DeepSignature: Digitally Signed, Content-Encoding Watermarks for Robust and Transparent Image Authentication

TL;DR

DeepSignature introduces a cryptographically verifiable watermarking method using neural networks for robust, transparent image authentication, capable of source attribution and tampering detection.

Contribution

It combines digital signatures with neural network-based watermarks, enabling imperceptible, robust, and verifiable image authentication without special image handling.

Findings

Achieves near 100% forgery detection in experiments.

Demonstrates robustness against benign transformations.

Maintains imperceptibility and compatibility with existing formats.

Abstract

AI-powered generative models have significantly expanded the possibilities for editing, manipulating, and creating high-quality images. Particularly, images that falsely appear to originate from trusted sources pose a serious threat, undermining public trust in image authenticity. We propose DeepSignature, a novel approach that integrates the guarantees of digital signatures with the capabilities of deep neural networks. Neural networks are used both to generate content-encoding watermarks and to embed them imperceptibly into images while ensuring robust extraction. These watermarks are cryptographically verifiable, enabling source attribution and image integrity validation. DeepSignature is compatible with existing image formats and requires no special handling of signed images. It supports client-side verification, requiring only the signer's public key. Additionally, we introduce a novel latent-space verification approach to detect and localize tampering attempts. We evaluate DeepSignature in terms of imperceptibility, robustness to benign transformations, forgery detection, and its resilience against various attack scenarios. Our results highlight the inherent trade-offs between imperceptibility, robustness, and integrity verification. We demonstrate that DeepSignature reliably identifies significant forgery attempts -- achieving near 100\% in our experiments. Finally, we emphasize DeepSignature's modularity and tunable parameters, allowing adaptation to application-specific requirements. Code and model weights will be published.