Uncovering and Mitigating Destructive Multi-Embedding Attacks in Deepfake Proactive Forensics

With the rapid evolution of deepfake technologies and the wide dissemination of digital media, personal privacy is facing increasingly serious security threats. Deepfake proactive forensics, which involves embedding imperceptible watermarks to enable reliable source tracking, serves as a crucial defense against these threats. Although existing methods show strong forensic ability, they rely on an idealized assumption of single watermark embedding, which proves impractical in real-world scenarios. In this paper, we formally define and demonstrate the existence of Multi-Embedding Attacks (MEA) for the first time. When a previously protected image undergoes additional rounds of watermark embedding, the original forensic watermark can be destroyed or removed, rendering the entire proactive forensic mechanism ineffective. To address this vulnerability, we propose a general training paradigm named Adversarial Interference Simulation (AIS). Rather than modifying the network architecture, AIS explicitly simulates MEA scenarios during fine-tuning and introduces a resilience-driven loss function to enforce the learning of sparse and stable watermark representations. Our method enables the model to maintain the ability to extract the original watermark correctly even after a second embedding. Extensive experiments demonstrate that our plug-and-play AIS training paradigm significantly enhances the robustness of various existing methods against MEA.

Key Contributions

• First formal definition and empirical validation of Multi-Embedding Attacks (MEA), showing they render existing proactive forensics methods completely ineffective by overwriting the original forensic watermark
• Adversarial Interference Simulation (AIS): a model-agnostic fine-tuning paradigm that explicitly simulates MEA and uses a resilience loss to enforce sparse, stable watermark representations
• Plug-and-play integration with state-of-the-art deepfake proactive forensics methods, significantly improving their robustness against MEA without architectural changes

🛡️ Threat Analysis

Details

Similar Papers