Pith. sign in

REVIEW 3 major objections 6 minor 1 cited by

Facial Features Matter: a Dynamic Watermark based Proactive Deepfake Detection Approach

T0 review · 3 major / 6 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Deepfakes can be caught by comparing an embedded watermark with one re-derived from the face's current features.

desk verdict Good idea, ambiguous experiments: the reported accuracy may just be measuring missing watermarks, not the claimed facial-feature comparison. read the letter →

arxiv 2411.14798 v1 pith:BXC5QZFH submitted 2024-11-22 cs.CV cs.CRcs.LGeess.IV

Shulin Lan , Kanlin Liu , Yazhou Zhao , Chen Yang , Yingchao Wang , Xingshan Yao , Liehuang Zhu This is my paper · ORCID
classification cs.CVcs.CRcs.LGeess.IV
keywords deepfakedetectionproactivedynamicwatermarkfacialfeaturesteganographyWGAN-GPfaceswappingattributeediting
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that deepfake images can be detected by tying a hidden watermark to the face's own features, so any facial manipulation breaks the link. It proposes FaceProtect, which embeds a dynamic watermark — a grayscale image generated from the face's 128-dimensional feature vector — into the original photo via steganography. At verification time, the detector recovers the hidden watermark and also generates a fresh watermark from the current face; high cosine similarity means authentic, low similarity means fake. Reported results show accuracy between 0.93 and 0.99 across two face-swap methods (SimSwap, InfoSwap) and two attribute-editing methods (StyleGAN2, AttGAN), without retraining per forgery type. The authors claim this outperforms passive detectors (SBI, CNNS, DDR) and a proactive baseline (RootAttr) on the same test sets.

What carries the argument

The load-bearing object is the two-watermark comparison: the recovered watermark $W_r$ (dug out of the image by the WVS recovery network) versus the freshly mapped watermark $W_m$ (produced by GODWGM from the current face's Dlib features), judged by cosine similarity against threshold $\tau = 0.8$. The machinery has two trained halves: a GAN-based One-way Dynamic Watermark Generating Mechanism (GODWGM), a WGAN-GP whose generator turns 128-dimensional feature vectors into grayscale watermark images and is deliberately one-way; and a Watermark-based Verification Strategy (WVS), a U-Net/SENet hiding network plus a six-layer CNN recovery network trained jointly with hiding and recovery losses. The claim that this machinery works rests on the assumption that deepfake manipulation changes facial features enough to move $W_m$ away from $W_r$, while ordinary watermark embedding leaves the features essentially intact.

What would settle it

Take a set of pristine, unwatermarked face images, apply SimSwap or StyleGAN2 to create fakes, then run FaceProtect's full pipeline (watermark embedding of the pristine images, then detection). If the reported accuracy collapses when the fakes are made from unwatermarked originals — or, conversely, if a random watermark unrelated to facial features yields the same accuracy — then the detector is responding to watermark presence, not to facial-feature change.

Watch

Extended reading notes

Core claim

FaceProtect's central claim is that a face's identity-bearing features can serve as the ground truth for its own authenticity. The pipeline starts with a trusted cloud unit that extracts a 128-dimensional Dlib facial feature vector from the pristine image and feeds it to a WGAN-GP generator (GODWGM) trained on MNIST, producing a grayscale watermark image; because the generator input is the feature vector rather than random noise, the watermark is unique to the face and effectively impossible to invert. This watermark is hidden in the image by a U-Net/SENet steganography net (WVS) that is trained jointly with a recovery net. At detection time, the recovery net extracts the embedded watermark $W_r$ from the suspect image, while GODWGM maps the suspect image's current facial features to a fresh watermark $W_m$; the two are compared by cosine similarity with threshold $\tau = 0.8$. If the face has been swapped or its attributes edited, the facial features shift, the newly mapped watermark diverges from the recovered one, and the image is flagged as fake — without any need to know in advance which deepfake method produced it.

Load-bearing premise

The whole comparison only proves the claimed mechanism if the fake images in the test set were produced from the same watermarked originals the framework protects — if the fakes were made from unwatermarked images, the detector would be flagging the absence of a watermark rather than a change in facial features.

