{"id":"a1baf69c-e7f5-4b7d-bd84-ce25693dc566","arxiv_id":"2507.21195","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"MaXsive embeds a continuous Gaussian watermark into the initial latent noise of a diffusion model and injects an independent X-shaped Fourier template so rotated, scaled, and translated images can be corrected before watermark extraction.","lead":"This paper introduces MaXsive, a training-free watermarking method for diffusion models that hides a shuffled Gaussian watermark in the initial noise and uses an X-shaped Fourier template to undo rotation, scaling, and translation attacks. It reports stronger average robustness than prior training-free methods on Stirmark and WAVES while claiming a much larger watermark capacity.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The 8,384-bit capacity headline rests on treating the differential entropy of a Gaussian watermark as its bit capacity; without a noise/quantization channel model this overstates what can be reliably recovered.","rationale":"The reader's weakest_assumption identifies the RST scaling formula domain restriction in Section 4.3.2 and Appendix A. That is a legitimate concern, but the reported benchmarks use rotations mostly in the 0-90 degree range where sin(theta)+cos(theta) is positive, so the formula's invalid range is not exercised by the headline numbers. The capacity error is more directly load-bearing because the title, abstract, Table 1, and the strongest claim all advertise 8384 bits as a primary quantitative advantage. Eq. (14) computes differential entropy, not watermark capacity: it ignores the attack channel, the false-positive constraint, and the fact that no 8384-bit bitstream is ever decoded. The paper's identification experiment with 4096 users is strong practical evidence that the scheme has large identification capacity, so this does not warrant rejection; it requires replacing or substantially qualifying the capacity analysis and likely rephrasing the '8384 bits' claim as key entropy rather than embedded payload. The RST formula issue also deserves a stated domain restriction or a modulo correction, but it is secondary to the capacity flaw. Because these are fixable but material issues, the reader's CONDITIONAL verdict remains appropriate.","tokens_in":17988,"tokens_out":5536,"duration_ms":64730,"concrete_test":"Measure the actual per-symbol channel from embedding to extraction: generate watermarked images with MaXsive, apply the same WAVES/Stirmark attacks as in Tables 2-4, invert to z'_T, deshuffle/aggregate, and estimate the empirical SNR of w' versus w for each attack. The Gaussian channel capacity per element is 0.5 log2(1+SNR); multiplying by 4096 gives an upper bound on reliably recoverable bits under that attack. If, for example, JPEG q=10 yields SNR near 0 dB (capacity about 2048 bits) or rotation 45 degrees yields SNR near 3 dB (about 3743 bits), then the headline 8,384 bits is unattainable under exactly the robustness conditions the paper claims.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central 'high-capacity' claim is built on Eq. (14), which multiplies the number of watermark elements L=4096 by H_g=2.0471 bits, the differential entropy of a standard Gaussian. Differential entropy is not a channel capacity: a continuous random variable has infinite Shannon entropy and can carry arbitrarily many bits if recovered with infinite precision. What matters for watermarking is the number of bits that can be reliably recovered from an attacked image at a fixed false-positive/error rate, i.e., the capacity of the channel from embedded watermark to extracted watermark. Under DDIM inversion plus JPEG, rotation, rescaling, and other attacks, each recovered element carries far less than 2.0471 bits; for an additive Gaussian channel the per-symbol capacity is 0.5 log2(1+SNR), and the actual per-coordinate SNR after attacks can be estimated from the experiments. Moreover, MaXsive does not decode 8,384 bits from the image at all: detection is a Pearson correlation between the full extracted vector and candidate watermarks. At best, the 4096 real-valued samples support a large identification space; the '8384 bits' number is not an embedded bitstream and should not be compared directly with the 256-bit or 11-bit payloads of Bernoulli schemes. Since the title, abstract, and introduction all advertise high capacity as a primary contribution, this unsupported number is a load-bearing gap.