Featmark protects images from mimicry attacks using subtle semantic features
FeatMark: Feature-level Watermark Protection against Mimicry Attacks with Diffusion Models
Cryptography and SecurityComputer Vision and Pattern Recognition
Summary
When people use powerful AI models to create fake images by learning from just a few photos, it becomes hard to tell real from fake. Existing watermarks that slightly change pixels are easy to erase or hide. The authors introduce FeatMark, a way to hide tiny, natural-looking details that machines can detect but humans barely notice. These hidden features stay intact even after attempts to remove them, helping prove which images are genuine. They tested FeatMark on photos and videos and found it very hard for attackers to remove the watermark without ruining the image.
What this means in practice
- •For digital image security teams: Add invisible, robust provenance markers to images to detect when AI models copy them for fake content creation.
- •For video content protection teams: Embed subtle semantic watermarks in videos to guard against manipulated reenactments using AI mimicry techniques.
Authors
Haoyang Li, Ruoxi Sun, Qingqing Ye, Benjamin Zi Hao Zhao, Yaxin Xiao, Jason Xue, Haibo Hu
Abstract
Text-to-image diffusion models enable data-efficient "mimicry" attacks, wherein adversaries fine-tune the model on a handful of public photos to synthesize convincing forgeries of a target individual. A common countermeasure is to embed imperceptible, low-energy watermarks, yet recent studies show these signatures are brittle: modest post-processing or lightweight adversarial perturbations readily suppress detection, exposing a fundamental tension between imperceptibility and robustness. We introduce FeatMark, a watermarking framework that shifts from pixel-level, energy-starved perturbations to inconspicuous semantic features: small, scene-consistent micro-features that remain natural to humans while providing a stronger, machine-verifiable provenance signal. FeatMark builds domain-specific feature banks that encode each watermark as a compact concept program, pairing open-vocabulary semantic cues with reliable edit regions and instruction templates. It then automatically selects features that are both feasible and executable and injects them through modular, mask-guided concept editing, yielding highly localized, scene-consistent micro-edits that are difficult to perceive. We conduct extensive experiments across VGGFace2, CelebA-HQ, and WikiArt, evaluating against 10 strong watermark removal/purification attacks (including regeneration-style purification) and several bespoke adaptive attacks tailored to FeatMark, to assess perceptual fidelity, watermark detection accuracy, and robustness. We further demonstrate FeatMark's extensibility to video mimicry attacks. The results show FeatMark remains virtually impervious, withstanding all evaluated attacks with negligible bit-accuracy and fidelity degradation.