{"id":"30f2be41-db88-4859-8a3b-14a911adca9b","arxiv_id":"2504.15026","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"Gaussian Shading++ hides an invisible watermark in diffusion images using a fixed key, storing the random seed in a pseudorandom error-correcting header and improving extraction with soft-decision decoding.","lead":"The paper proposes a watermarking method for AI-generated images that stays invisible, uses a single fixed key, and still works when users change generation settings. It combines a coded header that carries a random seed, a soft-decision decoder, and a public-key signature for third-party verification.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"AWGN channel model with fixed sigma=sqrt(3/2) is unvalidated; if Exact Inversion residuals under guidance mismatch are not Gaussian with this variance, the claimed near-optimal soft-decision decoding lacks support.","rationale":"The reader's weakest_assumption identifies the same load-bearing point: the entire soft-decision decoding pipeline is derived from an unvalidated AWGN model with fixed variance. This is the right concern because it sits directly under the paper's headline claim that robustness across varying generation parameters is 'ensured' by the noise modeling. The experimental results in Tab. VI are encouraging, but they compare only end-to-end bit accuracy; they do not establish that the model used in Eq. 8 is correct. If the real residual distribution under guidance mismatch is heavy-tailed, correlated, or biased, then the MAP optimality argument collapses even though the heuristic soft decision may still work reasonably. The proposed test is concrete and would settle the question: measure the actual residuals and compare the extraction accuracy obtained with the assumed versus empirically estimated noise model. The paper's internal inconsistency in Eq. 12 (repetition count equals capacity rather than the replication factor) is a further sign that the formal derivation needs scrutiny, though it may be a fixable typo. Overall, the conditional verdict remains appropriate: the central idea is plausible and the experiments support an incremental advance, but the theoretical grounding of the soft-decision contribution needs validation or revision before the 'near-optimal' and 'strong robustness' claims can be accepted at face value.","tokens_in":33143,"tokens_out":14808,"duration_ms":147605,"concrete_test":"Generate a fixed set of watermarked images with known z_T for guidance scales 3, 6, 9, 12, and 15, then run Exact Inversion at guidance 3 as in the paper. Compute the residual r = z'_T - z_T across all latent coordinates and check whether r is approximately zero-mean Gaussian with variance 3/2 (via QQ plots, variance estimate, and spatial autocorrelation). Then repeat watermark extraction using the empirical posterior or per-scale empirical variance instead of Eq. 8. If bit accuracy changes by less than one percentage point on the Tab. VI distortion matrix, the AWGN assumption is not load-bearing; if it changes materially, the soft-decision decoding claim must be revised or the fixed sigma must be justified empirically.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central robustness contribution rests on Eq. 8, where the posterior estimate is computed as erf(z'_T / sqrt(2*sigma^2*(1+sigma^2))) with sigma=sqrt(3/2), and on the LLR aggregation in Eqs. 10-14. These formulas are exact only if the difference between the true watermarked latent z_T and the inverted latent z'_T is zero-mean additive white Gaussian noise with variance sigma^2=3/2, independent across dimensions. The paper never measures this residual, nor does it validate the noise distribution under the exact deployment conditions it targets: generation with guidance scales 3, 6, 9, 12, 15 followed by inversion at fixed guidance 3 (Sec. V-C5). Exact Inversion errors are known to be prompt- and guidance-dependent rather than i.i.d. Gaussian, so the assumed noise model may be substantially misspecified. If misspecification is severe, the 'near-optimal MAP decoding' claim is not established, and the observed robustness gains over hard-decision decoding cannot be attributed to the AWGN model. A separate internal inconsistency compounds this: Eq. 12's repetition count is given as ch*h*w/(2*fch*fhw^2), which equals the watermark capacity q=256 for the default v=1, fch=2, fhw=4, whereas the stated replication construction implies only fch*fhw^2=32 repetitions per bit. The derivation as written is therefore not self-consistent.