Editorial extensions

If this is right

  • Detection generalizes across face-swap and attribute-edit forgeries without retraining, since it keys on feature change rather than tamper artifacts.
  • Senders and receivers need no pre-shared watermark sequence: the benchmark watermark is always re-derived from the received image's own face.
  • A one-way feature-to-watermark mapping means an attacker who sees the watermark cannot invert it to recover the original facial features or forge a matching watermark.
  • Using grayscale images rather than binary sequences as watermarks preserves more information, making recovery robust enough for the 0.8 threshold to separate real from fake.
  • Even if a new deepfake method destroys the embedded watermark, the recovered watermark becomes blank and still differs from the re-mapped watermark, so detection is claimed to persist.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The method's practical reach depends on adoption at the source: images can only be verified if they were watermarked before any manipulation, so the approach protects a distribution pipeline rather than analyzing arbitrary internet images.
  • The reported accuracy likely depends on fakes being generated from the same watermarked originals; if test fakes were produced from pristine, unwatermarked images, the detector would be measuring the watermark's absence rather than feature change. Testing that setup explicitly would separate the two mechanisms.
  • The comparison of $W_r$ vs $W_m$ might also localize tampering: regions where the face features diverge could be highlighted, turning a binary detector into a soft tamper-localization signal, though the paper does not explore this.
  • The method could in principle combine with passive detectors: a passive model could flag unwatermarked images, while this proactive check handles watermarked ones. That hybrid is a natural next step the paper does not discuss.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. This manuscript proposes FaceProtect, a proactive deepfake detection framework in which a watermark is derived from the face's 128-dimensional Dlib feature vector by a WGAN-GP generator, hidden into the image by a U-Net/SENet steganography network, and later recovered and compared against a watermark re-mapped from the current facial features. The claimed contribution is a dynamic, content-dependent watermark that detects face swapping and attribute editing by the mismatch between the recovered and re-derived watermarks. Experiments on SimSwap, InfoSwap, StyleGAN2, and AttGAN report ACC/PREC/F1 values of roughly 0.93-0.99, above the passive baselines SBI, CNNS, and DDR.

Significance. The core idea is timely and potentially valuable: tying the watermark to facial content is a natural way to avoid fixed-watermark vulnerabilities and to link the watermark to the semantics being protected. The paper also reports strong steganographic quality (SSIM 0.986, PSNR 42.23), and the use of grayscale-image watermarks rather than bit sequences is a sensible design choice. However, the current experimental evidence does not establish that deepfake detection actually works by the claimed facial-feature comparison; the protocol does not state whether fake test images ever contained the watermark, and the detection threshold is selected on the same data used for evaluation. These issues are load-bearing, so the significance of the claimed results cannot be assessed from the manuscript as written.

major comments (3)
  1. [Section 4.2 and Section 5 (Limitations)] The experimental protocol does not state whether the 1000 fake samples per deepfake method are generated from the watermarked mixed images produced by the proposed system or from pristine unwatermarked originals. This distinction is decisive: if the fakes are generated from unwatermarked originals, then the recovered watermark Wr is blank for every fake, and the classifier is simply thresholding watermark presence rather than comparing facial-feature-derived watermarks. Table 3 would then not support the paper's central claim, and the comparison against passive baselines would be unfair. The Limitations section explicitly says that images generated by new deepfakes 'typically fail to retain the watermark (which can be viewed as a blank watermark), which suggests that the method proposed in this paper is still effective,' confirming that watermark-absence detection is part of the intended behavior. To support the claimed facial-feature mechanism, the authors should specify the test-generation pipeline, and provide ablations for (a) watermark present and facial features changed, (b) watermark present and facial features unchanged, and (c) watermark removed or corrupted, so that the contribution of facial-feature mismatch can be isolated.
  2. [Section 4.2, Eq. (5)] The cosine similarity threshold tau is set to 0.8 'based on the experiments we conduct,' which appears to mean the threshold is selected on the same test data used for the reported ACC/PREC/F1 results in Table 3. This makes the evaluation circular and the reported numbers optimistic. The authors should describe how the threshold is selected, use a held-out validation set for threshold selection, and report ROC curves or performance across a range of tau values so that the sensitivity of the results to this choice is transparent.
  3. [Section 4.3 and Table 3] The performance comparison is made only against passive detectors (SBI, CNNS, DDR) under a protocol whose relation to the proactive setting is unclear. The only proactive baseline, RootAttr, is not actually compared because only its steganography code is available. As a result, the claim that the proposed method outperforms existing proactive methods is not supported. The authors should either implement a complete proactive baseline or clearly restrict the comparison to passive methods and acknowledge that cross-protocol comparisons are indicative only.
minor comments (6)
  1. [Section 4.1] The acronym 'GODFGM' appears in the training details and should be 'GODWGM' to match the rest of the paper.
  2. [Section 4.2] MNIST is described as containing '600,000 handwritten Arabic numerals,' but the standard MNIST dataset contains 60,000 training images; this should be corrected.
  3. [Section 3.4, Eq. (4)] The loss weights lambda1 and lambda2 are introduced but their values are never reported, which prevents reproduction of the hiding and recovery network training.
  4. [Section 4.3, Table 1] The table caption should define P, M, A, and S explicitly and state whether the fake images used for A and S were generated from watermarked or unwatermarked images, since this determines how the similarity values should be interpreted.
  5. [Section 4.3, Visual Quality] In the comparison list, 'IN(43.37)' appears to be a typo for 'CIN' (CIN watermarking), and this should be corrected.
  6. [Table 3] The header announces 'ACC/PREC/F1-Score' but each row contains three numbers; the table should clearly label these three metrics.

