We present a key-recovery attack on a watermarking scheme for authentication and localisation due to Li and Yuan. The attack exploits a lack of diffusion in the system. Each bit of the key affects only a small region of the watermarked image. Even though a brute-force attack is intractible, an exhaustive search is possible by considering one region at a time, and thereby recover the key. General Terms security