{"id":"cc1de949-62fd-4eda-beda-ac1396ad68c9","arxiv_id":"2605.23994","paper_version":1,"verdict":"UNVERDICTED","confidence":"LOW","novelty_score":6.0,"correctness_risk":"unknown","formal_verification":"none","parameter_count":0,"one_line_summary":"RAW benchmark shows existing watermark methods fail on avatar post-processing like background removal; new WALT method reaches 92.4% robustness on zoom and 95.6% on background removal.","lead":"The paper creates RAW, a benchmark with 50 avatar videos and 6 real-world attacks, then tests 7 watermark methods and introduces WALT which embeds marks in 3D face textures. A smart generalist might read it to understand how to protect digital avatars from easy removal of ownership marks during editing and sharing.","discovery_kind":"new_method","skeptic_critique":{"model":"grok-4.3","headline":"Benchmark representativeness for real-world avatar post-processing remains unverified","rationale":"The reader's weakest assumption directly identifies the condition required for the performance numbers to support the claim. No other internal inconsistency is visible from the supplied text.","tokens_in":1610,"tokens_out":246,"duration_ms":13165,"concrete_test":"Add 20 videos from a sixth commercial provider plus two new attacks (JPEG compression at Q=70/90 and random color jitter); recompute WALT metrics on the expanded set. If either robustness number falls below 85%, the headline claim does not generalize.","verdict_should_be":"UNCHANGED","load_bearing_attack":"WALT's reported robustness (92.4% on zoom, 95.6% on background removal) is the central claim. This holds only if the 50 videos from 5 providers and the 6 simulated attacks adequately sample the distribution of actual avatar pipelines (background replacement, reframing, format conversion, plus unmodeled steps such as platform-specific compression, lighting edits, or multi-frame temporal processing). The abstract provides no validation that these choices cover that distribution or that performance is stable outside the chosen set.","agreement_with_reader":"agree"},"referee_report":{"model":"grok-4.3","summary":"The paper introduces the RAW benchmark consisting of 50 synthetic avatar videos from 5 commercial providers together with 6 attacks that simulate common post-processing steps (background replacement, reframing, format conversion). It evaluates seven existing watermarking methods on this benchmark, finds that avatar-specific attacks such as background removal substantially reduce recovery rates, and proposes WALT, which performs 3D face reconstruction and embeds the watermark in UV texture space. WALT is reported to achieve 92.4% robustness under zoom attacks and 95.6% under background removal, outperforming the baselines; the benchmark is released publicly.","tokens_in":1717,"tokens_out":593,"duration_ms":16749,"significance":"If the empirical claims are substantiated with complete methodology, the work supplies a needed public benchmark and an avatar-specific embedding technique that targets a practically relevant threat model. The release of the benchmark itself constitutes a concrete contribution that can be used by subsequent research regardless of the performance numbers.","major_comments":[{"comment":"Abstract and Experimental Results: the central performance figures (92.4% zoom robustness, 95.6% background-removal robustness) are stated without error bars, without the number of trials or videos per condition, and without any description of how the 3D face reconstruction step is implemented or which reconstruction library/parameters are used. These omissions make the quantitative comparison to the seven baselines impossible to reproduce or assess for statistical reliability.","section":"Abstract and Experimental Results"},{"comment":"Benchmark construction (Section 3): the claim that the chosen 50 videos and 6 attacks adequately represent real-world avatar pipelines is not supported by any validation (e.g., comparison against actual platform outputs or coverage of additional steps such as platform-specific compression or temporal filtering). Because the benchmark is the primary artifact and the performance claims rest on it, this gap is load-bearing.","section":"Section 3"},{"comment":"WALT method (Section 4): the embedding procedure is described at a high level (UV texture space after 3D reconstruction) but supplies no concrete details on the texture resolution, the exact watermark encoding, or how the reconstructed mesh is aligned back to the original video frames. These parameters directly determine whether the reported robustness numbers can be attributed to the proposed technique.","section":"Section 4"}],"minor_comments":[{"comment":"The abstract states that seven existing methods were evaluated but does not list which methods or cite their original papers; this should be added for completeness.","section":"Abstract"},{"comment":"Figure captions and tables reporting recovery rates should explicitly state the number of videos/frames used for each percentage.","section":"Figures