FakeMark: Dual Systems in Misinformation & Deepfake Attribution

• FakeMark is a term denoting two distinct systems: one for multimodal misinformation grounding and one for deepfake speech attribution via watermarked artifacts.
• The multimodal version leverages training-free VLM/LLM pipelines to deliver binary veracity, multi-label fake-type predictions, and precise grounding across video, text, and speech modalities.
• The speech attribution system embeds artifact-correlated watermarks to robustly trace deepfake generators even under distortions such as codec compression and overwriting attacks.

FakeMark is a name currently used for two distinct systems in recent arXiv literature. In one usage, FakeMark is a training-free, VLM/LLM-driven, question-answering-style pipeline introduced as a baseline for Grounding Multimodal Misinformation (GroundMM), where the objective is not only to predict veracity but also to localize misleading evidence across title, speech, and video (Yang et al., 8 Sep 2025). In another usage, FakeMark is a watermarking framework for deepfake speech attribution that injects artifact-correlated watermarks associated with deepfake systems rather than pre-assigned bitstring messages, so that attribution can exploit both the injected watermark and intrinsic deepfake artifacts (Ge et al., 14 Oct 2025). The shared name therefore denotes different technical objects: a multimodal misinformation-grounding baseline in one paper, and a proactive speech attribution watermark in another.

1. Terminological scope

The ambiguity of the term is amplified by adjacent literature that uses “FakeMark-style” descriptively rather than as the name of a single canonical framework. In this broader usage, the label may denote proactive marking before release, watermark-based provenance, randomized trigger statistics, or simplified benchmark settings for fake-content detection (Wu et al., 2023, Wang et al., 2024, Liu et al., 13 Apr 2026, Chistyakova et al., 11 Mar 2026, Kouritzin et al., 2024).

In the proactive-forensics line, systems such as SepMark and LampMark embed watermarks into faces before foreseeable manipulations and later inspect whether those marks remain consistent with the content (Wu et al., 2023, Wang et al., 2024). StreamMark applies the same general logic to audio, but explicitly as a semi-fragile watermark that is robust to benign transformations and fragile to semantics-altering deepfake manipulations (Liu et al., 13 Apr 2026). In ownership-verification work for visual foundation models and DNNs, RandMark, ActiveMark, and FreeMark instead focus on watermark-based IP protection and model lineage verification rather than content authentication (Chistyakova et al., 11 Mar 2026, Chistyakova et al., 6 Oct 2025, Chen et al., 2024). This suggests that “FakeMark” functions both as a proper method name and as part of a wider naming convention for proactive marking, attribution, and verification schemes.

2. FakeMark in Grounding Multimodal Misinformation

In “A New Dataset and Benchmark for Grounding Multimodal Misinformation”, FakeMark is the proposed baseline for GroundMM, a task formulated on instances

$(x, y, \mathbf{c}, \mathbf{G}),$

where $x=(\mathcal{V}, \mathcal{T}, \mathcal{R})$ is the multimodal input consisting of video $\mathcal{V}$, title $\mathcal{T}$, and ASR transcript $\mathcal{R}$, $y \in \{0,1\}$ is the binary veracity label, $\mathbf{c}\in\{0,1\}^6$ is a multi-hot vector over six fake types, and $\mathbf{G}$ is the set of grounding annotations for the fake types present (Yang et al., 8 Sep 2025).

The six fake types are False Title, False Speech, Temporal Edit, CGI, Contradictory Content, and Unsupported Content. GroundMM requires three outputs: binary veracity classification, multi-label fake-type prediction, and grounding localization for each detected fake type. The paper’s motivation is that prior multimodal fake-news systems are typically too coarse: they often provide only binary labels or global explanations, whereas real-world misinformation videos may distribute falsehoods across text, speech, visuals, or contradictions between modalities (Yang et al., 8 Sep 2025).

FakeMark is therefore designed as a two-stage analytic and grounding framework around a VLM/LLM backend. Its role is not to serve as a highly specialized trained detector, but to provide a general-purpose, interpretable, and modular baseline that operationalizes the GroundMM task with single-modal cues and cross-modal consistency checks (Yang et al., 8 Sep 2025).

