High-Fidelity Face Content Recovery via Tamper-Resilient Versatile Watermarking

Peipeng Yu; Jinfeng Xie; Chengfu Ou; Xiaoyu Zhou; Jianwei Fei; Yunshu Dai; Zhihua Xia; Chip Hong Chang

cs.CVMar 25, 2026

High-Fidelity Face Content Recovery via Tamper-Resilient Versatile Watermarking

Authors: Peipeng Yu, Jinfeng Xie, Chengfu Ou, Xiaoyu Zhou, Jianwei Fei, Yunshu Dai, Zhihua Xia, Chip Hong Chang

Organizations: Jinan University, Guangzhou, Guangdong, China · University of Macau, Macau, China · Sun Yat-sen University, Guangzhou, Guangdong, China · Nanyang Technological University, Singapore, Singapore

Abstract

The proliferation of AIGC-driven face manipulation and deepfakes poses severe threats to media provenance, integrity, and copyright protection. Existing versatile watermarking systems typically rely on embedding explicit localization payloads, which introduces a fidelity--functionality trade-off: larger localization signals degrade visual quality and often reduce decoding robustness under strong generative edits. Moreover, these methods rarely support content recovery, limiting their forensic value when original evidence must be reconstructed. To address these challenges, we present VeriFi, a versatile watermarking framework that unifies copyright protection, pixel-level manipulation localization, and high-fidelity face content recovery. VeriFi makes three key contributions: (1) it embeds a compact semantic latent watermark that serves as a content-preserving prior, enabling faithful restoration even after severe manipulations; (2) it achieves fine-grained localization without dedicated payloads by correlating image features with decoded provenance signals; and (3) it introduces an AIGC attack simulator that combines latent-space mixing with seamless blending to enhance robustness against realistic deepfake pipelines. Extensive experiments on CelebA-HQ and FFHQ demonstrate that VeriFi consistently outperforms state-of-the-art baselines in watermark robustness, localization accuracy, and recovery quality, providing a practical and verifiable defense for deepfake forensics.

Figures & tables

Figure 1. Overview of our VeriFi framework for proactive deepfake defense. Our unified architecture embeds a robust copyright watermark and a compact semantic recovery prior into the original image $I_{\mathrm{ori}}$ . For a potentially forged image $I_{\mathrm{edit}}$ , VeriFi enables three integrated forensic capabilities: (1) provenance verification via robust copyright extraction; (2) pixel-level forgery localization, and (3) high-fidelity face recovery using the decoded semantic prior to reconstruct the original facial content $\hat{I}_{\mathrm{ori}}$ .

Figure 2. Overview of our VeriFi . (1) Unified Recovery-Copyright Watermark Embedder $Enc$ inserts an ownership code $w_{cop}$ and a compact facial signature $z_{face}$ . (2) AIGC Attack Simulator performs Latent Mixing and Poisson blending to mimic realistic deepfake attacks during training. (3) Watermark Extractor $Dec$ recovers $\hat{w}_{cop}$ and $\hat{z}_{face}$ , reconstructs a coarse content proxy $\hat{I}_{b}$ , and uses the decoded watermark signals to guide the Forgery Locator in predicting the manipulation map $\hat{M}$ . (4) Watermark-Guided Content Recovery Network employs a dual-stream Transformer with spatially gated cross-attention to fuse the edited image, $\hat{I}_{b}$ , and $\hat{M}$ for selective content restoration.

Figure 3. Overview of the proposed AIGC Attack Simulator. It emulates AIGC edits through latent feature grafting and seamless image blending to improve watermark robustness.

