A Valid Watermark Is Not a Valid Identity: Spatial-Spectral Adversarial Face Evasion with Watermark Preservation

Summary

Researchers introduce a watermark-preserving face evasion attack, PGD-L_2, that works black-box against facial image watermarking without access to the watermarking components. It adds spatial and spectral preservation terms to reduce face-recognition similarity while keeping pixel distortion and high-frequency changes low so hidden watermarks survive. Tested on two watermarking schemes, two face-recognition models and two datasets, it reached evasion rates above 92% and kept watermark recovery above 93% (StegaFormer) and 99.7% (FaceSigns) at 47dB PSNR, exposing a gap in watermark-based facial certification.

Related items

• InfoDecisionRobust: Benchmarking Robustness for JEV Style Decision Models Across Text and VisionSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoAIRRI: Towards a Human-Readable, Machine-Resistant Reading InterfaceSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoLimits of Statistical Assurance for Embodied and Agentic AI under Adaptive AdversariesSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoSame Attack, Different Judge: A First Controlled Adversarial Comparison of Jev, LLM Judges, and Purpose-Built Safety ClassifiersSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoCircuitBreak: Pruning a Sparse Safety Circuit of NeuronsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)