{"id":"ae166217-b5cd-49f5-8e3d-902bb632f63c","arxiv_id":"2412.10049","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":7.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"A training-free watermarking framework that embeds watermarks into diffusion super-resolution noise and extracts them via DDIM inversion, reaching 99.46% bit accuracy under standard distortions and 89.29% under adaptive attacks on MS-COCO.","lead":"SuperMark hides a watermark inside the random noise that a super-resolution diffusion model uses to upscale an image, then recovers it by reversing the upscaling. It reports high robustness to distortions and attacks with no training, using only off-the-shelf super-resolution models.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The extraction pipeline's robustness rests on an unvalidated assumption that DDIM inversion tolerates mismatched low-resolution conditioning; a targeted low-frequency attack could break it.","rationale":"The reader's weakest_assumption correctly identifies the DDIM inversion conditioning mismatch as the load-bearing step. My reading confirms this: the paper's own equations show that extraction conditions on I'_low and on the VAE encoding of I'wm_up, neither of which equals the embedding-time inputs Ilow and Z_0_wm. The citation to text-to-image watermarking robustness is not a substitute for evidence in the image-conditioned SR setting, because in T2I models the prompt is not an attacked object. This is a missing validation rather than an internal inconsistency: the reported experiments do show high accuracy under the tested distortions, so the assumption may well hold under those conditions. The concern is that the tested attacks do not isolate the conditioning path, leaving open the possibility that a low-frequency-targeted attack breaks the method. Therefore the appropriate verdict remains conditional: the central claim is plausible but not yet secured without this ablation or an explicit robustness analysis of the conditioning mismatch. I do not recommend rejection because the empirical results are strong and the proposed test is straightforward to run. Secondary issues such as missing code and error bars reinforce conditionality but are not the load-bearing concern.","tokens_in":15970,"tokens_out":5072,"duration_ms":58890,"concrete_test":"Run a controlled ablation on the default 500-image COCO set: for each clean watermarked image, perform DDIM inversion under three conditionings: (a) the original Ilow, (b) I'_low = downscale(Iwm) as in the paper, and (c) I'_low obtained from a strongly low-pass filtered or heavily JPEG-compressed version of Iwm. Compare watermark bit accuracy. If (a)~(b)~(c), the conditioning mismatch is benign. If (c) drops substantially below the reported 99.46% while (a) remains high, then the method's robustness depends on the low-res conditioning surviving the attack, and an adaptive attack that perturbs only low-frequency content should be added to the evaluation. Report bit accuracy per condition over the same images.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The headline robustness numbers (99.46% normal, 89.29% adaptive) depend on DDIM inversion recovering the watermarked noise from a distorted image under an input-conditioning mismatch. In embedding (Sec. 3.3), the SR model M denoises Z_T_wm conditioned on Ilow, the original downscaled cover image. In extraction (Sec. 3.4), M is inverted from Z'_0_wm = E(I'wm_up) conditioned on I'_low, a downscaled, distorted version of the watermarked image Iwm. Unlike Tree-Ring/Gaussian Shading in text-to-image models, where the text prompt is fixed and known at extraction, here the conditioning input is itself derived from the attacked image and is never equal to Ilow. Moreover, Iwm is not the SR output: Eq. (3) adds only fs=0.4 of the residual Isr-Iori, so inversion starts from a VAE encoding of a blended image (0.6 Iori + 0.4 Isr), not from the clean SR output. The paper cites 'inherent robustness of DDIM inversion' (Secs. 3.1, 3.4) but provides no analysis or ablation isolating this conditioning mismatch. The evaluated distortions and attacks do not specifically target the low-resolution conditioning path, so the central assumption remains untested exactly where it is weakest.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes SuperMark, a training-free watermarking framework that composes existing Gaussian-noise watermarking methods (Gaussian Shading, Tree-Ring) with a pre-trained diffusion-based super-resolution model. Watermark embedding injects the watermark into the initial Gaussian noise used by the SR model to upsample a downscaled cover image, and the watermarked image is formed as a blend of the original and the super-resolved output (Eq. 3). Extraction performs DDIM inversion on the (possibly distorted) watermarked image, using a downscaled and upscaled version of the attacked image as conditioning, to recover the initial noise and decode the watermark. The paper reports extensive experiments on 500 COCO images and four other datasets, claiming 99.46% extraction accuracy under normal distortions and 89.29% under adaptive attacks, with PSNR 32.50 and SSIM 0.93, plus transferability across SR models, injection methods, datasets, and resolutions.","tokens_in":16261,"tokens_out":5941,"duration_ms":57896,"significance":"If the empirical claims hold, SuperMark is a significant contribution to post-processing watermarking: it requires no