{"id":"2dc7b1b3-c2a2-46c3-a0e0-0dcfff41385f","arxiv_id":"2506.22960","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"high","formal_verification":"none","parameter_count":6,"one_line_summary":"PECCAVI embeds watermarks in paraphrase-stable image regions and reports improved watermark retention after visual paraphrase attacks, but overclaims distortion-free performance and ships no code.","lead":"PECCAVI is a proposed image watermarking method that hides watermarks inside semantic regions that survive AI-based visual paraphrase attacks, reporting higher detection rates after such attacks than existing watermarkers. It targets the AI provenance problem behind misinformation policy, though the paper's 'distortion-free' claim is contradicted by its own PSNR values.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"NMP stability is only validated under the same visual-paraphrase pipeline used to select NMPs; independent or stronger paraphrases are untested, so the 'visual paraphrase attack-safe' claim is not established.","rationale":"The reader's weakest assumption correctly identifies NMP stability as load-bearing. The paper's method embeds watermarks inside regions that survive visual paraphrasing; if those regions are defined with the same paraphrase generator that later evaluates attack resistance, the experiment can overfit to artifacts of that generator. Section 4.4 only uses strengths 0.1 and 0.2 from the same pipeline, so robustness across the attack space is assumed. Our proposed check would test transfer to a different generator and stronger paraphrases, directly probing the central premise. The secondary distortion issue (PSNR ~29.6 vs WAM 46.05) further weakens the abstract's 'distortion-free' claim, but the stability issue is the more fundamental reason the central claim is unsupported. We therefore agree with the reader's REJECT verdict; no adjustment is needed.","tokens_in":9605,"tokens_out":3867,"duration_ms":38521,"concrete_test":"Recompute PECCAVI's NMPs with the authors' pipeline, embed watermarks, then attack with an independent image-to-image model (e.g., stable-diffusion-2-1-base) at strengths 0.1–0.4, measuring WDP. If WDP falls materially below the Table 1 values at matched strengths, NMP stability does not transfer to other paraphrase distributions, and the 'visual paraphrase attack-safe' claim fails.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Section 3.1 defines Non-Melting Points as regions stable across five paraphrases generated with the authors' Barman et al. (2024) pipeline. Section 4.4 evaluates robustness using the same pipeline (stable-diffusion-xl-base-1.0, caption-conditioned, strengths 0.1 and 0.2). Thus NMP selection and attack evaluation share the same generative distribution. The central claim that PECCAVI is 'visual paraphrase attack-safe' assumes NMPs will remain stable for paraphrases produced by other models, at other strengths, or after an adversary locates the random patches, but the paper provides no evidence for those conditions. If NMPs are only stable under the specific paraphrasing setup used for selection, the watermark will melt under any sufficiently different paraphrase attack. The paper also reports PSNR 29.6–29.9 for PECCAVI (XRAI), well below WAM's 46.05, contradicting the 'distortion-free' description, although this is secondary to the stability concern.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The manuscript proposes PECCAVI, a watermarking method for AI-generated images designed to survive visual paraphrase attacks. The method detects Non-Melting Points (NMPs)—regions stable across five paraphrases generated with the Barman et al. (2024) pipeline—embeds watermarks in these regions using multi-channel Fourier-domain watermarking, adds random patching and noisy burnishing to hinder reverse engineering, and applies adaptive enhancement to reduce distortion. The authors report results on 100 COCO images, claiming PECCAVI is the first visual-paraphrase-attack-safe, distortion-free watermarking technique and that it outperforms ZoDiac and WAM under brightness, Gaussian noise, JPEG compression, and two paraphrase strengths. The paper also states that resources and code will be open-sourced.","tokens_in":9769,"tokens_out":4361,"duration_ms":46925,"significance":"The problem is timely and important: generative-AI image provenance and resistance to paraphrase-based de-watermarking are active concerns for policy and practice. The core idea of embedding watermarks in regions that are stable under visual paraphrasing is intuitive and worth investigating, and the paper provides useful ablations over saliency methods (XRAI, MSI-Net, Vanilla Integrated) and top-k patch choices. The authors are also explicit that PECCAVI is model-agnostic and that code will be open-sourced, which are commendable