{"type":"ScholarlyArticle","title":"Are Watermarks Bugs for Deepfake Detectors? Rethinking Proactive Forensics","authors":[{"name":"Xiaoshuai Wu","slug":"xiaoshuai-wu","given":"Xiaoshuai","family":"Wu","affiliation":"College of Computer Science and Electronic Engineering , Hunan University , Changsha , China"},{"name":"Xin Liao","slug":"xin-liao","given":"Xin","family":"Liao","affiliation":"College of Computer Science and Electronic Engineering , Hunan University , Changsha , China"},{"name":"Bo Ou","slug":"bo-ou","given":"Bo","family":"Ou","affiliation":"College of Computer Science and Electronic Engineering , Hunan University , Changsha , China"},{"name":"Yuling Liu","slug":"yuling-liu","given":"Yuling","family":"Liu","affiliation":"College of Computer Science and Electronic Engineering , Hunan University , Changsha , China"},{"name":"Zheng Qin","slug":"zheng-qin","given":"Zheng","family":"Qin","affiliation":"College of Computer Science and Electronic Engineering , Hunan University , Changsha , China"}],"abstract":"AI-generated content has accelerated the topic of media synthesis, particularly Deepfake, which can manipulate our portraits for positive or malicious purposes. Before releasing these threatening face images, one promising forensics solution is the injection of robust watermarks to track their own provenance. However, we argue that current watermarking models, originally devised for genuine images, may harm the deployed Deepfake detectors when directly applied to forged images, since the watermarks are prone to overlap with the forgery signals used for detection. To bridge this gap, we thus propose AdvMark, on behalf of proactive forensics, to exploit the adversarial vulnerability of passive detectors for good. Specifically, AdvMark serves as a plug-and-play procedure for fine-tuning any robust watermarking into adversarial watermarking, to enhance the forensic detectability of watermarked images; meanwhile, the watermarks can still be extracted for provenance tracking. Extensive experiments demonstrate the effectiveness of the proposed AdvMark, leveraging robust watermarking to fool Deepfake detectors, which can help improve the accuracy of downstream Deepfake detection without tuning the in-the-wild detectors. We believe this work will shed some light on the harmless proactive forensics against Deepfake.","doi":"10.24963/ijcai.2024/673","url":"https://ijcai.org/proceedings/2024/673","pdf":"https://ijcai.org/proceedings/2024/0673.pdf","markdown":"https://ijcai.org/proceedings/2024/673.md","bibtex":"https://ijcai.org/proceedings/2024/bibtex/673","volume":{"slug":"2024","title":"Proceedings of the Thirty-Third International Joint Conference on Artificial Intelligence","short_title":"IJCAI 2024","url":"https://ijcai.org/proceedings/2024/","year":2024,"location":"Jeju, Korea","dates":"3-9 August 2024","editors":"Kate Larson","isbn":"978-1-956792-04-1","publisher":"International Joint Conferences on Artificial Intelligence Organization","doi_prefix":"10.24963/ijcai.2024"},"section":"Multidisciplinary Topics and Applications","track":"Main Track","number":673,"pages":{"first":6089,"last":6097},"keywords":["Computer Vision: CV: Biometrics, face, gesture and pose recognition","Multidisciplinary Topics and Applications: MTA: Security and privacy"],"videos":[],"references":[{"position":1,"raw":"[Al-Maliki et al., 2024] Shawqi Al-Maliki, Adnan Qayyum, Has- san Ali, Mohamed Abdallah, Junaid Qadir, Dinh