{"id":"6e88226a-5123-45a3-8519-682c8b48a33d","arxiv_id":"2411.14798","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"A proactive deepfake detector that generates watermarks from 128-dim facial embeddings and validates images by comparing recovered vs re-mapped watermarks.","lead":"FaceProtect embeds a face-specific dynamic watermark into images, then detects deepfakes by checking whether the recovered watermark still matches the face's current features. The method is a new branch of proactive deepfake defense, but its experimental proof is weakened by an unclear test setup and missing error bars.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Reported detection accuracy may reflect absence of the embedded watermark in fake images rather than the claimed facial-feature-mismatch mechanism; Section 4.2 does not state whether fake samples were generated from watermarked or pristine originals.","rationale":"The reader's weakest assumption is exactly the load-bearing issue: the test-set construction in Section 4.2 is ambiguous about whether fake images are derived from watermarked or pristine originals. This ambiguity is decisive because the decision rule in Eq. 5 compares the recovered watermark Wr with the re-mapped watermark Wm. If the fake images carry no watermark at all, Wr is blank and the cosine similarity is trivially below threshold, so the classifier is effectively detecting the absence of a watermark, not the facial-feature mismatch that the paper's title and abstract emphasize. The paper's own Limitations section explicitly concedes that new deepfakes that fail to retain the watermark would still be detected because the watermark is blank, which reinforces this concern. Thus the current experiments cannot establish that the proposed method detects deepfakes through the claimed facial-feature mechanism. The threshold being fixed at 0.8 'based on experiments we conduct' on the same test data and the absence of error bars further weaken the quantitative claims, but the test-set ambiguity is the primary blocker. Since the reader already reached REJECT and this concern supports that verdict, no adjustment is needed.","tokens_in":10837,"tokens_out":4394,"duration_ms":43475,"concrete_test":"Re-run the Section 4.2 evaluation with three test splits: (1) fake images generated by applying each of InfoSwap, SimSwap, StyleGAN2, and AttGAN to the 1000 watermarked mixed images; (2) fake images generated from 1000 unwatermarked pristine images; (3) the original reported setting. Report ACC/PREC/F1 separately for splits (1) and (2). Additionally, recover Wr from each fake image and report the mean cosine similarity between Wr and Wm, and the fraction of fakes whose recovered Wr is blank (e.g., near-zero variance). If split (1) accuracy is substantially below the reported 0.96-0.99, or if Wr is blank in most fakes, the current numbers support watermark-presence detection, not facial-feature-based detection. Also report an ROC curve with the threshold chosen on a held-out validation set rather than on the test set.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim is that deepfakes are detected by comparing the recovered watermark Wr with the watermark Wm re-mapped from the current facial features. For this mechanism to be tested, fake test images must be produced from watermarked mixed images so that the watermark is initially present, and the deepfake operation must either distort facial features (changing Wm) or damage the watermark. Section 4.2 only states 'we retain 1000 pristine images of real examples while producing 1000 fake samples for each deepfake method', with no statement of whether the fake samples are generated from the watermarked images or from unwatermarked pristine images. If the latter, Wr is blank for every fake, and the classifier is simply thresholding watermark presence; the reported ACC of 0.96-0.99 would not be evidence for the facial-feature comparison mechanism. This is not a pedantic detail: the paper's own Limitations section says 'images generated by these new deepfakes typically fail to retain the watermark (which can be viewed as a blank watermark), which suggests that the method proposed in this paper is still effective' - an admission that watermark absence alone can produce detection. Under that reading, the comparison with passive baselines (SBI, CNNS, DDR) is also unfair, since those methods have to detect manipulation while the proposed method would only need to detect missing steganography. Without an ablation separating 'watermark present, features changed' from 'watermark absent', the central claim is unverified.