High-Fidelity Face Content Recovery via Tamper-Resilient Versatile Watermarking

TL;DR

VeriFi is a novel watermarking framework that enables high-fidelity face content recovery, precise manipulation localization, and robust protection against deepfake attacks, addressing key limitations of prior methods.

Contribution

It introduces a semantic latent watermark for faithful content restoration, achieves artifact-free localization, and develops an AIGC attack simulator to enhance robustness against deepfake pipelines.

Findings

Outperforms baselines in robustness and localization accuracy

Enables high-quality face content recovery after manipulations

Provides practical defense for deepfake forensics

Abstract

The proliferation of AIGC-driven face manipulation and deepfakes poses severe threats to media provenance, integrity, and copyright protection. Prior versatile watermarking systems typically rely on embedding explicit localization payloads, which introduces a fidelity--functionality trade-off: larger localization signals degrade visual quality and often reduce decoding robustness under strong generative edits. Moreover, existing methods rarely support content recovery, limiting their forensic value when original evidence must be reconstructed. To address these challenges, we present VeriFi, a versatile watermarking framework that unifies copyright protection, pixel-level manipulation localization, and high-fidelity face content recovery. VeriFi makes three key contributions: (1) it embeds a compact semantic latent watermark that serves as an content-preserving prior, enabling faithful restoration even after severe manipulations; (2) it achieves fine-grained localization without embedding localization-specific artifacts by correlating image features with decoded provenance signals; and (3) it introduces an AIGC attack simulator that combines latent-space mixing with seamless blending to improve robustness to realistic deepfake pipelines. Extensive experiments on CelebA-HQ and FFHQ show that VeriFi consistently outperforms strong baselines in watermark robustness, localization accuracy, and recovery quality, providing a practical and verifiable defense for deepfake forensics.