{"id":"7b7fc14e-da00-4afb-882f-71dd2e97068d","arxiv_id":"2608.08645","paper_version":1,"verdict":"REJECT","confidence":"HIGH","novelty_score":6.0,"correctness_risk":"high","formal_verification":"none","parameter_count":5,"one_line_summary":"HaloMark proposes publishing an LSH commitment in the C2PA sidecar to watermark embeddings, but it derives the secret key from public manifest data, making the key recoverable by any sidecar observer.","lead":"HaloMark adds a watermark to AI embedding vectors and binds it to a C2PA content-provenance certificate, claiming to survive attacks that try to strip it. The security setup assumes attackers never learn the watermark key, but the key is derived from public certificate data, so the main security claim fails.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Public key derivation from the C2PA manifest hash breaks the core secrecy assumption; any sidecar-visible adversary can derive K, regenerate signatures, and strip the watermark.","rationale":"The reader's weakest_assumption correctly identifies the decisive flaw, and my own reading of the construction confirms it. KeyGen derives K solely from the public C2PA manifest claim hash, so the threat model's denial of K to the C4 adversary is not a real restriction. With K and the public calibration data, every secret component of the watermark is reconstructible. In the manifold-aligned default the watermark is exactly a public-subspace additive perturbation, so subtraction is exact and Verify's score collapses while cosine fidelity stays at 1. This invalidates the central robustness and unforgeability claims, independent of the extensive empirical evaluation. The spectral threshold, the published-commit idea, and the deployment measurements may still be useful as engineering artifacts, but they cannot support the paper's security conclusion. I therefore agree with the reader's REJECT verdict and recommend no change to it.","tokens_in":21359,"tokens_out":7076,"duration_ms":78014,"concrete_test":"Run the released HaloMark code on a MiniLM MS-MARCO test vector: parse its C2PA manifest, compute the C2PA claim hash, set K = HKDF(claim_hash, \"HaloMark\") exactly as in §IV-A, regenerate U_top and η = PRF_K(\"sig\" || i || c || n), and set ˜x = normalize(x' - U_top η). Then call Verify(K, ˜x, n, c, τ_det) and compute cos(˜x, x_clean) against the clean vector. If Verify returns reject with T ≈ 0 while cos ≥ 0.999, the key-secrecy attack succeeds with no KPA training, confirming the C4 break.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The load-bearing flaw is an internal inconsistency between KeyGen in §IV-A and the threat model in §II-C. KeyGen(pp, m) sets K = HKDF(claim_hash(m), \"HaloMark\"), and claim_hash(m) is deterministic public data in the C2PA manifest; indeed §IV-E says the verifier derives K the same way. The C1 capability already grants the adversary the manifest m and full sidecar visibility, so the C4 statement that the adversary does not have access to K is vacuous. An attacker computes claim_hash(m), derives K, then regenerates the block subset W, the rotation Q, and every signature s_i(c, n, K) from the published (n, c). In the manifold-aligned production default (§IV-C), the embedding step is x' = normalize(x + U_top η); subtracting U_top η and renormalizing recovers x_clean exactly. Verify then sees T ≈ 0 while cos(˜x, x_clean) ≈ 1, which is precisely a C4 removal success. Lemma 1's conditioning on the C2PA signature only certifies that m is authentic; it does not keep m's claim hash secret. Because K is the only secret in the construction and is derivable from public data, the published-commit protocol and empirical threshold do not repair the broken premise. This is not a disagreement with external consensus; it is a failure inside the paper's own model.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes HaloMark, a watermarking scheme for embedding vectors that binds a per-vector watermarked embedding to a C2PA manifest. The core design publishes an input-dependent LSH commitment c in the C2PA sidecar so that the verifier reads c instead of recomputing it, then derives per-block signatures from the key K, the nonce n, and c. The authors argue that this reduces verification to a single scalar β(A), bound it for linear attackers, and report an empirical spectral threshold: encoders with eff_rank(Σ)/d above roughly 0.19 defend against polynomial-known-plaintext and denoising-autoencoder attacks, while encoders below this threshold fail. The evaluation includes eleven embedders, eight baselines, ten adaptive attackers, multi-tenant