Thai Hoang, Dusit Niyato, and Ala Al-Fuqaha. Adversarial machine learning for social good: Reframing the adversary as an ally. IEEE TAI, 2024.","title":"Adversarial machine learning for social good: Reframing the adversary as an ally","authors":"Shawqi Al-Maliki, Adnan Qayyum, Hassan Ali, Mohamed Abdallah, Junaid Qadir, Dinh Thai Hoang, Dusit Niyato, Ala Al-Fuqaha","year":"2024","venue":"IEEE TAI","doi":null,"url":null,"internal_url":null},{"position":2,"raw":"[Asnani et al., 2022] Vishal Asnani, Xi Yin, Tal Hassner, Sijia Liu, and Xiaoming Liu. Proactive image manipulation detection. In CVPR, 2022.","title":"Proactive image manipulation detection","authors":"Xi Vishal Asnani, Tal Yin, Sijia Hassner, Xiaoming Liu, Liu","year":"2022","venue":"CVPR","doi":null,"url":null,"internal_url":null},{"position":3,"raw":"[Asnani et al., 2023] Vishal Asnani, Xi Yin, Tal Hassner, and Xi- aoming Liu. Malp: Manipulation localization using a proactive scheme. In CVPR, 2023.","title":"Malp: Manipulation localization using a proactive scheme","authors":"Xi Vishal Asnani, Tal Yin, Xiaoming Hassner, Liu","year":"2023","venue":"CVPR","doi":null,"url":null,"internal_url":null},{"position":4,"raw":"[Bui et al., 2023] Tu Bui, Shruti Agarwal, Ning Yu, and John Col- lomosse. Rosteals: Robust steganography using autoencoder la- tent space. In CVPRW, 2023.","title":"Rosteals: Robust steganography using autoencoder latent space","authors":"Tu Bui, Shruti Agarwal, Ning Yu, John Collomosse","year":"2023","venue":"CVPRW","doi":null,"url":null,"internal_url":null},{"position":5,"raw":"[C2PA, 2021] C2PA. Coalition for content provenance and authen- ticity. https://c2pa.org/, 2021. Accessed: 2023-07.","title":"C2PA. Coalition for content provenance and authenticity","authors":"C2pa","year":"2021","venue":null,"doi":null,"url":"https://c2pa.org/,2021","internal_url":null},{"position":6,"raw":"[Cao et al., 2022] Junyi Cao, Chao Ma, Taiping Yao, Shen Chen, Shouhong Ding, and Xiaokang Yang. End-to-end reconstruction- classification learning for face forgery detection. In CVPR, 2022.","title":"End-to-end reconstructionclassification learning for face forgery detection","authors":"Junyi Cao, Chao Ma, Taiping Yao, Shen Chen, Shouhong Ding, Xiaokang Yang","year":"2022","venue":"CVPR","doi":null,"url":null,"internal_url":null},{"position":7,"raw":"[Chai et al., 2020] Lucy Chai, David Bau, Ser-Nam Lim, and Phillip Isola. What makes fake images detectable? understanding properties that generalize. In ECCV, 2020.","title":"What makes fake images detectable? understanding properties that generalize","authors":"Lucy Chai, David Bau, Ser-Nam Lim, Phillip Isola","year":"2020","venue":"ECCV","doi":null,"url":null,"internal_url":null},{"position":8,"raw":"[Chen et al., 2020] Renwang Chen, Xuanhong Chen, Bingbing Ni, and Yanhao Ge. Simswap: An efficient framework for high fi- delity face swapping. In ACM MM, 2020.","title":"Simswap: An efficient framework for high fidelity face swapping","authors":"Chen","year":"2020","venue":"ACM MM","doi":null,"url":null,"internal_url":null},{"position":9,"raw":"[Chen et al., 2021] Zhikai Chen, Lingxi Xie, Shanmin Pang, Yong He, and Bo Zhang. Magdr: Mask-guided detection and recon- struction for defending deepfakes. In CVPR, 2021.","title":"Magdr: Mask-guided detection and reconstruction for defending deepfakes","authors":"Chen","year":"2021","venue":"CVPR","doi":null,"url":null,"internal_url":null},{"position":10,"raw":"[Choi