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"MaXsive proposes a training-free watermarking method for diffusion models. It embeds a Gaussian watermark into the initial noise of a DDIM generation process via shuffling and duplication, and separately injects an X-shaped template in the Fourier domain to estimate and correct rotation/scaling distortions during detection. The watermark is detected by DDIM inversion, template-based geometric correction, deshuffling, aggregation, and Pearson correlation. The paper claims a watermark capacity of 8,384 bits based on multiplying the number of Gaussian elements by the differential entropy of a standard Gaussian, and reports verification and identification results on the WAVES and Stirmark benchmarks, claiming superiority over Tree-Rings, RingID, and Gaussian Shading.","tokens_in":18251,"tokens_out":5011,"duration_ms":53170,"significance":"The template design is a genuinely interesting idea: decoupling the geometric-correction template from the watermark pattern is more elegant than the repetitive-ring approaches of Tree-Rings and RingID, and the Stirmark RST result (0.70 verification TPR versus 0.34 for RingID, Table 3) is a real experimental improvement. The exhaustive per-distortion tables (Tables 6-8) are valuable for the community. The main weakness is that the headline capacity number (8,384 bits) is not an information-theoretic capacity in any operational sense: it is the product of an arbitrarily chosen vector length and the differential entropy of a Gaussian, which is not the number of reliably recoverable bits under attack. The rotation-scaling formula also lacks a valid derivation for the full 0-360 degree detection range used in Eq. (10). If these two issues are fixed, the paper's contribution would be solid, but as written the central 'high-capacity' claim is overstated.","major_comments":[{"comment":"The capacity measure in Eq. (14) equates differential entropy with watermark capacity. Differential entropy is not the number of bits that can be reliably recovered from an attacked image; a continuous random variable sampled from a standard Gaussian has infinite Shannon entropy if measured with unbounded precision, and the right quantity is the capacity of the channel from the embedded watermark to the extracted watermark under the specific attacks considered. The paper never defines a decoding model for the 8,384 bits; detection is performed by Pearson correlation between the entire extracted vector and candidate watermarks, so the 8,384-bit number does not correspond to an embedded bitstream. Since the title, abstract, and introduction advertise high capacity as the primary contribution, this needs to be reworked: either remove the 8,384-bit claim and report the size of the identification space supported by the correlation detector at the target FPR, or estimate the per-coordinate SNR after attacks and compute the resulting channel capacity. As it stands, the comparison in Table 1 between Bernoulli and Gaussian methods is not a valid capacity comparison.","section":"Sec. 4.4, Eq. (14)"},{"comment":"The scaling parameter gamma = 1/(sin(theta)+cos(theta)) is derived in Appendix A only for a square image rotated by theta in [0, 90] degrees before central cropping, where sin(theta)+cos(theta) is positive. In Sec. 4.3.2 this same formula is applied to any detected angle, and Eq. (10) searches over [0, 360) degrees. For angles outside the first quadrant, sin(theta)+cos(theta) can be zero or negative, making gamma invalid. The authors should either restrict the applicability statement to the angle range covered by the derivation, or replace the formula with gamma = 1/(|sin(theta)|+|cos(theta)|) and verify that the template detection still works with the corrected expression. This is load-bearing for the claimed RST robustness beyond the narrow benchmark angles.","section":"Sec. 4.3.2 and Appendix A"},{"comment":"The abstract states that MaXsive 'surpasses all existing algorithms on the robustness benchmarks, Stirmark 3.1 and WAVES, in both verification and identification settings,' but Table 7 shows that on individual WAVES distortions MaXsive is not the best: on C&R (crop-and-resize) verification it achieves 0.20 vs. 0.47 for Gaussian Shading, and on blurring it achieves 0.85 vs. 0.92 for Gaussian Shading. The aggregate results in Table 2 are indeed strong, but the unqualified 'surpasses all existing algorithms' claim is contradicted by the paper's own per-distortion data. Please qualify the claim to refer to average performance or to specific distortion categories, and explicitly acknowledge the C&R gap, which is also consistent with the limitation stated in Sec. 7.","section":"Abstract and Tables 7-8"}],"minor_comments":[{"comment":"There is a typo: 'desgined' should be 'designed'.","section":"Sec. 6.2"},{"comment":"The notation M eta[std(|F(z_t^0)|)] is unclear; M is a binary mask and eta is a scalar, so the intended product is M * eta * std(|F(z_t^0)|). Please clarify the operator precedence.","section":"Eq. (8)"},{"comment":"The reported FPR is 1e-34, which is extremely stringent and not typical for watermark evaluation. Please clarify how this threshold is derived for each method (e.g., from the theoretical distribution of the Pearson correlation under the null hypothesis) and whether the same threshold is used for all compared methods.","section":"Sec. 5.1"},{"comment":"The table lists Tree-Rings capacity as 20.471 bits, which is 10*2.0471, but the original Tree-Rings paper does not report capacity in bits; this is the authors' reinterpretation. A footnote or explanation of how the column was computed from the original settings would improve reproducibility.","section":"Table 1"},{"comment":"The template pattern design describes a line composed of 8 points 'located in the range of 0.2w/2 to 0.5w/2 with an interval of 0.1w/2.' A figure or explicit coordinates would help readers understand the exact mask geometry, especially since the template is central to the method.","section":"Sec. 4.2.2"}],"recommendation":"major_revision","confidential_remarks":"The capacity claim is the most visible contribution and will be scrutinized by the community; the current Eq. (14) argument is not defensible as an information-theoretic capacity. The rotation-scaling formula issue is also real but fixable. The paper contains strong experimental results, especially on Stirmark RST, so I see a path to acceptance after a careful revision that reframes the capacity claim and tightens the RST correction analysis. I would also encourage the authors to release code, as the template-based correction is non-trivial to reproduce from the text alone."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The X-shaped template injection is the real contribution here, and it earns the robustness results. Prior training-free methods use repetitive rings that eat capacity; MaXsive decouples the template from the watermark, detects rotation and scaling from the Fourier-domain template, and corrects the initial noise before watermark extraction. On Stirmark RST it jumps from 0.34 (RingID) to 0.70, and on WAVES rotation identification it goes from 0.00 to 1.00. Those numbers are meaningful, and the 4,096-user identification experiment is the right stress test for capacity claims.\n\nThe capacity claim is where the paper overreaches. Eq. (14) multiplies the number of watermark elements by the differential entropy of a Gaussian, getting 8,384 bits. Differential entropy is not channel capacity. A continuous random variable can carry arbitrarily many bits only with infinite-precision recovery; after DDIM inversion plus JPEG or geometric attacks, each element carries far less than 2 bits. The actual capacity is the number of bits reliably recoverable at a fixed error rate, and the paper never measures that. The 8,384-bit number should not be compared with the 256-bit binary payload of Gaussian Shading. This is a load-bearing problem because the title and abstract advertise high capacity as a primary contribution. The identification experiment shows the method supports thousands of users, which is the practically relevant capacity, and that is sufficient — the paper should just say that and drop the pseudo-Shannon framing.\n\nThe gamma scaling formula in Appendix A is derived for rotations between 0 and 90 degrees with central cropping, but the detection routine searches 0 to 360 degrees. For angles where sin(theta)+cos(theta) crosses zero (e.g., 135 degrees), the correction becomes invalid or negative. In the tested Stirmark/WAVES range the formula seems to work, so this is a theoretical gap rather than a demonstrated failure, but it should be stated as a domain restriction.\n\nMinor but annoying: no code, no error bars, and the identification tables report only a single run. The paper is a workshop-quality idea with solid proof-of-concept experiments; the capacity analysis and the angle-range caveat are fixable in a revision.\n\nBottom line: this is worth reading for anyone working on diffusion watermarking. It deserves serious peer review, but the capacity headline needs to be reworked before the paper is acceptable.","headline":"Novel X-shaped template makes training-free diffusion watermarking genuinely robust to rotation, but the 8,384-bit capacity claim is information-theoretic sleight of hand.","tokens_in":18766,"tokens_out":1788,"would_cite":true,"duration_ms":21485,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A training-free watermark for diffusion images can pack 8,384 bits and still survive rotation, scaling, and translation attacks by using an X-shaped correction template.","keywords":["training-free