Active Defense for Deepfakes Using Watermark-Guided Original Face Recovery

Abstract

At present, active defense strategies based on digital watermarking mainly rely on post-event watermark extraction, which verifies the occurrence of deepfake events by measuring the degree of watermark degradation, or on adversarial watermarks to interfere with image generation. To overcome these limitations, we propose a unified watermarking framework that can restore the original content of images tampered with by deepfakes. This scheme integrates three core components: an encoder for watermark pre-embedding, a decoder for robust watermark extraction, and a face restorer for watermark-guided image restoration. Numerous experiments have shown that this method has achieved good results in terms of extraction accuracy and recovery performance, thereby verifying the effectiveness of this approach.

1. Introduction

With the continuous advancement of deep learning, an increasing number of researchers have become engaged in this field, driving breakthroughs in related technologies across multiple domains, such as remote sensing image scene classification [1], deepfake detection [2,3,4], vulnerability detection [5], etc. Deepfakes are a technology capable of tampering with human faces. After such tampering, facial images may exhibit obvious differences and changes [6,7,8,9,10]. The societal impact of deepfakes is profound, and their potential risks are multifaceted. For instance, malicious actors may manipulate facial images of political figures to disrupt public order or engage in other harmful activities [11,12]. Consequently, developing effective defenses against deepfakes is imperative.

Defense against deepfakes mainly consists of proactive and passive approaches. Passive defense [13,14] focuses on capturing the subtle traces left by facial tampering to achieve security goals. Yu et al. [15] proposed a method that provides auxiliary detection for invisible face forgery through cross-domain comparison. However, passive approaches—due to the lack of a universal model—may not robustly cover images generated by known or unknown deep forgery tools. Lu et al. [16] designed a spatiotemporal model that regards spatial and temporal cues as a whole and synchronously captures forgery traces across frames and regions. Nie et al. [17] proposed a diffusion-based inconsistent pattern learning mechanism, which is specifically designed to uncover subtle contradictions at the temporal level.

However, these passive detection technologies cannot promptly prevent deepfakes from occurring and often can only be verified after the fact. Therefore, proactive detection technologies can play a more effective role in this regard. Proactive deepfake defense is generally achieved by adding perturbations [18,19] to the image or embedding watermarks [20,21].

Watermarks can be further refined into three mainstream types, namely adversarial watermarks, fragile watermarks, and robust watermarks. All three types involve pre-embedded watermarks, which are then used to detect and defend against deepfakes. Among them, adversarial watermarking focuses on interfering with the generation of deepfakes through watermarking, thereby resisting deepfakes at their source. Lv et al. [20] proposed an adversarial watermarking technique, embedding imperceptible perturbations in images, which cause the images to blur and degrade semantic fidelity during the processing of deepfake models, thereby simultaneously enhancing the anti-counterfeiting capabilities of both visual and automatic detection. Fragile watermarking is achieved by deliberately allowing the watermark to be destroyed by a deepfake for post-event comparison and detection. Neekhara et al. [22] designed a watermarking scheme that remains robust to ordinary interference but is vulnerable to deepfakes. Robust watermarks maintain a high extraction rate under any circumstance, making them suitable for post-event tracking. Wu et al. [23] constructed a watermarking scheme that can effectively resist interference in different deepfake scenarios, thereby maintaining the watermark’s robustness.

While the above-mentioned schemes offer some resistance against deepfakes, they generally lack the capability to restore manipulated images. Recent research, however, has begun to address this gap. For example, Yu et al. [24] proposed DFREC, a deepfake identity recovery method that simultaneously reconstructs source and target faces using identity segmentation and dual-path reconstruction, achieving high fidelity and traceability. Similarly, Ai et al. [25] introduced DeepReversion, an end-to-end UNet-based network that learns an inverse mapping from fake to original faces, enabling high-fidelity facial inversion and identity recovery. Shao et al. [26] further advanced the field with SeqFakeFormer, which performs sequential prediction of facial manipulations, allowing both the detection of tampered sequences and high-fidelity restoration of original faces.

It is important to clarify that “restoration” in this context refers primarily to the semantic recovery of facial attributes and overall visual content, rather than pixel-level reconstruction of high-frequency details. Moreover, these approaches typically operate without access to true attribute information, which limits their recovery precision. Critically, they also lack the ability to perform copyright verification. Therefore, a unified framework capable of simultaneous copyright verification, semantic content recovery, and forensic traceability remains urgently needed.

In this paper, we propose a unified watermarking framework that integrates the aforementioned functionalities. Our approach employs an encoder−decoder architecture to imperceptibly embed and reliably extract a robust watermark. A dedicated face restorer is further developed to recover images altered by deepfake manipulations. Crucially, the embedded watermark is designed to maintain high robustness even after deepfake processing. The main contributions of this work are as follows:

1.

A facial image recovery framework leveraging auxiliary watermark information has been developed. The framework restores deepfake images by extracting and utilizing guidance information from watermarks present in the images.

2.

A two-stage training procedure was implemented. First, an encoding and decoding architecture was fine-tuned to enhance the robustness of the watermark against both deepfake manipulations and subsequent image recovery operations. Subsequently, a face restorer network was fine-tuned, enabling it to recover deepfake-corrupted images under the guidance of the embedded watermarks.

3.

A dual watermarking framework is proposed. The first-layer watermark is used to provide the labels required for face recovery and can maintain robustness after various sources of noise interference. The second-layer watermark is used to hide additional information by extending the bit length. This integrated approach enables the watermarking system to support both face recovery and forensic traceability.

2. Related Work

2.1. Deepfakes Based on Attribute Editing

In recent years, the continuous advancement of deep learning techniques has driven the rapid evolution of deepfake technologies. Among them, deepfakes based on facial attribute editing [27,28] have gradually attracted widespread attention. This paradigm typically takes a host image and a target attribute vector as inputs, and outputs a forged image exhibiting noticeable alterations in hair color, facial characteristics, and other identity-related features, thereby achieving identity spoofing. StarGAN [6] is a representative method within this category; it attains high-fidelity generation via adversarial training between a generator and a discriminator. Similar frameworks include AttGAN [8], CafeGAN [7], PA-GAN [29], etc., all of which annotate specific facial attributes and leverage these annotations to guide the synthesis of manipulated images. Inspired by these approaches, our solution employs watermarks as supervisory labels to steer the recovery of deepfake images back to the original host image. As a supplement, here are three representative loss functions in attribute editing:

$${\mathcal{L}}_{cls}={\mathbb{E}}_{I,V_{tar}}[-log\left(Dis\left(V_{tar}\right|G(I,V_{tar}))\right)]+{\mathbb{E}}_{I,V_{ori}}[-log\left(Dis\left(V_{ori}\right|I)\right)]$$

(1)

$${\mathcal{L}}_{rec}={\mathbb{E}}_{I,V_{tar},V_{ori}}[I-G(G(I,V_{tar}),V_{ori})]$$

(2)

$${\mathcal{L}}_{adv}={\mathbb{E}}_I\left[log\left(Dis\left(I\right)\right)\right]+{\mathbb{E}}_{I,V_{tar}}[log(1-Dis\left(G(I,V_{tar})\right)]$$

(3)

Among them, I is the host image, $V_{tar}$ is the target domain label, $V_{ori}$ is the source domain label, G is the deepfake generator, and $Dis$ is the deepfake discriminator.

2.2. Proactive Defense Against Deepfakes Based on Digital Watermarking

With the abuse of deepfake technology, its defense countermeasures have become an urgent research topic that must be addressed. Compared with passive detection, active defense mechanisms have received extensive attention due to their advantages of proactive and real-time performance. Against this backdrop, the active defense paradigm based on digital watermarking, as a proactive solution, has become an important research direction in this field. Wu et al. [23] embedded watermarks in images in advance, achieving real-time detection of deepfakes through fragile watermarks, and then achieving post-event tracking of deepfakes by training robust watermarks. Zhang et al. [21] implemented an architectural solution that can first counter deepfakes and still maintain the robustness of the watermark when the countermeasure fails. This achieves dual protection based on the watermark, ensuring that the watermark can be successfully extracted after a deepfake occurs. Nadimpalli et al. [30] proposed an active deepfake detection technology based on GAN visible watermarks. By adding reconstruction regularization to the loss function, the generated fake images come with detectable watermarks. This further enables active detection of deepfakes based on watermarks. Wang et al. [31] designed a robust scheme. By using chaotic encryption and jointly training the encoder−decoder, they embedded identity semantics as watermarks into images, achieving high-precision active detection and source tracing of deepfake face-changing. Furthermore, they proposed a “LampMark” keypoint robust perception watermark. Through end-to-end embedding in real-person images, deepfakes can be actively detected by restoring consistency between the watermark and the test image [32].

