All in One: Unifying Deepfake Detection, Tampering Localization, and Source Tracing with a Robust Landmark-Identity Watermark

Junjiang Wu; Liejun Wang; Zhiqing Guo

cs.CVFeb 26, 2026

All in One: Unifying Deepfake Detection, Tampering Localization, and Source Tracing with a Robust Landmark-Identity Watermark

Authors: Junjiang Wu, Liejun Wang, Zhiqing Guo

Organizations: School of Computer Science and Technology, Xinjiang University, Urumqi, China · Xinjiang Multimodal Intelligent Processing and Information Security Engineering Technology Research Center, Urumqi, China

Abstract

With the rapid advancement of deepfake technology, malicious face manipulations pose a significant threat to personal privacy and social security. However, existing proactive forensics methods typically treat deepfake detection, tampering localization, and source tracing as independent tasks, lacking a unified framework to address them jointly. To bridge this gap, we propose a unified proactive forensics framework that jointly addresses these three core tasks. Our core framework adopts an innovative 152-dimensional landmark-identity watermark termed LIDMark, which structurally interweaves facial landmarks with a unique source identifier. To robustly extract the LIDMark, we design a novel Factorized-Head Decoder (FHD). Its architecture factorizes the shared backbone features into two specialized heads (i.e., regression and classification), robustly reconstructing the embedded landmarks and identifier, respectively, even when subjected to severe distortion or tampering. This design realizes an "all-in-one" trifunctional forensic solution: the regression head underlies an "intrinsic-extrinsic" consistency check for detection and localization, while the classification head robustly decodes the source identifier for tracing. Extensive experiments show that the proposed LIDMark framework provides a unified, robust, and imperceptible solution for the detection, localization, and tracing of deepfake content. The code is available at https://github.com/vpsg-research/LIDMark.

Figures & tables

Figure 1: Comparison of proactive deepfake forensic paradigms. Conventional approaches shown at the top are limited to single tasks or require complex dual-decoder architectures for bifunctional forensics. The proposed “all-in-one” framework illustrated at the bottom employs the trifunctional LIDMark and a novel FHD for deepfake detection, source tracing, and tampering localization.

Figure 2: The 152-D LIDMark $W$ construction. The composite watermark concatenates two primary streams: (1) $W_{L}$ , a 136-D vector of normalized 2-D facial landmarks, and (2) $W_{ID}$ , a 16-D bipolar identifier derived via a SHA-256 hash of the filename.

Figure 3: Overview of the LIDMark framework. The trifunctional forensic framework features an encoder $E$ , a stochastic manipulation operator $\mathcal{M}$ , a factorized-head decoder FHD, and a discriminator $D$ . (a) The encoder embeds the LIDMark $W$ into $I_{co}$ via a two-stream fusion network, yielding the watermarked image $I_{wm}$ . (b) $\mathcal{M}$ simulates diverse common distortions and deepfake manipulations on $I_{wm}$ , producing the manipulated image $I^{\prime}_{wm}$ . (c) The FHD recovers $\hat{W}_{L}$ and $\hat{W}_{ID}$ from $I^{\prime}_{wm}$ via the shared backbone and factorized heads. (d) The multi-task loss functions guide the training process. (e) The “intrinsic-extrinsic” consistency check employs recovered landmarks $\hat{W}_{L}$ and re-detected landmarks $W_{new}$ for fine-grained tamper detection and localization, while identifiers $\hat{W}_{ID}$ are extracted for source tracing.

Model	Image Size	W.L.	PSNR $\uparrow$	SSIM $\uparrow$
MBRS [ 21 ]	$128\times 128$	30	35.19	0.90
CIN [ 24 ]	$128\times 128$	30	39.70	0.93
SepMark [ 40 ]	$128\times 128$	30	38.31	0.96
EditGuard [ 45 ]	$128\times 128$	30	37.17	0.95
LampMark [ 38 ]	$128\times 128$	30	40.20	0.97
DiffMark [ 31 ]	$128\times 128$	30	40.12	0.96

Table 1: Objective imperceptibility comparison on CelebA-HQ [ 22 ] . Results are shown across

128\times 128

and

256\times 256

resolutions. W.L. denotes the watermark length.

Figure 4: Visual assessment of LIDMark robustness and imperceptibility. Comparing rows 1 and 2 shows the watermarked image $I_{wm}$ is indistinguishable from the cover image $I_{co}$ . Row 3 displays the manipulation results $\mathcal{M}(I_{wm})$ . The “intrinsic-extrinsic” consistency check compares the green dots in row 4, representing FHD-recovered intrinsic landmarks $\hat{W}_{L}$ , against the red dots in row 5, representing re-detected extrinsic landmarks $W_{new}$ . Row 6 merges these two landmark sets into a combined image to visualize their spatial differences.

