{"id":"fa985cff-49b5-47e5-a7a9-4b46fccedc4f","arxiv_id":"2507.13407","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"IConMark adds preselected, human-readable objects to AI images via prompt engineering and detects them with a vision-language model, achieving higher AUROC than noise-based watermarks on tested augmentations.","lead":"IConMark embeds visible, human-readable objects, such as a blue street sign or a stone Buddha statue, into AI-generated images by adding them to the text prompt, then detects them with a vision-language model. It reports better robustness than noise-based watermarks under common image edits, but the technique visibly changes the image content, which limits its practical use.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The 'private' concept database is printed in the appendix, so adversarial robustness rests on a secret that is public; no knowledgeable-adversary evaluation exists.","rationale":"The reader identified the public database and the absence of a knowledgeable adversary as part of the weakest assumption; I focus on that as the single most load-bearing issue. The paper's own appendix contradicts its 'private database' premise, and the experimental section tests only benign augmentations. This is not a consensus dispute but an internal inconsistency: the security model and the artifact presented are incompatible. The empirical AUROC results are credible as a proof-of-concept for non-adversarial settings, and the hybrid combinations are a reasonable idea, but the advertised adversarial robustness is unsupported. The proposed concrete test would settle the matter: a targeted removal or spoofing attack using the published database. If the detector survives targeted removal, the main objection is mitigated; if not, the paper's central claim should be downgraded to robustness against common image edits only. I therefore keep the reader's CONDITIONAL verdict rather than moving to accept or reject, since the core empirical findings are not invalidated, but the advertised security property is unverified.","tokens_in":12105,"tokens_out":4195,"duration_ms":51343,"concrete_test":"Use the published database. (1) Removal attack: for each watermarked image in the MS-COCO test set, run an instruction-based editing model (e.g., FLUX.1 with a prompt such as 'remove the following objects from this image: [the k concepts detected by IDEFICS3]') or a targeted diffusion purification with a negative prompt listing the concepts. Recompute IConMark AUROC on the edited set. If AUROC remains above ~95%, the robustness claim survives; if it drops toward 50%, adversarial robustness fails. (2) Spoofing attack: take 1000 real/non-watermarked images, use the same editor to insert 2–3 concepts from the public database, and measure the false positive rate at the paper's threshold. Report both numbers. Also (optional) run a 20-image human study asking annotators to identify the embedded concepts in watermarked images to test the interpretability claim.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central robustness claim is that IConMark is 'resilient to adversarial manipulation' (Abstract, Section 1). The mechanism supposed to provide this resilience is a 'private concept database' (Sections 3.1, 3.3, 4). However, the full 100-concept database is listed verbatim in Appendix A.1, so the secrecy assumption is violated by the paper itself. An attacker who knows D can (1) prompt a diffusion editor to remove or inpaint the known concepts from a watermarked image, or (2) add these concepts to arbitrary real images to spoof a watermark. Section 5.3 evaluates only non-adversarial augmentations—affine, valuemetric, warp, and untargeted regeneration—none of which uses knowledge of D. Therefore the headline AUROC gains (10.8–15.9%) are demonstrated only against benign distortions, not against the adversarial manipulations the paper claims to resist. A secondary but related gap: 'interpretable to humans' is asserted without a human study or a ground-truth check that Flux actually renders the sampled concepts; the VLM-based detection score could partly reflect VLM hallucination. The load-bearing condition for the paper's contribution is that a secret, human-verifiable semantic signal survives hostile editing; that condition is currently untested and its premise (secrecy) is false.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes IConMark, a watermarking method for AI-generated images that samples k concepts from a hand-crafted concept database, augments the user prompt with these concepts, and later detects the watermark by prompting a vision-language model (IDEFICS3) to check for the presence of database concepts. The method is combined optionally with StegaStamp or TrustMark to form IConMark+SS and IConMark+TM. The experiments on MS-COCO and OIP datasets measure watermark detection AUROC, accuracy, true-positive rates at fixed false-positive rates, and image-quality metrics (CLIP score, aesthetic ratings, artifacts, diversity) under affine, valuemetric, regen (diffusion purification), and warp augmentations. The paper reports that IConMark and its variants achieve higher mean AUROC than the baseline methods and claims that IConMark is the first interpretable watermark, robust to adversarial manipulation and human-verifiable.","tokens_in":12341,"tokens_out":4150,"duration_ms":44706,"significance":"If