Review Report: 'Two-Stage Diffusion Model Watermarking Scheme Based on LoRA' (DOI: 10.15888/j.cnki.csa.009855)

Academic fraud report · Geng Detector

Summary

This report examines a 2025 paper in Journal of Computer Systems Applications concerning a LoRA-based two-stage diffusion watermarking approach. The overall verdict is 'questionable' (yellow), based on four main concerns rather than outright evidence of fraud. First, the citation labels in Table 4 are mismatched: references [14] and [16] do not correspond to StegaStamp and HiDDeN respectively, indicating a copy-paste referencing error. Second, the abstract claims the proposed method 'improves' the FID metric by 0.61%, which contradicts the convention that lower FID indicates better image quality; the magnitude was also computed only against a weaker baseline (Stable Signature at 24.77 vs. the authors' 24.62), avoiding comparison with RivaGAN (24.53). Third, the paper claims robustness against 'rotation' attacks in one section but never implements rotation in the experimental setup. Fourth, suspicious precision in TPR (0.521 vs. Acc 53.48%) for DWT-DCT-SVD lacks methodological justification. Image reuse and timeline analyses were inconclusive. Confidence is moderate; findings need author clarification.

Verdict

🟡 Questionable. The paper contains multiple citation mismatches, a conceptual error in interpreting FID, internal inconsistency in attack descriptions, and a suspiciously precise TPR value without methodology. None of these alone proves fraud, but together they indicate substantial editorial and methodological sloppiness.

Key findings

Citation mismatch in Table 4: Reference [16] is cited as HiDDeN but actually points to "Zhang KA, et al. Robust invisible video watermarking with attention." The genuine HiDDeN paper is reference [15] (Zhu JR, et al.). Similarly, reference [14] is cited as StegaStamp but corresponds to "Jia ZY, et al. MBRS..."; the real StegaStamp is reference [13].
FID interpretation paradox: The abstract states the watermark image's FID distance was "improved by 0.61%" as evidence of imperceptibility. In generative modeling, lower FID means better quality, so an "increase" indicates degradation, not improvement.
Selective baseline comparison: In Table 2, the authors report FID = 24.62 for "Ours" on Stable Diffusion, while RivaGAN achieves 24.53 (better) and Stable Signature achieves 24.77 (worse). The 0.61% figure is derived from (24.77 − 24.62)/24.77 ≈ 0.61%, selecting only the worse baseline for comparison rather than reporting against the strongest competitor.
Phantom rotation attack: The discussion of Table 3 claims robustness under "Gaussian noise, JPEG compression, cropping, rotation, etc." but Section 3.3 lists only five implemented attacks: JPEG compression, cropping and scaling, Gaussian blur, Gaussian noise, and color jitter. Rotation was never implemented.
Suspicious numerical alignment: In Table 3, DWT-DCT-SVD yields Acc = 53.48% with TPR = 0.521. The unexplained three-decimal precision coinciding with a two-decimal accuracy rate raises questions about the threshold selection methodology behind TPR.
Image and timeline checks: Visual inspection of Figures 1–3 did not reveal obvious image reuse. Publication timeline (latest ref 2024, received 2024-11-01, published 2025) is self-consistent; RTX 3090 hardware is plausible.

Evidence highlights

Table 4 citation errors confirmed against the bibliography list (refs [13], [14], [15], [16]).
Table 2 raw values: Ours = 24.62; RivaGAN = 24.53; Stable Signature = 24.77. Authors' 0.61% claim is mathematically reproducible only against Stable Signature.
Section 3.3 explicit enumeration of five attacks excludes rotation.
Table 3 DWT-DCT-SVD row: Acc = 53.48%, TPR = 0.521 (no threshold rationale provided).

Notes

DOI: 10.15888/j.cnki.csa.009855
Image-level forensic analysis (Forensically-style ELA/noise) was not possible because source images were not available in the provided document; visual inspection only.
Acc computation check for Stable Diffusion in Table 1: (94.93 + 91.33 + 93.67 + 95.98 + 93.35) / 5 = 93.852, which matches the reported three-decimal mean—arithmetically consistent but does not validate experimental integrity.
Confidence is moderate; final determination of misconduct requires institutional investigation. Authors are encouraged to clarify citation mapping, FID interpretation, the rotation-attack statement, and TPR threshold methodology.