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes Gaussian Shading++, a watermarking scheme for latent diffusion models that addresses three deployment challenges: fixed-key performance-lossless embedding, robustness to mismatched generation parameters, and third-party verifiability. The latent space is split into a PRC channel, which encodes a freshly sampled seed using pseudorandom error-correcting codes, and a GS channel, which embeds the watermark encrypted by a stream cipher derived from that seed. Extraction uses Exact Inversion followed by a soft-decision decoder derived from an AWGN channel model, and a public-key signature (ECDSA) is added for public verification. The paper claims a provable performance-lossless guarantee via an IND$-CPA security proof and reports experiments on SD V2.1 showing improved robustness over PRCW under guidance-scale mismatch and state-of-the-art distribution preservation.","tokens_in":33501,"tokens_out":7537,"duration_ms":64576,"significance":"If the claims hold, this is a practically valuable contribution: it is the first scheme I am aware of that combines a fixed watermark key with per-image pseudorandomness, explicit robustness to unknown guidance scales, and public verification in one latent-space watermarking framework. The manuscript deserves credit for shipping a formal security proof sketch (Theorem 1), an extensive robustness evaluation against six distortions and five removal attacks, a normality-test battery on 80,000 latent vectors, and an ablation study isolating the PRC, the soft-decision decoder, and channel placement. The distribution-preserving sampling argument in Sec. IV-B3 is clean and correctly reduces performance losslessness to pseudorandomness of the driving bitstream. However, the central robustness contribution is built on an AWGN residual model whose variance is asserted rather than measured, and a formula inconsistency in the repetition-count derivation weakens the decoding description; these issues must be resolved before the results can be fully trusted.","major_comments":[{"comment":"The AWGN channel model with fixed noise standard deviation sigma = sqrt(3/2) is asserted without empirical validation. The posterior estimate m'_z = erf(z'_T / sqrt(2*sigma^2*(1+sigma^2))) and the entire soft-decision decoding pipeline in Eqs. (10)-(14) are exact only if the residual z'_T - z_T is zero-mean i.i.d. Gaussian with variance sigma^2 across all latent dimensions. The paper never measures this residual, and it is especially important to validate the model under the target deployment condition of Sec. V-C5, where the guidance scale during generation is 3, 6, 9, 12, or 15 while inversion is always at guidance 3. Exact Inversion residuals are known to be prompt- and guidance-dependent rather than i.i.d. Gaussian, so the model may be substantially misspecified; without a residual distribution analysis, the claimed near-optimal MAP decoding is not established.","section":"Sec. IV-C1, Eq. (8)"},{"comment":"The repetition count in Eq. (12) is given as num = ch*h*w/(2*fch*fhw^2), which for the default settings (ch=4, h=w=64, fch=2, fhw=4) equals 256. This is the watermark capacity q, not the number of repetitions per bit. According to the construction in Sec. IV-B2, each watermark bit is replicated fch*fhw^2 = 32 times. As written, Eq. (12) sums 256 terms rather than 32, which is internally inconsistent with the stated replication construction and would overcount the LLR aggregation by a factor of 8. Please correct the formula or clarify what 'num' denotes.","section":"Sec. IV-C3, Eq. (12)"},{"comment":"The hybrid argument replaces H(seed||skc) with a random string by arguing that an adversary would need to query the random oracle at exactly seed||skc, and that each query hits the correct input with probability at most 2^{-k} because skc is a k-bit secret. This argument neglects the information about seed that the adversary obtains from the observed PRC codeword G*seed XOR e. A rigorous reduction must show that recovering seed from the PRC codeword (or otherwise identifying seed||skc) is hard under the stated LPN/PRC assumptions. As written, the proof of IND$-CPA security has a gap in step (1), which is load-bearing for the provable performance-lossless claim.","section":"Sec. IV-D, Proof step (1)"},{"comment":"The parameters of the pseudorandom error-correcting code are not specified. The KeyGen procedure in Sec. II-E requires (n, g, t, r), and the Encode procedure uses a Bernoulli noise rate eta, but Sec. V-A2 only states that a 32-bit seed is encoded. Without these values (block length, sparsity, number of parity checks, and noise rate), the PRC channel's error-correction capability and pseudorandomness regime cannot be assessed, and the experiments are not reproducible. Please report the exact PRC parameters used in the main experiments and ablations.","section":"Sec. V-A2 and Sec. II-E"}],"minor_comments":[{"comment":"The sentence 'with traceability accuracy remaining above 70%' is technically true only for the non-filtering distortions (all values are at least 0.714), but juxtaposed with the 0.158 and 0.358 values for GauBlur and MedFilter it may mislead a casual reader; consider stating the filtered cases explicitly in the text.","section":"Sec. V-B2, Table I"},{"comment":"The K-S statistic for Gaussian Shading++ is printed as '2.2996 / 0.4922' without the negative exponent, which makes it appear inconsistent with the PRCW row (2.3074e-5 / 0.4877). Use consistent scientific notation in the table.","section":"Table V"},{"comment":"The claim that the first-order approximation of arctanh 'shows negligible performance difference' is not supported by any numerical comparison in the paper; either provide the comparison or soften the claim to 'empirically small difference'.","section":"Eq. (14)"},{"comment":"The proof