Pith. sign in

REVIEW 4 major objections 8 minor 60 references

LampMark: Proactive Deepfake Detection via Training-Free Landmark Perceptual Watermarks

T0 review · 4 major / 8 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper claims that a training-free binary watermark derived from facial landmarks, embedded proactively and compared against the suspect image's own landmarks, detects both face-swapping and face-reenactment deepfakes without training…

desk verdict Genuinely new proactive watermarking idea with strong reported results, but the missing landmark extractor is a load-bearing gap that must be fixed before the numbers can be trusted. read the letter →

arxiv 2411.17209 v1 pith:AAFXSKYG submitted 2024-11-26 cs.CV

Tianyi Wang , Mengxiao Huang , Harry Cheng , Xiao Zhang , Zhiqi Shen This is my paper · ORCID
classification cs.CV
keywords deepfakedetectionproactivedefenserobustimagewatermarkingfaciallandmarkscellularautomatonencryptionfaceswappingreenactmentauto-encoder
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

LampMark is a proactive deepfake detector: it embeds an invisible watermark derived from facial landmarks into images before they can be manipulated, rather than hunting for artifacts left by generators. The paper's central claim is that deepfake manipulations, both face swapping and face reenactment, necessarily displace facial structures, while benign processing such as JPEG, noise, and blur does not. Detection is therefore a consistency check between the watermark recovered from a suspect image and a fresh landmark watermark computed from the suspect image's own landmarks: if the two disagree, the image has been structurally altered. The authors report average watermark recovery accuracies of 91.83% and 91.86% at 128 and 256 resolution on CelebA-HQ and 98.39% and 98.55% AUC on a mixed set of seven deepfake manipulations, even though the embedding network was trained only against JPEG and SimSwap.

What carries the argument

The load-bearing object is the landmark perceptual watermark, a fixed-length binary string produced by PCA projection of facial landmark coordinates (fit once on the CelebA-HQ corpus), followed by min-max normalization and a 0.5 threshold. It gives the framework three properties at once: discrimination, because landmark geometry separates benign from manipulated images; confidentiality, because cellular automaton Rule 30 with randomly selected XOR keys makes the mapping from image to watermark unpredictable to attackers; and robustness, because an auto-encoder trained adversarially with a discriminator and a benign-operation pool embeds the string imperceptibly and recovers it after distortion. The detection rule itself is a bit-wise matching rate between the recovered watermark and the landmark watermark recomputed from the suspect image, which serves as a content-matched reference for what the watermark would be if the image had never been structurally edited.

What would settle it

Recompute the landmark-offset statistics that motivate the method (Figure 1) using the actual landmark detector the framework deploys, on watermarked images: if heavy JPEG or mild blur produces landmark displacements overlapping the deepfake range, the consistency check cannot separate real from fake. Conversely, if a reenactment that preserves keypoint positions still triggers detection, the claimed structural invariant is not what drives the result.

Watch

Extended reading notes

Core claim

Deepfake generation, whether it swaps a source identity onto a target (SimSwap, InfoSwap, UniFace, E4S) or reenacts expression and pose (StarGAN, StyleMask, HyperReenact), changes the geometry of facial landmarks far more than any benign image operation does. LampMark converts this structural sensitivity into a practical defense. A training-free pipeline fits PCA on a landmark corpus, projects each face's landmarks into a short coordinate vector, normalizes it, and thresholds at 0.5 to obtain a binary landmark perceptual watermark; a cellular automaton using Rule 30 XOR-encrypts the string so that attackers cannot forge a content-matched replacement. An end-to-end auto-encoder with convolutional attention embeds and recovers the watermark, and detection is declared by the bit-wise matching rate between the recovered watermark and the landmark watermark of the suspect image. The paper demonstrates across in-dataset, cross-dataset, and cross-manipulation settings that this single watermarking framework performs consistently, with all detection AUC scores above 95% on individual manipulations.

Load-bearing premise

The approach depends on being able to reliably find the same facial keypoints in both watermarked originals and deepfake-altered faces, and the paper never names the landmark detector or checks how it behaves on synthetic faces.