et al., 2018] Yunjey Choi, Minje Choi, Munyoung Kim, Jung-Woo Ha, Sunghun Kim, and Jaegul Choo. Stargan: Uni- fied generative adversarial networks for multi-domain image-to- image translation. In CVPR, 2018.","title":"Stargan: Unified generative adversarial networks for multi-domain image-toimage translation","authors":"Choi","year":"2018","venue":"CVPR","doi":null,"url":null,"internal_url":null},{"position":11,"raw":"[Dang et al., 2020] Hao Dang, Feng Liu, Joel Stehouwer, Xiaom- ing Liu, and Anil K Jain. On the detection of digital face manip- ulation. In CVPR, 2020.","title":"On the detection of digital face manipulation","authors":"Hao Dang, Feng Liu, Joel Stehouwer, Xiaoming Liu, Anil K Jain","year":"2020","venue":"CVPR","doi":null,"url":null,"internal_url":null},{"position":12,"raw":"[Goodfellow et al., 2014] Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial net- works. In NeurIPS, 2014.","title":"Generative adversarial networks","authors":"Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, Yoshua Bengio","year":"2014","venue":"NeurIPS","doi":null,"url":null,"internal_url":null},{"position":13,"raw":"[Guan et al., 2023] Jiazhi Guan, Tianshu Hu, Hang Zhou, Zhizhi Guo, Lirui Deng, Chengbin Quan, Errui Ding, and Youjian Zhao. Building an invisible shield for your portrait against deepfakes. arXiv preprint arXiv:2305.12881, 2023.","title":"Building an invisible shield for your portrait against deepfakes","authors":"Jiazhi Guan, Tianshu Hu, Hang Zhou, Zhizhi Guo, Lirui Deng, Chengbin Quan, Errui Ding, Youjian Zhao","year":"2023","venue":null,"doi":null,"url":null,"internal_url":null},{"position":14,"raw":"[Hacker et al., 2023] Philipp Hacker, Andreas Engel, and Marco Mauer. Regulating chatgpt and other large generative ai models. In ACM FAccT, 2023.","title":"Regulating chatgpt and other large generative ai models","authors":"Philipp Hacker, Andreas Engel, Marco Mauer","year":"2023","venue":"ACM FAccT","doi":null,"url":null,"internal_url":null},{"position":15,"raw":"[Hou et al., 2023] Yang Hou, Qing Guo, Yihao Huang, Xiaofei Xie, Lei Ma, and Jianjun Zhao. Evading deepfake detectors via adver- sarial statistical consistency. In CVPR, 2023.","title":"Evading deepfake detectors via adversarial statistical consistency","authors":"Yang Hou, Qing Guo, Yihao Huang, Xiaofei Xie, Lei Ma, Jianjun Zhao","year":"2023","venue":"CVPR","doi":null,"url":null,"internal_url":null},{"position":16,"raw":"[Hu et al., 2022] Juan Hu, Xin Liao, Jinwen Liang, Wenbo Zhou, and Zheng Qin. Finfer: Frame inference-based deepfake detec- tion for high-visual-quality videos. In AAAI, 2022.","title":"Finfer: Frame inference-based deepfake detection for high-visual-quality videos","authors":"Juan Hu, Xin Liao, Jinwen Liang, Wenbo Zhou, Zheng Qin","year":"2022","venue":"AAAI","doi":null,"url":null,"internal_url":null},{"position":17,"raw":"[Huang et al., 2022] Hao Huang, Yongtao Wang, Zhaoyu Chen, Yuze Zhang, Yuheng Li, Zhi Tang, Wei Chu, Jingdong Chen, Weisi Lin, and Kai-Kuang Ma. Cmua-watermark: A cross-model universal adversarial watermark for combating deepfakes. In AAAI, 2022.","title":"Cmua-watermark: A cross-model universal adversarial watermark for combating deepfakes","authors":"Hao Huang, Yongtao Wang, Zhaoyu Chen, Yuze Zhang, Yuheng Li, Zhi Tang, Wei Chu, Jingdong Chen, Weisi Lin, Kai-Kuang Ma","year":"2022","venue":"AAAI","doi":null,"url":null,"internal_url":null},{"position":18,"raw":"[Ilyas et al., 2019] Andrew