commitments. However, the current validation does not establish the headline claims: the NMP selection and the attack evaluation share the same paraphrase pipeline, the 'distortion-free' claim is contradicted by the reported PSNR/SSIM values, and statistical reliability is not demonstrated. If the evaluation were broadened and the claims appropriately qualified, the method could be a meaningful contribution.","major_comments":[{"comment":"The evaluation is potentially circular. Section 3.1 defines Non-Melting Points as regions stable across five paraphrases generated with the Barman et al. (2024) pipeline, and Section 4.4 evaluates robustness using the same pipeline (stable-diffusion-xl-base-1.0, caption-conditioned, strengths 0.1 and 0.2). The watermark is therefore placed in regions that are stable under exactly the paraphrase distribution used for testing. The claim that PECCAVI is 'visual paraphrase attack-safe' requires evidence that NMPs remain stable under stronger paraphrases (s > 0.2), under different image-to-image models, under unseen prompts and seeds, and under the open-ended visual paraphrase variant described in Section 2.1. Please add held-out attack tests that do not share the NMP-selection pipeline.","section":"§3.1 and §4.4"},{"comment":"The 'distortion-free' claim is not supported by the reported numbers. Table 1 shows PECCAVI PSNR values of 29.56–31.50 dB and SSIM 0.93–0.95, whereas WAM reports PSNR 46.05 and SSIM 1.00, and even ZoDiac reports SSIM 0.92. A PSNR around 30 dB indicates visible distortion, not a distortion-free result. The abstract and Section 5 should either remove the 'distortion-free' claim or qualify it with a perceptual threshold; additionally, Section 3.5's adaptive enhancement procedure should specify how the target SSIM s* and the blending parameter gamma are chosen, since these are free parameters that directly affect the reported distortion.","section":"Table 1 and §5"},{"comment":"The statistical basis of the comparison is too weak. All results are averages over 100 images, but no error bars, confidence intervals, or significance tests are reported. Differences such as PECCAVI (XRAI, Top-50) WDP 0.85 vs. ZoDiac 0.70 at paraphrase strength s=0.2 may be meaningful, but without variance estimates the claim of superiority is not established. The paper should also define Watermark Detection Probability (WDP) explicitly, including the detection threshold and false-positive rate, since a higher WDP at an unstated threshold can be misleading.","section":"§4.4 and Table 1"},{"comment":"The two security mechanisms—random patching and noisy burnishing—are central to the claimed robustness against reverse engineering, but they are not evaluated. Table 1 contains no attack scenario that attempts to locate or distort NMPs, and no experiment measures how noisy burnishing affects image quality versus watermark detectability. To support the security claims, the authors should include an adversarial evaluation, for example re-running saliency detection on the watermarked image and deleting or distorting the detected salient patches, then reporting WDP.","section":"§3.2, §3.3, and Table 1"},{"comment":"There are serious completeness and citation issues. The 'ZoDiac' baseline is cited inconsistently: Section 2 and Table 1 cite Zhou et al. (2024), but the reference list entry for Zhou et al. (2024) is 'Zodiac: A cardiologist-level LLM framework for multi-agent diagnostics', which is not an image-watermarking paper, while Section 3.2 cites 'ZoDiac (Zhang et al., 2024)' with a different author. In addition, the manuscript contains multiple 'Figure ??' placeholders and references an appendix ('Appendix: Visual Paraphrase', 'Appendix: Distortion vs. Detectability') that is not present. These must be corrected for the paper to be reproducible and for the baseline comparison to be credible.","section":"References and missing appendices"}],"minor_comments":[{"comment":"The notation 'PECCA VI' and 'PECCAVI' are used inconsistently; please unify the spelling.","section":"Throughout"},{"comment":"The column labeled 'λ' is not explained anywhere in the text; please either define it or remove it.","section":"Table 1"},{"comment":"The stability score is described as 'lower scores indicate greater consistency', which is counterintuitive; please define the score formula explicitly and explain the direction of the measure.","section":"§3.1"},{"comment":"The statement that all resources and codes will be open-sourced conflicts with the patent footnote stating that 'adoption or research involving this technology for non-profit purposes is strictly prohibited'; please clarify the intended availability.","section":"Footnote 3"},{"comment":"The description says PECCAVI was tested across SD3, SDXL, SD2.1, DALL-E 3, and Midjourney 6, but Table 1 only reports