REVIEW 4 major objections 7 minor 35 references
A Watermark for Auto-Regressive Image Generation Models
T0 review · 4 major / 7 minor · reviewed 2026-08-07 · deepseek-v4-flash
Pith's one-line read C-REWEIGHT embeds a distortion-free watermark in autoregressive image generation by clustering tokens so retokenization mismatches do not erase the detection signal, and claims a 10% increase in detection accuracy over prior methods.
desk verdict Solid distortion-free watermark extension with a real but unquantified robustness gap: the detector's code depends on the re-encoded prefix, so retokenization of preceding tokens can kill the signal even when current tokens stay in cluster. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The mechanism is cluster-based reweight. Image tokens are clustered once per model with k-means on the decoder embeddings. At each generation step, the watermark code pseudo-randomly selects a target cluster; the sampler picks a token from that cluster with probability proportional to the base model's mass in the cluster, using a rejection step and an overflow distribution to correct the bias. Theorem 4.1 proves the correction makes the overall sampling distribution identical to the base model's, so there is no image-quality loss. At detection, the image is re-encoded and the score $s(\theta, x)$ simply checks whether each token lies in the cluster named by the code; under the null hypothesis the score is binomial with success probability $1/h$.
What would settle it
Measure, on a model like Emu3, the fraction of tokens whose re-encoding $E(D(x))$ falls in a different k-means cluster than $x$, as a function of the cluster count $h$; if that fraction is large, detection accuracy should collapse despite the distortion-free guarantee.
Extended reading notes
Core claim
The central claim is that C-REWEIGHT is a distortion-free watermark for autoregressive image generation that stays detectable after the image is decoded and re-encoded. Formally, Theorem 4.1 states that the cluster-based reweight is distortion-free: for every token $x$, the expectation of the watermarked distribution over watermark codes equals the original model distribution, $E_\theta[P_W(x \mid x_{1:n}, \theta)] = P_M(x \mid x_{1:n})$. Empirically, on Emu3 with $h=100$ and $h=200$ clusters over four image datasets, the method reports TPR@FPR=1% of 0.96-0.99, and the abstract claims a 10% increase in detection accuracy over existing distortion-free methods. The paper's insight is that a retokenization error tends to move a token to another token with similar decoder embedding, so a k-means clustering of decoder embeddings contains both original and re-encoded tokens in the same cluster, preserving the detector's statistical signal.
Load-bearing premise
The watermark stays detectable only if a re-encoded token usually lands in the same cluster as the original token; the paper gives no measurement of how often retokenization crosses a cluster boundary.
Editorial extensions
If this is right
- Watermarking can be added to existing autoregressive image models without retraining, since clustering is done once on decoder embeddings and the reweight runs at sampling time.
- Detectability holds after the image is saved and re-encoded, the exact setting that defeated direct adaptation of language-model watermarks.
- Robustness to noise attacks improves: with $h=200$, TPR@FPR=1% stays 0.99 under an $\ell_2$ budget of 1.00 and 0.78 under an $\ell_\infty$ budget of 8/255.
- The detector has a closed-form statistical test based on a binomial tail bound, unlike baselines that only report empirical false-positive rates.
- Fidelity is preserved: FID and CLIP scores for watermarked images stay close to unwatermarked baselines, making the watermark effectively invisible.
Reading between the lines
- A natural testable extension is to measure cluster-boundary crossing rates directly and use them to choose the number of clusters $h$, rather than fixing $h=100$ or 200; the paper's own logic predicts an optimal $h$ that balances detection power against rejection by the overflow correction.
- Because the watermark code is derived from the n-gram context plus a secret key, the scheme inherits the code-history safeguard of earlier reweight methods, which may weaken the signal on highly repetitive sequences; that trade-off is not analyzed for images.
- The method should transfer to any VQ-style tokenizer beyond Emu3, since the only model-specific ingredient is a set of decoder embeddings to cluster; a cross-tokenizer study would test whether retokenization mismatch is indeed the dominant failure mode.