training, composes existing watermark-injection techniques, and shows robustness against standard distortions and generative attacks. The framework is flexible, and the ablations over strength factor, low-resolution size, steps, and bit length are useful. However, the paper's central mechanism—robustness of DDIM inversion under a conditioning mismatch—is not theoretically or experimentally isolated, and the fidelity claim in the abstract is overstated relative to Table 1. The evaluation also lacks error bars or significance tests, which matters for the comparisons where the margins are small.","major_comments":[{"comment":"The extraction pipeline inverts the SR model from Z'_0_wm = E(I'^up_wm) conditioned on I'_low, a downscaled, distorted version of the watermarked image, rather than the original Ilow used at embedding; moreover, Eq. (3) means Iwm is only a 40% blend of the SR residual, so inversion does not start from the clean SR output. The paper's citations to text-to-image watermarking works (Wen et al., Yang et al.) demonstrate DDIM-inversion robustness only when the conditioning (text prompt) is fixed and known, which is not the case here. The paper should provide an analysis or a dedicated experiment (e.g., attacking only the conditioning path, or varying the conditioning mismatch) to validate that inversion remains accurate under this mismatch; without it, the central robustness claim is not substantiated in the exact regime where the method is weakest.","section":"Sec. 3.3–3.4, Eq. (3)"},{"comment":"The claim that SuperMark achieves fidelity \"comparable to existing methods\" is not supported by Table 1. SuperMark's PSNR (32.50) and SSIM (0.93) are lower than most baselines (MBRS 43.25/0.987, CIN 41.74/0.979, RivaGAN 40.53/0.979, PIMoG 37.46/0.977, SepMark 35.91/0.952, DwtDctSvd 38.11/0.973); only StegaStamp (28.69) and RoSteALS (28.34) have lower PSNR. The phrasing \"comparable\" should be qualified to \"comparable to the most robust baselines (StegaStamp and RoSteALS)\" or the fidelity comparison should be presented with appropriate context, since the robustness-fidelity trade-off is a load-bearing part of the paper's central claim.","section":"Abstract and Table 1"},{"comment":"All reported numbers are mean bit accuracies over 500 randomly selected images, but the paper provides no standard deviations, confidence intervals, or significance tests. This is particularly important for the adaptive-attack comparison with StegaStamp (overall 89.29% vs 96.07%, and per-attack differences are small for Zhao23: 0.87 vs 0.93) and for the claim that SuperMark \"significantly surpasses\" most methods in robustness. Reporting variance or bootstrap confidence intervals would allow readers to judge whether the differences are meaningful.","section":"Sec. 4.1 and Table 1"}],"minor_comments":[{"comment":"The interpolation method used for downscaling and upscaling is not specified; please state it (e.g., bicubic) for reproducibility.","section":"Sec. 3.3"},{"comment":"There are typos: \"inherent roboust extraction\" in Sec. 1 and \"robustneelatively\" in Sec. 4.4.","section":"Sec. 1 and Sec. 4.4"},{"comment":"The caption should state that both SR models are evaluated with 16-bit watermarks (as described in the text) to avoid confusion with the default 32-bit setting in Table 1.","section":"Table 3 caption"},{"comment":"The finding that inversion steps have minimal effect on robustness is surprising given the central role of DDIM inversion; a brief explanation or an additional ablation over a wider range of steps would strengthen the reader's understanding.","section":"Sec. 4.4, Figure 4"},{"comment":"There is a typo in the caption: \"StgeaStamp\" should be \"StegaStamp\".","section":"Appendix A.3, Figure 7"},{"comment":"Figure 2 is difficult to read; enlarging the labels and clarifying the flow between embedding and extraction would improve accessibility.","section":"Figure 2"}],"recommendation":"major_revision","confidential_remarks":"The paper composes existing components (Gaussian Shading, Tree-Ring, DDIM inversion, SD-Upscaler), and the novelty lies primarily in the framework rather than in any new building block. The contribution is publishable if the robustness mechanism is properly validated, but the central conditioning-mismatch assumption needs dedicated experimental support. The authors should also make code and random subsets public to support reproducibility. The comparison with ZoDiac relies on numbers from the original paper; that is acceptable but should be stated clearly in the text."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"SuperMark is a genuinely clever composition: embed the watermark in the initial noise of a pretrained diffusion SR model, then extract it by DDIM inversion. The trick is real—they show it works across datasets, SR models, injection methods, and resolutions, with bit accuracies in the high 90s under normal distortions and high 80s under strong learned compression and diffusion editing attacks. That is the main thing to know.\n\nWhat is actually new: the paper treats a super-resolution diffusion model as a watermarking engine without any training. The residual blending (Iori + fs*(Isr - Iori)) is a neat way to manage fidelity, and the framework is modular: swap Gaussian Shading for Tree-Ring, swap SD-Upscaler for LDM-SR, and it still works. The paper also honestly discusses inference overhead and points to acceleration methods.