Editorial extensions

If this is right

  • One watermarking framework can flag both face-swap and face-reenactment deepfakes, the two dominant manipulation categories, without being trained on the specific generator.
  • Detection transfers to unseen manipulations and unseen datasets, since it keys on structural change rather than generator-specific visual artifacts.
  • Benign image processing such as JPEG, noise, blur, brightness, and hue changes does not trigger the detector, because landmarks and the embedded watermark both survive those operations.
  • An attacker who does not know the cellular-automaton key cannot replace the watermark with a content-matched forgery, so the consistency signal stays trustworthy.
  • Images are protected proactively at publication time, before any deepfake of them exists, which is a different guarantee from passive detectors that only work after a fake appears.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A fair benchmark for this method should pin down the landmark detector, which the paper leaves unnamed, and test whether its keypoints on synthetic faces are stable enough for the consistency check to separate benign from manipulated images.
  • The method's own logic implies that a generator trained to preserve keypoint positions, or a swap that reuses the target face's landmarks, would evade detection; testing that boundary would map the method's real coverage.
  • The same structure-sensitive watermark idea could be carried to video deepfakes by watermarking each frame's landmarks, or to other object classes with reliable keypoint extractors.
  • Combining LampMark with a passive detector could arbitrate borderline matching rates: the proactive consistency score gives a strong prior, and the passive artifact score decides when the two watermarks disagree narrowly.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 8 minor

Summary. LampMark is a proactive deepfake detector that embeds a binary watermark derived from facial landmarks into face images. The watermark is constructed without supervised training: landmark coordinates are flattened to vectors of length 2d_lm, projected with PCA (fit on a CelebA-HQ corpus), min-max normalized, binarized, and then XOR-encrypted with keys generated by a Rule-30 cellular automaton. An auto-encoder is trained end-to-end to embed and recover the watermark, using JPEG compression and SimSwap as the only adversarial distortions during training. At detection time, the decoder recovers the embedded watermark m_rec from the suspect image, and a fresh watermark m_sus is computed from the suspect image's landmarks via the same pipeline; a low bit-wise matching rate between m_rec and m_sus is taken as evidence of the structural change caused by Deepfake manipulation, while benign processing leaves the matching rate high. Experiments on CelebA-HQ at 128 and 256 resolutions and on LFW evaluate visual quality (PSNR/SSIM), bit-wise watermark recovery under four benign and seven Deepfake manipulations, and Deepfake detection AUC against four passive detectors, reporting state-of-the-art results (e.g., 98.39% and 98.55% AUC on a mixed set of seven manipulations, and average recovery accuracies of 87.23% and 87.21% under Deepfake manipulations).

Significance. The paper's central idea is attractive and, if the experiments are taken at face value, effective: unlike a trained passive detector, the detection rule is a content-consistency check between a recovered watermark and a landmark-derived watermark of the suspect image, so the approach is not circular in the way a fitted real-vs-fake classifier would be; the only supervised component (the auto-encoder) is trained for watermark recovery rather than for the detection decision, and the PCA projection is fit on unlabeled landmarks. The empirical scope is genuinely broad: seven Deepfake manipulation models of which six are unseen at training time, two resolutions, a cross-dataset transfer test (LFW), a benign-manipulation robustness pool that the appendix extends to twelve operations, and comparisons against six watermarking and four passive baselines. The reported numbers are strong (state-of-the-art PSNR/SSIM of 44.75/0.992 at 128, about 87% average recovery under Deepfake manipulations, and 98.39% mixed AUC), and the authors frankly acknowledge the weak spot of their scheme, the lower watermark recovery under face reenactment.

