Watermarked face images can evade recognition while preserving authenticity
A Valid Watermark Is Not a Valid Identity: Spatial-Spectral Adversarial Face Evasion with Watermark Preservation
Computer Vision and Pattern Recognition
Summary
Watermarks on face images are meant to prove they are genuine and not manipulated. This paper shows that an image can keep its watermark but still fool facial recognition systems into thinking it is someone else. The authors created a method that changes the image just enough to avoid being recognized but without damaging the hidden watermark or making the image look suspicious. This finding means relying on watermarks alone is not enough to confirm a person’s identity in biometric systems.
What this means in practice
- •For security engineers: Improve biometric system design by understanding vulnerabilities to watermark-preserving adversarial attacks that cause identification errors.
- •For digital watermark developers: Develop watermarking methods that resist adversarial face evasion while maintaining image quality and recognition reliability.
Authors
Jefferson David Rodriguez Chivata, Davide Ghiani, Simone Maurizio La Cava, Marco Micheletto, Giulia Orrù, Gian Luca Marcialis
Abstract
Facial image watermarking can support traceability and certification in biometric pipelines, but provenance or manipulation detection alone does not guarantee reliable biometric identity. We introduce a watermark-preserving face evasion attack that targets this gap under a black-box watermarking setting, without access to the watermarking components. The proposed PGD-L_2 attack guides adversarial perturbations with spatial and spectral preservation terms to reduce face-recognition similarity while limiting pixel-level distortion and high-frequency changes that may interfere with hidden watermark cues. Evaluated on controlled facial images with two watermarking schemes, two face-recognition models, and two datasets, the attack achieves evasion rates above 92% at operational thresholds while preserving watermark recovery above 93% for StegaFormer and above 99.7% for FaceSigns, with visual quality above 47dB PSNR at epsilon_2=2.0. These results expose a structural gap in watermark-based facial certification: a face image can remain watermark-valid and visually faithful while becoming biometrically unreliable.