Although the current defense schemes can achieve effective deepfake defense, their limitation lies in the fact that once the image is tampered with, it loses its value because it cannot be recovered. Therefore, this research aims to propose a reliable watermarking mechanism. This mechanism should not only utilize the watermark information to guide the restoration of image content, but also ensure the robustness of the watermark throughout the entire process, thereby ensuring the security of the entire procedure.

3. Security Objective

In the envisioned scenario, given that facial images contain highly sensitive information such as identity, physiological features, and behavioral patterns, attackers can generate realistic deepfake content based on them, thereby triggering risks such as identity forgery, reputation damage, and social engineering attacks. Therefore, it is urgently necessary to build a proactive defense mechanism for facial images to weaken or block the information sources of potential deepfake attacks at the data level.

Therefore, we propose a digital watermarking-centered propagation process protection paradigm: embedding a robust watermark that is imperceptible and carries attribute information in the protected image before transmission, and providing the user with a decoder in conjunction. Users can utilize this decoder to extract the embedded watermark, parse its specific bit segments to obtain image attributes, and thereby achieve restoration of the original content. The overall pipeline is illustrated in Figure 1. Mathematically, we have the following:

$$\begin{array}{c}\hfill {\mathrm{W}}_{\mathrm{enc}}(I_h,\mathbf{w})\to I_w\end{array}$$

(4)

$$\begin{array}{c}\hfill \mathrm{G}\left(I_w\right)\to I_f\end{array}$$

(5)

$$\begin{array}{c}\hfill {\mathrm{W}}_{\mathrm{dec}}\left(I_f\right)\to {\mathbf{w}}^{\prime }\end{array}$$

(6)

$$\begin{array}{c}\hfill \mathrm{A}\left({\mathbf{w}}^{\prime }\right)\to A_{ext}\end{array}$$

(7)

$$\begin{array}{c}\hfill \mathrm{Gen}(I_f,A_{ext})\to I_{res}\end{array}$$

(8)

Among them, $W_{enc}$ is the watermark encoder, $W_{dec}$ is the watermark decoder, $Gen$ is the face restorer, $I_h$ is the host image, $I_w$ is the encoded image after embedding the watermark, $\mathbf{w}$ is the embedded watermark, ${\mathbf{w}}^{\prime }$ is the extracted watermark, A is a function corresponding to Equation (12), $A_{ext}$ is the attribute label recovered from the watermark, $I_f$ is the image tampered with by a deepfake, G is the generator used for deepfake generation, and $I_{res}$ is the recovered image.

4. Proposed Method

This section elaborates on, as thoroughly as possible, the overall idea, the technical route, and implementation details of the proposed solution.

4.1. Framework Overview

We employ a robust watermarking technique to realize the envisioned protection mechanism. Specifically, we adopt the end-to-end embedding–extraction pipeline proposed in [23] as our backbone framework, given its ability to maintain high watermark fidelity even under facial attribute manipulations. The overall architecture, depicted in Figure 2, comprises three key components: an encoder, a decoder, and a face restorer. The encoder embeds a watermark sequence containing facial attribute labels and copyright information into the original facial image. The decoder then extracts this embedded information from a potentially distorted or manipulated image. Finally, the face restorer reconstructs the original facial appearance using the extracted data.

4.2. Network Architecture

4.2.1. Encoder and Decoder

The encoder works in coordination along two parallel paths to achieve watermark embedding. Specifically, the first path extracts the bottleneck feature representation of the host image with the help of the UNet structure; the second path diffuses the watermark bits to different resolution levels through multi-level diffusion and upsampling modules. In the upsampling path of the UNet, the features extracted by the contraction layer in the first path and the extended watermark features in the second path are fused into the corresponding expanded features. In addition, the SE-block is deeply integrated with the ResBlock in the upsampling stage to efficiently complete the watermark embedding task.

The decoder is composed of a UNet structure, a 1 × 1 convolutional layer, and a downsampling operation in sequence. This decoder has been specially trained to enhance the robustness of the watermark extraction process, ensuring accurate restoration of watermark information even under complex conditions.

4.2.2. Face Restorer

The input to this face restorer is the concatenation tensor of a three-channel image and a conditional vector. First, the initial feature mapping is completed through a 7 × 7 convolution, and then high-dimensional bottleneck features are extracted by downsampling. Multiple residual blocks are stacked to enhance the feature representation. Subsequently, the feature dimensions are restored through transposed convolution upsampling. Finally, the image is output by a $7\times 7$ convolution and an activation function. The conditional vector participates in the feature transformation throughout the process after spatial replication.

Please note that while training the face restorer, in order to improve the quality of the images, we also incorporated a discriminator for adversarial joint training. It is a PatchGAN [33].

4.3. Dual Watermarking Mechanism

In this section, we will elaborate on the proposed dual watermarking mechanism.

4.3.1. Dual Watermarking Construction

Dual watermarking $w=w_1,w_2,...,w_n$ is composed of the symbol bit $A_{ext}\in \{0,1\}$ and the extended bit $A_{copy}\in \{0,1\}$: the first layer $A_{ext}$ is used for face restoration labels, and the second layer $A_{copy}$ is used to hide additional information by extending the bits.

The first layer construction. For the first layer, we set the watermark according to the following formula:

$${\mathbf{w}}_{\mathbf{1}{\mathbf{st}}_{\mathbf{i}}}=\left\{\begin{array}{cc}+0.1,\hfill & \mathrm{if}{A}_{at{t}_i}=1\hfill \\ -0.1,\hfill & \mathrm{if}{A}_{at{t}_i}=0\hfill \end{array}\right.$$

(9)

Among them, $A_{at{t}_i}$ is the i-th facial attribute label, and ${\mathbf{w}}_{\mathbf{1}{\mathbf{st}}_{\mathbf{i}}}$ is the i-th first-layer watermark.

The second layer construction. We dynamically allocate the amplitude based on $A_{copy}$ as follows:

$$\Delta A_{of{f}_i}=\left\{\begin{array}{cc}+0.025,\hfill & \mathrm{if}{A}_{cop{y}_i}=1\hfill \\ -0.025,\hfill & \mathrm{if}{A}_{cop{y}_i}=0\hfill \end{array}\right.$$

(10)

Among them, $\Delta A_{of{f}_i}$ is the offset of the i-th bit, and $A_{cop{y}_i}$ is the i-th bit of $A_{copy}$.

Then, substitute the watermark offset and the first-layer watermark into the following formula to obtain the final watermark:

$${\mathbf{w}}_{\mathbf{i}}=\mathrm{sign}\left({\mathbf{w}}_{\mathbf{1}{\mathbf{st}}_{\mathbf{i}}}\right)\left(\right|{\mathbf{w}}_{\mathbf{1}{\mathbf{st}}_{\mathbf{i}}}|+\Delta A_{off})$$

(11)

Here, ${\mathbf{w}}_{\mathbf{1}{\mathbf{st}}_{\mathbf{i}}}$ is the first layer watermark at the i-th bit, and ${\mathbf{w}}_{\mathbf{i}}$ is the embedded watermark at the i-th bit. It should be noted that—in order to improve the accuracy of subsequent extraction of the second-layer watermark—we will repeat the embedding of each bit five times during the embedding process, that is, a total of six watermark bits will be embedded.

4.3.2. Dual Watermarking Extraction

The first layer extraction. Specifically, after the user extracts the watermark, since the watermark is inevitably subject to slight interference during the embedding and extraction process, in order to improve the restoration accuracy of the image, the user binarizes the received watermark signal: each soft bit estimation undergoes a hard decision with a threshold of 0.5, thereby obtaining a noise-free attribute vector label.

$$A_{ex{t}_i}=\left\{\begin{array}{cc}1,\hfill & \mathrm{if}{\mathbf{w}}_{\mathbf{i}}^{\prime }\ge 0\hfill \\ 0,\hfill & \mathrm{otherwise}\hfill \end{array}\right.$$

(12)

Among them, ${\mathbf{w}}_{\mathbf{i}}^{\prime }$ is the i-th bit for extracting the watermark, and $A_{ex{t}_i}$ is the i-th bit for restoring the facial attributes. Here, we adopt the indices $i\in [0,4]$ to denote the extracted facial-attribute label as $A_{ext}$.

Subsequently, for the tampered image, the user sends it along with the attribute label $A_{ext}$ into the face restorer. The face restorer then outputs the restored image based on this, making it visually approach the original image as closely as possible to achieve the security goal.