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"This manuscript proposes FaceProtect, a proactive deepfake detection framework in which a watermark is derived from the face's 128-dimensional Dlib feature vector by a WGAN-GP generator, hidden into the image by a U-Net/SENet steganography network, and later recovered and compared against a watermark re-mapped from the current facial features. The claimed contribution is a dynamic, content-dependent watermark that detects face swapping and attribute editing by the mismatch between the recovered and re-derived watermarks. Experiments on SimSwap, InfoSwap, StyleGAN2, and AttGAN report ACC/PREC/F1 values of roughly 0.93-0.99, above the passive baselines SBI, CNNS, and DDR.","tokens_in":11135,"tokens_out":5099,"duration_ms":49208,"significance":"The core idea is timely and potentially valuable: tying the watermark to facial content is a natural way to avoid fixed-watermark vulnerabilities and to link the watermark to the semantics being protected. The paper also reports strong steganographic quality (SSIM 0.986, PSNR 42.23), and the use of grayscale-image watermarks rather than bit sequences is a sensible design choice. However, the current experimental evidence does not establish that deepfake detection actually works by the claimed facial-feature comparison; the protocol does not state whether fake test images ever contained the watermark, and the detection threshold is selected on the same data used for evaluation. These issues are load-bearing, so the significance of the claimed results cannot be assessed from the manuscript as written.","major_comments":[{"comment":"The experimental protocol does not state whether the 1000 fake samples per deepfake method are generated from the watermarked mixed images produced by the proposed system or from pristine unwatermarked originals. This distinction is decisive: if the fakes are generated from unwatermarked originals, then the recovered watermark Wr is blank for every fake, and the classifier is simply thresholding watermark presence rather than comparing facial-feature-derived watermarks. Table 3 would then not support the paper's central claim, and the comparison against passive baselines would be unfair. The Limitations section explicitly says that images generated by new deepfakes 'typically fail to retain the watermark (which can be viewed as a blank watermark), which suggests that the method proposed in this paper is still effective,' confirming that watermark-absence detection is part of the intended behavior. To support the claimed facial-feature mechanism, the authors should specify the test-generation pipeline, and provide ablations for (a) watermark present and facial features changed, (b) watermark present and facial features unchanged, and (c) watermark removed or corrupted, so that the contribution of facial-feature mismatch can be isolated.","section":"Section 4.2 and Section 5 (Limitations)"},{"comment":"The cosine similarity threshold tau is set to 0.8 'based on the experiments we conduct,' which appears to mean the threshold is selected on the same test data used for the reported ACC/PREC/F1 results in Table 3. This makes the evaluation circular and the reported numbers optimistic. The authors should describe how the threshold is selected, use a held-out validation set for threshold selection, and report ROC curves or performance across a range of tau values so that the sensitivity of the results to this choice is transparent.","section":"Section 4.2, Eq. (5)"},{"comment":"The performance comparison is made only against passive detectors (SBI, CNNS, DDR) under a protocol whose relation to the proactive setting is unclear. The only proactive baseline, RootAttr, is not actually compared because only its steganography code is available. As a result, the claim that the proposed method outperforms existing proactive methods is not supported. The authors should either implement a complete proactive baseline or clearly restrict the comparison to passive methods and acknowledge that cross-protocol comparisons are indicative only.","section":"Section 4.3 and Table 3"}],"minor_comments":[{"comment":"The acronym 'GODFGM' appears in the training details and should be 'GODWGM' to match the rest of the paper.","section":"Section 4.1"},{"comment":"MNIST is described as containing '600,000 handwritten Arabic numerals,' but the standard MNIST dataset contains 60,000 training images; this should be corrected.","section":"Section 4.2"},{"comment":"The loss weights lambda1 and lambda2 are introduced but their values are never reported, which prevents reproduction of the hiding and recovery network training.","section":"Section 3.4, Eq. (4)"},{"comment":"The table caption should define P, M, A, and S explicitly and state whether the