Multi-Embedding Attacks in Deepfake Forensics

• The paper introduces MEA as repeated watermark embedding that disrupts forensic recoverability, with BER rising from under 1% to 38–50% after the attack.
• Multi-Embedding Attacks weaken forensic integrity by overwriting original watermarks through an additional embedding round, whether accidentally or intentionally.
• Adversarial Interference Simulation (AIS) is proposed as a mitigation strategy, enabling robust watermark recovery even after multiple embedding stages.

Multi-Embedding Attacks (MEA) are a failure mode in deepfake proactive forensics in which an image that already contains a forensic watermark is subjected to an additional round of watermark embedding, causing the original watermark to be disrupted, overwritten, or destroyed. In the formulation introduced and experimentally demonstrated for the first time in 2025, MEA can arise both accidentally, such as through automated platform processing, and deliberately, as an anti-forensic action; in either case, the consequence is loss of recoverability of the original forensic watermark and, potentially, the collapse of the proactive forensic mechanism itself (Jia et al., 24 Aug 2025).

1. Terminology and scope

In the deepfake-forensics literature, Multi-Embedding Attack denotes repeated watermark embedding on an already protected image, with destructive interference against the pre-existing forensic payload (Jia et al., 24 Aug 2025). This meaning is specific and should not be conflated with other uses of the acronym “MEA” in neighboring literatures.

Usage of “MEA”	Meaning	Example source
Multi-Embedding Attacks	Additional watermark embedding destroys or removes an original forensic watermark	(Jia et al., 24 Aug 2025)
Model Extraction Attacks	Black-box querying to replicate model functionality	(Lv et al., 2024)
Multiblock Embedding Alignment	Representation alignment for speech emotion recognition; explicitly not Multi-Embedding Attacks	(Tiwari et al., 10 Oct 2025)

A further neighboring but distinct line of work studies public multi-user information embedding under multiple-access attacks, where two independently embedded watermarks pass through a multiple-access attack channel and the objective is to characterize achievable rate regions under distortion constraints (Zhong et al., 2010). That formulation concerns information-theoretic embedding capacity under joint channel attacks, not the image-level repeated-embedding threat now called Multi-Embedding Attacks.

This terminological separation matters because the 2025 deepfake-forensics paper frames MEA as a previously overlooked systems-level assumption failure: existing proactive forensic methods were evaluated largely under single-watermark embedding, whereas real-world images may undergo further embedding by other systems or adversaries (Jia et al., 24 Aug 2025).

2. Encoder–decoder watermarking model and MEA formalization

The attack is defined in the standard encoder–decoder framework used by proactive forensic watermarking. An encoder $En$ embeds watermark $w$ into image $X$, producing a protected image $X_w = En(X,w)$, and a decoder $De$ attempts to recover $w$ from distorted inputs. The usual training objective balances robustness and imperceptibility:

$$\operatorname*{min}_{En,De} \mathcal{H}(De(\mathcal{N}(En(X,w))),w) + \lambda \mathcal{G}(X,En(X,w)).$$

Here, $\mathcal{H}$ measures recovery error, $\mathcal{G}$ measures visual distortion, $\mathcal{N}$ models image distortions, and $w$0 is a balance parameter (Jia et al., 24 Aug 2025).

MEA is formalized as a second embedding round applied to an already watermarked image. If the original protected image is

$w$1

then an additional, unrelated watermark $w$2 is embedded as

$w$3

The second embedding follows an objective of the same type:

$w$4

The critical observation is that, under the imperceptibility constraint, the new encoder attempts to minimize visible changes to $w$5 and can therefore treat the previous watermark as redundant noise, effectively overwriting or deleting it (Jia et al., 24 Aug 2025).

The integrity loss of the original forensic watermark after the second embedding is quantified as

$w$6

A high $w$7 indicates that the original watermark information is no longer recoverable from the twice-embedded image (Jia et al., 24 Aug 2025).

3. Failure mechanism, measurement, and threat characterization

The empirical evaluation protocol in the defining study uses a three-step procedure: initial embedding, MEA simulation by a second embedding, and decoding of the original watermark from the twice-embedded image. Recovery quality is measured with bit error rate (BER):

$w$8

Here, $w$9 binarizes each code element, and lower BER indicates better preservation of the original watermark (Jia et al., 24 Aug 2025).

The central empirical claim is that BER rises from less than 1% before MEA to approximately 38–50% after MEA across all state-of-the-art methods. The same source interprets this as catastrophic loss of forensic information, since BER at about 50% for a binary code approaches random guessing (Jia et al., 24 Aug 2025).

The paper further states that MEA may occur both accidentally and deliberately. Accidental cases include additional embedding introduced by external systems; deliberate cases correspond to adversaries embedding a new watermark specifically to erase provenance evidence. This broadens the threat model beyond conventional post-processing distortions such as compression, resizing, or generic image degradation. The attack is not merely another corruption process; it is an adversarially meaningful re-encoding of the image by a second watermarking system (Jia et al., 24 Aug 2025).

