有效水印并非有效身份：保留水印的空间-光谱对抗人脸规避
A Valid Watermark Is Not a Valid Identity: Spatial-Spectral Adversarial Face Evasion with Watermark Preservation
AI总结：
该研究提出黑盒设置下保留水印的PGD-L₂对抗人脸规避攻击，在多数据集、多模型与水印方案上实现92%以上规避率，同时保持高水印恢复率，揭示了水印人脸认证的结构性缺陷。
摘要：
人脸图像水印可支持生物识别流程中的可追溯性与认证，但仅靠来源或操作检测无法保证可靠的生物识别身份。针对这一空白，我们在黑盒水印设置下（无法访问水印组件）提出一种保留水印的人脸规避攻击。所提出的PGD-L₂攻击通过空间和光谱保留项引导对抗扰动，以降低人脸识别相似度，同时限制可能干扰隐藏水印线索的像素级失真和高频变化。在受控人脸图像上使用两种水印方案、两个人脸识别模型和两个数据集进行评估，该攻击在操作阈值下实现了92%以上的规避率，同时保留了水印恢复率：StegaFormer达93%以上，FaceSigns达99.7%以上，在ε₂=2.0时视觉质量的PSNR高于47dB。这些结果揭示了基于水印的人脸认证中的结构性空白：人脸图像可保持水印有效且视觉逼真，同时在生物识别层面不可靠。
英文摘要：
Facial image watermarking can support traceability and certification in biometric pipelines, but provenance or manipulation detection alone does not guarantee reliable biometric identity. We introduce a watermark-preserving face evasion attack that targets this gap under a black-box watermarking setting, without access to the watermarking components. The proposed PGD-L_2 attack guides adversarial perturbations with spatial and spectral preservation terms to reduce face-recognition similarity while limiting pixel-level distortion and high-frequency changes that may interfere with hidden watermark cues. Evaluated on controlled facial images with two watermarking schemes, two face-recognition models, and two datasets, the attack achieves evasion rates above 92% at operational thresholds while preserving watermark recovery above 93% for StegaFormer and above 99.7% for FaceSigns, with visual quality above 47dB PSNR at epsilon_2=2.0. These results expose a structural gap in watermark-based facial certification: a face image can remain watermark-valid and visually faithful while becoming biometrically unreliable.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