aggregate results on 'MS COCO AI' without per-model breakdowns; please indicate where per-model results are shown.","section":"§4.1"}],"recommendation":"major_revision","confidential_remarks":"The overlap of authors with Barman et al. (2024) is worth the editor's attention in terms of novelty disclosure, but the circular-evaluation concern stands independently of authorship. The manuscript is not ready for acceptance because the central attack-safety claim is validated only under the same paraphrase distribution used to select embedding locations, and the 'distortion-free' claim is contradicted by the paper's own numbers. The issues are potentially fixable with additional experiments and careful rewriting, so I recommend major revision rather than outright rejection."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: the Non-Melting Points idea is genuinely novel and worth a serious look, but the paper's central claims—\"first visual paraphrase attack-safe, distortion-free\"—are not supported by its own evidence. The evaluation is circular in a way that matters: NMPs are defined using five paraphrases from the authors' own Barman et al. 2024 pipeline, and robustness is then tested on the same pipeline at two mild strengths. That doesn't prove visual paraphrase safety; it proves stability under the same distribution used for selection.\n\nWhat's genuinely new: nobody has targeted visual paraphrase attacks by embedding watermarks in paraphrase-stable regions. The combination of saliency-based NMP selection, multi-channel Fourier embedding, and noisy burnishing is a reasonable engineering response to a real attack family. The reported WDP numbers on the 100 COCO images are plausible and internally consistent, and XRAI-based selection does beat the listed baselines after mild paraphrasing.\n\nSoft spots, in order: (1) Circularity. Section 3.1 and 4.4 share the same generator, so the attack-safe claim generalizes to other models/strengths without evidence. (2) \"Distortion-free\" is contradicted by Table 1 (PSNR 29–31) and by the adaptive enhancement baseline; SSIM 0.93 is good but not distortion-free. (3) ZoDiac is cited as Zhou et al. 2024, which is a medical LLM paper, not the watermark baseline. That's a real mis-citation and needs fixing. (4) No error bars, statistical tests, or false positive rates; 100 images is small. (5) The abstract promises open-sourced code, but footnote 3 says the technology is patent-protected and non-profit research is \"strictly prohibited.\" That is an internal contradiction and a reproducibility blocker.\n\nMinor: the strength schedule is hand-chosen, and random patching's security benefit isn't analyzed against an adversary who finds the patches.\n\nOverall: the NMP concept deserves discussion and maybe a follow-up, but the paper is not ready as-is. I'd send it to peer review because the idea is substantive enough to get expert eyes on it, but the reviewers should insist on dropping the \"first/distortion-free\" framing, evaluation across independent paraphrase models and strengths, uncertainty metrics, and code/data release (or an explicit patent-consent mechanism). A serious referee could turn this into a solid paper.","headline":"NMP placement is a genuinely new idea, but the circular evaluation and overclaims mean the paper needs major revision before it can support its headline claims.","tokens_in":10400,"tokens_out":2663,"would_cite":false,"duration_ms":28328,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"PECCAVI claims the first distortion-free watermark that survives visual paraphrase attacks, by hiding in paraphrase-stable image regions.","keywords":["image watermarking","AI-generated images","visual paraphrase attack","Non-Melting Points","saliency detection","frequency-domain watermarking","watermark detection probability","content provenance"],"falsifier":"Generate a PECCAVI watermarked image, paraphrase it at strength 0.5 or with a different image-to-image model than the one used to define the Non-Melting Points, and measure watermark detection probability; if detection drops below the paper's reported range while SSIM stays near 0.93, then Non-Melting Point stability does not generalize. A second test: remove or perturb only the randomly patched watermark regions and check whether detection collapses, which would show random patching, not Non-Melting Point embedding, is carrying the robustness.","tokens_in":9322,"feed_emoji":"🛡️","tokens_out":7719,"duration_ms":74564,"temperature":0.7,"pith_summary":"Visual paraphrase attacks regenerate an image with an image-to-image diffusion model, keeping the meaning but changing pixels enough to erase ordinary watermarks. This paper claims the first watermark that survives such attacks without visible distortion: PECCAVI finds the regions that stay put across five paraphrases, calls