Writing study: Spherical Watermark: Encryption-Free, Lossless Watermarking for Diffusion Models

ICLR overviewCorpus atlasBy contribution typeVisual galleryRules & templateWriting patternsPaper studies

← ICLR 2026 oral writing corpus

Xiaoxiao Hu, Jiaqi Jin, Sheng Li, Wanli Peng, Xinpeng Zhang, Zhenxing Qian · Official ICLR 2026 oral record

Observed writing choices, not acceptance rules. This study examines the inspected manuscript version. It does not establish why the paper was accepted or that its presentation choices should be copied unchanged.

Figure, table and section ledger

Editorial contribution type: Inference, algorithms & systems efficiency (primary) · Theory & formal foundations.

Layout extraction, not a required paper template. Counts are distinct caption labels; a multi-panel figure counts once. Section spans are estimated from heading positions, including floats and whitespace. Method and limitations.

Canonical PDF

33 physical pages

Before references / appendix

≈ 10.45 page-equivalents

Main figures / tables

6 / 5

Attached appendix figures / tables

11 / 12

Attached appendix span

≈ 18.31 page-equivalents

Before references / appendix: ≈ 31.67%References / intervening material: ≈ 12.85%Attached appendix: ≈ 55.48%Estimated layout envelopes, not text/artwork area. Unresolved appendix boundaries remain within the undivided post-body material.

Section-by-section lengths and source pages

The title/abstract/front matter precede the first numbered heading. A span ends at the next detected top-level heading, not at the last sentence; end-page whitespace is included. References and statements are listed separately. These are not measurements of text-only or artwork area.

Top-level heading	Starts on PDF page	Estimated span	Share of entire PDF
1 INTRODUCTION	1	≈ 0.89 pp.	2.7%
2 RELATED WORKS	2	≈ 0.87 pp.	2.64%
3 METHOD	3	≈ 3.23 pp.	9.79%
4 EXPERIMENT	6	≈ 4.03 pp.	12.21%
5 DISCUSSION AND LIMITATIONS	10	≈ 0.18 pp.	0.55%
6 CONCLUSION	10	≈ 0.31 pp.	0.94%
ACKNOWLEDGMENTS	11	≈ 0.1 pp.	0.3%
ETHICS STATEMENT	11	≈ 0.11 pp.	0.33%
REPRODUCIBILITY STATEMENT	11	≈ 0.14 pp.	0.42%
REFERENCES	11	≈ 4.24 pp.	12.85%
APPENDIX	15	≈ 0.16 pp.	0.48%
A USE OF LARGE LANGUAGE MODELS	15	≈ 0.59 pp.	1.79%
B OVERVIEW OF BASELINE METHODS	16	≈ 0.92 pp.	2.79%
C PROOFS OF THEOREMS AND LEMMAS IN SECTION 3.3	17	≈ 4.94 pp.	14.97%
D ROLE OF ROTATION IN ENHANCING ROBUSTNESS	22	≈ 1.8 pp.	5.45%
E WHY LOSSLESSNESS MATTERS: AN DETECTOR-DRIVEN OPTIMIZATION	24	≈ 1.51 pp.	4.58%
F MORE DETAILS AND EXPERIMENTAL RESULTS	25	≈ 8.38 pp.	25.39%

All detected figure and table locations

Main text

• Figure 1 · p. 3
• Table 1 · p. 7
• Figure 2 · p. 7
• Figure 3 · p. 7
• Table 2 · p. 8
• Figure 4 · p. 8
• Figure 5 · p. 9
• Figure 6 · p. 9
• Table 3 · p. 10
• Table 4 · p. 10
• Table 5 · p. 10

Attached appendix

• Figure 7 · p. 16
• Figure 8 · p. 25
• Table 6 · p. 25
• Table 7 · p. 25
• Figure 9 · p. 26
• Figure 10 · p. 26
• Table 8 · p. 27
• Table 9 · p. 27
• Table 10 · p. 28
• Table 11 · p. 28
• Figure 11 · p. 28
• Figure 12 · p. 29
• Figure 13 · p. 29
• Table 12 · p. 30
• Table 13 · p. 30
• Table 14 · p. 30
• Table 15 · p. 30
• Table 16 · p. 31
• Table 17 · p. 31
• Figure 14 · p. 31
• Figure 15 · p. 32
• Figure 16 · p. 33
• Figure 17 · p. 33

Argument and organization

1. Provenance problem → invertible embedding pipeline

   Separates offline signature construction from runtime generation and extraction.

2. Theory → fidelity, tracing, speed → ablations

   Groups evaluation around distinct promised benefits.

Argument and section order

The method first defines Embed/Extract and desired properties, then introduces three named modules whose symbols recur in the equations and ablations.

Sections 3.1–3.3, pages 3–6 · Main paper

Figures, captions and visual explanation

Figure 1 separates the deployment workflow from the algebraic pipeline and uses forward/backward arrows for embedding and extraction; the sphere drawings give a concrete meaning to the rotation step.

Figure 1, page 3 · Main paper

Tables, comparisons and evidence

Table 2 distinguishes bit accuracy from TPR at 1% FPR and separates clean, post-processing, and adversarial settings rather than compressing robustness into one score.

Table 2, page 8 · Main paper

The efficiency paragraph explicitly excludes diffusion generation and inversion from its timing; retaining that boundary prevents a watermark-decoder speedup being mistaken for end-to-end acceleration.

Figure 4 and Computational Efficiency, page 8 · Main paper

Appendix and reproducibility

The appendix has a navigational overview, then separates mathematical arguments from attack parameters and cross-backbone experiments; attack-strength details make the aggregate main table interpretable.

Appendix overview, page 15; Appendices C–F, pages 17–33 · Main paper

Clarity and writing conventions

The strong exact-Gaussian and indistinguishability language should be narrowed to the proved low-order moment properties and tested detectors: a fixed rotation of a finite spherical design is not a uniform continuous sphere.

Section 3.3, page 6; Section 5, page 10; Appendix C, pages 19–22 · Main paper

What to reuse—and what not to infer

Transferable lesson: Give each advertised property its own evaluation axis and disclose what is excluded from speed measurements directly beside the figure.

Boundary: Moment matching and near-chance performance of selected classifiers do not establish general cryptographic indistinguishability or exact joint Gaussianity. Fixed-key Gaussian Shading is also a deliberately altered baseline configuration.

Apply this lesson using the argument and evidence worksheet.

Inspection record and sources

Checked

2026-09-19

Reading status

Full text + selected visuals inspected

Main text

Pages 1–11, Sections 1–6 and reproducibility statement; references through page 15

Appendix / supplement

Pages 15–33, Appendices A–F: baseline descriptions, proofs, channel analysis, threat-model argument, additional models and attacks

Visually inspected PDF pages

3, 8

• ICLR 2026 final proceedings · 33 pages