Circularity Check

2 steps flagged · score 5.0 of 10

Detection rule defines unwatermarked images as fake by construction, and the test-fake provenance is never stated; reported ACC may reduce to blank-watermark detection rather than the claimed facial-feature mechanism.

  1. self definitional [Section 3.4 (Watermark-based Verification Strategy, Eq. 5 decision rule); Section 5 (Limitations); Section 4.2 (Experiment Setting)]
    "otherwise the image is fake or not proactively protected. ... images generated by these new deepfakes typically fail to retain the watermark (which can be viewed as a blank watermark), which suggests that the method proposed in this paper is still effective because the mapped watermark and the blank watermark differ more noticeably."

    The rule defines 'not proactively protected' as 'fake' by construction: any image whose recovered watermark is blank is classified fake regardless of facial-feature matching. The Limitations then justify robustness to new deepfakes by this blank-watermark difference. Section 4.2 says only that 'we retain 1000 pristine images of real examples while producing 1000 fake samples for each deepfake method,' without specifying whether fakes are made from watermarked mixed images. If, as the wording suggests, fakes are produced from pristine images, Wr is blank for every fake, and the reported ACC follows from the definitional blank-watermark rule, not from the claimed Wr-versus-Wm facial-feature comparison.

  2. fitted input called prediction [Section 4.2 (Experiment Setting, Evaluation Metrics)]
    "The criterion for judging the true prediction of the method proposed in this paper is that the cosine similarity threshold of the watermarks used for comparison is greater than the τ, 0.8 in this case, based on the experiments we conduct."

    The threshold τ is selected 'based on the experiments we conduct,' and the same experimental test data are subsequently scored with this threshold in Table 3. No independent validation split or held-out threshold-selection procedure is described. Consequently the reported ACC/PREC/F1 are resubstitution values: the decision rule is fitted to the data it is then used to predict, so the performance numbers are partly determined by the threshold-tuning step rather than being an out-of-sample prediction of the method's behavior.

full rationale

The core construction — generating a watermark from a face embedding, hiding it, and comparing the recovered watermark with a re-mapped watermark — is not circular in itself: for a watermarked image that survives deepfake manipulation with its watermark intact, the Wr-versus-Wm comparison is a genuine test of facial-feature change. No load-bearing self-citation or imported uniqueness theorem appears. However, two steps in the evaluation chain are circular. First, the decision rule in Section 3.4 explicitly classes 'not proactively protected' (i.e., no recoverable watermark) as fake, and the Limitations section confirms that deepfakes that fail to retain the watermark are detected via the 'blank watermark' difference. Section 4.2 never states that the 1000 fake test samples per method were generated from watermarked mixed images rather than from the pristine images; on the natural reading, fakes contain no watermark, so the reported ACC is a watermark-presence check defined by the rule, not a test of the facial-feature mechanism. Second, the cosine threshold τ=0.8 is said to be chosen 'based on the experiments we conduct,' and the same experiments are then scored with that threshold in Table 3, with no validation split described; the reported metrics are therefore resubstitution estimates. These are evaluation circularities rather than a fully circular derivation, so the score is moderate.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The method relies on several domain assumptions about the stability and discriminative power of Dlib face embeddings, the absence of GAN mode collapse, and the robustness of the steganography. None are formally proven or quantified. The only fitted scalar in the comparison rule is the cosine threshold.