\n\nWhere it gets soft. First, the fidelity claim in the abstract ('comparable to existing methods') is misleading relative to Table 1. SuperMark's PSNR is 32.5; most baselines sit in the high 30s to 43. It beats only StegaStamp and RoSteALS. That needs rewording. Second—and this is the load-bearing issue—the extraction pipeline relies on DDIM inversion tolerating a conditioning mismatch. At embedding, the model sees Ilow; at extraction, it sees a downscaled, distorted version of the blended watermarked image. The paper cites the robustness of DDIM inversion from text-to-image works, but those keep the prompt fixed. Here the conditioning input is derived from the attacked image and is never equal to the embedding-time input. The paper never ablates this. The empirical results are encouraging, but no attack targets the conditioning path directly (e.g., heavy low-pass filtering before downscaling). I'd want a dedicated experiment on that before trusting the 89% adaptive-attack number as a guarantee.\n\nThird, the headline numbers come from hyperparameters (fs, Slow) selected on the same COCO test set, with no error bars or significance tests. Fourth, no code is released, which hurts reproducibility for a method that is otherwise embarrassingly simple.\n\nNone of this kills the paper. The central idea is sound enough to deserve a serious referee. The citation pattern is fine; the self-reference to Robust-Wide is not load-bearing. A revision should fix the fidelity wording, add an ablation on the conditioning mismatch (or a theoretical argument), report variance, and release code.","headline":"SuperMark is a clever training-free watermarking scheme built on diffusion SR and DDIM inversion; the empirical case is strong, but the inversion-under-mismatched-conditioning assumption is not properly examined and the fidelity framing is misleading.","tokens_in":16768,"tokens_out":3158,"would_cite":true,"duration_ms":33943,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"SuperMark claims that a pretrained super-resolution diffusion model, with no fine-tuning, can embed watermarks in its initial noise and recover them from distorted images by DDIM inversion, reaching 99.46% bit accuracy under normal…","keywords":["image watermarking","diffusion models","super-resolution","DDIM inversion","training-free watermarking","Gaussian Shading","Tree-Ring watermark","robustness"],"falsifier":"Take the default COCO test set and apply a distortion outside the reported suite—for example, JPEG at quality 10, a 45° rotation with no cropping, or a 50% center crop—then measure bit accuracy. If any such common distortion drives accuracy to near chance (50%) while a trained scheme such as StegaStamp retains high accuracy, the claim that DDIM inversion is inherently robust would be refuted.","tokens_in":15797,"feed_emoji":"🖼️","tokens_out":6764,"duration_ms":65408,"temperature":0.7,"pith_summary":"SuperMark sets out to break the robustness–fidelity trade-off that plagues trained encoder–decoder watermarking systems by removing training altogether. The paper's central claim is that a pretrained diffusion-based super-resolution model can act as both embedder and extractor: the watermark is written into the initial Gaussian noise, the model denoises that noise into a watermarked image, and DDIM inversion of a distorted copy recovers enough of the original noise to read the message. On 500 MS-COCO images the pipeline reports 99.46% average bit accuracy under JPEG, cropping, blur, noise, and brightness changes, and 89.29% under VAE-based and diffusion-based adaptive attacks, with PSNR 32.49 and SSIM 0.93. If true, the result matters because watermarking could ride on off-the-shelf generative models rather than bespoke trained decoders, and would inherit improvements in super-resolution automatically.","feed_headline":"No-training watermark hits 99.46% accuracy after distortion","feed_subtitle":"SuperMark embeds messages in a super-resolution model's starting noise and reads them back by DDIM inversion.","key_machinery":"The central object is DDIM inversion of a latent diffusion super-resolution model. DDIM gives a deterministic map from Gaussian noise to image, and its inverse reconstructs the starting noise from an image; SuperMark exploits the observation, borrowed from text-to-image watermarking, that this inverse is stable under perturbation. The watermarking front-end is Gaussian Shading—bit strings converted into a Gaussian-preserving sampling of the noise, so fidelity is untouched—or Tree-Ring for ring patterns in Fourier space. The SR model's conditioning on a low-resolution image is what keeps the denoised output close to the cover image: the original is downscaled, denoised to a larger version, downscaled again, and only a fraction $f_s$ of that residual is added back, balancing fidelity and robustness. No network is trained or fine-tuned.","core_discovery":"The paper claims that watermark embedding/extraction and diffusion denoising/noising are two sides of the same reversible transformation. Concretely, it embeds a 32-bit message into the initial Gaussian noise of SD-Upscaler, a pretrained latent diffusion super-resolution model, using Gaussian Shading's bit-to-noise sampling; the model's determinism lets DDIM inversion map a distorted watermarked image back to the watermarked noise, from which the message is read by voting over replicated copies. The authors report an average 99.46% bit accuracy across five normal