Ilyas, Shibani Santurkar, Dimitris Tsipras, Logan Engstrom, Brandon Tran, and Aleksander Madry. Adversarial examples are not bugs, they are features. In NeurIPS, 2019.","title":"Adversarial examples are not bugs, they are features","authors":"Andrew Ilyas, Shibani Santurkar, Dimitris Tsipras, Logan Engstrom, Brandon Tran, Aleksander Madry","year":"2019","venue":"NeurIPS","doi":null,"url":null,"internal_url":null},{"position":19,"raw":"[Jia et al., 2021] Zhaoyang Jia, Han Fang, and Weiming Zhang. Mbrs: Enhancing robustness of dnn-based watermarking by mini-batch of real and simulated jpeg compression. In ACM MM, 2021.","title":"Mbrs: Enhancing robustness of dnn-based watermarking by mini-batch of real and simulated jpeg compression","authors":"Zhaoyang Jia, Han Fang, Weiming Zhang","year":"2021","venue":"ACM MM","doi":null,"url":null,"internal_url":null},{"position":20,"raw":"[Jolicoeur-Martineau, 2019] Alexia Jolicoeur-Martineau. The rela- tivistic discriminator: a key element missing from standard gan. In ICLR, 2019.","title":"The relativistic discriminator: a key element missing from standard gan","authors":"Alexia Jolicoeur-Martineau","year":"2019","venue":"ICLR","doi":null,"url":null,"internal_url":null},{"position":21,"raw":"[Juefei-Xu et al., 2022] Felix Juefei-Xu, Run Wang, Yihao Huang, Qing Guo, Lei Ma, and Yang Liu. Countering malicious deep- fakes: Survey, battleground, and horizon. IJCV, 2022.","title":"Countering malicious deepfakes: Survey, battleground, and horizon","authors":"Felix Juefei-Xu, Run Wang, Yihao Huang, Qing Guo, Lei Ma, Yang Liu","year":"2022","venue":"IJCV","doi":null,"url":null,"internal_url":null},{"position":22,"raw":"[Karras et al., 2018] Tero Karras, Timo Aila, Samuli Laine, and Jaakko Lehtinen. Progressive growing of gans for improved qual- ity, stability, and variation. In ICLR, 2018.","title":"Progressive growing of gans for improved quality, stability, and variation","authors":"Tero Karras, Timo Aila, Samuli Laine, Jaakko Lehtinen","year":"2018","venue":"ICLR","doi":null,"url":null,"internal_url":null},{"position":23,"raw":"[Karras et al., 2019] Tero Karras, Samuli Laine, and Timo Aila. A style-based generator architecture for generative adversarial net- works. In CVPR, 2019.","title":"A style-based generator architecture for generative adversarial networks","authors":"Tero Karras, Samuli Laine, Timo Aila","year":"2019","venue":"CVPR","doi":null,"url":null,"internal_url":null},{"position":24,"raw":"[Li et al., 2021] Dongze Li, Wei Wang, Hongxing Fan, and Jing Dong. Exploring adversarial fake images on face manifold. In CVPR, 2021.","title":"Exploring adversarial fake images on face manifold","authors":"Dongze Li, Wei Wang, Hongxing Fan, Jing Dong","year":"2021","venue":"CVPR","doi":null,"url":null,"internal_url":null},{"position":25,"raw":"[Liang et al., 2023] Chumeng Liang, Xiaoyu Wu, Yang Hua, Jiaru Zhang, Yiming Xue, Tao Song, Zhengui Xue, Ruhui Ma, and Haibing Guan. Adversarial example does good: Preventing paint- ing imitation from diffusion models via adversarial examples. In ICML, 2023.","title":"Adversarial example does good: Preventing painting imitation from diffusion models via adversarial examples","authors":"Chumeng Liang, Xiaoyu Wu, Yang Hua, Jiaru Zhang, Yiming Xue, Tao Song, Zhengui Xue, Ruhui Ma, Haibing Guan","year":"2023","venue":"ICML","doi":null,"url":null,"internal_url":null},{"position":26,"raw":"[Lin et al., 2022] Yuzhen Lin, Han Chen, Emanuele