major comments (4)
  1. [§3.2.1, §4.2.3; Figures 1 and 6; Table 6] The method is built on a facial landmark extractor that is never identified. The detection rule in §4.2.3 computes m_sus = G_m(landmarks(I_sus)) and compares it with the recovered watermark m_rec, and the motivating structure-sensitivity statistics in Figure 1, Figure 6, and Table 6 are produced by the same unnamed detector; yet the paper states neither the detector nor the number of landmarks d_lm, nor the face detection/alignment steps that precede landmark extraction. If the detector's outputs on reenacted faces (which the paper itself notes erase or replace background content) or on watermarked images are noisy or biased, m_sus would not faithfully encode the true structural changes and the benign/fake matching-rate separation could collapse. This is load-bearing because even a perfect watermark embedder and decoder cannot detect if the landmark-derived code is unreliable; it also blocks adversarial analysis, since an attacker who knows the extractor could target its failure modes. Please specify the complete landmark-extraction pipeline (detection, alignment, detector identity, d_lm), validate its localization on clean, watermarked, and manipulated faces, and include an ablation with at least one alternative landmark detector to show that detection AUC is insensitive to that choice.
  2. [§4.1 and Eq. (4)] The PCA projection matrix W and the min-max bounds in Eq. (4) are fit on 'CelebA-HQ ... as the data corpus' (§4.1), while the same dataset supplies the test split; the paper does not state whether the corpus includes the test images. If it does, the 'training-free' watermark construction is subtly adapted to the test landmark distribution, which would flatter the in-dataset numbers and leave the LFW cross-dataset experiment as the only clean test. Please state explicitly that W and the normalization bounds are computed from the training (or validation) split only, and report the corpus size and composition.
  3. [§4.2, Table 4] The comparison against the four passive detectors in Table 4 is not interpretable without their training protocol. The paper says only that 'algorithms with source code available are reproduced in all experiments' (§4.2), which leaves open whether Xception, SBIs, RECCE, and CADDM were trained on the same CelebA-HQ splits, on watermarked or raw images, with the same seven manipulations, or evaluated with pre-trained public weights. The reported values (e.g., Xception at 39.37% AUC on SimSwap at 128) are far below the typical within-dataset performance of these models, so the reader cannot tell whether the comparison is fair or whether the baselines are operating out-of-domain. Please specify the exact training and evaluation protocol for each passive baseline, including which images (raw vs. watermarked) were used for training and testing.
  4. [§3.4 and §4.1] The watermarking framework cannot be reproduced from the paper: the four objectives in §3.4 are never combined with explicit weights (no λ values are given), and §4.1 omits the batch size, number of iterations, optimizer details, discriminator architecture, and the layer counts and channel dimensions of the encoder and decoder. Since the paper's evidence is entirely experimental, these omissions block independent verification of the central claim. Please provide the complete training configuration and architecture details, or release the code.
minor comments (8)
  1. [§3.2.2, Eq. (6) and Eq. (13)] In the boundary case i = l-1, Eq. (6) (and its duplicated Eq. (13)) uses the undefined index s^t_l and appears to drop the central bit s^t_{l-1} from the update; please correct the recurrence and state the boundary condition (e.g., periodic) explicitly.
  2. [§4.3] The text reports an average recovery accuracy of 89.73% on LFW, which matches neither the benign average (99.95%) nor the Deepfake average (83.73%) given in Table 5; please correct this inconsistency.
  3. [Abstract and Table 3] The abstract's averages of 91.83% and 91.86% appear to be computed over all eleven manipulations (four benign plus seven Deepfake), whereas Table 3 reports 87.23% and 87.21% for the seven Deepfake manipulations alone; please state the averaging convention in both places.
  4. [§4.2.3] Since the detection rule is defined by the bit-wise matching rate between m_sus and m_rec, the paper should report the actual matching-rate distributions (e.g., mean ± std per manipulation) rather than only AUC, which would also reveal the separation margin for reenactment manipulations whose recovery accuracy is only about 74%.
  5. [§3.2.2 and Appendix C] The confidentiality claim is supported only by the non-repetition of Rule-30 keys; the paper neither states the threat model (which pipeline components are public versus secret) nor includes any attack experiment (e.g., watermark removal or replacement), so the practical security level of the 'confidentiality' contribution is uncharacterized.
  6. [Table 5; §4.2.3; §3.2.1] Table 5's caption lists 'Hidden [56]' where HiDDeN [56] is meant; the abbreviation 'RDA' is never defined; Xception is cited as [31] in §4.2.3 but [48] in Table 4; and 'principle component analysis' in §3.2.1 should be 'principal component analysis.'
  7. [§4.1] The paper contains no code availability statement, which is particularly consequential given the missing implementation details noted above.
  8. [§4.2] The watermark length l (64 and 128) and the fixed binarization threshold of 0.5 are neither justified nor tested for sensitivity; a brief analysis of detection AUC as a function of l and of the threshold would clarify the capacity-robustness trade-off.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: the detection rule is a content-consistency check between a robustly recovered landmark watermark and a landmark watermark recomputed from the suspect image; no fitted parameter is relabeled as a prediction.

full rationale

The derivation chain is self-contained. The landmark-to-watermark map G_m is unsupervised: PCA is fit to unlabeled landmark coordinates (Eqs. 1-4) and is not trained on deepfake/benign labels. The auto-encoder is trained to embed and recover the binary watermark via L_m = ||m_rec - m||_2 (Eq. 9), not to predict manipulation labels. Detection in Section 4.2.3 compares m_rec (which carries the original landmark structure through robust watermark recovery) with m_sus = G_m(landmarks(I_sus)), so the separation between benign and manipulated images is inherited from the independent landmark-offset statistics in Figure 1 and Table 6, not from the detector's own fitted outputs. The prior identity-watermark paper [38] is cited as related work only and is not load-bearing; no uniqueness theorem or fitted parameter is imported. The main unaddressed weakness is that the landmark extractor is never specified in Section 3.2.1, which is a reproducibility/generalization risk for the empirical premise, but it is not a circularity. No equation in the paper reduces by construction to its own input, so the circularity score is minimal.