assumes that skc remains secret, but in the Third-party Verification scenario (Sec. IV-A) skc is made public together with (P, G). The manuscript correctly notes at the end of Sec. IV-D that undetectability is not claimed in that setting, but this distinction should be stated at the beginning of the proof to avoid an apparent contradiction.","section":"Sec. IV-D and Sec. IV-A"},{"comment":"The axis labels are garbled with placeholder-like unicode symbols (e.g., '10010 3 10 6 10 9 10 12 /uni00000029/...'). Replace them with proper mathematical notation such as '10^{-3}', '10^{-6}', and standard curve labels.","section":"Fig. 6 and Fig. 7"}],"recommendation":"major_revision","confidential_remarks":"The paper is a solid incremental extension of Gaussian Shading and PRCW, and the idea of encoding the seed in a PRC header is natural and useful. My main concerns are technical: the AWGN residual model needs direct empirical validation, the repetition-count formula needs correction, and the IND$-CPA proof step (1) needs a proper reduction. These are fixable within the scope of a revision. I would encourage the editor to ask for the missing PRC parameters and a residual-distribution analysis before acceptance."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The paper is a solid incremental advance over Gaussian Shading and PRCW. The double-channel design—PRC-encoded seed header plus GS payload—solves the fixed-key problem cleanly, and the measured robustness gains under guidance-scale mismatch are believable. The soft-decision decoding is standard MAP for repetition codes, but the first-order arctanh approximation is a sensible practical choice and the ablations show it clearly beats hard decisions. The ECDSA extension is straightforward, and the third-party forgery experiments are honest about its limits. The security proof is a plausible hybrid argument, the experiments cover a reasonable range of distortions, removal attacks, guidance scales, and ablations, and the limitations section names the real bottlenecks (PRC channel, similar-proxy forgery, inversion cost). The citation pattern is fine; self-citation points to a genuine predecessor. The soft spots: The AWGN assumption with sigma = sqrt(3/2) is asserted and never validated. The paper never measures the residual between true and inverted latents, especially under guidance mismatch, and Exact Inversion errors are known to be prompt- and guidance-dependent rather than i.i.d. Gaussian. The observed robustness gains may survive even if the noise model is misspecified, but the 'near-optimal MAP decoding' claim is stronger than the evidence. That needs an empirical residual analysis or at least a sensitivity check on sigma. There's also an internal inconsistency: Eq. 12 gives the repetition count as ch*h*w/(2*fch*fhw^2), which for default settings equals the watermark capacity q=256, while the replication construction implies 32 repetitions per bit. That is off by a factor of 8; the implementation likely uses the correct count, but the math as written is wrong. The Sec. V-B2 claim that traceability stays above 70% after ECDSA under other conditions is technically qualified but the phrasing is generous given GauBlur 0.158 and MedFilter 0.358; it should be tightened. No code or parameters are shipped; for a deployment-focused paper that hurts reproducibility. Who is this for: researchers on latent-space watermarks for diffusion models, especially those handling deployment constraints like fixed keys and user-chosen parameters. They'll get a useful reference point and a fair empirical comparison. It deserves a serious referee with revisions, not a desk reject. I'd send it out and ask for noise-model validation, the Eq. 12 fix, and code release.","headline":"A solid incremental advance that fixes key management for performance-lossless diffusion watermarks and shows clear robustness gains under guidance mismatch, but the AWGN noise model is asserted rather than validated and one decoding equation has a real off-by-factor-8 error.","tokens_in":804,"tokens_out":1625,"would_cite":true,"duration_ms":33720,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Gaussian Shading++ claims a fixed-key, performance-lossless watermark for diffusion images that also survives changed generation parameters and supports third-party verification.","keywords":["diffusion model watermark","performance-lossless watermark","pseudorandom error-correcting codes","soft decision decoding","AWGN channel","latent representation watermarking","third-party verification","guidance scale robustness"],"falsifier":"Generate watermarked images with known seeds, run the full extraction pipeline, and replace the fixed-variance Gaussian posterior estimate with a decoder built from the empirical distribution of the residual $z'_T - z_T$ measured on a held-out set; if the empirical decoder gives substantially higher bit accuracy, then the fixed AWGN model is the wrong assumption. A simpler diagnostic is to estimate the residual variance separately for each guidance scale used during generation: if it moves with the guidance scale instead of staying at $\\sigma^2=3/2$, the model is an approximation rather than the true