{"id":"e4ee577a-e2f2-423b-b7c4-7d69c30778ea","arxiv_id":"2506.11371","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":1,"one_line_summary":"Clustering visual tokens into equivalence classes lets a distortion-free reweight watermark survive the retokenization step in auto-regressive image generation.","lead":"C-REWEIGHT is a watermarking method that hides a detection signal in images generated by auto-regressive models without altering the model's output distribution. It groups visual tokens into clusters so the signal survives the re-encoding step that normally corrupts the watermark.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Robustness after re-encoding is asserted but not established: the detector's watermark code is derived from the re-encoded raw-token n-gram context, so a retokenized predecessor changes the target cluster even if current-token clusters are stable; no measurement of this code-agreement rate is…","rationale":"The reader's verdict is CONDITIONAL and I agree that the paper needs more evidence before its central claim is accepted, but the weakest point is not exactly the one the reader identified. The reader's concern is that a retokenized token may leave its original cluster, which would break the detection score for that token. My concern is more fundamental: even if every retokenized token stays in its original cluster, the detector computes the watermark code from the re-encoded raw-token prefix, so a change in any preceding token changes the code and therefore the target cluster. This makes the detection score depend on the exact reproduction of the context, not just on cluster membership. The paper's Section 1 motivation—mismatched token pairs are similar—does not imply that the derived code is stable, because the code is keyed to raw token ids. Section 4.2 and Algorithms 2 and 3 confirm that the code is derived from the raw n-gram context. The paper reports no measurement of the retokenization mismatch rate, the cluster retention rate, or the code-agreement rate, so the mechanism behind the high TPR in Table 2 is unverified. Separately, the formal proof of Theorem 4.1 in Appendix A contains sign errors: the overflow distribution is defined with min instead of max, and in Case 2 the probability of sampling c1 from Pc is set to 0 and then later replaced by (hPr(c1)-1) without justification. This is correctable, but it means the formal anchor as written does not establish the theorem. Both issues are addressable with additional measurements and proof repairs, so the CONDITIONAL verdict is appropriate. If the code-agreement test shows that the context instability is negligible in practice, or if the authors change the code derivation to be cluster-based, the claim would be substantially supported.","tokens_in":12132,"tokens_out":13007,"duration_ms":136002,"concrete_test":"On the Pickapic_v2 split used for Table 2, regenerate 500 images with C-REWEIGHT(h=200), then compute the original token sequence x and the re-encoded sequence x'=E(D(x)). For each position i, record (i) cluster retention of the current token, and (ii) code agreement: whether (key, x'_{i-n:i-1}) yields the same target cluster as (key, x_{i-n:i-1}). Report the empirical per-token success probability p1 = P(score=1 | x') and compare it with an oracle detector that uses the original codes while scoring x'. If oracle TPR substantially exceeds actual TPR, the context-derived code instability, not cluster retention, is the binding constraint and the robustness claim must be re-quantified.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim is detectability after decoding and re-encoding, but the detector (Algorithm 3, line 5) recomputes the watermark code from the re-encoded prefix: k_i = (key, x'_{i-n:i-1}). The generator (Algorithm 2, line 5) used the original prefix x_{i-n:i-1}. Since the code is a function of raw token ids (Section 4.2), any retokenization of a preceding token changes θ_i and hence the target cluster c_i'(θ_i), even when the retokenized token stays inside its original cluster. Definition 4.2 then returns 0 for that position. Thus the paper's key insight—cluster-coherent retokenization—addresses only the membership of the current token, not the stability of the context-derived code. For n=1 (Section 5), a single changed previous token kills the signal at that position. No experiment reports the code-agreement rate P(θ_i(x') = θ_i(x)) or the retokenization mismatch rate. Table 2's high TPR does not settle this: with t=4096 tokens, even an H1 per-token success probability p1≈0.5 yields overwhelming detection, so the observed 0.99 TPR is consistent with a wide range of code-instability rates and does not validate the clustering mechanism as the source of