fake images used for A and S were generated from watermarked or unwatermarked images, since this determines how the similarity values should be interpreted.","section":"Section 4.3, Table 1"},{"comment":"In the comparison list, 'IN(43.37)' appears to be a typo for 'CIN' (CIN watermarking), and this should be corrected.","section":"Section 4.3, Visual Quality"},{"comment":"The header announces 'ACC/PREC/F1-Score' but each row contains three numbers; the table should clearly label these three metrics.","section":"Table 3"}],"recommendation":"major_revision","confidential_remarks":"The protocol ambiguity in Section 4.2 is the central issue: as written, the paper cannot rule out trivial watermark-presence detection. I believe this is fixable with new ablations and a clearer description of how fake test images are produced, but without those additions the main claim is unverifiable. The post hoc threshold selection strengthens the need for revision rather than supporting rejection outright."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Worth a look if you work on proactive deepfake defense. The core idea—map dlib 128-d face embeddings through a WGAN-GP to generate grayscale watermark images, hide them with a U-Net/SENet encoder, then detect forgeries by comparing the recovered watermark against one re-mapped from the current image—is new to me and is a sensible way to make watermarks content-dependent. The paper also handles watermark synchronization, which fixed-sequence schemes dodge, and the reported embedding quality (SSIM 0.986, PSNR 42.23) beats the UDH baseline they replicated.\n\nThe problem is the evidence for the headline claim. Section 4.2 says 1000 pristine and 1000 fake samples per deepfake method but never says whether fakes are made from the watermarked 'mixed' images or from clean originals. If the latter, every fake has no watermark and the detector is just thresholding watermark presence, making the 0.96-0.99 ACC uninformative and the comparison with SBI/CNNS/DDR unfair. The Limitations section essentially admits this: it says new deepfakes 'fail to retain the watermark (which can be viewed as a blank watermark),' so the method still works. That's a watermark-absence detector, not necessarily a facial-feature-mismatch detector. Without an ablation that separates the two, the central novelty is unverified.\n\nOther soft spots: the cosine threshold tau=0.8 is chosen on the same data; no error bars or variance; 'one-way' security of GODWGM is asserted but not tested against any reverse-inference attack. Some text inconsistencies (GODFGM vs GODWGM, MNIST 60k vs 600k) don't change the substance.\n\nOn the plus side, the authors are honest about the robustness limitation, the pipeline is clearly described, and the idea is testable. This is a conference-grade idea that currently lacks the experiment to prove it. It deserves a serious referee, but I would send it back for major revision: state the source of fake images, add the ablation I described, and report variance.","headline":"Good idea, ambiguous experiments: the reported accuracy may just be measuring missing watermarks, not the claimed facial-feature comparison.","tokens_in":11678,"tokens_out":2632,"would_cite":false,"duration_ms":25592,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Deepfakes can be caught by comparing an embedded watermark with one re-derived from the face's current features.","keywords":["deepfake detection","proactive detection","dynamic watermark","facial feature","steganography","WGAN-GP","face swapping","attribute editing"],"falsifier":"Take a set of pristine, unwatermarked face images, apply SimSwap or StyleGAN2 to create fakes, then run FaceProtect's full pipeline (watermark embedding of the pristine images, then detection). If the reported accuracy collapses when the fakes are made from unwatermarked originals — or, conversely, if a random watermark unrelated to facial features yields the same accuracy — then the detector is responding to watermark presence, not to facial-feature change.","tokens_in":10663,"feed_emoji":"🎭","tokens_out":7930,"duration_ms":65938,"temperature":0.7,"pith_summary":"The paper argues that deepfake images can be detected by tying a hidden watermark to the face's own features, so any facial manipulation breaks the link. It proposes FaceProtect, which embeds a dynamic watermark — a grayscale image generated from the face's 128-dimensional feature vector — into the original photo via steganography. At verification time, the detector recovers the hidden watermark and also generates a fresh watermark from the current face; high cosine similarity means authentic, low similarity means fake. Reported results show accuracy