{"id":"8e1d0c49-98cc-4146-919d-6796c998ec24","arxiv_id":"2508.17138","paper_version":1,"verdict":"UNVERDICTED","confidence":"LOW","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":2,"one_line_summary":"SyncGuard embeds the same watermark in every time-frequency frame of an audio spectrogram, which lets it survive cropping and time-scale attacks without synchronization codes.","lead":"The submitted record is internally inconsistent: the abstract describes a stochastic control model, while the full text is a deep-learning audio watermarking paper. If the full text is the intended work, it proposes a frame-wise watermark broadcast scheme that resists cropping, time-scale, and jitter attacks.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Load-bearing concern: the TSM/PS rows of Table 3 are validated only against the differentiable proxy of Eqs. (12)-(14); if the test-time attacks are generated with the same proxy, the 97-100% ACC is partly circular and real-world transfer is unestablished.","rationale":"The reader's weakest assumption and my concern coincide: the realism of the differentiable TSM/PS simulation is unvalidated, and I agree with that identification. For the central claim about cropping, the frame-wise broadcast mechanism gives a coherent explanation for 100% accuracy at 20% crop, so I do not see an internal flaw there. For TSM and PS, however, the evidence is only as good as the simulator in Section 3.4.1. The phase-update rule in Eq. (14) scales phase differences by r but ignores that the analysis frame index should be warped to t/r and that real TSM implementations use analysis-synthesis with overlap-add and transients; these differences are exactly where a learned watermark can overfit to simulation artifacts. Because the paper does not identify the test-time TSM/PS implementation, the reader cannot distinguish 'robust to real TSM' from 'robust to the training proxy.' A concrete external-tool evaluation would settle this. I would therefore keep the reader's caution but, for the full text considered on its own, mark CONDITIONAL pending that evaluation. The metadata mismatch remains a separate reason the record as submitted is not reviewable as a single coherent paper.","tokens_in":10100,"tokens_out":5727,"duration_ms":63160,"concrete_test":"Evaluate SyncGuard's trained model against external, non-differentiable desynchronization tools only: SoX tempo -m WSOLA at factors 0.8, 0.9, 1.1, and 1.2; SoundTouch soundstretch at the same factors; and librosa time_stretch/phase_vocoder; for pitch scaling use sox pitch -s by approximately -1 and +1 semitone, then compare ACC against Table 3. If the same code was used for training and testing, this is a true held-out test. Also compute the average magnitude-spectrogram distance between the differentiable Timewarp(aw, rate) output and the external TSM output on the same 100 LibriSpeech clips. If ACC drops by more than 5 percentage points on external tools, or if the proxy-to-external spectral distance is large, the reported TSM robustness is an artifact of the training proxy.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"The central claim for desynchronization robustness rests on the distortion layer in Section 3.4. TSM is simulated by linearly interpolating the STFT magnitude spectrogram and updating phase with p'_f(t)=p_f(t)+unwrap(p_f(t+1)-p_f(t))*r (Eqs. 12-14). This is a simplified phase-vocoder-style rule, not the WSOLA/PSOLA/phase-vocoder implementations used by real audio tools, and it does not model window overlap-add artifacts, transient smearing, or resampling filter effects. The experimental section does not state whether test-time TSM/PS attacks were generated with the same differentiable routine or with an external tool; if they were generated with the same routine, the reported 97-100% accuracy is partly circular; if with an external tool, the claimed transferability is asserted but not evidenced. The cropping results are less vulnerable because frame-wise broadcast plus temporal averaging provides a clear mechanism, but the TSM/PS rows are the load-bearing part of 'desynchronization robustness' and are exactly where the simulation-to-reality gap is unmeasured. No code, error bars, or independent implementation is provided, so this is an external-validity gap rather than an internal inconsistency.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The submission advertised as arXiv:2508.17138 (math.OC) presents an abstract on optimal feedback control in a McKean-Vlasov-Friedkin-Johnsen social-network model, but the full text is a completely different paper, 'SyncGuard: Robust Audio Watermarking Capable of Countering Desynchronization Attacks.' The SyncGuard body proposes a deep-learning audio watermarking system: a frame-wise broadcast embedding strategy, a differentiable distortion layer that simulates time-scale modification and pitch scaling, dilated residual and gated blocks, and a staged training objective combining imperceptibility, extraction accuracy, and adversarial losses. Experiments on LibriSpeech report high bit accuracy against cropping, jittering, TSM, PS, and common signal-processing attacks, with a temporal-averaging extraction mechanism intended to eliminate synchronization-code localization. The submitted text therefore contains two unrelated papers, and the content promised by the abstract is absent from the body.","tokens_in":10332,"tokens_out":7668,"duration_ms":75501,"significance":"If the SyncGuard results were independently validated, the frame-wise broadcast idea is a plausible and clearly described mechanism for cropping robustness, and the ablation of TSM/PS distortion components is informative. The paper does