoder on the full test set with known fingerprints; for each image, record the raw 63-bit decoder output before BCH decoding, compute its Hamming distance to the true codeword, and tabulate the distance distribution. Then run the BCH decoder and classify every output as correct, flagged (uncorrectable detected), or miscorrected (valid codeword belonging to a different user). If any image has >4 pre-correction bit errors, verify whether it is flagged; if any is miscorrected, the '100% attribution' claim is false. Report FER separately for flagged and miscorrected cases, with the total number of test images, and check whether the 0.0004 and 0.0124 FER values are consistent with the observed counts.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"PALADIN's central claim ('cent percent user attribution accuracy', Sec. 6) can hold only if, for every generated image, the raw 63-bit output of the decipher network is within the BCH(63,39) correction radius (t=4) of the true codeword, and whenever it is not, the decoder flags rather than miscorrects. The paper establishes neither condition. Sections 3.4 and 4.3 report only aggregate bit accuracy and FER (Tables 1 and 4); there is no histogram of per-codeword Hamming distances before BCH decoding and no breakdown of decoder outcomes into correct, flagged, and miscorrected. This is not a technicality: FER is nonzero in the paper's own tables (0.0004 nominal, up to 0.0124 under JPEG), so some codewords are not attributed. If those are flagged, attribution coverage is below 100% and 'cent percent user attribution accuracy' is false; if any are miscorrected, the system silently attributes to the wrong user. Bounded-distance BCH decoding makes miscorrection possible: a received word more than 4 bits from the true codeword can still lie within 4 bits of a different valid codeword, and with only 2^32 user fingerprints active, that event cannot be dismissed from aggregate bit accuracy alone. The reported 1.0000 accuracy is rounded to four decimals and does not rule out rare >4-error outliers. Thus the deployment claim rests on an unmeasured tail of the error distribution.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"PALADIN is a method for embedding user-specific fingerprints into images generated by latent diffusion models. The authors fine-tune the Stable Diffusion decoder with a weight-modulation scheme, add a ciphering network that maps a BCH-encoded fingerprint into modulation weights, and train a deciphering network (ConvNeXt-based) to recover the encoded fingerprint from generated images. The BCH(63,39) code is used to correct up to 4 bit errors. The paper evaluates on MS-COCO, compares against WOUAF, and reports bit accuracy, a newly introduced Fingerprint Error Rate (FER), and image-quality metrics under post-processing attacks, autoencoder compression, and hyperparameter variations. The central claim is that PALADIN is the first method to achieve 'cent percent user attribution accuracy,' making it deployable.","tokens_in":7951,"tokens_out":7643,"duration_ms":64314,"significance":"If substantiated, the contribution is practically significant: the combination of BCH error correction with learned fingerprint embedding is a sensible route to reduce residual bit errors, and the FER metric is a useful addition to the standard bit-accuracy reporting. The reported quality numbers also show consistent improvement over WOUAF on SSIM/PSNR in Table 2. However, the evidence as presented does not establish perfect attribution: FER is nonzero in every table, the 1.0000 accuracy values are rounded, no error bars or exact counts are given, and only one baseline is used. No code or reproducibility artifacts are mentioned, so the empirical claims rest entirely on the tables and figures. The paper is an incremental but potentially useful engineering advance; the headline claim and the missing tail analysis need substantial work before the central claim can be accepted.","major_comments":[{"comment":"The claim that PALADIN achieves 'cent percent user attribution accuracy' is contradicted by the paper's own FER values. Table 1 lists FER = 0.0004 for PALADINϕ, meaning 0.04% of fingerprints are corrupted after decoding, and Table 4b lists FER up to 0.0124 under JPEG. If corrupted fingerprints are flagged, then attribution coverage is below 100%; if any are miscorrected, the system silently attributes to the wrong user. The abstract and conclusions must either be revised to a 'high attribution accuracy with explicit corruption flags' claim, or supported by exact counts showing that all non-flagged codewords are correctly attributed and that no miscorrections occur.","section":"Abstract, §6, Table 1"},{"comment":"The perfect-attribution claim requires every extracted 63-bit codeword to lie within the BCH(63,39) correction radius (t = 4) of the true codeword, or to be flagged by the decoder rather than miscorrected. The paper supplies only aggregate bit accuracy and FER (Tables 1 and 4); it does not report the distribution of per-codeword Hamming distances before BCH decoding, nor a breakdown of decoder outcomes into corrected, flagged, and miscorrected. Because bounded-distance BCH decoding can miscorrect when a received word is more than 4 bits from