{"id":"5f156623-7193-483a-802a-878e7b153ed3","arxiv_id":"2507.03646","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"high","formal_verification":"none","parameter_count":3,"one_line_summary":"Blur-plus-deblur and generator fine-tuning can push watermark bit accuracy toward chance, but only when the attacker can train a surrogate decoder that matches the target's architecture.","lead":"This paper tests whether watermarks embedded in Stable Diffusion images can be removed by attackers who never see the watermark decoder. It finds that blur-then-deblur and model fine-tuning reduce detection accuracy, but the fine-tuning setup depends on knowing the decoder architecture.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The fine-tuning attack violates its own no-box threat model: Table 3 shows success only when surrogate depth is within roughly two layers of the target, yet §3.1 forbids knowledge of decoder depth; and no fine-tuning row reaches the claimed ≈0.5 bit accuracy.","rationale":"The paper proposes three attacks and explicitly tests surrogate-depth and message-length sensitivity; that is a useful ablation and shows some honesty about fragility. My stress-test focuses on the fine-tuning attack because it is the paper's main novel mechanism and because the blur attack, while decoder-free, cannot carry the 'preserving visual quality' claim without a baseline. The load-bearing failure is not a stylistic mismatch but an internal tension: the no-box threat model in §3.1 excludes decoder architecture knowledge, while Table 3's own conclusion is that such knowledge is required. Moreover, the reported fine-tuning bit accuracies do not approach the 0.5 chance level used in the problem formulation; the best matched-depth value is 0.6792 and the best over all tested depths is 0.6375. This discrepancy is not explained in the text. I therefore see no alternative reading that supports the abstract's claim that fine-tuning is a successful no-box attack. The blur results are suggestive but are reported without original-image FID/CLIP baselines and with high absolute FID, so they cannot rescue the central claim. Under the instruction to report honest non-findings, this is a real finding: the central claim is not supported by the experimental design. No code or formal verification is provided to offset the contradiction, although the ablations are a useful contribution. I agree with the reader's REJECT verdict and recommend no change.","tokens_in":11692,"tokens_out":6161,"duration_ms":72567,"concrete_test":"Run a strict no-box replication: target depth 8 and message length 48 are fixed but withheld; the attacker selects surrogate depth and message length using only public HiDDeN defaults (e.g., depth 4 or 6, length 32 or 48) and fine-tunes Eq. (9). Report median and interquartile bit accuracy against the target decoder over 10 random attack messages. If no reasonable no-box choice gives bit accuracy below the paper's 0.5 target (or even below the 0.77 upper bound stated in §4.1), the no-box fine-tuning attack is not demonstrated. Also report FID and CLIP for original and attacked images to test the quality-preservation claim.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central no-box fine-tuning attack in §3.5 depends on the surrogate decoder F_Dec in Eq. (9) transferring to the unknown target decoder. The threat model (§3.1) states the attacker has no knowledge of decoder architecture, layer count, or message length, and cannot interact with the target decoder. However, §4.2 reports exactly the opposite dependency: Table 3 varies surrogate depth while the target depth is fixed at 8 and finds bit accuracies of 0.8938 (depth 4), 0.7937 (depth 6), 0.6792 (depth 8), 0.6375 (depth 10), and 0.7369 (depth 12). The authors themselves conclude the attack succeeds only when surrogate depth closely matches the target's. Table 2 shows comparable sensitivity to message length (0.6479–0.8542 across 32–64 bits). A no-box attacker cannot pick the matching depth or length, so the paper's own ablations undercut the claim that fine-tuning removes watermarks without decoder information. Additionally, no fine-tuning row in Tables 2–3 reaches the ≈0.5 bit accuracy asserted in Eq. (4) and the abstract; the closest is 0.6375 at depth 10. The only values near 0.5 come from the box-blur attack (Table 1), but those images have FID 78–100 with no original-image baseline, so the dual claim of removing the watermark while preserving visual fidelity is not established. Thus the load-bearing mechanism for the headline result is either absent or reliant on information the threat model withholds.