robustness.","agreement_with_reader":"disagree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes C-REWEIGHT, a watermarking scheme for auto-regressive image generation models. The method first clusters image tokens by k-means on decoder embeddings, then uses a cluster-level reweighting rule: at each generation step a cluster is pseudo-randomly selected from the watermark code and the next token is sampled from that cluster according to the original model distribution, with an overflow distribution to maintain unbiasedness. Detection recomputes the code from the re-encoded token sequence and scores each position by whether the observed token lies in the code-selected cluster. The paper claims distortion-freeness (Theorem 4.1) and reports empirical detectability and robustness results on Emu3 across four datasets, with TPR@FPR comparisons against KGW, Unigram, ITS-edit, EXP-edit, γ-reweight, DiPmark, and STA-1.","tokens_in":12383,"tokens_out":7388,"duration_ms":73472,"significance":"If the robustness claim holds, C-REWEIGHT addresses a real and specific problem: retokenization mismatch in auto-regressive image generation, a setting where token-level watermarks designed for language models degrade. The distortion-free proof in Appendix A is analytical and is not fitted to data, which is a genuine strength. The method is simple and plausibly deployable, and the empirical comparisons cover multiple datasets and attack budgets. However, the central claim of detectability after decoding and re-encoding rests on an unmeasured assumption about the stability of the context-derived watermark code, and the reported experiments do not directly substantiate the mechanism claimed to provide robustness. These gaps need to be closed before the paper's main claims can be accepted.","major_comments":[{"comment":"Algorithm 1 line 6 prints the condition 'if j < Pr(c_i'(θ))', but the surrounding text and the proof in Appendix A use the condition 'j < h·Pr(c_i'(θ))'. Under the printed condition, the expectation in Case 1 of the proof would be (1/h)·Pr(c1)·(PM/Pr(c1)) = PM/h, not PM, so the algorithm as printed is not distortion-free. This is a load-bearing inconsistency: Theorem 4.1 depends on the h-scaled condition. The algorithm must be corrected to match the proof, and the proof line should be cross-checked with the final Algorithm 1.","section":"§4.1, Algorithm 1"},{"comment":"The generator (Algorithm 2, line 5) derives the watermark code from the original prefix x_{i-n:i-1}, while the detector (Algorithm 3, line 5) recomputes the code from the re-encoded prefix x'_{i-n:i-1}. Since the code is a function of raw token ids (§4.2), any retokenization of a preceding token changes θ_i and hence the target cluster c_i'(θ), even when the retokenized token itself stays in its original cluster. For n=1, which the experiments use, a single changed previous token kills the signal at that position. The paper's key insight—cluster-coherent retokenization—addresses membership of the current token, not the stability of the context-derived code. No experiment reports the code-agreement rate P(θ_i(x') = θ_i(x)) or the per-token retokenization mismatch rate. With t=4096 tokens, the high TPR values in Table 2 are consistent with a per-token success probability as low as about 0.5, so the table does not validate the clustering mechanism as the source of robustness. Please add direct measurements of code stability and per-position signal preservation, and report TPR as a function of sequence length or per-token success probability.","section":"§4.2, Algorithms 2 and 3"},{"comment":"The claim of 'a 10% increase in detection accuracy' is not defined or connected to any table, metric, or baseline. Tables 2–4 report TPR@FPR at various FPRs and attack budgets, but no comparison in the manuscript yields a single 10% figure. If this number refers to a specific aggregated comparison, it should be derived explicitly; otherwise it should be removed or replaced with a precise statement tied to the reported results.","section":"Introduction, Contributions"},{"comment":"The rows for ITS-edit and EXP-edit are reported at their empirical false positive rates, while the C-REWEIGHT rows are reported at guaranteed FPRs of 1% and 0.1%. These operating points are not matched, so the table does not support the statement that C-REWEIGHT 'outperforms all other unbiased watermarks' over those baselines. Please re-report ITS-edit and EXP-edit at the same FPRs used for the other methods, or state the empirical FPRs explicitly and restrict the comparison to methods with comparable operating points.","section":"§5.1, Table 2"}],"minor_comments":[{"comment":"The definition of Pc writes 'min{0, hPr(ci)-1}, ..., min{0, hPr(ci)-1}', which repeats the