💻 computer science

High-Fidelity Face Content Recovery via Tamper-Resilient Versatile Watermarking

This paper introduces VeriFi, a versatile watermarking framework that simultaneously achieves high-fidelity face content recovery, pixel-level manipulation localization, and robust copyright protection by embedding compact semantic latent watermarks and utilizing an AIGC attack simulator to overcome the fidelity-functionality trade-offs of prior methods.

Original authors: Peipeng Yu, Jinfeng Xie, Chengfu Ou, Xiaoyu Zhou, Jianwei Fei, Yunshu Dai, Zhihua Xia, Chip Hong Chang

Published 2026-03-26

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Peipeng Yu, Jinfeng Xie, Chengfu Ou, Xiaoyu Zhou, Jianwei Fei, Yunshu Dai, Zhihua Xia, Chip Hong Chang

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you have a priceless, original painting. In the digital world, this is your face photo. Now, imagine a group of digital forgers (using AI) can steal that painting, paint over parts of it, swap the face with someone else's, or even generate a completely fake version that looks real.

For a long time, the only way to catch these forgers was to play "detective" after the damage was done, trying to spot tiny clues that the image was fake. But as AI gets smarter, these clues disappear, and the detectives often fail.

Enter VeriFi: The "Unbreakable Invisible Ink" for Your Face.

This paper introduces a new system called VeriFi. Think of it not just as a security seal, but as a magical, invisible ink that you paint onto your photo before you post it online. This ink does three amazing things at once, solving problems that previous technologies couldn't handle together.

Here is how VeriFi works, broken down into simple analogies:

1. The "Invisible ID Card" (Copyright Protection)

Imagine stamping your photo with a tiny, invisible ID card that says, "This belongs to me."

The Problem: Old watermarks were like big, heavy stamps. If you tried to make them strong enough to survive a forgery, they would ruin the picture's quality (making it look blurry). If you made them subtle, the forgers could easily wash them away.
The VeriFi Solution: VeriFi uses a "compact semantic latent." Think of this as a micro-chip hidden inside the pixels. It's so small and smart that it doesn't change how the photo looks to the human eye, but it carries a unique code that proves ownership. Even if someone tries to edit the photo, this code is tough enough to survive.

2. The "X-Ray Vision" (Tamper Localization)

Imagine you have a photo, and someone paints over the nose with a fake one. How do you know exactly where the fake nose is?

The Problem: Most systems need a second, separate "map" to show where the forgery is. But adding a second map makes the image even more distorted (like adding too many layers of paint).
The VeriFi Solution: VeriFi is clever. It doesn't need a second map. It uses the damage to the invisible ID card as the map!
- The Analogy: Imagine the invisible ID card is a perfect grid of light. When a forger paints over a part of the image, they accidentally smash that part of the grid. VeriFi looks at the photo, sees where the grid is broken, and says, "Aha! The damage is here, so the forgery is here." It finds the fake parts by looking at where the invisible ink got messed up, without needing to add any extra clutter to the image.

3. The "Time-Traveling Blueprint" (Content Recovery)

This is the magic trick. Imagine a forger completely erases your face and replaces it with a stranger's. Can you get your original face back?

The Problem: Usually, once a face is edited, the original data is gone forever. You can't un-bake a cake.
The VeriFi Solution: Before you even post the photo, VeriFi takes a compressed "blueprint" of your original face and hides it inside the invisible ink.
- The Analogy: Think of it like a backup drive hidden inside a postcard. If someone destroys the postcard's image, you can still pull the backup drive out, read the blueprint, and 3D-print a perfect copy of your original face.
- VeriFi uses a "latent" (a compressed digital summary) of your face. When a forgery is detected, the system uses this hidden blueprint to reconstruct your original face, pixel by pixel, with high fidelity. It's like having a "Undo" button for deepfakes.

How It Gets Smarter: The "Fake Attack Simulator"

To make sure VeriFi is tough enough, the researchers didn't just train it on simple edits. They built a Video Game Simulator for the AI.

They created a virtual environment where the AI attacks the watermarks using the same tricks real deepfake tools use (mixing faces, blending edges, changing lighting).
It's like a firefighter training in a burning building simulator. By practicing against these "fake" attacks in the lab, VeriFi becomes a superhero when it faces real-world forgers.

Why This Matters

In the past, you had to choose between:

High Quality: A pretty picture, but easy to fake.
High Security: A secure picture, but it looked blurry or had artifacts.
Recovery: You could find the fake, but you couldn't get the original back.

VeriFi breaks the rules. It gives you all three:

It looks perfect (High Fidelity).
It proves who owns it (Copyright).
It tells you exactly what was faked (Localization).
It lets you restore the original face (Recovery).

The Bottom Line

VeriFi is like giving every face photo a superpower. It carries its own ID, its own map of where lies are, and its own backup copy of the truth. In an era where AI can make anyone say or do anything, VeriFi provides a way to say, "No, that's not real. Here is the proof, and here is the original truth."