Assumptions & free parameters 5 free parameters · 4 assumptions · 0 invented entities

The central claim rests on a fixed landmark-to-watermark transform (PCA + threshold) plus a trained auto-encoder. Most free parameters are hand-set without sensitivity analysis, and the PCA corpus split is ambiguous. No new physical entities are introduced.

free parameters (5)
  • Number of principal components / watermark length l = 64 at 128x128, 128 at 256x256
    Chosen by hand, not justified; directly controls the watermark capacity and the amount of landmark information retained. Table 1 lists the values.
  • Binarization threshold = 0.5
    Applied to normalized PCA features; arbitrary, no sensitivity analysis is provided.
  • Cellular automaton key count p and iteration count n = Not specified
    The encryption selects p keys from n iterations; both are hand-set hyperparameters. The paper only states 0 < p <= n+1.
  • Loss weights for L_I, L_m, L_adv, L_G = Not disclosed
    The objective function has four terms with implicit weights; the paper never reports the weight values, so they are free parameters tuned for training.
  • PCA projection matrix W = Top-l eigenvectors of CelebA-HQ landmark covariance
    Fit on the CelebA-HQ corpus; if the corpus includes test images, this is data leakage. The paper is ambiguous about whether the split is respected (Section 4.1).
assumptions (4)
  • domain assumption The same facial landmark detector produces accurate landmark positions on clean watermarked images and on Deepfake-manipulated images.
    The entire pipeline builds watermarks from landmarks and compares suspect-image landmarks to recovered watermarks; if landmark extraction is unreliable on synthetic faces, the matching-rate separation collapses. The paper does not specify which landmark detector is used or how it performs on manipulated faces (Section 3.2, Figure 1).
  • domain assumption Deepfake manipulations in the face-swapping and face-reenactment categories always cause landmark offsets large enough to separate them from benign manipulations.
    This structure-sensitive property is the motivation for the method, demonstrated empirically on 10K CelebA-HQ images in Figure 1 and Table 6. The method would fail on manipulations that preserve landmark positions (e.g., texture-only edits), which are outside the paper's scope but not explicitly delimited.
  • domain assumption The learned auto-encoder's watermark extraction generalizes from training on Jpeg(50) and SimSwap to unseen benign and deepfake manipulations.
    The robustness of the embedded watermark to unseen manipulations is the key enabler of detection. The paper reports cross-manipulation results, but the generalization is not theoretically guaranteed and depends on the distribution shift being small (Section 3.3, Section 4.2.2).
  • standard math PCA computed on the CelebA-HQ landmark corpus preserves the discrimination between benign and Deepfake manipulations after projecting to l dimensions and thresholding at 0.5.
    PCA is a standard linear transform, but the specific choice of l (64/128) and threshold 0.5 are not derived or justified. The assumption that these choices retain enough structure for separation underlies all watermarks (Section 3.2.1).

how reviews work

0 comments
Cite this review

Pith. "Pith review of LampMark: Proactive Deepfake Detection via Training-Free Landmark Perceptual Watermarks." pith.science (2026). https://pith.science/paper/AAFXSKYG

@misc{pith2026241117209,
  author       = {Pith},
  title        = {Pith review of: LampMark: Proactive Deepfake Detection via Training-Free Landmark Perceptual Watermarks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/AAFXSKYG}},
  note         = {Machine review of arXiv:2411.17209}
}
read the original abstract

Deepfake facial manipulation has garnered significant public attention due to its impacts on enhancing human experiences and posing privacy threats. Despite numerous passive algorithms that have been attempted to thwart malicious Deepfake attacks, they mostly struggle with the generalizability challenge when confronted with hyper-realistic synthetic facial images. To tackle the problem, this paper proposes a proactive Deepfake detection approach by introducing a novel training-free landmark perceptual watermark, LampMark for short. We first analyze the structure-sensitive characteristics of Deepfake manipulations and devise a secure and confidential transformation pipeline from the structural representations, i.e. facial landmarks, to binary landmark perceptual watermarks. Subsequently, we present an end-to-end watermarking framework that imperceptibly and robustly embeds and extracts watermarks concerning the images to be protected. Relying on promising watermark recovery accuracies, Deepfake detection is accomplished by assessing the consistency between the content-matched landmark perceptual watermark and the robustly recovered watermark of the suspect image. Experimental results demonstrate the superior performance of our approach in watermark recovery and Deepfake detection compared to state-of-the-art methods across in-dataset, cross-dataset, and cross-manipulation scenarios.