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes three watermark-removal attacks against model-specific watermarking in text-to-image diffusion models under a claimed no-box setting: edge prediction, box blurring with deblurring, and fine-tuning with a surrogate decoder (Eq. (9)). The central claim is that while edge-based attacks fail, box blurring and fine-tuning reduce watermark detection accuracy, with the best attack lowering bit accuracy to approximately 47.92%, and that even advanced defenses leave extraction accuracy below an acceptable level. The experiments use a self-built Stable Diffusion generator with a HiDDeN-based decoder, with ablations over message length, kernel size, and decoder depth.","tokens_in":1916,"tokens_out":1555,"duration_ms":59409,"significance":"If the no-box results were valid, this would be an important contribution to watermark robustness research, showing that proprietary decoders can be bypassed without any query access. The paper has useful elements: it evaluates three smoothing defenses, includes ablations over message length and decoder depth, and reports multiple quality metrics (IS, FID, CLIP). However, the central no-box claim is not supported by the evidence: the fine-tuning attack relies on surrogate-decoder architecture and training details that the threat model forbids, and the reported fine-tuning accuracies never approach the claimed 0.5 target. The significance is therefore undermined by an internal inconsistency between the threat model and the attack mechanism, and by the narrow experimental setup that does not evaluate actual production watermarking systems.","major_comments":[{"comment":"The threat model states that attackers have no knowledge of the target decoder's internal structure, including layer count, and cannot interact with it. The fine-tuning attack in Eq. (9), however, relies on a surrogate decoder F_Dec trained to approximate the target, and Table 3 shows that attack accuracy is highly sensitive to surrogate depth: with target depth fixed at 8, bit accuracy is 0.8938 at depth 4, 0.6792 at depth 8, and 0.7369 at depth 12. The authors themselves conclude in Section 4.2 that the attack succeeds only when the attacker's decoder closely matches the target depth. This directly contradicts the no-box assumption and means the central fine-tuning attack is not a no-box attack as claimed; it is a transfer attack that requires knowledge of the decoder's architecture and training recipe.","section":"§3.1 vs. §4.2 (Table 3)"},{"comment":"The abstract and Section 1 claim the best attack reduces watermark detection accuracy to approximately 47.92%, but no fine-tuning row in Tables 2 or 3 reaches that value; the closest fine-tuning result is 0.6375 (depth 10), and most rows are above 0.64. The 47.92% figure appears to refer to the deblurred box-blur result (0.4906 in Table 1), not to fine-tuning. Since Eq. (4) and the introduction present fine-tuning as a mechanism that forces bit accuracy near 0.5, the reported fine-tuning results actually show that the watermark remains extractable with better-than-random accuracy, and the headline number is therefore not supported by the experiments.","section":"§4.2, Tables 2–3, and abstract"},{"comment":"The box-blurring attack is evaluated on only 20 images, and no FID, IS, or CLIP baselines are reported for the original unwatermarked or original watermarked images, so the claim that the attack maintains visual fidelity is not established. In addition, the deblurred box (k=9) result has Acc 0.4906 while the blurred result has Acc 0.3792; the paper does not explain why deblurring, which is supposed to restore image quality, moves bit accuracy toward 0.5 while also recovering watermark information, and without confidence intervals the 0.4906 value cannot support a strong robustness conclusion.","section":"§4.1 and Table 1"},{"comment":"The experiments use a self-built pipeline consisting of Stable Diffusion plus a HiDDeN decoder, not the actual model-specific watermarking systems discussed in the related work, such as Stable Signature [3] or the flexible watermarking method of Xiong et al. [28]. The paper's conclusion that model-specific watermarking is vulnerable is therefore an overgeneralization from a single surrogate implementation; no evidence is provided that the attacks transfer to production systems with different embedding losses, decoder architectures, or training procedures.","section":"§4.1 and paper scope"}],"minor_comments":[{"comment":"The threshold ˆλ is introduced but never assigned a value or estimated, and the similarity function Sim is not formally defined; the reader cannot tell what 'approximately 0.5' means operationally.","section":"§3.2, Eq. (4)"},{"comment":"The header 'Class Label Regression' is unclear; the caption defines these as Multi-Class Smoothing, Multi-Label Smoothing, and Regression Smoothing, but the table should label the columns explicitly.","section":"Table 