{"id":"c87725a5-7029-43ff-8da3-6d10e92708df","arxiv_id":"2607.26723","paper_version":1,"verdict":"ACCEPT","confidence":"HIGH","novelty_score":6.0,"correctness_risk":"low","formal_verification":"none","parameter_count":5,"one_line_summary":"One-step adversarially LoRA-tuned inversion exploits low-curvature reverse trajectories to beat 50-step DDIM on watermark robustness after ~20 minutes of fine-tuning.","lead":"FARI turns multi-step diffusion inversion into a single step by exploiting lower curvature on the reverse path, then adversarially fine-tunes a tiny LoRA so watermark extraction stays accurate under real image distortions. It makes practical authentication of AI images far faster and more robust than the 50-step baselines used today.","discovery_kind":"new_method","skeptic_critique":{"model":"grok-4.5","headline":"No significant objection identified","rationale":"The central claim is comparative and empirical: after ~20 min of adversarial LoRA fine-tuning, one-step FARI beats 50-step DDIM (and listed inversion/acceleration baselines) on watermark verification robustness for GS and TR under common distortions on SD v1.5/v2.1 while cutting NFE from 50 to 1. That claim is directly supported by Table 1, the intensity sweeps in Fig. 4, the training-dynamics plot (Fig. 9) that crosses the DDIM baseline by ~step 300, and public code/weights. The geometric story (lower discrete curvature κ_t = θ_t/s_t on inversion trajectories, §3.1) is offered as motivation, not as a formal proof; the paper already tests the practical consequence (one-step viability under distortion) rather than leaving it assumed. The reader's identified weakest assumption is therefore real but already stress-tested inside the manuscript's regime, so it does not justify moving the verdict. Minor gaps (missing error bars, incomplete baseline coverage on every model version, ODE-only scope) are noted by the reader and do not refute the watermark claim as stated. Verdict remains ACCEPT; no adjustment warranted.","tokens_in":34166,"tokens_out":623,"duration_ms":12481,"concrete_test":"Re-run the SD v2.1 Gaussian-Shading and Tree-Ring columns of Table 1 on a held-out prompt set (e.g., DiffusionDB) with the released LoRA weights, reporting mean±std over 3 random seeds for the Adv./JPEG/R.Crop rows; if FARI's mean bit-acc/TPR falls below the corresponding 50-step DDIM numbers, the dominance claim weakens.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The reader's weakest assumption (that lower inversion curvature remains stable enough under external distortions for one-step + LoRA to keep external error dominant) is the natural soft spot, but the paper already supplies direct empirical checks that keep it from being load-bearing against the stated claim. Fig. 1 (right) shows inversion MSE grows far more slowly than generation MSE as NFE drops; Fig. 3 shows FARI's one-step trajectory error under JPEG is lower than 50-step DDIM's; Table 1 and Fig. 4 show consistent gains on both GS bit-acc and TR TPR@1e-3 across distortions and intensities; Fig. 5 (left) shows partial transfer to unseen distortions; and the multi-NFE ablation (Fig. 5 right) finds that forcing NFE>1 during end-to-end training does not help. Limitations (ODE-only; poor clean PSNR) are acknowledged and orthogonal to the watermark-extraction claim. No internal inconsistency or untested premise that would overturn Table 1 was found.","agreement_with_reader":"agree"},"referee_report":{"model":"grok-4.5","summary":"The paper addresses the practical bottleneck of slow, error-prone inversion in inversion-based watermarking for diffusion models. It observes that (i) DDIM inversion trajectories have substantially lower curvature than generation trajectories and are therefore more compressible to low NFE, and (ii) external channel distortions dominate internal truncation error for watermark verification, so high-NFE optimization of internal error is misaligned. Building on this, FARI collapses inversion to a single step via LoRA fine-tuning of the denoiser, trained end-to-end with an MSE objective to the ground-truth initial noise under a suite of random distortions. LoRA is activated only at extraction, preserving generation quality. Empirically, after ~20 minutes of training on one A6000, one-step FARI outperforms 50-step DDIM (and several specialized inversion and acceleration baselines) on Gaussian Shading bit accuracy and Tree-Ring TPR@FPR=1e-3 across nine distortions on SD v1.5 and v2.1, with additional generalization and ablation studies.","tokens_in":34416,"tokens_out":1172,"duration_ms":34595,"significance":"If the empirical claims hold, FARI removes a major deployment obstacle for inversion-based watermarks by simultaneously cutting NFE from 50 to 1 and improving robustness under realistic distortions, at negligible fine-tuning cost and without degrading the base generator. The geometric asymmetry observation (lower inversion curvature) and the dual-benefit argument (speed enabling end-to-end adversarial training) are useful conceptual contributions beyond the specific method. Strengths include public code and pretrained models, head-to-head evaluation on two watermark schemes with their native metrics, multiple strong baselines (EDICT, BELM, ExactDPM, adversarially-tuned AMED, LCM-LoRA, DMD2), and ablations on LoRA rank, training NFE, unseen distortions, guidance scales, and samplers. Limitations (ODE-only; poor clean reconstruction PSNR; unsuitable for editing) are stated and orthogonal to the watermark-extraction