RecoverMark: Robust Watermarking for Localization and Recovery of Manipulated Faces

2026-02-24

AI Summary

Existing fragile watermarking schemes are vulnerable to removal by informed attackers, and dual-watermark strategies often suffer from mutual interference between robustness and fragility, making it challenging to simultaneously achieve tamper localization, content recovery, and copyright verification. This work proposes RecoverMark, a novel framework that innovatively embeds the facial content itself as a watermark into the background. By leveraging semantic consistency constraints between background and face regions and employing a two-stage progressive training scheme, RecoverMark unifies robust tamper localization, high-quality content restoration, and image copyright authentication—without relying on conventional fragile watermarks. The method demonstrates strong robustness against both known and unknown attacks and generalizes effectively to both in-distribution and out-of-distribution data, significantly outperforming existing watermarking techniques.

Technology Category

• Computer Vision: Adversarial Attacks & Robustness
• Machine Learning: Adversarial Learning & Robustness
• Natural Language Processing: Safety and Robustness

Application Category

• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking
• Web Mining and Content Analysis: Robustness and generalizability of Web mining methods

Abstract

The proliferation of AI-generated content has facilitated sophisticated face manipulation, severely undermining visual integrity and posing unprecedented challenges to intellectual property. In response, a common proactive defense leverages fragile watermarks to detect, localize, or even recover manipulated regions. However, these methods always assume an adversary unaware of the embedded watermark, overlooking their inherent vulnerability to watermark removal attacks. Furthermore, this fragility is exacerbated in the commonly used dual-watermark strategy that adds a robust watermark for image ownership verification, where mutual interference and limited embedding capacity reduce the fragile watermark's effectiveness. To address the gap, we propose RecoverMark, a watermarking framework that achieves robust manipulation localization, content recovery, and ownership verification simultaneously. Our key insight is twofold. First, we exploit a critical real-world constraint: an adversary must preserve the background's semantic consistency to avoid visual detection, even if they apply global, imperceptible watermark removal attacks. Second, using the image's own content (face, in this paper) as the watermark enhances extraction robustness. Based on these insights, RecoverMark treats the protected face content itself as the watermark and embeds it into the surrounding background. By designing a robust two-stage training paradigm with carefully crafted distortion layers that simulate comprehensive potential attacks and a progressive training strategy, RecoverMark achieves a robust watermark embedding in no fragile manner for image manipulation localization, recovery, and image IP protection simultaneously. Extensive experiments demonstrate the proposed RecoverMark's robustness against both seen and unseen attacks and its generalizability to in-distribution and out-of-distribution data.

Problem

• watermark removal attacks
• fragile watermark
• face manipulation
• dual-watermark interference
• visual integrity

Innovation

• robust watermarking
• face manipulation localization
• content recovery
• ownership verification
• adversarial robustness