free parameters (3)
  • Cosine similarity threshold tau = 0.8
    Chosen based on experiments; directly determines the real/fake classification boundary.
  • Loss weights lambda1/lambda2 = not reported
    Weights for hiding vs recovery losses; no values given, presumably tuned.
  • SENet reduction ratio = 10
    Hyperparameter of the hiding network; set from experiment results.
assumptions (4)
  • domain assumption Deepfake manipulation changes the 128-d Dlib facial feature vector enough to produce a distinguishable mapped watermark.
    The entire detection rationale relies on the feature curves differing after tampering; observed qualitatively but not quantified with a discrimination analysis.
  • domain assumption The GAN generator maps distinct facial feature vectors to sufficiently distinct watermarks and does not collapse.
    The paper states WGAN-GP helps avoid mode collapse, but no collision rate or separation analysis is provided.
  • domain assumption The steganographic hiding and recovery networks preserve the watermark through image manipulations and deepfake processes.
    The paper's Limitations section explicitly states this robustness is not directly addressed and should be added to training.
  • domain assumption The test fake images are constructed from the same watermarked originals, so that the detection signal is the facial feature change rather than mere watermark absence.
    Section 4.2 does not specify whether the fake samples are derived from watermarked images; if not, the comparison is trivial.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Facial Features Matter: a Dynamic Watermark based Proactive Deepfake Detection Approach." pith.science (2026). https://pith.science/paper/BXC5QZFH

@misc{pith2026241114798,
  author       = {Pith},
  title        = {Pith review of: Facial Features Matter: a Dynamic Watermark based Proactive Deepfake Detection Approach},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/BXC5QZFH}},
  note         = {Machine review of arXiv:2411.14798}
}
read the original abstract

Current passive deepfake face-swapping detection methods encounter significance bottlenecks in model generalization capabilities. Meanwhile, proactive detection methods often use fixed watermarks which lack a close relationship with the content they protect and are vulnerable to security risks. Dynamic watermarks based on facial features offer a promising solution, as these features provide unique identifiers. Therefore, this paper proposes a Facial Feature-based Proactive deepfake detection method (FaceProtect), which utilizes changes in facial characteristics during deepfake manipulation as a novel detection mechanism. We introduce a GAN-based One-way Dynamic Watermark Generating Mechanism (GODWGM) that uses 128-dimensional facial feature vectors as inputs. This method creates irreversible mappings from facial features to watermarks, enhancing protection against various reverse inference attacks. Additionally, we propose a Watermark-based Verification Strategy (WVS) that combines steganography with GODWGM, allowing simultaneous transmission of the benchmark watermark representing facial features within the image. Experimental results demonstrate that our proposed method maintains exceptional detection performance and exhibits high practicality on images altered by various deepfake techniques.

Figures

Figures reproduced from arXiv: 2411.14798 by the authors.

Figure 1
Figure 1. Overview of the proactive detection framework based on differences in facial features. [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Curves of different people with similar facical features and the same person with different expressions. [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Overview of GAN-based one-way dynamic watermark generating mechanism(GODWGM). [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (4 more)
Figure 4
Figure 4. Figure 4: Architecture of Watermark-based verification strategy (WVS). [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]
Figure 5
Figure 5. Figure 5: Watermarks generated by WGAN GP and DCGAN. The watermarks in (a) have low similarity, and the watermarks in (b) are similar. in the WGAN GP[10], we employ 60,000 128-dimensional feature vectors extracted from the preprocessed dataset of CelebA[26] using the Dlib instea…
Figure 6
Figure 6. Figure 6: Images and relevant watermarks. the carrier dataset of 30,000 images from CelebA. We em￾ploy two identity manipulation methods, InfoSwap[7] and SimSwap[3], as well as two facial attribute editing methods, StyleGAN2[19] and AttGAN[13], to assess the detection performanc…
Figure 8
Figure 8. Figure 8: Conversion from sequences to grayscales image. [PITH_FULL_IMAGE:figures/full_fig_p008_8.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. PhantomSeal: Proactive Deepfakes Defense with Identity/Context Protection and Forensic Tracing