Figures

Figures reproduced from arXiv: 2411.17209 by the authors.

Figure 1
Figure 1. Demonstration of the structure-sensitive charac [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Overall framework of the proposed method. The landmark perceptual watermarks are produced via pipeline [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Visual effects of the manipulations on the watermarked images. The raw and watermarked images are displayed in the [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (4 more)
Figure 4
Figure 4. Figure 4: Visualizations of the effects for each benign manip [PITH_FULL_IMAGE:figures/full_fig_p010_4.png]
Figure 5
Figure 5. Figure 5: Visualization of the binary key values from time [PITH_FULL_IMAGE:figures/full_fig_p010_5.png]
Figure 6
Figure 6. Figure 6: Full demonstration of the structure-sensitive characteristic of Deepfake manipulations regarding facial landmarks. [PITH_FULL_IMAGE:figures/full_fig_p011_6.png]
Figure 7
Figure 7. Figure 7: Visualization of the binary key values in white and [PITH_FULL_IMAGE:figures/full_fig_p012_7.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

60 extracted references · 50 canonical work pages

  1. [1]

    Darius Afchar, Vincent Nozick, Junichi Yamagishi, and Isao Echizen. 2018. MesoNet: a Compact Facial Video Forgery Detection Network. 2018 IEEE Inter- national Workshop on Information Forensics and Security , 1–7

    work page 2018

  2. [2]

    Bounareli, C

    S. Bounareli, C. Tzelepis, V. Argyriou, I. Patras, and G. Tzimiropoulos. 2023. HyperReenact: One-Shot Reenactment via Jointly Learning to Refine and Retarget Faces. In Proceedings of the IEEE/CVF International Conference on Computer Vision . 7115–7125

    work page 2023

  3. [3]

    Bounareli, C

    S. Bounareli, C. Tzelepis, V. Argyriou, I. Patras, and G. Tzimiropoulos. 2023. StyleMask: Disentangling the Style Space of StyleGAN2 for Neural Face Reenact- ment. In 2023 IEEE 17th International Conference on Automatic Face and Gesture Recognition. 1–8

    work page 2023

  4. [4]

    Junyi Cao, Chao Ma, Taiping Yao, Shen Chen, Shouhong Ding, and Xiaokang Yang. 2022. End-to-End Reconstruction-Classification Learning for Face Forgery Detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 4113–4122

    work page 2022

  5. [5]

    Liang Chen, Yong Zhang, Yibing Song, Lingqiao Liu, and Jue Wang. 2022. Self- supervised Learning of Adversarial Examples: Towards Good Generalizations for DeepFake Detections. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition

    work page 2022

  6. [6]

    Renwang Chen, Xuanhong Chen, Bingbing Ni, and Yanhao Ge. 2020. SimSwap: An Efficient Framework For High Fidelity Face Swapping. In Proceedings of the 28th ACM International Conference on Multimedia . 2003–2011

    work page 2020

  7. [7]

    Yunjey Choi, Youngjung Uh, Jaejun Yoo, and Jung-Woo Ha. 2020. StarGAN v2: Diverse Image Synthesis for Multiple Domains. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition . 8185–8194

    work page 2020

  8. [8]

    Shichao Dong, Jin Wang, Renhe Ji, Jiajun Liang, Haoqiang Fan, and Zheng Ge

Show all 60 references
  1. [9]

    Gege Gao, Huaibo Huang, Chaoyou Fu, Zhaoyang Li, and Ran He. 2021. Infor- mation Bottleneck Disentanglement for Identity Swapping. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition . 3403–3412

    2021

  2. [10]

    Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. 2014. Generative Adversarial Nets. In Advances in Neural Information Processing Systems , Vol. 27

    2014

  3. [11]