The second layer extraction. The extraction of the second-layer watermark first calculates the value of each bit of $A_{coex}$ according to the following formula:

$$A_{coe{x}_i}=\left\{\begin{array}{cc}1,\hfill & \mathrm{if}|{\mathbf{w}}_{\mathbf{i}}^{\prime }| >0.1\hfill \\ 0,\hfill & \mathrm{otherwise}\hfill \end{array}\right.$$

(13)

Among them, $A_{coe{x}_i}$ is the i-th bit of the second-layer watermark for extraction and determination.

Then, since we mentioned in the previous section that each digit is actually repeated five times in the embedding, a majority vote is used to determine the final result, as shown below:

$$A_{result}^{\left(g\right)}=\left\{\begin{array}{cc}1,\hfill & \mathrm{if}\sum _{j=0}^4{A}_{vote}^{(5g+j)}\ge 3,g=0,1,\dots ,5.\hfill \\ 0,\hfill & \mathrm{otherwise}\hfill \end{array}\right.$$

(14)

Among them, $A_{vote}$ represents every five elements, and $A_{result}$ is the voting result, that is, the element with more than half of the votes selected from every five is taken as the final result.

4.4. Loss Function and Training Procedure

In this section, we will describe the training measures and loss functions. Besides extracting the embedded watermark bits, the authenticity of facial images altered by deepfake manipulations must also be restored. We draw on the training architecture in [6]. The generator, jointly optimized with an adversarial reconstruction loss and an attribute-classification loss, is capable of reconstructing the original facial appearance when conditioned on the true attribute vector recovered via the watermark. We also leverage its reconstruction loss to aid in image restoration.

Our training is divided into two stages. First, we fine-tune the encoding and decoding parts to ensure that the watermark maintains high robustness in specific environments. Then, we fine-tune the face restorer network to recover the original image and improve the restoration effect in terms of image quality.

4.4.1. Watermark Decoding Stage

We perform fine-tuning based on the framework proposed in [23]. During training, we keep the encoder and discriminator frozen, and introduce a secondary noise simulation step—each encoded image is passed through the same noise perturbation twice consecutively. This strategy enhances the robustness of our fine-tuned model against various deepfake manipulations. The corresponding loss function is defined as follows:

$$\begin{array}{c}\hfill I_{noise}=\mathcal{N}\left(\mathcal{N}\left(I_w\right)\right)\end{array}$$

(15)

$$\begin{array}{c}\hfill {\mathcal{L}}_{de}=\parallel \mathbf{w}-{\mathrm{W}}_{\mathrm{dec}}\left(I_{noise}\right)\parallel \end{array}$$

(16)

Here, $\mathcal{N}$ represents various types of noise, including identity transformation, common signal processing (JpegTest with $Q=50$, Resize with $p=50\%$, GaussianBlur with $k=3,\sigma =2$, MedianBlur with $k=3$, Brightness with $f=0.5$, Contrast with $f=0.5$, Saturation with $f=0.5$, Hue with $f=0.1$, and GaussianNoise with $\sigma =0.1$), adversarial attack (SPSA [34]), and generative attacks (StarGAN, AttGAN, and CafeGAN). Among these, SPSA is a gradient-free adversarial attack strategy configured with the following parameters: steps = 20, learning rate = 0.2/255, and standard deviation $=0.005$. To ensure that the embedded watermark information resists a series of such perturbations, we apply the noise twice to the image, as shown in Equation (15), aiming to achieve enhanced robustness.

Therefore, the total loss at this stage is as follows:

$${\mathcal{L}}_{S_1}={\mathcal{L}}_{de}$$

(17)

The pseudocode for the training of watermark decoding is detailed in Algorithm 1.

Algorithm 1: Training of watermark decoding

Input:  Trained ${\mathrm{W}}_{\mathrm{enc}}\left(\right)$, host images $I_h$, watermark $\mathbf{w}$, and epoch number $i_n$.      Output:  Trained ${\mathrm{W}}_{\mathrm{dec}}\left(\right)$.        1: for  $i=0$ to $i_n$ do        2:     Randomly select a host image $I_h$.        3:     Generate the watermarked image $I_w$ using $\mathbf{w}$.        4:     Generate a noised image $I_{noise}$ using $\mathcal{N}$.        5:     Compute ${\mathcal{L}}_{de}$ using $\mathbf{w}$ and $I_{noise}$.        6:     Optimize ${\mathrm{W}}_{\mathrm{dec}}\left(\right)$ by minimizing ${\mathcal{L}}_{de}$.        7: end for

4.4.2. Image Recovery Stage

Based on the successful optimization of the watermark extraction task, this paper further focuses on improving image restoration performance. Specifically, we take the Network [6] as the backbone and migrate it to the image restoration scenario through fine-tuning strategies. During the training procedure, we observed that the reconstruction loss introduced by [6] has a significant benefit for maintaining the consistency of details with the structure. Based on this, we explicitly introduce this reconstruction term as an auxiliary supervision signal in the original objective function to strengthen the optimization constraints of the image restoration branch, thereby systematically improving the visual quality of the recovered image.

Inspired by [24], we further introduce the following loss function to assist in restoring images to be closer to their original state during training. This loss term relies on a VGG19 model pre-trained on ImageNet [35] and operates by quantifying the feature-level differences between the original face image and the restored face image:

$${\mathcal{L}}_{pce}=\sum _{n=1}^5{∥b_n\left(I_{\mathrm{h}}\right)-b_n\left(I_{\mathrm{rec}}\right)∥}_2$$

(18)

Here, $b_n$ denotes the feature map from the n-th layer of VGG; the first five layers used are relu1_2, relu2_2, relu3_4, relu4_4, and relu5_4 as in [35]. $I\mathrm{rec}$ represents the restored image.

Therefore, the complete loss function is defined as follows:

$${\mathcal{L}}_{S_2}={\lambda }_1{\mathcal{L}}_{cls}+{\lambda }_2{\mathcal{L}}_{rec}+{\lambda }_3{\mathcal{L}}_{adv}+{\lambda }_4{\mathcal{L}}_{pce}$$

(19)

where ${\mathcal{L}}_{cls}$ is the classification loss from Equation  (1), ${\mathcal{L}}_{rec}$ is the reconstruction loss from Equation (2), ${\mathcal{L}}_{adv}$ is the adversarial loss from Equation (3), and ${\mathcal{L}}_{pce}$ is the newly introduced auxiliary loss. The coefficients ${\lambda }_1$, ${\lambda }_2$, ${\lambda }_3$, and ${\lambda }_4$ are hyperparameters tuned to ensure high-quality image recovery.

The training pseudocode for this stage is shown in Algorithm 2.

Algorithm 2: Training of image restoration

Input:  Host images $I_h$, watermark $\mathbf{w}$, target domain           vector $V_{tar}$, source domain vector $V_{ori}$, and epoch number $i_n$.     Output:  Trained $\mathrm{Gen}\left(\right)$.       1: for $i=0$ to $i_n$ do       2:     Randomly select a host image $I_h$.       3:     Generate a watermarked image $I_w$ using the host image $I_h$ and watermark $\mathbf{w}$.       4:     Generate a deepfake image $I_f$ using the target domain vector $V_{tar}$ and the watermarked image $I_w$.       5:     Generate a recovered image $I_{res}$ using $V_{ori}$ and the deepfake image $I_f$.       6:     Compute ${\mathcal{L}}_{S_2}$ using $V_{ori}$, $V_{tar}$, and $I_h$.       7:     Optimize $\mathrm{Gen}\left(\right)$ by minimizing ${\mathcal{L}}_{S_2}$.       8: end for

5. Experimental Results

5.1. Experimental Setup

5.1.1. Datasets

We conducted our experiments using three publicly available face image datasets: CelebA-HQ [36] (30,000 images), FFHQ [37] (70,000 images), and HumanFace [38] (1000 images). All images, originally provided at $1024\times 1024$ resolution, were uniformly resized to $128\times 128$ pixels to meet computational requirements.

5.1.2. Baseline Methods

Our method was compared against several state-of-the-art watermarking schemes [23,39,40,41]. For fair comparison, we used the official code and pre-trained models released by the respective authors, while maintaining consistent experimental conditions, including image size, watermark length, and noise layer configurations. To evaluate robustness against deepfake attacks, we employed three attribute-manipulation models: StarGAN, CafeGAN, and AttGAN [6,7,8]. Our experiments specifically focused on deepfake-induced tampering involving hair color alteration and gender modification.

5.1.3. Implementation Details

The watermark length for all the compared schemes was fixed at 30 bits, consistent with the design in [23], to ensure fair comparison. For deepfake generation, we employed officially released pre-trained models for all methods except CafeGAN. Since no pre-trained CafeGAN model was available, we retrained it using the original paper’s publicly released code and configurations.