distortions, 89.29% across four adaptive attacks (VAE compression and diffusion editing), and fidelity comparable to trained baselines, with transfer across datasets, SR models, injection schemes, and resolutions. The load-bearing assertion is that the DDIM inversion of the distorted image, conditioned on its own downscaled version rather than the original low-resolution input, still recovers the watermarked noise.","pith_inferences":["A natural stress test the paper does not run: distortions that break the conditioning assumption, such as severe cropping that removes most of the image or resizing to a different aspect ratio, could drop accuracy sharply; measuring that boundary would map the method's true envelope.","The same 'watermark in noise, recover by inversion' recipe may transfer to other image-conditioned diffusion tasks—restoration, inpainting, or editing—turning any deterministic conditional diffusion model into a general post-hoc watermarking channel for real images.","If DDIM inversion is the bottleneck, the paper's own extension logic suggests that exact-inversion solvers or single-step distilled SR models could make extraction faster and more accurate; the reported numbers are a floor, not a ceiling.","Because the watermark is embedded as a fraction of the SR residual, the method implicitly concentrates the message at semantic edges; an editor's smoothing filter targeted at edges is a plausible adaptive attack not tested here."],"forward_implications":["Because the SR model is frozen and interchangeable, any improved diffusion-based super-resolution model should directly improve SuperMark's fidelity and robustness—the paper demonstrates this by swapping SD-Upscaler for LDM-SR.","The watermarking scheme is not tied to one injection method: switching from Gaussian Shading to Tree-Ring gives SuperMark near-perfect robustness to 90° rotation, which the default scheme lacks.","Higher-resolution cover images support longer messages (up to 72 bits at 768×768 in the paper's tests) with essentially unchanged robustness, because higher-resolution super-resolution leaves more recoverable pixels.","Because extraction is inversion rather than classification, the method carries no trained decoder to attack; adaptive attacks that fool trained decoders reduce accuracy only from about 99% to about 89%.","The framework can be applied after generation to both real and synthetic images, which is broader than in-generation watermarking."],"supporting_citations":[{"why":"Supplies DDIM, the deterministic sampling scheme whose reversibility underlies inversion-based extraction.","marker":"Song et al. (2021)"},{"why":"Supplies Tree-Ring, the noise-domain watermark injection and DDIM-inversion extraction scheme that SuperMark adopts for geometric robustness tests.","marker":"Wen et al. (2024)"},{"why":"Supplies Gaussian Shading, the default watermark injection method that maps bits to Gaussian-preserving noise for provable fidelity.","marker":"Yang et al. (2024)"},{"why":"Supplies latent diffusion models, the architecture underlying the SD-Upscaler SR model used for embedding and inversion.","marker":"Rombach et al. (2022)"},{"why":"Supplies DDIM inversion as an editing technique, the procedure SuperMark reuses to recover watermarked noise from a real image.","marker":"Mokady et al. (2023)"},{"why":"ZoDiac is the closest prior work embedding watermarks in Gaussian noise with a diffusion model; SuperMark compares against it and avoids its per-image optimization.","marker":"Zhang et al. (2024)"},{"why":"InstructPix2Pix is one of the adaptive diffusion attacks used to test robustness, alongside VAE codecs.","marker":"Brooks et al. (2023)"}],"fun_headline_variants":["Training-free watermark hits 99.46% accuracy via SR and DDIM","SuperMark: DDIM inversion yields robust watermark without training","Watermark survives distortion: 99.46% accuracy with DDIM","No-training watermark embeds in SR noise, reads via DDIM"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"Extraction assumes DDIM inversion of a distorted image still returns the watermarked starting noise, even though the inversion is conditioned on the distorted image's own downscaled copy rather than on the exact low-resolution image used when embedding.","fun_headline_variants_meta":{"raw":{"variants":["Training-free watermark hits 99.46% accuracy via SR and DDIM","SuperMark: DDIM inversion yields robust watermark without training","Watermark survives distortion: 99.46% accuracy with DDIM","No-training watermark embeds in SR noise, reads via DDIM"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000493,"raw_usage":{"total_tokens":2467,"prompt_tokens":1033,"completion_tokens":1434,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":649,"completion_tokens_details":{"reasoning_tokens":1370}},"tokens_in":649,"tokens_out":1434,"duration_ms":11282,"temperature":1.0,"reasoning_tokens":1370,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T16:24:35.389324+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take the default COCO test set and apply a distortion outside the reported suite—for example, JPEG at quality 10, a 45° rotation with no cropping, or a 50% center crop—then measure bit accuracy. If any such common distortion drives accuracy to near chance (50%) while a trained scheme such as StegaStamp retains high accuracy, the claim that DDIM inversion is inherently robust would be refuted.","supporting_citations":[],"review_version":1}