    Gee-Sern Hsu, Chun-Hung Tsai, and Hung-Yi Wu. 2022. Dual-Generator Face Reenactment. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 632–640

    2022

  4. [12]

    Jie Hu, Li Shen, and Gang Sun. 2018. Squeeze-and-Excitation Networks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 7132–7141

    2018

  5. [13]

    Huang, Marwan Mattar, Honglak Lee, and Erik Learned-Miller

    Gary B. Huang, Marwan Mattar, Honglak Lee, and Erik Learned-Miller. 2012. Learning to Align from Scratch. In Advances in Neural Information Processing Systems

    2012

  6. [14]

    Hao Huang, Yongtao Wang, Zhaoyu Chen, Yuze Zhang, Yuheng Li, Zhi Tang, Wei Chu, Jingdong Chen, Weisi Lin, and Kai-Kuang Ma. 2022. CMUA-Watermark: A Cross-Model Universal Adversarial Watermark for Combating Deepfakes. Proceedings of the AAAI Conference on Artificial Intelligenc...

    2022

  7. [15]

    Jiangtao Huang, Ting Luo, Li Li, Gaobo Yang, Haiyong Xu, and Chin-Chen Chang

  8. [16]

    Qidong Huang, Jie Zhang, Wenbo Zhou, Weiming Zhang, and Nenghai Yu. 2021. Initiative Defense against Facial Manipulation.Proceedings of the AAAI Conference on Artificial Intelligence 35, 2, 1619–1627

    2021

  9. [17]

    IEEE Transactions on Instrumentation and Measurement 72, 1–17

    ARWGAN: Attention-Guided Robust Image Watermarking Model Based on GAN. IEEE Transactions on Instrumentation and Measurement 72, 1–17

  10. [18]

    Tero Karras, Timo Aila, Samuli Laine, and Jaakko Lehtinen. 2018. Progressive Growing of GANs for Improved Quality, Stability, and Variation. InInternational Conference on Learning Representations

    2018

  11. [19]

    Zhaoyang Jia, Han Fang, and Weiming Zhang. 2021. MBRS: Enhancing Ro- bustness of DNN-based Watermarking by Mini-Batch of Real and Simulated JPEG Compression. In Proceedings of the 29th ACM International Conference on Multimedia. 41–49

    2021

  12. [20]

    Lingzhi Li, Jianmin Bao, Hao Yang, Dong Chen, and Fang Wen. 2020. Advancing High Fidelity Identity Swapping for Forgery Detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition . 5073–5082

    2020

  13. [21]

    Iryna Korshunova, Wenzhe Shi, Joni Dambre, and Lucas Theis. 2017. Fast Face- Swap Using Convolutional Neural Networks. In 2017 IEEE International Confer- ence on Computer Vision . 3697–3705

    2017

  14. [22]

    Jiahao Liang, Huafeng Shi, and Weihong Deng. 2022. Exploring Disentangled Content Information for Face Forgery Detection. In European Conference on Computer Vision. 128–145

    2022

  15. [23]

    Yuezun Li and Siwei Lyu. 2019. Exposing DeepFake Videos By Detecting Face Warping Artifacts. In IEEE Conference on Computer Vision and Pattern Recognition Workshops

    2019

  16. [24]

    Yuchen Luo, Yong Zhang, Junchi Yan, and Wei Liu. 2021. Generalizing Face Forgery Detection With High-Frequency Features. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition . 16317–16326

    2021

  17. [25]

    Z. Liu, M. Li, Y. Zhang, C. Wang, Q. Zhang, J. Wang, and Y. Nie. 2023. Fine-Grained Face Swapping Via Regional GAN Inversion. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition . 8578–8587

    2023

  18. [26]

    Paarth Neekhara, Shehzeen Hussain, Xinqiao Zhang, Ke Huang, Julian McAuley, and Farinaz Koushanfar. 2022. FaceSigns: Semi-Fragile Neural Watermarks for Me- dia Authentication and Countering Deepfakes. arXiv preprint arXiv:2204.01960

    2022 arXiv

  19. [27]

    Rui Ma, Mengxi Guo, Yi Hou, Fan Yang, Yuan Li, Huizhu Jia, and Xiaodong Xie

  20. [28]

    Yuval Nirkin, Lior Wolf, Yosi Keller, and Tal Hassner. 2022. DeepFake Detection Based on Discrepancies Between Faces and Their Context. IEEE Transactions on Pattern Analysis and Machine Intelligence 44, 10, 6111–6121

    2022

  21. [29]

    Dpfks, Carl Shift Facenheim, Luis RP, Jian Jiang, Sheng Zhang, Pingyu Wu, Bo Zhou, and Weiming Zhang

    Ivan Perov, Daiheng Gao, Nikolay Chervoniy, Kunlin Liu, Sugasa Marangonda, Chris Umé, Mr. Dpfks, Carl Shift Facenheim, Luis RP, Jian Jiang, Sheng Zhang, Pingyu Wu, Bo Zhou, and Weiming Zhang. 2021. DeepFaceLab: Integrated, flexible and extensible face-swapping framework.arXiv ...

