{"id":"2ee43a90-f4ae-4f67-90e5-87dce5d353fc","arxiv_id":"2608.03539","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":7.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":7,"one_line_summary":"IRIS embeds a keyed ring derived from the generated image's CLIP-based semantic code back into late diffusion steps, making the watermark fail automatically when the image's semantics change.","lead":"IRIS is a new watermarking method for AI-generated images that derives the mark from the image's own visual content and embeds it during generation, so the mark cannot be transplanted onto other images. In tests on three prompt datasets it reports high detection accuracy, near-identical image quality, and resistance to both forgery and regeneration attacks.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Untested same-prompt ring-transfer attack likely bypasses IRIS's semantic binding; the cone width is deliberately tolerant of near-semantic drift.","rationale":"The reader's weakest assumption identified the uncharacterized adaptive search into the candidate cone. That is related but not the most concrete threat, because the keyed SimHash and one-way HMAC may make arbitrary black-box code collisions expensive. The more direct attack is a key-free ring transfer to a same-prompt different-seed image, which exploits the cone's intentionally wide acceptance of near-semantic drift. The paper's own measurements show the cone spans roughly half the separation of unrelated images; same-prompt images are likely to be much closer, and the ring's matched-filter score of ~0.85 indicates the ring can be extracted and replayed without the key. This attack targets the paper's headline claim directly, is absent from the experimental section, and can be settled with a straightforward experiment. The concern is load-bearing: if the attack succeeds, IRIS does not 'withstand forgery' in the sense claimed. The verdict should remain CONDITIONAL, requiring the authors to run this same-prompt ring-transfer test and report the resulting ASR before the security claim is accepted.","tokens_in":18278,"tokens_out":13012,"duration_ms":165973,"concrete_test":"Take N=500 watermarked IRIS images across the three prompt datasets. For each, (1) extract the ring phases from the latent band (16,20] via DDIM inversion of the released image; (2) generate a same-prompt, different-seed image with SD 2.1-base at T=50; (3) DDIM-invert that new image to t0=40 and blend the extracted ring using the published α_t schedule; (4) run IRIS detection at the paper's 1%-FPR threshold. Report the ASR. Also report the median CLIP-image angle between same-prompt different-seed pairs and compare it to θ50≈23°. If ASR exceeds 0.1, the central 'forgery-resistant' claim fails; if the median angle is below θ50, the cone is demonstrably wide enough to admit such transplants.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"The forgery-resistance claim in Table 1 rests on the assumption that a transplanted ring cannot verify on an image whose recomputed code falls outside the acceptance cone C(ĉ) of Eq. (6). But the cone is deliberately wide enough to absorb benign drift (r=3, L=7, §5.4), and the paper never tests the simplest transplant that exploits this width. An attacker can take a released watermarked image, extract its ring phases from the known band (16,20] using DDIM inversion (§4.2), generate a new image from the same prompt with a different seed, invert it to t0=40, and blend the extracted ring into those late latents with the same α_t schedule of Eq. (4). Because the new image is semantically close to the original, its canonicalized CLIP embedding may lie within the ~23° half-acceptance angle θ50 of Fig. 4(b); if so, the recomputed code falls in C(ĉ) and the detector will test the original ring. The attacker never needs the key—the ring is read directly from the public image and replayed. Same-prompt different-seed images are exactly 'images the generator did not produce' under the threat model, so this is a forgery. The paper's reprompt attack changes the prompt, moving far outside the cone, and the PGD attack starts from an unrelated MS-COCO cover; neither tests the near-semantic transplant that the cone is designed to tolerate.