Maiorana, Pa- trizio Campisi, and Bin Li. Source-id-tracker: Source face iden- tity protection in face swapping. In ICME, 2022.","title":"Source-id-tracker: Source face identity protection in face swapping","authors":"Yuzhen Lin, Han Chen, Emanuele Maiorana, Patrizio Campisi, Bin Li","year":"2022","venue":"ICME","doi":null,"url":null,"internal_url":null},{"position":27,"raw":"[Liu et al., 2022] Xinwei Liu, Jian Liu, Yang Bai, Jindong Gu, Tao Chen, Xiaojun Jia, and Xiaochun Cao. Watermark vaccine: Ad- versarial attacks to prevent watermark removal. In ECCV, 2022.","title":"Watermark vaccine: Adversarial attacks to prevent watermark removal","authors":"Xinwei Liu, Jian Liu, Yang Bai, Jindong Gu, Tao Chen, Xiaojun Jia, Xiaochun Cao","year":"2022","venue":"ECCV","doi":null,"url":null,"internal_url":null},{"position":28,"raw":"[Liu et al., 2023] Honggu Liu, Xiaodan Li, Wenbo Zhou, Han Fang, Paolo Bestagini, Weiming Zhang, Yuefeng Chen, Stefano Tubaro, Nenghai Yu, Yuan He, et al. Bifpro: A bidirectional facial-data protection framework against deepfake. In ACM MM, 2023.","title":"Bifpro: A bidirectional facial-data protection framework against deepfake","authors":"Honggu Liu, Xiaodan Li, Wenbo Zhou, Han Fang, Paolo Bestagini, Weiming Zhang, Yuefeng Chen, Stefano Tubaro, Nenghai Yu, Yuan He","year":"2023","venue":"ACM MM","doi":null,"url":null,"internal_url":null},{"position":29,"raw":"[Neekhara et al., 2022] Paarth Neekhara, Shehzeen Hussain, Xin- qiao Zhang, Ke Huang, Julian McAuley, and Farinaz Koushanfar. Facesigns: semi-fragile neural watermarks for media authentica- tion and countering deepfakes. arXiv preprint arXiv:2204.01960, 2022.","title":"Facesigns: semi-fragile neural watermarks for media authentication and countering deepfakes","authors":"Neekhara","year":"2022","venue":null,"doi":null,"url":null,"internal_url":null},{"position":30,"raw":"[Ojha et al., 2023] Utkarsh Ojha, Yuheng Li, and Yong Jae Lee. To- wards universal fake image detectors that generalize across gen- erative models. In CVPR, 2023.","title":"Towards universal fake image detectors that generalize across generative models","authors":"Utkarsh Ojha, Yuheng Li, Yong Jae Lee","year":"2023","venue":"CVPR","doi":null,"url":null,"internal_url":null},{"position":31,"raw":"[Poursaeed et al., 2018] Omid Poursaeed, Isay Katsman, Bicheng Gao, and Serge Belongie. Generative adversarial perturbations. In CVPR, 2018.","title":"Generative adversarial perturbations","authors":"Omid Poursaeed, Isay Katsman, Bicheng Gao, Serge Belongie","year":"2018","venue":"CVPR","doi":null,"url":null,"internal_url":null},{"position":32,"raw":"[Rossler et al., 2019] Andreas Rossler, Davide Cozzolino, Luisa Verdoliva, Christian Riess, Justus Thies, and Matthias Nießner. Faceforensics++: Learning to detect manipulated facial images. In ICCV, 2019.","title":"Faceforensics++: Learning to detect manipulated facial images","authors":"Andreas Rossler, Davide Cozzolino, Luisa Verdoliva, Christian Riess, Justus Thies, Matthias Nießner","year":"2019","venue":"ICCV","doi":null,"url":null,"internal_url":null},{"position":33,"raw":"[Shiohara and Yamasaki, 2022] Kaede Shiohara and Toshihiko Ya- masaki. Detecting deepfakes with self-blended images. In CVPR, 2022.","title":"Kaede Shiohara and Toshihiko Yamasaki. Detecting deepfakes with self-blended images","authors":"Yamasaki Shiohara","year":"2022","venue":"CVPR","doi":null,"url":null,"internal_url":null},{"position":34,"raw":"[Siarohin