channel.","tokens_in":32969,"feed_emoji":"🖼️","tokens_out":9702,"duration_ms":84762,"temperature":0.7,"pith_summary":"The paper introduces a watermarking scheme for diffusion-generated images that targets three deployment problems at once: watermarking should not shift the distribution of generated images, it should work with one fixed key instead of a unique key per image, and it should stay readable when the user's generation settings (notably the guidance scale) differ from the settings used during verification. The central idea is to split the latent space into two channels: a header channel encodes a freshly sampled random seed with pseudorandom error-correcting codes, and a payload channel encrypts and repeats the actual watermark under a stream key derived from that seed. Because the seed changes with every image, the watermark ciphertext stays pseudorandom even though the key is fixed; because the bit-to-latent mapping preserves the Gaussian distribution, watermarked latents are statistically indistinguishable from normal samples. During extraction the paper models the entire generation-plus-inversion loop as an additive white Gaussian noise channel with $\\sigma=\\sqrt{3/2}$ and decodes the payload through soft-decision log-likelihood aggregation, which is what keeps the watermark alive under mismatched parameters. If the claims hold, the scheme would remove key management and parameter sensitivity as blockers to real-world deployment, and a public-key signature variant would allow any third party to verify ownership.","feed_headline":"Fixed-key watermark stays lossless and survives parameter shifts","feed_subtitle":"Two-channel embedding keeps images normal while soft-decision decoding survives changed guidance scales.","key_machinery":"The carrying mechanism is a double-channel watermark in the latent space, with one channel as the header and one as the payload. The header channel uses an LDPC-based pseudorandom error-correcting code to encode a fresh random seed; this seed, together with a private key, drives a pseudorandom generator whose output encrypts the diffused watermark in the payload channel. Distribution-preserving sampling then maps the combined pseudorandom bit string into latent values by inverse cumulative-distribution intervals, so the watermarked latents follow $\\mathcal{N}(0,I)$ exactly rather than being merely close to normal. For extraction, the paper uses exact inversion to recover $z'_T$, estimates each latent symbol by the AWGN posterior with $\\sigma=\\sqrt{3/2}$ through the error function, and aggregates repeated watermark bits into LLRs, whose sign is the final decoded bit.","core_discovery":"The paper's central claim is that latent-space diffusion watermarking no longer needs to trade losslessness against key simplicity or robustness. It asserts that by encoding a fresh random seed in a PRC-protected header and using that seed to drive the Gaussian-Shading payload channel, the whole watermark ciphertext is pseudorandom under a fixed key, and the proof reduces performance-losslessness to the IND$-CPA security of the construction. On recovery, it asserts that the distortions of generation and inversion can be treated as an AWGN channel, allowing each repeated payload bit to be summarized by a posterior expectation and combined into a log-likelihood ratio, a soft-decision rule that performs near MAP decoding. The paper reports that this soft decoding is what lifts robustness under guidance-scale mismatch relative to the hard-decision PRCW baseline. Finally, it claims that adding a public-key signature to the payload enables any third party to verify and trace images while providing partial resistance to reprompt forgery, at the explicit cost of no longer offering undetectability in that public mode.","pith_inferences":["The paper leaves implicit that the fixed $\\sigma=\\sqrt{3/2}$ could be replaced by an adaptive noise estimate per image, which would likely extend the guidance-scale range and attack classes the soft-decision decoder can handle.","The latent-normality evidence is marginal, so a stronger check on performance-losslessness would test conditional independence between header and payload channels, not only the marginal normality of the full latent vector.","The operator and third-party modes are different security targets; a future design could separate them with a key hierarchy so that public verification does not force the watermark to give up undetectability against the operator.","The AWGN model plus repetition coding gives a closed-form capacity-robustness tradeoff; platform operators could use it to select replication factors and false-positive thresholds analytically instead of by experiment."],"forward_implications":["A deployed service can keep a single watermark key and still embed a fresh pseudorandom watermark into every image, so tracing a user no longer requires per-image key storage or transmission.","A verification pipeline can run without knowing the user's guidance scale; the reported experiments hold up across generation guidance 3 to 15 while inversion stays at guidance 3, where the hard-decision baseline degrades sharply.","Because the ciphertext is IND$-CPA secure and