and Tables"}],"recommendation":"major_revision","confidential_remarks":null},"author_rebuttal":{"model":"grok-4.3","summary":"We thank the referee for the constructive comments, which highlight important gaps in reproducibility and validation. We address each major comment below and will incorporate revisions to strengthen the manuscript.","responses":[{"response":"We agree that these details are essential for reproducibility. The revised manuscript will add error bars (standard deviations across videos), explicitly state that all results are averaged over the full set of 50 videos, and describe the 3D reconstruction implementation including the specific library and parameters employed.","revision_made":"yes","referee_comment":"[Abstract and Experimental Results] Abstract and Experimental Results: the central performance figures (92.4% zoom robustness, 95.6% background-removal robustness) are stated without error bars, without the number of trials or videos per condition, and without any description of how the 3D face reconstruction step is implemented or which reconstruction library/parameters are used. These omissions make the quantitative comparison to the seven baselines impossible to reproduce or assess for statistical reliability."},{"response":"We acknowledge the need for stronger justification. We will expand Section 3 with a rationale for the selection of providers, videos, and attacks based on documented common post-processing workflows, and will add explicit discussion of limitations regarding proprietary platform steps such as compression.","revision_made":"partial","referee_comment":"[Section 3] Benchmark construction (Section 3): the claim that the chosen 50 videos and 6 attacks adequately represent real-world avatar pipelines is not supported by any validation (e.g., comparison against actual platform outputs or coverage of additional steps such as platform-specific compression or temporal filtering). Because the benchmark is the primary artifact and the performance claims rest on it, this gap is load-bearing."},{"response":"We will revise Section 4 to include the required implementation specifics: UV texture resolution, the precise watermark encoding procedure, and the mesh-to-frame alignment method using landmark-based registration.","revision_made":"yes","referee_comment":"[Section 4] WALT method (Section 4): the embedding procedure is described at a high level (UV texture space after 3D reconstruction) but supplies no concrete details on the texture resolution, the exact watermark encoding, or how the reconstructed mesh is aligned back to the original video frames. These parameters directly determine whether the reported robustness numbers can be attributed to the proposed technique."}],"tokens_in":1400,"tokens_out":515,"duration_ms":25224,"standing_objections":[]},"desk_editor":{"model":"grok-4.3","letter":"The one or two things to know: this paper releases a benchmark of 50 avatar videos from five commercial sources along with six simulated attacks, and it proposes WALT, which embeds watermarks in UV texture space after 3D reconstruction, reporting 92.4% robustness on zoom and 95.6% on background removal.\n\nWhat is new is the RAW dataset itself and the shift to operating on reconstructed textures rather than raw 2D frames. The evaluation of seven prior methods shows that background removal hurts standard approaches, which is a useful observation for anyone dealing with avatar pipelines. Releasing the data lets others test their own ideas against the same material.\n\nThe soft spots are in the reporting and scope. The percentages appear without error bars, trial counts, or any description of how the 3D reconstruction is performed or how often it fails. The six attacks and fifty videos may not match the mix of compression, reframing, and platform edits that actually occur, so the robustness claims are hard to generalize from. Those gaps are real but not surprising in a first benchmark paper.\n\nThis work is for researchers and engineers who need test material for protecting synthetic 3D assets on social or VR platforms. A reader who wants a concrete starting point for avatar watermarking experiments will find the released benchmark useful even if the baseline method needs more scrutiny.