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes IRIS, a training-free in-generation watermark for diffusion images that binds the mark to the visual semantics of the delivered image. During generation, IRIS first produces the clean image, reads a keyed 24-bit SimHash content code from a canonicalized CLIP embedding, derives a one-time phase-only ring in a mid-frequency Fourier band (16,20] of latent channel 0, and replays the last 10 DDIM steps (t0=40) with the ring blended in at a strength matched to the band energy. Detection recomputes the code from the query image, expands it to a candidate set of Hamming ball radius 3 plus 7 low-margin-bit flips, and runs a matched filter over the corresponding candidate rings after DDIM inversion. The paper reports TPR 0.99 at 1% FPR, PSNR 30.2 / SSIM 0.92 versus the same-seed non-watermarked counterpart, robustness to JPEG/blur/noise/brightness/crop/rotation, and the lowest mean ASR (0.04) across reprompt, PGD forgery, regeneration, and PGD removal when compared with Tree-Ring, Gaussian Shading, SEAL, Stable Signature, and DwtDctSvd. The paper explicitly concedes in Section 5.2 that an adaptive search for a semantically distinct image whose code still lands in the candidate set is uncharacterized.","tokens_in":18678,"tokens_out":4300,"duration_ms":54572,"significance":"If the security claim holds, the paper is a meaningful advance: it demonstrates a blind, stateless, training-free watermark that survives regeneration while resisting the tested transplantation attacks, and it improves same-seed fidelity by an order of magnitude in PSNR over the in-generation baselines. The experimental work is detailed and internally consistent, and the framing of the acceptance cone as the security parameter is a useful contribution to the content-bound watermarking literature. However, the central forgery-resistance claim rests on an uncharacterized collision assumption: that an adversary cannot find a semantically distinct image whose recomputed code falls inside the candidate set. The paper's own Figure 4 shows that the observed band (oracle code) survives replacement nearly unchanged, so the binding is enforced entirely by the code readout; any image whose code lands in C(ĉ) inherits the embedded ring. The submitted experiments do not quantify the distance of same-prompt different-seed images on the CLIP angle axis, which is precisely the regime the candidate set is designed to tolerate. This gap is load-bearing for the headline security claim.","major_comments":[{"comment":"The paper concedes that 'an adaptive search for a semantically distinct image whose code still lands in the candidate set remains uncharacterized.' This is not a peripheral limitation: it is the security property. A concrete untested attack is the same-prompt ring-transfer: take a released watermarked image, extract the band (16,20] phases via DDIM inversion (§4.2), generate a new image from the same prompt with a different seed, invert it to t0=40, and blend the extracted phases with the schedule of Eq. (4). Because the new image is semantically close to the original, its canonicalized CLIP embedding may fall within the half-acceptance angle θ50≈23° reported in Fig. 4(b), so the recomputed code lands in C(ĉ). The detector would then test the original ring and, given the oracle-code ring survival shown in Fig. 4(a), would likely accept. This attack is squarely within the threat model (al","section":"§5.2 / Eq. (6)"},{"comment":"The evidence that 'the code does the letting go' is partly by construction, since detection recomputes the code from the query and a drifted code maps through HMAC to an unrelated ring. More important, Fig. 4(a) shows that ring survival with the oracle code stays nearly unchanged under content replacement; this means the band itself is reusable if the code can be kept in the cone. The security question is not whether arbitrary edited images drift out of C(ĉ), but whether an adversary can efficiently find a semantically distinct image that does not. The current protocol-level observation that code survival overlaps TPR does not address adversarial optimization toward the cone. I would like to see a measurement of the distribution of CLIP angles for same-prompt different-seed generations and for small prompt perturbations (e.g., synonym or attribute changes), and the resulting TPR/ASR when","section":"§5.2 / Fig. 4(a)"},{"comment":"The candidate-set ablation quantifies how r and L trade off against cone width (4° per radius step, ~1° per bit), but it does not connect this to the actual attack surface. The deployed r=3, L=7 yields θ50≈23°, while unrelated generated images are reported to sit about 49° apart. Same-prompt different-seed images will plausibly sit far below 49°, possibly below 23°, yet this quantity is never reported. Without this number, the 'deployed pair sits at the joint knee' statement is only a robustness-coverage trade-off, not a security calibration. The paper should report the same-prompt/slightly-edited CLIP-angle distribution and, if it overlaps the cone, adjust the candidate set or the threat model accordingly.","section":"§5.4 / Fig. 7"}],"minor_comments":[{"comment":"The claim 'IRIS alone among the compared marks withstands both forgery and regeneration' is supported by the mean ASR column, but the PGD removal ASR of 0.09 is nonzero; the wording could be sharpened to 'lowest mean ASR' or 'below 0.10 on all four attacks' to match the data.","section":"§5.1 / Table 1"},{"comment":"The rotation experiment searches a grid of candidate angles and applies the same search