them Non-Melting Points, and embeds a multi-channel frequency-domain watermark only there, adding random extra patches and noise to hide the location. On 100 COCO images, it reports watermark detection probability 0.90 at paraphrase strength 0.1 and 0.85 at 0.2, above ZoDiac's 0.81/0.70 and WAM's 0.63/0.56, at PSNR around 29.8 and SSIM 0.93. If true, AI-generated images could carry provenance through mild edits and semantic rewrites that defeat current watermarks.","feed_headline":"Watermark hides in paraphrase-stable spots, outlasting ZoDiac and WAM","feed_subtitle":"Keeps AI-image provenance readable through the paraphrase attacks that erase earlier watermarks.","key_machinery":"The central object is the Non-Melting Point (NMP): a salient image region whose location survives visual paraphrase, found by intersecting saliency maps of five paraphrased copies. The watermark is carried by multi-channel Fourier-space ring patterns placed inside NMP patches; the ring spacing (channel strength) sets resistance, and the number of paraphrases in which a region appears sets the strength. Two security mechanisms protect the embedding: random patching plants an extra watermark patch at a random non-overlapping location, and noisy burnishing adds adversarial noise that blinds saliency detectors trying to find the NMPs. Adaptive enhancement blends the watermarked image with the original to minimize distortion, choosing the smallest blending factor $\\gamma$ that keeps SSIM above a target.","core_discovery":"The paper's central claim is that robustness to visual paraphrase attacks and freedom from visible distortion are compatible for image watermarking, contrary to the brittleness of existing methods. The argument is constructive: a watermark should be placed precisely in the semantic core that a paraphrase preserves, not spread across the whole image. PECCAVI identifies Non-Melting Points by generating five paraphrases, computing saliency maps, and keeping the regions with highest Intersection over Union across paraphrases, then embeds Fourier-domain ring watermarks in multiple channels of those patches, with strength set by stability score ($W_s = \\max(0.1, 1 - 0.25(n-1))$). Random patching and noisy burnishing are added so an attacker who reverse-engineers the saliency method cannot simply excise the watermark. The paper reports that this design beats ZoDiac and WAM on watermark detection probability after paraphrase attacks at strengths 0.1 and 0.2 while keeping SSIM at 0.93.","pith_inferences":["The paper tests only paraphrase strengths 0.1 and 0.2; an untested implication is that at higher strengths or with a different image-to-image model, the Non-Melting Points may shift and the reported detection margins could shrink.","An adversary who reproduces the same paraphrase pipeline offline might learn where the stable regions are; the random patch adds uncertainty, but the paper does not quantify how much entropy that uncertainty provides.","The same Non-Melting Point idea could be extended to video watermarking by looking for patches stable across frames rather than across paraphrases, though the paper does not propose this.","If NMP stability is intrinsic to semantic content, similar stable-region detection could also improve the robustness of other image provenance markers beyond watermarking, but this is an editorial extrapolation."],"forward_implications":["A deployed PECCAVI detector can scan all patches and channels and take the highest score, so it needs no prior knowledge of where the watermark was placed.","Classical post-processing—brightness change, Gaussian noise, JPEG compression at quality 50—leaves watermark detection probability near 0.96–0.99 in the paper's measurements, so routine social-media re-encoding should not erase the watermark.","Because NMP detection uses saliency methods, the approach works across different text-to-image generators, including SD 3, SDXL, SD 2.1, DALL-E 3, and Midjourney 6 images evaluated on MS-COCO.","At paraphrase strengths 0.1 and 0.2, PECCAVI retains watermark detection probability of 0.90 and 0.85 with the best saliency configuration, a margin over ZoDiac and WAM that the paper attributes to embedding inside paraphrase-stable regions.","The random patch and noisy burnishing are meant to stop an attacker from locating the embedded regions, so the method's security does not rely on the watermark placement being secret."],"supporting_citations":[{"why":"Defines the visual paraphrase attack and supplies the image-to-image paraphrase pipeline used to generate the five paraphrases from which Non-Melting Points are computed.","marker":"(Barman et al., 2024)"},{"why":"XRAI saliency detection is the empirically best method for locating Non-Melting Points on which PECCAVI embeds watermarks.","marker":"(Kapishnikov et al., 