A common misconception is that robustness to ordinary distortions implies robustness to MEA. The reported BER behavior directly contradicts that assumption. Another misconception is that repeated embedding is a niche scenario. The paper’s framing suggests the opposite: the single-embedding assumption is the idealized case, whereas repeated embedding can arise naturally in multi-system media pipelines (Jia et al., 24 Aug 2025).

4. Adversarial Interference Simulation (AIS)

To mitigate MEA, the same work introduces Adversarial Interference Simulation (AIS), a general training paradigm that does not modify the network architecture. AIS explicitly simulates MEA during fine-tuning and adds a resilience-driven objective so that the model learns watermark representations that are described as sparse and stable (Jia et al., 24 Aug 2025).

The AIS workflow is: protect the image with watermark $X$0, optionally apply distortion, simulate MEA by embedding a second watermark $X$1, and then train the decoder to still recover $X$2 from the twice-embedded image. The core AIS objective is

$X$3

This is combined with the normal task objective through

$X$4

where the task term may be written as

$X$5

For architectures with multiple decoding heads, the AIS loss is expanded as

$X$6

The first term enforces correct post-MEA recovery of $X$7; the second regularizes auxiliary outputs when such heads are used (Jia et al., 24 Aug 2025).

The design motivation is explicit: standard models learn dense watermark representations that are easily overwritten, whereas MEA-aware training encourages representations that remain decodable after subsequent embedding. This suggests a shift from robustness against passive distortions to robustness against structurally interfering encoders (Jia et al., 24 Aug 2025).

5. Experimental evidence and robustness profile

The reported evaluation uses CelebA-HQ at 256×256 resolution and compares AIS-enhanced models against six baselines: SepMark, LampMark, WaveGuard, EditGuard, MBRS, and HiDDeN. The principal metrics are BER, PSNR, and SSIM (Jia et al., 24 Aug 2025).

Under intra-model MEA, repeated embedding by the same model drives BER for the original watermark toward approximately 50% when AIS is absent. With AIS, BER remains below 0.25% even after 5 consecutive attacks. Under cross-model MEA, where the second embedding is performed by another watermarking model, BER also rises sharply without AIS; with AIS, BER is reduced by an order of magnitude or more, and the paper also summarizes this effect as roughly 10x to 100x in cross-model robustness tables (Jia et al., 24 Aug 2025).

The ablation study varies the AIS weight $X$8 and reports a monotonic improvement in robustness as $X$9 increases, with only minor visual-quality trade-offs at extreme values. The same source states that $X_w = En(X,w)$0 is effective. Visual quality remains high in terms of PSNR and SSIM, and the reported differences from standard models are described as visually indistinguishable (Jia et al., 24 Aug 2025).

These results support three claims specific to the evaluated setting. First, MEA is not a marginal corner case: it breaks all evaluated state-of-the-art methods when they are trained conventionally. Second, architecture changes are not required for mitigation, because AIS is formulated as a plug-and-play training paradigm. Third, MEA robustness is proposed as a new benchmark for proactive forensic research, rather than a one-off stress test (Jia et al., 24 Aug 2025).

6. Relation to adjacent security literatures

The term MEA is heavily overloaded in machine-learning security. In model-stealing work, MEA commonly means Model Extraction Attacks. For example, MEA-Defender proposes a backdoor-based watermark whose watermark samples are designed to be “within” the main task’s input and output domains so that the watermark transfers into a stolen model during extraction; its reported evaluation spans four extraction attacks, five datasets, and six models from supervised and self-supervised learning, with average watermark success rate in extracted models of about 83% (Lv et al., 2024). A later study on Class-Feature Watermarks argues that this risk was underestimated because earlier removal attacks were weakened by entanglement, introduces Watermark Removal attacK (WRK), and reports that WRK reduces watermark success rates by at least 88.79% on existing black-box watermark benchmarks, including MEA-Defender (Xiao et al., 11 Nov 2025).

These model-extraction papers are adjacent because they also concern watermark resilience, but they address a different attacker capability: black-box imitation of model functionality rather than repeated embedding into already protected media. The distinction is substantive. In proactive forensics, the destructive operator is a second watermark encoder acting on an image; in model extraction, the destructive operator is the surrogate-training pipeline acting on API outputs (Jia et al., 24 Aug 2025).

A second neighboring literature studies embedding-space adversarial attacks against multimodal models. “Jailbreak in pieces” composes benign prompts with adversarial images targeted toward harmful embeddings and requires access only to the vision encoder, not the LLM (Shayegani et al., 2023). CrossFire transforms an attacker-chosen target into the same modality as the original image or audio, then minimizes angular deviation between normalized embeddings to produce perturbations that manipulate downstream tasks, outperforming prior attacks across six datasets (Dou et al., 2024). These attacks target shared representation spaces; they are not Multi-Embedding Attacks in the forensic sense.

Finally, the ambiguity is explicit in speech emotion recognition, where one paper states that MEA refers to Multiblock Embedding Alignment—not to “Multi-Embedding Attacks” or any adversarial framework (Tiwari et al., 10 Oct 2025). For encyclopedia purposes, this makes the 2025 deepfake-forensics definition especially important: it establishes Multi-Embedding Attacks as a distinct attack class centered on repeated watermark insertion, destructive interference, and post-embedding provenance failure (Jia et al., 24 Aug 2025).