to non-watermarked images. It would be helpful to state the grid resolution and the range searched, since the TPR curve's flatness depends on that search density.","section":"§5.3 / Fig. 5"},{"comment":"The sentence 'the margin subsets are few and half of them lie inside the ball' is unclear: a subset count is not given, and it is not obvious which 'half' is meant. Clarify the overlap statistic.","section":"§5.4 / Fig. 7"},{"comment":"The phrase 'from the same seed' is used for IRIS's fidelity comparison, but for Tree-Ring the same-seed counterpart is 'verified bit-identical before injection' and then modified; the caption of Table 1 could state explicitly whether all same-seed comparisons hold the initial latent fixed before each mark's injection.","section":"Abstract/§5.1"}],"recommendation":"major_revision","confidential_remarks":"The paper is well executed and the experimental presentation is thorough, but the central security claim is currently protected by an uncharacterized assumption. The same-prompt ring-transfer attack described in the main report is a concrete, realistic exploit that the current evaluation does not cover. If that attack succeeds, the main comparative advantage over SEAL and the other baselines weakens substantially, since the ring is read directly from the public image and replayed without the key. I would ask the authors to run that attack (and a small sweep over prompt edits) before acceptance; this is a fixable gap within the paper's scope, so I recommend major revision rather than rejection. I also suggest the authors release code or at least the exact DDIM inversion and blending hyperparameters for reproducibility."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The core idea is real. IRIS derives the watermark from the canonicalized CLIP embedding of the delivered image at the end of the trajectory, then replays a phase ring into the late DDIM steps. That late-injection trick is the right fix for the causal entanglement problem. It is training-free, blind, stateless, and reasonably cheap. The paper is also refreshingly honest: Section 5.2 explicitly names the adaptive collision search as uncharacterized and proposes its cost as the security notion. The ablation study (candidate set, t0, canonicalization) is thorough, and the code-survival/ring-survival decomposition shows the mechanism actually works as described.\n\nFidelity is the strongest part. PSNR 30.2 with SSIM 0.92 against the same-seed counterpart is a real improvement over the in-generation baselines that redraw the image. The robustness results under JPEG, blur, noise, and geometric distortions are plausible and well documented.\n\nThe soft spot is exactly where the paper says it is: the acceptance cone. The whole security argument is that a forged image's recomputed code lands outside the candidate set C(ĉ). But the paper never measures how hard it is to find an image inside that cone that is semantically distinct, and it does not test the simplest attack that exploits the cone's width: same-prompt, different-seed regeneration with a transplanted ring. The stress-test note is right—the adversary reads the ring from the public image via inversion, regenerates under a near-identical prompt, and replays the ring at t0. The recomputed code for the new image is likely within the roughly 23° half-acceptance angle, so the detector would test the original ring and probably accept. That is precisely the \"forgery\" the paper claims to resist, and Section 5.2's PGD and reprompt attacks never approach it. The paper's own numbers (θ50 ≈ 23°, two unrelated images ≈ 49° apart) show the cone spans a large part of the semantic neighbourhood.\n\nA second concern, minor relative to the above: the hyperparameters (band radius, α0, t0, r, L) are selected on the same datasets used for evaluation, with no held-out split. No code is released, which makes the security question harder to resolve by replication.\n\nMy verdict: the engineering is solid and the description of the mechanism is honest, but the headline claim \"resists forgery\" is not yet supported. The paper needs a security analysis of the candidate-cone collision problem and, at minimum, an evaluation of the same-prompt ring-transfer attack. This is a good candidate for peer review—send it to referees with instructions to focus on Section 5.2 and the cone width—but I would not cite it as a forgery-resistant scheme until that is addressed.","headline":"IRIS is a genuinely new and cleanly engineered in-generation watermark, but the forgery-resistance headline rests on an uncharacterized collision cone and an untested same-prompt transplant.","tokens_in":19128,"tokens_out":1744,"would_cite":false,"duration_ms":18414,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"IRIS claims a training-free watermark that binds a one-time phase ring to a generated image's visual semantics, so verification recomputes the