same expression; the i-th component should be min{0, hPr(c_i)-1}. As printed, the vector definition is ambiguous.","section":"§4.1, Algorithm 1 line 3"},{"comment":"The text says 'Pseudo-randomly select a cluster c_i'(θ)' but does not state that the selection is uniform over the h clusters. The proof in Appendix A assumes a uniform selection, so this should be made explicit in the algorithm.","section":"§4.1, Algorithm 1 line 4"},{"comment":"The notation 'i.i.d. watermark codes {θ_i}' is inaccurate because θ_i is derived from the preceding n-gram context and is therefore not i.i.d. across positions. The paper should say 'pseudo-randomly generated codes' or specify the i.i.d. code schedule before conditioning on context.","section":"§3.1, Notation"},{"comment":"Table 1 is described as a visual comparison of generation results, but no images appear in the manuscript. Either include the figure or refer to a supplementary file.","section":"Table 1"},{"comment":"The experiments use 500 examples per task, but no confidence intervals or standard deviations are reported. Given that many TPR values in Tables 2–4 are at saturation (0.99), error bars or a small number of repeated trials would help assess the stability of the comparisons.","section":"§5, Experimental setup"},{"comment":"Definition 4.2 returns 1 only when x lies in c_i'(θ), but in the generator the actual sampled cluster can be c_i''(θ) when the overflow branch is taken. The paper acknowledges that this reduces detection accuracy, but it does not quantify the resulting detection score distribution. A short sentence explaining how the overflow case affects the expected score would improve the statistical discussion.","section":"§4.2, Definition 4.2"},{"comment":"The condition 'if θ_i ∈ hist' is not fully specified: it is unclear whether hist stores the full code, the code together with the context, or just the sampled cluster, and how hist is updated. This matters for reproducibility.","section":"§4.2, Algorithm 2 line 6"}],"recommendation":"major_revision","confidential_remarks":"The theoretical core of the paper is, after correcting the Algorithm 1 line 6 typo, essentially sound: the distortion-free proof is a clean analytic argument. The main weakness is empirical: the central robustness claim after decoding and re-encoding is not directly measured, and the reported TPRs at t=4096 are too coarse to validate the cluster-stability mechanism. I would not reject, because the gap is fixable with additional measurements and a corrected algorithm. The '10%' claim should also be made precise or removed. Please weigh the fit of the paper's experimental validation against the strength of the claimed mechanism."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The genuinely new thing here is the multi-cluster reweight, which generalizes DiPmark's two-cluster scheme to h clusters, and the application to autoregressive image generation with explicit attention to retokenization mismatch. The distortion-free proof in Appendix A is algebraically correct, provided the pseudocode in Algorithm 1 is read as j < h·Pr(ci') rather than the printed j < Pr(ci'). The prose and proof use the h factor, so I'd call that a typo, not a conceptual flaw. The authors also deserve credit for choosing a scheme that is provably distortion-free rather than just empirically close, and for reporting image quality metrics that look comparable to unwatermarked generation.\n\nThe soft spots are real but mostly addressable. First, the claimed 10% improvement in detection accuracy in the introduction is not directly supported: the tables report TPR at fixed FPR for most methods, but ITS-edit and EXP-edit are measured at their empirical FPR, so those comparisons are not aligned. Second, the robustness experiments use only one dataset (Pickapic_v2), which is thin. Third, and most important, the paper never measures the stability of the context-derived code under retokenization. The detector recomputes θ_i from the re-encoded prefix x'_{i-n:i-1}, so even if the current token stays in its original cluster, a changed previous token changes the target cluster and Definition 4.2 returns 0 for that position. The high TPR in Table 2 is consistent with a per-token success probability of around 0.5–0.6 over 4096 tokens, so it does not by itself validate the clustering mechanism as the source of robustness. A measurement of the code-agreement rate P(θ_i(x') = θ_i(x)) and the retokenization mismatch rate would close this gap.