Our experiments utilized a total of 30,000 images. For watermark extraction training, 24,195 images were used for training and 3003 for validation. A separate set of 200 images was randomly selected for testing. The model was fine-tuned for three epochs with a batch size of 16, using the Adam optimizer ($l_r=0.0002$, $\beta =0.5$).

For the final evaluation, the dataset was split into 28,000 training images and 2000 test images. To rigorously assess robustness, the test images were processed through three different deepfake algorithms to simulate challenging real-world conditions. A final test set of 2000 images was then constructed from these processed outputs. The image restoration model was fine-tuned for 1000 iterations with a batch size of 32, using the Adam optimizer ($\alpha =1\times {10}^{-5}$, ${\beta }_1=0.5$, ${\beta }_2=0.999$). The learning rate decayed every 1000 iterations. The loss function comprised a weighted combination of multiple terms, with coefficients set as ${\lambda }_1=1$, ${\lambda }_2=10$, ${\lambda }_3=1$, and ${\lambda }_4=0.5$.

All implementations were developed in PyTorch 2025.2 and executed on an NVIDIA RTX 3090 GPU.

5.1.4. Evaluation Metrics

A comprehensive set of metrics was employed to evaluate the experimental results. Watermark robustness was assessed using the average bit error rate (BER). For ablation studies and image quality assessment, we utilized the peak signal-to-noise ratio (PSNR), structural similarity index measure (SSIM), and learned perceptual image patch similarity (LPIPS).

5.2. Watermark Extraction Accuracy Evaluation

We first evaluate the accuracy of watermark extraction in the absence of distortions. Our framework employs a dual watermarking scheme. The first layer serves as a robust watermark, while the second layer functions as an extended robust watermark. Initially, we individually evaluated the robustness of each watermark layer across different datasets under no-interference conditions, as summarized in

Table 1. Watermark extraction accuracy (BER) under distortion-free conditions.

Dataset	Watermark Extraction Accuracy (BER)
	First Layer Watermark	Second Layer Watermark
HumanFace	$0.0000\%$	$9.3333\%$
FFHQ	$0.0000\%$	$10.2500\%$
CelebAHQ	$0.0000\%$	$3.4167\%$
Average	$0.0000\%$	$7.6667\%$

.

As shown in the results, both the first-layer and second-layer watermarks maintain strong robustness. This demonstrates that in the absence of attacks, our scheme can reliably verify facial attributes and image copyright.

5.3. Recovery Evaluation

This section presents the restoration results of images subjected to deepfake interference. The receiver extracts the embedded watermark bits and submits them together with the corrupted images to a face restorer model. The model then returns the recovered images.

We investigated two typical tampering scenarios, namely, color alteration and gender modification, to validate the effectiveness of the proposed method. Specifically, we altered the hair color in a facial image from black to blonde and reversed the gender of the subject. Subsequently, the tampered face image, along with its embedded watermark tags, was jointly fed into the constructed generator for recovery. Representative results are illustrated in Figure 3, Figure 4 and Figure 5. These results demonstrate that both the hair color and the gender of the subject were successfully restored, confirming the efficacy of the proposed approach in handling the aforementioned tampering scenarios.

6. Discussion

6.1. Robustness Analysis

This section begins with an evaluation of the robustness of each watermark layer across different datasets under various distortion conditions. The experimental results are summarized in

Table 2. Watermark extraction accuracy (BER) under various distortions.

Distortion Type	The First Layer Watermark			The Second Layer Watermark
	HumanFace	FFHQ	CelebAHQ	HumanFace	FFHQ	CelebAHQ
Identity	0.0000%	0.0000%	0.0000%	9.3333%	10.2500%	3.4167%
Jpeg	0.1333%	0.2333%	0.2167%	11.5833%	15.9167%	14.9167%
Resize	0.0000%	0.0167%	0.0000%	8.5833%	9.7500%	6.5000%
GaussianBlur	0.0000%	0.0000%	0.0000%	31.6667%	28.0833%	32.1667%
MedianBlur	0.0000%	0.0000%	0.0000%	5.9167%	4.0000%	4.1667%
Brightness	0.0000%	0.0000%	0.0000%	11.3333%	13.3333%	7.4167%
Contrast	0.0000%	0.0000%	0.0000%	11.5000%	14.9167%	9.7500%
Saturation	0.0000%	0.0000%	0.0000%	10.5000%	12.8333%	5.7500%
Hue	0.0000%	0.0000%	0.0000%	13.1667%	12.0000%	8.2500%
GaussianNoise	0.5000%	0.6000%	0.8167%	11.1667%	17.0833%	17.5833%
SPSA	0.4333%	1.1833%	1.4000%	22.0000%	24.2500%	26.0000%
StarGAN (blond)	0.2333%	0.4333%	0.1667%	12.9167%	12.9167%	12.1667%
StarGAN (male)	0.1333%	0.2000%	0.1500%	12.5000%	14.3333%	14.6667%
AttGAN (blond)	2.5667%	2.2667%	1.1000%	22.5000%	22.5000%	20.4167%
AttGAN (male)	1.1833%	0.7333%	0.5833%	22.7500%	20.7500%	16.3333%
CafeGAN (blond)	3.7500%	3.3333%	3.3667%	26.0833%	26.0833%	23.6667%
CafeGAN (male)	0.5333%	0.6500%	0.5333%	17.2500%	17.5000%	17.8333%
Average	0.5569%	0.5676%	0.4902%	15.3382%	16.2647%	14.1765%

. These results indicate that the BER scores for the first-layer watermark in our scheme remain close to zero across all tested datasets and distortions, demonstrating its high robustness. Concurrently, the BER for the second-layer watermark remains stable, but slightly higher than that of the first layer. This confirms that the second-layer watermark is suitable for serving as an extension for concealing additional information.

Subsequently, we evaluate the first-layer watermark under different deepfake reconstructions across multiple datasets. Its BER values under various distortions are listed in

Table 3. Watermark extraction accuracy (BER) on the images processed by StarGAN (blond).

Scheme (Dataset)	Identity	JpegTest	Resize	GaussianBlur	MedianBlur	Brightness	Contrast	Saturation	Hue	GaussianNoise	SPSA	Average
HumanFace
Ours (HumanFace)	0.5667%	2.6500%	1.4667%	1.0000%	1.0333%	0.7333%	1.2167%	0.6000%	0.6833%	4.8500%	13.6833%	2.5893%
SepMark (HumanFace)	0.8333%	3.1333%	1.5833%	1.0667%	1.0833%	1.0667%	1.3000%	0.9000%	0.9000%	5.6667%	12.0333%	2.6879%
CIN (HumanFace)	34.8500%	42.2267%	32.8167%	53.5000%	38.5000%	35.6667%	36.5167%	35.4000%	35.6500%	45.8000%	40.5167%	39.2221%
MBRS (HumanFace)	28.8333%	42.7500%	30.0500%	37.9833%	36.8667%	30.6667%	30.3667%	29.8000%	31.0333%	46.7333%	42.3167%	35.2182%
PIMOG (HumanFace)	23.9667%	42.3000%	22.5667%	25.1000%	24.8000%	28.7500%	27.4167%	25.2500%	26.1333%	41.9667%	44.1000%	30.2136%
FFHQ
Ours (FFHQ)	0.5000%	2.9333%	1.1500%	0.8333%	0.7667%	0.6000%	0.9500%	0.5333%	0.4667%	4.5833%	17.3333%	2.7864%
SepMark (FFHQ)	0.5833%	3.0667%	1.0167%	0.8333%	0.7000%	0.7000%	0.9000%	0.5667%	0.6000%	6.1500%	15.7667%	2.8076%
CIN (FFHQ)	33.6000%	37.6167%	47.8667%	46.7667%	40.8167%	34.5667%	35.6667%	33.8500%	34.1667%	46.9667%	41.9500%	39.4394%
MBRS (FFHQ)	25.6333%	40.9333%	27.0167%	36.0333%	34.6500%	27.5500%	27.9500%	26.3500%	28.1667%	47.0000%	42.2833%	33.0515%
PIMOG (FFHQ)	21.1500%	40.9000%	20.6167%	22.3167%	22.0833%	25.9333%	25.2000%	22.4333%	23.0333%	41.1833%	43.5667%	28.0379%
CelebAHQ
Ours (CelebAHQ)	0.4833%	3.1333%	1.2000%	0.9333%	0.7500%	0.7167%	1.4333%	0.4500%	0.7333%	6.1833%	17.7000%	3.0651%
SepMark (CelebAHQ)	0.5000%	3.3500%	1.0000%	0.8667%	0.8000%	0.6167%	1.1000%	0.4833%	0.4833%	6.1833%	16.9667%	2.9409%
CIN (CelebAHQ)	33.2333%	40.5833%	30.3500%	52.9833%	38.1500%	34.5167%	34.4833%	33.0000%	34.5000%	33.5333%	35.0000%	36.3939%
MBRS (CelebAHQ)	50.1000%	43.3333%	29.4333%	37.3333%	34.8333%	29.5000%	30.2999%	25.6500%	27.9000%	33.4167%	34.3667%	34.1970%
PIMOG (CelebAHQ)	22.1667%	39.9500%	21.0667%	23.2667%	22.7500%	26.9333%	25.7833%	23.5000%	23.5333%	35.7833%	33.8167%	27.1409%

Note: The bold values indicate that this solution is the most effective.