isolation, C2PA SDK interop, and a Qdrant admission-filter deployment at 284 μs per vector.","tokens_in":21608,"tokens_out":10106,"duration_ms":126811,"significance":"If its security claims were valid, the paper would make a useful contribution: the published-commit verifier is a clean way to avoid LSH bucket-flip fragility under whitening, the reduction of the security analysis to a single retention scalar is elegant, and the empirical spectral-threshold observation is interesting even without a derivation. The paper also ships reproducible code, detailed attack sweeps, and careful deployment measurements, which are strengths. However, the central secrecy premise is false: the scheme derives the only secret key from a public manifest field, so the C4 adversary can recompute K and all derived signatures. The security analysis, the AUROC tables, and the threshold claim all measure a protocol whose supposed secret is not secret. As written, the manuscript does not establish the claimed KPA resistance or the claimed C4 removal security.","major_comments":[{"comment":"The key-secrecy assumption is internally contradicted by the construction. KeyGen(pp, m) sets K = HKDF(claim_hash(m), \"HaloMark\"), and §IV-E instructs the verifier to derive K from C2PA.manifest_claim_hash. The C2PA manifest and its deterministic claim hash are public, and the C1 adversary is explicitly given the manifest m and full sidecar visibility. Therefore the statement in §II-C that the C4 attacker does not have access to K is false by construction. Any adversary holding the manifest can compute claim_hash(m), derive K, regenerate the block subset W, the rotation Q, the commitment projection P, and every signature s_i(c, n, K) from the published (n, c). For the manifold-aligned production default of §IV-C, the attacker can compute the added watermark component U_top * eta and remove it from a watermarked vector, yielding a vector that satisfies the cosine budget while driving the verifier score toward the null distribution. This is a successful C4 removal with no additional known-plaintext pairs beyond the C1 observation. Lemma 1, Theorem 1, Proposition 1, and the AUROC tables in §VI analyze a protocol whose only secret is publicly derivable; they therefore do not establish the claimed security.","section":"§IV-A, §II-C, §IV-E"},{"comment":"The entire empirical security evaluation is conditioned on the broken secrecy premise. The DAE, direction-oracle, and baseline comparisons in Tables II–VI are run against a scheme whose key is recoverable from public manifest data, so the measured AUROC values do not measure KPA resistance under the stated threat model. A correct version of the paper must either provision K as a true secret shared between producer and verifier and rerun the full attack suite under that key-management model, or explicitly state that no secrecy-based security is provided. As written, the protocol's own key-derivation rule and the threat model cannot both be true.","section":"§IV-D and §VI"}],"minor_comments":[{"comment":"The same symbol W denotes both the whitening matrix and the w-element block subset; the notation table warns about this, but adjacent equations in §IV-A still use W for both objects. Please use a distinct symbol such as \\mathcal{W} for the block subset.","section":"Table I and §IV-A"},{"comment":"The proof sketch of Lemma 1 attributes the tail bound to Chernoff; for a sub-Gaussian variable the standard tool is a Hoeffding-type inequality. Please correct the wording.","section":"§IV-D"},{"comment":"The statement that continuous-score PGD drives AUROC to 0 at q=64 should also report the cosine fidelity at that operating point, since an attack that pushes the vector below δ_C4 is not a C4-valid removal by the paper's own outcome accounting.","section":"§VI-C"},{"comment":"The 'if and only if' phrasing attached to the eff_rank/d ≈ 0.19 threshold is stronger than the evidence: the threshold is an empirical regularity, the straddling pair consists of one encoder on each side, and the d-uniformity is admittedly unexplained. Please phrase the claim as 'the tested encoders separate at' rather than as a universal iff.","section":"§VI-D and Abstract"}],"recommendation":"reject","confidential_remarks":"The rejection is driven by a single internal inconsistency rather than a disagreement with external consensus: the only secret in the construction, K, is derived from a public C2PA claim hash, so the level of security promised in the threat model is not achieved. This is not a subtle boundary case; it invalidates the central robustness claim. If the authors replace the public key derivation with proper secret-key provisioning and regenerate the security evaluation under that model, the spectral-threshold observation and the deployment engineering could form the basis of a future submission, but the present manuscript should not be published as a security claim."