mark from the image and key alone and forgery fails.","keywords":["diffusion image watermarking","visual-semantic binding","forgery resistance","DDIM inversion","phase-ring watermark","CLIP embedding","SimHash","regeneration removal"],"falsifier":"Run an adaptive search over generated or adversarially perturbed images to find, for each released watermarked image, a semantically distinct image whose canonicalized CLIP embedding hashes to a code within the candidate set (Hamming radius 3 or the 7 low-margin flips), then submit it to verification; if a substantial fraction pass at the 1% FPR threshold, the binding claim collapses. The paper's own concession about the uncharacterized adaptive search is exactly the test to run.","tokens_in":18215,"feed_emoji":"🔒","tokens_out":5707,"duration_ms":60698,"temperature":0.7,"pith_summary":"This paper tries to establish that a watermark for diffusion-generated images can be bound to the visual meaning of the image it protects, so a mark transplanted onto different content no longer verifies. It claims that this binding can be done inside generation without training: derive a one-time phase ring from a keyed hash of the canonicalized CLIP embedding of the clean generated image, then blend it into the late, low-noise steps of the same sampling trajectory. Because detection recomputes the ring from the query image and the secret key alone, a forged or spliced image derives a different ring and fails verification, while common distortions and mild regeneration are absorbed by canonicalization and a candidate set. The paper reports that IRIS detects at TPR 0.99 with 1% false positive rate, keeps PSNR 30.2 and SSIM 0.92 against its same-seed non-watermarked counterpart, and holds the lowest attack success rate across reprompt, PGD forgery, regeneration, and PGD removal among the compared marks. The broader reason to care: if true, content provenance can be verified statelessly from the image itself, making forgery of AI-generated images measurably harder.","feed_headline":"Watermark bound to image meaning resists forgery and regeneration","feed_subtitle":"IRIS derives a one-time ring from the image's own semantics, so transplanted marks fail and fidelity stays high.","key_machinery":"The intrinsic ring identifier: a one-time, phase-only Fourier ring on a narrow mid-frequency annulus, derived from the image's canonicalized CLIP embedding through keyed SimHash, HMAC, and a PRNG, and blended into the last ten DDIM steps of the same trajectory. It carries the argument because it makes the mark recomputable from the image plus key at detection, while any semantic change shifts the embedding, changes the code, and yields a different ring, so the mark fails exactly when visual meaning moves.","core_discovery":"The central claim is that the watermark can be intrinsic to the image's semantics rather than an independent pattern. IRIS reads the clean endpoint image through a canonicalization (luminance normalization, heavy blur, low-quality JPEG, and averaging over re-degraded copies), quantizes its CLIP embedding with a keyed SimHash into a 24-bit content code, hashes the code with HMAC into a seed, and expands the seed into a Hermitian phase ring on a narrow mid-frequency annulus of one latent channel. It then replays only the final ten DDIM steps, blending the ring in with energy matched to the band's own spectrum and a decaying weight, so the semantics the mark binds to are already settled. At ver","pith_inferences":["The security guarantee is only as strong as the uncharacterized search cost for a semantic collision; an adaptive attacker who optimizes over CLIP embedding space or generated variants to land inside the candidate set could forge the mark without recovering the key. The paper itself flags this, so I read the contribution as establishing the binding mechanism and its non-adaptive resistance, not a ","Because the semantic axis is CLIP, the scheme inherits CLIP's blind spots: an adversarial perturbation that preserves human-visible content but moves the CLIP embedding could either push a legitimate image out of the cone or, in principle, pull an attacker-chosen image in. A direct test would attack the code-reading stage with a small perturbation search.","The acceptance-cone size is explicitly controlled by the candidate-set radius and low-margin bit count; deployment could tune the mark's sensitivity to a target semantic-displacement threshold, at the cost of opening a larger forgery window.","A stronger canonicalization or a perceptual encoder trained for value-metric invariance might widen the retained range, as the paper suggests, but it could also widen the cone to semantic changes—so that extension is not guaranteed to preserve the binding sharpness."],"forward_implications":["If IRIS works as claimed, in-generation watermarks no longer have to trade fidelity for robustness: the mark can preserve the generated