Статьи
Tracing Stolen Faces: Watermarks Against Deepfake Porn
28.09.2026
When a face-swap application maps an innocent photograph onto explicit material, the first casualty is provenance. Standard copyright metadata—EXIF tags, IPTC records—vanishes during the app’s export process. Victims and rights holders are left with an untraceable derivative. Digital watermarks offer a technical retort to this erasure. Unlike metadata, a well-constructed watermark binds ownership information directly into the image pixels, surviving the operations that strip file headers.
The mechanics of face-swap manipulation
Face-swap utilities do not merely paste one image over another. They perform complex geometric warping, colour grading, and frequency blending to match lighting and skin textures. The output is then compressed, often heavily, for distribution on social platforms or illicit forums. Each step—cropping the facial bounding box, resizing, rotation, JPEG compression—acts as a filter designed to destroy auxiliary data. Fragile copyright markers embedded in spatial domains or attached as file headers rarely survive this pipeline. The derivative image is structurally distinct from the source, making traditional hash-matching (like MD5 or SHA-256) entirely ineffective.
What digital watermarks actually do
A digital watermark modifies the pixel values of an image according to a specific algorithm, embedding a payload—typically a hash, an identifier, or a copyright notice—that remains detectable under duress. There are two primary categories relevant to copyright defence:
- Visible watermarks: Overlays of text or logos. While they assert ownership, face-swap apps routinely use inpainting tools to remove them before swapping the face, rendering them useless for post-hoc identification. They also degrade the commercial value of the source image.
- Imperceptible watermarks: Alterations embedded in the frequency domain. Using mathematical transforms such as the Discrete Cosine Transform (DCT) or Discrete Wavelet Transform (DWT), the payload is encoded into the mid-range frequencies of the image. High frequencies are lost during compression; low frequencies dictate broad visual features and cannot be altered without visible distortion. Mid-range frequencies survive both compression and standard geometric transformations, allowing the hidden signal to persist even when the image looks untouched to the human eye.
Surviving the deepfake pipeline
For a watermark to protect against face-swap derivatives, it must be robust. Robustness here is a carefully qualified term. It does not mean invincibility. It means the detector can extract the payload—or even a partial, verifiable fragment of it—after specific, foreseeable manipulations.
When a face-swap app processes a source image, it isolates the face. A watermark confined to the background is lost. Therefore, effective watermarking for portrait photography must distribute the signal across the entire image, or specifically weight the facial region. If the payload survives the crop, the warping, and the final compression, a platform or rights holder can scan the explicit output, extract the original identifier, and trace the source photograph. This traceability is vital for copyright enforcement, especially in jurisdictions where non-consensual intimate imagery (NCII) laws are lacking but copyright statutes provide a mechanism for takedown.
The legal intersection of copyright and deepfakes
Copyright law provides a distinct, often faster remedy for victims of face-swap pornography compared to criminal statutes against harassment or revenge porn. The original photographer—or the subject, if they hold the copyright—can issue takedown notices under frameworks like the Digital Millennium Copyright Act (DMCA) or the EU's Digital Services Act (DSA). However, these mechanisms require a claim of ownership. When a face-swap app strips metadata and alters the image, proving ownership becomes legally contentious. A surviving digital watermark transforms this dynamic. It provides an objective, mathematical assertion of origin. While a legal adversary might argue the watermark was fabricated, the burden of proof shifts, and the watermark offers a stronger foundation than mere testimony. Still, copyright is an imperfect shield for personal dignity; it protects the economic rights of the creator, not necessarily the privacy rights of the subject, unless the subject is the copyright holder.
Practical checks for copyright and identity
Creators, victims, and platform moderators can take specific, actionable steps to leverage watermarked media. The process requires preparation before the image is published and verification after a derivative is discovered.
- Pre-emptive embedding: Photographers should apply imperceptible, robust watermarks using established toolkits before publishing portraits online. Relying on platform-native watermarking is insufficient; platforms routinely strip their own watermarks when content is downloaded or processed by third-party apps.
- Extraction over detection: A detection tool that merely flags "watermark present" is inadequate for copyright claims. The extraction process must yield the specific payload—the unique image ID or creator signature—to prove provenance. Without the extracted payload matching a known record, the presence of a watermark proves nothing.
- Hash verification: Link the extracted payload to a timestamped hash stored on a decentralised ledger or a secure, independent database. The extracted ID must match the original record to establish a chain of custody. If the source image was watermarked in 2022, and the deepfake appears in 2024, the timestamp proves the source preceded the derivative.
- Platform integration: Hosting platforms facing NCII can implement automated extraction scanners. If a face-swap porn output yields a watermark payload registered to a non-pornographic source, the platform can automate takedowns or flag the content for review. This shifts the moderation burden from subjective visual review to cryptographic verification.
Inherent limitations and realistic expectations
Digital watermarks are an evidentiary tool, not a preventative shield. They do not stop a face-swap app from generating the image. They only assist in identifying the source after the fact. Furthermore, the technology operates within an active arms race, and its efficacy is bounded by several constraints.
Adversarial attacks pose a significant threat. Specialised neural networks can be trained to estimate and subtract frequency-domain watermarks. If an attacker applies an adversarial perturbation before feeding the image into a face-swap app, the watermark may be destroyed by design. The certainty of extraction drops significantly when facing a determined, technically proficient adversary.
Resolution limits also dictate success. Face-swap apps often source low-resolution inputs from social media profiles. If the source image lacks sufficient pixel density, the frequency domain lacks the capacity to hold a robust payload. A tiny, heavily compressed profile picture offers minimal space for embedding; any watermark applied may be irreparably damaged by a single resize operation.
Additionally, watermarking standards remain fragmented. Proprietary algorithms from different vendors often cannot read each other's payloads. Without interoperability, a victim relying on one tool may find a platform's scanner using an incompatible system, severing the evidentiary chain. The absence of a universal standard undermines the collective utility of the technology.
A measured path forward
Relying on digital watermarks to combat face-swap pornography requires acknowledging their precise utility. They establish a mathematical link between a derivative work and its source, bypassing the metadata stripping inherent to deepfake pipelines. They provide a mechanism for rights holders to assert copyright when personality rights laws fail. Yet, they fail against targeted adversarial scrubbing and cannot prevent the initial abuse. For copyright holders and victims, the sensible approach combines robust, frequency-domain watermarking with secure, independent payload registries. The watermark does not erase the harm; it merely provides the technical evidence required to assert a copyright claim or request an enforceable takedown.
