{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/cmua-watermark-a-cross-model-universal","title":"CMUA-Watermark: A Cross-Model Universal Adversarial Watermark for Combating Deepfakes","arxiv_id":"2105.10872","date":"2021-05-23","proceeding":null,"authors":["Hao Huang","Yongtao Wang","Zhaoyu Chen","Yuze Zhang","Yuheng Li","Zhi Tang","Wei Chu","Jingdong Chen","Weisi Lin","Kai-Kuang Ma"],"abstract":"Malicious applications of deepfakes (i.e., technologies generating target facial attributes or entire faces from facial images) have posed a huge threat to individuals' reputation and security. To mitigate these threats, recent studies have proposed adversarial watermarks to combat deepfake models, leading them to generate distorted outputs. Despite achieving impressive results, these adversarial watermarks have low image-level and model-level transferability, meaning that they can protect only one facial image from one specific deepfake model. To address these issues, we propose a novel solution that can generate a Cross-Model Universal Adversarial Watermark (CMUA-Watermark), protecting a large number of facial images from multiple deepfake models. Specifically, we begin by proposing a cross-model universal attack pipeline that attacks multiple deepfake models iteratively. Then, we design a two-level perturbation fusion strategy to alleviate the conflict between the adversarial watermarks generated by different facial images and models. Moreover, we address the key problem in cross-model optimization with a heuristic approach to automatically find the suitable attack step sizes for different models, further weakening the model-level conflict. Finally, we introduce a more reasonable and comprehensive evaluation method to fully test the proposed method and compare it with existing ones. Extensive experimental results demonstrate that the proposed CMUA-Watermark can effectively distort the fake facial images generated by multiple deepfake models while achieving a better performance than existing methods.","url_abs":"https://arxiv.org/abs/2105.10872v2","url_pdf":"https://arxiv.org/pdf/2105.10872v2.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"cmua-watermark-a-cross-model-universal","repo_url":"https://github.com/vdigpku/cmua-watermark","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"MIT"}}],"tasks":[{"task_slug":"adversarial-attack","task_name":"Adversarial Attack"},{"task_slug":"face-swapping","task_name":"Face Swapping"},{"task_slug":"model-optimization","task_name":"Model Optimization"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2105.10872","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2105.10872"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/vdigpku/cmua-watermark","reach":{"status":"ok","spdx":"MIT"}}],"summary":{"unverified":5},"by_repo_kind":{"official":{"samples":5,"ran":0,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"89fcb17a1e902888","entry":"avg_smoothing_filter","repo":"vdigpku/cmua-watermark","repo_kind":"official","path":"stargan/model.py","file_url":"https://github.com/vdigpku/cmua-watermark/blob/HEAD/stargan/model.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"89fcb17a1e902888"}},{"code_sha256_prefix":"e146588f3635fb05","entry":"clip_tensor","repo":"vdigpku/cmua-watermark","repo_kind":"official","path":"attacks.py","file_url":"https://github.com/vdigpku/cmua-watermark/blob/HEAD/attacks.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"e146588f3635fb05"}},{"code_sha256_prefix":"b27511e26968bb40","entry":"parse","repo":"vdigpku/cmua-watermark","repo_kind":"official","path":"model_data_prepare.py","file_url":"https://github.com/vdigpku/cmua-watermark/blob/HEAD/model_data_prepare.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"b27511e26968bb40"}},{"code_sha256_prefix":"ff1150bb48d8be90","entry":"parse","repo":"vdigpku/cmua-watermark","repo_kind":"official","path":"AttGAN/attack_attgan.py","file_url":"https://github.com/vdigpku/cmua-watermark/blob/HEAD/AttGAN/attack_attgan.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"ff1150bb48d8be90"}},{"code_sha256_prefix":"d5fb3912cee27206","entry":"perturb_batch","repo":"vdigpku/cmua-watermark","repo_kind":"official","path":"attacks.py","file_url":"https://github.com/vdigpku/cmua-watermark/blob/HEAD/attacks.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"d5fb3912cee27206"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}