RecoverMark：面向篡改人脸定位与恢复的鲁棒水印
RecoverMark: Robust Watermarking for Localization and Recovery of Manipulated Faces
把被保护的人脸内容本身当作水印嵌入背景，并配合模拟去水印攻击的失真层与渐进式两阶段训练，使水印在全局不可见攻击下仍可提取；做篡改定位/取证或需要版权与完整性保护的视觉工作可直接复用这一「内容即水印」的鲁棒嵌入范式。
原文依据 RecoverMark treats the protected face content itself as the watermark and embeds it into the surrounding background.
摘要译文
由模型翻译 · 术语统一 · 请对照原文核对关键结论AI 生成内容（AIGC）的泛滥助长了精细的人脸篡改，严重破坏视觉完整性，并对知识产权（IP）构成前所未有的挑战。对此，一种常见的主动防御利用脆弱水印来检测、定位甚至恢复被篡改区域。然而，这些方法通常假设攻击者并不知晓嵌入的水印，忽视了其对去水印攻击的固有脆弱性。此外，在常用的双水印策略（额外加入一个用于图像所有权验证的鲁棒水印）中，这种脆弱性会被进一步加剧：相互干扰与有限的嵌入容量降低了脆弱水印的有效性。为弥补这一空白，我们提出 RecoverMark，一个同时实现鲁棒篡改定位、内容恢复与所有权验证的水印框架。我们的核心洞见有两点。第一，我们利用一个关键的现实约束：即使攻击者施加全局的、不可察觉的去水印攻击，也必须保持背景的语义一致性以避免被视觉察觉。第二，使用图像自身的内容（本文中为人脸）作为水印可增强提取的鲁棒性。基于上述洞见，RecoverMark 将被保护的人脸内容本身作为水印，并将其嵌入周围背景中。通过设计鲁棒的两阶段训练范式，配合精心构造、可模拟各类潜在攻击的失真层以及渐进式训练策略，RecoverMark 以非脆弱的方式实现鲁棒的水印嵌入，同时完成图像篡改定位、恢复与图像知识产权保护。大量实验表明，所提出的 RecoverMark 对已见与未见攻击均具有鲁棒性，并对分布内（ID）与分布外（OOD）数据具有泛化能力。
英文原文摘要 1933 字符
The proliferation of AI-generated content (AIGC) has facilitated sophisticated face manipulation, severely undermining visual integrity and posing unprecedented challenges to intellectual property (IP). In response, a common proactive defense leverages fragile watermarks to detect, localize, or even recover manipulated regions. However, these methods always assume an adversary unaware of the embedded watermark, overlooking their inherent vulnerability to watermark removal attacks. Furthermore, this fragility is exacerbated in the commonly used dual-watermark strategy that adds a robust watermark for image ownership verification, where mutual interference and limited embedding capacity reduce the fragile watermark's effectiveness.To address the gap, we propose RecoverMark, a watermarking framework that achieves robust manipulation localization, content recovery, and ownership verification simultaneously. Our key insight is twofold. First, we exploit a critical real-world constraint: an adversary must preserve the background's semantic consistency to avoid visual detection, even if they apply global, imperceptible watermark removal attacks. Second, using the image's own content (face, in this paper) as the watermark enhances extraction robustness. Based on these insights, RecoverMark treats the protected face content itself as the watermark and embeds it into the surrounding background. By designing a robust two-stage training paradigm with carefully crafted distortion layers that simulate comprehensive potential attacks and a progressive training strategy, RecoverMark achieves a robust watermark embedding in no fragile manner for image manipulation localization, recovery, and image IP protection simultaneously. Extensive experiments demonstrate the proposed RecoverMark's robustness against both seen and unseen attacks and its generalizability to in-distribution (ID) and out-of-distribution (OOD) data.