3. Architecture, grounding pipeline, and empirical behavior in GroundMM

FakeMark first constructs a set of analyses $\mathcal{A}$ through modality-specific and cross-modal prompts. The paper defines four principal analyses: $$\mathbf{A_t} = \mathrm{LLM}(\mathcal{T}, \mathcal{R}),$$

$x=(\mathcal{V}, \mathcal{T}, \mathcal{R})$0

$x=(\mathcal{V}, \mathcal{T}, \mathcal{R})$1

$x=(\mathcal{V}, \mathcal{T}, \mathcal{R})$2

with the final analysis summary written as

$x=(\mathcal{V}, \mathcal{T}, \mathcal{R})$3

Using $x=(\mathcal{V}, \mathcal{T}, \mathcal{R})$4 together with $x=(\mathcal{V}, \mathcal{T}, \mathcal{R})$5, FakeMark produces a binary authenticity prediction $x=(\mathcal{V}, \mathcal{T}, \mathcal{R})$6 and a multi-label fake-type prediction $x=(\mathcal{V}, \mathcal{T}, \mathcal{R})$7 (Yang et al., 8 Sep 2025).

Grounding is type-specific. For text-based types, FakeMark outputs token spans over $x=(\mathcal{V}, \mathcal{T}, \mathcal{R})$8 or $x=(\mathcal{V}, \mathcal{T}, \mathcal{R})$9. For Temporal Edit, it first segments the video with TransNetV2,

$\mathcal{V}$0

and then prompts the VLM to identify misleading transitions. For CGI, the paper defines a multi-step pipeline: generate an object-level grounding query

$\mathcal{V}$1

select fake scene intervals

$\mathcal{V}$2

sample representative frames

$\mathcal{V}$3

generate initial boxes

$\mathcal{V}$4

and refine temporal spans and boxes with SAM2-based tracking to obtain

$\mathcal{V}$5

The implementation uses GPT-4o-mini for text-only reasoning and InternVL-8B for visual and multimodal reasoning; videos and segmented scenes are sampled to 16 frames (Yang et al., 8 Sep 2025).

The benchmark dataset, GroundLie360, contains 2,044 target videos under 5 minutes and 588 auxiliary videos, with labels for binary veracity, six fake types, and fine-grained grounding annotations. Reported grounding agreement is 0.74 for text, 0.84 for temporal spans, and 0.98 for bounding boxes. Representative FakeMark results are a Binary F1 of 59.38, Macro F1 of 29.23 for subtype classification, Text grounding micro F1 of 22.39, Temporal edit grounding F1 of 2.37, and CGI grounding F1 of 17.15 (Yang et al., 8 Sep 2025). The paper explicitly notes strong performance unevenness across fake types and emphasizes error propagation: failure in binary classification or subtype prediction often causes downstream grounding failure.

4. FakeMark in deepfake speech attribution

In “FakeMark: Deepfake Speech Attribution With Watermarked Artifacts”, the name refers to a different system: a watermarking framework for deepfake speech attribution. The task is to identify which generator system made a synthetic utterance, and the central claim is that neither pure classifiers nor conventional watermarking alone are adequate under domain shift, codec compression, neural vocoder regeneration, or malicious removal attacks (Ge et al., 14 Oct 2025).

The method’s key idea is to replace “one system = one arbitrary bitstring” with one system = one artifact-correlated watermark. A speech signal $\mathcal{V}$6 together with a watermark message $\mathcal{V}$7 yields a watermarked signal

$\mathcal{V}$8

and a detector outputs class probabilities

$\mathcal{V}$9

The detector is trained not merely as a bit decoder, but also as a deepfake artifact classifier, so attribution can proceed from the watermark cue, the artifact cue, or both (Ge et al., 14 Oct 2025).

The generator has four conceptual stages. First, the message $\mathcal{T}$0 is mapped to an embedding $\mathcal{T}$1. Second, the input speech is encoded into a latent carrier

$\mathcal{T}$2

Third, the watermark latent is injected only in speech-active regions using a VAD-derived mask

$\mathcal{T}$3

Fourth, the system reconstructs the perturbation $\mathcal{T}$4 from $\mathcal{T}$5 (Ge et al., 14 Oct 2025).

Two generator variants are evaluated. FakeMark$\mathcal{T}$6 is waveform-based and follows an AudioSeal-style encoder-decoder with latent dimension $\mathcal{T}$7. FakeMark$\mathcal{T}$8 is spectrogram-based, follows a Timbre-style encoder, uses 1024-point STFT with 256 hop length, and has latent dimension $\mathcal{T}$9. The shared detector uses a pre-trained SSL front-end: MMS-300M / wav2vec-style encoder, followed by global pooling and a classifier over $\mathcal{R}$0 classes (Ge et al., 14 Oct 2025).

