{"id":"dfc3b4cc-8e55-43e4-816b-b6ff6ae24e20","arxiv_id":"2412.07129","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":6,"one_line_summary":"A watermark embedded in the style-feature statistics of an art image can be recovered from images produced by black-box arbitrary style transfer models.","lead":"StyleMark embeds invisible copyright watermarks into art style images so that the watermark survives when someone uses style transfer to copy the artist's style. If it works, platforms could trace unauthorized stylized images back to the original artist instead of only detecting that style transfer happened.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The central generalization claim is only tested within the VGG feature-statistics family; a non-AdaIN-style AST model could collapse the decoder, so 'across different AST' is broader than the evidence.","rationale":"The paper's empirical core is substantial: StyleMark's accuracies are far above all baselines, ablations show both the proposed encoder and the residual/re-embedding path matter, and the use of official pre-trained AST models is appropriate. I did not find an internal inconsistency in the equations or a smoking-gun numeric error. The concern is about the scope of the central claim, not about a specific reported number. The Introduction explicitly labels the shared-feature-transfer idea a 'mild hypothesis'; the experiments are the only support. All seven AST models in Table 1 (including the AdaIN white-box) use VGG-19 front-ends and rely, to varying degrees, on feature-statistics matching, so the six black-box results are in-family generalization tests rather than out-of-family stress tests. If a genuinely different AST model—one that does not compute channel-wise mean/variance from the style image—were evaluated, the decoder would likely fail because the encoder was trained end-to-end through AdaIN. This does not invalidate the method for current VGG-based AST, but it does mean the title and conclusion overstate 'different AST'. The reader's weakest assumption identifies exactly this gap; my recommendation is to keep the conditional verdict pending the proposed out-of-family evaluation, not to change it.","tokens_in":889,"tokens_out":818,"duration_ms":122605,"concrete_test":"Use the authors' frozen AdaIN-trained StyleMark encoder/decoder and evaluate on an AST model whose style alignment does not use AdaIN channel-wise mean/variance statistics—e.g., WCT2, ArtFlow, or the optimization-based Gatys method—on the same 500 test style/content pairs. If bit accuracy on the new model drops to near 50% while AdaIN-family models remain near their Table 1 values, the central generalization claim fails; if accuracy stays above the attribution threshold on all such models, the concern is resolved.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The load-bearing assumption is the 'mild hypothesis' in the Introduction: watermark information can accompany shared style features and be co-rendered across different AST. The method is trained end-to-end with AdaIN only (Eqs. 2, 9, 12), so the encoder learns to place the watermark in channel-wise mean/variance statistics of VGG features. The six black-box AST models in Table 1 all use VGG front-ends and feature-statistics style alignment; SANet/MccSTN add attention or fusion, EFDM matches higher-order statistics, CAP uses reversible linear modules, but none is structurally outside the family the method was designed for. Thus the high accuracies are consistent with the hypothesis but do not test it. No experiment or structural argument shows survival when a model aligns style via, e.g., whitening/coloring (WCT2), invertible normalization flows, a transformer-based alignment on a different backbone, or a Gram-matrix optimization objective. In such a model, the watermark-carrying statistics encoded by Eq. (2) may never be computed, and the AdaIN-trained decoder could fall to chance. The claim 'across different AST' therefore exceeds the demonstrated domain.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper introduces StyleMark, a watermarking method that embeds an artist identifier into a style image so that the watermark can be recovered from images produced by black-box arbitrary style transfer (AST). The encoder uses multi-scale style features and an AdaIN-style feature alignment (Eq. 2) to plant the watermark in channel statistics; a distribution squeeze loss pushes watermark energy into style features rather than content structure; a two-stage training procedure first trains with AdaIN as the distortion model and then fine-tunes the decoder on pixel-level noise. Experiments on seven AST models and common image distortions report bit accuracies of 82%–99% after AST, far above the near-chance performance of baseline deep watermarking methods. Ablations show that the proposed network, residual reconstruction, and distribution squeeze loss all contribute.","tokens_in":13148,"tokens_out":5093,"duration_ms":54200,"significance":"StyleMark addresses a genuinely new and practically relevant watermarking scenario—art style attribution after arbitrary style transfer—and its central mechanism is