the latent distribution is preserved, the watermark adds no measurable FID or CLIP-Score shift, which supports its use in quality-sensitive commercial generation.","Public verification with ECDSA lets an arbitrary third party authenticate an image using only a public key, and roughly reduces the success of reprompt forgery attacks in the tested settings, though similar-parameter proxy models remain a residual risk.","The header channel is the robustness bottleneck: when erasure-style attacks such as VQ-VAE reconstruction destroy the seed, the payload cannot be decoded even though the payload channel itself remains strong."],"supporting_citations":[{"why":"Supplies the base Gaussian Shading mechanism and distribution-preserving sampling that the GS Channel builds on; also the per-image key baseline that this paper overcomes.","marker":"[27]"},{"why":"The PRCW scheme establishes the fixed-key performance-lossless approach and provides the comparison baseline whose robustness collapses under guidance-scale mismatch; PRC Channel inherits its encoding idea.","marker":"[28]"},{"why":"Defines pseudorandom error-correcting codes based on sparse LDPC matrices and supplies the pseudorandomness guarantee used to prove the header indistinguishable from random.","marker":"[29]"},{"why":"Provides Exact Inversion, the latent-recovery step that makes posterior estimation and soft-decision decoding possible.","marker":"[31]"},{"why":"Identifies reprompt forgery attacks against public watermarks, the threat that motivates the ECDSA third-party verification design.","marker":"[33]"},{"why":"Public-key signature (ECDSA) is used to sign user information and enable any third party to verify authenticity while resisting forgery.","marker":"[34]"},{"why":"Supplies the IND$-CPA indistinguishability argument that links pseudorandom ciphertext to performance-lossless distribution of sampled latents.","marker":"[68]"}],"fun_headline_variants":["Fixed-key diffusion watermark: lossless and parameter-robust","Soft-decision decoding keeps diffusion watermark robust","Public-key watermark for diffusion: lossless and verifiable","Two-channel design: lossless watermark, no key management","Gaussian Shading++: robust watermark without key hassle"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that everything between embedding and extraction behaves like additive white Gaussian noise with one fixed variance, $\\sigma^2=3/2$; if the real distortion, especially at mismatched guidance scales, is non-Gaussian or has a different variance, the claimed near-optimality of the soft-decision decoder is not guaranteed.","fun_headline_variants_meta":{"raw":{"variants":["Fixed-key diffusion watermark: lossless and parameter-robust","Soft-decision decoding keeps diffusion watermark robust","Public-key watermark for diffusion: lossless and verifiable","Two-channel design: lossless watermark, no key management","Gaussian Shading++: robust watermark without key hassle"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000353,"raw_usage":{"total_tokens":1942,"prompt_tokens":984,"completion_tokens":958,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":600,"completion_tokens_details":{"reasoning_tokens":879}},"tokens_in":600,"tokens_out":958,"duration_ms":7976,"temperature":1.0,"reasoning_tokens":879,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-16T11:35:19.138590+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Generate watermarked images with known seeds, run the full extraction pipeline, and replace the fixed-variance Gaussian posterior estimate with a decoder built from the empirical distribution of the residual $z'_T - z_T$ measured on a held-out set; if the empirical decoder gives substantially higher bit accuracy, then the fixed AWGN model is the wrong assumption. A simpler diagnostic is to estimate the residual variance separately for each guidance scale used during generation: if it moves with the guidance scale instead of staying at $\\sigma^2=3/2$, the model is an approximation rather than the true channel.","supporting_citations":[{"cited_title":"An undetectable watermark for generative image models,","cited_arxiv_id":null,"evidence_quote":"The PRCW scheme establishes the fixed-key performance-lossless approach and provides the comparison baseline whose robustness collapses under guidance-scale mismatch; PRC Channel inherits its encoding idea."},{"cited_title":"Pseudorandom error-correcting codes,","cited_arxiv_id":null,"evidence_quote":"Defines pseudorandom error-correcting codes based on sparse LDPC matrices and supplies the pseudorandomness guarantee used to prove the header indistinguishable from random."},{"cited_title":"On exact inversion of dpm-solvers,","cited_arxiv_id":null,"evidence_quote":"Provides Exact Inversion, the latent-recovery step that makes posterior estimation and soft-decision decoding possible."},{"cited_title":"62: public key cryptography for the financial services industry: the elliptic curve digital signature algorithm (ecdsa),","cited_arxiv_id":null,"evidence_quote":"Public-key signature (ECDSA) is used to sign user information and enable any third party to verify authenticity while resisting forgery."}],"review_version":1}