2"},{"comment":"The paired dataset description says the data are used 'in section 3.3' (edge prediction), but the pairing of watermarked and unwatermarked images under identical prompts, seeds, and inference steps is also central to the fine-tuning attack; the text should clarify which attack uses which dataset.","section":"§4.1"},{"comment":"The bit-accuracy curves would benefit from error bars or confidence intervals, especially because the box-blurring results are based on a small number of images.","section":"Figures 5 and 6"},{"comment":"The sentence about Zhu et al.'s HiDDeN method cites reference [12], but reference [12] is Koh and Liang's influence functions paper; the citation appears to be mismatched.","section":"Related work"}],"recommendation":"reject","confidential_remarks":"The paper's core no-box claim is contradicted by the authors' own ablations: the fine-tuning attack requires surrogate-decoder depth and message-length information that the threat model explicitly withholds. Reframing the contribution as a transfer attack with partial knowledge would be a different and weaker claim, so the central result cannot be repaired within the manuscript's current scope."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague, here's my read. The paper has a genuinely interesting idea: instead of attacking individual images, fine-tune the generation model itself to embed a different watermark message. That framing is new relative to the cited attacks, and the ablation on decoder depth and message length is informative—they show that the attack only works when the surrogate decoder's capacity roughly matches the target's. That's a useful empirical finding for anyone designing surrogate-based transfer attacks.\n\nThe box-blur attack is a decent baseline and they carefully compare it with resize, motion, and Gaussian blur. Their claim that blur-plus-deblur lands near 0.5 bit accuracy is plausible, but the evidence is thin: 20 images, no error bars, and FID values around 78–100 with no original-image baseline, so the 'preserving visual fidelity' half of the claim isn't established.\n\nThe big soft spot is the threat model. Section 3.1 says the attacker has no knowledge of the decoder's architecture, layer count, or message length, and cannot interact with it. But the fine-tuning attack requires training a surrogate decoder (Eq. 9) with the same HiDDeN recipe, and Table 3 shows success only when the surrogate depth is close to the target's fixed depth of 8. The authors themselves acknowledge this. That means the 'no-box' framing is not honest; it's a transfer attack that assumes the attacker knows both the training pipeline and the depth. The paper's own ablations undermine its central claim. Also, no row in Tables 2 or 3 reaches the 0.5 accuracy the abstract highlights; the best fine-tuning result is 0.6375. The only values near 0.5 come from blur, which fails the quality requirement.\n\nThe references are fine, and the paper does engage with prior work on surrogate-based attacks. The writing is clear. But the central claim is overstated and the experimental design doesn't support it.\n\nMy take: this should be rejected as stated, but there's enough substance here that a revised version reframed as a study of transfer attacks with a method for estimating surrogate capacity could be worth another look. For peer review, I'd probably desk reject this version because the load-bearing flaw is fundamental, but if the venue wants to give authors a chance to reframe, it could go to reviewers.\n\nRecommendation: don't sink significant time into this in its current form; there's one table (Table 3) that's actually useful, and the fine-tuning attack idea is worth citing later.","headline":"A promising fine-tuning-the-generator attack idea buried under an overstated no-box threat model that the paper's own ablations contradict.","tokens_in":76,"tokens_out":3426,"would_cite":true,"duration_ms":62065,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":false},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper argues that model-specific watermarks in Stable Diffusion can be removed without any access to the watermark decoder, with the best attack lowering detection bit accuracy to about 47.92%.","keywords":["watermark removal","no-box attack","stable diffusion","model-specific watermarking","surrogate decoder","box blurring","fine-tuning attack","watermark robustness"],"falsifier":"Run the fine-tuning attack with a surrogate decoder of depth 8 against a target decoder of depth 12, holding the fine-tuning dataset and generator fixed; if the target's bit accuracy stays above 0.77, the claimed no-box vulnerability does not survive a wrong architecture guess.","tokens_in":11474,"feed_emoji":"🔓","tokens_out":10468,"duration_ms":105860,"temperature":0.7,"pith_summary":"This