Media Watermarking, Security, and Forensics 2026 Program
Excel to HTML
MONDAY 2 MARCH 2026
Watermarking and Fingerprinting
Session Chair: Adnan Alattar, Digimarc Corporation
08:30 - 10:30
Harbour A
08:30MWSF-307
Defining cost function of steganography with large language models, Hanzhou Wu, Shanghai University (China (Mainland)); Yige Wang, Shanghai University (China (Mainland)) [view abstract]
We make the first attempt towards defining cost function of steganography with large language models (LLMs), which is totally different from previous works that rely heavily on expert knowledge or require large-scale data for cost learning. To achieve this goal, a two-stage strategy combining LLM-guided program synthesis with evolutionary search is applied in the proposed method. In the first stage, a certain number of cost functions in the form of computer program are synthesized from LLM responses to structured prompts. These cost functions are then evaluated with pretrained steganalysis models so that candidate cost functions suited to steganography can be collected. In the second stage, by retraining a steganalysis model for each candidate cost function, the optimal cost function can be determined according to the detection accuracy. This two-stage strategy is performed by an iterative fashion so that the best cost function is determined at the latest iteration. Experimental results show that the proposed method enables LLMs to design new cost functions of steganography that significantly outperform existing works in terms of resisting steganalysis tools, which verifies the superiority of the proposed method. To the best knowledge of the authors, this is the first work applying LLMs to the design of advanced cost function of steganography, which provides a novel perspective on steganography design and may shed light on further research.
08:50MWSF-308
Task migration resistant watermarking for natural language encoders, Yijia Xu, Shanghai University (China (Mainland)); Gejian Zhao, Shanghai University (China (Mainland)); Hanzhou Wu, Shanghai University (China (Mainland)); Xinpeng Zhang, Shanghai University (China (Mainland)) [view abstract]
Protecting the intellectual property of natural language encoders faces a critical challenge: existing watermarks are often erased when models are fine-tuned for downstream applications, a process known as task migration. To address this problem, we introduce a Task Migration Resistant Watermarking (TMRW) framework to ensure watermark durability against fine-tuning. Our method employs a dual-objective fine-tuning strategy based on contrastive learning. In the watermark embedding stage, a specialized watermark loss function is introduced to systematically pull the embeddings of a secret trigger corpus towards the embedding of a predefined target sentence. To counteract the potential performance degradation introduced by this process, an augmented contrastive loss is simultaneously optimized to preserve the encoder's general semantic representation abilities. This dual-objective strategy is further enhanced by a novel trigger corpus crafting method that ensures the watermark's stealthiness. Experimental results show that the proposed method enables the embedding of a robust watermark that significantly outperforms existing techniques in resisting erasure from task migration. This work systematically solves the challenge of encoder watermark's durability against task migration, which provides a novel and practical framework for intellectual property protection in modern NLP systems.
09:10MWSF-309
Unveiling the hidden model fingerprints in API-protected LLMs, Zhiguang Yang, Shanghai University (China (Mainland)); Hanzhou Wu, Shanghai University (China (Mainland)) [view abstract]
Recent advances confirm that large language models (LLMs) can achieve state-of-the-art performance across many tasks. However, due to the resource-intensive nature of training LLMs from scratch, it is urgent and crucial to protect the intellectual property of LLMs against infringement. This has motivated the authors in this paper to propose a novel black-box fingerprinting technique for LLMs. We firstly demonstrate that the outputs of LLMs span a unique vector space associated with each model. We model the problem of fingerprint authentication as the task of evaluating the similarity between the space of the victim model and the space of the suspect model. To tackle with this problem, we introduce two solutions: the first determines whether suspect outputs lie within the victim's subspace, enabling fast infringement detection; the second reconstructs a joint subspace to detect models modified via parameter-efficient fine-tuning (PEFT). Experiments indicate that the proposed method achieves superior performance in fingerprint verification and robustness against the PEFT attacks. This work reveals inherent characteristics of LLMs and provides a promising solution for protecting LLMs, ensuring efficiency, generality and practicality.