provide explicit equations for the embedding, extraction, and distortion layers, which supports reproducibility in principle. However, the desynchronization claim rests on training and evaluation with the same differentiable proxy, so the practical significance is unestablished. More fundamentally, the manuscript's abstract and full text are different papers; as submitted, there is no way for a reader to verify the advertised control-theoretic contribution. The mismatch, rather than disagreement with consensus, is what blocks acceptance.","major_comments":[{"comment":"The manuscript is internally inconsistent: the abstract and the declared title describe an optimal control problem for a McKean-Vlasov-Friedkin-Johnsen opinion dynamics model with Feynman-type path-integral methods, but the full text contains none of these elements. Instead, the body is an audio watermarking paper ('SyncGuard') with its own abstract, methods, and experiments, and no equation or result in the full text addresses social networks, stochastic differential equations, or feedback control. This is not a minor editorial issue: the claimed contribution of the paper as titled is entirely absent, so the manuscript cannot be evaluated against its own stated central claim.","section":"Abstract / Full Text"},{"comment":"The load-bearing robustness claim for desynchronization attacks is not externally validated. The TSM/PS distortion layer used in training is a simplified differentiable phase-vocoder-style proxy: linear interpolation of the magnitude spectrogram in Eq. (12) and a phase update based on the unwrapped adjacent-frame phase difference times the stretch factor in Eqs. (13)-(14). The experimental section never states whether the test-time TSM and PS attacks in Table 3 are generated with this same routine or with an independent implementation such as WSOLA/PSOLA or a standard audio tool. If they are generated with the same routine, the reported 97.72-100.0% ACC for TSM and 99.83-99.92% for PS is to a substantial degree circular, measuring robustness to the training proxy rather than to real-world attacks; if an external tool was used, its identity and parameters should have been reported. Since desynchronization robustness is the paper's headline claim, this gap is load-bearing.","section":"Section 3.4, Eqs. (12)-(15), Table 3"},{"comment":"The comparative evaluation is not capacity-controlled and lacks uncertainty quantification. DeAR is run with 100 embedded bits, DRAW at 32.73 bps, and the remaining methods at 32 bps (Section 4.1.4), yet Table 1 is described as comparing 'under similar bps' and Tables 2-3 pool all methods without adjusting for the capacity difference. Moreover, all accuracy tables report point estimates without error bars or statistical tests, and many SyncGuard cells are at the 100.0 ceiling, so the claimed consistent superiority over the state of the art is not established even for the reported test set. This directly affects the paper's central comparative claim.","section":"Section 4.1.4, Tables 1-3"}],"minor_comments":[{"comment":"The text states 'As shown in Table 6' for the desynchronization results, but Table 6 is the distortion-layer ablation; the desynchronization results are in Table 3. Please correct the cross-reference.","section":"Section 4.2.3, Table 3"},{"comment":"The same quantity is called 'rate' in Eq. (12) and 'r' in Eq. (14); unify the notation to avoid confusion.","section":"Section 3.4.1, Eqs. (12) and (14)"},{"comment":"The symbol N is used for the watermark sequence length in Eq. (9) and for the audio length in Eq. (10); distinct symbols would make the two loss terms unambiguous.","section":"Sections 3.2 and 3.3, Eqs. (9) and (10)"},{"comment":"The text says the DR/DG ablation results are 'as shown in Fig. 9', but Figure 9 displays loss curves; the numerical accuracy values quoted in the text (e.g., 38.60%) should be presented in a table or figure for direct verification.","section":"Section 4.3.2, Figure 9"},{"comment":"The evaluation is carried out on LibriSpeech speech only, while the motivating applications include general audio on social platforms; the scope of the imperceptibility and robustness claims should be stated more carefully.","section":"Section 4.1.1"}],"recommendation":"reject","confidential_remarks":"The file appears to combine two unrelated manuscripts: the arXiv metadata, title, and abstract are for a math.OC paper on social-network control, while the body is a cs.CR audio watermarking paper. Please verify with the authors which paper was intended for submission; as it stands, the manuscript is not internally coherent and cannot be reviewed as a single contribution."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Two things you should know. First, the submission is incoherent as a record: the abstract and metadata describe a McKean-Vlasov-Friedkin-Johnsen optimal control paper, while the full text is an entirely different audio-watermarking paper (SyncGuard) by Gan et al. There is no overlap. Do not review this as one paper. Second, the SyncGuard work has a real idea—frame-wise broadcast embedding with temporal averaging—and the results are plausible, but the desynchronization claim has an external-validity gap.\n\nWhat's good: the frame-wise broadcast strategy is a clean architectural twist. It embeds the same watermark in every STFT frame, so the decoder can average over time, which gives a natural mechanism for cropping robustness. The differentiable TSM/pitch-scaling proxy (Eqs. 12–17) is a useful training device. The ablation study (Table 6) is the most credible part: removing TSM or PS from the distortion layer degrades accuracy, and the mutual reinforcement story is sensible. The imperceptibility numbers are competitive.