content (PSNR 30.2 vs baselines at 14.4 or below) while surviving regeneration.","Verification is blind and stateless—only the image and the secret key are needed—so no per-image prompt, seed, latent, or external record has to be stored or transmitted.","Forgery resistance becomes tied to how far an attacker must move an image's semantics to find a code collision; the acceptance-cone angle is a measurable security parameter that can be capped by tuning the candidate set.","The design extends naturally to any deterministic invertible sampler, including flow-based samplers, not just DDIM.","Post-hoc marks remain removable by regeneration, but a semantically bound late-step ring is not, because the ring sits in a band that redrawn detail leaves largely untouched."],"supporting_citations":[{"why":"SEAL is the closest semantic-binding baseline; IRIS is positioned against its proxy-caption binding and must beat it on forgery and fidelity.","marker":"Arabi et al. 2025"},{"why":"Supplies the keyed SimHash quantization that turns a CLIP embedding into a short content code.","marker":"Charikar 2002"},{"why":"RingID provides the Hermitian phase-ring construction whose symmetry lets the ring survive the write whole.","marker":"Ci et al. 2024"},{"why":"Spread-spectrum watermarking and the normalized matched-filter scoring used for detection.","marker":"Cox et al. 1997, 2007"},{"why":"Defines the inversion-reuse reprompt forgery attack that IRIS must resist and that is used as an attack in evaluation.","marker":"Müller et al. 2025"},{"why":"Supplies the CLIP vision encoder used as the semantic readout for the content code.","marker":"Radford et al. 2021"},{"why":"Provides the latent diffusion and DDIM backbone that IRIS generates with and inverts through.","marker":"Rombach et al. 2022"},{"why":"Tree-Ring introduces ring watermarks in diffusion latents and is the primary in-generation baseline IRIS compares against.","marker":"Wen et al. 2023"},{"why":"Supplies the add-noise-then-denoise regeneration attack used to evaluate removal resistance.","marker":"Zhao et al. 2024"}],"fun_headline_variants":["Watermark bound to image meaning resists forgery and regeneration","IRIS: training-free watermark that reads image code to stop mark theft","Image-derived watermark survives regeneration, rejects spliced images","Semantic binding makes watermarks fail on foreign images","One-time ring from image semantics outsmarts watermarks thieves"],"cache_read_input_tokens":2688,"weakest_assumption_plain":"The scheme's forgery resistance rests on it being genuinely hard to find a semantically different image whose keyed SimHash code still lands in the candidate set; the paper states this search cost is uncharacterized, so if such collisions are easy to find, the mark can be forged despite its semantic binding.","fun_headline_variants_meta":{"raw":{"variants":["Watermark bound to image meaning resists forgery and regeneration","IRIS: training-free watermark that reads image code to stop mark theft","Image-derived watermark survives regeneration, rejects spliced images","Semantic binding makes watermarks fail on foreign images","One-time ring from image semantics outsmarts watermarks thieves"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000755,"raw_usage":{"total_tokens":3238,"prompt_tokens":830,"completion_tokens":2408,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":574,"completion_tokens_details":{"reasoning_tokens":2324}},"tokens_in":574,"tokens_out":2408,"duration_ms":21580,"temperature":1.0,"reasoning_tokens":2324,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-05T17:07:29.462427+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run an adaptive search over generated or adversarially perturbed images to find, for each released watermarked image, a semantically distinct image whose canonicalized CLIP embedding hashes to a code within the candidate set (Hamming radius 3 or the 7 low-margin flips), then submit it to verification; if a substantial fraction pass at the 1% FPR threshold, the binding claim collapses. The paper's own concession about the uncharacterized adaptive search is exactly the test to run.","supporting_citations":[{"cited_title":"T.; Hegde, C.; and Cohen, N","cited_arxiv_id":null,"evidence_quote":"SEAL is the closest semantic-binding baseline; IRIS is positioned against its proxy-caption binding and must beat it on forgery and fidelity."},{"cited_title":"J.; Kilian, J.; Leighton, F","cited_arxiv_id":null,"evidence_quote":"Spread-spectrum watermarking and the normalized matched-filter scoring used for detection."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Tree-Ring introduces ring watermarks in diffusion latents and is the primary in-generation baseline IRIS compares against."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the add-noise-then-denoise regeneration attack used to evaluate removal resistance."}],"review_version":1}