,

Table 4. Watermark extraction accuracy (BER) on the images processed by StarGAN (male).

Scheme (Dataset)	Identity	JpegTest	Resize	GaussianBlur	MedianBlur	Brightness	Contrast	Saturation	Hue	GaussianNoise	SPSA	Average
HumanFace
Ours (HumanFace)	0.4333%	2.8833%	1.3167%	0.8667%	0.9667%	0.6667%	0.9667%	0.4333%	0.5500%	5.0500%	12.7333%	2.4424%
SepMark (HumanFace)	0.4833%	2.8000%	1.1500%	1.1167%	1.2000%	0.6500%	1.0500%	0.5333%	0.6500%	5.4667%	12.0167%	2.4652%
CIN (HumanFace)	35.7500%	41.3333%	33.5000%	53.4833%	39.0000%	36.0500%	37.0500%	35.6333%	36.4000%	45.8833%	41.0000%	39.5530%
MBRS (HumanFace)	29.7500%	43.1000%	32.4167%	38.6333%	37.1500%	32.0500%	30.9833%	30.4667%	32.0000%	47.0167%	42.1000%	35.9697%
PIMOG (HumanFace)	22.9000%	41.1833%	21.7833%	24.3167%	23.5833%	28.1833%	26.2833%	24.4167%	24.4333%	42.0167%	44.8833%	29.4530%
FFHQ
Ours (FFHQ)	0.4167%	2.9333%	1.0667%	0.8167%	0.7333%	0.4833%	0.8167%	0.3833%	0.4333%	5.0667%	15.7000%	2.6227%
SepMark (FFHQ)	0.5000%	2.9500%	1.2500%	0.8333%	0.7167%	0.6333%	0.8000%	0.4667%	0.5333%	5.9667%	14.0333%	2.6076%
CIN (FFHQ)	33.6167%	37.6167%	47.8667%	46.7667%	40.8167%	34.5500%	35.6667%	33.8500%	34.1500%	49.9667%	41.9667%	39.7121%
MBRS (FFHQ)	26.5167%	42.7833%	28.2667%	37.5500%	35.1000%	29.1000%	29.0000%	27.4333%	28.3300%	47.5000%	42.6500%	34.0209%
PIMOG (FFHQ)	21.5833%	42.4167%	20.4000%	23.2667%	22.2833%	26.3167%	24.4000%	22.5667%	23.4167%	41.3667%	42.9500%	28.2697%
CelebAHQ
Ours (CelebAHQ)	0.5333%	3.4000%	1.2167%	0.8333%	0.7667%	0.7167%	1.0500%	0.4667%	0.5167%	6.2500%	17.2667%	3.0015%
SepMark (CelebAHQ)	0.4833%	3.4000%	1.0833%	0.9333%	0.9000%	0.6667%	0.8167%	0.5000%	0.5167%	6.6833%	15.8500%	2.8939%
CIN (CelebAHQ)	41.6833%	48.2000%	33.1000%	55.1667%	44.8167%	43.0667%	42.1500%	41.4000%	42.1500%	44.6500%	43.2667%	43.6046%
MBRS (CelebAHQ)	27.1833%	42.7000%	29.3333%	38.3833%	35.7833%	29.0833%	29.7833%	27.3833%	29.3667%	46.7000%	42.2000%	34.3545%
PIMOG (CelebAHQ)	21.2167%	40.6167%	20.4167%	22.6833%	22.2333%	25.5833%	25.4333%	22.5167%	23.2667%	41.6667%	43.6667%	28.1182%

Note: The bold values indicate that this solution is the most effective.

,

Table 5. Watermark extraction accuracy (BER) on the images processed by AttGAN (blond).

Scheme (Dataset)	Identity	JpegTest	Resize	GaussianBlur	MedianBlur	Brightness	Contrast	Saturation	Hue	GaussianNoise	SPSA	Average
HumanFace
Ours (HumanFace)	4.7833%	9.4667%	7.0000%	5.3667%	6.4667%	5.5500%	5.4333%	4.8333%	4.7833%	11.0833%	19.4500%	7.6561%
SepMark (HumanFace)	6.1667%	10.6333%	8.2000%	7.4333%	7.6667%	7.0667%	6.7667%	6.2333%	6.3500%	13.6500%	19.8167%	9.0894%
CIN (HumanFace)	35.6833%	39.3667%	48.1333%	49.0000%	40.5833%	37.1167%	36.6000%	35.7500%	35.8500%	47.4167%	41.9333%	40.6758%
MBRS (HumanFace)	34.6833%	36.7500%	38.7000%	34.3333%	35.0833%	36.2833%	34.3667%	34.7167%	35.5000%	50.2167%	40.2500%	37.3530%
PIMOG (HumanFace)	30.6000%	42.8333%	30.2333%	30.5500%	31.0667%	33.0333%	31.7333%	31.2500%	31.4833%	43.5167%	41.9500%	34.3864%
FFHQ
Ours (FFHQ)	3.9833%	8.5667%	6.9000%	4.6000%	6.0667%	4.4667%	4.2000%	4.0000%	4.3333%	10.6000%	23.7667%	7.4076%
SepMark (FFHQ)	5.4333%	9.0167%	7.5333%	6.4333%	6.7667%	5.9000%	6.1500%	5.3500%	5.6333%	11.8833%	24.3333%	8.5848%
CIN (FFHQ)	33.6167%	37.6167%	47.8667%	46.7667%	40.8167%	34.5667%	35.6667%	33.8500%	34.1667%	46.9667%	41.9667%	39.4425%
MBRS (FFHQ)	31.6333%	35.3833%	34.5000%	31.2833%	32.6000%	31.9500%	31.5667%	31.3167%	33.2167%	50.1667%	40.3167%	34.9030%
PIMOG (FFHQ)	28.5333%	40.9333%	28.0500%	28.3000%	28.7333%	30.5667%	29.7000%	29.1667%	23.7833%	41.9667%	42.8500%	32.0530%
CelebAHQ
Ours (CelebAHQ)	2.8667%	7.9000%	5.1500%	3.5500%	4.3000%	3.4667%	3.7167%	2.9667%	2.8167%	10.6833%	23.4500%	6.4424%
SepMark (CelebAHQ)	4.0167%	8.5333%	5.6500%	4.9833%	5.4500%	4.2667%	4.9500%	4.0000%	4.1167%	11.6500%	24.7833%	7.4909%
CIN (CelebAHQ)	33.0167%	38.0500%	48.4667%	47.7833%	39.1833%	33.1167%	34.9500%	32.7667%	33.2000%	36.0167%	44.6833%	38.2939%
MBRS (CelebAHQ)	27.3500%	34.1167%	30.5333%	26.5167%	28.1167%	29.3667%	27.5500%	27.3500%	29.0500%	37.5333%	42.4167%	30.9000%
PIMOG (CelebAHQ)	24.2667%	39.5333%	23.2000%	23.8500%	23.9333%	27.1500%	26.2000%	24.3667%	25.1667%	31.3500%	39.6500%	28.0606%

Note: The bold values indicate that this solution is the most effective.

,

Table 6. Watermark extraction accuracy (BER) on the images processed by AttGAN (male).