\n\nSoft spots, in proportion. The load-bearing issue is that the TSM/PS rows of Table 3 are very likely generated with the same differentiable interpolation routine used in training. The stress-test note is right: Section 3.4.1 defines a simplified phase-vocoder-style rule that does not model overlap-add artifacts or resampling filter effects, and the paper never states whether test-time attacks used an external tool. If the same routine generated both training and test distortions, the 97–100% accuracy is partly circular and says little about real WSOLA/PSOLA attacks. Cropping robustness does not have this problem—temporal averaging explains it, and Figure 6 is a nice result. Also: no error bars, many cells at 100% ceiling, DeAR runs at 100 bits vs 32 bps for others (unfair), and Section 4.2.3 says 'Table 6' when it means Table 3. No code. These are real but fixable issues.\n\nBottom line: if the SyncGuard text is the actual submission, it deserves a serious referee who will push for external-TSM/PS evaluation and code. As an arXiv record matching the metadata, it should be sent back for clarification. For you personally, the frame-wise broadcast idea is worth keeping in mind, but I wouldn't build on the desync numbers until they are validated against non-differentiable attacks.","headline":"The record is two different papers—the metadata advertises a math.OC control theory paper, the full text is an audio watermarking paper—and the watermarking paper has a genuine idea but its TSM/PS results are validated only against the training proxy.","tokens_in":10847,"tokens_out":2488,"would_cite":false,"duration_ms":23897,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"SyncGuard embeds the full watermark into every audio frame, eliminating localization and recovering messages perfectly under heavy cropping and time-stretch attacks.","keywords":["audio watermarking","desynchronization attacks","frame-wise broadcast","time scale modification","pitch scaling","dilated convolution","imperceptibility","deep learning"],"falsifier":"Apply a third-party time-scale modification tool, such as a standard WSOLA or phase-vocoder implementation, at factor 0.9 to SyncGuard-watermarked audio and measure extraction accuracy; if accuracy drops well below the 100% reported for the built-in TSM simulation at the same factor, the simulation-to-reality transfer premise fails.","tokens_in":9863,"feed_emoji":"🎧","tokens_out":5528,"duration_ms":50886,"temperature":0.7,"pith_summary":"SyncGuard claims that an audio watermark can be made robust to desynchronization attacks by broadcasting the full watermark into every frequency-domain frame of the audio, so no localization step is needed. The paper argues that this frame-wise broadcast strategy, together with a differentiable distortion layer that simulates time-stretch and pitch-shift attacks during training, lets a learned encoder and decoder recover the message with near-perfect accuracy on arbitrary-length audio. A sympathetic reader takes away that synchronization codes are not required for robust watermark extraction, and that robustness to severe temporal distortions can be trained end-to-end if the attack simulation is made differentiable.","feed_headline":"Watermark survives 20% cropping at 100% accuracy","feed_subtitle":"Broadcasting the watermark into every frame lets SyncGuard beat desynchronization attacks without sync codes.","key_machinery":"The frame-wise broadcast embedding (Eq. 3) is the central object: the watermark bits are expanded by a linear layer into a vector the size of one spectrogram frame and then repeated along the time dimension to match the full spectrogram. This mechanism converts temporal distortions into a many-redundant-copies problem, because any surviving frame still contains the full message. Around it sits the differentiable distortion layer (Eqs. 12 to 17), which simulates time-scale modification by interpolating the linear spectrogram and adjusting phases, and pitch scaling by combining TSM with resampling, so the network can be trained end-to-end against desynchronization; the dilated residual and dilated gated blocks in the encoder and decoder provide the multi-resolution receptive field that helps decode the broadcast message after warping.","core_discovery":"The paper's central claim is that the localization problem in audio watermarking can be eliminated entirely by embedding the full watermark repeatedly at the level of each short-time Fourier transform frame, rather than over a fixed-length segment or with an auxiliary synchronization code. Extraction then averages the decoded message across time, so cropping, jitter, and time-scale modification cannot remove all copies of the message. The paper reports bit accuracies of 100% under 10% and 20% cropping, 97 to 100% under time-scale factors from 0.8 to 1.2, and robustness on unseen attack parameters, while maintaining an SNR of 28.27 dB and a PESQ of 4.02.","pith_inferences":["Extension: because extraction averages over frames, the effective robustness floor is set by the fraction of frames that survive an attack; a targeted attack that destroys a specific time-frequency region but spares the rest would still leak the watermark, shifting the attack surface toward wideband destruction.","Extension: the same broadcast-then-average principle could transfer to other sequential modalities such as video frames, text spans, or sensor streams where synchronization between embedder and decoder is the main failure mode.","Extension: a stronger test of the transfer claim would evaluate against third-party TSM and PS implementations not used in training; the current evaluation