the scope were limited to robustness against benign image manipulations and to machine-based watermark detection using semantic concepts, the paper would be a useful proof-of-concept: the augmentation evaluation is reasonably thorough, the hybrid combination logic is sensible, and the idea of embedding natural-language concepts is novel. However, the central security claim that IConMark is 'resilient to adversarial manipulation' is not supported by the evidence, because the so-called private concept database is printed verbatim in Appendix A.1, enabling an informed adversary to remove or spoof the watermark. The interpretability claim also lacks a human-subject evaluation. With a reframing of the claims and targeted additional experiments, the contribution could become a solid step toward semantic watermarking; in its current form, the adversarial-robustness framing overstates what is demonstrated.","major_comments":[{"comment":"The paper calls D a 'private concept database' (Sec. 3.1) and motivates resilience to adversarial manipulation on that basis (Abstract, Sec. 1), but the complete 100-concept list is printed verbatim in Appendix A.1. The secrecy assumption is therefore violated by the paper itself, and the evaluation in Sec. 5.3 considers only four oblivious augmentations (affine, valuemetric, regen, warp). A knowledgeable adversary could remove or inpaint known concepts or inject them into arbitrary images to spoof detection. The reported AUROC gains therefore do not support the adversarial-robustness claim; please either evaluate a knowledgeable adversary or explicitly scope the claim to benign image manipulations.","section":"Sec. 3.1; Appendix A.1"},{"comment":"The paper claims IConMark is 'interpretable to humans' and enables 'manual verification of watermarks,' but no human-subject experiment is reported. The only evidence is that concepts are natural-language descriptions. Without measuring whether humans can distinguish watermarked from non-watermarked images, or reliably identify database concepts, the 'interpretable watermark' contribution is not substantiated. A small human study, or a clear statement that human interpretability is conjectural, is needed.","section":"Sec. 1; Sec. 6"},{"comment":"The detection score is the number of database concepts that IDEFICS3 claims to see. Because watermarked images are generated by prompting Flux to insert exactly those concepts, high scores in the watermarked condition are expected by construction. The paper does not report per-concept false-positive rates or VLM precision, and Figure 3's histogram lacks labeled axes, making it hard to assess the true separation between classes. Moreover, the comparison to StegaStamp under augmentations is not attack-calibrated: the same perturbation may be much stronger for one watermark type than another. Please report per-concept detection statistics and an explicit false-positive analysis on a larger non-watermarked corpus.","section":"Sec. 3.3; Fig. 3; Table 3"}],"minor_comments":[{"comment":"The sentence 'we halve our dataset size to 1080 images' is ambiguous: it is unclear whether 1080 is the total number of images or the number per class. Please clarify.","section":"Sec. 5.1"},{"comment":"The phrase 'compared to the best baseline' is misleading: in Table 3, StegaStamp outperforms IConMark alone on OIP for regen (95.81 vs 86.34) and valuemetric (99.33 vs 83.43). The comparison appears to be against the best average baseline, StegaStamp; please state that explicitly.","section":"Abstract; Sec. 5.3"},{"comment":"The heading 'Additional Examples of Generated Images' is followed by the concept database and then more figures; give the concept database its own subsection title so that its presence is not buried.","section":"Appendix A.1"},{"comment":"Reference [16] (OpenAI ChatGPT) contains the placeholder 'Accessed: YYYY-MM-DD'; the access date should be completed.","section":"References"},{"comment":"The right-hand histogram shows the number of detected concepts for watermarked and non-watermarked images, but the axes are unlabeled and the threshold τ is not marked. Adding axis labels and a threshold line would make the separation argument clearer.","section":"Fig. 3"}],"recommendation":"major_revision","confidential_remarks":"The paper is a promising proof-of-concept for semantic watermarking, but the adversarial-robustness framing is not supportable as written because the secret is public. I would encourage the authors to reframe the contribution as robustness to common image manipulations, add a knowledgeable-adversary experiment (or explicitly defer it), and run a small human interpretability study. With those changes, the paper could be a solid contribution to the watermarking literature. I also note that the paper's stated 'first interpretable watermark' claim should be checked for prior art, as semantic/syntactic watermarking ideas may exist in other modalities."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Read through IConMark. The core idea is genuinely new: instead of hiding noise-based watermarks, the method instructs the generator to include a few semantic objects from a curated concept database, then uses a VLM to check for those objects. That is a simple but real departure from StegaStamp, TrustMark, TreeRing, etc., and the paper demonstrates the idea convincingly on the tested settings. The detection AUROC on benign augmentations (affine, valuemetric, warp, regeneration) is high, and the hybrid combinations with StegaStamp and TrustMark are sensible and improve robustness. The quality metrics show little degradation, though those metrics do not measure whether the added objects distort the user's semantic intent.