In the blind RSA signature scheme the blinding of a message
$m$ (to be blindly signed) is **multiplicative** with value $r^e$, where
you ensure that $r$ is invertible modulo $N$.

So if the sender receives the signed blinded message back from the
signer, he can unblind by multiplying with $r^{-1}$, yielding $s\equiv
m^d \pmod N$ which is a valid (textbook) RSA signature for $m$. 

**Padding by the sender**

Note, that $m$ could also be the result of any [padding method for RSA
signatures](http://en.wikipedia.org/wiki/PKCS_1#Schemes), which however
needs to be applied **by the sender** before blinding. By denoting this padding as $f$ we can simply 
consider the blinded message to be $m'\equiv f(m)r^e \pmod N$ (which clearly can be unblinded after blind signing).


**Padding by the signer**

Denoting the blinded message which is sent to the signer as $m'\equiv
mr^e \pmod N$, then padding **by the signer** means that the signer
changes the blinded message $m'\equiv mr^e \pmod N$ to some $m''$ before
signing. [Padding methods for RSA signatures](http://en.wikipedia.org/wiki/PKCS_1#Schemes) hash the original
message (possibly with some parameters), padd the hash value to some
certain format and the result is then interpreted as an element in
$Z_N$, which is then exponentiated with the private signing exponent
$d$. 

Observe that in doing so the signer padds an already blinded message and denote this padded blinded 
message as $m''=f(m')=f(mr^e)$. If such a padding to the message $m'$ received by the signer is applied **by the
signer**, then the signature obtained by the sender for $m''$ will be $s' \equiv (f(mr^e))^d \pmod N$ 
and then unblinding, i.e., computing $s'\cdot r^{-1} \equiv (f(mr^e))^d\cdot r^{-1} \pmod N$, 
will yield some element from $Z_N$ which is clearly not a valid signature $m^d\pmod N$ for the message $m$ the sender wants to be signed 
(for padding functions $f$ we assume to be applied, i.e., involving hashing. Clearly, if $f$ is the identity function then it works, but that is no padding).