2019)"},{"why":"WAM is a state-of-the-art local watermarking baseline that PECCAVI claims to surpass under paraphrase attacks.","marker":"(Sander et al., 2024)"},{"why":"ZoDiac is the strongest existing watermarking baseline against generative de-watermarking attacks; PECCAVI reports higher watermark detection probability at paraphrase strengths 0.1 and 0.2.","marker":"(Zhou et al., 2024)"},{"why":"Supplies the multi-channel Fourier domain embedding that carries the actual watermark signal.","marker":"(Gourrame et al., 2022)"},{"why":"Motivates noisy burnishing, which PECCAVI uses to stop attackers from locating salient regions.","marker":"(Gao et al., 2022)"},{"why":"Supplies the adaptive enhancement blending step that trades watermark strength against image quality.","marker":"(Zhang et al., 2024)"},{"why":"MS COCO is the source dataset for the 100 sampled images used in the Table 1 evaluation.","marker":"(Lin et al., 2014)"}],"fun_headline_variants":["Paraphrase-safe watermark hides in stable image cores, beats ZoDiac","AI image watermark survives paraphrase by hiding in stable pixels","PECCAVI: distortion-free watermark that resists visual paraphrase","Watermark embeds in paraphrase-stable regions, beats ZoDiac","Safe from visual paraphrase: watermark in stable image patches"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that the Non-Melting Points found from five paraphrases made with the authors' own image-to-image pipeline will also stay put when an adversary paraphrases with a stronger or different model; if those regions melt, the watermark goes with them.","fun_headline_variants_meta":{"raw":{"variants":["Paraphrase-safe watermark hides in stable image cores, beats ZoDiac","AI image watermark survives paraphrase by hiding in stable pixels","PECCAVI: distortion-free watermark that resists visual paraphrase","Watermark embeds in paraphrase-stable regions, beats ZoDiac","Safe from visual paraphrase: watermark in stable image patches"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.00084,"raw_usage":{"total_tokens":3693,"prompt_tokens":1010,"completion_tokens":2683,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":626,"completion_tokens_details":{"reasoning_tokens":2594}},"tokens_in":626,"tokens_out":2683,"duration_ms":19875,"temperature":1.0,"reasoning_tokens":2594,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-06T21:54:04.586242+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Generate a PECCAVI watermarked image, paraphrase it at strength 0.5 or with a different image-to-image model than the one used to define the Non-Melting Points, and measure watermark detection probability; if detection drops below the paper's reported range while SSIM stays near 0.93, then Non-Melting Point stability does not generalize. A second test: remove or perturb only the randomly patched watermark regions and check whether detection collapses, which would show random patching, not Non-Melting Point embedding, is carrying the robustness.","supporting_citations":[{"cited_title":"The brittleness of ai-generated image watermarking techniques: Examining their robustness against visual paraphrasing attacks, 2024","cited_arxiv_id":null,"evidence_quote":"Defines the visual paraphrase attack and supplies the image-to-image paraphrase pipeline used to generate the five paraphrases from which Non-Melting Points are computed."},{"cited_title":"Xrai: Better attributions through regions","cited_arxiv_id":null,"evidence_quote":"XRAI saliency detection is the empirically best method for locating Non-Melting Points on which PECCAVI embeds watermarks."},{"cited_title":"Watermark anything with localized messages, 2024","cited_arxiv_id":null,"evidence_quote":"WAM is a state-of-the-art local watermarking baseline that PECCAVI claims to surpass under paraphrase attacks."},{"cited_title":"Zodiac: A cardiologist-level llm framework for multi-agent diagnostics, 2024","cited_arxiv_id":null,"evidence_quote":"ZoDiac is the strongest existing watermarking baseline against generative de-watermarking attacks; PECCAVI reports higher watermark detection probability at paraphrase strengths 0.1 and 0.2."},{"cited_title":"Fourier image watermarking: Print-cam application","cited_arxiv_id":null,"evidence_quote":"Supplies the multi-channel Fourier domain embedding that carries the actual watermark signal."},{"cited_title":"Can you spot the chameleon? adversarially camouflaging images from co-salient object detection","cited_arxiv_id":null,"evidence_quote":"Motivates noisy burnishing, which PECCAVI uses to stop attackers from locating salient regions."},{"cited_title":"Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Doll \\'a r, and C","cited_arxiv_id":null,"evidence_quote":"MS COCO is the source dataset for the 100 sampled images used in the Table 1 evaluation."}],"review_version":1}