\n\nThe main soft spot is exactly what the stress-test note flags: the concept database is called 'private' (Sections 3.1, 3.3) but is printed verbatim in Appendix A.1. An attacker who reads the paper knows the full set of 100 concepts. They can prompt an editor to remove or inpaint those objects from a watermarked image, or add them to real images to spoof detection. The paper evaluates only non-adversarial distortions—none of which uses knowledge of D—so the headline 'resilient to adversarial manipulation' is not supported by the experiments. A knowledgeable-adversary evaluation is needed, and the simplest fix is to treat the database as public and measure robustness against an attacker who knows it. The 'interpretable to humans' claim also lacks a human study; the VLM-based detection score could in part reflect VLM hallucination, and the paper does not verify that Flux actually renders the requested concepts. No code or data are released, which limits reproducibility. The limitations section is honest and acknowledges the proof-of-concept nature, but the abstract and introduction make stronger claims than the experiments justify.\n\nFor the watermarking/forensics community, this is a worthwhile direction and deserves a serious referee. The fix is not a redesign—it is a more careful evaluation and a re-scoped claim. I'd accept it with major revisions, and I'd bring it to a reading group for the discussion of what 'robust' should mean when the watermark is visible.\n\nRecommendation: send it to peer review; the idea is new enough and the execution clean enough to warrant referee time, with the expectation of significant revision.","headline":"IConMark is a genuinely new idea—semantic objects as watermarks—with credible results on benign edits, but its 'private' concept database is printed in the appendix, so the adversarial-robustness claim is untested.","tokens_in":12871,"tokens_out":2445,"would_cite":true,"duration_ms":26468,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A visible-object watermark beats noise-based marks on AI images.","keywords":["interpretable watermarking","AI image provenance","concept-based watermark","vision-language model","image augmentation robustness","diffusion purification","prompt-based embedding","watermark detection"],"falsifier":"Remove or repaint all k embedded objects in a set of IConMark images using inpainting or targeted cropping, then rerun the IDEFICS3 detector; if AUROC at 5% false-positive rate falls to the level of the noise-based baselines, the robustness claim fails. Conversely, if ordinary real or non-watermarked AI images from the same generator accumulate enough database concepts to cross the threshold, the false-positive side of the claim fails.","tokens_in":11860,"feed_emoji":"🖼️","tokens_out":6146,"duration_ms":69845,"temperature":0.7,"pith_summary":"IConMark proposes that an AI-image watermark can be a set of ordinary-looking objects rather than an invisible noise pattern. Before generating an image, the method appends several concepts from a fixed database to the user's prompt, so the generator paints those objects into the scene; at detection time, a vision-language model is asked whether each database concept is present, and an image is marked as AI-generated if enough of them show up. The paper reports that this scheme, plus two hybrids that combine its verdict with StegaStamp or TrustMark, achieves mean AUROC gains of 10.8%, 14.5%, and 15.9% over the strongest noise-based baseline across affine, valuemetric, regeneration, and warp manipulations, and that IConMark variants are the only tested methods that stay accurate under all four. If correct, the work establishes interpretability as a robustness mechanism: a watermark a person can point to is also one that survives image edits.","feed_headline":"A visible-object watermark beats noise-based marks on AI images","feed_subtitle":"IConMark embeds readable objects in generated images and still detects them after heavy edits.","key_machinery":"The machinery is a concept database plus a concept-count detection score. The database supplies the watermark alphabet; the top-k sampler selects contextually plausible entries from it; the image generator renders those concepts into the scene; and the vision-language model counts how many database concepts appear in a candidate image, with a threshold deciding the watermark verdict. This shifts the detection signal from low-amplitude noise, which diffusion purification and similar edits can erase, to semantic objects that remain recognizable after cropping, warping, color changes, and regeneration.","core_discovery":"The central claim is that a watermark need not be a perturbation: it can be a set of concepts, describable objects with a distinctive detail such as 'a stone garden statue of buddha', inserted into the generated image by prompt augmentation. IConMark builds a private database of N=100 concepts, uses a language model to select k=9 related concepts for each user prompt, appends them to the