- The detection statistic ignores which token inside a cluster was sampled, so an adversary who swaps tokens within a cluster avoids detection; whether intra-cluster token substitution counts as a realistic image edit remains an open security question.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper proposes C-REWEIGHT, a watermarking scheme for auto-regressive image generation models. The method first clusters image tokens by k-means on decoder embeddings, then uses a cluster-level reweighting rule: at each generation step a cluster is pseudo-randomly selected from the watermark code and the next token is sampled from that cluster according to the original model distribution, with an overflow distribution to maintain unbiasedness. Detection recomputes the code from the re-encoded token sequence and scores each position by whether the observed token lies in the code-selected cluster. The paper claims distortion-freeness (Theorem 4.1) and reports empirical detectability and robustness results on Emu3 across four datasets, with TPR@FPR comparisons against KGW, Unigram, ITS-edit, EXP-edit, γ-reweight, DiPmark, and STA-1.
Significance. If the robustness claim holds, C-REWEIGHT addresses a real and specific problem: retokenization mismatch in auto-regressive image generation, a setting where token-level watermarks designed for language models degrade. The distortion-free proof in Appendix A is analytical and is not fitted to data, which is a genuine strength. The method is simple and plausibly deployable, and the empirical comparisons cover multiple datasets and attack budgets. However, the central claim of detectability after decoding and re-encoding rests on an unmeasured assumption about the stability of the context-derived watermark code, and the reported experiments do not directly substantiate the mechanism claimed to provide robustness. These gaps need to be closed before the paper's main claims can be accepted.
major comments (4)
- [§4.1, Algorithm 1] Algorithm 1 line 6 prints the condition 'if j < Pr(c_i'(θ))', but the surrounding text and the proof in Appendix A use the condition 'j < h·Pr(c_i'(θ))'. Under the printed condition, the expectation in Case 1 of the proof would be (1/h)·Pr(c1)·(PM/Pr(c1)) = PM/h, not PM, so the algorithm as printed is not distortion-free. This is a load-bearing inconsistency: Theorem 4.1 depends on the h-scaled condition. The algorithm must be corrected to match the proof, and the proof line should be cross-checked with the final Algorithm 1.
- [§4.2, Algorithms 2 and 3] The generator (Algorithm 2, line 5) derives the watermark code from the original prefix x_{i-n:i-1}, while the detector (Algorithm 3, line 5) recomputes the code from the re-encoded prefix x'_{i-n:i-1}. Since the code is a function of raw token ids (§4.2), any retokenization of a preceding token changes θ_i and hence the target cluster c_i'(θ), even when the retokenized token itself stays in its original cluster. For n=1, which the experiments use, a single changed previous token kills the signal at that position. The paper's key insight—cluster-coherent retokenization—addresses membership of the current token, not the stability of the context-derived code. No experiment reports the code-agreement rate P(θ_i(x') = θ_i(x)) or the per-token retokenization mismatch rate. With t=4096 tokens, the high TPR values in Table 2 are consistent with a per-token success probability as low as about 0.5, so the table does not validate the clustering mechanism as the source of robustness. Please add direct measurements of code stability and per-position signal preservation, and report TPR as a function of sequence length or per-token success probability.
- [Introduction, Contributions] The claim of 'a 10% increase in detection accuracy' is not defined or connected to any table, metric, or baseline. Tables 2–4 report TPR@FPR at various FPRs and attack budgets, but no comparison in the manuscript yields a single 10% figure. If this number refers to a specific aggregated comparison, it should be derived explicitly; otherwise it should be removed or replaced with a precise statement tied to the reported results.
- [§5.1, Table 2] The rows for ITS-edit and EXP-edit are reported at their empirical false positive rates, while the C-REWEIGHT rows are reported at guaranteed FPRs of 1% and 0.1%. These operating points are not matched, so the table does not support the statement that C-REWEIGHT 'outperforms all other unbiased watermarks' over those baselines. Please re-report ITS-edit and EXP-edit at the same FPRs used for the other methods, or state the empirical FPRs explicitly and restrict the comparison to methods with comparable operating points.
minor comments (7)
- [§4.1, Algorithm 1 line 3] The definition of Pc writes 'min{0, hPr(ci)-1}, ..., min{0, hPr(ci)-1}', which repeats the same expression; the i-th component should be min{0, hPr(c_i)-1}. As printed, the vector definition is ambiguous.
- [§4.1, Algorithm 1 line 4] The text says 'Pseudo-randomly select a cluster c_i'(θ)' but does not state that the selection is uniform over the h clusters. The proof in Appendix A assumes a uniform selection, so this should be made explicit in the algorithm.
- [§3.1, Notation] The notation 'i.i.d. watermark codes {θ_i}' is inaccurate because θ_i is derived from the preceding n-gram context and is therefore not i.i.d. across positions. The paper should say 'pseudo-randomly generated codes' or specify the i.i.d. code schedule before conditioning on context.
