{"id":"b510b4aa-0998-48ec-a938-0f450ed55d9d","arxiv_id":"2507.04495","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"high","formal_verification":"none","parameter_count":4,"one_line_summary":"By cropping an image and adding a learned error-painting correction module, an off-the-shelf 64-bit watermarking model is claimed to carry 2048-bit signatures with 86.3% zero-bit-error image rate under JPEG compression.","lead":"README cuts an image into patches, watermarks pieces of a 2048-bit signature into 32 patches, and adds a second set of patches carrying a learned error-painting code that is meant to repair bit errors at extraction. The paper reports raising the zero-bit-error image rate from 1.2% to 86.3% under JPEG compression without retraining an existing watermarking model.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The central claim is causally unsupported: ERPA requires the error vector e = m XOR m~ to be known at signing time, but that vector encodes decoding errors under the distortion that has not yet occurred.","rationale":"The reader's weakest-assumption analysis identifies the same logical gap, and I agree with it: the error vector embedded in B cannot be known at signing time because it is defined from the post-distortion decode. This is not a matter of tuning or missing comparison; it is a causal impossibility in the described protocol. The paper's own text in Sec. 3.2 confirms that e is computed from 'its predicted version m~', and the only plausible source of that prediction during signing is the clean watermarked image, where e is near zero. Since the framework claims to improve JPEG-distorted recovery from 1.2% to 86.3%, the correction data must contain information about JPEG-induced errors, but no mechanism supplies it. I therefore recommend no change to the reader's REJECT verdict, with the central concern stated precisely and a concrete computational test that would settle it.","tokens_in":11061,"tokens_out":4264,"duration_ms":53611,"concrete_test":"Reimplement the README pipeline on 1,000 COCO images using only causal signing-time information: decode each clean A patch to obtain e_clean, encode e_clean into B patches, reassemble, apply JPEG Q=50, decode, and measure Z.B.I.R. If the result remains near the 1.2% baseline instead of 86.3%, the load-bearing assumption fails. As a control, repeat the same pipeline using e computed from the JPEG-degraded A patches; if this oracle version reproduces 86.3%, it confirms that the paper's headline numbers rely on information unavailable to the sender.","verdict_should_be":"UNCHANGED","load_bearing_attack":"In Sec. 3.2, the paper defines e = m XOR m~ and states: 'We assume that the error pattern within patch A is deterministic and consistent during decoding.' It then embeds e into patch B at signing time. At signing, the only m~ the sender can obtain is the output of the watermark decoder on the clean, just-watermarked A patch. The JPEG-degraded m~ that determines the actual bit errors under the tested distortion is produced only later, at verification time. Determinism and consistency do not make an unknown future quantity available; no procedure is given for Alice to compute the error vector caused by a distortion she has not seen. If she embeds the clean-image error vector instead, patch B is essentially a no-op, and row V of Table 2 should collapse toward row IV (Z.B.I.R. 1.2%). The reported 86.3% can only be produced if e is obtained from the distorted image itself, i.e., from an oracle that README cannot access at signing time. Table 5 includes a 'Known Exact Error' oracle for training the decoder, but that does not supply the inference-time error vector. Without a causal source for e, the headline claim is not supported by the described algorithm.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes README, a framework for embedding 2048-bit digital signatures into images using a pretrained 64-bit DNN watermarking model (MBRS) without fine-tuning. Capacity is scaled by cropping the image into an 8x8 grid; 32 patches (A) carry 2048 message bits and 32 patches (B) carry ERPA error-correction information. ERPA computes an error vector e = m XOR m_tilde from the decoded message, encodes it by DCSS painting into B, and a lightweight neural decoder recovers e at verification to correct m_tilde. The headline result is that Z.B.I.R under JPEG Q=50 increases from 1.2% to 86.3% at a 2048-bit payload. The paper also proposes pHash-based signature verification and reports analyses of painting density, DCSS permutation, and decoder training distribution.","tokens_in":11356,"tokens_out":5680,"duration_ms":63310,"significance":"If the causal gap were closed, the result would be significant: it would demonstrate that a pretrained watermarking model can be turned into a reliable carrier for cryptographic payloads without model modification, and the Z.B.I.R metric