et al., 2019] Aliaksandr Siarohin, Stéphane Lathuilière, Sergey Tulyakov, Elisa Ricci, and Nicu Sebe. First order motion model for image animation. In NeurIPS, 2019.","title":"First order motion model for image animation","authors":"Aliaksandr Siarohin, Stéphane Lathuilière, Sergey Tulyakov, Elisa Ricci, Nicu Sebe","year":"2019","venue":"NeurIPS","doi":null,"url":null,"internal_url":null},{"position":35,"raw":"[Sun et al., 2022a] Pu Sun, Yuezun Li, Honggang Qi, and Siwei Lyu. Faketracer: Exposing deepfakes with training data contam- ination. In ICIP, 2022.","title":"Faketracer: Exposing deepfakes with training data contamination","authors":"Sun","year":"2022","venue":"ICIP","doi":null,"url":null,"internal_url":null},{"position":36,"raw":"[Sun et al., 2022b] Shangquan Sun, Wenqi Ren, Tao Wang, and Xi- aochun Cao. Rethinking image restoration for object detection. In NeurIPS, 2022.","title":"Rethinking image restoration for object detection","authors":"Sun","year":"2022","venue":"NeurIPS","doi":null,"url":null,"internal_url":null},{"position":37,"raw":"[Szegedy et al., 2014] Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. In ICLR, 2014.","title":"Intriguing properties of neural networks","authors":"Szegedy","year":"2014","venue":"ICLR","doi":null,"url":null,"internal_url":null},{"position":38,"raw":"[Tancik et al., 2020] Matthew Tancik, Ben Mildenhall, and Ren Ng. Stegastamp: Invisible hyperlinks in physical photographs. In CVPR, 2020.","title":"Stegastamp: Invisible hyperlinks in physical photographs","authors":"Matthew Tancik, Ben Mildenhall, Ren Ng","year":"2020","venue":"CVPR","doi":null,"url":null,"internal_url":null},{"position":39,"raw":"[Wang and Deng, 2021] Chengrui Wang and Weihong Deng. Rep- resentative forgery mining for fake face detection. In CVPR, 2021.","title":"Representative forgery mining for fake face detection","authors":"Wang, Deng, Chengrui Wang, Weihong Deng","year":"2021","venue":"CVPR","doi":null,"url":null,"internal_url":null},{"position":40,"raw":"[Wang et al., 2020] Sheng-Yu Wang, Oliver Wang, Richard Zhang, Andrew Owens, and Alexei A Efros. Cnn-generated images are surprisingly easy to spot... for now. In CVPR, 2020.","title":"Cnn-generated images are surprisingly easy to spot","authors":"Sheng-Yu Wang, Oliver Wang, Richard Zhang, Andrew Owens, Alexei A Efros","year":"2020","venue":"CVPR","doi":null,"url":null,"internal_url":null},{"position":41,"raw":"[Wang et al., 2021] Run Wang, Felix Juefei-Xu, Meng Luo, Yang Liu, and Lina Wang. Faketagger: Robust safeguards against deepfake dissemination via provenance tracking. In ACM MM, 2021.","title":"Faketagger: Robust safeguards against deepfake dissemination via provenance tracking","authors":"Wang","year":"2021","venue":"ACM MM","doi":null,"url":null,"internal_url":null},{"position":42,"raw":"[Wang et al., 2022a] Run Wang, Ziheng Huang, Zhikai Chen, Li Liu, Jing Chen, and Lina Wang. Anti-forgery: Towards a stealthy and robust deepfake disruption attack via adversarial perceptual-aware perturbations. In IJCAI, 2022.","title":"Anti-forgery: Towards a stealthy and robust deepfake disruption attack via adversarial perceptual-aware perturbations","authors":"Wang","year":"2022","venue":"IJCAI","doi":null,"url":null,"internal_url":"/proceedings/2022/107"},{"position":43,"raw":"[Wang et al., 2022b] Xueyu Wang, Jiajun Huang, Siqi Ma, Surya Nepal, and Chang Xu. Deepfake disrupter: The detector of deep- fake is my