- [Table 1] Table 1 is described as a visual comparison of generation results, but no images appear in the manuscript. Either include the figure or refer to a supplementary file.
- [§5, Experimental setup] The experiments use 500 examples per task, but no confidence intervals or standard deviations are reported. Given that many TPR values in Tables 2–4 are at saturation (0.99), error bars or a small number of repeated trials would help assess the stability of the comparisons.
- [§4.2, Definition 4.2] Definition 4.2 returns 1 only when x lies in c_i'(θ), but in the generator the actual sampled cluster can be c_i''(θ) when the overflow branch is taken. The paper acknowledges that this reduces detection accuracy, but it does not quantify the resulting detection score distribution. A short sentence explaining how the overflow case affects the expected score would improve the statistical discussion.
- [§4.2, Algorithm 2 line 6] The condition 'if θ_i ∈ hist' is not fully specified: it is unclear whether hist stores the full code, the code together with the context, or just the sampled cluster, and how hist is updated. This matters for reproducibility.
Circularity Check
No significant circularity: the distortion-free theorem is derived in-appendix from the algorithm's own definitions, and detectability is empirically anchored to external baselines; self-citations are present but not load-bearing.
full rationale
Verdict: no significant circularity (score 1 in the normal 0-2 band). The central formal claim, Theorem 4.1 ('Cluster-based reweight is distortion-free'), is a self-contained analytic argument (Appendix A, Eqs. 3-5): it expands E_theta[PW(x|x1:n,theta)] using only the cluster probabilities Pr(ci)=sum_{x in ci} PM(x|x1:n) and the reweight rule of Algorithm 1, and shows the expectation collapses to PM(x|x1:n) for arbitrary cluster probabilities; no capacity is fitted to detection data and no self-cited result is invoked at this step. The detection score (Definition 4.2) and the binomial tail bound in Section 4.2 follow from the uniform code-to-cluster map under H0, not from fitted constants. Detectability and robustness claims (Tables 2-4) are empirical outcomes on Emu3 against external baselines (KGW, Unigram, ITS-edit, EXP-edit, gamma-reweight, STA-1); the overlapping-author entries (DiP-reweight/Dipmark, Wu et al. 2023) are comparison baselines, not justification. Algorithm 2 adopts the watermark-code history of (Hu et al., 2023), an overlapping-author paper; the mechanism is parameter-free, trivially verifiable replay protection, and does not import the target result, so it is independent support and does not raise the circularity score. Two non-circularity risks are flagged per the reviewing rule: (i) Algorithm 1 line 3 and Appendix A define the overflow distribution Pc with min{0, hPr(ci)-1}; because these weights are non-positive as written, the proof is internally inconsistent (e.g., h=2, Pr(c1)=0.9 gives P(sample c1)=0.5 under the literal rule, not 0.9), which is a correctness/typo concern, not a reduction of the claim to its inputs; (ii) robustness-after-re-encoding rests on unmeasured quantities — the per-position probability that a retokenized prefix preserves the code theta_i (Algorithm 3 line 5 vs. Algorithm 2 line 5) and that retokenized tokens remain in-cluster — so the generalization is less supported than claimed, but this unsupportedness is an empirical gap, not circularity.
Assumptions & free parameters
free parameters (1)
- number of clusters h =
100 and 200
assumptions (3)
- domain assumption The image encoder E and decoder D are deterministic, and the same encoder is available at detection time.
- domain assumption The watermark code θi is a pseudo-random function of the key and the preceding n-gram, independent of the token under H0, and selects clusters uniformly at random.
- domain assumption The generator has access to the base model's next-token distribution PM at every step.
Cite this review
Pith. "Pith review of A Watermark for Auto-Regressive Image Generation Models." pith.science (2026). https://pith.science/paper/JSOSMQV7
@misc{pith2026250611371,
author = {Pith},
title = {Pith review of: A Watermark for Auto-Regressive Image Generation Models},
year = {2026},
howpublished = {\url{https://pith.science/paper/JSOSMQV7}},
note = {Machine review of arXiv:2506.11371}
}
read the original abstract
The rapid evolution of image generation models has revolutionized visual content creation, enabling the synthesis of highly realistic and contextually accurate images for diverse applications. However, the potential for misuse, such as deepfake generation, image based phishing attacks, and fabrication of misleading visual evidence, underscores the need for robust authenticity verification mechanisms. While traditional statistical watermarking techniques have proven effective for autoregressive language models, their direct adaptation to image generation models encounters significant challenges due to a phenomenon we term retokenization mismatch, a disparity between original and retokenized sequences during the image generation process. To overcome this limitation, we propose C-reweight, a novel, distortion-free watermarking method explicitly designed for image generation models. By leveraging a clustering-based strategy that treats tokens within the same cluster equivalently, C-reweight mitigates retokenization mismatch while preserving image fidelity. Extensive evaluations on leading image generation platforms reveal that C-reweight not only maintains the visual quality of generated images but also improves detectability over existing distortion-free watermarking techniques, setting a new standard for secure and trustworthy image synthesis.