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"You should know: the paper's central security claim doesn't survive its own key-derivation design. KeyGen sets K = HKDF(claim_hash(m), \"HaloMark\"), and the C2PA claim hash is public, verifier-visible data. The threat model says the adversary lacks K, but any C4 attacker with the manifest can compute claim_hash(m), derive K, regenerate the block subset, rotation, and all signatures, then subtract the exact watermark. In the manifold-aligned default this recovers x_clean with cosine near 1 while Verify sees T ≈ 0. Lemma 1 authenticates m but doesn't keep the claim hash secret. The reader's report is right, and the stress-test note holds up on a direct read.\n\nThat's the bad news. The rest of the paper is more useful than the average broken watermark submission. The published-commit protocol is a real idea: signing the LSH commitment c into the C2PA sidecar so the verifier reads it instead of recomputing removes the bucket-flip fragility under whitening, and the 62% flip rate at cos=0.96 is a concrete motivation. The empirical spectral threshold eff_rank/d≈0.19 across eleven encoders is a genuinely interesting regularity for anyone designing embedding watermarks, even if it is not derived. The evaluation is extensive, the baselines are plausible, and the reporting is honest: the authors explicitly say which bounds are rigorous, which are empirical, and where the theory is loose (Cauchy-Schwarz floor of 0.136 vs empirical 0.851; the dimension-uniformity gap). Code and data are provided. That's real evidence of careful work.\n\nThe soft spot is as large as it gets: the secret is derivable from public data. This is an internal contradiction between the threat model and KeyGen, not a disagreement with an external consensus or a missing baseline. Fixing it would require a producer-held secret key somewhere in the derivation, which would change the protocol's deployment story but not the empirical threshold or the published-commit idea. As written, the security analysis is not salvageable.\n\nWho gets value from this? People working on embedding provenance might mine the threshold and the protocol as a starting point, and security folks might use this as a textbook example of why \"public manifest, secret key\" must not share an input. It deserves a serious referee because the empirical survey is substantial and the flaw is instructive, but it cannot be accepted as a security contribution in its current form. I'd recommend peer review with a clear note that the central claim fails unless the key-derivation premise changes.","headline":"The key derivation from the public C2PA claim hash breaks the central secrecy assumption, so the headline security claim collapses; the empirical threshold and published-commit idea remain useful.","tokens_in":22148,"tokens_out":4518,"would_cite":false,"duration_ms":43338,"reading_group":"yes","serious_thinker":"no","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A C2PA-bound embedding watermark survives known-plaintext removal only when the encoder's effective-rank ratio exceeds about 0.19.","keywords":["embedding watermarking","C2PA provenance","known-plaintext attack","spectral threshold","locality-sensitive hashing","denoising autoencoder","vector databases","signature retention"],"falsifier":"Take any published watermarked vector and its C2PA manifest; compute $K=\\mathrm{HKDF}(\\mathrm{claim\\_hash}(m), \\text{'HaloMark'})$, regenerate the block-diagonal rotation, commitment, and per-block signatures, and subtract the reconstructed perturbation from $x'$. If the cosine to the clean vector stays at or above 0.95 while the HaloMark score drops to the null distribution, the C4 removal claim fails under the paper's own public-data assumption.","tokens_in":21099,"feed_emoji":"🛡️","tokens_out":9347,"duration_ms":92362,"temperature":0.7,"pith_summary":"HaloMark tries to establish that embedding vectors can carry a C2PA-bound watermark that survives routine post-processing and even a polynomial known-plaintext attacker, provided the embedding model's spectrum is favorable. The protocol change that makes this tractable is publishing the per-vector locality-sensitive-hash commitment in the signed C2PA sidecar so the verifier reads it