09:30MWSF-310
A practical approach to traitor tracing in environments with lossy feedback channels, Vladimir Zivkovic, Irdeto (Netherlands); Abhijeet Golwelkar, Irdeto (US); Ronald Peters, Irdeto (Netherlands) [view abstract]
This paper proposes Uniform Switching Identities (USWIDs) as a lightweight, collusion-resistant identity scheme designed for computationally constrained environments. USWIDs use uniformly structured identities and simplified penalization logic while retaining effectiveness comparable to classical Tardos-based methods. Through simulations, we show U-SWIDs maintain robustness even under lossy feedback conditions - common in forensic watermarking scenarios. Compared to Approximated Tardos Switching Identities (AT-SWIDs), U-SWIDs offer improved scalability, ease of generation, and operational simplicity without compromising traceability. The findings suggest U-SWIDs are a viable alternative for practical traitor tracing systems, especially where delivery, derivation cost, and resilience to partial symbol loss are critical deployment factors.
Deepfake Face Swapping
Session Chair: Adnan Alattar, Digimarc Corporation
15:30 - 17:30
Harbour A
15:30MWSF-311
Face swap source attribution, Martin Steinebach, (Germany); Julian Goetzinger, Fraunhofer SIT (Germany) [view abstract]
Face swapping techniques enable the realistic manipulation of facial identities across images, posing significant challenges for digital forensics. While xisting research has focused on detecting manipulated media, little attention has been given to identifying the specific source image used in a face swap. In this work, we investigate whether it is possible to reliably trace a manipulated image back to the exact photo that served as the source for the swapped face. We propose a comparisonbased method that generates candidate face swaps using known source images and compares them to the target manipulation. Experiments data set demonstrate that our method identifies the correct source image based. We further evaluate robustness against common image istortions, such as JPEG compression and down-scaling, and find that the identification process remains reliable. Our findings highlight the potential of image-level forensic analysis to support source attribution in face-swapped media, with important implications for legal and investigative contexts.
15:50MWSF-312
Retinex-guided relighting and latent-space refinement for realistic diffusion-based face swapping, Thu Hien Le, University of Caen Normandie (France); Christophe Charrier, University of Caen Normandie (France); Emmanuel Giguet, CNRS (France); Maxime Berube, Universite du Quebec a Trois Rivieres (Canada) [view abstract]
Face swapping, or deepfake generation, remains a challenging task that requires balancing three objectives: preserving the source identity, maintaining the target s pose and expression, and achieving photorealistic realism. This work introduces a novel post-training three-stage face swapping pipeline that systematically disentangles and refines lighting, skin tone, and facial structure. The first module performs illumination normalization through Retinex-based relighting, improving photometric consistency. The second identifies a semantic skin direction in the StyleGAN2 W+ latent space using a 3D Morphable Model to ensure accurate skin tone transfer. The final stage utilizes the REFace diffusion model [1] as the main face swapping module. Quantitative results on CelebAMask-HQ demonstrate significant improvements in realism (FID = 7.16) and attribute preservation compared to the baseline. The proposed approach provides a robust framework for controllable and realistic face swapping under varying illumination and appearance conditions.
16:10MWSF-313
EuroCulture: A multi-strategy approach to large-scale cultural heritage dataset creation, Julian Goetzinger, Fraunhofer SIT (Germany); Huajian Liu; Waldemar Berchtold, (Germany); Martin Steinebach (Germany) [view abstract]
Cultural artifact classification supports law enforcement anti-tracking efforts by providing non-specialist personnel with geographical and temporal context for seized objects. However, computational heritage methodologies are limited by severe data scarcity due to inconsistent metadata standards and incomplete annotations in digital collections, making structured dataset creation infeasible.This paper presents a methodology for large-scale cultural heritage dataset creation that utilizes context provided by unstructured text descriptions to create interpretable labels. Our approach extracts cultural markers from full-text corpus analysis across concatenated metadata and description fields, enabling systematic identification of civilization-related terminology. Cross-lingual querying expands coverage beyond English-only collections, and visual feature clustering using DinoV2 refines the categorical boundaries. This transforms heterogeneous heritage repositories into categorical, civilization-based datasets that provide law enforcement with approximate geographic and temporal provenance to aid in the investigation of illicit artifact movements.Applied to Europeana's aggregated collection, this produced datasets containing 33,859-310,252 cultural artifacts across 6-62 civilization classes. A key contribution addresses institutional bias through collection-aware group-based data splitting, preventing institutional signatures from inflating model performance metrics and ensuring realistic cross-institutional generalization capabilities.The framework provides a strategy for scalable transformation of unstructured heritage repositories into systematic datasets for both scholarly research and practical law enforcement applications.