    cs.CR 2026-07 conditional novelty 6.0 of 10

    A single perturbation can steer face-swap outputs toward a chosen 'cloak' identity, giving both identity/context protection and forensic tracing.

Reference graph

Works this paper leans on

49 extracted references · 38 canonical work pages · cited by 1 Pith paper

  1. [1]

    Wasserstein gan

    Martín Arjovsky, Soumith Chintala, and Léon Bottou. Wasserstein gan. ArXiv, abs/1701.07875, 2017. 1, 5

    arXiv 2017

  2. [2]

    Self-supervised learning of adversarial exam- ple: Towards good generalizations for deepfake detection

    Liang Chen, Yong Zhang, Yibing Song, Lingqiao Liu, and Jue Wang. Self-supervised learning of adversarial exam- ple: Towards good generalizations for deepfake detection. 2022 IEEE/CVF Conference on Computer Vision and Pat- tern Recognition (CVPR), pages 18689–18698, 2022. 3

    work page 2022

  3. [3]

    Simswap: An efficient framework for high fidelity face swapping

    Renwang Chen, Xuanhong Chen, Bingbing Ni, and Yanhao Ge. Simswap: An efficient framework for high fidelity face swapping. Proceedings of the 28th ACM International Con- ference on Multimedia, 2020. 7

    work page 2020

  4. [4]

    V oice-face homogeneity tells deep- fake

    Harry Cheng, Yangyang Guo, Tianyi Wang, Qi Li, Xiaojun Chang, and Liqiang Nie. V oice-face homogeneity tells deep- fake. ACM Transactions on Multimedia Computing, Com- munications and Applications, 2022. 3

    work page 2022

  5. [5]

    Stargan v2: Diverse image synthesis for multiple domains

    Yunjey Choi, Youngjung Uh, Jaejun Yoo, and Jung-Woo Ha. Stargan v2: Diverse image synthesis for multiple domains. 2020 IEEE/CVF Conference on Computer Vision and Pat- tern Recognition (CVPR), pages 8185–8194, 2019. 1

    work page 2020

  6. [6]

    Pentyala, Yuening Li, and Xia Hu

    Mengnan Du, Shiva K. Pentyala, Yuening Li, and Xia Hu. Towards generalizable deepfake detection with locality- aware autoencoder. Proceedings of the 29th ACM Interna- tional Conference on Information & Knowledge Manage- ment, 2019. 1

    work page 2019

  7. [7]

    Information bottleneck disentanglement for identity swapping

    Gege Gao, Huaibo Huang, Chaoyou Fu, Zhaoyang Li, and Ran He. Information bottleneck disentanglement for identity swapping. 2021 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 3403–3412, 2021. 7

    work page 2021

  8. [8]

    Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron C

    Ian J. Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron C. Courville, and Yoshua Bengio. Generative adversarial networks. Com- munications of the ACM, 63:139 – 144, 2014. 1

    work page 2014

Show all 49 references
  1. [9]

    David Guera and Edward J. Delp. Deepfake video detec- tion using recurrent neural networks. 2018 15th IEEE Inter- national Conference on Advanced Video and Signal Based Surveillance (AVSS), pages 1–6, 2018. 3

    2018

  2. [10]

    Courville

    Ishaan Gulrajani, Faruk Ahmed, Martín Arjovsky, Vincent Dumoulin, and Aaron C. Courville. Improved training of wasserstein gans. In Neural Information Processing Systems,

  3. [11]

    Lips don’t lie: A generalisable and robust approach to face forgery detection

    Alexandros Haliassos, Konstantinos V ougioukas, Stavros Petridis, and Maja Pantic. Lips don’t lie: A generalisable and robust approach to face forgery detection. 2021 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 5037–5047, 2020. 3

