# FaceSigns: Semi-Fragile Neural Watermarks for Media Authentication and Countering Deepfakes arXiv: https://arxiv.org/abs/2204.01960 ยท HTML: https://mlsanity.com/paper/2204.01960/ ## Key facts - Cited by 18 papers in the map (data through 14 Oct 2026). - Placed in Watermarking generated content and models, one of 12 directions in LLM safety and security. - Builds on 24 of its 51 references that are in the map. - First posted on arXiv 5 Apr 2022. ## Placed in - LLM safety and security / [Watermarking generated content and models](https://mlsanity.com/safety/watermarking-generated-content-and-models/) ## Builds on (most cited first, 24 of 24) - [U-Net: Convolutional Networks for Biomedical Image Segmentation](https://mlsanity.com/paper/1505.04597/) (2015) - [The Unreasonable Effectiveness of Deep Features as a Perceptual Metric](https://mlsanity.com/paper/1801.03924/) (2018) - [A Style-Based Generator Architecture for Generative Adversarial Networks](https://mlsanity.com/paper/1812.04948/) (2018) - [Image-to-Image Translation with Conditional Adversarial Networks](https://mlsanity.com/paper/1611.07004/) (2016) - [Deep Learning Face Attributes in the Wild](https://mlsanity.com/paper/1411.7766/) (2014) - [FaceForensics++: Learning to Detect Manipulated Facial Images](https://mlsanity.com/paper/1901.08971/) (2019) - [StarGAN v2: Diverse Image Synthesis for Multiple Domains](https://mlsanity.com/paper/1912.01865/) (2019) - [CNN-generated images are surprisingly easy to spot... for now](https://mlsanity.com/paper/1912.11035/) (2019) - [Face2Face: Real-time Face Capture and Reenactment of RGB Videos](https://mlsanity.com/paper/2007.14808/) (2020) - [MesoNet: a Compact Facial Video Forgery Detection Network](https://mlsanity.com/paper/1809.00888/) (2018) - [HiDDeN: Hiding Data With Deep Networks](https://mlsanity.com/paper/1807.09937/) (2018) - [FSGAN: Subject Agnostic Face Swapping and Reenactment](https://mlsanity.com/paper/1908.05932/) (2019) - [Few-Shot Adversarial Learning of Realistic Neural Talking Head Models](https://mlsanity.com/paper/1905.08233/) (2019) - [StegaStamp: Invisible Hyperlinks in Physical Photographs](https://mlsanity.com/paper/1904.05343/) (2019) - [The Creation and Detection of Deepfakes: A Survey](https://mlsanity.com/paper/2004.11138/) (2020) - [SimSwap: An Efficient Framework For High Fidelity Face Swapping](https://mlsanity.com/paper/2106.06340/) (2021) - [Distortion Agnostic Deep Watermarking](https://mlsanity.com/paper/2001.04580/) (2020) - [Adversarial Deepfakes: Evaluating Vulnerability of Deepfake Detectors to Adversarial Examples](https://mlsanity.com/paper/2002.12749/) (2020) - [Generating Steganographic Images via Adversarial Training](https://mlsanity.com/paper/1703.00371/) (2017) - [Adversarial Perturbations Fool Deepfake Detectors](https://mlsanity.com/paper/2003.10596/) (2020) - [Adversarial Threats to DeepFake Detection: A Practical Perspective](https://mlsanity.com/paper/2011.09957/) (2020) - [DeepFake Detection: Current Challenges and Next Steps](https://mlsanity.com/paper/2003.09234/) (2020) - [Invisible Steganography via Generative Adversarial Networks](https://mlsanity.com/paper/1807.08571/) (2018) - [Compact Deep Aggregation for Set Retrieval](https://mlsanity.com/paper/2003.11794/) (2020) ## Built on by (most cited first, 18 of 18) - [Raising the Cost of Malicious AI-Powered Image Editing](https://mlsanity.com/paper/2302.06588/) (2023) - [EditGuard: Versatile Image Watermarking for Tamper Localization and Copyright Protection](https://mlsanity.com/paper/2312.08883/) (2023) - [REMARK-LLM: A Robust and Efficient Watermarking Framework for Generative Large Language Models](https://mlsanity.com/paper/2310.12362/) (2023) - [SepMark: Deep Separable Watermarking for Unified Source Tracing and Deepfake Detection](https://mlsanity.com/paper/2305.06321/) (2023) - [LampMark: Proactive Deepfake Detection via Training-Free Landmark Perceptual Watermarks](https://mlsanity.com/paper/2411.17209/) (2024) - [Robust Identity Perceptual Watermark Against Deepfake Face Swapping](https://mlsanity.com/paper/2311.01357/) (2023) - [Are Watermarks Bugs for Deepfake Detectors? Rethinking Proactive Forensics](https://mlsanity.com/paper/2404.17867/) (2024) - [A Survey of Defenses Against AI-Generated Visual Media: Detection,Disruption, and Authentication](https://mlsanity.com/paper/2407.10575/) (2024) - [Social Media Authentication and Combating Deepfakes using Semi-fragile Invisible Image Watermarking](https://mlsanity.com/paper/2410.01906/) (2024) - [Traceable and Authenticable Image Tagging for Fake News Detection](https://mlsanity.com/paper/2211.10923/) (2022) - [Towards Generalized Proactive Defense against Face Swapping with Contour-Hybrid Watermark](https://mlsanity.com/paper/2505.19081/) (2025) - [Robustness Assessment and Enhancement of Text Watermarking for Google's SynthID](https://mlsanity.com/paper/2508.20228/) (2025) - [Uncovering and Mitigating Destructive Multi-Embedding Attacks in Deepfake Proactive Forensics](https://mlsanity.com/paper/2508.17247/) (2025) - [FastStamp: Accelerating Neural Steganography and Digital Watermarking of Images on FPGAs](https://mlsanity.com/paper/2209.12391/) (2022) - [Proactive Schemes: A Survey of Adversarial Attacks for Social Good](https://mlsanity.com/paper/2409.16491/) (2024) - [Deep Data Hiding for ICAO-Compliant Face Images: A Survey](https://mlsanity.com/paper/2508.19324/) (2025) - [Facial Features Matter: a Dynamic Watermark based Proactive Deepfake Detection Approach](https://mlsanity.com/paper/2411.14798/) (2024) - [Transferable Multi-Bit Watermarking Across Frozen Diffusion Models via Latent Consistency Bridges](https://mlsanity.com/paper/2603.20304/) (2026) ## Abstract (arXiv) Deepfakes and manipulated media are becoming a prominent threat due to the recent advances in realistic image and video synthesis techniques. There have been several attempts at combating Deepfakes using machine learning classifiers. However, such classifiers do not generalize well to black-box image synthesis techniques and have been shown to be vulnerable to adversarial examples. To address these challenges, we introduce a deep learning based semi-fragile watermarking technique that allows media authentication by verifying an invisible secret message embedded in the image pixels. Instead of identifying and detecting fake media using visual artifacts, we propose to proactively embed a semi-fragile watermark into a real image so that we can prove its authenticity when needed. Our watermarking framework is designed to be fragile to facial manipulations or tampering while being robust to benign image-processing operations such as image compression, scaling, saturation, contrast adjustments etc. This allows images shared over the internet to retain the verifiable watermark as long as face-swapping or any other Deepfake modification technique is not applied. We demonstrate that FaceSigns can embed a 128 bit secret as an imperceptible image watermark that can be recovered with a high bit recovery accuracy at several compression levels, while being non-recoverable when unseen Deepfake manipulations are applied. For a set of unseen benign and Deepfake manipulations studied in our work, FaceSigns can reliably detect manipulated content with an AUC score of 0.996 which is significantly higher than prior image watermarking and steganography techniques.