RecoverMark: Robust Watermarking for Localization and Recovery of Manipulated Faces

Haonan An; Xiaohui Ye; Guang Hua; Yihang Tao; Hangcheng Cao; Xiangyu Yu; Yuguang Fang

cs.CVFeb 24, 2026

RecoverMark: Robust Watermarking for Localization and Recovery of Manipulated Faces

Authors: Haonan An, Xiaohui Ye, Guang Hua, Yihang Tao, Hangcheng Cao, Xiangyu Yu, Yuguang Fang

Organizations: City University of Hong Kong, Hong Kong · South China University of Technology · Singapore Institute of Technology, Singapore 828608

Abstract

The proliferation of AI-generated content has facilitated sophisticated face manipulation, severely undermining visual integrity and posing unprecedented challenges to intellectual property. In response, a common proactive defense leverages fragile watermarks to detect, localize, or even recover manipulated regions. However, these methods always assume an adversary unaware of the embedded watermark, overlooking their inherent vulnerability to watermark removal attacks. Furthermore, this fragility is exacerbated in the commonly used dual-watermark strategy that adds a robust watermark for image ownership verification, where mutual interference and limited embedding capacity reduce the fragile watermark's effectiveness. To address the gap, we propose RecoverMark, a watermarking framework that achieves robust manipulation localization, content recovery, and ownership verification simultaneously. Our key insight is twofold. First, we exploit a critical real-world constraint: an adversary must preserve the background's semantic consistency to avoid visual detection, even if they apply global, imperceptible watermark removal attacks. Second, using the image's own content (face, in this paper) as the watermark enhances extraction robustness. Based on these insights, RecoverMark treats the protected face content itself as the watermark and embeds it into the surrounding background. By designing a robust two-stage training paradigm with carefully crafted distortion layers that simulate comprehensive potential attacks and a progressive training strategy, RecoverMark achieves a robust watermark embedding in no fragile manner for image manipulation localization, recovery, and image IP protection simultaneously. Extensive experiments demonstrate the proposed RecoverMark's robustness against both seen and unseen attacks and its generalizability to in-distribution and out-of-distribution data.

Figures & tables

Figure 2: A practical example when a judge determines whether the evidence is credible based on background consistency.

Figure 3: Flowchart of the training process for the proposed RecoverMark, where MTCNN [ 47 ] is used as segmentation model, and the watermark encoder/decoder are trained in Stage $1$ but remain frozen during Stage $2$ .

Figure 4: Demonstration of manipulation localization, recovery, and ownership verification for a suspicious image.

Figure 5: Demonstration of RecoverMark’s robustness against a range of attacks (from single to multiple), including the unseen lattice attack [ 21 ] , arranged from top to bottom and left to right..

Panel of Figure 6 — Figure 6: Empirical watermark capacity evaluated by the fidelity of recovered saliency and watermarked background at varying saliency-to-image percentages, measured under regeneration attack.

Method		Localization
		Regeneration		Patch Remove		Noise		JPEG		LP Filter		Lattice [ 21 ]
		F1	AUC	F1	AUC	F1	AUC	F1	AUC	F1	AUC	F1	AUC
Passive	MVSS-Net [ 6 ]	0.041	0.723	0.025	0.685	0.062	0.711	0.157	0.776	0.184	0.755	0.034	0.719
Passive	HiFiNet [ 9 ]	0.048	0.522	0.020	0.531	0.022	0.553	0.080	0.608	0.067	0.552	0.051	0.556
Proactive	Imuge+ [ 44 ]	0.091	0.587	0.217	0.835	0.016	0.639	0.419	0.956	0.087	0.530	0.010	0.585
	EditGuard [ 52 ]	0.090	0.610	0.243	0.888	0.528	0.932	0.552	0.954	0.090	0.658	0.438	0.930

Table 1: Quantitative comparison on the ID dataset (CelebA [ 22 ] ) under Structpix2pix [ 4 ] manipulation.