    2021

  4. [12]

    Beyond the spectrum: Detecting deepfakes via re-synthesis

    Yang He, Ning Yu, Margret Keuper, and Mario Fritz. Beyond the spectrum: Detecting deepfakes via re-synthesis. ArXiv, abs/2105.14376, 2021. 7, 9

    2021 arXiv

  5. [13]

    Shan, and Xilin Chen

    Zhenliang He, Wangmeng Zuo, Meina Kan, S. Shan, and Xilin Chen. Attgan: Facial attribute editing by only changing what you want. IEEE Transactions on Image Processing, 28: 5464–5478, 2017. 7

    2017

  6. [14]

    Squeeze-and-excitation networks

    Jie Hu, Li Shen, Samuel Albanie, Gang Sun, and Enhua Wu. Squeeze-and-excitation networks. 2018 IEEE/CVF Confer- ence on Computer Vision and Pattern Recognition , pages 7132–7141, 2017. 3, 5

    2018

  7. [15]

    Cmua-watermark: A cross-model universal adversarial watermark for combating deepfakes.ArXiv, abs/2105.10872,

    Hao Huang, Yongtao Wang, Zhaoyu Chen, Yuheng Li, Zhi Tang, Wei Chu, Jingdong Chen, Weisi Lin, and Kai-Kuang Ma. Cmua-watermark: A cross-model universal adversarial watermark for combating deepfakes.ArXiv, abs/2105.10872,

    arXiv

  8. [16]

    Zhang, Wenbo Zhou, Weiming Zhang, and Nenghai Yu

    Qidong Huang, J. Zhang, Wenbo Zhou, Weiming Zhang, and Nenghai Yu. Initiative defense against facial manipulation. In AAAI Conference on Artificial Intelligence, 2021. 3

    2021

  9. [17]

    Fang, and Weiming Zhang

    Zhaoyang Jia, H. Fang, and Weiming Zhang. Mbrs: Enhanc- ing robustness of dnn-based watermarking by mini-batch of real and simulated jpeg compression. Proceedings of the 29th ACM International Conference on Multimedia , 2021. 8

    2021

  10. [18]

    Progressive growing of gans for improved quality, stability, and variation

    Tero Karras, Timo Aila, Samuli Laine, and Jaakko Lehtinen. Progressive growing of gans for improved quality, stability, and variation. ArXiv, abs/1710.10196, 2017. 1 9

    2017 arXiv

  11. [19]

    A style-based generator architecture for generative adversarial networks

    Tero Karras, Samuli Laine, and Timo Aila. A style-based generator architecture for generative adversarial networks. 2019 IEEE/CVF Conference on Computer Vision and Pat- tern Recognition (CVPR), pages 4396–4405, 2018. 7

    2019

  12. [20]

    Analyzing and improving the image quality of stylegan

    Tero Karras, Samuli Laine, Miika Aittala, Janne Hellsten, Jaakko Lehtinen, and Timo Aila. Analyzing and improving the image quality of stylegan. 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 8107–8116, 2019. 1, 7

    2020

  13. [21]

    Davis E. King. Dlib-ml: A machine learning toolkit. J. Mach. Learn. Res., 10:1755–1758, 2009. 3, 5

    2009

  14. [22]

    Kingma and Jimmy Ba

    Diederik P. Kingma and Jimmy Ba. Adam: A method for stochastic optimization. CoRR, abs/1412.6980, 2014. 6

    2014 arXiv

  15. [23]

    Gradient-based learning applied to document recog- nition

    Yann LeCun, Lëon Bottou, Yoshua Bengio, and Patrick Haffner. Gradient-based learning applied to document recog- nition. Proceedings of the IEEE , 86(11):2278–7324, 1998. 5

    1998

  16. [24]

    Frequency-aware discriminative feature learning supervised by single-center loss for face forgery de- tection

    Jiaming Li, Hongtao Xie, Jiahong Li, Zhongyuan Wang, and Yongdong Zhang. Frequency-aware discriminative feature learning supervised by single-center loss for face forgery de- tection. 2021 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 6454–6463, 2021. 3

    2021

  17. [25]