Method	Venue	SD Inpainting			HD-painter			Splicing
		F1	AUC	mIoU	F1	AUC	mIoU	F1	AUC	mIoU
CAT-Net ( Kwon et al., 2021 )	WACV’21	0.066	0.714	0.427	0.107	0.727	0.447	0.490	0.876	0.659
MVSS-Net ( Dong et al., 2022 )	TPAMI’22	0.262	0.843	0.484	0.378	0.866	0.540	0.639	0.935	0.707
PSCC-Net ( Liu et al., 2022 )	TCSVT’22	0.310	0.702	0.275	0.335	0.691	0.245	0.362	0.727	0.290
HiFi-Net ( Guo et al., 2023 )	CVPR’23	0.115	0.742	0.430	0.396	0.815	0.567	0.169	0.757	0.458
NCL-IML ( Zhou et al., 2023 )	ICCV’23	0.085	0.518	0.423	0.087	0.516	0.421	0.040	0.503	0.406

Table 2. Tamper-localization results on CelebA-HQ (1,000 images). Metrics: F1 / AUC / mIoU (higher is better). Best and second-best per column are bold and underlined , respectively.

Figure 4. Qualitative comparison of face recovery under SD Inpainting/HD-painter and Splicing.

Figure 5. Face recovery visualization under InfoSwap/E4S on CelebA-HQ.

Method	Dataset	Diffusion-based						GAN-based									Traditional
Method	Dataset	SD Inpainting			HD-painter			E4S			InfoSwap			MaskFaceGAN			Splicing
		$\emph{PSNR}_{\emph{rec}}$	$\emph{SSIM}_{\emph{rec}}$	FID	$\emph{PSNR}_{\emph{rec}}$	$\emph{SSIM}_{\emph{rec}}$	FID	$\emph{PSNR}_{\emph{rec}}$	$\emph{SSIM}_{\emph{rec}}$	FID	$\emph{PSNR}_{\emph{rec}}$	$\emph{SSIM}_{\emph{rec}}$	FID	$\emph{PSNR}_{\emph{rec}}$	$\emph{SSIM}_{\emph{rec}}$	FID	$\emph{PSNR}_{\emph{rec}}$	$\emph{SSIM}_{\emph{rec}}$	FID
Imuge+ ( Ying et al., 2023 )	CelebA-HQ	21.49	0.741	29.60	16.91	0.753	118.07	18.52	0.625	129.94	17.69	0.674	68.41	19.65	0.622	105.23	27.07	0.906	34.52
DFREC ( Yu et al., 2026 )	CelebA-HQ	21.14	0.666	71.68	18.36	0.691	107.15	17.74	0.608	38.57	21.11	0.628	38.51	18.63	0.624	91.03	19.64	0.661	59.95
VeriFi (Ours)	CelebA-HQ	31.05	0.894	39.25	28.34	0.892	45.68	25.12	0.839	26.71	27.33	0.866	18.82	25.73	0.845	41.18	31.06	0.921	21.51
Imuge+ ( Ying et al., 2023 )	FFHQ	16.46	0.745	94.05	19.54	0.697	47.13	11.28	0.542	121.56	15.32	0.592	78.10	18.34	0.619	63.57	29.52	0.891	31.48

Table 3. Face recovery performance under six representative tampering types. Higher

\emph{PSNR}_{\emph{rec}}

\emph{SSIM}_{\emph{rec}}

indicate better fidelity; lower FID indicates higher realism. Attack types are grouped by generation paradigm: Diffusion-based (SD Inpainting, HD-painter), GAN-based (E4S, InfoSwap, MaskFaceGAN), and Traditional (Splicing). Best results per column are bold .

Design
Setting (Factor)	F1	AUC	mIoU
Seg-only (no similarity branch)	0.912	0.966	0.842
Seg + Similarity (ours)	0.946	0.975	0.941
Supervision
Original-only (genuine pairs)	0.881	0.939	0.808
Orig. + Synthetic (ours)	0.946	0.975	0.941

Table 6. Ablation: localization similarity metric and supervision on CelebA-HQ (SD Inpainting).