Distortion	MBRS [ 21 ]		CIN [ 24 ]		SepMark [ 40 ]		EditGuard [ 45 ]		LampMark [ 38 ]		DiffMark [ 31 ]		KAD-NET [ 16 ]		Ours
	BER		BER		BER		BER		BER		BER		BER		BER		AED
	128	256	128	256	128	256	128	256	128	256	128	256	128	256	128	256	128	256
Identity	0.00%	0.00%	0.00%	0.00%	0.00%	0.00%	0.09%	0.12%	0.00%	0.00%	0.00%	0.00%	0.00%	0.00%	0.00%	0.00%	1.06	2.96
Resize	10.72%	13.58%	24.97%	35.21%	23.81%	3.40%	0.60%	0.28%	14.00%	13.82%	0.02%	0.01%	0.00%	0.13%	0.00%	0.00%	1.19	3.00
GausBlur	4.57%	10.14%	6.89%	0.39%	0.41%	0.04%	1.53%	3.37%	1.82%	0.59%	0.00%	0.00%	0.00%	0.00%	0.00%	0.00%	1.05	3.03
MedBlur	1.11%	5.55%	0.81%	0.65%	0.20%	0.03%	1.62%	3.85%	1.72%	0.63%	0.00%	0.00%	0.00%	0.00%	0.00%	0.00%	1.06	3.01

Table 2: Quantitative comparison of BER and AED on CelebA-HQ [ 22 ] under common distortions

\mathcal{M}_{c}

. All results are reported at

128\times 128

and

256\times 256

resolutions. GausNoise and MedBlur denote Gaussian noise and median blur, respectively.

Manipulation	MBRS [ 21 ]		CIN [ 24 ]		SepMark [ 40 ]		EditGuard [ 45 ]		LampMark [ 38 ]		DiffMark [ 31 ]		KAD-NET [ 16 ]		Ours
	BER		BER		BER		BER		BER		BER		BER		BER		AED
	128	256	128	256	128	256	128	256	128	256	128	256	128	256	128	256	128	256
SimSwap [ 5 ]	24.60%	27.09%	40.08%	31.07%	20.02%	11.95%	45.32%	47.99%	16.53%	15.11%	5.58%	5.96%	13.15%	5.47%	0.02%	0.97%	1.31	3.55
UniFace [ 41 ]	0.48%	26.57%	11.80%	48.27%	0.34%	31.93%	9.17%	49.41%	6.28%	29.85%	0.01%	2.20%	7.24%	2.31%	0.01%	2.44%	1.28	4.01
CSCS [ 19 ]	10.10%	10.33%	0.29%	0.79%	0.68%	2.35%	0.99%	1.61%	2.30%	0.63%	0.13%	0.56%	1.87%	0.62%	0.00%	0.01%	1.21	3.05
StarGAN-v2 [ 6 ]	5.76%	19.97%	54.46%	39.38%	2.35%	1.26%	15.33%	7.91%	9.17%	3.11%	6.13%	3.89%	5.16%	3.51%	16.42%	8.47%	2.56	5.51

Table 3: Quantitative comparison of BER and AED on CelebA-HQ [ 22 ] under deepfake manipulations

\mathcal{M}_{d}

. All results are reported at

128\times 128

and

256\times 256

resolutions.

Figure 5: Landmarks Average Euclidean Distance (AED) under various attacks. AED measures the geometric error between FHD-recovered landmarks $\hat{W}_{L}$ and re-detected landmarks $W_{new}$ on $\mathcal{M}(I_{wm})$ . The distribution shows clear separability between benign operations and malicious attacks. The blue $\mathcal{M}_{c}$ bars yield low AED, while the red $\mathcal{M}_{d}$ bars introduce large geometric change, enabling the “intrinsic-extrinsic” consistency check.

Manipulation	MBRS [ 21 ]		CIN [ 24 ]		SepMark [ 40 ]		EditGuard [ 45 ]		LampMark [ 38 ]		DiffMark [ 31 ]		KAD-NET [ 16 ]		Ours
	BER		BER		BER		BER		BER		BER		BER		BER		AED
	128	256	128	256	128	256	128	256	128	256	128	256	128	256	128	256	128	256
SimSwap [ 5 ]	26.38%	27.09%	43.02%	27.47%	25.91%	18.07%	45.53%	47.40%	24.95%	15.11%	9.03%	8.35%	14.35%	6.23%	0.65%	0.99%	1.23	3.68
UniFace [ 41 ]	0.14%	21.16%	12.26%	47.99%	0.41%	25.52%	8.98%	48.80%	10.17%	29.85%	0.01%	2.07%	7.11%	4.36%	0.59%	2.65%	1.88	4.22
CSCS [ 19 ]	5.27%	6.53%	0.31%	0.70%	1.73%	1.06%	4.29%	2.33%	10.32%	0.63%	0.64%	3.82%	2.20%	2.65%	0.01%	0.01%	1.46	3.32
StarGAN-v2 [ 6 ]	6.23%	19.39%	57.98%	41.26%	3.51%	3.34%	13.15%	3.42%	11.10%	3.11%	7.04%	4.11%	8.38%	4.32%	18.12%	8.96%	2.79	5.98