Scheme (Dataset)	Identity	JpegTest	Resize	GaussianBlur	MedianBlur	Brightness	Contrast	Saturation	Hue	GaussianNoise	SPSA	Average
HumanFace
Ours (HumanFace)	2.1000%	5.1833%	3.6500%	2.8000%	3.4833%	2.5833%	3.3333%	2.1333%	2.2500%	7.8167%	19.7167%	5.0045%
SepMark (HumanFace)	2.8167%	5.8000%	4.5667%	3.5667%	3.6500%	2.9833%	3.8000%	2.8333%	3.0833%	9.4500%	19.9333%	5.6803%
CIN (HumanFace)	33.6167%	37.6167%	47.8667%	46.7667%	40.7833%	34.5500%	35.6833%	33.8167%	34.1167%	46.9667%	41.9333%	39.4288%
MBRS (HumanFace)	30.3333%	36.6500%	34.9667%	29.7833%	30.9667%	32.5667%	32.0833%	32.1833%	32.7500%	49.7833%	39.3833%	34.6773%
PIMOG (HumanFace)	26.7833%	41.4000%	25.9500%	27.0000%	26.9833%	29.3000%	28.2000%	27.6500%	28.4000%	41.9500%	42.7000%	31.4833%
FFHQ
Ours (FFHQ)	1.9667%	4.3333%	3.4667%	2.2167%	2.7167%	2.2833%	2.4000%	1.9000%	2.0000%	7.0500%	22.0500%	4.7621%
SepMark (FFHQ)	2.2167%	4.7000%	3.5667%	2.6333%	2.9833%	2.3333%	3.1000%	2.2833%	2.3833%	7.9833%	22.1000%	5.1167%
CIN (FFHQ)	33.6167%	37.6333%	47.8667%	46.7667%	40.8167%	34.5500%	35.6667%	33.8500%	34.1667%	46.9667%	41.9667%	39.4424%
MBRS (FFHQ)	26.8000%	33.2167%	31.2833%	25.9500%	28.0000%	27.3833%	28.4333%	26.8167%	28.4833%	50.1333%	40.5833%	31.5530%
PIMOG (FFHQ)	22.9667%	40.0167%	22.9500%	23.4000%	23.0500%	26.0333%	24.7167%	23.6500%	26.0333%	39.9500%	42.1833%	28.6318%
CelebAHQ
Ours (CelebAHQ)	1.7500%	5.4500%	3.1333%	2.1000%	2.4333%	1.8167%	2.4333%	1.7167%	1.8833%	8.3667%	21.9500%	4.8212%
SepMark (CelebAHQ)	2.0833%	5.8167%	3.4333%	3.1000%	3.0833%	2.5500%	3.0333%	2.1333%	2.3833%	9.7167%	21.8667%	5.3818%
CIN (CelebAHQ)	31.1667%	38.4333%	47.8167%	47.4833%	39.0333%	32.9500%	32.9500%	32.9500%	31.7500%	46.7500%	43.0167%	38.5727%
MBRS (CelebAHQ)	24.0667%	33.1000%	29.5000%	23.5333%	24.5667%	25.8500%	25.8333%	24.4833%	25.4833%	49.0000%	38.4667%	29.4439%
PIMOG (CelebAHQ)	22.1667%	40.0333%	21.9500%	22.8667%	22.7000%	24.6000%	24.9167%	22.7333%	23.8167%	40.4667%	38.4667%	27.7015%

Note: The bold values indicate that this solution is the most effective.

,

Table 7. Watermark extraction accuracy (BER) on the images processed by CafeGAN (blond).

Scheme (Dataset)	Identity	JpegTest	Resize	GaussianBlur	MedianBlur	Brightness	Contrast	Saturation	Hue	GaussianNoise	SPSA	Average
HumanFace
Ours (HumanFace)	7.1667%	11.7500%	9.3833%	6.0667%	9.1833%	7.7667%	7.5333%	7.1167%	7.0333%	13.8833%	23.1000%	9.9985%
SepMark (HumanFace)	9.3667%	12.9333%	10.7167%	10.9833%	11.1833%	10.2333%	10.1000%	9.4000%	9.7833%	15.5833%	25.0167%	12.3000%
CIN (HumanFace)	42.1167%	44.2333%	48.1667%	48.3333%	45.0000%	42.9667%	42.5833%	42.3500%	42.4167%	48.4833%	45.1333%	44.7076%
MBRS (HumanFace)	37.7000%	41.5833%	38.0833%	38.8167%	39.3000%	38.4500%	38.2667%	37.6833%	39.4000%	38.8167%	43.6333%	39.2485%
PIMOG (HumanFace)	29.6500%	42.5333%	27.7000%	30.5167%	29.4667%	32.0000%	30.3500%	29.5667%	31.1500%	43.8000%	43.9167%	33.6955%
FFHQ
Ours (FFHQ)	7.0833%	11.1500%	9.2167%	6.1667%	9.1500%	7.7333%	7.7667%	6.9667%	6.9000%	13.4000%	26.4500%	10.1803%
SepMark (FFHQ)	9.4167%	12.1000%	10.9667%	10.4667%	11.2833%	9.7000%	9.7000%	9.5333%	9.5500%	16.1167%	27.9000%	12.4303%
CIN (FFHQ)	33.6000%	37.6167%	47.8667%	46.7667%	40.8167%	34.5500%	35.6667%	33.8500%	34.1667%	46.9667%	41.9667%	39.4394%
MBRS (FFHQ)	37.5833%	43.3833%	38.4833%	38.0167%	39.3000%	38.0333%	37.6000%	37.4833%	39.1833%	47.6333%	42.8500%	40.1966%
PIMOG (FFHQ)	26.4833%	42.1333%	25.2833%	27.0167%	26.6667%	29.5833%	27.4333%	27.1833%	27.5000%	41.9500%	42.7833%	30.1233%
CelebAHQ
Ours (CelebAHQ)	6.6000%	11.8000%	9.5333%	5.9167%	9.2333%	7.2000%	7.6500%	6.6667%	6.5000%	14.8000%	27.6333%	10.3212%
SepMark (CelebAHQ)	9.0667%	13.1167%	10.9833%	10.6000%	10.7167%	9.8670%	9.9167%	9.3000%	9.3167%	17.0333%	28.2000%	12.5561%
CIN (CelebAHQ)	41.2000%	44.6667%	47.5833%	47.7333%	45.0500%	41.9333%	41.8000%	41.2333%	41.6000%	42.7833%	50.8167%	44.2182%
MBRS (CelebAHQ)	38.5333%	43.5167%	37.6000%	40.0333%	40.0333%	39.6833%	39.4667%	38.6333%	39.4167%	40.7500%	46.6667%	40.3939%
PIMOG (CelebAHQ)	26.4167%	43.0167%	25.3667%	27.0167%	26.8667%	29.3833%	27.8167%	27.1167%	28.1667%	42.2000%	45.8333%	31.7455%

Note: The bold values indicate that this solution is the most effective.

and

Table 8. Watermark extraction accuracy (BER) on the images processed by CafeGAN (male).

Scheme (Dataset)	Identity	JpegTest	Resize	GaussianBlur	MedianBlur	Brightness	Contrast	Saturation	Hue	GaussianNoise	SPSA	Average
HumanFace
Ours (HumanFace)	1.7667%	4.1667%	3.3500%	1.5833%	3.0000%	2.0000%	2.8500%	1.7667%	1.8833%	6.5000%	19.8333%	4.4273%
SepMark (HumanFace)	2.5333%	4.6333%	3.5833%	3.3667%	3.3167%	2.8500%	6.6667%	2.5167%	2.5667%	8.3833%	20.5833%	5.5455%
CIN (HumanFace)	38.0667%	40.9833%	47.2500%	47.5333%	43.3167%	38.5167%	38.7500%	37.9667%	38.6333%	47.3000%	43.3500%	41.9697%
MBRS (HumanFace)	31.4667%	39.5500%	33.4833%	32.2167%	33.4500%	33.3167%	32.9000%	32.3000%	34.4167%	48.0500%	40.6667%	35.6197%
PIMOG (HumanFace)	17.9333%	37.8333%	16.0833%	18.9500%	18.5333%	21.7500%	20.1167%	18.4333%	20.2000%	38.0000%	40.7000%	24.4121%
FFHQ
Ours (FFHQ)	1.4500%	4.1000%	3.4333%	1.6500%	2.8833%	1.7500%	2.4833%	1.6000%	1.5833%	6.9833%	24.2500%	4.7424%
SepMark (FFHQ)	2.4167%	4.5167%	3.7333%	3.1833%	3.1500%	2.3000%	3.3300%	2.2000%	2.3500%	8.5333%	24.4000%	5.4648%
CIN (FFHQ)	33.6167%	37.6167%	47.8667%	46.7667%	40.8167%	34.5500%	35.6667%	33.8500%	34.1667%	46.7667%	41.9500%	39.4212%
MBRS (FFHQ)	31.1667%	40.8000%	32.7167%	31.5167%	32.7500%	32.3667%	32.3500%	31.3333%	33.9333%	46.7167%	42.2500%	35.2636%
PIMOG (FFHQ)	16.3667%	36.8333%	15.1000%	17.1833%	26.6167%	18.9833%	18.9000%	17.6333%	18.8000%	37.2500%	46.0167%	24.5167%
CelebAHQ
Ours (CelebAHQ)	1.8333%	5.6333%	3.6333%	1.8000%	3.0833%	2.0333%	3.3000%	1.7500%	2.0000%	8.9000%	24.8000%	5.3424%
SepMark (CelebAHQ)	2.5833%	5.8167%	3.8833%	3.7000%	3.2333%	2.8167%	3.5833%	2.5333%	2.6500%	10.1667%	25.6500%	6.0561%
CIN (CelebAHQ)	37.7333%	42.0667%	47.8667%	47.2000%	42.9333%	38.5833%	38.6000%	37.5000%	38.1000%	47.2000%	44.9167%	42.0636%
MBRS (CelebAHQ)	31.1667%	40.5500%	33.0333%	31.5833%	31.9167%	32.3333%	32.3500%	31.4167%	33.8333%	48.6500%	40.1000%	35.1758%
PIMOG (CelebAHQ)	16.9000%	38.3667%	16.3167%	17.8000%	17.5500%	20.0833%	20.1167%	17.7833%	19.0667%	37.1000%	40.3167%	23.7636%

Note: The bold values indicate that this solution is the most effective.