claim.","major_comments":[{"comment":"§3.1 and Fig. 1 (middle): the curvature comparison that motivates one-step compressibility is measured on clean, unconditional trajectories. While Fig. 1 (right), Fig. 3, Table 1, and Fig. 5 (left) provide strong downstream empirical support that external error remains dominant after consolidation, the manuscript would be tighter if it also reported discrete curvature (or an analogous local linearity measure) on trajectories starting from distorted latents, to directly confirm that the geometric premise survives the channel noise the method is designed to handle.","section":"§3.1, Figure 1"},{"comment":"§3.2, Eqs. (9)–(10): setting the one-step inversion timestep to t=0 (rather than t=T) is presented as an empirical fix for the violated piecewise-linear assumption. The appendix ablation (Table 10) shows t≈0 is best, but the main text should briefly state the range of t that works and whether this choice interacts with the noise schedule or VAE latent scale, so that the one-step map is reproducible without consulting the appendix.","section":"§3.2, Equations (9)–(10)"}],"minor_comments":[{"comment":"Figure 1 (left) PCA visualization of inversion residual is helpful but the caption should note the number of components retained and whether the same projection is used for generation vs. inversion for fair visual comparison.","section":"Figure 1"},{"comment":"Table 1: the Adv. column is not defined in the main caption; clarify whether it is a fixed composite attack or the average over the training distortion set.","section":"Table 1"},{"comment":"§4.1: state explicitly that training is watermark-agnostic (MSE to z_T) so that the same LoRA applies to both Tree-Ring and Gaussian Shading; this is clear from the method but easy to miss.","section":"§4.1"},{"comment":"Appendix E.1 inference-time note on LoRA overhead and merge strategy is important for practitioners; a one-sentence pointer in the main efficiency discussion would help.","section":"§4 / Appendix E.1"},{"comment":"Typos / formatting: title line breaks (“ROBUSTONE-STEP”, “WATER-MARKING”); “T olerance” in Fig. 1; occasional missing spaces before citations. Minor polish only.","section":"Throughout"},{"comment":"§5 Limitations correctly flags SDE failure and editing unsuitability; consider one sentence on whether multi-step FARI (NFE=2–4) could recover intermediate features for editing without losing the robustness gains (Fig. 5 right already suggests NFE>1 does not help watermark metrics).","section":"§5"}],"recommendation":"accept","confidential_remarks":"The central empirical claim is well supported and the paper is already at accept quality for a methods/security venue. The two major comments are clarifications that strengthen the geometric motivation and reproducibility; they do not threaten the Table 1 result. Fit for cs.CR / ICLR-style ML+security is good. No novelty or citation concerns noted."},"author_rebuttal":null,"desk_editor":{"model":"grok-4.5","letter":"The useful takeaway is simple: for inversion-based watermark extraction, you do not need a high-NFE inverter. FARI collapses DDIM inversion to one step via LoRA, trains end-to-end against distortions, and in ~20 minutes on one A6000 beats 50-step DDIM on Gaussian Shading bit accuracy and Tree-Ring TPR@1e-3 across the usual channel attacks, on both SD 1.5 and 2.1.\n\nWhat is actually new is the geometric observation plus the recipe that follows from it. They measure discrete curvature on generation vs inversion trajectories and show inversion is much flatter, so NFE tolerance is higher (Fig. 1). That justifies one-step distillation aimed at ground-truth initial noise rather than at a multi-step teacher, then adversarial LoRA only on the inverter path so generation quality is untouched. Prior inversion work (EDICT, BELM, ExactDPM) optimizes clean reconstruction/editing; generation distillations (LCM-LoRA, DMD2) do not transfer cleanly to reverse-from-image. The paper shows those baselines underperform on the watermark metrics, which is the right comparison.\n\nExperiments are the strong part. Table 1 is head-to-head on two watermarks, nine distortions, multiple baselines; they add guidance-scale sweeps, intensity curves, unseen-noise transfer, sampler/NFE generalization, and ablations on rank, t, multi-step training, and training strategy. Code and weights are promised. Clean-reconstruction PSNR is weak and they say so; ODE-only is a real limit but orthogonal to the claim.\n\nSoft spots are minor and already mostly checked. The curvature story is empirical, not a theorem, and the premise that external error still dominates after consolidation is supported by Fig. 3 and the multi-NFE ablation rather than assumed away. Missing error bars and incomplete baseline coverage on every model version are ordinary single-lab issues, not load-bearing flaws. Self-citation is normal for the watermark schemes they build on.