the true codeword but within 4 bits of another valid codeword, the tail of the error distribution is load-bearing. Please provide exact counts or histograms of uncorrected, flagged, and miscorrected codewords for every attack setting.","section":"§3.4, §4.3"},{"comment":"The method description is internally inconsistent about which modules are trained. Section 3.2 states that 'only the decoder D is fine-tuned keeping the reset [rest] of the components untouched,' while Section 3.5 states that 'The ciphering network Eψ, SD decoder D and the deciphering network Dψ are jointly optimized,' and Figure 1 marks the Cipher network and decipher network as trainable. This ambiguity affects what the reported experiments actually evaluate and must be resolved for reproducibility.","section":"§3.2, §3.5, Fig. 1"},{"comment":"The text discussing Table 3 contradicts the displayed numbers. The paper says PALADIN 'improves upon SD in terms of LPIPS and FID,' but Table 3 shows LPIPS = 0.1108 for PALADIN versus 0.1047 for SD, and FID = 14.5790 versus 9.4744, i.e., PALADIN is worse on both metrics. Please correct either the sentence or the table.","section":"§4.2, Table 3"},{"comment":"All accuracy and FER results are reported as point estimates with no error bars, no repeated-seed statistics, and no exact numbers of evaluated images or fingerprints. Every PALADIN accuracy is rounded to 1.0000, which does not establish zero errors, particularly because the same tables report nonzero FER. Please report exact numerator/denominator counts and confidence intervals (or repeated-seed ranges) for every table.","section":"§4.2, Tables 1, 4–6"},{"comment":"The empirical comparison uses a single baseline (WOUAF). The paper's claim of being 'first ever' to achieve 100% attribution accuracy cannot be evaluated without comparison to at least one additional recent fingerprinting method (e.g., Stable Signature or Fourier-based approaches) and, ideally, a public benchmark. Please add at least one more baseline or temper the novelty claim accordingly.","section":"§4"}],"minor_comments":[{"comment":"'Cent percent' should be written as '100%' or 'one hundred percent' throughout, and the sentence introducing PALADIN contains a typo: 'legendary nights' should be 'legendary knights.'","section":"Abstract, §1, §6"},{"comment":"The sum in Eq. (4) should run from i = 1 to dϕ, not i = 0; also define the indicator 1(·) explicitly and clarify whether accuracy is computed per bit before or after BCH decoding.","section":"Eq. (4)"},{"comment":"The sentence 'The weights used in these experiments were trained on Euler scheduler and the number of inference steps was set to 7.5' should read 'the guidance scale was set to 7.5'; an inference step count of 7.5 is not meaningful.","section":"§5"},{"comment":"The column 'Err. Detection' is never defined and is empty for both methods; either define and fill it or remove it.","section":"Table 1"},{"comment":"The footnote stating that WOUAF's fingerprint corruption is 'calculated in test bench with reference fingerprint' is unclear; please specify how FER was computed for WOUAF and whether the reference is the original fingerprint ϕ or the BCH-encoded ψ.","section":"Table 1 footnote"},{"comment":"The abbreviations PALADINψ and PALADINϕ are used without explicit definition; please define them (apparently pre-error-correction and post-error-correction outputs, respectively).","section":"§4.2"},{"comment":"The autoencoder experiments report only bit accuracy versus PSNR and omit FER; please add FER curves and indicate the number of test images used.","section":"§4.4"},{"comment":"Equation (5) should define 'corrupted fingerprint' precisely (e.g., any output that is flagged or miscorrected after BCH decoding) and state whether FER is computed before or after BCH correction.","section":"Eq. (5)"}],"recommendation":"major_revision","confidential_remarks":"The manuscript is within scope and the core idea is worth pursuing, but the abstract and conclusions currently overclaim to a degree that could mislead readers. I would advise the editor that acceptance should require the authors to either drop the 'cent percent' claim or provide the missing tail analysis and exact counts. The paper would also benefit from a second baseline and from correcting the Table 3 discussion."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Read PALADIN. Short version: it's a clean engineering addition to WOUAF—put a BCH(63,39) code in front of the fingerprint, swap ResNet for a ConvNext decipher, and add a flag for undecodable codewords. The robustness numbers are better than WOUAF across all tested attacks, and the image quality metrics are competitive. That part is real.\n\nBut the '100% attribution' headline doesn't survive contact with the paper's own tables. FER is 0.0004 on clean COCO and 0.0124 under JPEG. That means some fraction of fingerprints are corrupted. The paper never says what happens to those corrupted cases: are they flagged, or are they silently miscorrected to the wrong user? With bounded-distance BCH decoding, a received word more than 4 bits from the true codeword can land within 4 bits of a different valid codeword. Miscorrection is possible, and the paper gives no per-codeword Hamming-distance histogram or outcome breakdown. So the perfect-attribution claim rests on an unmeasured tail. If the corrupted cases are flagged, effective attribution coverage is 99.96%, not 100%. If any are miscorrected, you have wrong attributions. Either way, the abstract and conclusion overstate.