is appropriate for signature applications. The paper's use of an off-the-shelf MBRS model and the explicit JPEG evaluation are strengths. However, the central ERPA mechanism requires information that is unavailable at signing time, and the pHash verification step requires exact hash equality that is not justified. As it stands, the reported numbers cannot be produced by the described algorithm.","major_comments":[{"comment":"Equation e = m XOR m_tilde defines the error vector from the distorted decoded message. At signing time, Alice has not yet applied JPEG compression and cannot know m_tilde after the distortion. Computing e from the clean decoder output yields approximately the zero vector, so the ERPA correction painted into patch B contains no information about the errors it is supposed to fix. The assumption that the error pattern is 'deterministic and consistent' only says that the same distortion produces the same errors; it does not make the future error pattern available to the encoder. No procedure in the paper supplies e at signing time. Without an oracle, Table 2 row V should collapse to row IV (Z.B.I.R. 1.2%), so the headline 86.3% claim is unsupported.","section":"Sec. 3.2, ERror PAinting Module"},{"comment":"Table 5 compares decoder training regimes including 'Known Exact Error' oracle. That oracle is used during training to supervise the decoder; it does not provide e to the encoder at signing time. The table therefore cannot validate the deployment scenario. The paper needs to specify the exact inference-time input to the ERPA encoder and to demonstrate that this input is computable from the clean image alone. As written, the distinction between training-time oracle and inference-time availability is conflated, and the causal gap from the previous comment remains.","section":"Sec. Experiments, ERPA Analysis, Table 5"},{"comment":"The signature is computed as Sign(sk, pHash(image)), and verification at Bob uses only the watermarked image and public key. A standard digital signature requires the verifier to recompute exactly the same hash value that was signed; 'nearly identical' pHash values are not sufficient. If pHash(watermarked image) differs from pHash(original image) in any bit, signature verification fails. The paper does not provide an error-tolerant signature verification scheme or evidence that pHash is exactly invariant under the tested JPEG distortion. This undermines the public verifiability claim.","section":"Sec. Perceptual Hash-Based Signature Verification"}],"minor_comments":[{"comment":"The DCSS condition as written is unsatisfiable because S1 = S2 gives equal sums; it should require S1 and S2 to be distinct and should specify whether subsequences are considered circularly. This is a local definitional issue but should be corrected for reproducibility.","section":"Eq. (1)"},{"comment":"The text repeats the same SHA-256 sensitivity statement twice, and the claim that pHash values are 'nearly identical' should be made quantitative by specifying the pHash variant and the observed Hamming distance distribution.","section":"Sec. Perceptual Hash-Based Signature Verification"},{"comment":"Rows III and V omit PSNR/SSIM values, so the claim that ERPA preserves visual quality is not quantitatively supported for those configurations.","section":"Table 1"},{"comment":"The acronym expansion 'Deep Water Marking Mod El' is inconsistent with the body's 'Deep WaterMarking ModEl'; please unify the terminology.","section":"Abstract"},{"comment":"No code or reproducibility artifacts are provided; given the causal concern in the major comments, pseudocode for the signing-time computation of e would greatly help the reader assess the method.","section":"General"}],"recommendation":"reject","confidential_remarks":"To the editor: the manuscript's central claim appears to rely on an oracle-based procedure that cannot be instantiated at signing time; this is a load-bearing flaw rather than a presentation issue. I see no minor revision that would repair the information gap without changing the core method. I would not request a major revision unless the authors can demonstrate an actual inference-time source for e, for example by replacing ERPA with a conventional error-correcting code and comparing against a properly implemented ECC baseline."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Dear colleague,\n\nThe headline number does not survive contact with the method. The ERPA module computes the error vector e = m XOR m~ from the decoded patch, then embeds e into a companion B patch at signing time. But m~ for the distorted image only exists at verification time. At signing, the sender only has the clean-image decode, which is error-free by the paper's own Table 1, so e is the zero vector. Without an oracle for the future distortion, patch B carries no information about the errors it is supposed to correct. The reported 86.3% Z.B.I.R. is therefore not derivable from the algorithm as written; row V should collapse toward row IV (1.2%).