{"id":"c1e6cd43-e12c-4c70-ae24-7e49e56c7c92","arxiv_id":"2411.17209","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":7.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"LampMark embeds a landmark-derived watermark into face images and detects deepfakes by comparing the recovered watermark to the current landmarks, achieving AUCs above 98% across seven manipulations.","lead":"LampMark embeds a watermark derived from facial landmarks into images before sharing, then detects deepfakes by checking whether the watermark recovered from a suspect image still matches the face's current landmarks. The approach offers a proactive alternative to passive detectors, which often fail on new deepfake techniques.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The paper never specifies or validates the facial-landmark extractor, so the content-matched watermark m_sus that drives detection may be unreliable on manipulated or watermarked faces.","rationale":"I agree with the reader's weakest_assumption: the landmark extractor is the single most load-bearing unexamined component. The central claim is that comparing a landmark-derived watermark of the suspect image to the recovered watermark detects both face swapping and reenactment. Every step of that argument passes through the landmark extractor, yet the paper neither names it nor tests its behavior on manipulated faces. The reader's CONDITIONAL verdict already reflects the need to substantiate this premise, so I do not propose a new verdict; I would make the requested revision explicit: specify the extractor and show stability across extractors. This is a reproducible, computationally cheap check that would settle whether the concern lands. I also note the paper's extensive cross-manipulation and cross-dataset experiments are real evidence, but they cannot compensate for an unspecified critical input.","tokens_in":18233,"tokens_out":4119,"duration_ms":44447,"concrete_test":"Run the full LampMark detection pipeline on the same CelebA-HQ splits using at least three publicly available landmark extractors (e.g., dlib 68-point, FAN 68-point, and MediaPipe) while keeping all other components fixed, and report the Section 4.3-style AUC for each detector. Also report the landmark detector name and version used for Figure 1 and Table 6. If the mixed-manipulation AUC varies by more than about 1 point across detectors, or if any detector yields AUC below 95%, then the unspecified extractor is load-bearing and the manuscript must be revised to fix and validate it before the central claim can be accepted.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The detection rule in Section 4.2.3 computes m_sus = G_m(landmarks(I_sus)) and compares it to the recovered watermark m_rec. Sections 3.2.1 and 4.2.3 therefore depend entirely on a landmark extractor, but no extractor is named: no detector, no number of landmarks d_lm, no training data or weights, and no validation that the detector localizes keypoints reliably on Deepfake-generated faces or on watermarked images. Figure 1 and Table 6, which motivate the entire 'structure-sensitive characteristic', are themselves computed with an unspecified landmark extractor. If the extractor is brittle on synthetic faces, especially reenactment outputs that erase or replace backgrounds (the paper notes lower watermark recovery for reenactment), then m_sus will not faithfully reflect true structural changes and the separation between benign and fake matching rates could collapse. This is load-bearing because even perfect watermark embedding and recovery would not yield detection if m_sus is noisy or biased. It also blocks adversarial analysis: an attacker who knows the extractor could target its failure modes. The authors should specify and release the exact landmark detector and demonstrate that the detection AUC is insensitive to that choice.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"LampMark is a proactive deepfake detector that embeds a binary watermark derived from facial landmarks into face images. The watermark is constructed without supervised training: landmark coordinates are flattened to vectors of length 2d_lm, projected with PCA (fit on a CelebA-HQ corpus), min-max normalized, binarized, and then XOR-encrypted with keys generated by a Rule-30 cellular automaton. An auto-encoder is trained end-to-end to embed and recover the watermark, using JPEG compression and SimSwap as the only adversarial distortions during training. At detection time, the decoder recovers the embedded watermark m_rec from the suspect image, and a fresh watermark m_sus is computed from the suspect image's landmarks via the same pipeline; a low bit-wise matching rate between m_rec and m_sus is taken as evidence of the structural change caused by Deepfake manipulation, while benign processing leaves the matching rate high. Experiments on CelebA-HQ at 128 and 256 resolutions and on LFW evaluate visual quality (PSNR/SSIM), bit-wise watermark recovery under four benign and seven Deepfake manipulations, and Deepfake detection AUC against four passive detectors, reporting state-of-the-art results (e.g., 98.39% and 98.55% AUC on a mixed set of seven manipulations, and average recovery accuracies of 87.23% and 87.21% under Deepfake manipulations).","tokens_in":18423,"tokens_out":22809,"duration_ms":192170,"significance":"The paper's central idea is attractive