\n\nThe text also misreads Table 3: it says PALADIN improves on SD in LPIPS and FID, but the table shows PALADIN's LPIPS 0.1108 > SD's 0.1047 and FID 14.58 > SD's 9.47. That is a straightforward error in the discussion.\n\nWhat's good: FER is a sensible metric (even if simple), applying error-correcting codes is a reasonable idea that likely helps, and the attack coverage (post-processing, JPEG, autoencoders, hyperparameters) is more thorough than many papers in this space. But there is only one baseline (WOUAF), no error bars, no stated test-set size, and no code or training details. Reproducibility is low.\n\nBottom line: this is a workshop-grade contribution with a publishable core observation, but the central claim is overstated and the missing error-distribution analysis is exactly what the paper needs. As is, I'd lean reject and ask for a major revision that fixes the claim, reports the decodability tail, and corrects the Table 3 discussion. If they do that, it's a decent paper for WACV or a watermarking venue. Worth sending to peer review? Yes—the method is concrete, the comparison is real, and a careful referee could turn this into something honest with modest effort.","headline":"PALADIN is a useful but incremental error-correcting wrapper around WOUAF; its '100% attribution' claim is contradicted by its own nonzero FER and absent miscorrection analysis.","tokens_in":8475,"tokens_out":6530,"would_cite":false,"duration_ms":59438,"reading_group":"maybe","serious_thinker":"no","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Wrapping user fingerprints in error-correcting codes lifts text-to-image attribution to 100 percent accuracy on tested attacks.","keywords":["neural fingerprinting","text-to-image diffusion models","user attribution","BCH error-correcting codes","weight modulation","latent diffusion models","fingerprint error rate","image provenance"],"falsifier":"Count, for every recovered 63-bit code, how many positions differ from the code that was actually embedded. If any image yields more than four differing positions under the tested attacks, the promised 100 percent attribution fails: the code either corrects to the wrong user or is flagged as unrecoverable.","tokens_in":7422,"feed_emoji":"🖼️","tokens_out":8825,"duration_ms":90924,"temperature":0.7,"pith_summary":"This paper sets out to eliminate the residual attribution errors that keep neural fingerprinting for text-to-image diffusion models out of deployment. Its proposal is to treat each user's fingerprint as a message in a BCH(63,39) cyclic error-correcting code: the fingerprint is encoded before being embedded into generated images, and the extraction pipeline corrects up to four bit errors before deciding who generated an image. On MS-COCO with 32-bit fingerprints, the system reports bit accuracy of 1.0000 and fingerprint error rates down to 0.0004, while keeping image quality closer to the unmodified generator than its baseline. The authors' point is that even 99.9 percent accuracy means a million wrong attributions per billion users, so only a scheme that either attributes correctly or explicitly flags a corrupted fingerprint is deployable.","feed_headline":"Error-correcting codes make AI image attribution 100% accurate","feed_subtitle":"Error correction lifts user attribution from near-perfect to 100 percent without hurting image quality.","key_machinery":"The load-bearing object is the BCH(63,39) code, a cyclic error-correcting code that stores a 39-bit message inside a 63-bit codeword and can detect and correct up to four bit errors. Around this sit the cipher network that maps the BCH codeword to a modulation signal, the weight-modulated Stable Diffusion decoder that hides the signal in generated pixels, the decipher network that recovers a noisy 63-bit codeword from an image, and the BCH decoder that performs final correction or flags corruption. The paper also introduces FER, Fingerprint Error Rate, as a whole-fingerprint corruption metric, arguing that average bit accuracy cannot expose rare but catastrophic attribution failures.","core_discovery":"PALADIN's central claim is that error correction, not a better network alone, is what closes the gap from near-perfect to perfect attribution. A 32-bit user ID is first expanded by a BCH(63,39) encoder into a 63-bit codeword, then passed through a cipher network whose output modulates the Stable Diffusion decoder's weights in the StyleGAN style, hiding the codeword in every generated image. A ConvNext-based decipher network recovers a noisy codeword from pixels, and the BCH decoder either corrects up to four bit errors or reports the fingerprint as unrecoverable. Relative to its WOUAF baseline, this lifts bit accuracy from 0.9974 to 1.0000 and lowers FER from 0.0700 to 0.0004 on MS-COCO, with improved SSIM, PSNR, LPIPS, and FID.","pith_inferences":["The reported numbers are aggregate bit accuracy and FER; a stricter deployment audit would look at the per-codeword