{"id":"105722ae-d92f-491f-9395-44872e626aeb","arxiv_id":"2411.11434","paper_version":4,"verdict":"REJECT","confidence":"HIGH","novelty_score":7.0,"correctness_risk":"high","formal_verification":"none","parameter_count":4,"one_line_summary":"CLUE-Mark uses the CLWE lattice problem to watermark diffusion model latents, claiming provable undetectability and minimal quality loss.","lead":"CLUE-Mark embeds a secret signal into the random noise that diffusion models use to create images, using a lattice-based cryptography distribution called hCLWE. The paper claims this watermark is provably undetectable without the key, preserves image quality, and remains recoverable after JPEG compression.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Algorithm 1 does not sample the hCLWE distribution at the deployed parameters (γ=2, β=0.001): the rounding step's pancake weights P(1)/P(0)≈0.885 differ from the required exp(−π/4)≈0.456, so Theorem 2 does not apply to the implemented scheme.","rationale":"The reader and I identify the same load-bearing point. Theorem 2's reduction is sound only for exact hCLWE samples, and Claim 2.1 is the bridge from the abstract distribution to the deployed code. That bridge fails at the rounding step: the probability mass over k is not the continuous Gaussian ρ_{γ'}(k), and at γ'≈2 the discrepancy is large, roughly a factor of two in the first pancake ratio. The remainder of the security argument—CLWE hardness, the sample-limited assumption, and the covariance attack—is conditional on the sampler being exact; once that fails, the central 'provably undetectable' claim for the implemented system is unsupported. I credit the paper for the novel construction, the explicit impossibility discussion in Appendix A, and the reproducible empirical study; those are real contributions. The paper's own Section 5.1 concession that parameters are empirical rather than reduction-backed reinforces the gap but is not the primary flaw. A fixed exact sampler and/or larger γ satisfying the hardness regime might salvage the approach, which is why I do not treat this as an indication of bad faith.","tokens_in":20419,"tokens_out":11706,"duration_ms":116321,"concrete_test":"Check Claim 2.1 analytically and numerically for γ=2, β=0.001: independently derive the distribution of k=round(γ'⟨y,w⟩) for the exact base distribution used in the released code and compare it with ρ_{γ'}(k). Concretely, draw 10^7 inputs from that base distribution, run Algorithm 1, and histogram the secret-direction coordinate ⟨y',w⟩ against the properly normalized Definition 4.1 density. Measure the mass ratio of the k=0 and k=1 pancakes: if it is ≈0.885 rather than ≈0.456, Algorithm 1 is not an hCLWE sampler. Then replace Algorithm 1 with an exact rejection sampler from [4] in the Section 5.3 pipeline and re-measure recovery AUC and the Section 5.5 steganalysis average; if these outputs change materially, the proved scheme and the evaluated scheme are different objects.","verdict_should_be":"REJECT","load_bearing_attack":"The load-bearing step is Claim 2.1, which asserts that Algorithm 1 exactly samples H_{w,β,γ}. The proof writes the output density as ρ(y⊥)Σ_k ρ_{γ'}(k)ρ_β(z), substituting the continuous weight ρ_{γ'}(k)=exp(−πk²/γ'²) for the actual probability that k=⌈γ'⟨y,w⟩⌋ is selected. That probability is an integral of the input density over the preimage interval of the rounding function, not the value of exp(−πk²/γ'²) at the center of the interval. At the deployed parameters γ=2, β=0.001, γ'≈2, the exact rounded-Gaussian masses are P(k=0)≈0.197 and P(k=1)≈0.175 (using the paper's N(0,1) convention), a ratio of ≈0.885. The hCLWE density of Definition 4.1 requires pancake masses proportional to exp(−πk²/γ²), giving ratio exp(−π/4)≈0.456 for k=0 vs k=1. Thus successive pancakes are misweighted by nearly a factor of two. This is not an asymptotic artifact; it is the regime the system actually uses. Theorem 2's reduction consumes oracle samples from H and feeds them to the image generator, so it proves nothing about the images produced by Algorithm 1. The paper's own Section 5.1 statement that the concrete parameters are empirical rather than reduction-backed is a separate gap, but the sampler mismatch alone breaks the central 'provably undetectable' claim for the deployed system.