and, if the experiments are taken at face value, effective: unlike a trained passive detector, the detection rule is a content-consistency check between a recovered watermark and a landmark-derived watermark of the suspect image, so the approach is not circular in the way a fitted real-vs-fake classifier would be; the only supervised component (the auto-encoder) is trained for watermark recovery rather than for the detection decision, and the PCA projection is fit on unlabeled landmarks. The empirical scope is genuinely broad: seven Deepfake manipulation models of which six are unseen at training time, two resolutions, a cross-dataset transfer test (LFW), a benign-manipulation robustness pool that the appendix extends to twelve operations, and comparisons against six watermarking and four passive baselines. The reported numbers are strong (state-of-the-art PSNR/SSIM of 44.75/0.992 at 128, about 87% average recovery under Deepfake manipulations, and 98.39% mixed AUC), and the authors frankly acknowledge the weak spot of their scheme, the lower watermark recovery under face reenactment.","major_comments":[{"comment":"The method is built on a facial landmark extractor that is never identified. The detection rule in §4.2.3 computes m_sus = G_m(landmarks(I_sus)) and compares it with the recovered watermark m_rec, and the motivating structure-sensitivity statistics in Figure 1, Figure 6, and Table 6 are produced by the same unnamed detector; yet the paper states neither the detector nor the number of landmarks d_lm, nor the face detection/alignment steps that precede landmark extraction. If the detector's outputs on reenacted faces (which the paper itself notes erase or replace background content) or on watermarked images are noisy or biased, m_sus would not faithfully encode the true structural changes and the benign/fake matching-rate separation could collapse. This is load-bearing because even a perfect watermark embedder and decoder cannot detect if the landmark-derived code is unreliable; it also blocks adversarial analysis, since an attacker who knows the extractor could target its failure modes. Please specify the complete landmark-extraction pipeline (detection, alignment, detector identity, d_lm), validate its localization on clean, watermarked, and manipulated faces, and include an ablation with at least one alternative landmark detector to show that detection AUC is insensitive to that choice.","section":"§3.2.1, §4.2.3; Figures 1 and 6; Table 6"},{"comment":"The PCA projection matrix W and the min-max bounds in Eq. (4) are fit on 'CelebA-HQ ... as the data corpus' (§4.1), while the same dataset supplies the test split; the paper does not state whether the corpus includes the test images. If it does, the 'training-free' watermark construction is subtly adapted to the test landmark distribution, which would flatter the in-dataset numbers and leave the LFW cross-dataset experiment as the only clean test. Please state explicitly that W and the normalization bounds are computed from the training (or validation) split only, and report the corpus size and composition.","section":"§4.1 and Eq. (4)"},{"comment":"The comparison against the four passive detectors in Table 4 is not interpretable without their training protocol. The paper says only that 'algorithms with source code available are reproduced in all experiments' (§4.2), which leaves open whether Xception, SBIs, RECCE, and CADDM were trained on the same CelebA-HQ splits, on watermarked or raw images, with the same seven manipulations, or evaluated with pre-trained public weights. The reported values (e.g., Xception at 39.37% AUC on SimSwap at 128) are far below the typical within-dataset performance of these models, so the reader cannot tell whether the comparison is fair or whether the baselines are operating out-of-domain. Please specify the exact training and evaluation protocol for each passive baseline, including which images (raw vs. watermarked) were used for training and testing.","section":"§4.2, Table 4"},{"comment":"The watermarking framework cannot be reproduced from the paper: the four objectives in §3.4 are never combined with explicit weights (no λ values are given), and §4.1 omits the batch size, number of iterations, optimizer details, discriminator architecture, and the layer counts and channel dimensions of the encoder and decoder. Since the paper's evidence is entirely experimental, these omissions block independent verification of the central claim. Please provide the complete training configuration and architecture details, or release the code.","section":"§3.4 and §4.1"}],"minor_comments":[{"comment":"In the boundary case i = l-1, Eq. (6) (and its duplicated Eq. (13)) uses the undefined index s^t_l and appears to drop the central bit s^t_{l-1} from the update; please correct the recurrence and state the boundary condition (e.g., periodic) explicitly.","section":"§3.2.2, Eq. (6) and Eq. (13)"},{"comment":"The text reports an average recovery accuracy of 89.73% on LFW, which matches neither the benign average (99.95%) nor the Deepfake average (83.73%) given in Table 5; please correct this inconsistency.","section":"§4.3"},{"comment":"The abstract's averages of 91.83% and 91.86% appear to be computed over all eleven manipulations (four benign plus seven Deepfake), whereas Table 3 reports 87.23% and 87.21% for the seven Deepfake manipulations