Method		Localization
		Regeneration		Patch Remove		Noise		JPEG		LP Filter		Lattice [ 21 ]
		F1	AUC	F1	AUC	F1	AUC	F1	AUC	F1	AUC	F1	AUC
Passive	MVSS-Net [ 6 ]	0.257	0.810	0.245	0.786	0.139	0.750	0.213	0.776	0.280	0.726	0.050	0.700
Passive	HiFiNet [ 9 ]	0.058	0.635	0.041	0.621	0.002	0.544	0.050	0.607	0.091	0.695	0.031	0.625
Proactive	Imuge+ [ 44 ]	0.195	0.782	0.442	0.915	0.012	0.655	0.983	0.862	0.186	0.628	0.034	0.546
	EditGuard [ 52 ]	0.176	0.580	0.434	0.970	0.792	0.990	0.835	0.995	0.176	0.580	0.704	0.989

Table 2: Quantitative comparison on the ID dataset (CelebA [ 22 ] ) under Stable Diffusion [ 30 ] Inpaint manipulation.

Method		Localization
		Regeneration		Patch Remove		Noise		JPEG		LP Filter		Lattice [ 21 ]
		F1	AUC	F1	AUC	F1	AUC	F1	AUC	F1	AUC	F1	AUC
Passive	MVSS-Net [ 6 ]	0.076	0.686	0.042	0.668	0.049	0.678	0.171	0.776	0.241	0.803	0.028	0.652
Passive	HiFiNet [ 9 ]	0.059	0.511	0.003	0.512	0.025	0.526	0.063	0.537	0.024	0.503	0.050	0.561
Proactive	Imuge+ [ 44 ]	0.081	0.556	0.269	0.867	0.045	0.593	0.463	0.962	0.142	0.763	0.030	0.546
	EditGuard [ 52 ]	0.108	0.612	0.286	0.897	0.572	0.940	0.601	0.957	0.115	0.561	0.483	0.932

Table 3: Quantitative comparison on the OOD dataset (FFHQ [ 14 ] ) under Instructpix2pix [ 4 ] manipulation.

Method		Localization
		Regeneration		Patch Remove		Noise		JPEG		LP Filter		Lattice [ 21 ]
		F1	AUC	F1	AUC	F1	AUC	F1	AUC	F1	AUC	F1	AUC
Passive	MVSS-Net [ 6 ]	0.215	0.805	0.155	0.813	0.071	0.773	0.189	0.789	0.348	0.763	0.012	0.713
Passive	HiFiNet [ 9 ]	0.071	0.628	0.041	0.621	0.002	0.605	0.068	0.648	0.128	0.706	0.031	0.659
Proactive	Imuge+ [ 44 ]	0.219	0.774	0.470	0.924	0.012	0.589	0.672	0.987	0.207	0.661	0.008	0.537
	EditGuard [ 52 ]	0.196	0.583	0.458	0.968	0.800	0.989	0.839	0.996	0.196	0.758	0.711	0.987

Table 4: Quantitative comparison on the OOD dataset (FFHQ [ 14 ] ) under Stable Diffusion [ 30 ] Inpaint manipulation.

Figure 7: Ablation study on the contribution of the distortion layer to RecoverMark.

Figure 8: Ablation study on the impact of the distortion order.

Robust Watermarking

Robust watermarking embeds or verifies ownership and provenance signals that survive editing, compression, model changes, and deliberate removal.

See all 207 papers

Mar 25, 2026

High-Fidelity Face Content Recovery via Tamper-Resilient Versatile Watermarking

The proliferation of AIGC-driven face manipulation and deepfakes poses severe threats to media provenance, integrity, and copyright protection. Existing versatile watermarking systems typically rely on embedding explicit localization payloads, which introduces a fidelity--functionality trade-off: larger localization signals degrade visual quality and often reduce decoding robustness under strong generative edits. Moreover, these methods rarely support content recovery, limiting their forensic value when original evidence must be reconstructed. To address these challenges, we present VeriFi, a versatile watermarking framework that unifies copyright protection, pixel-level manipulation localization, and high-fidelity face content recovery. VeriFi makes three key contributions: (1) it embeds a compact semantic latent watermark that serves as a content-preserving prior, enabling faithful restoration even after severe manipulations; (2) it achieves fine-grained localization without dedicated payloads by correlating image features with decoded provenance signals; and (3) it introduces an AIGC attack simulator that combines latent-space mixing with seamless blending to enhance robustness against realistic deepfake pipelines. Extensive experiments on CelebA-HQ and FFHQ demonstrate that VeriFi consistently outperforms state-of-the-art baselines in watermark robustness, localization accuracy, and recovery quality, providing a practical and verifiable defense for deepfake forensics.