plausible: embedding in style-feature statistics that are precisely what AdaIN-style AST aligns. The reported accuracy gaps over HiDDeN, MBRS, FakeTagger, PIMoG, and FIN are large, and the ablations support the contribution of the style-specific encoder, the squeeze loss, and decoder fine-tuning. The paper includes clear algorithmic pseudocode and tests on several representative open-source AST models. However, the significance is bounded by three evaluation gaps: the tested black-box AST models all share the VGG/channel-statistics family for which the method was designed; the attribution claim lacks false-positive analysis and error bars; and the adaptive-attack evaluation is narrow relative to the security claim.","major_comments":[{"comment":"The paper's central claim, 'across different AST', is supported only within the family of VGG-front-end, channel-statistic-based style alignments. The six black-box models in Table 1 (SANet, CCPL, CAP, EFDM, MANet, MccSTN) all use VGG-style feature extractors and align features by matching channel statistics; the encoder is trained exclusively with the AdaIN alignment of Eq. (2) and Eq. (9). The manuscript gives no experiment or structural argument for a model that aligns style via whitening/coloring (e.g., WCT2), normalizing flows, or a non-VGG transformer. Because the watermark is placed in the mean/variance statistics of VGG features, a structurally different AST model could discard those statistics entirely. Please either test such a model or explicitly bound the claim to the AdaIN/VGG feature-statistics family.","section":"Introduction / Eq. (2) / Table 1"},{"comment":"No false-positive analysis is provided for the attribution guarantee. The paper reports average bit accuracies (0.821–0.986 for 30-bit watermarks) but does not define a decision rule, such as a Hamming-distance threshold, or report the probability that an arbitrary stylized image is attributed to the wrong artist. Since the threat model envisions over a billion possible identifiers, a per-user false-positive rate is needed to substantiate the claim of precise attribution; otherwise a 0.82 bit-accuracy can correspond to very different per-image false-positive risks depending on the threshold. Also, the results are reported without standard deviations or multiple seeds, so it is unclear whether the smallest accuracy gaps are significant. Add repeated runs and a threshold/false-positive-rate analysis.","section":"Threat Model / Robustness Evaluation (Table 1)"},{"comment":"The adaptive-attack evaluation tests only watermark overwriting with FakeTagger and MBRS, including versions retrained with the StyleMark framework. This does not support the statement that StyleMark 'securely defends against malicious adaptive attacks.' A knowledgeable adversary could instead fine-tune a removal network, add combined geometric and pixel distortions, or train an attack that minimizes decoder confidence while preserving style. Please add at least one attack that directly targets the StyleMark decoder, or replace the security claim with a more limited statement.","section":"Security Evaluation / Table 3"}],"minor_comments":[{"comment":"Fcon is introduced as a single-image encoder (fcon = Fcon(Isty)), but it is called as Fcon(gray(Iwm), gray(Isty)) in Eq. (5) and Algorithm 1; clarify what the two arguments are, and make the output order in Eq. (5) consistent with Algorithm 1.","section":"Eq. (5) / Algorithm 1"},{"comment":"The text refers to 'Table 4' for the watermark overwriting results, but those results appear in Table 3; Table 4 is the ablation table.","section":"Adaptive Attacks"},{"comment":"The 'Average' column appears to include the 'Ori' column; state the averaging scope explicitly so that readers can reproduce the reported mean.","section":"Table 1"},{"comment":"The phrase 'securely defending against malicious adaptive attacks' and the term 'plug-and-play' are stronger than what the current experiments demonstrate; please calibrate these claims to the tested attack and AST families.","section":"Abstract / Introduction"}],"recommendation":"major_revision","confidential_remarks":"The paper is a competent first study of a new watermarking task, and I see no evidence of methodological circularity in the main derivation. The central risk is overclaiming generalization beyond the AdaIN/VGG feature-statistics family and beyond the tested adaptive attacks. Given the novelty and the large reported gains, major revision rather than rejection seems appropriate."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"First thing: this paper shows a real new capability. StyleMark embeds a watermark into the mean/variance statistics of the style image, in the same feature space AdaIN-style AST models use, and trains with an AST noise pool. The result is 82-98% bit accuracy after seven black-box AST models while HiDDeN, MBRS, FakeTagger, PIMoG, and FIN all sit at chance. That's a big gap, and the ablation makes the case that the style-feature encoder is the reason: swap in MBRS's encoder and recovery collapses to ~50%. The distribution squeeze loss and two-stage decoder fine-tuning both show measurable gains, and the authors test on the official pre-trained AST models. Credit where due.