reuses the same simulated distortion families, so it cannot by itself validate simulation realism."],"forward_implications":["Watermarking no longer needs an explicit localization or synchronization stage: any audio segment of arbitrary length can be decoded by the same model, as long as it contains at least one usable frame.","Robustness to desynchronization attacks can be achieved by training against differentiable approximations of TSM and PS; the ablation shows PS training alone partially covers TSM, while adding TSM improves accuracy under both PS and TSM attacks.","The method outperforms the compared fixed-length and synchronization-code baselines on robustness and imperceptibility under similar embedding rates, suggesting that broadcast embedding is a stronger design than joint sync-code embedding.","The system is efficient enough for near-real-time use, with an encoder inference time of 3.34 ms per second of audio, so the robustness gains do not require an impractical decoder."],"supporting_citations":[{"why":"DeAR is the deep-learning baseline that requires fixed-length input and fails under desynchronization, motivating the frame-wise broadcast design.","marker":"[11]"},{"why":"DRAW is the dual-decoder sync-code baseline that SyncGuard must beat; it fails when synchronization codes are attacked.","marker":"[7]"},{"why":"Robust-DNN is the earlier end-to-end STFT-based method that ignores desynchronization attacks, establishing the gap for temporal robustness.","marker":"[19]"},{"why":"FDLM is a traditional method using synchronization codes and fixed-length segmentation, which breaks when audio length changes.","marker":"[14]"},{"why":"FSVC is a traditional desynchronization-resilient baseline that does not require training, providing a strong hand-crafted comparison point.","marker":"[24]"},{"why":"This work inspires the differentiable simulation of desynchronization attacks as stretching or compressing the audio signal.","marker":"[2]"},{"why":"WaveNet's dilated causal convolution design inspires the DR and DG blocks used in the encoder and decoder.","marker":"[16]"},{"why":"Dilated residual networks provide the DR block structure for capturing multi-resolution time-frequency features.","marker":"[23]"},{"why":"CSRNet provides the dilated gated block structure, which the ablation shows is important for stable convergence.","marker":"[9]"}],"fun_headline_variants":["Closed-form optimal feedback for social networks with memory","Feynman path integral yields explicit control in opinion dynamics","Solving McKean-Vlasov social control with stubborn agents","Optimal influence strategies for opinion evolution under noise","Explicit feedback laws for Friedkin-Johnsen with memory"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The central claim rests on the assumption that the differentiable time-stretch and pitch-shift simulations used in training (Eqs. 12 to 17) reproduce real desynchronization attacks closely enough that robustness trained on them transfers to actual TSM, PS, jittering, and cropping.","fun_headline_variants_meta":{"raw":{"variants":["Closed-form optimal feedback for social networks with memory","Feynman path integral yields explicit control in opinion dynamics","Solving McKean-Vlasov social control with stubborn agents","Optimal influence strategies for opinion evolution under noise","Explicit feedback laws for Friedkin-Johnsen with memory"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000239,"raw_usage":{"total_tokens":1477,"prompt_tokens":873,"completion_tokens":604,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":489,"completion_tokens_details":{"reasoning_tokens":525}},"tokens_in":489,"tokens_out":604,"duration_ms":6688,"temperature":1.0,"reasoning_tokens":525,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T17:06:25.358799+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Apply a third-party time-scale modification tool, such as a standard WSOLA or phase-vocoder implementation, at factor 0.9 to SyncGuard-watermarked audio and measure extraction accuracy; if accuracy drops well below the 100% reported for the built-in TSM simulation at the same factor, the simulation-to-reality transfer premise fails.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"DeAR is the deep-learning baseline that requires fixed-length input and fails under desynchronization, motivating the frame-wise broadcast design."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"DRAW is the dual-decoder sync-code baseline that SyncGuard must beat; it fails when synchronization codes are attacked."},{"cited_title":"Pavlovi ´c, S","cited_arxiv_id":null,"evidence_quote":"Robust-DNN is the earlier end-to-end STFT-based method that ignores desynchronization attacks, establishing the gap for temporal robustness."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"FDLM is a traditional method using synchronization codes and fixed-length segmentation, which breaks when audio length changes."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"FSVC is a traditional desynchronization-resilient baseline that does not require training, providing a strong hand-crafted comparison point."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"This work inspires the differentiable simulation of desynchronization attacks as stretching or compressing the audio signal."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Dilated residual networks provide the DR block structure for capturing multi-resolution time-frequency features."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"CSRNet provides the dilated gated block structure, which the ablation shows is important for stable convergence."}],"review_version":1}