paper tries to establish that model-specific watermarks embedded in Stable Diffusion images are not robust to attackers who never see the watermark decoder. In a no-box setting, where the attacker only has the generator's weights and a fine-tuning dataset, the paper proposes three attacks: edge-based noise, box blurring followed by deblurring, and fine-tuning the generator with a surrogate decoder. The edge attack fails without ruining the image, but box blurring pushes watermark detection bit accuracy toward chance (the stated best result is about 47.92%), and the fine-tuning attack succeeds when the surrogate decoder's depth matches the target's. The paper also tests three smoothing defenses and finds that even the strongest, multi-label smoothing, leaves extraction accuracy below an acceptable level. If right, current watermarking schemes cannot guarantee traceability against a practical attacker with no decoder access.","feed_headline":"No-box attacks cut Stable Diffusion watermark accuracy to 47.92%","feed_subtitle":"Blurring and surrogate-decoder fine-tuning erase watermarks without any access to the real decoder.","key_machinery":"The machinery is the surrogate-decoder fine-tuning objective of Eq. (9). Here $F_{\\mathrm{Dec}}$ is a fake decoder pre-trained by the attacker to imitate the target decoder, $G$ is the generator with parameters $\\theta_G$, $m_0$ is the original watermark message, and $\\hat{m}$ is a different chosen message. Minimizing the squared distance forces the generator to embed $\\hat{m}$ instead of $m_0$, so the target decoder's extracted message shifts away from the original. The paper shows the objective works only when $F_{\\mathrm{Dec}}$'s capacity, measured by decoder depth, is close to the target's, and that shorter attack messages (32 bits) lower bit accuracy more than longer ones.","core_discovery":"The central claim is that no-box watermark removal is achievable against model-specific watermarking. The load-bearing result is the fine-tuning attack, formalized as minimizing $\\|F_{\\mathrm{Dec}}(G(s,r,s_t;\\theta_G);\\theta_D)-\\hat{m}\\|^2$ subject to $\\hat{m}\\neq m_0$, where $F_{\\mathrm{Dec}}$ is a surrogate decoder trained by the attacker and $m_0$ is the original embedded message; this objective pushes the generator to embed a different message. The experiments show the attack only works when the surrogate decoder's depth equals the target's depth of 8: shallower and deeper surrogates both lose effectiveness. The box-blurring attack needs no learned surrogate: blurring with a box kernel and then deblurring drives bit accuracy to about 0.5 while keeping image quality metrics competitive, and the paper reports the best attack reduction to approximately 47.92% bit accuracy. The edge-prediction attack is ineffective, either leaving bit accuracy near 1.0 or visibly distorting the image.","pith_inferences":["A natural defense suggested by the depth-matching result is to hide or randomize the decoder architecture across deployments, so an attacker cannot pick a matching surrogate depth; the paper does not test this.","The box-blurring result implies watermark energy in these schemes is concentrated in high-frequency edge structure; training the encoder to spread the message across a broader frequency band could plausibly resist blur while preserving invisibility, though this is untested.","Using an ensemble of surrogate decoders with different depths, in the same spirit as multi-surrogate transfer attacks, could make the fine-tuning attack robust to decoder variability; the paper evaluates only single-surrogate fine-tuning.","If these results transfer beyond Stable Diffusion, they would apply to any model-specific watermarking scheme built from a HiDDeN-style autoencoder integrated into a generator, because the attack targets decoder capacity rather than diffusion-specific internals; that generalization is not demonstrated."],"forward_implications":["A no-box attacker can degrade watermark detection to near chance: blurring and deblurring yields bit accuracy around 0.5, so a detector cannot reliably distinguish watermarked from unwatermarked images.","Fine-tuning a watermarked Stable Diffusion model for a legitimate downstream purpose can silently erase its watermark if the fine-tuning is run against a matching surrogate decoder, turning a common workflow into an attack vector.","Post-hoc smoothing defenses such as multi-label smoothing only partially restore bit accuracy and remain below the acceptable range, so current defensive post-processing does not close the vulnerability.","Edge-based perturbation alone is not viable: it either leaves the watermark intact or visibly damages the image, indicating that low-level pixel noise in edge