# A Valid Watermark Is Not a Valid Identity: Spatial-Spectral Adversarial Face Evasion with Watermark Preservation

arXiv: https://arxiv.org/abs/2610.20278 · HTML: https://mlsanity.com/paper/2610.20278/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 23 of its 32 references that are in the map.
- First posted on arXiv 14 Oct 2026.

## Builds on (most cited first, 23 of 23)

- [Explaining and Harnessing Adversarial Examples](https://mlsanity.com/paper/1412.6572/) (2014)
- [Towards Deep Learning Models Resistant to Adversarial Attacks](https://mlsanity.com/paper/1706.06083/) (2017)
- [Progressive Growing of GANs for Improved Quality, Stability, and Variation](https://mlsanity.com/paper/1710.10196/) (2017)
- [FaceNet: A Unified Embedding for Face Recognition and Clustering](https://mlsanity.com/paper/1503.03832/) (2015)
- [Joint Face Detection and Alignment using Multi-task Cascaded Convolutional Networks](https://mlsanity.com/paper/1604.02878/) (2016)
- [HiDDeN: Hiding Data With Deep Networks](https://mlsanity.com/paper/1807.09937/) (2018)
- [StegaStamp: Invisible Hyperlinks in Physical Photographs](https://mlsanity.com/paper/1904.05343/) (2019)
- [Efficient Decision-based Black-box Adversarial Attacks on Face Recognition](https://mlsanity.com/paper/1904.04433/) (2019)
- [MBRS : Enhancing Robustness of DNN-based Watermarking by Mini-Batch of Real and Simulated JPEG Compression](https://mlsanity.com/paper/2108.08211/) (2021)
- [Robust Watermarking Using Generative Priors Against Image Editing: From Benchmarking to Advances](https://mlsanity.com/paper/2410.18775/) (2024)
- [WAVES: Benchmarking the Robustness of Image Watermarks](https://mlsanity.com/paper/2401.08573/) (2024)
- [CMUA-Watermark: A Cross-Model Universal Adversarial Watermark for Combating Deepfakes](https://mlsanity.com/paper/2105.10872/) (2021)
- [SepMark: Deep Separable Watermarking for Unified Source Tracing and Deepfake Detection](https://mlsanity.com/paper/2305.06321/) (2023)
- [TAFIM: Targeted Adversarial Attacks against Facial Image Manipulations](https://mlsanity.com/paper/2112.09151/) (2021)
- [Edit Away and My Face Will not Stay: Personal Biometric Defense against Malicious Generative Editing](https://mlsanity.com/paper/2411.16832/) (2024)
- [Are Watermarks Bugs for Deepfake Detectors? Rethinking Proactive Forensics](https://mlsanity.com/paper/2404.17867/) (2024)
- [AMP: Authentication of Media via Provenance](https://mlsanity.com/paper/2001.07886/) (2020)
- [Social Media Authentication and Combating Deepfakes using Semi-fragile Invisible Image Watermarking](https://mlsanity.com/paper/2410.01906/) (2024)
- [DIP-Watermark: A Double Identity Protection Method Based on Robust Adversarial Watermark](https://mlsanity.com/paper/2404.14693/) (2024)
- [Effective Message Hiding with Order-Preserving Mechanisms](https://mlsanity.com/paper/2402.19160/) (2024)
- [Fragile Watermarking for Image Certification Using Deep Steganographic Embedding](https://mlsanity.com/paper/2504.13759/) (2025)
- [Adversarial Watermarking for Face Recognition](https://mlsanity.com/paper/2409.16056/) (2024)
- [Deep Data Hiding for ICAO-Compliant Face Images: A Survey](https://mlsanity.com/paper/2508.19324/) (2025)

## Abstract (arXiv)

Facial image watermarking can support traceability and certification in biometric pipelines, but provenance or manipulation detection alone does not guarantee reliable biometric identity. We introduce a watermark-preserving face evasion attack that targets this gap under a black-box watermarking setting, without access to the watermarking components. The proposed PGD-L_2 attack guides adversarial perturbations with spatial and spectral preservation terms to reduce face-recognition similarity while limiting pixel-level distortion and high-frequency changes that may interfere with hidden watermark cues. Evaluated on controlled facial images with two watermarking schemes, two face-recognition models, and two datasets, the attack achieves evasion rates above 92% at operational thresholds while preserving watermark recovery above 93% for StegaFormer and above 99.7% for FaceSigns, with visual quality above 47dB PSNR at epsilon_2=2.0. These results expose a structural gap in watermark-based facial certification: a face image can remain watermark-valid and visually faithful while becoming biometrically unreliable.