Table 4: Quantitative comparison of BER and AED on LFW [ 18 ] under deepfake manipulations

\mathcal{M}_{d}

. All results are reported at

128\times 128

and

256\times 256

resolutions.

Model	Image Size	W.L.	PSNR $\uparrow$	SSIM $\uparrow$
MBRS [ 21 ]	$128\times 128$	30	34.99	0.90
CIN [ 24 ]	$128\times 128$	30	39.12	0.93
SepMark [ 40 ]	$128\times 128$	30	37.30	0.95
EditGuard [ 45 ]	$128\times 128$	30	34.98	0.94
LampMark [ 38 ]	$128\times 128$	30	37.18	0.94
DiffMark [ 31 ]	$128\times 128$	30	39.10	0.97

Table 5: Objective imperceptibility comparison on LFW [ 18 ] . Results are shown across

128\times 128

and

256\times 256

resolutions.

$\lambda_{L}$	$\lambda_{ID}$	PSNR $\uparrow$	SSIM $\uparrow$	BER $\downarrow$		AED $\downarrow$
$\lambda_{L}$	$\lambda_{ID}$	PSNR $\uparrow$	SSIM $\uparrow$	$\mathcal{M}_{c}$	$\mathcal{M}_{d}$	$\mathcal{M}_{c}$	$\mathcal{M}_{d}$
✗	$\checkmark$	42.12	0.98	0.00%	0.14%	342.39	359.98
$\checkmark$	✗	47.31	0.99	0.42%	0.49%	2.31	2.79
$\checkmark$	$\checkmark$	40.22	0.98	0.27%	3.33%	1.17	1.58
✗	$\checkmark$	43.54	0.99	0.00%	0.29%	540.91	405.97
$\checkmark$	✗	49.18	0.99	0.35%	0.48%	5.29	5.65

Table 6: Ablation study on the FHD loss components. Symbols

\checkmark

and ✗ denote loss enablement and disablement, respectively. The results for the

128\times 128

and

256\times 256

resolutions are shown in the top and bottom sections of the table.

W.L.	Image Size	PSNR $\uparrow$	SSIM $\uparrow$
152	$256\times 256$	44.31	0.99
168	$256\times 256$	42.36	0.99

Table 7: Objective imperceptibility comparison on CelebA-HQ [ 22 ] . Results are at

256\times 256

resolution. We compare the standard payload (W.L. 152) against the expanded (W.L. 168).

Distortion	W.L. 152		W.L. 168
Distortion	BER $\downarrow$	AED $\downarrow$	BER $\downarrow$	AED $\downarrow$
Identity	0.00%	2.96	0.00%	2.14
Resize	0.00%	3.00	0.00%	2.17
GausBlur	0.00%	3.03	0.00%	2.16
MedBlur	0.00%	3.01	0.02%	2.16
JpegTest	0.57%	3.39	0.00%	2.36

Table 8: Quantitative comparison on CelebA-HQ [ 22 ] of BER and AED for LIDMark with different capacities (W.L. 152 vs. 168) under common distortions

\mathcal{M}_{c}

, demonstrating highly robust scalability.

Manipulation	W.L. 152		W.L. 168
Manipulation	BER $\downarrow$	AED $\downarrow$	BER $\downarrow$	AED $\downarrow$
SimSwap [ 5 ]	0.97%	3.55	0.59%	2.58
UniFace [ 41 ]	2.44%	4.01	0.18%	2.47
CSCS [ 19 ]	0.01%	3.05	0.00%	2.21
StarGAN-v2 [ 6 ]	8.47%	5.51	14.33%	5.32
InfoSwap [ 9 ]	0.84%	3.91	1.19%	2.48

Table 9: Quantitative comparison on CelebA-HQ [ 22 ] of BER and AED for LIDMark with different capacities (W.L. 152 vs. 168) under deepfake manipulations

\mathcal{M}_{d}

, demonstrating highly robust scalability.