    Face x-ray for more general face forgery detection

    Lingzhi Li, Jianmin Bao, Ting Zhang, Hao Yang, Dong Chen, Fang Wen, and Baining Guo. Face x-ray for more general face forgery detection. 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 5000–5009, 2019. 1, 3

    2020

  18. [26]

    Deep learning face attributes in the wild

    Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang. Deep learning face attributes in the wild. 2015 IEEE In- ternational Conference on Computer Vision (ICCV) , pages 3730–3738, 2014. 5, 6

    2015

  19. [27]

    Xudong Mao, Qing Li, Haoran Xie, Raymond Y . K. Lau, Zhen Wang, and Stephen Paul Smolley. Least squares gener- ative adversarial networks. 2017 IEEE International Confer- ence on Computer Vision (ICCV) , pages 2813–2821, 2016. 1

    2017

  20. [28]

    Proactive deep- fake detection using gan-based visible watermarking

    Aakash Varma Nadimpalli and Ajita Rattani. Proactive deep- fake detection using gan-based visible watermarking. ACM Transactions on Multimedia Computing, Communications and Applications, 2023. 1, 3

    2023

  21. [29]

    Facesigns: Semi-fragile neural watermarks for me- dia authentication and countering deepfakes

    Paarth Neekhara, Shehzeen Samarah Hussain, Xinqiao Zhang, Ke Huang, Julian McAuley, and Farinaz Koushan- far. Facesigns: Semi-fragile neural watermarks for me- dia authentication and countering deepfakes. ArXiv, abs/2204.01960, 2022. 1, 3, 8

    2022 arXiv

  22. [30]

    Use of a capsule network to detect fake images and videos

    Huy Hoang Nguyen, Junichi Yamagishi, and Isao Echizen. Use of a capsule network to detect fake images and videos. ArXiv, abs/1910.12467, 2019. 1

    1910 arXiv

  23. [31]

    Thinking in frequency: Face forgery detection by min- ing frequency-aware clues

    Yuyang Qian, Guojun Yin, Lu Sheng, Zixuan Chen, and Jing Shao. Thinking in frequency: Face forgery detection by min- ing frequency-aware clues. ArXiv, abs/2007.09355, 2020. 3

    2007 arXiv

  24. [32]

    Unsuper- vised representation learning with deep convolutional gen- erative adversarial networks

    Alec Radford, Luke Metz, and Soumith Chintala. Unsuper- vised representation learning with deep convolutional gen- erative adversarial networks. CoRR, abs/1511.06434, 2015. 5

    2015 arXiv

  25. [33]

    U-net: Convolutional networks for biomedical image segmentation

    Olaf Ronneberger, Philipp Fischer, and Thomas Brox. U-net: Convolutional networks for biomedical image segmentation. ArXiv, abs/1505.04597, 2015. 2, 5

    2015 arXiv

  26. [34]

    Detecting and grounding multi-modal media ma- nipulation and beyond

    Rui Shao, Tianxing Wu, Jianlong Wu, Liqiang Nie, and Zi- wei Liu. Detecting and grounding multi-modal media ma- nipulation and beyond. ArXiv, abs/2309.14203, 2023. 3

    2023 arXiv

  27. [35]

    Yamasaki

    Kaede Shiohara and T. Yamasaki. Detecting deepfakes with self-blended images. 2022 IEEE/CVF Conference on Com- puter Vision and Pattern Recognition (CVPR), pages 18699– 18708, 2022. 1, 3, 7, 9

    2022

  28. [36]

    Fake- tracer: Proactively defending against face-swap deepfakes via implanting traces in training

    Pu Sun, Honggang Qi, Yuezun Li, and Siwei Lyu. Fake- tracer: Proactively defending against face-swap deepfakes via implanting traces in training. ArXiv, abs/2307.14593,

    arXiv

  29. [37]

    Stegas- tamp: Invisible hyperlinks in physical photographs

    Matthew Tancik, Ben Mildenhall, and Ren Ng. Stegas- tamp: Invisible hyperlinks in physical photographs. 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 2114–2123, 2019. 7

    2020

  30. [38]

    Anti-forgery: Towards a stealthy and robust deepfake disruption attack via adversarial perceptual-aware perturbations