    2021 arXiv

  22. [30]

    Yuval Nirkin, Yosi Keller, and Tal Hassner. 2019. FSGAN: Subject Agnostic Face Swapping and Reenactment. In Proceedings of the IEEE/CVF International Conference on Computer Vision . 7183–7192

    2019

  23. [31]

    Andreas Rössler, Davide Cozzolino, Luisa Verdoliva, Christian Riess, Justus Thies, and Matthias Niessner. 2019. FaceForensics++: Learning to Detect Manipulated Facial Images. InProceedings of the IEEE/CVF International Conference on Computer Vision. 1–11

    2019

  24. [32]

    Kaede Shiohara and Toshihiko Yamasaki. 2022. Detecting Deepfakes With Self- Blended Images. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 18720–18729

    2022

  25. [33]

    Nataniel Ruiz, Sarah Adel Bargal, and Stan Sclaroff. 2020. Disrupting Deepfakes: Adversarial Attacks Against Conditional Image Translation Networks and Facial Manipulation Systems. In European Conference on Computer Vision Workshop . 236–251

    2020

  26. [34]

    John Von Neumann. 1951. The General and Logical Theory of Automata . John Wiley & Sons Inc., 1–31

    1951

  27. [35]

    Run Wang, Ziheng Huang, Zhikai Chen, Li Liu, Jing Chen, and Lina Wang. 2022. Anti-Forgery: Towards a Stealthy and Robust DeepFake Disruption Attack via Adversarial Perceptual-aware Perturbations. In International Joint Conference on Artificial Intelligence. 761–767

    2022

  28. [36]

    Ke Sun, Taiping Yao, Shen Chen, Shouhong Ding, Jilin Li, and Rongrong Ji. 2022. Dual Contrastive Learning for General Face Forgery Detection. Proceedings of the AAAI Conference on Artificial Intelligence 36, 2, 2316–2324

    2022

  29. [37]

    Tianyi Wang and Kam Pui Chow. 2023. Noise Based Deepfake Detection via Multi-Head Relative-Interaction. Proceedings of the AAAI Conference on Artificial Intelligence

    2023

  30. [38]

    Tianyi Wang, Mengxiao Huang, Harry Cheng, Bin Ma, and Yinglong Wang. 2024. Robust Identity Perceptual Watermark Against Deepfake Face Swapping. arXiv preprint arXiv:2311.01357

    2024

  31. [39]

    Tianyi Wang, Harry Cheng, Kam Pui Chow, and Liqiang Nie. 2023. Deep Con- volutional Pooling Transformer for Deepfake Detection. ACM Transactions on Multimedia Computing, Communications, and Applications 19, 6

    2023

  32. [40]

    Tianyi Wang, Xin Liao, Kam Pui Chow, Xiaodong Lin, and Yinglong Wang. 2023. Deepfake Detection: A Comprehensive Study from the Reliability Perspective. arXiv preprint arXiv:2211.10881

    2023 arXiv

  33. [41]

    Xueyu Wang, Jiajun Huang, Siqi Ma, Surya Nepal, and Chang Xu. 2022. DeepFake Disrupter: The Detector of DeepFake Is My Friend. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition . 14920–14929

    2022

  34. [42]

    Tianyi Wang, Zian Li, Ruixia Liu, Yinglong Wang, and Liqiang Nie. 2024. An Efficient Attribute-Preserving Framework for Face Swapping. IEEE Transactions on Multimedia, 1–13

    2024

  35. [43]

    Stephen Wolfram. 1984. Cellular Automata as Models of Complexity. Nature 311, 5985 (1984), 419–424

    1984

  36. [44]

    Stephen Wolfram. 2002. A New Kind of Science . Wolfram Media, Inc

    2002

  37. [45]

