Abstract
The proliferation of AIGC-driven face manipulation and deepfakes poses severe threats to media provenance, integrity, and copyright protection. Prior versatile watermarking systems typically rely on embedding explicit localization payloads, which introduces a fidelity--functionality trade-off: larger localization signals degrade visual quality and often reduce decoding robustness under strong generative edits. Moreover, existing methods rarely support content recovery, limiting their forensic value when original evidence must be reconstructed. To address these challenges, we present VeriFi, a versatile watermarking framework that unifies copyright protection, pixel-level manipulation localization, and high-fidelity face content recovery. VeriFi makes three key contributions: (1) it embeds a compact semantic latent watermark that serves as an content-preserving prior, enabling faithful restoration even after severe manipulations; (2) it achieves fine-grained localization without embedding localization-specific artifacts by correlating image features with decoded provenance signals; and (3) it introduces an AIGC attack simulator that combines latent-space mixing with seamless blending to improve robustness to realistic deepfake pipelines. Extensive experiments on CelebA-HQ and FFHQ show that VeriFi consistently outperforms strong baselines in watermark robustness, localization accuracy, and recovery quality, providing a practical and verifiable defense for deepfake forensics.
Abstract (translated)
AIGC驱动的人脸操作与深度伪造技术的泛滥，对媒体来源追溯、内容完整性和版权保护构成了严重威胁。此前通用的水印系统通常依赖嵌入显式的定位载荷，这引入了保真度-功能性权衡：更大的定位信号会降低视觉质量，并常在强生成性编辑下削弱解码鲁棒性。此外，现有方法极少支持内容恢复，限制了当原始证据必须重建时的取证价值。为应对这些挑战，我们提出了VeriFi，一个统一版权保护、像素级操作定位与高保真人脸内容恢复的通用水印框架。VeriFi的三项核心贡献包括：(1) 嵌入紧凑的语义隐式水印作为内容保持先验，即使在严重操作后也能忠实恢复；(2) 通过关联图像特征与解码的来源信号，在不嵌入定位特定伪影的情况下实现细粒度定位；(3) 引入结合隐空间混合与无缝融合的AIGC攻击模拟器，以提升对现实深度伪造流程的鲁棒性。在CelebA-HQ与FFHQ上的大量实验表明，VeriFi在水印鲁棒性、定位精度与恢复质量上持续优于强基线方法，为深度伪造取证提供了实用且可验证的防御方案。
URL
https://arxiv.org/abs/2603.23940