\n\nNow the soft spots. The main one is the generalization claim. Every AST model in the test set is in the VGG-feature-statistics family. AdaIN is the white-box training model, and SANet, CCPL, CAP, EFDM, MANet, MccSTN all align style via feature statistics on VGG features. So 'across different AST' actually means 'across variants of the AdaIN-style family.' There's no WCT2, no ArtFlow, no transformer-based alignment, no Gram-matrix optimization. The paper calls this a 'mild hypothesis,' which is honest, but it means the headline is broader than the evidence. If a future AST model doesn't compute those statistics, the watermark likely doesn't survive.\n\nSecond, the evaluation lacks the statistical grounding a watermarking paper needs. No error bars, so I can't tell if the 82% vs 85% differences are noise. More importantly, no false-positive analysis: with a 30-bit watermark, is 0.82 bit accuracy enough to claim attribution with a known false-alarm rate? The paper never gives the decision threshold. For a copyright tool, that's the number that matters. The adaptive attacks are also weak—overwriting with FakeTagger/MBRS and retraining those two under the StyleMark framework is not a serious removal attempt (no fine-tuning against an adversarial AST, no adversarial stylization, no removal network).\n\nWho should read this? Anyone working on watermarking or style transfer robustness. It's a genuine step in a new direction, and the experiments are mostly well done. The revision needs to narrow the generalization claim, add error bars and false-positive analysis, and test at least one structurally different AST model. I'd send it to review, and I'd also bring it to our reading group.","headline":"A genuinely new watermarking approach for style transfer, but the 'across different AST' claim outruns the evidence and the evaluation needs error bars and a false-positive analysis.","tokens_in":13659,"tokens_out":3838,"would_cite":true,"duration_ms":39217,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A watermark embedded in style-feature statistics survives black-box arbitrary style transfer, letting platforms trace stylized images back to the source artwork.","keywords":["watermarking","arbitrary style transfer","copyright protection","style feature statistics","AdaIN","black-box robustness","image attribution","deep neural networks"],"falsifier":"Train or adapt a pre-trained AST model that matches style without aligning channel-wise means and variances, for example by explicit higher-order distribution matching or attention-only feature fusion, then run StyleMark; if the recovered 30-bit watermark accuracy falls from above 80% toward 50%, the shared-statistics hypothesis is falsified.","tokens_in":12700,"feed_emoji":"🎨","tokens_out":4486,"duration_ms":43403,"temperature":0.7,"pith_summary":"StyleMark claims that copyright watermarks can survive arbitrary style transfer if they are embedded into the shared style-feature statistics that AST models transfer, rather than into the image's visible structure. The paper proposes an encoder that hides a 30-bit artist identifier in the mean activations of style features at multiple scales, so that when a black-box AST model renders the style onto a content image, the watermark is re-rendered along with the brushstrokes. A decoder then recovers the identifier from the stylized image with 82.1%–98.6% bit accuracy across seven AST models, while prior watermarking methods stay near random guessing. If correct, art-sharing platforms could attribute stylized images to the source artwork without knowing which AST model produced them.","feed_headline":"Watermarks survive style transfer with 82–99% accuracy","feed_subtitle":"New method hides artist IDs in style statistics so stylized images stay traceable to the source artwork.","key_machinery":"The carrier of the argument is the shared style-feature statistics used by adaptive instance normalization (AdaIN): channel-wise mean and standard deviation of the style image's feature map. StyleMark's encoder, a style-feature encoder plus a reconstructor with residual connections, learns to shift these statistics under control of the watermark bits, and its distribution squeeze loss forces the watermark into style features rather than content structure. The decoder, a ResNet50 classifier, is first trained end-to-end with the AdaIN AST model as the only distortion, then fine-tuned under random pixel noise, so that it learns to read the watermark from stylized and post-processed images alike.","core_discovery":"StyleMark's central claim is that a copyright watermark can be co-rendered into arbitrary style transfer outputs if the watermark is embedded in the style-feature statistics that AST models actually transfer. The paper's 'mild hypothesis' is that these statistics—specifically channel-wise mean and variance—form a shared style feature space across different AST architectures. The encoder modifies these statistics at multiple scales, and the decoder is trained end-to-end with AdaIN as a white-box stand-in, then fine-tuned against noise. On seven AST models the