. The experimental results demonstrate that the proposed scheme exhibits exceptional robustness: in most scenarios, its BER remains below $10\%$, significantly outperforming the comparative schemes.

From the perspectives of dataset adaptability and scene adaptability, the proposed scheme maintains a low watermark extraction BER on three mainstream facial datasets across various experimental scenarios involving specific deepfake perturbation-recovery followed by common noise attacks. In StarGAN-related perturbation scenarios—whether after hair color alteration, gender modification, or subsequent common noise attacks—the proposed scheme sustains a low BER on each dataset (primarily between 0.4% and 7%). In corresponding scenarios for AttGAN and CafeGAN involving hair color or gender perturbation-recovery followed by common noise, the BER performance of our scheme remains stable, generally within the range of 1.7% to 14.8%. Even when compared against the best-performing benchmark, our scheme maintains a clear advantage in most settings (with an average BER reduction ranging from approximately 0.02% to 2.3%), fully demonstrating its strong dataset generalization capability and scene adaptability. Remarkably, even after undergoing specific deepfake perturbation and recovery processes, the scheme can effectively withstand subsequent common noise attacks, unaffected by differences in facial data distribution or specific perturbation types.

For scenarios involving specific deepfake perturbations followed by strong interference, such as Gaussian noise or other common noises, the proposed solution still maintains excellent watermark extraction performance. Across all experimental settings, even after images undergo color or transformation perturbations by StarGAN, AttGAN, or CafeGAN followed by restoration and subsequent strong interference (e.g., Gaussian noise, SPSA), the BER of our solution remains significantly lower than that of all benchmark schemes. In contrast, the BER of the comparative schemes typically increases substantially in such complex scenarios, sometimes exceeding 50%. This further verifies that the proposed solution can effectively recover the watermark after specific deepfake perturbations and restoration, exhibiting outstanding robustness.

In summary, the proposed scheme exhibits strong robustness, maintaining stable performance even against subsequent common noise attacks following facial attribute manipulation. This confirms its capability to provide reliable traceability for facial image copyright protection.

6.2. Recovered Images Quality Analysis

This section compares our proposed approach with the image restoration solution GFP-GAN [42]. We have separately evaluated the image restoration quality after being processed by different deepfakes under each dataset, as shown in

Table 9. Image quality comparison of recovered images obtained by GFP-GAN and ours.

Distortion Type	HumanFace		FFHQ		CelebAHQ
	GFP-GAN	Ours	GFP-GAN	Ours	GFP-GAN	Ours
StarGAN(blond)	(16.1569, 0.7429, 0.1083)	(27.0001, 0.9112, 0.0466)	(15.6818, 0.6878, 0.1388)	(27.4159, 0.9022, 0.0489)	(15.6297, 0.6841, 0.1461)	(28.4617, 0.9159, 0.0380)
StarGAN(male)	(22.8294, 0.8543, 0.0531)	(27.5393, 0.9141, 0.0444)	(23.0230, 0.8336, 0.0693)	(27.8128, 0.9056, 0.0464)	(23.1393, 0.8332, 0.0722)	(28.7715, 0.9161, 0.0359)
AttGAN(blond)	(13.6015, 0.6421, 0.1624)	(18.3305, 0.7180, 0.1157)	(14.7626, 0.6159, 0.1758)	(18.7024, 0.6931, 0.1238)	(15.1420, 0.6535, 0.1535)	(21.8117, 0.7805, 0.0773)
AttGAN(male)	(20.2485, 0.7911, 0.0995)	(19.4030, 0.7639, 0.1063)	(22.4829, 0.8191, 0.0865)	(21.2123, 0.7871, 0.0912)	(24.7060, 0.8533, 0.0658)	(23.6924, 0.6932, 0.0678)
CafeGAN(blond)	(15.7986, 0.6755, 0.1407)	(19.8994, 0.7397, 0.0987)	(13.4619, 0.5979, 0.1833)	(19.4606, 0.7028, 0.1121)	(15.2037, 0.6258, 0.1724)	(20.1800, 0.5367, 0.1116)
CafeGAN(male)	(25.9666, 0.8940, 0.0432)	(23.9651, 0.8566, 0.0554)	(26.1756, 0.8815, 0.0613)	(24.4656, 0.8469, 0.0579)	(26.7685, 0.8896, 0.0606)	(25.5523, 0.7342, 0.0538)
Average	(19.0988, 0.7667, 0.1012)	(22.6896, 0.8173, 0.0779)	(19.2646, 0.7393, 0.1192)	(23.1783, 0.8063, 0.0801)	(20.0982, 0.7566, 0.1118)	(24.7449, 0.7628, 0.0641)

Note: The values in parentheses are the PSNR, SSIM, and LPIPS of the recovered image, respectively, and the bold values indicate that this solution is the most effective.

.

The results show that although the recovery performance for some specific distortion types is slightly better or worse than that of GFP-GAN, overall, the method proposed in this paper demonstrates superior image recovery performance over GFP-GAN in the vast majority of deepfake distortion types and across all tested datasets. This fully validates that the proposed method has stronger recovery capabilities and generalization in deepfake image restoration.

6.3. Complexity Analysis

As our networks are largely built upon convolutional layers, we provide a complexity analysis of the adopted model in this section. The computational complexity can be derived from the following formula [43]:

$$O\left(Net\right)=\left(\sum _{i=1}^d{l}_{i-1}\times t_i^2\times g_i\times p_i^2\right)$$

(20)

Here, d represents the depth, and $l_{i-1}$, $t_i^2$, $g_i$, and $p_i^2$ are the number of input channels of the i-th layer, the size of the filters, the number of filters, and the size of the output feature map, respectively.

Thus, the complexity of the encoder in our method is $2.84\times {10}^9$, the complexity of the decoder is $1.88\times {10}^9$, the complexity of the face restorer is $5.66\times {10}^9$, and the complexity of the discriminator is $3.44\times {10}^{10}$.

6.4. Ablation Study

All experimental images and model configurations in this section remain consistent with those described in Section 5.1. For testing, 200 images of size $128\times 128$ were selected from the dataset.

6.4.1. Parameter Sensitivity

When embedding the watermark into the image using the encoder, we also introduce a strength factor to control the embedding intensity. This design balances the visibility and robustness of the watermark, ensuring it can be reliably extracted in various application scenarios without significantly degrading the visual quality of the host image, as written as follows:

$$I_{\mathrm{w}}=I_h+\gamma ·(I_w-I_h)$$

(21)

where $\gamma$ is the strength factor.

To systematically evaluate its impact, we performed a sensitivity analysis on the strength factor parameter. This parameter governs the watermark embedding intensity, thereby directly influencing both the robustness of the watermark and the visual fidelity of the host image. We conducted comparative experiments with three distinct values of the strength factor: 0.5, 1, and 2, as detailed in

Table 10. The watermark extraction accuracy (BER) of each strength factor for each dataset under different noise conditions.