Guidance	PSNR ${}_{\emph{rec}}$	SSIM ${}_{\emph{rec}}$	Bit Acc. (%)	Latency (ms)
256-D embedding	23.15	0.709	97.54	49.77
576-D embedding	25.83	0.843	96.06	51.15
1024-D embedding	31.05	0.894	97.29	53.57

Table 7. Ablation on face-representation guidance. Evaluation on CelebA-HQ under SD Inpainting (1,000 images). PSNR

{}_{\emph{rec}}

in dB; Bit Acc. denotes watermark extraction accuracy; latency is per-image decode time on one RTX 3090.

Robust Watermarking

Robust watermarking embeds or verifies ownership and provenance signals that survive editing, compression, model changes, and deliberate removal.

See all 207 papers

RecoverMark: Robust Watermarking for Localization and Recovery of Manipulated Faces
Feb 24, 2026Haonan An, Xiaohui Ye, Guang Hua +4Robust Watermarking Image Forgery Localization
City University of Hong Kong, Hong Kong · South China University of Technology · Singapore Institute of Technology, Singapore 828608
SAiW: Source-Attributable Invisible Watermarking for Proactive Deepfake Defense
Mar 24, 2026Bibek Das, Chandranath Adak, Soumi Chattopadhyay +2Robust Watermarking
Dept. of CSE, Indian Institute of Technology Patna, India – 801106. · Dept. of CSE, Indian Institute of Technology Indore, India – 453552. · State University of New York Polytechnic Institute, NY, USA – 13502. +1
GIFGuard: Proactive Forensics against Deepfakes in Facial GIFs via Spatiotemporal Watermarking
Apr 29, 2026Shupeng Che, Zhiqing Guo, Changtao Miao +2Digital Image Forensics Deepfake Detection
School of Computer Science and Technology, Xinjiang University · Ant Group · College of Computer Science and Electronic Engineering, Hunan University

Feb 24, 2026J/K move · Enter open · S save

RecoverMark: Robust Watermarking for Localization and Recovery of Manipulated Faces

Haonan An, Xiaohui Ye, Guang Hua, Yihang Tao+3

City University of Hong Kong, Hong Kong · South China University of Technology · Singapore Institute of Technology, Singapore 828608

Robust Watermarking Image Forgery Localization

Open paper AskPDF arXiv

The proliferation of AI-generated content has facilitated sophisticated face manipulation, severely undermining visual integrity and posing unprecedented challenges to intellectual property. In response, a common proactive defense leverages fragile watermarks to detect, localize, or even recover manipulated regions. However, these methods always assume an adversary unaware of the embedded watermark, overlooking their inherent vulnerability to watermark removal attacks. Furthermore, this fragility is exacerbated in the commonly used dual-watermark strategy that adds a robust watermark for image ownership verification, where mutual interference and limited embedding capacity reduce the fragile watermark's effectiveness. To address the gap, we propose RecoverMark, a watermarking framework that achieves robust manipulation localization, content recovery, and ownership verification simultaneously. Our key insight is twofold. First, we exploit a critical real-world constraint: an adversary must preserve the background's semantic consistency to avoid visual detection, even if they apply global, imperceptible watermark removal attacks. Second, using the image's own content (face, in this paper) as the watermark enhances extraction robustness. Based on these insights, RecoverMark treats the protected face content itself as the watermark and embeds it into the surrounding background. By designing a robust two-stage training paradigm with carefully crafted distortion layers that simulate comprehensive potential attacks and a progressive training strategy, RecoverMark achieves a robust watermark embedding in no fragile manner for image manipulation localization, recovery, and image IP protection simultaneously. Extensive experiments demonstrate the proposed RecoverMark's robustness against both seen and unseen attacks and its generalizability to in-distribution and out-of-distribution data.

Abstract

Robust Watermarking

Explore similar work

RecoverMark: Robust Watermarking for Localization and Recovery of Manipulated Faces

SAiW: Source-Attributable Invisible Watermarking for Proactive Deepfake Defense

GIFGuard: Proactive Forensics against Deepfakes in Facial GIFs via Spatiotemporal Watermarking