1. Problem Statement

The rapid advancement of Artificial Intelligence Generated Content (AIGC) has led to the proliferation of highly realistic face manipulations and deepfakes. This poses severe threats to media provenance, copyright protection, and content integrity. Existing solutions face three critical limitations:

Fidelity–Functionality Trade-off: Versatile watermarking systems that combine copyright protection with tamper localization often rely on embedding large, explicit localization payloads. This degrades visual quality (fidelity) and reduces the robustness of the copyright signal under strong generative edits.
Lack of Content Recovery: Most existing methods focus on detection or localization but fail to reconstruct the original, unaltered content. This limits their forensic utility when original evidence must be restored.
Weakness Against AIGC: Passive detection methods and traditional watermarking often struggle against sophisticated, unseen AIGC pipelines (e.g., latent-space mixing and seamless blending) used in modern deepfake generation.

2. Methodology: The VeriFi Framework

VeriFi is a unified, proactive framework that simultaneously achieves robust copyright protection, pixel-level tamper localization, and high-fidelity face content recovery. It operates through four tightly integrated modules:

A. Unified Recovery-Copyright Watermark (URW) Embedder

Instead of embedding separate signals for copyright and localization, VeriFi embeds two compact signals into the original image ( $I_{ori}$ ):

Ownership Code ( $w_{cop}$ ): A discrete $n$ -bit code for copyright verification.
Facial Latent ( $z_{face}$ ): A compact, continuous semantic latent derived from a pre-trained Variational Autoencoder (VAE). This serves as a "content-preserving prior" for recovery.
The encoder produces a protected image ( $I_{pro}$ ) that is visually imperceptible from the original.

B. Watermark-Guided Forgery Localization

VeriFi eliminates the need for a separate localization payload by leveraging the degradation of the embedded watermark as a spatial prior.

Mechanism: When an image is manipulated, the watermark signal in the tampered regions becomes corrupted or decodes incorrectly.
Architecture: A dual-branch Swin-Unet network compares features from the manipulated image against features decoded from the recovered watermark.
Similarity Calculation: It computes per-pixel cosine similarity between the image features and watermark-derived features. Low similarity indicates tampering. This generates a dense manipulation probability map ( $\hat{M}$ ) without embedding extra artifacts.

C. Watermark-Guided Deepfake Recovery

To reconstruct the original face, VeriFi uses the decoded facial latent ( $\hat{z}_{face}$ ) and the manipulation map ( $\hat{M}$ ).

Inputs: The network takes the manipulated image (masked by $\hat{M}$ ), a coarse content proxy reconstructed from $\hat{z}_{face}$ , the decoded latent itself, and the mask.
Architecture: A dual-stream Transformer with spatially gated cross-attention.
Gating Mechanism: The predicted mask $\hat{M}$ acts as a gate, ensuring that the semantic priors from the watermark are injected only into the tampered regions. This prevents "semantic leakage" into authentic areas, preserving the original content while restoring damaged regions.

D. AIGC Attack Simulator

To train the model against realistic deepfakes, VeriFi introduces a simulator used only during training. It emulates the two-stage process of modern deepfake generation:

Latent Mixing: It grafts latent features from a source face into the watermarked image's latent space using a random channel mask, simulating feature-level synthesis.
Image Blending: It applies Poisson blending to seamlessly integrate the source face into the generated image, followed by random degradations (JPEG, noise).

3. Key Contributions

Unified Framework: VeriFi is the first to unify copyright protection, pixel-level localization, and high-fidelity content recovery in a single versatile watermarking system.
Fidelity-Functionality Breakthrough: By using the watermark signal itself as a localization prior and a compact semantic latent for recovery, VeriFi avoids the trade-off between visual quality and functionality.
AIGC Robustness: The novel AIGC Attack Simulator (combining latent mixing and blending) significantly enhances the model's robustness against realistic deepfake pipelines compared to methods trained only on post-blending perturbations.
High-Fidelity Recovery: The watermark-guided recovery network successfully reconstructs original facial details even after severe manipulations, a capability missing in prior art.

4. Experimental Results

The authors evaluated VeriFi on CelebA-HQ and FFHQ datasets against strong baselines (e.g., EditGuard, OmniGuard, StableGuard, WAM, and passive detectors).

Tamper Localization: VeriFi achieved state-of-the-art performance. On CelebA-HQ, it reached an F1 score of 0.946 (SD Inpainting), 0.975 (HD-painter), and 0.989 (Splicing), significantly outperforming the second-best methods.
Content Recovery: VeriFi demonstrated superior reconstruction quality. Under SD Inpainting, it achieved 31.05 dB PSNR and 0.894 SSIM, far exceeding competitors like Imuge+ (21.49 dB) and DFREC (21.14 dB). The recovered faces were semantically consistent with the original.
Copyright Robustness: VeriFi maintained a high mean extraction accuracy of 97.70% across various AIGC attacks and common degradations, while maintaining high visual fidelity (42.53 dB PSNR, 0.948 SSIM).
Efficiency: The total inference latency is approximately 82.75 ms per image on an RTX 3090, making it suitable for near-real-time applications.

5. Significance

VeriFi represents a paradigm shift in media forensics. By moving from passive detection to proactive, recovery-capable watermarking, it provides a comprehensive defense against deepfakes.

Forensic Utility: It allows judges or platforms not only to detect a forgery but to restore the original evidence, which is crucial for legal and verification contexts.
Scalability: The framework addresses the "fidelity-functionality" bottleneck that has limited previous versatile watermarking systems.
Future Impact: The approach sets a new benchmark for protecting digital identity and media integrity in the era of generative AI, with potential extensions to video and other modalities.