\n\nIt deserves a serious referee to check the missing implementation details and to suggest whether the attack set should be expanded. I would send it to peer review rather than desk reject.","headline":"RAW adds a benchmark and WALT texture-space method for avatar watermarking, but the reported numbers rest on unreported details and a narrow attack set.","tokens_in":2208,"tokens_out":387,"would_cite":false,"duration_ms":33607,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"grok-4.3","headline":"Embedding watermarks in the UV texture space of 3D face reconstructions makes them survive avatar post-processing attacks better than prior methods.","keywords":["avatar watermarking","robust watermarking","3D face reconstruction","UV texture embedding","digital watermarking benchmark","background removal attack","post-processing robustness","synthetic avatar videos"],"falsifier":"A controlled experiment in which WALT is applied to a fresh collection of avatar videos and post-processing attacks and yields lower average recovery rates than at least one of the seven baseline methods would falsify the claim of superior robustness.","tokens_in":2504,"feed_emoji":"🖼️","tokens_out":754,"duration_ms":18277,"temperature":0.7,"pith_summary":"The paper creates a benchmark of 50 synthetic avatar videos drawn from five commercial sources together with six attacks that mimic common editing steps such as background removal, reframing, and zoom. Existing watermarking techniques lose most of their signal under these avatar-specific operations. The authors introduce WALT, which first reconstructs a 3D face model and then places the watermark directly in its UV texture map. On the benchmark this placement yields 92.4 percent recovery after zoom and 95.6 percent after background removal, the strongest results among the seven methods tested. The benchmark itself is released so that subsequent work can measure progress on the same standardized set of videos and attacks.","feed_headline":"UV-texture watermarking survives avatar edits at 92 percent","feed_subtitle":"WALT reconstructs 3D faces then places marks in their texture maps, outperforming seven prior methods on zoom and background-removal attacks","key_machinery":"WALT (Watermarking Avatars with Learned Textures), the procedure that reconstructs a 3D face and embeds the watermark inside its UV texture map rather than in the final 2D rendered frames.","core_discovery":"WALT embeds watermarks in the UV texture space of 3D face reconstructions and thereby records the highest recovery rates on the RAW benchmark: 92.4 percent under zoom attacks and 95.6 percent under background removal, exceeding the performance of seven previously published watermarking methods across fifty avatar videos and six real-world-style attacks.","pith_inferences":["If 3D reconstruction quality varies across different avatar styles or lighting conditions, WALT's advantage may shrink on inputs that produce inaccurate meshes.","The same UV-space placement could be tested on other 3D-rendered assets such as animated characters or virtual objects to check whether the robustness gain is specific to human faces.","An adversary who can detect and alter the 3D reconstruction stage before watermark extraction might bypass the protection without touching the final video frames."],"forward_implications":["Watermark recovery can be made more stable by moving the embedding step from 2D image space into the UV texture coordinates of a 3D model.","Background removal and zoom operations are shown to be the attacks that most strongly degrade recovery for existing 2D watermarking methods.","A public benchmark of fifty videos and six attacks now exists against which any new avatar watermarking algorithm can be measured.","Reconstruction-based embedding opens the possibility of watermark survival even after format conversion and reframing that alter pixel values but preserve the underlying 3D texture."],"fun_headline_variants":["WALT watermarking uses UV textures from 3D face reconstructions","RAW benchmark covers 50 synthetic avatar videos and 6 attacks","WALT achieves 92 percent recovery rate under zoom attacks","Background removal yields 95 percent recovery with WALT","Seven existing methods compared on RAW avatar benchmark"],"cache_read_input_tokens":2112,"weakest_assumption_plain":"The six chosen attacks and fifty videos from five commercial providers adequately represent the distribution of real-world avatar post-processing pipelines that watermarks must survive.","fun_headline_variants_meta":{"raw":{"variants":["WALT watermarking uses UV textures from 3D face reconstructions","RAW benchmark covers 50 synthetic avatar videos and 6 attacks","WALT achieves 92 percent recovery rate under zoom attacks","Background removal yields 95 percent recovery with WALT","Seven existing methods compared on RAW avatar benchmark"]},"model":"grok-4.3","cost_usd":0.006194,"raw_usage":{"total_tokens":2873,"prompt_tokens":576,"num_sources_used":0,"completion_tokens":78,"cost_in_usd_ticks":61937000,"prompt_tokens_details":{"text_tokens":576,"audio_tokens":0,"image_tokens":0,"cached_tokens":256},"completion_tokens_details":{"audio_tokens":0,"reasoning_tokens":2219,"accepted_prediction_tokens":0,"rejected_prediction_tokens":0}},"tokens_in":576,"tokens_out":78,"duration_ms":16631,"temperature":1.0,"reasoning_tokens":2219,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-06-30T18:47:33.970858+00:00","model_set":{"reader":"grok-4.3"},"falsifier":"A controlled experiment in which WALT is applied to a fresh collection of avatar videos and post-processing attacks and yields lower average recovery rates than at least one of the seven baseline methods would falsify the claim of superior robustness.","supporting_citations":[],"review_version":1}