Mutual Effects of Face-Swap Deepfakes and Digital Watermarking—A Region-Aware Study

Abstract

Highlights: What are the main findings? Region-aware evaluation across visible and invisible watermarks with tunable strength and six face-swap families shows that edits are non-local and non-monotonic—background changes introduced by generators even degrade watermarks that are far from the face, and retention does not vary linearly with embedding strength. A locality-preserving baseline bounds the minimal impact—architectures that better confine edits to the facial region, typically those with segmentation-weighted objectives, preserve background watermark signal more reliably than globally trained GAN pipelines. What are the implications of the main findings? Classical robustness tests for watermarking are not sufficient on their own—evaluation should include generator-induced transformations from face swap and report region-wise metrics for face and background. Watermark strength and placement should be selected in an architecture-aware manner—in our sweeps, appropriately tuned invisible marks achieved higher background correlation under manipulation than visible overlays at comparable perceptual distortion. Face swapping is commonly assumed to act locally on the face region, which motivates placing watermarks away from the face to preserve the integrity of the face. We demonstrate that this assumption is violated in practice. Using a region-aware protocol with tunable-strength visible and invisible watermarks and six face-swap families, we quantify both identity transfer and watermark retention on the VGGFace2 dataset. First, edits are non-local—generators alter background statistics and degrade watermarks even far from the face, as measured by background-only PSNR and Pearson correlation relative to a locality-preserving baseline. Second, dependencies between watermark strength, identity transfer, and retention are non-monotonic and architecture-dependent. Methods that better confine edits to the face—typically those employing segmentation-weighted objectives—preserve background signal more reliably than globally trained GAN pipelines. At comparable perceptual distortion, invisible marks tuned to the background retain higher correlation with the background than visible overlays. These findings indicate that classical robustness tests are insufficient alone—watermark evaluation should report region-wise metrics and be strength- and architecture-aware.