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes CLUE-Mark, a watermarking scheme for diffusion-model images based on the continuous learning with errors (hCLWE) distribution. The latent noise vector of a diffusion model is replaced, blockwise, by samples that are claimed to come from the hCLWE distribution; the watermark is recovered by inverting the diffusion process and applying a keyed statistical test. The main theoretical contribution is Theorem 2, a reduction showing that if the decision hCLWE problem is hard, then no efficient adversary without the key can distinguish watermarked from unwatermarked images. The paper also reports empirical evaluations of recovery accuracy, image quality, robustness to JPEG/brightness changes, and resistance to a specific steganographic attack, with a proof-of-concept implementation made available.","tokens_in":20713,"tokens_out":26688,"duration_ms":256853,"significance":"The idea of basing a diffusion-model watermark on a lattice-derived continuous distribution is novel and potentially useful: if the reduction were tight and the sampler exact, CLUE-Mark would be the first watermarking scheme with undetectability reduced to a cryptographic hardness assumption, and the paper provides a clear formal framework (Definitions 2.2–2.6) for reasoning about such schemes. The paper also honestly identifies the impossibility of simultaneously achieving completeness, soundness, undetectability, and perfect robustness (Appendix A). However, the central claim is currently not established for the implemented system: the proof of Claim 2.1 does not show that Algorithm 1 samples the hCLWE distribution, and the concrete parameters used in the evaluation are explicitly outside the regime covered by known CLWE hardness reductions. The reduction template in Theorem 2 is a useful contribution, but the gap between the oracle-based theorem and the deployed sampler is load-bearing.","major_comments":[{"comment":"The proof of Claim 2.1 is incorrect: it substitutes the continuous weight ρ_{γ′}(k) = exp(−πk²/γ′²) for the actual probability that k = round(γ′⟨y,w⟩) is selected. For input y drawn from the standard normal used by diffusion models, the correct probability is P_k = Φ((k+1/2)/γ′) − Φ((k−1/2)/γ′). At the deployed parameters γ = 2, β = 0.001 (so γ′≈2), P_1/P_0 ≈ 0.885, whereas Definition 4.1 requires the k-th pancake weight to be proportional to exp(−πk²/γ′²), giving exp(−π/4) ≈ 0.456 for k=0 versus k=1. Consequently Algorithm 1 does not sample H_{w,β,γ}; successive pancakes are misweighted by nearly a factor of two. Since Theorem 2's reduction assumes oracle samples from H_{w,β,γ}, the undetectability guarantee does not apply to the implemented CLUE-Mark pipeline. The algebra in Appendix B proves that a different algorithm—one that samples k directly with weight ρ_{γ′}(k)—would produce H_{w,β,γ}, but that is not what Algorithm 1 does.","section":"§4.3, Claim 2.1 and Algorithm 1"},{"comment":"The parameters actually deployed (n=32, γ=2, β=0.001, m≤512) are chosen from the empirical covariance-attack experiments in Figure 8, and Section 5.1 states explicitly that these parameters are 'based on our empirical evaluations and not on the theoretical reductions of CLWE hardness'. Known CLWE hardness results require γ = Ω(√n), which for n=32 means γ≥5.66, so the security of the deployed parameters is not supported by Theorem 1. Moreover, the empirical attack experiments in Section 5.1 evaluate Algorithm 1's samples, not the hCLWE distribution H_{w,β,γ} of Definition 4.1; because the sampler is not exact, those experiments cannot validate the hardness assumption needed by Theorem 2 for the implemented scheme. The paper should either use parameters in the known-hard regime, or clearly reframe the security claim as conditional on a new, nonstandard hardness assumption for the sampled distribution.","section":"§5.1, RQ1 parameter selection"},{"comment":"The reduction does not account for the effect of the inverse discrete wavelet transform on the secret direction. In the implemented scheme, hCLWE samples are created in the frequency domain and the latent vector is z = IDWT(y). If the DWT is orthogonal, z is distributed as H_{U^T w, β, γ}, not H_{w, β, γ}, where U is the DWT matrix. The proof never specifies that the key used by the watermark distinguisher must be U^T w (or, equivalently, that the key in the security experiment is the transformed direction). As written, the marked distribution in the reduction is not the one defined by the CLUE-Mark key w. This is fixable, but it is a genuine gap in the formal statement. Additionally, the theorem bounds m (samples per image) but not the number q of images queried by the distinguisher; the hCLWE assumption should be stated for the total number of oracle samples, which is mq.","section":"§4.2, Theorem 2 proof"},{"comment":"There is also a variance-convention mismatch. Algorithm 1 draws z_i ← N(0,β), which under the standard reading gives a Gaussian with standard deviation β, whereas Definition 4.1's ρ_β(x) = exp(−π∥x/β∥²) corresponds to a Gaussian with standard deviation β/√(2π). Even if the pancake weights were correct, the noise around each pancake in the output would be wider by a factor √(2π) than the hCLWE density of Definition 4.1. The proof of Claim 2.1 uses ρ_β(z) but the algorithm samples N(0,β); this mismatch reinforces that