between 0.93 and 0.99 across two face-swap methods (SimSwap, InfoSwap) and two attribute-editing methods (StyleGAN2, AttGAN), without retraining per forgery type. The authors claim this outperforms passive detectors (SBI, CNNS, DDR) and a proactive baseline (RootAttr) on the same test sets.","feed_headline":"Face-linked watermarks catch deepfakes across four forgery types","feed_subtitle":"If the recovered watermark no longer matches one re-mapped from the tampered face, the image is flagged fake.","key_machinery":"The load-bearing object is the two-watermark comparison: the recovered watermark $W_r$ (dug out of the image by the WVS recovery network) versus the freshly mapped watermark $W_m$ (produced by GODWGM from the current face's Dlib features), judged by cosine similarity against threshold $\\tau = 0.8$. The machinery has two trained halves: a GAN-based One-way Dynamic Watermark Generating Mechanism (GODWGM), a WGAN-GP whose generator turns 128-dimensional feature vectors into grayscale watermark images and is deliberately one-way; and a Watermark-based Verification Strategy (WVS), a U-Net/SENet hiding network plus a six-layer CNN recovery network trained jointly with hiding and recovery losses. The claim that this machinery works rests on the assumption that deepfake manipulation changes facial features enough to move $W_m$ away from $W_r$, while ordinary watermark embedding leaves the features essentially intact.","core_discovery":"FaceProtect's central claim is that a face's identity-bearing features can serve as the ground truth for its own authenticity. The pipeline starts with a trusted cloud unit that extracts a 128-dimensional Dlib facial feature vector from the pristine image and feeds it to a WGAN-GP generator (GODWGM) trained on MNIST, producing a grayscale watermark image; because the generator input is the feature vector rather than random noise, the watermark is unique to the face and effectively impossible to invert. This watermark is hidden in the image by a U-Net/SENet steganography net (WVS) that is trained jointly with a recovery net. At detection time, the recovery net extracts the embedded watermark $W_r$ from the suspect image, while GODWGM maps the suspect image's current facial features to a fresh watermark $W_m$; the two are compared by cosine similarity with threshold $\\tau = 0.8$. If the face has been swapped or its attributes edited, the facial features shift, the newly mapped watermark diverges from the recovered one, and the image is flagged as fake — without any need to know in advance which deepfake method produced it.","pith_inferences":["The method's practical reach depends on adoption at the source: images can only be verified if they were watermarked before any manipulation, so the approach protects a distribution pipeline rather than analyzing arbitrary internet images.","The reported accuracy likely depends on fakes being generated from the same watermarked originals; if test fakes were produced from pristine, unwatermarked images, the detector would be measuring the watermark's absence rather than feature change. Testing that setup explicitly would separate the two mechanisms.","The comparison of $W_r$ vs $W_m$ might also localize tampering: regions where the face features diverge could be highlighted, turning a binary detector into a soft tamper-localization signal, though the paper does not explore this.","The method could in principle combine with passive detectors: a passive model could flag unwatermarked images, while this proactive check handles watermarked ones. That hybrid is a natural next step the paper does not discuss."],"forward_implications":["Detection generalizes across face-swap and attribute-edit forgeries without retraining, since it keys on feature change rather than tamper artifacts.","Senders and receivers need no pre-shared watermark sequence: the benchmark watermark is always re-derived from the received image's own face.","A one-way feature-to-watermark mapping means an attacker who sees the watermark cannot invert it to recover the original facial features or forge a matching watermark.","Using grayscale images rather than binary sequences as watermarks preserves more information, making recovery robust enough for the 0.8 threshold to separate real from fake.","Even if a new deepfake method destroys the embedded watermark, the recovered watermark becomes blank and still differs from the re-mapped watermark, so detection is claimed to persist."],"supporting_citations":[{"why":"Dlib extracts the 128-dimensional facial feature vectors that drive watermark generation and verification.","marker":"[21]"},{"why":"WGAN-GP is the base of GODWGM, providing stable training and diverse