Reference graph
Works this paper leans on
-
[1]
Scott Aaronson. 2022. https://scottaaronson.blog/?p=6823 My AI safety lecture for UT effective altruism,
work page 2022
-
[2]
Tom B Brown. 2020. Language models are few-shot learners. arXiv preprint arXiv:2005.14165
arXiv 2020
-
[3]
Miranda Christ, Sam Gunn, and Or Zamir. 2023. Undetectable watermarks for language models. arXiv preprint arXiv:2306.09194
arXiv 2023
-
[4]
Hai Ci, Pei Yang, Yiren Song, and Mike Zheng Shou. 2024. Ringid: Rethinking tree-ring watermarking for enhanced multi-key identification. In European Conference on Computer Vision, pages 338--354. Springer
work page 2024
-
[5]
Sumanth Dathathri, Abigail See, Sumedh Ghaisas, Po-Sen Huang, Rob McAdam, Johannes Welbl, Vandana Bachani, Alex Kaskasoli, Robert Stanforth, Tatiana Matejovicova, and 1 others. 2024. Scalable watermarking for identifying large language model outputs. Nature, 634(8035):818--823
2024
-
[6]
Patrick Esser, Robin Rombach, and Bjorn Ommer. 2021. Taming transformers for high-resolution image synthesis. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 12873--12883
work page 2021
-
[7]
Pierre Fernandez, Guillaume Couairon, Herv \'e J \'e gou, Matthijs Douze, and Teddy Furon. 2023. The stable signature: Rooting watermarks in latent diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 22466--22477
work page 2023
-
[8]
Sam Gunn, Xuandong Zhao, and Dawn Song. 2024. An undetectable watermark for generative image models. arXiv preprint arXiv:2410.07369
arXiv 2024
Show all 35 references
-
[9]
Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter. 2017. Gans trained by a two time-scale update rule converge to a local nash equilibrium. Advances in neural information processing systems, 30
2017
-
[10]
Micah Hodosh, Peter Young, and Julia Hockenmaier. 2013. Framing image description as a ranking task: Data, models and evaluation metrics. Journal of Artificial Intelligence Research, 47:853--899
2013
-
[11]
Zhengmian Hu, Lichang Chen, Xidong Wu, Yihan Wu, Hongyang Zhang, and Heng Huang. 2023. Unbiased watermark for large language models. arXiv preprint arXiv:2310.10669
2023 arXiv
-
[12]
John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. 2023. A watermark for large language models. arXiv preprint arXiv:2301.10226
2023 arXiv
-
[13]
Yuval Kirstain, Adam Polyak, Uriel Singer, Shahbuland Matiana, Joe Penna, and Omer Levy. 2023. Pick-a-pic: An open dataset of user preferences for text-to-image generation. Advances in Neural Information Processing Systems, 36:36652--36663
2023
-
[14]
Rohith Kuditipudi, John Thickstun, Tatsunori Hashimoto, and Percy Liang. 2023. Robust distortion-free watermarks for language models. arXiv preprint arXiv:2307.15593
2023 arXiv
-
[15]
Tsung-Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Doll \'a r, and C Lawrence Zitnick. 2014. Microsoft coco: Common objects in context. In Computer vision--ECCV 2014: 13th European conference, zurich, Switzerland, September 6-12, 2014, ...
2014
-
[16]
Haotian Liu, Chunyuan Li, Qingyang Wu, and Yong Jae Lee. 2023. Visual instruction tuning. Advances in neural information processing systems, 36:34892--34916
2023
-
[17]
Minjia Mao, Dongjun Wei, Zeyu Chen, Xiao Fang, and Michael Chau. 2024. A watermark for low-entropy and unbiased generation in large language models. arXiv preprint arXiv:2405.14604
2024 arXiv
-
[18]
Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, and 1 others. 2021. Learning transferable visual models from natural language supervision. In International conference on machine...