Algorithm 1 is not an exact sampler for the distribution used in Theorem 2.","section":"§4.3, Algorithm 1 and Definition 4.1"}],"minor_comments":[{"comment":"The abstract contains typos ('watermaking', 'purturbations') and the claim that CLUE-Mark 'cannot be detected nor removed by recent steganographic attacks' is too strong: only the specific averaging attack of [39] is evaluated in Section 5.5, and Section 5.6 shows that the watermark is not robust to cropping or rotation.","section":"Abstract and Section 1"},{"comment":"The sentence 'the blue area is a histogram generated by a simulation of 10,000 samples using this approximation and is not simply the area under the dashed line (the expected PDF)' is ambiguous; the authors should state explicitly whether the histogram is intended to match the dashed PDF and, if there is a discrepancy, explain it.","section":"§4.3, Figure 4 discussion"},{"comment":"The Gaussian Shading baseline is evaluated with a fixed key and nonce for all images, which is exactly the setting in which Gaussian Shading's own undetectability proof does not apply. The conclusion that CLUE-Mark 'is robust to standard steganographic attacks unlike the baselines' should be qualified, because the baseline comparison deliberately violates a stated security assumption of Gaussian Shading.","section":"§5.5, RQ4"},{"comment":"The text says the attack 'is successful with several thousand samples' for γ=1, while the figure's x-axis starts at 10²; a precise statement of the sample counts used for each curve would improve readability. Also, the notation 't. acc.' in the legend is not defined in the caption.","section":"§5.1, Figure 8"},{"comment":"There are several typographical errors (e.g., 'distringuisher' in Theorem 2's proof, 'hypotheseses' in Section 3.2, 'probablity' in Definition 2.4, 'identitical' in Section 2.1, 'Cyphertexts' in Section 6). The paper would benefit from a careful proofreading pass.","section":"General"}],"recommendation":"major_revision","confidential_remarks":"The core idea is appealing and the reduction in Theorem 2 is a useful template, but the proof of Claim 2.1 is not merely missing a detail: the rounding-based sampler provably does not produce the hCLWE distribution at the deployed parameters. I would encourage the authors to replace Algorithm 1 with an exact or statistically close sampler (e.g., sampling k from the appropriate discrete Gaussian), re-derive the corresponding distribution, and re-run the parameter-selection experiments. If that is done, the paper could become a solid contribution; in its current form the central 'provably undetectable' claim is unsupported."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Here's my read on CLUE-Mark. The core idea—using hCLWE to bias diffusion latents and reduce undetectability to the CLWE assumption—is new, and the paper is a clear, honest piece of work. The reduction in Theorem 2 is fine in the abstract: if you had an oracle returning exact hCLWE samples, undetectability would follow from hCLWE hardness. The problem is that Algorithm 1 is not such an oracle. Claim 2.1's proof replaces the actual probability that k = round(γ' <y,w>) with the continuous weight ρ_{γ'}(k) = exp(-π k^2/γ'^2). That's not the probability; the probability is the integral of a Gaussian over the rounding interval. At the deployed parameters γ=2, β=0.001, so γ'≈2, the ratio P(k=1)/P(k=0) is about 0.885, not the required exp(-π/4)≈0.456. The adjacent pancakes are misweighted by nearly a factor of two. So the output is not H_{w,β,γ}, and Theorem 2 has nothing to say about the images the paper actually produces.\n\nThe paper's own Section 5.1 already concedes that the concrete parameters are empirical, not reduction-backed. That concession becomes load-bearing once the sampler is off.\n\nThe empirical study is useful, though limited: 100 prompts, no error bars, AUC >0.99 for recovery, FID much closer to unwatermarked than Tree Ring or Gaussian Shading, and the steganalysis attack doesn't remove the watermark. The robustness to JPEG and brightness is real but modest. Those are secondary.\n\nWho should read it: people working on watermarking or provenance for generative models. The CLWE angle is worth taking seriously, and the sampler bug is exactly the kind of subtle gap that careful refereeing should catch. The paper is salvageable: either fix the sampler so it really draws from hCLWE (e.g., correct rounded-Gaussian weights or rejection sampling), or reframe the claims as empirical with the provable part as an open problem.