WaveGuard: Robust Deepfake Detection and Source Tracing via Dual-Tree Complex Wavelet and Graph Neural Networks

TL;DR

WaveGuard tackles deepfake threats by combining frequency-domain watermark embedding with a structural consistency constraint via a Graph Neural Network. It leverages the translation-invariant, directional properties of the DT-CWT to embed watermarks in high-frequency sub-bands, while a Structural Consistency Graph Neural Network enforces visual fidelity and resilience to semantic manipulations. The method demonstrates superior robustness against common distortions and sophisticated deepfake attacks, with strong traceability and competitive image quality and efficiency. This approach offers a practical, end-to-end solution for proactive deepfake defense, enabling reliable source tracing and tamper detection in real-world media pipelines.

Abstract

Deepfake technology poses increasing risks such as privacy invasion and identity theft. To address these threats, we propose WaveGuard, a proactive watermarking framework that enhances robustness and imperceptibility via frequency-domain embedding and graph-based structural consistency. Specifically, we embed watermarks into high-frequency sub-bands using Dual-Tree Complex Wavelet Transform (DT-CWT) and employ a Structural Consistency Graph Neural Network (SC-GNN) to preserve visual quality. We also design an attention module to refine embedding precision. Experimental results on face swap and reenactment tasks demonstrate that WaveGuard outperforms state-of-the-art methods in both robustness and visual quality. Code is available at https://github.com/vpsg-research/WaveGuard.

Figures (8)

• Figure 1: Three categories of approaches for balancing robustness and invisibility in proactive deepfake detection.
• Figure 2: Two-level dual-tree complex wavelet transform decomposition.
• Figure 3: Frequency response of four sub-bands with watermark embedding and propagation. Sub-band 1 and sub-band 3 (pink) represent the watermark embedding regions, while sub-band 4 and sub-band 6 (blue) indicate the propagation of watermark information due to sub-band redundancy.
• Figure 4: Overall architecture of WaveGuard. Frequency Subband Selection Module ($FSSM$) extracts and processes high-frequency sub-bands in the frequency domain, providing essential features for watermark embedding, tracing, and detection. Attention Module ($AM$) highlights salient regions in the image and guides the features to focus on key areas, thereby enhancing the robustness and effectiveness of watermark embedding. The encoder ($En$) embeds the watermark into the high-frequency sub-bands and reconstructs the watermarked image $I_w$. The Noise Pool Layer ($NPL$) applies various distortions to $I_w$ to generate distorted images $I_n$. The tracer decoder ($Tr$) extracts the watermark $w_t$ from $I_n$ to evaluate its robustness, while the decoder ($De$) extracts the correct watermark $w_d$ under common distortions and outputs random-like messages under malicious distortions. In addition, Structural Consistency Graph Neural Network ($SC-GNN$) extracts the structural features of the original image $I_o$ and the watermarked image $I_w$ by constructing graph representation to ensure the consistency between them.
• Figure 5: Illustrates the visual effects of operations performed on watermarked images. The original image $I_o$ and the watermarked image $I_w$ are shown in the first and second rows, respectively. The results of applying different operations to the watermarked image, denoted as $I_n$, are displayed in the third row. The fourth row shows the watermarked residual signals, represented as $|I_o - I_w|$, which are processed to enhance the visualization of differences. All images are sized $128 \times 128$.