\n\nThat said, the central idea is sound: clustering tokens by decoder-embedding similarity is a plausible way to make a distortion-free watermark more resilient to re-encoding. The paper is a solid extension of existing LM watermarking work, not a paradigm shift, but it is a useful step for autoregressive image models. I would send it to review. The typos and missing measurements are fixable, and the core theorem holds. I'd want a referee to push on the retokenization-stability question, but that's a reason for revision, not rejection. For a reading group, it's a good paper to discuss because it illustrates how a seemingly small domain shift (text to images) creates a new failure mode.\n\nRecommendation: accept for peer review with the expectation of major revision. The method is worth engaging with.","headline":"Solid distortion-free watermark extension with a real but unquantified robustness gap: the detector's code depends on the re-encoded prefix, so retokenization of preceding tokens can kill the signal even when current tokens stay in cluster.","tokens_in":12923,"tokens_out":1009,"would_cite":true,"duration_ms":12066,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"C-REWEIGHT embeds a distortion-free watermark in autoregressive image generation by clustering tokens so retokenization mismatches do not erase the detection signal, and claims a 10% increase in detection accuracy over prior methods.","keywords":["watermarking","autoregressive image generation","distortion-free watermark","retokenization mismatch","cluster-based reweight","Emu3","image provenance","k-means token clustering"],"falsifier":"Measure, on a model like Emu3, the fraction of tokens whose re-encoding $E(D(x))$ falls in a different k-means cluster than $x$, as a function of the cluster count $h$; if that fraction is large, detection accuracy should collapse despite the distortion-free guarantee.","tokens_in":1549,"feed_emoji":"🖼️","tokens_out":6307,"duration_ms":94794,"temperature":0.7,"pith_summary":"Auto-regressive image models turn pictures into discrete tokens, generate new tokens one by one, and then decode tokens back into pixels. Any watermark placed on those tokens must survive a second encoding when the image is checked, and that re-encoding usually produces a different token sequence. The paper claims this retokenization mismatch is the main obstacle, and that grouping similar tokens into clusters before applying a reweighting watermark solves it: the generator and detector only care which cluster a token is in. If the claim is right, invisibly watermarked AI images can be verified after a decode-encode round with better accuracy than existing distortion-free schemes, at the cost of one offline clustering run per model.","feed_headline":"AI-image watermark stays detectable after re-encoding","feed_subtitle":"Grouping similar image tokens keeps the signal intact through re-encoding and beats prior distortion-free methods.","key_machinery":"The mechanism is cluster-based reweight. Image tokens are clustered once per model with k-means on the decoder embeddings. At each generation step, the watermark code pseudo-randomly selects a target cluster; the sampler picks a token from that cluster with probability proportional to the base model's mass in the cluster, using a rejection step and an overflow distribution to correct the bias. Theorem 4.1 proves the correction makes the overall sampling distribution identical to the base model's, so there is no image-quality loss. At detection, the image is re-encoded and the score $s(\\theta, x)$ simply checks whether each token lies in the cluster named by the code; under the null hypothesis the score is binomial with success probability $1/h$.","core_discovery":"The central claim is that C-REWEIGHT is a distortion-free watermark for autoregressive image generation that stays detectable after the image is decoded and re-encoded. Formally, Theorem 4.1 states that the cluster-based reweight is distortion-free: for every token $x$, the expectation of the watermarked distribution over watermark codes equals the original model distribution, $E_\\theta[P_W(x \\mid x_{1:n}, \\theta)] = P_M(x \\mid x_{1:n})$. Empirically, on Emu3 with $h=100$ and $h=200$ clusters over four image datasets, the method reports TPR@FPR=1% of 0.96-0.99, and the abstract claims a 10% increase in detection accuracy over existing distortion-free methods. The paper's insight is that a retokenization error tends to move a token to another token with similar decoder embedding, so a k-means clustering of decoder embeddings contains both original and re-encoded tokens in the same cluster, preserving the detector's statistical signal.","pith_inferences":["A natural testable extension is to measure cluster-boundary crossing rates directly and use them to choose the number of clusters $h$, rather than fixing $h=100$ or 200; the paper's own logic predicts an optimal $h$ that balances detection power against rejection by the overflow