5. Training objectives, robustness, and measured trade-offs in speech attribution

FakeMark is trained with three loss families. The attribution loss

$\mathcal{R}$1

trains the detector on clean unwatermarked deepfake speech so that it learns intrinsic artifact discrimination. The watermark detection loss

$\mathcal{R}$2

trains the detector to recover the watermark class from watermarked speech. Perceptual quality is preserved with HiFi-GAN-style perceptual losses, Mel-spectrogram reconstruction loss, adversarial discriminator loss, and additional $\mathcal{R}$3, loudness, and frequency magnitude losses. The reported weights are 10.0 for attribution loss, 10.0 for watermark detection loss, 1.0 for HiFi-GAN losses, 0.1 for $\mathcal{R}$4, 10.0 for loudness, and 1.0 for frequency magnitude (Ge et al., 14 Oct 2025).

The experimental setup uses MLAAD_v5 for training and in-domain testing. MLAAD_v5 contains 24 TTS systems, 8 languages, and is grouped into 12 classes by architecture, with 9 classes appearing in evaluation. Cross-dataset evaluation uses ASVspoof5 and TIMIT-TTS. Baselines include watermarking systems AudioSeal and Timbre, and classifier baselines MMS-300M and ResNet34 (Ge et al., 14 Oct 2025).

The paper reports that, without distortion, all methods are near perfect in-domain. Under distortions, the differences become large. For SpeechTokenizer, reported attribution accuracies are 0.10 for AudioSeal, 0.94 for Timbre, 0.85 for FakeMark$\mathcal{R}$5, and 0.99 for FakeMark$\mathcal{R}$6. Under Overwriting, the corresponding values are 0.68, 0.55, 0.99, and 0.95. For cross-dataset clean evaluation on ASVspoof5 + TIMIT-TTS, the MMS-300M and ResNet34 classifier baselines fall to about 0.07 and 0.12, whereas FakeMark$\mathcal{R}$7 and FakeMark$\mathcal{R}$8 remain at 1.00 (Ge et al., 14 Oct 2025).

The quality trade-off is explicit. Reported values are SI-SNR 36.49 and PESQ 4.55 for AudioSeal, 21.79 and 2.97 for Timbre, 35.34 and 3.79 for FakeMark$\mathcal{R}$9, and 14.97 and 2.83 for FakeMark$y \in \{0,1\}$0. The paper interprets FakeMark$y \in \{0,1\}$1 as the better quality–robustness balance, while FakeMark$y \in \{0,1\}$2 is generally stronger but more quality-degrading. An ablation further compares No watermark, Random watermark, and Matching watermark. Under distortion on MLAAD_v5, FakeMark$y \in \{0,1\}$3 improves from 0.73 to 0.80 to 0.86, and FakeMark$y \in \{0,1\}$4 from 0.78 to 0.85 to 0.91, supporting the claim that the injected watermark materially enhances traceability (Ge et al., 14 Oct 2025).

6. Relations to adjacent watermarking and provenance research

A common misconception is that FakeMark denotes a single unified benchmark or watermark family. The literature instead supports a narrower and more fragmented interpretation. The GroundMM FakeMark is not a watermarking method at all; it is a training-free, QA-driven multimodal misinformation baseline (Yang et al., 8 Sep 2025). The speech FakeMark is a proactive watermarking framework for system attribution (Ge et al., 14 Oct 2025). Several other papers then use “FakeMark-style” only as a comparative label for related proactive-marking or detection ideas (Wu et al., 2023, Liu et al., 13 Apr 2026).

The surrounding ecosystem is technically important because it clarifies both the ambition and the limits of such systems. In proactive deepfake detection, SepMark, LampMark, and StreamMark pursue source tracing, structural consistency checking, or semi-fragile audio integrity verification (Wu et al., 2023, Wang et al., 2024, Liu et al., 13 Apr 2026). In model-IP protection, FreeMark, RandMark, and ActiveMark shift the emphasis to watermark extraction from activations or internal representations for ownership verification (Chen et al., 2024, Chistyakova et al., 11 Mar 2026, Chistyakova et al., 6 Oct 2025). At the same time, watermark-removal work such as UnMarker, DeMark, MarkSweep, and MarkCleaner argues that defensive watermarks can often be erased or rendered undetectable while preserving perceptual quality, whether through spectral disruption, latent sparsification, noise-intensification plus denoising, or micro-geometric perturbation (Kassis et al., 2024, Song et al., 23 Jan 2026, Cao et al., 17 Feb 2026, Kong et al., 2 Feb 2026).

This broader record suggests two different encyclopedia-level readings of FakeMark. In the strict sense, it names two unrelated research systems, one for grounded multimodal misinformation analysis and one for deepfake speech attribution with watermarked artifacts. In the looser sense used by neighboring papers, it denotes a family resemblance among proactive marking, watermark-based provenance, and statistical or structural verification of synthetic content.