regions is the wrong target for this watermarking scheme.","The fine-tuning attack is fragile because it requires the surrogate decoder's depth to match the target, making the practical risk depend on how much architecture information leaks to attackers."],"supporting_citations":[{"why":"Supplies the Stable Signature model-specific watermarking scheme whose encoder is integrated into latent diffusion, the target setup for the attacks.","marker":"[3]"},{"why":"Provides the WEvade attack and the key objective of moving decoded bit accuracy toward 0.5 rather than zero, which the paper adopts.","marker":"[10]"},{"why":"Supplies the HiDDeN encoder-decoder architecture used to build the watermark decoder and the surrogate decoder in experiments.","marker":"[32]"},{"why":"Provides the FFTformer deblurring network used after box blurring to restore image quality in the blurring attack.","marker":"[13]"},{"why":"Supplies the three smoothing defenses (multi-class, multi-label, regression) that the paper evaluates against its attacks.","marker":"[9]"},{"why":"Provides the Stable Diffusion generator that the paper fine-tunes and watermarks in its experiments.","marker":"[21]"},{"why":"Supplies the COCO dataset used to pre-train the decoder and to select images for fine-tuning.","marker":"[14]"}],"fun_headline_variants":["No-box attacks drop Stable Diffusion watermark accuracy to 47.92%","Blur and fine-tune remove watermarks without decoder – accuracy 47.92%","Edge prediction fails; blur/fine-tune no-box attack yields 47.92% watermark accuracy","No decoder? No problem: SD watermarks cut to 47.92% accuracy","Fine-tuning without decoder reduces SD watermark detection to 47.92%"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The central attack succeeds only if the attacker can pre-train a surrogate decoder that closely mimics the target decoder, including guessing the target's internal depth (8), while having no direct access to it; if that surrogate transfer fails, the fine-tuning route collapses.","fun_headline_variants_meta":{"raw":{"variants":["No-box attacks drop Stable Diffusion watermark accuracy to 47.92%","Blur and fine-tune remove watermarks without decoder – accuracy 47.92%","Edge prediction fails; blur/fine-tune no-box attack yields 47.92% watermark accuracy","No decoder? No problem: SD watermarks cut to 47.92% accuracy","Fine-tuning without decoder reduces SD watermark detection to 47.92%"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000909,"raw_usage":{"total_tokens":3928,"prompt_tokens":989,"completion_tokens":2939,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":605,"completion_tokens_details":{"reasoning_tokens":2830}},"tokens_in":605,"tokens_out":2939,"duration_ms":25603,"temperature":1.0,"reasoning_tokens":2830,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-06T20:05:44.080022+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the fine-tuning attack with a surrogate decoder of depth 8 against a target decoder of depth 12, holding the fine-tuning dataset and generator fixed; if the target's bit accuracy stays above 0.77, the claimed no-box vulnerability does not survive a wrong architecture guess.","supporting_citations":[{"cited_title":"In: Proceedings of the IEEE/CVF International Conference on Computer Vision","cited_arxiv_id":null,"evidence_quote":"Supplies the Stable Signature model-specific watermarking scheme whose encoder is integrated into latent diffusion, the target setup for the attacks."},{"cited_title":"In: Proceedings of the 2023 ACM SIGSAC Conference on Com- puter and Communications Security","cited_arxiv_id":null,"evidence_quote":"Provides the WEvade attack and the key objective of moving decoded bit accuracy toward 0.5 rather than zero, which the paper adopts."},{"cited_title":"In: Proceedings of the European conference on computer vision (ECCV)","cited_arxiv_id":null,"evidence_quote":"Supplies the HiDDeN encoder-decoder architecture used to build the watermark decoder and the surrogate decoder in experiments."},{"cited_title":"In: Proceedings of the IEEE/CVF Con- ference on Computer Vision and Pattern Recognition","cited_arxiv_id":null,"evidence_quote":"Provides the FFTformer deblurring network used after box blurring to restore image quality in the blurring attack."},{"cited_title":"In: European Conference on Computer Vision","cited_arxiv_id":null,"evidence_quote":"Supplies the three smoothing defenses (multi-class, multi-label, regression) that the paper evaluates against its attacks."},{"cited_title":"In: Computer Vision– ECCV 2014: 13th European Conference, Zurich, Switzerland, September 6-12, 2014, Proceedings, Part V 13","cited_arxiv_id":null,"evidence_quote":"Supplies the COCO dataset used to pre-train the decoder and to select images for fine-tuning."}],"review_version":1}