Peipeng Yu, Jinfeng Xie, Chengfu Ou +5

Jinan University, Guangzhou, Guangdong, China · University of Macau, Macau, China · Sun Yat-sen University, Guangzhou, Guangdong, China +1

Robust Watermarking Image Forgery Localization

Ask PDF

Sep 25, 2026

FeatMark: Feature-level Watermark Protection against Mimicry Attacks with Diffusion Models

Text-to-image diffusion models enable data-efficient "mimicry" attacks, wherein adversaries fine-tune the model on a handful of public photos to synthesize convincing forgeries of a target individual. A common countermeasure is to embed imperceptible, low-energy watermarks, yet recent studies show these signatures are brittle: modest post-processing or lightweight adversarial perturbations readily suppress detection, exposing a fundamental tension between imperceptibility and robustness. We introduce FeatMark, a watermarking framework that shifts from pixel-level, energy-starved perturbations to inconspicuous semantic features: small, scene-consistent micro-features that remain natural to humans while providing a stronger, machine-verifiable provenance signal. FeatMark builds domain-specific feature banks that encode each watermark as a compact concept program, pairing open-vocabulary semantic cues with reliable edit regions and instruction templates. It then automatically selects features that are both feasible and executable and injects them through modular, mask-guided concept editing, yielding highly localized, scene-consistent micro-edits that are difficult to perceive. We conduct extensive experiments across VGGFace2, CelebA-HQ, and WikiArt, evaluating against 10 strong watermark removal/purification attacks (including regeneration-style purification) and several bespoke adaptive attacks tailored to FeatMark, to assess perceptual fidelity, watermark detection accuracy, and robustness. We further demonstrate FeatMark's extensibility to video mimicry attacks. The results show FeatMark remains virtually impervious, withstanding all evaluated attacks with negligible bit-accuracy and fidelity degradation.

Haoyang Li, Ruoxi Sun, Qingqing Ye +4

The Hong Kong Polytechnic University · CSIRO’s Data61 · Macquarie University

AI-Generated Image Watermarking Diffusion Model Watermarking Robust Watermarking T2I Diffusion Models Adversarial Attacks Watermark Removal

Ask PDF

May 10, 2026

PGID: Progressive Guided Inversion and Denoising for Robust Watermark Detection

With the proliferation of AI-generated images, digital watermarking has become an essential safeguard for protecting intellectual property and mitigating malicious exploitation. Recent works on semantic watermarking have enabled efficient copyright protection for diffusion models. However, the dependence of semantic watermarking on diffusion inversion for watermark detection creates a critical vulnerability. Imprint removal and forgery attacks exploit this weakness to produce deceptive results. Our analysis reveals that these attacks succeed by displacing watermarked latents into the unwatermarked region, while guiding unwatermarked latents into the watermarked region. Based on that, we propose Progressive Guided Inversion and Denoising (PGID), the first plug-and-play, training-free noise extraction framework designed to defend against both attack strategies. PGID effectively defends by projecting perturbed latents back to the region where they originally belong. The projection is achieved by eliminating intermediate latent deflections and mitigating adversarial perturbations through progressive inversion-denoising cycles. Comprehensive evaluations across multiple schemes demonstrate that PGID successfully restores detection reliability by recovering removed watermarks and identifying forged instances.

Minh Quoc Duong, Chun Tong Lei, Chun Pong Lau

City University of Hong Kong

Diffusion Model Inversion Diffusion Model Watermarking Watermark Removal Image Forgery Detection Robust Watermarking Diffusion Models

Ask PDF

Abstract

Robust Watermarking

Explore similar work

High-Fidelity Face Content Recovery via Tamper-Resilient Versatile Watermarking

FeatMark: Feature-level Watermark Protection against Mimicry Attacks with Diffusion Models

PGID: Progressive Guided Inversion and Denoising for Robust Watermark Detection