Figure 6: Visual assessment of the 168-D LIDMark robustness and imperceptibility. Comparing rows 1 and 2 shows the watermarked image $I_{wm}$ is indistinguishable from the cover image $I_{co}$ . Row 3 displays the manipulation results $\mathcal{M}(I_{wm})$ . The “intrinsic-extrinsic” consistency check compares the green dots in row 4, representing FHD-recovered intrinsic landmarks $\hat{W}_{L}$ , against the red dots in row 5, representing re-detected extrinsic landmarks $W_{new}$ . Row 6 merges these two landmark sets into a combined image to visualize their spatial differences.

Model	Image Size	Params (M)	FLOPs (G)
SepMark [ 40 ]	$128\times 128$	28.310	4.031
WaveGuard [ 17 ]	$128\times 128$	34.810	27.014
KAD-NET [ 16 ]	$128\times 128$	8.542	7.835
Ours	$128\times 128$	5.815	12.221
SepMark [ 40 ]	$256\times 256$	28.310	16.059
WaveGuard [ 17 ]	$256\times 256$	34.810	27.011

Table 10: Comparison of model complexity against dual-function baselines. We report the number of Parameters (M) and FLOPs (G). For fair comparison, the watermark length (W.L.) is standardized to 152-D for all methods.

Digital Image Forensics

Digital image forensics develops methods to detect, localize, explain, and trace image manipulation, synthetic content, and hidden data.

See all 112 papers

Whether, Which, and Whose: Solving the Triple Challenge of Deepfake Proactive Forensics in Multi-Face Scenarios
Apr 29, 2026Lei Zhang, Zhiqing Guo, Dan Ma +2Digital Forensics Image Forgery Localization
School of Computer Science and Technology, Xinjiang University, Urumqi, 830017, China · Xinjiang Multimodal Intelligent Processing and Information Security Engineering Technology Research Center, Urumqi, 830017, China · College of Computer Science and Electronic Engineering, Hunan University, Changsha, 410082, China
SAiW: Source-Attributable Invisible Watermarking for Proactive Deepfake Defense
Mar 24, 2026Bibek Das, Chandranath Adak, Soumi Chattopadhyay +2Robust Watermarking
Dept. of CSE, Indian Institute of Technology Patna, India – 801106. · Dept. of CSE, Indian Institute of Technology Indore, India – 453552. · State University of New York Polytechnic Institute, NY, USA – 13502. +1
Deepfake Forensics Adapter: A Dual-Stream Network for Generalizable Deepfake Detection
Mar 2, 2026Jianfeng Liao, Yichen Wei, Raymond Chan Ching Bon +3Deepfake Detection Digital Image Forensics
Shenzhen Technology University, Guangdong, China · Singapore Institute of Technology, Singapore, Singapore · The University of Hong Kong, Hong Kong, China +1

Apr 29, 2026J/K move · Enter open · S save

Whether, Which, and Whose: Solving the Triple Challenge of Deepfake Proactive Forensics in Multi-Face Scenarios

Lei Zhang, Zhiqing Guo, Dan Ma, Wenzhong Yang+1

School of Computer Science and Technology, Xinjiang University, Urumqi, 830017, China · Xinjiang Multimodal Intelligent Processing and Information Security Engineering Technology Research Center, Urumqi, 830017, China · College of Computer Science and Electronic Engineering, Hunan University, Changsha, 410082, China

Digital Forensics Image Forgery Localization Deepfake Detection Robust Watermarking

Open paper AskPDF arXiv

Unlike single-face forgeries, deepfakes in complex multi-person interaction scenarios (such as group photos and multi-person meetings) more closely reflect real-world threats. Although existing proactive forensics solutions demonstrate good performance, they heavily rely on a "single-face" setting, making it difficult to effectively deal with the problems of deepfake detection, localization, and source tracing in complex multi-person environments. In this paper, we propose a Deep Attributable Watermarking Framework (DAWF) tailored to multi-face proactive forensics, which establishes an isolated identity attribution space. This spatial isolation ensures that multiple independent tracing signals can coexist within a single image and be successfully anchored to their respective identity instances. Crucially, we propose a selective regional supervision loss to suppress cross-face interference, guiding the decoder to focus exclusively on the manipulated facial regions. DAWF unifies image-level detection, instance-level localization, and identity-level source tracing, successfully achieving the "whether, which, and whose" forensic goals of determining whether an image is manipulated, which face is forged, and whose identity is tampered with. Extensive experiments on challenging multi-face datasets demonstrate robust triple-forensic performance, achieving an AUC of 0.91, an F1-score of 0.87, and a BER of 0.54%. The code is available at https://github.com/vpsg-research/DAWF.

Abstract

Digital Image Forensics

Explore similar work

Whether, Which, and Whose: Solving the Triple Challenge of Deepfake Proactive Forensics in Multi-Face Scenarios

SAiW: Source-Attributable Invisible Watermarking for Proactive Deepfake Defense

Deepfake Forensics Adapter: A Dual-Stream Network for Generalizable Deepfake Detection