\n\nMy recommendation: send it to peer review. The idea deserves time, but the reviewers should be told to focus on the sampler and on whether the security claim can be made to match the implementation.","headline":"The CLWE-for-watermarking idea is fresh and the paper is well-written, but the provable undetectability claim breaks at Algorithm 1: the sampler does not actually output hCLWE samples at the deployed parameters.","tokens_in":21324,"tokens_out":6721,"would_cite":false,"duration_ms":67202,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"CLUE-Mark embeds a secret signal in diffusion latent noise and proves that detecting it without the key is as hard as solving the decision hCLWE problem.","keywords":["watermarking","diffusion models","CLWE","hCLWE","undetectability","steganography","lattice-based cryptography","latent space"],"falsifier":"Draw many samples from Algorithm 1 with $\\gamma=2$, $\\beta=0.001$, compute $z=\\gamma'\\langle y,w\\rangle\\bmod 1$, and compare the empirical mass on integer bins with the rounded Gaussian's prediction: the paper's Claim 2.1 gives $P(1)/P(0)=\\exp(-\\pi/\\gamma'^2)\\approx 0.456$ for $\\gamma'\\approx 2$, whereas direct rounding of a Gaussian gives about $0.885$. A statistically significant mismatch would show the sampler is not producing the hCLWE distribution, severing the reduction between the implemented watermark and CLWE hardness.","tokens_in":20135,"feed_emoji":"🖼️","tokens_out":10561,"duration_ms":86382,"temperature":0.7,"pith_summary":"CLUE-Mark aims to stamp diffusion-model images with a secret signal that no efficient detector without the key can distinguish from an ordinary generated image. The watermark lives in the latent noise vector: instead of drawing the initial latents from a standard Gaussian, the scheme blocks them and draws each block from the homogeneous Continuous Learning With Errors (hCLWE) distribution, which is Gaussian in every direction except one secret direction where it is periodically concentrated. The paper proves that any efficient distinguisher between marked and unmarked images would solve the decision hCLWE problem, so under the hCLWE assumption the watermark is undetectable and cannot degrade output quality. A verifier holding the key inverts the diffusion process, projects the estimated latents onto the secret direction, and runs a Rayleigh test on the wrapped scores to recover the signal. If the construction holds, a provider can watermark an unmodified diffusion model and verify images without any per-image nonce or prompt.","feed_headline":"Latent-noise watermark is provably undetectable without the key","feed_subtitle":"CLUE-Mark hides a CLWE signal in the noise vector; image quality stays intact, yet key holders can recover it.","key_machinery":"The load-bearing object is the homogeneous Continuous Learning With Errors (hCLWE) distribution $H_{w,\\beta,\\gamma}$, whose density is a standard Gaussian in every direction except the secret unit direction $w$, where it is periodically concentrated into 'pancakes' of spacing about $1/\\gamma$ and width about $\\beta/\\gamma$. CLUE-Mark blocks the diffusion latent vector into $n$-dimensional chunks, transforms them with the inverse discrete wavelet transform, and uses them as the initial latents; recovery inverts the diffusion model, projects the estimated latents onto $w$ to form $z_i = \\gamma \\langle y_i, w \\rangle \\bmod 1$, and feeds the wrapped scores to the Rayleigh test. The proof connects the detectable pattern to CLWE hardness, and Algorithm 1 is the practical sampler that attempts to produce $H$ exactly by rounding the projection to the nearest lattice point and adding Gaussian noise in the secret direction.","core_discovery":"The paper's central claim is Theorem 2: under the hCLWE hardness assumption for $n$ dimensions with parameters $\\gamma$ and $\\beta$, the CLUE-Mark scheme with latent vectors of dimension $mn$ (with $m$ polynomial in $n$) is undetectable in the sense of Definition 2.6. The proof is a reduction: a distinguisher that tells watermarked images from normal ones can be turned into a distinguisher for the decision hCLWE problem by assembling each queried image's latent vector from oracle samples and running the rest of the generation pipeline unchanged. The practical counterpart is that with $\\gamma=2$, $\\beta=0.001$ and 32-dimensional blocks in the DWT domain, the recovered signal separates marked from unmarked images with AUC above 0.99 on both datasets, image quality measured by FID is essentially unchanged, and the mark survives JPEG compression and brightness adjustment while resisting the steganalysis attack that defeats Tree Ring and Gaussian Shading.","pith_inferences":["An external reader should note that Claim 2.1's sampler is not proven to output exactly hCLWE: for $\\gamma'\\approx 2$ the rounded-Gaussian bin ratio is about $0.885$, not $\\exp(-\\pi/4)\\approx 0.456$, so a direct statistical test of Algorithm 1 would determine whether the implemented watermark is the distribution the reduction covers.","The paper itself states that its concrete parameters ($\\gamma=2$, $\\beta=0.001$) come