alone; please state the averaging convention in both places.","section":"Abstract and Table 3"},{"comment":"Since the detection rule is defined by the bit-wise matching rate between m_sus and m_rec, the paper should report the actual matching-rate distributions (e.g., mean ± std per manipulation) rather than only AUC, which would also reveal the separation margin for reenactment manipulations whose recovery accuracy is only about 74%.","section":"§4.2.3"},{"comment":"The confidentiality claim is supported only by the non-repetition of Rule-30 keys; the paper neither states the threat model (which pipeline components are public versus secret) nor includes any attack experiment (e.g., watermark removal or replacement), so the practical security level of the 'confidentiality' contribution is uncharacterized.","section":"§3.2.2 and Appendix C"},{"comment":"Table 5's caption lists 'Hidden [56]' where HiDDeN [56] is meant; the abbreviation 'RDA' is never defined; Xception is cited as [31] in §4.2.3 but [48] in Table 4; and 'principle component analysis' in §3.2.1 should be 'principal component analysis.'","section":"Table 5; §4.2.3; §3.2.1"},{"comment":"The paper contains no code availability statement, which is particularly consequential given the missing implementation details noted above.","section":"§4.1"},{"comment":"The watermark length l (64 and 128) and the fixed binarization threshold of 0.5 are neither justified nor tested for sensitivity; a brief analysis of detection AUC as a function of l and of the threshold would clarify the capacity-robustness trade-off.","section":"§4.2"}],"recommendation":"major_revision","confidential_remarks":"Two editorial points beyond the report. First, the manuscript is from the same group as reference [38] (arXiv:2311.01357, 'Robust Identity Perceptual Watermark Against Deepfake Face Swapping'), and the auto-encoder and loss design appear largely shared; the present contribution is the replacement of identity embeddings by facial landmarks and the extension from face swapping to also cover reenactment. The authors should be asked to state explicitly what is new relative to [38] and to verify the claim of being 'the first to simultaneously detect face swapping and face reenactment with a single robust watermark' against that prior work and against SepMark. Second, the manuscript carries an ACM MM 2024 camera-ready header; if this is a journal submission, the editor should confirm that overlap with the published conference version is properly disclosed."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"LampMark is worth a serious look. The core idea—encode facial landmarks into a robust watermark, then detect deepfakes by comparing the recovered watermark to the landmarks of the suspect image—is genuinely new and neatly sidesteps the generalization failures of passive detectors. The authors show it works across seven manipulation types, including both face swapping and reenactment, with only SimSwap and JPEG seen in training. That is a real result. The landmark offset analysis in Figure 1 and Table 6 supports the structural-change premise, and the detection rule is a content-consistency check rather than a fitted predictor, so circularity is not a concern.\n\nThe soft spots are real, though. The biggest one: the paper never names the facial landmark extractor. No detector, no landmark count, no validation on synthetic or watermarked faces. The entire detection rule in Section 4.2.3 depends on m_sus being a faithful structural encoding of the suspect image. If the extractor is brittle on deepfake outputs—especially reenactment results that replace backgrounds—the matching-rate separation collapses. This is load-bearing, not a cosmetic omission. The authors need to specify the extractor, show its outputs on manipulated faces, and test sensitivity to the choice.\n\nSecond, the PCA fit is underspecified. They fit the projection matrix on CelebA-HQ but don't say whether the test images are part of that corpus. If the test split overlaps the PCA corpus, the watermark construction could see test landmarks during fitting. That needs clarification.\n\nThird, the passive detectors' training is unspecified. It's not clear whether Xception, SBIs, RECCE, and CADDM are used off-the-shelf or trained on the same data, which makes the comparison hard to interpret. The cellular automaton confidentiality claim also deserves a proper threat model; Rule 30 XOR encryption is not argued against any specific attack.\n\nOn balance, the central mechanism holds up and the experimental evidence is broad. The paper is a solid new contribution that deserves a serious referee, but the missing extractor and corpus split are major revision items. I'd want to see the code and the exact pipeline before relying on the numbers.","headline":"Genuinely new proactive watermarking idea with strong reported results, but the missing landmark extractor is a load-bearing gap that must be fixed before the numbers can be trusted.","tokens_in":19021,"tokens_out":2075,"would_cite":true,"duration_ms":18661,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper claims that a training-free binary watermark derived from facial landmarks, embedded proactively and compared against the suspect image's own landmarks, detects both face-swapping and face-reenactment deepfakes without training…","keywords":["deepfake detection","proactive defense","robust