friend. In CVPR, 2022.","title":"Deepfake disrupter: The detector of deepfake is my friend","authors":"Wang","year":"2022","venue":"CVPR","doi":null,"url":null,"internal_url":null},{"position":44,"raw":"[Wang et al., 2023] Tianyi Wang, Mengxiao Huang, Harry Cheng, Bin Ma, and Yinglong Wang. Robust identity perceptual watermark against deepfake face swapping. arXiv preprint arXiv:2311.01357, 2023.","title":"Robust identity perceptual watermark against deepfake face swapping","authors":"Tianyi Wang, Mengxiao Huang, Harry Cheng, Bin Ma, Yinglong Wang","year":"2023","venue":null,"doi":null,"url":null,"internal_url":null},{"position":45,"raw":"[Wu et al., 2023] Xiaoshuai Wu, Xin Liao, and Bo Ou. Sepmark: Deep separable watermarking for unified source tracing and deepfake detection. In ACM MM, 2023.","title":"Sepmark: Deep separable watermarking for unified source tracing and deepfake detection","authors":"Xiaoshuai Wu, Xin Liao, Bo Ou","year":"2023","venue":"ACM MM","doi":null,"url":null,"internal_url":null},{"position":46,"raw":"[Xiao et al., 2018] Chaowei Xiao, Bo Li, Jun-Yan Zhu, Warren He, Mingyan Liu, and Dawn Song. Generating adversarial examples with adversarial networks. In IJCAI, 2018.","title":"Generating adversarial examples with adversarial networks","authors":"Chaowei Xiao, Bo Li, Jun-Yan Zhu, Warren He, Mingyan Liu, Dawn Song","year":"2018","venue":"IJCAI","doi":null,"url":null,"internal_url":"/proceedings/2018/543"},{"position":47,"raw":"[Xie et al., 2020] Cihang Xie, Mingxing Tan, Boqing Gong, Jiang Wang, Alan L Yuille, and Quoc V Le. Adversarial examples improve image recognition. In CVPR, 2020.","title":"Adversarial examples improve image recognition","authors":"Cihang Xie, Mingxing Tan, Boqing Gong, Jiang Wang, Alan L Yuille, Quoc V Le","year":"2020","venue":"CVPR","doi":null,"url":null,"internal_url":null},{"position":48,"raw":"[Xiong et al., 2023] Cheng Xiong, Chuan Qin, Guorui Feng, and Xinpeng Zhang. Flexible and secure watermarking for latent dif- fusion model. In ACM MM, 2023.","title":"Flexible and secure watermarking for latent diffusion model","authors":"Cheng Xiong, Chuan Qin, Guorui Feng, Xinpeng Zhang","year":"2023","venue":"ACM MM","doi":null,"url":null,"internal_url":null},{"position":49,"raw":"[Yu et al., 2021] Ning Yu, Vladislav Skripniuk, Sahar Abdelnabi, and Mario Fritz. Artificial fingerprinting for generative models: Rooting deepfake attribution in training data. In ICCV, 2021.","title":"Artificial fingerprinting for generative models: Rooting deepfake attribution in training data","authors":"Yu","year":"2021","venue":"ICCV","doi":null,"url":null,"internal_url":null},{"position":50,"raw":"[Yu et al., 2023] Chong Yu, Tao Chen, and Zhongxue Gan. Adver- sarial amendment is the only force capable of transforming an enemy into a friend. In IJCAI, 2023.","title":"Adversarial amendment is the only force capable of transforming an enemy into a friend","authors":"Chong Yu, Tao Chen, Zhongxue Gan","year":"2023","venue":"IJCAI","doi":null,"url":null,"internal_url":"/proceedings/2023/503"},{"position":51,"raw":"[Zhang et al., 2018] Richard Zhang, Phillip Isola, Alexei A Efros, Eli Shechtman, and Oliver Wang. The unreasonable effectiveness of deep features as a perceptual metric. In CVPR, 2018.","title":"The unreasonable effectiveness of deep features as a perceptual metric","authors":"Richard Zhang, Phillip Isola, Alexei A Efros, Eli Shechtman, Oliver