from an empirical covariance attack, not from the theoretical CLWE reductions; the formal theorem is therefore conditional on the hCLWE assumption holding at those values.","If the latent-blocking recipe transfers, the same construction could watermark other generative models that consume Gaussian noise, such as GANs or DDIM-style samplers, whenever the initial latent can be recovered by inversion.","Since the keyed detector is a Rayleigh test on wrapped projections, deployment can tune the p-value threshold to set the false-positive rate, which is the operating point for platforms that want to avoid flagging unmarked images."],"forward_implications":["A model provider can watermark outputs without retraining, fine-tuning, or changing model weights, because only the input noise vector is modified.","Under the hCLWE assumption, no efficient adversary without the key can distinguish marked from unmarked images, so marked images behave identically to ordinary outputs for every downstream use.","The scheme supports multiple keys, so a provider can assign a different key per user and trace which account generated a given image.","CLUE-Mark is deliberately not perfectly robust: it survives mild JPEG compression and brightness shifts but fails under cropping and rotation, consistent with the paper's impossibility theorem for undetectable robust watermarks."],"supporting_citations":[{"why":"Defines the CLWE/hCLWE problem and its hardness reduction from worst-case lattice problems, which CLUE-Mark relies on.","marker":"[4]"},{"why":"Gives further CLWE hardness results and the guidance that $\\gamma = \\tilde{\\Omega}(\\sqrt{n})$ is needed, informing the parameter discussion.","marker":"[10]"},{"why":"Provides the exact DPM-solver inversion used in recovery to estimate the original latent vector from an image.","marker":"[15]"},{"why":"Motivates frequency-domain (DWT) watermarking for robustness, which CLUE-Mark adopts.","marker":"[3]"},{"why":"Supplies the Rayleigh test the keyed detector uses to distinguish uniform from concentrated wrapped scores.","marker":"[31]"},{"why":"Tree Ring is the pre-processing baseline whose undetectability claim is shown to fail under steganalysis.","marker":"[37]"},{"why":"Gaussian Shading is the other baseline; its proof requires a per-image nonce, which CLUE-Mark avoids.","marker":"[40]"},{"why":"The steganalysis technique that detects and removes Tree Ring and Gaussian Shading watermarks, used as the attack baseline for CLUE-Mark.","marker":"[39]"}],"fun_headline_variants":["Provably undetectable watermark in diffusion noise","Cryptographic watermark: undetectable, no quality loss","CLWE watermark: provably invisible to any adversary","Steganography-proof watermark for AI images","Latent watermark with cryptographic undetectability guarantee"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that Algorithm 1 exactly samples the hCLWE distribution, because the undetectability proof feeds those samples to the generator as if they were oracle draws from that distribution.","fun_headline_variants_meta":{"raw":{"variants":["Provably undetectable watermark in diffusion noise","Cryptographic watermark: undetectable, no quality loss","CLWE watermark: provably invisible to any adversary","Steganography-proof watermark for AI images","Latent watermark with cryptographic undetectability guarantee"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000284,"raw_usage":{"total_tokens":1721,"prompt_tokens":1037,"completion_tokens":684,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":653,"completion_tokens_details":{"reasoning_tokens":611}},"tokens_in":653,"tokens_out":684,"duration_ms":6627,"temperature":1.0,"reasoning_tokens":611,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T18:32:39.971633+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Draw many samples from Algorithm 1 with $\\gamma=2$, $\\beta=0.001$, compute $z=\\gamma'\\langle y,w\\rangle\\bmod 1$, and compare the empirical mass on integer bins with the rounded Gaussian's prediction: the paper's Claim 2.1 gives $P(1)/P(0)=\\exp(-\\pi/\\gamma'^2)\\approx 0.456$ for $\\gamma'\\approx 2$, whereas direct rounding of a Gaussian gives about $0.885$. A statistically significant mismatch would show the sampler is not producing the hCLWE distribution, severing the reduction between the implemented watermark and CLWE hardness.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides the exact DPM-solver inversion used in recovery to estimate the original latent vector from an image."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Motivates frequency-domain (DWT) watermarking for robustness, which CLUE-Mark adopts."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the Rayleigh test the keyed detector uses to distinguish uniform from concentrated wrapped scores."}],"review_version":1}