\n\nThat said, there are legitimate pieces here. The crop-and-then-watermark capacity scaling is a simple, effective trick to multiply payload without retraining, and the DCSS offset construction is a small but tidy combinatorial scheme. The writing is clear, and the evaluation setup (MBRS, COCO, JPEG Q=50) is standard. The pHash-bound signature idea is a reasonable direction, though its stability assumption is untested.\n\nThe other soft spots are secondary to the causal gap but worth noting. The Bernoulli training probability p=0.07 is chosen after seeing Table 5, which is post-hoc selection. There is no comparison with standard error-correcting codes at the same 50% redundancy, a natural baseline. No code or evaluation scripts are released, so the numbers are not independently checkable. The security analysis is brief, and the pHash equality claim needs support.\n\nWho should read this? Someone working on deep watermarking capacity could borrow the cropping idea. But the ERPA mechanism as described is not a working error-correction module, and the framework's central claim is unsupported.\n\nI would still send it to peer review: the flaw is serious but precisely identifiable, and the authors may have an unstated step (e.g., embedding the error vector after a simulated distortion) that could be clarified. If they cannot, the paper should be rejected.\n\nBest.","headline":"The cropping-based capacity scaling is a legitimate small idea, but the ERPA mechanism as written cannot know the error vector it embeds, so the headline 86.3% Z.B.I.R. is unsupported.","tokens_in":11840,"tokens_out":4596,"would_cite":false,"duration_ms":48477,"reading_group":"maybe","serious_thinker":"no","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Perfect watermark recovery jumps from 1.2% to 86.3% for 2048-bit signatures.","keywords":["digital signature","deep watermarking","error correction","image authentication","zero-bit-error rate","perceptual hash","cropping capacity scaling","DCSS"],"falsifier":"Run an honest signing-verification cycle: compute the error vector on the clean image (it will be all zeros), embed it as patch B, then apply JPEG compression and decode; if the zero-bit-error rate is no higher than without ERPA, the reported improvement relies on an oracle that cannot exist at signing time.","tokens_in":10859,"feed_emoji":"🔏","tokens_out":6187,"duration_ms":57622,"temperature":0.7,"pith_summary":"The paper proposes README, a framework for embedding 2048-bit digital signatures into a single image using existing pretrained deep watermarking models, without any fine-tuning. It combines two ideas: cropping the image into patches so a 64-bit watermarker can carry over 4000 bits, and an error-painting module that records where bit errors occur and spreads that information across a companion patch so a learned decoder can correct them. The headline result is that the zero-bit-error image rate, the fraction of images from which every signature bit is recovered exactly, rises from 1.2% to 86.3% under JPEG compression at a 2048-bit payload. If this holds, cryptographic image authentication becomes practical on top of existing watermarkers.","feed_headline":"Perfect watermark recovery jumps from 1.2% to 86.3%","feed_subtitle":"Cropping plus an error-painting module lets 64-bit watermarkers carry 2048-bit signatures without retraining.","key_machinery":"The central machinery is the ERror PAinting Module (ERPA) paired with Distinct Circular Subsum Sequences (DCSS). DCSS is a permutation of a 64-bit circular array with offset set {0,1,3,7,12,20,30} such that no two contiguous subsequences have equal sums modulo 64; each bit error is painted onto these seven offsets, spreading one error into a redundant spatial pattern that a trained single-layer decoder can invert even when the painted positions are themselves corrupted. The cropping strategy that partitions the image into an 8x8 grid is the capacity carrier, effectively turning a 64-bit watermarker into a 4096-bit channel, while ERPA is the reliability carrier that makes that channel usable for zero-bit-error applications.","core_discovery":"On its own terms, the paper establishes that the main obstacle to embedding digital signatures in images is not capacity but bit-level reliability, and that reliability can be restored by a model-agnostic error-correction layer. The authors show that cropping a 1024x1024 image into 64 patches lets an off-the-shelf MBRS watermarker embed 4096 bits, but JPEG compression leaves only 1.2% of images with a perfectly recovered 2048-bit payload. Adding ERPA, which encodes the per-patch error vector into a redundant pattern using Distinct Circular Subsum Sequences and decodes it with a single linear layer, raises that rate to 86.3% while