A Valid Watermark Is Not a Valid Identity: Spatial-Spectral Adversarial Face Evasion with Watermark Preservation

• Watermark evaluations mainly measure recovery or manipulation detection, not whether the same watermarked image remains reliable for biometric recognition.Source: §1 · p. 1
• The studied failure is a decoder-success, recognizer-rejection case: the watermark remains recoverable while the image no longer matches its enrollment template.To a human examiner, the image can still look like the same person.Source: §1 · pp. 1–2
• Semi-fragile schemes target structural changes such as swaps or deepfakes, while small adversarial perturbations may resemble benign degradation to the decoder.The image can therefore remain traceable even as its biometric content is compromised.Source: §1 · p. 2
• Unlike work that alters watermarking, this attack starts from an already-watermarked image and treats the watermark system as a black box.The threat model assumes white-box access to face recognition and leaves transfer to unseen recognizers for future work.Source: §1 · p. 2
• The study evaluates a watermark-preserving PGD-L2 attack across two watermark-capacity regimes, two controlled face datasets, and two face-recognition models.It concludes that watermark validity and biometric identity are independent properties.Source: §1 · p. 2

• Neural watermarking balances imperceptibility, robustness, payload, and recovery; facial schemes support authentication, forensics, tracing, and manipulation detection [33] [24] [14] [29] [20] [26].WAVES [1] and W-Bench [17] evaluate watermark survival, but not biometric recognition reliability of the same image.Source: §2 · p. 2
• Face-recognition attacks and defenses show that facial representations can be disrupted, but do not test whether watermark recovery survives attacks on already-watermarked images [10] [19] [6] [25].Source: §2 · pp. 2–3
• Active-protection methods inject adversarial or watermark-like signals during embedding, whereas this work perturbs an existing watermark without access to its encoder, decoder, or message [11] [2] [32] [27] [28].The setting is downstream biometric evasion, not manipulation prevention or watermark optimization.Source: §2 · p. 3

3.1 Problem Formulation and Threat Model

• The threat model watermarks only the probe, then applies a face-region-masked L2 perturbation to reduce its verification score while keeping the watermark system black-box.The recognizer is white-box, and watermark recovery cannot be optimized directly because the encoder, decoder, and message are unavailable.Source: §3.1 · p. 3

3.2 Baseline PGD-L2 Evasion Attack

• The baseline PGD-L2 attack minimizes a hinge loss on template–probe cosine similarity, using masked gradient updates projected onto an L2 ball.It has no watermark-related term, so any recovery change reflects biometric evasion alone.Source: §3.2 · pp. 3–4

3.3 PGD-L2 with Spatial–Spectral Preservation

• The proposed attack combines biometric evasion with spatial and frequency-domain penalties, applying a masked perturbation without querying the watermark decoder.Its frequency-selective quadratic penalty assigns greater cost to high-frequency changes, where hidden watermark residuals may be sensitive to interference.Source: §3.3 · pp. 4–5, Figure 1 · p. 4

4 Experimental Protocol

• 831 CFD probes and 102 FaceLab London probes form mated pairs from 158 and 102 identities, respectively; only probes are watermarked and attacked.Templates remain unchanged, and paired images share identity while differing mainly in expression.Source: §4 · p. 5
• Two recognition models, ArcFace and FaceNet, evaluate evasion after MTCNN detection, landmark-based alignment, and fixed detected-region masks during each attack.The perturbation is optimized in the image domain, with gradients propagated through differentiable recognition preprocessing.Source: §4 · p. 5
• FaceSigns embeds 128-bit messages, while StegaFormer is evaluated at 1 bpp; each identity receives a unique message embedded consistently across its probes.Probe images are resized to 256 × 256 before embedding.Source: §4 · p. 5
• PGD-L2 budgets are ϵ2 ∈{0.5, 1.0, 2.0, 3.0}; the baseline uses 80 steps without preservation terms, while the proposed spatial–spectral attack uses 180.Preservation weights λspa and λspe vary to examine trade-offs among evasion, visual fidelity, and watermark recovery; λadv = 1 unless otherwise stated.Source: §4 · p. 6
• Evaluation jointly measures ASR, PSNR, and watermark bit accuracy; ASR counts mated pairs accepted before but rejected after attack at dataset- and model-specific thresholds.Operating points correspond to FAR=1% and FAR=0.1%; thresholds are estimated from pre-attack non-mated scores, and attack PSNR compares adversarial and original watermarked images.Source: §4 · p. 6

5 Results

• The evaluation measures biometric evasion with ASR at FAR=1% and FAR=0.1%, visual fidelity with PSNR, and watermark recovery with BAR.Before attacks, StegaFormer BAR ranges from 99.58% to 99.98%, and FaceSigns BAR from 99.91% to 99.99%.Source: §5 · p. 6

5.1 Baseline PGD-L2 attack

• At ε2=2.0, baseline ASR0.1 exceeds 96% in all configurations, while FaceSigns BAR remains above 99.7% across baseline configurations.Table 1 reports the baseline white-box PGD-L2 results on CFD and FaceLab London.Source: §5.1 · p. 6, Table 1 · p. 7

5.2 Proposed attack with spatial–spectral terms

• For FaceSigns, BAR remains above 99.7% in every proposed configuration and ASR0.1 reaches 100% for ε2 ≥2.0, though the spectral term slightly degrades BAR at those budgets.The spectral constraint permits changes in low- and mid-frequency bands where FaceSigns introduces visible artifacts.Source: §5.2 · pp. 7–8
• For StegaFormer on CFD at ε2=2.0, spatial–spectral preservation raises BAR from 89.49% to 94.53% for ArcFace and from 92.53% to 97.55% for FaceNet.At ε2=2.0, ASR0.1 remains at least 96.2% on CFD for ArcFace and 100% for FaceNet; all FaceLab London configurations reach 100%.Source: Table 2 · p. 7, §5.2 · p. 8

5.3 The watermark–identity gap

• At ε2 ≥2.0, evasion exceeds 92% at FAR=0.1% while BAR stays above 93% for StegaFormer and above 99% for FaceSigns; at ε2=2.0, PSNR exceeds 47 dB.Figure 3 shows examples at ε2=2.0 against ArcFace on CFD and FaceLab London.Source: Figure 3 · p. 9, §5.3 · p. 9
• FaceSigns exhibits the gap even under baseline PGD, while StegaFormer’s denser payload is more sensitive to perturbations and benefits from spatial–spectral regularization.The results support treating provenance and biometric identity as independent properties.Source: §5.1 · p. 7, §5.3 · p. 9

6 Conclusions

• Across two controlled face datasets, two watermarking architectures, and two face-recognition models, the attack achieves high evasion while preserving high watermark recovery and visual quality.The evaluated setting shows that traceability can persist while face verification becomes unreliable.Source: §6 · p. 9
• FaceSigns remains almost perfectly recoverable under standard PGD, while spatial–spectral regularization substantially improves StegaFormer BAR and maintains high attack success.StegaFormer recovery is more sensitive to adversarial perturbations because of its higher payload density.Source: §6 · p. 9
• The evaluated watermarking models were not designed to resist this threat, and the attack assumes white-box access to the face-recognition model.Transferability to unseen recognition models remains future work.Source: §6 · p. 10
• The perturbation is designed to remain below semi-fragile detection thresholds, motivating further study of defenses that rely solely on watermark fragility.The paper calls for integrated defenses that assess provenance preservation and biometric consistency under adversarial conditions.Source: §6 · p. 10