reviews: 
Comments: This paper introduces a post-processing watermarking scheme that leverages a diffusion-based super-resolution model. The author aims to exploit the inherent resilience of stable diffusion to withstand various distortions, resulting in a training-free framework. In this approach, the watermark is embedded within initial Gaussian noise, which is subsequently processed using pretrained super-resolution models to denoise the watermark.
Strengths: -	The paper clearly points out the parts of the proposed framework that come from other works, and this candor could be a strength of the paper.
Weaknesses: - My humble thought on this paper is that the method is very similar to a “super-resolution-variant” of Gaussian Shading [1]. The frameworks of the two are very similar. The only obvious difference is that the DPM-solver part of Gaussian Shading is replaced with the sampler in the super-resolution model in this paper. As for this super-resolution model, its necessity is not seen. Both the image provided by the user and the watermarked images returned to the user are of normal resolution, which means that the so-called super-resolution model can be replaced by another stable-diffusion based model. We believe that both train-free and performance are advantages brought by stable diffusion, not the contribution of this paper.
- Performance is not good enough since visual quality and decoding accuracy is lower than some previous methods. According to Table 1, the PSNR of the proposed method is lower than CIN [2], MBRS [3] and so on, and the extraction accuracy is lower than StegaStamp [4] in most of the cases.
- As stated by the author, this paper also adopts the injection strategy of Gaussian Shade. We may raise a concern that, in the injection strategy of Gaussian Shade, there is one step that needs to replicate the watermarking information for many times, which may make the distribution deviate far from the uniform distribution. Therefore, an encryption process needs to be added to preserve a uniform distribution. Then a problem arises. When extracting the watermark, both the image and the key must be provided. Obviously, if there is a malicious attacker, we should assume that the attacker has obtained the same image. At this time, the security of the copyright is entirely entrusted to the key, so how can we ensure the security of the key? The service provider may also use a secure channel to transmit the key to the client at this time. This behavior is more like steganography than watermarking. After all, for watermarking, it is enough to extract the content that matches the identity. For previous methods, even if the attacker obtains the same image (from public channel), it is impossible to extract the content that matches him. But now the security guarantee has been transferred to the key, which needs to be transmitted over a secure channel. In this case, why not use a password, which is more convenient? We suggest the author include a section discussing the trade-offs between their approach and traditional watermarking in terms of security.

Ref:
- [1] Yang, Zijin, et al. "Gaussian Shading: Provable Performance-Lossless Image Watermarking for Diffusion Models." Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2024.
- [2] Ma, Rui, et al. "Towards blind watermarking: Combining invertible and non-invertible mechanisms." Proceedings of the 30th ACM International Conference on Multimedia. 2022.
- [3] Jia, Zhaoyang, Han Fang, and Weiming Zhang. "Mbrs: Enhancing robustness of dnn-based watermarking by mini-batch of real and simulated jpeg compression." Proceedings of the 29th ACM international conference on multimedia. 2021.
- [4] Tancik, Matthew, Ben Mildenhall, and Ren Ng. "Stegastamp: Invisible hyperlinks in physical photographs." Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. 2020.
Recommendation: 3
Reviewer confidence: 4
Soundness/correctness: 3
Clarity: 2