# FontGuard: A Robust Font Watermarking Approach Leveraging Deep Font Knowledge

arXiv: https://arxiv.org/abs/2504.03128 · HTML: https://mlsanity.com/paper/2504.03128/

## Key facts

- Cited by 3 papers in the map (data through 14 Oct 2026).
- Builds on 30 of its 68 references that are in the map.
- First posted on arXiv 4 Apr 2025.

## Builds on (most cited first, 30 of 30)

- [Adam: A Method for Stochastic Optimization](https://mlsanity.com/paper/1412.6980/) (2014)
- [Learning Transferable Visual Models From Natural Language Supervision](https://mlsanity.com/paper/2103.00020/) (2021)
- [Microsoft COCO: Common Objects in Context](https://mlsanity.com/paper/1405.0312/) (2014)
- [The Unreasonable Effectiveness of Deep Features as a Perceptual Metric](https://mlsanity.com/paper/1801.03924/) (2018)
- [Supervised Contrastive Learning](https://mlsanity.com/paper/2004.11362/) (2020)
- [Perceptual Losses for Real-Time Style Transfer and Super-Resolution](https://mlsanity.com/paper/1603.08155/) (2016)
- [HiDDeN: Hiding Data With Deep Networks](https://mlsanity.com/paper/1807.09937/) (2018)
- [Character Region Awareness for Text Detection](https://mlsanity.com/paper/1904.01941/) (2019)
- [StegaStamp: Invisible Hyperlinks in Physical Photographs](https://mlsanity.com/paper/1904.05343/) (2019)
- [DeepSVG: A Hierarchical Generative Network for Vector Graphics Animation](https://mlsanity.com/paper/2007.11301/) (2020)
- [MBRS : Enhancing Robustness of DNN-based Watermarking by Mini-Batch of Real and Simulated JPEG Compression](https://mlsanity.com/paper/2108.08211/) (2021)
- [Identifying and Mitigating the Security Risks of Generative AI](https://mlsanity.com/paper/2308.14840/) (2023)
- [Distortion Agnostic Deep Watermarking](https://mlsanity.com/paper/2001.04580/) (2020)
- [Robust Multi-bit Natural Language Watermarking through Invariant Features](https://mlsanity.com/paper/2305.01904/) (2023)
- [SteganoGAN: High Capacity Image Steganography with GANs](https://mlsanity.com/paper/1901.03892/) (2019)
- [DG-Font: Deformable Generative Networks for Unsupervised Font Generation](https://mlsanity.com/paper/2104.03064/) (2021)
- [Generalizable Synthetic Image Detection via Language-guided Contrastive Learning](https://mlsanity.com/paper/2305.13800/) (2023)
- [Few-shot Font Generation with Localized Style Representations and Factorization](https://mlsanity.com/paper/2009.11042/) (2020)
- [CopyRNeRF: Protecting the CopyRight of Neural Radiance Fields](https://mlsanity.com/paper/2307.11526/) (2023)
- [DeepVecFont-v2: Exploiting Transformers to Synthesize Vector Fonts with Higher Quality](https://mlsanity.com/paper/2303.14585/) (2023)
- [CF-Font: Content Fusion for Few-shot Font Generation](https://mlsanity.com/paper/2303.14017/) (2023)
- [Protecting NeRFs' Copyright via Plug-And-Play Watermarking Base Model](https://mlsanity.com/paper/2407.07735/) (2024)
- [EXIF as Language: Learning Cross-Modal Associations Between Images and Camera Metadata](https://mlsanity.com/paper/2301.04647/) (2023)
- [An Automated and Robust Image Watermarking Scheme Based on Deep Neural Networks](https://mlsanity.com/paper/2007.02460/) (2020)
- [De-END: Decoder-driven Watermarking Network](https://mlsanity.com/paper/2206.13032/) (2022)
- [VQ-Font: Few-Shot Font Generation with Structure-Aware Enhancement and Quantization](https://mlsanity.com/paper/2308.14018/) (2023)
- [GeometrySticker: Enabling Ownership Claim of Recolorized Neural Radiance Fields](https://mlsanity.com/paper/2407.13390/) (2024)
- [A Robust Document Image Watermarking Scheme using Deep Neural Network](https://mlsanity.com/paper/2202.13067/) (2022)
- [Generating Robust Adversarial Examples against Online Social Networks (OSNs)](https://mlsanity.com/paper/2310.12708/) (2023)
- [A Screen-Shooting Resilient Document Image Watermarking Scheme using Deep Neural Network](https://mlsanity.com/paper/2203.05198/) (2022)

## Built on by (most cited first, 3 of 3)

- [LLM-as-a-Reviewer: Benchmarking Their Ability, Divergence, and Prompt Injection Resistance as Paper Reviewers](https://mlsanity.com/paper/2605.25415/) (2026)
- [FeatDistill: A Feature Distillation Enhanced Multi-Expert Ensemble Framework for Robust AI-generated Image Detection](https://mlsanity.com/paper/2603.21939/) (2026)
- [When Modalities Fail to Tango: Conformal Backdoor Detection in Multimodal Contrastive Learning](https://mlsanity.com/paper/2608.04052/) (2026)

## Abstract (arXiv)

The proliferation of AI-generated content brings significant concerns on the forensic and security issues such as source tracing, copyright protection, etc, highlighting the need for effective watermarking technologies. Font-based text watermarking has emerged as an effective solution to embed information, which could ensure copyright, traceability, and compliance of the generated text content. Existing font watermarking methods usually neglect essential font knowledge, which leads to watermarked fonts of low quality and limited embedding capacity. These methods are also vulnerable to real-world distortions, low-resolution fonts, and inaccurate character segmentation. In this paper, we introduce FontGuard, a novel font watermarking model that harnesses the capabilities of font models and language-guided contrastive learning. Unlike previous methods that focus solely on the pixel-level alteration, FontGuard modifies fonts by altering hidden style features, resulting in better font quality upon watermark embedding. We also leverage the font manifold to increase the embedding capacity of our proposed method by generating substantial font variants closely resembling the original font. Furthermore, in the decoder, we employ an image-text contrastive learning to reconstruct the embedded bits, which can achieve desirable robustness against various real-world transmission distortions. FontGuard outperforms state-of-the-art methods by +5.4%, +7.4%, and +5.8% in decoding accuracy under synthetic, cross-media, and online social network distortions, respectively, while improving the visual quality by 52.7% in terms of LPIPS. Moreover, FontGuard uniquely allows the generation of watermarked fonts for unseen fonts without re-training the network. The code and dataset are available at https://github.com/KAHIMWONG/FontGuard.