\n\nThis is for people who ship or attack diffusion watermarks, or who care about fast inversion under channel noise. Not an editing paper. I would send it to referees; the central comparative claim is instrumented well enough to deserve that time. Worth a reading-group slot if the group does generative security or provenance.","headline":"Solid systems paper: one-step adversarially LoRA-tuned inversion beats 50-step DDIM on watermark robustness with ~20 min fine-tune; curvature observation is the real hook.","tokens_in":35065,"tokens_out":597,"would_cite":true,"duration_ms":19193,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"grok-4.5","headline":"One-step inversion with brief adversarial LoRA training beats 50-step DDIM on watermark robustness for diffusion images.","keywords":["diffusion models","watermarking","inversion","DDIM","LoRA","adversarial training","one-step inversion","robustness"],"falsifier":"Measure bit accuracy (Gaussian Shading) and TPR at FPR 1e-3 (Tree-Ring) for one-step FARI versus 50-step DDIM on held-out distortion types or higher intensities after the same training budget; if FARI falls below the baseline, the robustness claim fails.","tokens_in":34982,"feed_emoji":"🔏","tokens_out":836,"duration_ms":31397,"temperature":0.7,"pith_summary":"Inversion-based watermarks can authenticate diffusion images, but extracting them requires running the model backward, which is slow and brittle under real-world distortions like JPEG or blur. This paper argues that the backward path has much lower curvature than the forward generation path, so it can be collapsed into a single step without losing the signal that matters for watermark checks. That speed-up then makes end-to-end adversarial fine-tuning cheap enough to run in minutes on one GPU. The resulting method, FARI, recovers Tree-Ring and Gaussian Shading marks more reliably under common distortions than a 50-step DDIM baseline while cutting the number of model calls from 50 to 1. A reader who cares about practical provenance for AI images gets both the speed and the robustness that high-step inverters never delivered together.","feed_headline":"One-step inverter beats 50-step DDIM on watermark checks","feed_subtitle":"Twenty minutes of LoRA fine-tuning makes diffusion watermark extraction faster and tougher under distortion.","key_machinery":"FARI: a single-step inversion that reconstructs initial noise from a (possibly distorted) latent by evaluating a LoRA-adapted denoiser at t≈0, trained with an MSE loss against ground-truth noise under random distortions; the LoRA is enabled only at extraction so generation quality is unchanged.","core_discovery":"The DDIM inversion trajectory has markedly lower curvature than the forward generation path, making it compressible to one step; because external channel distortions already dominate internal truncation error in the watermark setting, that one-step map can be adversarially LoRA-fine-tuned end-to-end and still outperform 50-step DDIM on verification robustness after roughly twenty minutes of training.","pith_inferences":["The same low-curvature observation may let other verification tasks such as tamper localization drop to few-step inversion.","Once inversion is one step, white-box adaptive attacks on inversion watermarks become routinely affordable, shifting the arms race.","Generation-oriented distillation methods systematically underperform on inversion because the input distribution is reversed (structured image versus pure noise).","Dependence on ODE samplers leaves open whether similar compressibility holds for SDE or flow-matching trajectories."],"forward_implications":["Watermark verification for diffusion images can run in one denoiser call instead of dozens.","End-to-end adversarial training of inverters becomes practical on a single GPU in minutes.","LoRA can carry inversion robustness without altering the base model’s generation quality.","High-NFE inversion methods built for editing are the wrong default for watermark extraction under channel noise.","Cheaper inversion graphs also make gradient-based watermark removal attacks easier to study."],"fun_headline_variants":["One-step FARI inversion beats 50-step DDIM on watermark robustness","Low-curvature path lets one-step inverter top 50-NFE watermark checks","20-minute LoRA makes one-step inversion tougher than 50-step DDIM","FARI: asymmetric one-step inversion outperforms DDIM under distortion","One-step watermark inverter surpasses 50-step DDIM after brief fine-tune"],"cache_read_input_tokens":16512,"weakest_assumption_plain":"That the lower curvature of inversion paths remains usable under real distortions, so one linear step plus light fine-tuning can absorb leftover error without erasing the watermark.","fun_headline_variants_meta":{"raw":{"variants":["One-step FARI inversion beats 50-step DDIM on watermark robustness","Low-curvature path lets one-step inverter top 50-NFE watermark checks","20-minute LoRA makes one-step inversion tougher than 50-step DDIM","FARI: asymmetric one-step inversion outperforms DDIM under distortion","One-step watermark inverter surpasses 50-step DDIM after brief fine-tune"]},"model":"grok-4.5","effort":"low","cost_usd":0.005438,"raw_usage":{"total_tokens":1528,"prompt_tokens":878,"num_sources_used":0,"completion_tokens":93,"cost_in_usd_ticks":54384000,"prompt_tokens_details":{"text_tokens":878,"audio_tokens":0,"image_tokens":0,"cached_tokens":128},"completion_tokens_details":{"audio_tokens":0,"reasoning_tokens":557,"accepted_prediction_tokens":0,"rejected_prediction_tokens":0}},"tokens_in":878,"tokens_out":93,"duration_ms":8702,"temperature":1.0,"reasoning_tokens":557,"cache_read_input_tokens":128,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-07-30T22:56:36.398109+00:00","model_set":{"reader":"grok-4.5"},"falsifier":"Measure bit accuracy (Gaussian Shading) and TPR at FPR 1e-3 (Tree-Ring) for one-step FARI versus 50-step DDIM on held-out distortion types or higher intensities after the same training budget; if FARI falls below the baseline, the robustness claim fails.","supporting_citations":[],"review_version":1}