2021
-
[19]
Colin Raffel, Noam Shazeer, Adam Roberts, Katherine Lee, Sharan Narang, Michael Matena, Yanqi Zhou, Wei Li, and Peter J Liu. 2020. Exploring the limits of transfer learning with a unified text-to-text transformer. Journal of machine learning research, 21(140):1--67
2020
-
[20]
Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bj \"o rn Ommer. 2022. High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 10684--10695
2022
-
[21]
Christoph Schuhmann, Romain Beaumont, Richard Vencu, Cade Gordon, Ross Wightman, Mehdi Cherti, Theo Coombes, Aarush Katta, Clayton Mullis, Mitchell Wortsman, and 1 others. 2022. Laion-5b: An open large-scale dataset for training next generation image-text models. Advances in n...
2022
-
[22]
Jiaming Song, Chenlin Meng, and Stefano Ermon. 2020. Denoising diffusion implicit models. arXiv preprint arXiv:2010.02502
2020 arXiv
-
[23]
Quan Sun, Qiying Yu, Yufeng Cui, Fan Zhang, Xiaosong Zhang, Yueze Wang, Hongcheng Gao, Jingjing Liu, Tiejun Huang, and Xinlong Wang. 2023. Emu: Generative pretraining in multimodality. arXiv preprint arXiv:2307.05222
2023 arXiv
-
[24]
Chameleon Team. 2024. Chameleon: Mixed-modal early-fusion foundation models. arXiv preprint arXiv:2405.09818
2024 arXiv
-
[25]
Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Lukasz Kaiser, and Illia Polosukhin. 2017. Attention is all you need. Advances in neural information processing systems, 30
2017
-
[26]
Xinlong Wang, Xiaosong Zhang, Zhengxiong Luo, Quan Sun, Yufeng Cui, Jinsheng Wang, Fan Zhang, Yueze Wang, Zhen Li, Qiying Yu, and 1 others. 2024. Emu3: Next-token prediction is all you need. arXiv preprint arXiv:2409.18869
2024 arXiv
-
[27]
Yi Wang, Yinan He, Yizhuo Li, Kunchang Li, Jiashuo Yu, Xin Ma, Xinhao Li, Guo Chen, Xinyuan Chen, Yaohui Wang, and 1 others. 2023. Internvid: A large-scale video-text dataset for multimodal understanding and generation. arXiv preprint arXiv:2307.06942
2023 arXiv
-
[28]
Yuxin Wen, John Kirchenbauer, Jonas Geiping, and Tom Goldstein. 2023. Tree-ring watermarks: Fingerprints for diffusion images that are invisible and robust. arXiv preprint arXiv:2305.20030
2023 arXiv
-
[29]
Yihan Wu, Zhengmian Hu, Hongyang Zhang, and Heng Huang. 2023. Dipmark: A stealthy, efficient and resilient watermark for large language models. arXiv preprint arXiv:2310.07710
2023 arXiv
-
[30]
Zijin Yang, Kai Zeng, Kejiang Chen, Han Fang, Weiming Zhang, and Nenghai Yu. 2024. Gaussian shading: Provable performance-lossless image watermarking for diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 12162--12171
2024
-
[31]
Richard Zhang, Phillip Isola, Alexei A Efros, Eli Shechtman, and Oliver Wang. 2018. The unreasonable effectiveness of deep features as a perceptual metric. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 586--595
2018
-
[32]
Xuandong Zhao, Prabhanjan Ananth, Lei Li, and Yu-Xiang Wang. 2023. Provable robust watermarking for ai-generated text. arXiv preprint arXiv:2306.17439
2023 arXiv
-
[33]
Chuanxia Zheng, Tung-Long Vuong, Jianfei Cai, and Dinh Phung. 2022. Movq: Modulating quantized vectors for high-fidelity image generation. Advances in Neural Information Processing Systems, 35:23412--23425
2022
-
[34]
online" 'onlinestring :=
ENTRY address archivePrefix author booktitle chapter edition editor eid eprint eprinttype howpublished institution journal key month note number organization pages publisher school series title type volume year doi pubmed url lastchecked label extra.label sort.label short.list...
-
[35]
write newline
" write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 gl...
Reviewed August 7, 2026 · model on record in the stance chip above.
Discussion (0). Sign in to comment.