error distribution, because one image with more than four bit errors either miscorrects to another user or gets flagged, and no aggregate metric would show which.","Since the BCH code sits outside the learned networks, choosing a different cyclic code would trade payload length and correction radius against how much signal the decoder must hide, a natural extension the paper does not explore.","The attack suite covers conventional post-processing and learned autoencoders; adversarial perturbations crafted specifically to push bit errors past the correction radius are the logical next test, and the paper does not claim to survive them.","At perfect attribution, the open problem shifts to provenance under semantic editing, such as inpainting or text-guided manipulation, which can change image content rather than merely degrade it."],"forward_implications":["A provider could deploy per-user attribution for open-source diffusion models without accepting a fixed rate of wrong attributions, because every decoded fingerprint is either corrected to the right user or explicitly marked as corrupted.","The BCH layer is independent of the embedding scheme, so other weight-modulation fingerprinters could be paired with the same encode-decode-correct machinery.","Because the code carries up to 39 message bits, the user space can scale beyond the tested 32-bit fingerprints while preserving the same correction capacity.","The error-reporting path turns the system into a provenance oracle that can answer 'this image has no recoverable fingerprint' instead of being forced to guess a user."],"supporting_citations":[{"why":"Supplies the BCH(63,39) cyclic error-correcting code that detects and corrects up to four bit errors in the recovered fingerprint.","marker":"[1]"},{"why":"Provides the StyleGAN weight-modulation technique used to embed the ciphered fingerprint into the diffusion decoder.","marker":"[6]"},{"why":"Defines WOUAF, the state-of-the-art baseline PALADIN builds on and outperforms in accuracy, FER, and image quality.","marker":"[7]"},{"why":"Supplies the MS-COCO dataset and Karpathy split used to fine-tune the decoder and evaluate fingerprinting.","marker":"[9]"},{"why":"Supplies the ConvNext architecture used as the backbone of the decipher network that extracts the 63-bit codeword from pixels.","marker":"[10]"},{"why":"Supplies the Stable Diffusion latent diffusion model whose decoder is weight-modulated to carry the fingerprint.","marker":"[12]"}],"fun_headline_variants":["BCH error-correcting codes perfect AI image attribution","Diffusion model attribution reaches 100% via error-correcting codes","Perfect attribution for text-to-image models with cyclic codes","PALADIN: error-correcting codes achieve 100% attribution accuracy","Error-correcting codes lift AI image attribution to perfect"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The perfect-attribution claim rests on the assumption that after the decoder reads the hidden code from an image, no image will contain more than four incorrect bits, because the error-correcting code can only fix four; the paper reports average accuracy and overall error rates, not the spread of per-image errors that would verify this.","fun_headline_variants_meta":{"raw":{"variants":["BCH error-correcting codes perfect AI image attribution","Diffusion model attribution reaches 100% via error-correcting codes","Perfect attribution for text-to-image models with cyclic codes","PALADIN: error-correcting codes achieve 100% attribution accuracy","Error-correcting codes lift AI image attribution to perfect"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000205,"raw_usage":{"total_tokens":1347,"prompt_tokens":851,"completion_tokens":496,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":467,"completion_tokens_details":{"reasoning_tokens":408}},"tokens_in":467,"tokens_out":496,"duration_ms":5868,"temperature":1.0,"reasoning_tokens":408,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-07T13:00:13.823088+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Count, for every recovered 63-bit code, how many positions differ from the code that was actually embedded. If any image yields more than four differing positions under the tested attacks, the promised 100 percent attribution fails: the code either corrects to the wrong user or is flagged as unrecoverable.","supporting_citations":[{"cited_title":"Bose and D.K","cited_arxiv_id":null,"evidence_quote":"Supplies the BCH(63,39) cyclic error-correcting code that detects and corrects up to four bit errors in the recovered fingerprint."},{"cited_title":"Analyzing and improving the image quality of stylegan, 2020","cited_arxiv_id":null,"evidence_quote":"Provides the StyleGAN weight-modulation technique used to embed the ciphered fingerprint into the diffusion decoder."},{"cited_title":"Lawrence Zitnick, and Piotr Doll ´ar","cited_arxiv_id":null,"evidence_quote":"Supplies the MS-COCO dataset and Karpathy split used to fine-tune the decoder and evaluate fingerprinting."},{"cited_title":"A convnet for the 2020s, 2022","cited_arxiv_id":null,"evidence_quote":"Supplies the ConvNext architecture used as the backbone of the decipher network that extracts the 63-bit codeword from pixels."}],"review_version":1}