grayscale watermark images.","marker":"[10]"},{"why":"U-Net is the backbone of the WVS hiding network that embeds watermarks while preserving image quality.","marker":"[33]"},{"why":"SENet modules in the hiding network improve the visual consistency of mixed images.","marker":"[14]"},{"why":"MNIST is the training dataset for the WGAN-GP discriminator, defining the watermark's output domain.","marker":"[23]"},{"why":"CelebA is the source of 60,000 face images used to train GODWGM and the WVS hiding/recovery networks.","marker":"[26]"},{"why":"SimSwap is one of the two face-swap methods used to generate fake test images.","marker":"[3]"},{"why":"InfoSwap is the other face-swap method used to generate fake test images.","marker":"[7]"},{"why":"StyleGAN2 is one of the two attribute-editing methods used to generate fake test images.","marker":"[20]"},{"why":"AttGAN is the other attribute-editing method used to generate fake test images.","marker":"[13]"}],"fun_headline_variants":["Facial features become dynamic watermarks for deepfake detection","FaceProtect: dynamic watermarks from face identity catch deepfakes","Proactive watermarks from facial features flag deepfakes without fixed keys","Face-linked watermarks adapt to unmask swapped and edited faces","Self-verifying watermarks from facial features detect deepfakes"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The whole comparison only proves the claimed mechanism if the fake images in the test set were produced from the same watermarked originals the framework protects — if the fakes were made from unwatermarked images, the detector would be flagging the absence of a watermark rather than a change in facial features.","fun_headline_variants_meta":{"raw":{"variants":["Facial features become dynamic watermarks for deepfake detection","FaceProtect: dynamic watermarks from face identity catch deepfakes","Proactive watermarks from facial features flag deepfakes without fixed keys","Face-linked watermarks adapt to unmask swapped and edited faces","Self-verifying watermarks from facial features detect deepfakes"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000279,"raw_usage":{"total_tokens":1667,"prompt_tokens":968,"completion_tokens":699,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":584,"completion_tokens_details":{"reasoning_tokens":609}},"tokens_in":584,"tokens_out":699,"duration_ms":6884,"temperature":1.0,"reasoning_tokens":609,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T14:52:36.142107+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take a set of pristine, unwatermarked face images, apply SimSwap or StyleGAN2 to create fakes, then run FaceProtect's full pipeline (watermark embedding of the pristine images, then detection). If the reported accuracy collapses when the fakes are made from unwatermarked originals — or, conversely, if a random watermark unrelated to facial features yields the same accuracy — then the detector is responding to watermark presence, not to facial-feature change.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Dlib extracts the 128-dimensional facial feature vectors that drive watermark generation and verification."},{"cited_title":"Courville","cited_arxiv_id":null,"evidence_quote":"WGAN-GP is the base of GODWGM, providing stable training and diverse grayscale watermark images."},{"cited_title":"Squeeze-and-excitation networks","cited_arxiv_id":null,"evidence_quote":"SENet modules in the hiding network improve the visual consistency of mixed images."},{"cited_title":"Gradient-based learning applied to document recog- nition","cited_arxiv_id":null,"evidence_quote":"MNIST is the training dataset for the WGAN-GP discriminator, defining the watermark's output domain."},{"cited_title":"Deep learning face attributes in the wild","cited_arxiv_id":null,"evidence_quote":"CelebA is the source of 60,000 face images used to train GODWGM and the WVS hiding/recovery networks."},{"cited_title":"Simswap: An efficient framework for high fidelity face swapping","cited_arxiv_id":null,"evidence_quote":"SimSwap is one of the two face-swap methods used to generate fake test images."},{"cited_title":"Information bottleneck disentanglement for identity swapping","cited_arxiv_id":null,"evidence_quote":"InfoSwap is the other face-swap method used to generate fake test images."},{"cited_title":"Analyzing and improving the image quality of stylegan","cited_arxiv_id":null,"evidence_quote":"StyleGAN2 is one of the two attribute-editing methods used to generate fake test images."},{"cited_title":"Shan, and Xilin Chen","cited_arxiv_id":null,"evidence_quote":"AttGAN is the other attribute-editing method used to generate fake test images."}],"review_version":1}