watermarking","diffusion model watermarking","RST attack robustness","X-shape template","watermark capacity","DDIM inversion","image provenance","identification"],"falsifier":"Take a MaXsive-watermarked image, rotate it by 135 degrees, and run the decoder: at 135 degrees the scaling factor is $\\gamma = 1/(\\sin 135^\\circ + \\cos 135^\\circ) = 1/0$, so the correction is undefined, while at angles where the denominator is negative the rescaling would invert the image size. Observing either failure for rotations inside the claimed RST range would falsify the robustness claim as stated.","tokens_in":17744,"feed_emoji":"🖼️","tokens_out":5964,"duration_ms":58402,"temperature":0.7,"pith_summary":"MaXsive aims to settle a trade-off in generative watermarking for diffusion models: prior training-free methods either resist rotation, scaling, and translation with repetitive ring patterns or keep high watermark capacity, but not both. The paper argues that an X-shaped template injected in the Fourier domain during every sampling step can estimate and undo geometric distortion independently of the watermark, leaving capacity intact. With a normalized Gaussian watermark duplicated and shuffled under private keys, MaXsive reports a capacity of 8,384 bits, far above the 11 bits of RingID and 256 bits of Gaussian Shading, and reports stronger robustness than existing methods on Stirmark 3.1 and WAVES in both verification and identification settings. The practical stakes are clear: high capacity makes identity collisions unlikely when tracing thousands of users, and no retraining is needed.","feed_headline":"8,384-bit watermark survives rotation attacks","feed_subtitle":"A training-free diffusion scheme uses an X-shaped template to undo rotation, scaling, and cropping without losing watermark capacity.","key_machinery":"The load-bearing object is an X-shaped binary template: two lines of eight points each crossing at the image center, injected into the Fourier domain of the predicted latent at every timestep via Eq. (8), with magnitude scaled by the standard deviation of the spectrum. At decoding, a greedy search over angles finds the line orientation that maximizes mean Fourier magnitude, and a check on the template's outermost points detects scaling; the detected transform is undone directly on the inverted latent, avoiding a second DDIM inversion. The watermark itself is a normalized Gaussian vector duplicated and shuffled with private keys, and similarity is scored by Pearson correlation. A Shannon-entropy capacity formula, 2.0471 bits per Gaussian element versus 1 bit per Bernoulli bit, is what turns the high-dimensional watermark into a quantitative capacity advantage.","core_discovery":"The paper's central discovery is that RST robustness in training-free diffusion watermarking does not require coupling the watermark to a repetitive pattern. Instead, a separate X-shaped template is injected into the Fourier spectrum of the predicted latent at each DDIM sampling step; at decoding, the template's lines are located by maximizing the mean Fourier magnitude over candidate angles, and the detected angle plus a scaling check drive a correction of the recovered initial noise before watermark extraction. Because the template and the watermark are independent, the watermark can be a high-dimensional vector sampled from the standard normal distribution, duplicated and privately shuffled to form the initial noise. Using Shannon entropy as the capacity measure, the paper computes 8,384 bits for MaXsive's 4,096 normal elements versus 11 bits for RingID and 256 bits for Gaussian Shading, and reports higher verification and identification robustness than existing algorithms on Stirmark 3.1 and WAVES.","pith_inferences":["Editorial extension: the template-decoupled design could be tested on other generative architectures, such as text-to-image transformers or video diffusion models, since the template operates on latent Fourier spectra rather than on a specific sampler.","Editorial extension: the entropy-based capacity yardstick suggests a direct search over watermark distributions with higher differential entropy under a fixed image-quality budget, which could push capacity beyond 8,384 bits.","Editorial extension: the rotation-correction formula is derived only for 0-90 degree rotations, so a full 360-degree robustness audit would clarify whether angles outside that range fail and whether a universal correction rule is needed.","Editorial extension: because the watermark is reconstructed by averaging many shuffled copies, error-correcting codes layered on the Gaussian payload could likely lower the false-positive rate or the required template strength."],"forward_implications":["With 