image watermarking","facial landmarks","cellular automaton encryption","face swapping","face reenactment","auto-encoder"],"falsifier":"Recompute the landmark-offset statistics that motivate the method (Figure 1) using the actual landmark detector the framework deploys, on watermarked images: if heavy JPEG or mild blur produces landmark displacements overlapping the deepfake range, the consistency check cannot separate real from fake. Conversely, if a reenactment that preserves keypoint positions still triggers detection, the claimed structural invariant is not what drives the result.","tokens_in":17975,"feed_emoji":"🎭","tokens_out":8206,"duration_ms":67797,"temperature":0.7,"pith_summary":"LampMark is a proactive deepfake detector: it embeds an invisible watermark derived from facial landmarks into images before they can be manipulated, rather than hunting for artifacts left by generators. The paper's central claim is that deepfake manipulations, both face swapping and face reenactment, necessarily displace facial structures, while benign processing such as JPEG, noise, and blur does not. Detection is therefore a consistency check between the watermark recovered from a suspect image and a fresh landmark watermark computed from the suspect image's own landmarks: if the two disagree, the image has been structurally altered. The authors report average watermark recovery accuracies of 91.83% and 91.86% at 128 and 256 resolution on CelebA-HQ and 98.39% and 98.55% AUC on a mixed set of seven deepfake manipulations, even though the embedding network was trained only against JPEG and SimSwap.","feed_headline":"Facial-landmark watermark catches face swaps and reenactments","feed_subtitle":"Watermark bits are matched against the suspect picture's own landmarks, reaching ~98% AUC on seven deepfakes.","key_machinery":"The load-bearing object is the landmark perceptual watermark, a fixed-length binary string produced by PCA projection of facial landmark coordinates (fit once on the CelebA-HQ corpus), followed by min-max normalization and a 0.5 threshold. It gives the framework three properties at once: discrimination, because landmark geometry separates benign from manipulated images; confidentiality, because cellular automaton Rule 30 with randomly selected XOR keys makes the mapping from image to watermark unpredictable to attackers; and robustness, because an auto-encoder trained adversarially with a discriminator and a benign-operation pool embeds the string imperceptibly and recovers it after distortion. The detection rule itself is a bit-wise matching rate between the recovered watermark and the landmark watermark recomputed from the suspect image, which serves as a content-matched reference for what the watermark would be if the image had never been structurally edited.","core_discovery":"Deepfake generation, whether it swaps a source identity onto a target (SimSwap, InfoSwap, UniFace, E4S) or reenacts expression and pose (StarGAN, StyleMask, HyperReenact), changes the geometry of facial landmarks far more than any benign image operation does. LampMark converts this structural sensitivity into a practical defense. A training-free pipeline fits PCA on a landmark corpus, projects each face's landmarks into a short coordinate vector, normalizes it, and thresholds at 0.5 to obtain a binary landmark perceptual watermark; a cellular automaton using Rule 30 XOR-encrypts the string so that attackers cannot forge a content-matched replacement. An end-to-end auto-encoder with convolutional attention embeds and recovers the watermark, and detection is declared by the bit-wise matching rate between the recovered watermark and the landmark watermark of the suspect image. The paper demonstrates across in-dataset, cross-dataset, and cross-manipulation settings that this single watermarking framework performs consistently, with all detection AUC scores above 95% on individual manipulations.","pith_inferences":["A fair benchmark for this method should pin down the landmark detector, which the paper leaves unnamed, and test whether its keypoints on synthetic faces are stable enough for the consistency check to separate benign from manipulated images.","The method's own logic implies that a generator trained to preserve keypoint positions, or a swap that reuses the target face's landmarks, would evade detection; testing that boundary would map the method's real coverage.","The same structure-sensitive watermark idea could be carried to video deepfakes by watermarking each frame's landmarks, or to other object classes with reliable keypoint extractors.","Combining LampMark with a passive detector could arbitrate borderline matching rates: the proactive consistency score gives a strong prior, and the passive artifact score decides when the two watermarks disagree narrowly."],"forward_implications":["One watermarking framework can flag both face-swap and face-reenactment deepfakes, the two dominant manipulation categories, without being trained on the specific generator.","Detection transfers to unseen manipulations and unseen datasets, since it keys on structural change rather than generator-specific visual artifacts.","Benign image processing such as JPEG, noise, blur, brightness, and hue changes does not trigger the detector, because landmarks and the embedded watermark both survive those operations.","An attacker who does not know the