instead of recomputing it from a possibly attacked input. That single move reduces the detection score to a null term plus a single retention scalar $\\beta(A)\\varepsilon$, and the paper claims the scalar stays high exactly when the encoder's effective-rank ratio $\\operatorname{eff\\_rank}(\\Sigma)/d$ is above about $0.19$. On eleven embedders, every above-threshold model defends (AUROC at least 0.98 across all in-budget attacks on the three fully swept encoders, and at least 0.965 under single-seed DAE removal on the rest) while every below-threshold variant fails. If correct, this fixes content provenance for dense vectors in RAG and semantic-search systems where fixed hashes cannot survive normal embedding transformations.","feed_headline":"Embedding watermark holds above spectral ratio 0.19","feed_subtitle":"A published LSH commitment in the C2PA sidecar keeps detection AUROC 0.965–0.997 on favorable encoders.","key_machinery":"The load-bearing object is the published commitment $c$: a scale-invariant locality-sensitive-hash bucket computed on the non-watermark subspace of the whitened, rotated embedding, signed into the C2PA sidecar alongside the vector and nonce. Because the verifier reads $c$ from the manifest instead of recomputing it, the verifier-side signatures equal the producer-side signatures bit-for-bit, and the verifier score splits linearly as $T = T_{\\mathrm{null}} + \\beta(A)\\varepsilon$ (Lemma 1). The scalar $\\beta(A)$, the attacker's retained signature fraction, then carries the whole security argument: the paper bounds it rigorously for linear attackers via a Wiener-filter characterization $\\beta_{\\mathrm{char}} = \\phi(\\nu^*)/\\sqrt{d\\,\\rho(\\nu^*)}$ and for non-adaptive attackers via $\\mathbb{E}[\\beta] \\ge 0.97$, while for the adaptive DAE it is measured empirically. Four primitives compose behind that scalar: a block-diagonal orthogonal rotation $Q$ keyed by $K$, public Tikhonov-regularized whitening $W = (\\Sigma_{\\mathrm{calib}} + \\lambda_{\\mathrm{reg}} I)^{-1/2}$, a content-dependent LSH commitment, and a per-vector nonce; the production default additionally aligns watermark blocks with the top eigenvectors of $\\Sigma_{\\mathrm{calib}}$.","core_discovery":"The central claim is that a perturbative embedding watermark can be cryptographically bound to C2PA and can resist known-plaintext removal attacks with detection AUROC at least 0.965, not for every encoder, but precisely for encoders whose covariance spectrum is diffuse enough that $\\operatorname{eff\\_rank}(\\Sigma)/d \\ge 0.19$. Above the threshold the construction keeps detection AUROC at 0.99 or better on the fully swept encoders under a denoising-autoencoder attacker trained on $10^5$ clean/watermarked pairs with full sidecar visibility, and at 0.965 or higher on the remaining above-threshold encoders. Below the threshold, six structurally distinct perturbative schemes all collapse, including manifold-aligned additive, multiplicative rotation, anchor-pulling, and adversarial-carrier selection. The paper interprets this as a structural limit: below the threshold, any perturbative direction is either off the data manifold and removable by projection, or on it and indistinguishable from data variability. The security statement is the reduction of the whole argument to a single scalar $\\beta(A)$, bounded rigorously for linear and non-adaptive attackers and characterized empirically, within about 13%, for the adaptive Wiener/DAE case.","pith_inferences":["The paper's own KeyGen derives $K = \\mathrm{HKDF}(\\mathrm{claim\\_hash}(m), \\text{'HaloMark'})$ from the public C2PA manifest claim hash, so a sidecar-visible adversary can recompute $K$ and regenerate every signature; the paper does not fold this consequence into its C4 analysis.","If the key-derivation issue is patched by deriving $K$ from a verifier-side secret rather than public manifest data, the remaining empirical claims about the spectral threshold, AUROC levels, and latency would stand or fall on their own.","The threshold $0.19$ could serve as a deployer-facing screening statistic: compute $\\operatorname{eff\\_rank}(\\Sigma)/d$ from a calibration corpus to predict whether any perturbative watermark can hold before implementing the attack suite.","The dimension-uniformity of the threshold across $d \\in \\{384,512,768,1024\\}$ is not captured by the paper's random-Q formula, suggesting a curvature-corrected derivation from the data manifold's geometry; testing embedders beyond $d=1024$ would show whether the uniformity persists."],"forward_implications":["Encoders with $\\operatorname{eff\\_rank}(\\Sigma)/d \\ge 0.19$ can deploy C2PA-bound embedding provenance with DAE-removal AUROC at least 0.965, usually above 0.99, even when the adversary holds $10^5$ clean/watermarked pairs and the full signed sidecar.","The verifier never needs to re-derive the LSH bucket from an attacked vector; the published commitment removes the whitening-induced bucket-flip fragility that costs about 20 TPR points in a recompute-commit design.","Below the threshold, no perturbative watermark design among those tested clears the AUROC 0.85 trip-wire, so the encoder's spectrum, not the watermark construction, decides feasibility.","The system fits into existing vector-database pipelines: 24 bytes of sidecar per vector, about 284 microseconds of verification as a vector-database admission filter, and end-to-end C2PA validation across three reference-SDK bindings.","When source text travels with the embedding, a MinHash sketch in the same manifest rejects 92% of multi-attempt paraphrases while accepting routine perturbations, closing the paraphrase gap for RAG deployments; pure-vector deployments remain paraphrase-open."],"supporting_citations":[{"why":"Supplies the LSH-commit pattern for content-dependent signatures; HaloMark changes it by publishing the commitment in the sidecar.","marker":"[1]"},{"why":"Defines the C2PA manifest claim hash and signature that bind the sidecar tuple and, in this scheme, derive the key.","marker":"[2]"},{"why":"Demonstrates single-pair black-box forgery on content-agnostic watermarks, the direction-oracle attack the construction must survive.","marker":"[5]"},{"why":"Provides the per-output randomness pattern that the per-vector nonce adapts to embedding vectors.","marker":"[8]"},{"why":"Establishes the C2PA-binding pattern for image watermarks that HaloMark carries over to embedding vectors.","marker":"[13]"},{"why":"Linear-transformation EaaS watermark used as the closest baseline; its port collapses under the direction oracle in this threat model.","marker":"[11]"},{"why":"Sparse content-dependent EaaS watermark whose port supplies the content-dependent-without-freshness failure mode.","marker":"[12]"},{"why":"Supplies the calibration corpus used to compute $\\Sigma_{\\mathrm{calib}}$ and the test and null embeddings for the headline numbers.","marker":"[35]"}],"fun_headline_variants":["Embedding watermark survives above spectral ratio 0.19","For embedding watermark, spectral ratio 0.19 is the cutoff","HaloMark: C2PA watermark's success hinges on one ratio","Watermark detection fails below spectral ratio 0.19"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The threat model requires that the adversary never learn the watermark key $K$, but the scheme defines $K$ as a hash of the public C2PA manifest claim hash, so a party who can read the signed sidecar can recompute $K$ and every derived signature.","fun_headline_variants_meta":{"raw":{"variants":["Embedding watermark survives above spectral ratio 0.19","For embedding watermark, spectral ratio 0.19 is the cutoff","HaloMark: C2PA watermark's success hinges on one ratio","Watermark detection fails below spectral ratio 0.19"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000312,"raw_usage":{"total_tokens":1900,"prompt_tokens":1193,"completion_tokens":707,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":809,"completion_tokens_details":{"reasoning_tokens":635}},"tokens_in":809,"tokens_out":707,"duration_ms":7616,"temperature":1.0,"reasoning_tokens":635,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-14T04:29:20.963030+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take any published watermarked vector and its C2PA manifest; compute $K=\\mathrm{HKDF}(\\mathrm{claim\\_hash}(m), \\text{'HaloMark'})$, regenerate the block-diagonal rotation, commitment, and per-block signatures, and subtract the reconstructed perturbation from $x'$. If the cosine to the clean vector stays at or above 0.95 while the HaloMark score drops to the null distribution, the C4 removal claim fails under the paper's own public-data assumption.","supporting_citations":[{"cited_title":"C2PA specification, version 2.0,","cited_arxiv_id":null,"evidence_quote":"Defines the C2PA manifest claim hash and signature that bind the sidecar tuple and, in this scheme, derive the key."},{"cited_title":"MetaSeal: Defending against image attribution forgery through content-dependent cryptographic watermarks,","cited_arxiv_id":null,"evidence_quote":"Establishes the C2PA-binding pattern for image watermarks that HaloMark carries over to embedding vectors."}],"review_version":1}