prompt, and feeds the augmented prompt to the Flux image generator. At detection time, the vision-language model IDEFICS3 is asked to check for each database concept, and the number of concepts found is compared to a threshold: above threshold means watermarked. The paper shows detection AUROC rising from 76.05% at k=1 to 97.46% at k=9 on MS-COCO, with histograms of concept counts separating watermarked from non-watermarked images, and reports that under the tested augmentations IConMark, IConMark+TM, and IConMark+SS maintain high detection while noise-based baselines degrade substantially. In the paper's own summary, IConMark and its variants are the only techniques that maintain high detection in the presence of all of the augmentation attacks.","pith_inferences":["Since the concept database is printed in the appendix, it is not actually secret: an attacker who knows the 100 concepts could try to add or scrub exactly those objects, so deployment would need a rotating or encrypted database to preserve security.","If semantic watermarks catch on, the attack surface shifts from pixel-space denoising to object-level editing, such as removing, repainting, or regenerating specific objects, so future detectors may need to check object relationships and location consistency, not just presence.","Because the watermark lives in the prompt, the same scheme could in principle transfer to newer image generators without retraining, as long as the generator reliably paints the requested concepts and the vision-language model reliably recognizes them."],"forward_implications":["Detection is human-auditable: a person can verify a watermark by looking for database concepts, with no decoder or secret key needed.","Because IConMark only changes the prompt, it can be layered under any post-hoc watermarker; the hybrid's verdict is the OR of the two detectors, so it inherits both robustness sets.","Detection quality improves with the number of embedded concepts in the experiments, from 76.05 to 97.46 AUROC as k goes from 1 to 9 on MS-COCO, with reported generation-quality metrics roughly unchanged.","Across affine, valuemetric, regeneration, and warp modifications, IConMark and its hybrids are the only evaluated methods that maintain high detection accuracy; on average they beat StegaStamp by 10.8%, 14.5%, and 15.9% AUROC.","The method is a proof of concept that interpretable watermarks can complement, rather than replace, existing noise-based watermarking schemes."],"supporting_citations":[{"why":"Supplies the Flux image generator that renders watermarked concepts into images.","marker":"[13]"},{"why":"Supplies the IDEFICS3 vision-language model used to count database concepts at detection time.","marker":"[14]"},{"why":"Supplies the Llama language model that samples top-k related concepts from the concept database.","marker":"[7]"},{"why":"Serves as the strongest baseline and as the post-hoc encoder combined in IConMark+SS.","marker":"[23]"},{"why":"Serves as a baseline and as the post-hoc encoder combined in IConMark+TM.","marker":"[4]"},{"why":"Motivates the robustness target by showing that diffusion purification and related attacks can remove low-perturbation watermarks.","marker":"[18]"},{"why":"Provides the WAVES benchmarking perspective and the regeneration-augmentation setting used in the evaluation.","marker":"[2]"},{"why":"Provides the MS-COCO captions used to generate and evaluate watermarked and non-watermarked images.","marker":"[15]"}],"fun_headline_variants":["Concept-based watermark beats noise-based ones on AI images","Human-readable watermark on AI images resists edits better","Semantic watermark embeds concepts, outlasts noise-based rivals","Visible-object AI watermark trumps perturbation methods"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"Everything rests on the concept count actually separating watermarked from unwatermarked images: the generator must reliably paint the sampled concepts, the vision-language model must still recognize them after manipulation, and ordinary images must rarely contain enough database concepts by chance to cross the threshold.","fun_headline_variants_meta":{"raw":{"variants":["Concept-based watermark beats noise-based ones on AI images","Human-readable watermark on AI images resists edits better","Semantic watermark embeds concepts, outlasts noise-based rivals","Visible-object AI watermark trumps perturbation methods"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000494,"raw_usage":{"total_tokens":2481,"prompt_tokens":1054,"completion_tokens":1427,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":670,"completion_tokens_details":{"reasoning_tokens":1363}},"tokens_in":670,"tokens_out":1427,"duration_ms":12605,"temperature":1.0,"reasoning_tokens":1363,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-06T16:38:19.663681+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Remove or repaint all k embedded objects in a set of IConMark images using inpainting or targeted cropping, then rerun the IDEFICS3 detector; if AUROC at 5% false-positive rate falls to the level of the noise-based baselines, the robustness claim fails. Conversely, if ordinary real or non-watermarked AI images from the same generator accumulate enough database concepts to cross the threshold, the false-positive side of the claim fails.","supporting_citations":[],"review_version":1}