Distortion	Dataset
	HumanFace			FFHQ			CelebAHQ
	$\mathit{\gamma }$ = 1	$\mathit{\gamma }$ = 0.5	$\mathit{\gamma }$ = 2	$\mathit{\gamma }$ = 1	$\mathit{\gamma }$ = 0.5	$\mathit{\gamma }$ = 2	$\mathit{\gamma }$ = 1	$\mathit{\gamma }$ = 0.5	$\mathit{\gamma }$ = 2
Identity	0.0000%	0.1333%	0.0000%	0.0000%	0.2167%	0.0000%	0.0000%	0.2833%	0.0000%
JPEG Test	0.1333%	5.7667%	0.0000%	0.2333%	6.4000%	0.0000%	0.2167%	6.7333%	0.0000%
Resize	0.0000%	1.5000%	0.0000%	0.0167%	1.4333%	0.0000%	0.0000%	1.2000%	0.0000%
GaussianBlur	0.0000%	2.3167%	0.0000%	0.0000%	2.2667%	0.0000%	0.0000%	1.8333%	0.0000%
MedianBlur	0.0000%	0.5167%	0.0000%	0.0000%	0.5167%	0.0000%	0.0000%	0.3333%	0.0000%
Brightness	0.0000%	0.1667%	0.0000%	0.0000%	0.3167%	0.0000%	0.0000%	0.3833%	0.0000%
Contrast	0.0000%	0.3333%	0.0000%	0.0000%	0.4500%	0.0000%	0.0000%	0.3833%	0.0000%
Saturation	0.0000%	0.2333%	0.0000%	0.0000%	0.2667%	0.0000%	0.0000%	0.2500%	0.0000%
Hue	0.0000%	0.2000%	0.0000%	0.0000%	0.3333%	0.0000%	0.0000%	0.2500%	0.0000%
GaussianNoise	0.5000%	9.3167%	0.0000%	0.6000%	9.9000%	0.0000%	0.8167%	11.5000%	0.0000%
SPSA	0.4333%	4.3333%	0.0333%	1.1833%	6.4500%	0.2500%	1.4000%	6.8667%	0.2333%
StarGAN (blond)	0.2333%	6.8500%	0.0167%	0.4333%	7.1167%	0.0000%	0.1667%	6.1000%	0.0333%
StarGAN (male)	0.1333%	6.3500%	0.0000%	0.2000%	5.8000%	0.0000%	0.1500%	5.2000%	0.0000%
AttGAN (blond)	2.5667%	14.9500%	0.1000%	2.2667%	14.7000%	0.1000%	1.1000%	12.9833%	0.0333%
AttGAN (male)	1.1833%	9.8667%	0.0167%	0.7333%	8.7000%	0.0000%	0.5833%	8.4667%	0.0000%
CafeGAN (blond)	3.7500%	16.8000%	0.1333%	3.3333%	16.3333%	0.2000%	3.3667%	16.6500%	0.1667%
CafeGAN (male)	0.5333%	8.3667%	0.0000%	0.6500%	8.1000%	0.0000%	0.5333%	7.9000%	0.0000%
Average	0.5569%	5.1794%	0.0176%	0.5676%	5.2529%	0.0324%	0.4902%	5.1549%	0.0274%

and

Table 11. Evaluation of the visual quality of watermarked images with different $\gamma$ values.

Dataset	$\mathit{\gamma }=1$	$\mathit{\gamma }=0.5$	$\mathit{\gamma }=2$
HumanFace	(37.6321, 0.9559, 0.0025)	(43.5612, 0.9856, 0.0006)	(31.6845, 0.8750, 0.0135)
FFHQ	(38.0710, 0.9567, 0.0030)	(43.9921, 0.9862, 0.0008)	(32.1337, 0.8756, 0.0159)
CelebAHQ	(39.0441, 0.9619, 0.0025)	(44.9401, 0.9880, 0.0007)	(33.1328, 0.8882, 0.0134)
Average	(38.2491, 0.9582, 0.0027)	(44.1645, 0.9866, 0.0007)	(32.3170, 0.8796, 0.0143)

.

The experimental results indicate that when the strength factor is set to 0.5, the image quality improves—as evidenced by higher PSNR and SSIM values—at the cost of a reduced watermark extraction rate, which suggests compromised watermark robustness under this setting. In contrast, increasing the strength factor to 2 significantly improves the extraction rate but degrades image quality, indicating that an excessively high embedding intensity harms visual fidelity. Setting the strength factor to 1 achieves an optimal balance, ensuring both reliable watermark extraction and satisfactory visual preservation.

6.4.2. Effectiveness of Watermark on Image Recovery

This section examines the necessity of using watermarks to guide image recovery. In practice, relying on image labels for restoration faces significant limitations. Under the worst-case scenario, users may possess no prior knowledge of the label’s structure, making correct recovery impossible. Even when users are aware of basic formatting constraints, such as the number of digits and the valid value range, randomly generated labels still rarely match the true content. Providing an incorrect label causes the face recovery model to fail, as demonstrated in Figure 6. Therefore, guiding the recovery process through extractable watermarks presents a reliable and necessary alternative. All erroneous labels in this section are assigned a value of 1.

6.4.3. Training Procedure

We first clarify the necessity of retraining the decoder. The proposed framework builds upon SepMark [23] but introduces a decoder retraining stage. To validate the importance of this stage, we quantitatively compare the performance of our watermarking scheme with that of SepMark. As shown in the first two rows of the experimental results in Table 3, Table 4, Table 5, Table 6, Table 7 and Table 8, our scheme achieves a lower bit error rate (BER) than SepMark in the StarGAN restoration scenario. Moreover, in both AttGAN and CafeGAN restoration scenarios, the proposed scheme consistently demonstrates stronger robustness against various distortions introduced by deepfake manipulations. These results confirm that the retraining stage is essential, as it significantly enhances watermark robustness, ensuring reliable watermark preservation after image restoration operations.

Then, we assess the necessity of the specialized training for the face restorer. As shown in

Table 12. Image quality of recovered images obtained by StarGAN and ours.

Distortion Type	HumanFace		FFHQ		CelebAHQ
	StarGAN	Ours	StarGAN	Ours	StarGAN	Ours
StarGAN (blond)	(26.9548, 0.7846, 0.0658)	(27.0001, 0.9112, 0.0466)	(27.5291, 0.7932, 0.0688)	(27.4159, 0.9022, 0.0489)	(28.6113, 0.9239, 0.0442)	(28.4617, 0.9159, 0.0380)
StarGAN (male)	(27.1126, 0.7751, 0.0663)	(27.5393, 0.9141, 0.0444)	(27.4235, 0.7816, 0.0708)	(27.8128, 0.9056, 0.0464)	(28.4101, 0.8203, 0.0538)	(28.7715, 0.9161, 0.0359)
AttGAN (blond)	(17.9340, 0.4623, 0.1418)	(18.3305, 0.7180, 0.1157)	(18.4189, 0.4930, 0.1504)	(18.7024, 0.6931, 0.1238)	(21.0817, 0.7606, 0.0897)	(21.8117, 0.7805, 0.0773)
AttGAN (male)	(19.1163, 0.5203, 0.1139)	(19.4030, 0.7639, 0.1063)	(20.5325, 0.5883, 0.1091)	(21.2123, 0.7871, 0.0912)	(22.6571, 0.6727, 0.0803)	(23.6924, 0.6932, 0.0678)
CafeGAN (blond)	(19.2086, 0.4813, 0.1242)	(19.8994, 0.7397, 0.0987)	(18.9439, 0.4789, 0.1385)	(19.4606, 0.7028, 0.1121)	(19.6383, 0.7115, 0.1096)	(20.1800, 0.5367, 0.1116)
CafeGAN (male)	(22.8836, 0.6549, 0.0736)	(23.9651, 0.8566, 0.0554)	(22.9488, 0.6608, 0.0818)	(24.4656, 0.8469, 0.0579)	(23.9011, 0.7080, 0.0681)	(25.5523, 0.7342, 0.0538)
Average	(22.2617, 0.6131, 0.0976)	(22.6896, 0.8173, 0.0779)	(22.6328, 0.6326, 0.1032)	(23.1783, 0.8063, 0.0801)	(24.0499, 0.7662, 0.0743)	(24.7449, 0.7628, 0.0641)

Note: The values in parentheses are the PSNR, SSIM, and LPIPS of the recovered image, respectively, and the bold values indicate that this solution is the most effective.

(the three values in parentheses denote PSNR, SSIM, and LPIPS, respectively), the images restored by our fine-tuned face restorer achieve significantly better visual quality than those generated by the benchmark method [6]. This performance gain confirms the effectiveness and necessity of the dedicated optimization employed in our training.

7. Conclusions

In this paper, we propose an active defense scheme based on digital watermarking to recover images compromised by deepfake attacks. The scheme employs a trained encoder−decoder model that effectively embeds watermark information into images and enables stable extraction even after various types of interference, including deepfake manipulations. Furthermore, an image recovery model is introduced, which utilizes the extracted watermark information to effectively recover tampered images.

Experimental results demonstrate the high robustness of the proposed watermarking mechanism, confirming the overall feasibility and effectiveness of the defense scheme. In future work, we will focus on enhancing the quality of the recovered images through approaches such as optimizing the loss function and refining the model architecture, thereby improving the scheme’s practicality and visual performance.