cellular-automaton key cannot replace the watermark with a content-matched forgery, so the consistency signal stays trustworthy.","Images are protected proactively at publication time, before any deepfake of them exists, which is a different guarantee from passive detectors that only work after a fake appears."],"supporting_citations":[{"why":"SimSwap is the face-swapping generator used both in the motivating landmark-offset analysis and as the sole deepfake manipulation seen during training.","marker":"[6]"},{"why":"StarGAN supplies the face-reenactment example in the structural-sensitivity demonstration and appears in the cross-manipulation evaluation.","marker":"[7]"},{"why":"InfoSwap is an additional face-swapping algorithm used to test whether watermarks survive unseen swapping manipulations.","marker":"[9]"},{"why":"HyperReenact is an unseen one-shot reenactment method that stresses cross-manipulation watermark recovery and detection.","marker":"[2]"},{"why":"StyleMask is a reenactment manipulation in the evaluation pool that shows the weakness of prior watermarking methods on expression changes.","marker":"[3]"},{"why":"UniFace is a unified swapping and reenactment framework used as an unseen manipulation in the cross-manipulation tests.","marker":"[47]"},{"why":"E4S is a fine-grained face-swapping method included in the deepfake manipulation pool for robustness evaluation.","marker":"[23]"},{"why":"CelebA-HQ is the dataset used to fit the PCA transform, train the auto-encoder, and evaluate watermark recovery and detection.","marker":"[18]"},{"why":"Wolfram's Rule 30 cellular automaton is the encryption mechanism that provides watermark confidentiality.","marker":"[44]"},{"why":"SepMark is the closest prior proactive watermarking system that also performs deepfake detection, serving as the key baseline to compare against.","marker":"[46]"}],"fun_headline_variants":["Landmark watermark exposes deepfakes without training","Training-free watermark catches face swaps and reenactments","Facial-geometry watermark flags deepfakes proactively","Watermark uses face landmarks to unmask deepfakes","Proactive landmark watermark detects deepfakes reliably"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The approach depends on being able to reliably find the same facial keypoints in both watermarked originals and deepfake-altered faces, and the paper never names the landmark detector or checks how it behaves on synthetic faces.","fun_headline_variants_meta":{"raw":{"variants":["Landmark watermark exposes deepfakes without training","Training-free watermark catches face swaps and reenactments","Facial-geometry watermark flags deepfakes proactively","Watermark uses face landmarks to unmask deepfakes","Proactive landmark watermark detects deepfakes reliably"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000179,"raw_usage":{"total_tokens":1311,"prompt_tokens":966,"completion_tokens":345,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":582,"completion_tokens_details":{"reasoning_tokens":269}},"tokens_in":582,"tokens_out":345,"duration_ms":3849,"temperature":1.0,"reasoning_tokens":269,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T12:23:14.547812+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Recompute the landmark-offset statistics that motivate the method (Figure 1) using the actual landmark detector the framework deploys, on watermarked images: if heavy JPEG or mild blur produces landmark displacements overlapping the deepfake range, the consistency check cannot separate real from fake. Conversely, if a reenactment that preserves keypoint positions still triggers detection, the claimed structural invariant is not what drives the result.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"SimSwap is the face-swapping generator used both in the motivating landmark-offset analysis and as the sole deepfake manipulation seen during training."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"StarGAN supplies the face-reenactment example in the structural-sensitivity demonstration and appears in the cross-manipulation evaluation."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"InfoSwap is an additional face-swapping algorithm used to test whether watermarks survive unseen swapping manipulations."},{"cited_title":"Bounareli, C","cited_arxiv_id":null,"evidence_quote":"HyperReenact is an unseen one-shot reenactment method that stresses cross-manipulation watermark recovery and detection."},{"cited_title":"Bounareli, C","cited_arxiv_id":null,"evidence_quote":"StyleMask is a reenactment manipulation in the evaluation pool that shows the weakness of prior watermarking methods on expression changes."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"UniFace is a unified swapping and reenactment framework used as an unseen manipulation in the cross-manipulation tests."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"E4S is a fine-grained face-swapping method included in the deepfake manipulation pool for robustness evaluation."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Wolfram's Rule 30 cellular automaton is the encryption mechanism that provides watermark confidentiality."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"SepMark is the closest prior proactive watermarking system that also performs deepfake detection, serving as the key baseline to compare against."}],"review_version":1}