correction.","Because the watermark code is derived from the n-gram context plus a secret key, the scheme inherits the code-history safeguard of earlier reweight methods, which may weaken the signal on highly repetitive sequences; that trade-off is not analyzed for images.","The method should transfer to any VQ-style tokenizer beyond Emu3, since the only model-specific ingredient is a set of decoder embeddings to cluster; a cross-tokenizer study would test whether retokenization mismatch is indeed the dominant failure mode.","The detection statistic ignores which token inside a cluster was sampled, so an adversary who swaps tokens within a cluster avoids detection; whether intra-cluster token substitution counts as a realistic image edit remains an open security question."],"forward_implications":["Watermarking can be added to existing autoregressive image models without retraining, since clustering is done once on decoder embeddings and the reweight runs at sampling time.","Detectability holds after the image is saved and re-encoded, the exact setting that defeated direct adaptation of language-model watermarks.","Robustness to noise attacks improves: with $h=200$, TPR@FPR=1% stays 0.99 under an $\\ell_2$ budget of 1.00 and 0.78 under an $\\ell_\\infty$ budget of 8/255.","The detector has a closed-form statistical test based on a binomial tail bound, unlike baselines that only report empirical false-positive rates.","Fidelity is preserved: FID and CLIP scores for watermarked images stay close to unwatermarked baselines, making the watermark effectively invisible."],"supporting_citations":[{"why":"Supplies the KGW baseline watermark and the TPR@FPR evaluation protocol that the paper adopts for comparison.","marker":"Kirchenbauer et al., 2023"},{"why":"Provides DiP-reweight, the two-cluster distortion-free reweight strategy that C-REWEIGHT generalizes to multiple clusters.","marker":"Wu et al., 2023"},{"why":"Supplies the notation, the gamma-reweight baseline, and the watermark-code history mechanism used to preserve distortion-freeness across multiple generations.","marker":"Hu et al., 2023"},{"why":"Emu3 is the autoregressive image generation model used for all experiments, establishing the tokenizer and the retokenization setting.","marker":"Wang et al., 2024"},{"why":"Provides ITS-edit and EXP-edit, the robustness-focused distortion-free baselines that C-REWEIGHT is compared against.","marker":"Kuditipudi et al., 2023"},{"why":"Introduced the distortion-free Gumbel-reweight watermark, the conceptual origin of the distortion-free guarantee the paper builds on.","marker":"Aaronson, 2022"},{"why":"Provides the MoVQGAN-based vision tokenizer that defines the discrete token space and the retokenization behavior central to the method.","marker":"Zheng et al., 2022"}],"fun_headline_variants":["Distortion-free AI image watermark survives re-encoding","Cluster-based watermark stays detectable after re-encoding","Watermark for autoregressive image models resists re-encoding","C-REWEIGHT watermark remains detectable after re-encoding"],"cache_read_input_tokens":15104,"weakest_assumption_plain":"The watermark stays detectable only if a re-encoded token usually lands in the same cluster as the original token; the paper gives no measurement of how often retokenization crosses a cluster boundary.","fun_headline_variants_meta":{"raw":{"variants":["Distortion-free AI image watermark survives re-encoding","Cluster-based watermark stays detectable after re-encoding","Watermark for autoregressive image models resists re-encoding","C-REWEIGHT watermark remains detectable after re-encoding"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000476,"raw_usage":{"total_tokens":2358,"prompt_tokens":939,"completion_tokens":1419,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":555,"completion_tokens_details":{"reasoning_tokens":1353}},"tokens_in":555,"tokens_out":1419,"duration_ms":12780,"temperature":1.0,"reasoning_tokens":1353,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-07T04:10:43.858850+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Measure, on a model like Emu3, the fraction of tokens whose re-encoding $E(D(x))$ falls in a different k-means cluster than $x$, as a function of the cluster count $h$; if that fraction is large, detection accuracy should collapse despite the distortion-free guarantee.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Introduced the distortion-free Gumbel-reweight watermark, the conceptual origin of the distortion-free guarantee the paper builds on."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides the MoVQGAN-based vision tokenizer that defines the discrete token space and the retokenization behavior central to the method."}],"review_version":1}