    Stephen Wolfram. 1983. Statistical Mechanics of Cellular Automata. Reviews of Modern Physics 55, 3 (1983), 601

    1983

  38. [46]

    Xiaoshuai Wu, Xin Liao, and Bo Ou. 2023. SepMark: Deep Separable Watermark- ing for Unified Source Tracing and Deepfake Detection. In Proceedings of the 31st ACM International Conference on Multimedia

    2023

  39. [47]

    Chao Xu, Jiangning Zhang, Yue Han, Guanzhong Tian, Xianfang Zeng, Ying Tai, Yabiao Wang, Chengjie Wang, and Yong Liu. 2022. Designing One Unified Framework for High-Fidelity Face Reenactment and Swapping. In European MM ’24, October 28-November 1, 2024, Melbourne, VIC, Austral...

    2022

  40. [48]

    Wayne Wu, Yunxuan Zhang, Cheng Li, Chen Qian, and Chen Change Loy. 2018. ReenactGAN: Learning to Reenact Faces via Boundary Transfer. In European Conference on Computer Vision . 622–638

    2018

  41. [49]

    Kewei Yang, Kang Chen, Daoliang Guo, Song-Hai Zhang, Yuan-Chen Guo, and Weidong Zhang. 2022. Face2Face𝜌 : Real-Time High-Resolution One-Shot Face Reenactment. In European Conference on Computer Vision . 55–71

    2022

  42. [50]

    Yuankun Yang, Chenyue Liang, Hongyu He, Xiaoyu Cao, and Neil Zhen- qiang Gong. 2021. FaceGuard: Proactive Deepfake Detection. arXiv preprint arXiv:2109.05673

    2021 arXiv

  43. [51]

    Zhiyuan Yan, Yong Zhang, Xinhang Yuan, Siwei Lyu, and Baoyuan Wu. 2023. DeepfakeBench: A Comprehensive Benchmark of Deepfake Detection. In Ad- vances in Neural Information Processing Systems , Vol. 36. 4534–4565

    2023

  44. [52]

    Jiangning Zhang, Xianfang Zeng, Mengmeng Wang, Yusu Pan, Liang Liu, Yong Liu, Yu Ding, and Changjie Fan. 2020. FReeNet: Multi-Identity Face Reenact- ment. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 5325–5334

    2020

  45. [53]

    Hanqing Zhao, Wenbo Zhou, Dongdong Chen, Tianyi Wei, Weiming Zhang, and Nenghai Yu. 2021. Multi-Attentional Deepfake Detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition . 2185–2194

    2021

  46. [54]

    N. Yu, V. Skripniuk, S. Abdelnabi, and M. Fritz. 2021. Artificial Fingerprinting for Generative Models: Rooting Deepfake Attribution in Training Data. InProceedings of the IEEE/CVF International Conference on Computer Vision . 14428–14437

    2021

  47. [55]

    Morariu, and Larry S

    Peng Zhou, Xintong Han, Vlad I. Morariu, and Larry S. Davis. 2017. Two-Stream Neural Networks for Tampered Face Detection. In 2017 IEEE Conference on Com- puter Vision and Pattern Recognition Workshops . 1831–1839

    2017

  48. [56]

    Jiren Zhu, Russell Kaplan, Justin Johnson, and Li Fei-Fei. 2018. HiDDeN: Hiding Data With Deep Networks. In European Conference on Computer Vision. 682–697

    2018

  49. [57]

    T. Zhao, X. Xu, M. Xu, H. Ding, Y. Xiong, and W. Xia. 2021. Learning Self- Consistency for Deepfake Detection. In Proceedings of the IEEE/CVF International Conference on Computer Vision . 15003–15013

    2021

  50. [60]

    Yao Zhu, Yuefeng Chen, Xiaodan Li, Rong Zhang, Xiang Tian, Bolun Zheng, and Yaowu Chen. 2023. Information-Containing Adversarial Perturbation for Com- bating Facial Manipulation Systems. IEEE Transactions on Information Forensics and Security 18, 2046–2059. A Detailed Statisti...

    2023

  51. [2022]

    In Proceedings of the 30th ACM International Conference on Multi- media

    Towards Blind Watermarking: Combining Invertible and Non-invertible Mechanisms. In Proceedings of the 30th ACM International Conference on Multi- media. 1532–1542

  52. [2023]

    In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition

    Implicit Identity Leakage: The Stumbling Block to Improving Deepfake Detection Generalization. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition . 3994–4004

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.