keeping the watermarker frozen.","pith_inferences":["The ERPA protocol as written assumes the error vector for patch A is known when patch B is being written; a practical deployment would have to predict the distortion channel or embed the correction after observing the decoder's output, which the paper does not specify.","The DCSS painting is essentially a combinatorial error-spreading code; comparing it against standard error-correcting codes (e.g., BCH or Reed-Solomon) over the same channel would isolate how much of the gain comes from the learned decoder rather than the spreading pattern.","Because the framework relies on cropping with a uniform grid, it is vulnerable to cropping attacks that misalign the grid; a testable extension would be to make the grid alignment robust or use overlapping patches."],"forward_implications":["Existing pretrained watermarking models, trained for 30-64 bit payloads, can be repurposed for cryptographic payloads without retraining or architecture changes.","A 2048-bit RSA or ECDSA signature can be bound to a perceptual hash of the image and verified with only the public key and the watermarked image, since the hash is stable under benign distortions.","The zero-bit-error image rate, not average bit error rate, becomes the operative metric for security-critical watermarking, since a single flipped bit invalidates a signature.","The cropping pattern localizes errors to individual patches, so error correction complexity scales linearly with payload size rather than requiring a stronger underlying watermarker."],"supporting_citations":[{"why":"MBRS is the pretrained 64-bit watermarking model the framework wraps; all experiments use its frozen weights.","marker":"Jia, Fang, and Zhang 2021"},{"why":"COCO test set supplies the 1k evaluation images for the reported Z.B.I.R and BER numbers.","marker":"Lin et al. 2014"},{"why":"Establishes the public-key cryptography background that motivates 2048-bit signature payloads.","marker":"Diffie and Hellman 1976"},{"why":"RSA is the digital signature scheme whose payload size defines the 2048-bit capacity target.","marker":"Rivest, Shamir, and Adleman 1978"},{"why":"ECDSA is the other signature scheme cited as requiring 2048-bit error-free payloads.","marker":"Johnson, Menezes, and Vanstone 2001"},{"why":"Cited as the recent difficulty result showing robust publicly-detectable watermarks are hard, the gap README targets.","marker":"Fairoze et al. 2025"}],"fun_headline_variants":["Error-painting module lifts perfect watermark recovery from 1.2% to 86.3%","No fine-tuning needed: error painting makes 2048-bit image signatures viable","Proof that watermark reliability, not capacity, gates image signatures","Model-agnostic ERPA turns 1.2% perfect recovery into 86.3% for 2048-bit payloads"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The scheme assumes the bit-error pattern introduced by distortion is known at signing time and can be embedded into a companion patch; on a clean image that error vector is all zeros, and the paper does not explain where the future errors are observed before embedding.","fun_headline_variants_meta":{"raw":{"variants":["Error-painting module lifts perfect watermark recovery from 1.2% to 86.3%","No fine-tuning needed: error painting makes 2048-bit image signatures viable","Proof that watermark reliability, not capacity, gates image signatures","Model-agnostic ERPA turns 1.2% perfect recovery into 86.3% for 2048-bit payloads"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000868,"raw_usage":{"total_tokens":3748,"prompt_tokens":919,"completion_tokens":2829,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":535,"completion_tokens_details":{"reasoning_tokens":2733}},"tokens_in":535,"tokens_out":2829,"duration_ms":21428,"temperature":1.0,"reasoning_tokens":2733,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-06T19:47:31.168485+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run an honest signing-verification cycle: compute the error vector on the clean image (it will be all zeros), embed it as patch B, then apply JPEG compression and decode; if the zero-bit-error rate is no higher than without ERPA, the reported improvement relies on an oracle that cannot exist at signing time.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"MBRS is the pretrained 64-bit watermarking model the framework wraps; all experiments use its frozen weights."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Establishes the public-key cryptography background that motivates 2048-bit signature payloads."},{"cited_title":"L.; Shamir, A.; and Adleman, L","cited_arxiv_id":null,"evidence_quote":"RSA is the digital signature scheme whose payload size defines the 2048-bit capacity target."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"ECDSA is the other signature scheme cited as requiring 2048-bit error-free payloads."}],"review_version":1}