recovered 30-bit watermark has 82.1%–98.6% accuracy, versus near 50% for prior watermarking techniques. The authors interpret this as evidence that watermark traces ride along with brushstroke features into the stylized image.","pith_inferences":["The core mechanism may transfer to other generative pipelines that rely on feature-statistics alignment, such as diffusion-based style transfer, but this is not tested in the paper.","The claimed robustness depends on the entire family of AST models sharing AdaIN-like statistics; a future AST built on attention or reversible transformations that discard channel-wise moments could evade the watermark.","The paper's two-stage training recipe—pretrain on the easiest white-box distortion, then fine-tune the decoder on a noise pool—could strengthen other watermarking methods if adopted generally.","A direct test would be to probe intermediate feature maps of stylized images for watermark signal in channel means, which would confirm or refute the claimed mechanism."],"forward_implications":["If StyleMark works as claimed, art-sharing platforms can attribute a stylized image to a registered artist's source image without knowing which AST model produced it.","Prior deep watermarking methods fail at this task, so the result would open a new defense line against unauthorized style transfer.","Watermark rewriting attacks and common post-processing (JPEG, blur, brightness) would not erase attribution, according to the reported experiments.","The method does not block legitimate AST use, since it only adds invisible markers and does not degrade the normal style-transfer experience."],"supporting_citations":[{"why":"Introduces adaptive instance normalization, the feature-statistics operation StyleMark embeds watermarks into and the white-box training model.","marker":"(Huang and Belongie 2017)"},{"why":"Provides HiDDeN, the first deep watermarking baseline that StyleMark compares against and surpasses on AST robustness.","marker":"(Zhu et al. 2018)"},{"why":"Provides MBRS, a strong deep watermarking baseline used for comparison and for the watermark-rewriting attack tests.","marker":"(Jia, Fang, and Zhang 2021)"},{"why":"Provides FIN, a state-of-the-art watermarking baseline that fails under AST and is used as a comparison point.","marker":"(Fang et al. 2023)"},{"why":"Supplies SANet, one of the black-box AST models used to test whether StyleMark generalizes beyond the white-box AdaIN.","marker":"(Park and Lee 2019)"},{"why":"Supplies FakeTagger, a provenance-tracking watermarking method used both as a baseline and as a tool in the watermark-rewriting attack evaluation.","marker":"(Wang et al. 2021)"}],"fun_headline_variants":["StyleMark: Watermark survives style transfer with 82–99% accuracy","Hidden artist ID survives style transfer via StyleMark","Watermark in style stats survives arbitrary style transfer","StyleMark: 82–99% watermark accuracy after style transfer","Artist IDs ride style features through AST: StyleMark"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that every black-box AST model conveys style through the same channel-wise mean and variance statistics that AdaIN uses, so a watermark embedded in those statistics by an encoder trained only with AdaIN survives all other AST models.","fun_headline_variants_meta":{"raw":{"variants":["StyleMark: Watermark survives style transfer with 82–99% accuracy","Hidden artist ID survives style transfer via StyleMark","Watermark in style stats survives arbitrary style transfer","StyleMark: 82–99% watermark accuracy after style transfer","Artist IDs ride style features through AST: StyleMark"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000742,"raw_usage":{"total_tokens":3312,"prompt_tokens":945,"completion_tokens":2367,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":561,"completion_tokens_details":{"reasoning_tokens":2295}},"tokens_in":561,"tokens_out":2367,"duration_ms":17536,"temperature":1.0,"reasoning_tokens":2295,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T19:05:44.292981+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Train or adapt a pre-trained AST model that matches style without aligning channel-wise means and variances, for example by explicit higher-order distribution matching or attention-only feature fusion, then run StyleMark; if the recovered 30-bit watermark accuracy falls from above 80% toward 50%, the shared-statistics hypothesis is falsified.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides HiDDeN, the first deep watermarking baseline that StyleMark compares against and surpasses on AST robustness."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides FIN, a state-of-the-art watermarking baseline that fails under AST and is used as a comparison point."},{"cited_title":"Y.; and Lee, K","cited_arxiv_id":null,"evidence_quote":"Supplies SANet, one of the black-box AST models used to test whether StyleMark generalizes beyond the white-box AdaIN."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies FakeTagger, a provenance-tracking watermarking method used both as a baseline and as a tool in the watermark-rewriting attack evaluation."}],"review_version":1}