    Run Wang, Zi-Shun Huang, Zhikai Chen, Li Liu, Jing Chen, and Lina Wang. Anti-forgery: Towards a stealthy and robust deepfake disruption attack via adversarial perceptual-aware perturbations. In International Joint Conference on Artificial Intelligence, 2022. 1, 3, 8

    2022

  31. [39]

    Sheng-Yu Wang, Oliver Wang, Richard Zhang, Andrew Owens, and Alexei A. Efros. Cnn-generated images are sur- prisingly easy to spot. . . for now. 2020 IEEE/CVF Confer- ence on Computer Vision and Pattern Recognition (CVPR) , pages 8692–8701, 2019. 7, 9

    2020

  32. [40]

    Yang, Yuan Li, Huizhu Jia, and Xiaodong Xie

    Rui ya Ma, Mengxi Guo, Yi Hou, F. Yang, Yuan Li, Huizhu Jia, and Xiaodong Xie. Towards blind watermarking: Com- bining invertible and non-invertible mechanisms. Proceed- ings of the 30th ACM International Conference on Multime- dia, 2022. 8

    2022

  33. [41]

    Faceguard: Proactive deepfake detection

    Yuankun Yang, Chenyue Liang, Hongyu Hè, Xiaoyu Cao, and Neil Zhenqiang Gong. Faceguard: Proactive deepfake detection. ArXiv, abs/2109.05673, 2021. 1, 3

    2021 arXiv

  34. [42]

    Artificial fingerprinting for generative models: Root- ing deepfake attribution in training data

    Ning Yu, Vladislav Skripniuk, Sahar Abdelnabi, and Mario Fritz. Artificial fingerprinting for generative models: Root- ing deepfake attribution in training data. 2021 IEEE/CVF International Conference on Computer Vision (ICCV), pages 14428–14437, 2020. 1, 7, 8

    2021

  35. [43]

    Davis, and Mario Fritz

    Ning Yu, Vladislav Skripniuk, Dingfan Chen, Larry S. Davis, and Mario Fritz. Responsible disclosure of gen- erative models using scalable fingerprinting. ArXiv, abs/2012.08726, 2020. 1, 3

    2012 arXiv

  36. [44]

    Udh: Universal deep hiding for steganogra- phy, watermarking, and light field messaging

    Chaoning Zhang, Philipp Benz, Adil Karjauv, Geng Sun, and In-So Kweon. Udh: Universal deep hiding for steganogra- phy, watermarking, and light field messaging. In Neural In- formation Processing Systems, 2020. 8

    2020

  37. [45]

    Multi-attentional deep- fake detection

    Hanqing Zhao, Wenbo Zhou, Dongdong Chen, Tianyi Wei, Weiming Zhang, and Nenghai Yu. Multi-attentional deep- fake detection. 2021 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) , pages 2185–2194,

    2021

  38. [46]

    Learning self-consistency for deep- fake detection

    Tianchen Zhao, Xiang Xu, Mingze Xu, Hui Ding, Yuanjun Xiong, and Wei Xia. Learning self-consistency for deep- fake detection. 2021 IEEE/CVF International Conference on Computer Vision (ICCV), pages 15003–15013, 2020. 3

    2021

  39. [47]

    Proactive deepfake defence via identity water- 10 marking

    Yuan Zhao, Bo Liu, Ming Ding, Baoping Liu, Tianqing Zhu, and Xin Yu. Proactive deepfake defence via identity water- 10 marking. 2023 IEEE/CVF Winter Conference on Applica- tions of Computer Vision (WACV), pages 4591–4600, 2023. 1, 3

    2023

  40. [48]

    Hidden: Hiding data with deep networks

    Jiren Zhu, Russell Kaplan, Justin Johnson, and Li Fei-Fei. Hidden: Hiding data with deep networks. In European Con- ference on Computer Vision, 2018. 8

    2018

  41. [49]

    Jun-Yan Zhu, Taesung Park, Phillip Isola, and Alexei A. Efros. Unpaired image-to-image translation using cycle- consistent adversarial networks. 2017 IEEE International Conference on Computer Vision (ICCV), pages 2242–2251,

    2017

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.