8,384 bits per watermark, a service with thousands of users can assign unique identifiers without the identity collisions that plague 11-bit ring-based watermarks.","RST attacks no longer force a capacity-robustness trade-off, so the same watermark can remain usable after rotation, scaling, and geometric distortions.","Because no training or fine-tuning is needed, the method applies to an already-deployed diffusion model by changing only the initial noise and sampling guidance.","In the reported benchmarks, rotation and rotation-plus-scaling verification reach full success under WAVES rotation and 0.70 on Stirmark RST, while cropping remains a partial weakness the paper explicitly flags."],"supporting_citations":[{"why":"supplies the tree-ring baseline and the initial-noise Fourier watermarking paradigm that MaXsive extends","marker":"[37]"},{"why":"supplies the ring-pattern baseline whose capacity-robustness trade-off MaXsive targets","marker":"[6]"},{"why":"supplies the Gaussian Shading baseline and the 256-bit binary-watermark comparison point","marker":"[40]"},{"why":"defines the latent diffusion model whose initial noise and decoder MaXsive uses for embedding","marker":"[31]"},{"why":"provides the DDIM deterministic sampling and inversion equations used for encoding and decoding","marker":"[33]"},{"why":"introduces template-based affine-resistance watermarking that motivates the X-shaped template","marker":"[27]"},{"why":"provides the WAVES robustness benchmark used for verification and identification evaluation","marker":"[1]"},{"why":"provide the Stirmark 3.1 benchmark for geometric and signal-processing attacks","marker":"[28, 29]"},{"why":"documents quality degradation from altered initial seeds, motivating normalization and shuffling","marker":"[30]"},{"why":"provides the DPM solver used to invert generated images before watermark extraction","marker":"[19]"}],"fun_headline_variants":["X-template watermark hits 8,384 bits, resists rotation","Training-free watermark: 8,384 bits, X-shaped RST defense","High-capacity watermark with X-template beats RST attacks","X-shaped template unlocks 8,384-bit training-free watermark","MaXsive: robust watermark, 8,384 bits, no training needed"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"Appendix A derives the scaling factor $\\gamma = 1/(\\sin\\theta + \\cos\\theta)$ only for rotations in $[0,90^\\circ]$ before central cropping, yet Section 4.3.2 applies it to any detected angle in $[0,360^\\circ]$, where $\\sin\\theta+\\cos\\theta$ can vanish or go negative and produce an invalid correction.","fun_headline_variants_meta":{"raw":{"variants":["X-template watermark hits 8,384 bits, resists rotation","Training-free watermark: 8,384 bits, X-shaped RST defense","High-capacity watermark with X-template beats RST attacks","X-shaped template unlocks 8,384-bit training-free watermark","MaXsive: robust watermark, 8,384 bits, no training needed"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000471,"raw_usage":{"total_tokens":2325,"prompt_tokens":907,"completion_tokens":1418,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":523,"completion_tokens_details":{"reasoning_tokens":1325}},"tokens_in":523,"tokens_out":1418,"duration_ms":11792,"temperature":1.0,"reasoning_tokens":1325,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T17:44:10.164129+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take a MaXsive-watermarked image, rotate it by 135 degrees, and run the decoder: at 135 degrees the scaling factor is $\\gamma = 1/(\\sin 135^\\circ + \\cos 135^\\circ) = 1/0$, so the correction is undefined, while at angles where the denominator is negative the rescaling would invert the image size. Observing either failure for rotations inside the claimed RST range would falsify the robustness claim as stated.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"supplies the tree-ring baseline and the initial-noise Fourier watermarking paradigm that MaXsive extends"},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"supplies the ring-pattern baseline whose capacity-robustness trade-off MaXsive targets"},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"defines the latent diffusion model whose initial noise and decoder MaXsive uses for embedding"},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"introduces template-based affine-resistance watermarking that motivates the X-shaped template"},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"provides the WAVES robustness benchmark used for verification and identification evaluation"},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"provides the DPM solver used to invert generated images before watermark extraction"}],"review_version":2}