Writing study: ROAR: Reducing Inversion Error in Generative Image Watermarking

ICCV overviewCorpus atlasBy contribution typeVisual galleryRules & templateWriting patternsPaper studies

← ICCV 2025 oral writing corpus

Hanyi Wang, Han Fang, Shi-Lin Wang, Ee-Chien Chang · Official ICCV 2025 oral record

Observed writing choices, not acceptance rules. This study examines the inspected manuscript version. It does not establish why the paper was accepted or that its presentation choices should be copied unchanged.

Figure, table and section ledger

Editorial contribution type: Domain-grounded methods & physical systems (primary).

Layout extraction, not a required paper template. Counts are distinct caption labels; a multi-panel figure counts once. Section spans are estimated from heading positions, including floats and whitespace. Method and limitations.

Canonical PDF

10 physical pages

Before references / appendix

≈ 8.05 page-equivalents

Main figures / tables

7 / 5

Attached appendix figures / tables

0 / 0

Attached appendix span

No boundary detected; not assumed zero

Before references / appendix: ≈ 80.5%References / intervening material: ≈ 19.5%Estimated layout envelopes, not text/artwork area. Unresolved appendix boundaries remain within the undivided post-body material.

Extraction notes: No attached appendix boundary detected. Zero means no recognized caption, not independently verified absence.

Section-by-section lengths and source pages

The title/abstract/front matter precede the first numbered heading. A span ends at the next detected top-level heading, not at the last sentence; end-page whitespace is included. References and statements are listed separately. These are not measurements of text-only or artwork area.

Top-level heading	Starts on PDF page	Estimated span	Share of entire PDF
1. Introduction	1	≈ 1.04 pp.	10.4%
2. Related Work	2	≈ 0.63 pp.	6.3%
3. Preliminary	3	≈ 0.68 pp.	6.8%
4. Method	3	≈ 1.68 pp.	16.8%
5. Experiments	5	≈ 3.42 pp.	34.2%
6. Conclusion	8	≈ 0.09 pp.	0.9%
7. Acknowledgment	8	≈ 0.12 pp.	1.2%
References	9	≈ 1.95 pp.	19.5%

All detected figure and table locations

Main text

• Figure 1 · p. 1
• Figure 2 · p. 3
• Figure 3 · p. 4
• Figure 4 · p. 5
• Table 1 · p. 6
• Figure 5 · p. 6
• Figure 6 · p. 7
• Table 2 · p. 7
• Table 3 · p. 7
• Table 4 · p. 8
• Table 5 · p. 8
• Figure 7 · p. 8

Attached appendix

No recognized caption labels.

Argument and organization

1. 1 Introduction; 2 Related Work; 3 Preliminary

   Reframes watermark robustness around extraction/inversion rather than only embedding design.

2. 4 Method

   Decomposes latent estimation and pixel distortion errors, then separates restoration training from test-time regeneration optimization.

3. 5 Experiments; 6 Conclusion

   Measures latent-error reduction before watermark detection, distortion/attack stress tests and component/iteration ablations.

Problem, claim and contribution

Two error sources are mapped to two interventions, while condition drift is explicitly distinguished from the estimation error targeted by regeneration.

Sections 1 and 4.1, physical pp.1–4 · Main paper

Argument and section order

A direct latent-distance experiment precedes downstream robustness, providing an intermediate check of the claimed inversion-error mechanism.

Sections 5.2–5.3 and Figure 4, pp.5–6 · Main paper

Figures, captions and visual explanation

The overview separates restoration-network training from extraction-time optimization and uses frozen/trainable markers to disambiguate which parameters change.

Figure 3, p.4 · Main paper

Tables, comparisons and evidence

Distortion sweeps label strength and distinguish detection TPR from bit accuracy; adaptive-attack results pair those metrics with image PSNR.

Figure 6 and Table 2, p.7 · Main paper

Appendix and reproducibility

Further mathematical analysis of regeneration-based optimization is explicitly assigned to the supplementary material, which was not inspected.

Section 4.1, p.4 · Main paper

Clarity and writing conventions

The attack discussion acknowledges quality degradation and declining recovery at stronger purification levels, rather than reporting only successful weak attacks.

Section 5.4, p.7 · Main paper

What to reuse—and what not to infer

Transferable lesson: Test the intermediate mechanism separately from the endpoint and report attack strength together with both recovery and image damage.

Boundary: Robustness against listed distortions and two attack families is not universal resistance or proof of provenance. The stated extremely low false-positive operating point needs its own threshold assumptions; 1,000 test images cannot empirically establish a 10^-10 tail probability. Test-time optimization adds cost and the detector requires the relevant generative model.

Apply this lesson using the argument and evidence worksheet.

Inspection record and sources

Checked

2026-10-07

Reading status

Writing-focused manuscript scan + selected visuals inspected

Main text

Writing-oriented scan across the main manuscript, physical PDF pp.1–8, covering framing, section progression, method explanations, captions, comparison protocols and concluding scope; reference boundary checked. Selected full-page rasters were inspected. Not exhaustive line-by-line reading, proof verification or experimental reproduction.

Appendix / supplement

Main-paper appendix/supplement references were checked. A separate supplementary source is linked in the inventory but was not retrieved or inspected; its contents are not included in the reading or visual-page counts.

Visually inspected PDF pages

4, 7

This is a writing-focused scan of the manuscript and the stated supplementary scope: framing, organization, visual explanation, evidence presentation and wording. It is not a line-by-line proof audit, reproduction of results or exhaustive scientific review.

• Official CVF open-access ICCV 2025 accepted-paper PDF, retrieved 7 October 2026; CVF states identical to accepted version except watermark; not assumed identical to initial submission · 10 pages