# FakeTagger: Robust Safeguards against DeepFake Dissemination via Provenance Tracking

arXiv: https://arxiv.org/abs/2009.09869 · HTML: https://mlsanity.com/paper/2009.09869/

## Key facts

- Cited by 46 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 21 Sep 2020.

## Built on by (most cited first, 30 of 46)

- [Untargeted Backdoor Watermark: Towards Harmless and Stealthy Dataset Copyright Protection](https://mlsanity.com/paper/2210.00875/) (2022)
- [Black-box Dataset Ownership Verification via Backdoor Watermarking](https://mlsanity.com/paper/2209.06015/) (2022)
- [Domain Watermark: Effective and Harmless Dataset Copyright Protection is Closed at Hand](https://mlsanity.com/paper/2310.14942/) (2023)
- [SepMark: Deep Separable Watermarking for Unified Source Tracing and Deepfake Detection](https://mlsanity.com/paper/2305.06321/) (2023)
- [Proactive Image Manipulation Detection](https://mlsanity.com/paper/2203.15880/) (2022)
- [TAFIM: Targeted Adversarial Attacks against Facial Image Manipulations](https://mlsanity.com/paper/2112.09151/) (2021)
- [MaLP: Manipulation Localization Using a Proactive Scheme](https://mlsanity.com/paper/2303.16976/) (2023)
- [Restricted Black-box Adversarial Attack Against DeepFake Face Swapping](https://mlsanity.com/paper/2204.12347/) (2022)
- [Robust Identity Perceptual Watermark Against Deepfake Face Swapping](https://mlsanity.com/paper/2311.01357/) (2023)
- [ProMark: Proactive Diffusion Watermarking for Causal Attribution](https://mlsanity.com/paper/2403.09914/) (2024)
- [FaceGuard: Proactive Deepfake Detection](https://mlsanity.com/paper/2109.05673/) (2021)
- [Disrupting Diffusion: Token-Level Attention Erasure Attack against Diffusion-based Customization](https://mlsanity.com/paper/2405.20584/) (2024)
- [Are Watermarks Bugs for Deepfake Detectors? Rethinking Proactive Forensics](https://mlsanity.com/paper/2404.17867/) (2024)
- [A Survey of Defenses Against AI-Generated Visual Media: Detection,Disruption, and Authentication](https://mlsanity.com/paper/2407.10575/) (2024)
- [Does Your Neural Code Completion Model Use My Code? A Membership Inference Approach](https://mlsanity.com/paper/2404.14296/) (2024)
- [DRAW: Defending Camera-shooted RAW against Image Manipulation](https://mlsanity.com/paper/2307.16418/) (2023)
- [Information-containing Adversarial Perturbation for Combating Facial Manipulation Systems](https://mlsanity.com/paper/2303.11625/) (2023)
- [PrObeD: Proactive Object Detection Wrapper](https://mlsanity.com/paper/2310.18788/) (2023)
- [U Can't Gen This? A Survey of Intellectual Property Protection Methods for Data in Generative AI](https://mlsanity.com/paper/2406.15386/) (2024)
- [DiffMark: Diffusion-based Robust Watermark Against Deepfakes](https://mlsanity.com/paper/2507.01428/) (2025)
- [FakeTracer: Catching Face-swap DeepFakes via Implanting Traces in Training](https://mlsanity.com/paper/2307.14593/) (2023)
- [ID-Guard: A Universal Framework for Combating Facial Manipulation via Breaking Identification](https://mlsanity.com/paper/2409.13349/) (2024)
- [FractalForensics: Proactive Deepfake Detection and Localization via Fractal Watermarks](https://mlsanity.com/paper/2504.09451/) (2025)
- [Towards Generalized Proactive Defense against Face Swapping with Contour-Hybrid Watermark](https://mlsanity.com/paper/2505.19081/) (2025)
- [Transfer Learning of Real Image Features with Soft Contrastive Loss for Fake Image Detection](https://mlsanity.com/paper/2403.16513/) (2024)
- [DIP-Watermark: A Double Identity Protection Method Based on Robust Adversarial Watermark](https://mlsanity.com/paper/2404.14693/) (2024)
- [CBW: Towards Dataset Ownership Verification for Speaker Verification via Clustering-based Backdoor Watermarking](https://mlsanity.com/paper/2503.05794/) (2025)
- [FastStamp: Accelerating Neural Steganography and Digital Watermarking of Images on FPGAs](https://mlsanity.com/paper/2209.12391/) (2022)
- [Proactive Schemes: A Survey of Adversarial Attacks for Social Good](https://mlsanity.com/paper/2409.16491/) (2024)
- [Big Brother is Watching: Proactive Deepfake Detection via Learnable Hidden Face](https://mlsanity.com/paper/2504.11309/) (2025)

## Abstract (arXiv)

In recent years, DeepFake is becoming a common threat to our society, due to the remarkable progress of generative adversarial networks (GAN) in image synthesis. Unfortunately, existing studies that propose various approaches, in fighting against DeepFake and determining if the facial image is real or fake, is still at an early stage. Obviously, the current DeepFake detection method struggles to catch the rapid progress of GANs, especially in the adversarial scenarios where attackers can evade the detection intentionally, such as adding perturbations to fool the DNN-based detectors. While passive detection simply tells whether the image is fake or real, DeepFake provenance, on the other hand, provides clues for tracking the sources in DeepFake forensics. Thus, the tracked fake images could be blocked immediately by administrators and avoid further spread in social networks. In this paper, we investigate the potentials of image tagging in serving the DeepFake provenance tracking. Specifically, we devise a deep learning-based approach, named FakeTagger, with a simple yet effective encoder and decoder design along with channel coding to embed message to the facial image, which is to recover the embedded message after various drastic GAN-based DeepFake transformation with high confidence. The embedded message could be employed to represent the identity of facial images, which further contributed to DeepFake detection and provenance. Experimental results demonstrate that our proposed approach could recover the embedded message with an average accuracy of more than 95% over the four common types of DeepFakes. Our research finding confirms effective privacy-preserving techniques for protecting personal photos from being DeepFaked.