Wang","year":"2018","venue":"CVPR","doi":null,"url":null,"internal_url":null},{"position":52,"raw":"[Zhang et al., 2024a] Xuanyu Zhang, Runyi Li, Jiwen Yu, Youmin Xu, Weiqi Li, and Jian Zhang. Editguard: Versatile image wa- termarking for tamper localization and copyright protection. In CVPR, 2024.","title":"Editguard: Versatile image watermarking for tamper localization and copyright protection","authors":"Zhang","year":"2024","venue":"CVPR","doi":null,"url":null,"internal_url":null},{"position":53,"raw":"[Zhang et al., 2024b] Yunming Zhang, Dengpan Ye, Caiyun Xie, Long Tang, Xin Liao, Ziyi Liu, Chuanxi Chen, and Jiacheng Deng. Dual defense: Adversarial, traceable, and invisible robust watermarking against face swapping. IEEE TIFS, 2024.","title":"Dual defense: Adversarial, traceable, and invisible robust watermarking against face swapping","authors":"Zhang","year":"2024","venue":"IEEE TIFS","doi":null,"url":null,"internal_url":null},{"position":54,"raw":"[Zhao et al., 2021] Hanqing Zhao, Wenbo Zhou, Dongdong Chen, Tianyi Wei, Weiming Zhang, and Nenghai Yu. Multi-attentional deepfake detection. In CVPR, 2021.","title":"Multi-attentional deepfake detection","authors":"Hanqing Zhao, Wenbo Zhou, Dongdong Chen, Tianyi Wei, Weiming Zhang, Nenghai Yu","year":"2021","venue":"CVPR","doi":null,"url":null,"internal_url":null},{"position":55,"raw":"[Zhao et al., 2023a] Xuandong Zhao, Kexun Zhang, Yu-Xiang Wang, and Lei Li. Generative autoencoders as watermark at- tackers: Analyses of vulnerabilities and threats. arXiv preprint arXiv:2306.01953, 2023.","title":"Generative autoencoders as watermark attackers: Analyses of vulnerabilities and threats","authors":"Zhao","year":"2023","venue":null,"doi":null,"url":null,"internal_url":null},{"position":56,"raw":"[Zhao et al., 2023b] Yuan Zhao, Bo Liu, Ming Ding, Baoping Liu, Tianqing Zhu, and Xin Yu. Proactive deepfake defence via iden- tity watermarking. In WACV, 2023.","title":"Proactive deepfake defence via identity watermarking","authors":"Zhao","year":"2023","venue":"WACV","doi":null,"url":null,"internal_url":null},{"position":57,"raw":"[Zhao et al., 2023c] Zhengyu Zhao, Hanwei Zhang, Renjue Li, Ro- nan Sicre, Laurent Amsaleg, Michael Backes, Qi Li, and Chao Shen. Revisiting transferable adversarial image examples: Attack categorization, evaluation guidelines, and new insights. arXiv preprint arXiv:2310.11850, 2023.","title":"Revisiting transferable adversarial image examples: Attack categorization, evaluation guidelines, and new insights","authors":"Zhao","year":"2023","venue":null,"doi":null,"url":null,"internal_url":null},{"position":58,"raw":"[Zhu et al., 2018] Jiren Zhu, Russell Kaplan, Justin Johnson, and Li Fei-Fei. Hidden: Hiding data with deep networks. In ECCV, 2018.","title":"Hidden: Hiding data with deep networks","authors":"Zhu","year":"2018","venue":"ECCV","doi":null,"url":null,"internal_url":null},{"position":59,"raw":"[Zhu et al., 2023] Yao Zhu, Yuefeng Chen, Xiaodan Li, Rong Zhang, Xiang Tian, Bolun Zheng, and Yaowu Chen. Information- containing adversarial perturbation for combating facial manipu- lation systems. IEEE TIFS, 2023.","title":"Informationcontaining adversarial perturbation for combating facial manipulation systems","authors":"Yao Zhu, Yuefeng Chen, Xiaodan Li, Rong Zhang, Xiang Tian, Bolun Zheng, Yaowu Chen","year":"2023","venue":"IEEE TIFS","doi":null,"url":null,"internal_url":null}],"license_note":"Copyright International Joint Conferences on Artificial Intelligence."}