---
title: Multi-Embedding Attacks in Deepfake Forensics
url: https://www.emergentmind.com/topics/multi-embedding-attacks-mea
type: topic
---

# Multi-Embedding Attacks in Deepfake Forensics

Multi-Embedding Attacks (MEA) are a failure mode in deepfake proactive forensics in which an image that already contains a forensic watermark is subjected to an additional round of watermark embedding, causing the original watermark to be disrupted, overwritten, or destroyed. In the formulation introduced and experimentally demonstrated for the first time in 2025, MEA can arise both accidentally, such as through automated platform processing, and deliberately, as an anti-forensic action; in either case, the consequence is loss of recoverability of the original forensic watermark and, potentially, the collapse of the proactive forensic mechanism itself [2508.17247].

## 1. Terminology and scope

In the deepfake-forensics literature, **Multi-Embedding Attack** denotes repeated watermark embedding on an already protected image, with destructive interference against the pre-existing forensic payload [2508.17247]. This meaning is specific and should not be conflated with other uses of the acronym “MEA” in neighboring literatures.

| Usage of “MEA” | Meaning | Example source |
|---|---|---|
| Multi-Embedding Attacks | Additional watermark embedding destroys or removes an original forensic watermark | [2508.17247] |
| Model Extraction Attacks | Black-box querying to replicate model functionality | [2401.15239] |
| Multiblock Embedding Alignment | Representation alignment for speech emotion recognition; explicitly not Multi-Embedding Attacks | [2510.09072] |

A further neighboring but distinct line of work studies **public multi-user information embedding under multiple-access attacks**, where two independently embedded watermarks pass through a multiple-access attack channel and the objective is to characterize achievable rate regions under distortion constraints [1003.1655]. That formulation concerns information-theoretic embedding capacity under joint channel attacks, not the image-level repeated-embedding threat now called Multi-Embedding Attacks.

This terminological separation matters because the 2025 deepfake-forensics paper frames MEA as a previously overlooked systems-level assumption failure: existing proactive forensic methods were evaluated largely under single-watermark embedding, whereas real-world images may undergo further embedding by other systems or adversaries [2508.17247].

## 2. Encoder–decoder watermarking model and MEA formalization

The attack is defined in the standard encoder–decoder framework used by proactive forensic watermarking. An encoder $En$ embeds watermark $w$ into image $X$, producing a protected image $X_w = En(X,w)$, and a decoder $De$ attempts to recover $w$ from distorted inputs. The usual training objective balances robustness and imperceptibility:
$$
\operatorname*{min}_{En,De} \mathcal{H}(De(\mathcal{N}(En(X,w))),w) + \lambda \mathcal{G}(X,En(X,w)).
$$
Here, $\mathcal{H}$ measures recovery error, $\mathcal{G}$ measures visual distortion, $\mathcal{N}$ models image distortions, and $\lambda$ is a balance parameter [2508.17247].

MEA is formalized as a **second embedding round** applied to an already watermarked image. If the original protected image is
$$
X_{w_1} = En(X,w_1),
$$
then an additional, unrelated watermark $w_2$ is embedded as
$$
X_{w_{1,2}} = En(X_{w_1}, w_2).
$$
The second embedding follows an objective of the same type:
$$
\operatorname*{min}_{En,De} \mathcal{H}(De(\mathcal{N}(En(X_{w_1},w_2))),w_2) + \lambda \mathcal{G}(X_{w_1},En(X_{w_1},w_2)).
$$
The critical observation is that, under the imperceptibility constraint, the new encoder attempts to minimize visible changes to $X_{w_1}$ and can therefore treat the previous watermark as redundant noise, effectively overwriting or deleting it [2508.17247].

The integrity loss of the original forensic watermark after the second embedding is quantified as
$$
\mathcal{L}_f = \mathcal{H}(De(X_{w_{1,2}}), w_1).
$$
A high $\mathcal{L}_f$ indicates that the original watermark information is no longer recoverable from the twice-embedded image [2508.17247].

## 3. Failure mechanism, measurement, and threat characterization

The empirical evaluation protocol in the defining study uses a three-step procedure: initial embedding, MEA simulation by a second embedding, and decoding of the original watermark from the twice-embedded image. Recovery quality is measured with bit error rate (BER):
$$
\mathrm{BER}(w_1, w_1') = \frac{1}{L} \sum_{i=0}^{L-1} |\mathcal{B}(w_1^i) - \mathcal{B}(w_1^{\prime i})| \times 100\%.
$$
Here, $\mathcal{B}(\cdot)$ binarizes each code element, and lower BER indicates better preservation of the original watermark [2508.17247].

The central empirical claim is that BER rises from **less than 1% before MEA to approximately 38–50% after MEA across all state-of-the-art methods**. The same source interprets this as catastrophic loss of forensic information, since BER at about 50% for a binary code approaches random guessing [2508.17247].

The paper further states that MEA may occur both accidentally and deliberately. Accidental cases include additional embedding introduced by external systems; deliberate cases correspond to adversaries embedding a new watermark specifically to erase provenance evidence. This broadens the threat model beyond conventional post-processing distortions such as compression, resizing, or generic image degradation. The attack is not merely another corruption process; it is an adversarially meaningful **re-encoding** of the image by a second watermarking system [2508.17247].

A common misconception is that robustness to ordinary distortions implies robustness to MEA. The reported BER behavior directly contradicts that assumption. Another misconception is that repeated embedding is a niche scenario. The paper’s framing suggests the opposite: the single-embedding assumption is the idealized case, whereas repeated embedding can arise naturally in multi-system media pipelines [2508.17247].

## 4. Adversarial Interference Simulation (AIS)

To mitigate MEA, the same work introduces **Adversarial Interference Simulation (AIS)**, a general training paradigm that does not modify the network architecture. AIS explicitly simulates MEA during fine-tuning and adds a resilience-driven objective so that the model learns watermark representations that are described as **sparse and stable** [2508.17247].

The AIS workflow is: protect the image with watermark $w_1$, optionally apply distortion, simulate MEA by embedding a second watermark $w_2$, and then train the decoder to still recover $w_1$ from the twice-embedded image. The core AIS objective is
$$
\min_{En,De} \mathbb{E}_{(X, w_1, w_2)} \left[ \mathcal{H}(De(X_{w_{1,2}}), w_1)\right].
$$
This is combined with the normal task objective through
$$
\mathcal{L}_{Total} = \mathcal{L}_{task} + \lambda_A \mathcal{L}_{AIS},
$$
where the task term may be written as
$$
\mathcal{L}_{task} = \lambda_1 \mathcal{L}_{I} + \lambda_2 \mathcal{L}_{D} + \lambda_3 \mathcal{L}_{A}.
$$
For architectures with multiple decoding heads, the AIS loss is expanded as
$$
\mathcal{L}_{AIS} =
\sum_{i=1}^k \beta_i \cdot \frac{1}{L} \| De_i(X_{w_{1,2}}) - w_1 \|_2^2
+ \beta_0 \cdot \frac{1}{L} \| De_0(X_{w_{1,2}}) - 0 \|_2^2.
$$
The first term enforces correct post-MEA recovery of $w_1$; the second regularizes auxiliary outputs when such heads are used [2508.17247].

The design motivation is explicit: standard models learn **dense watermark representations that are easily overwritten**, whereas MEA-aware training encourages representations that remain decodable after subsequent embedding. This suggests a shift from robustness against passive distortions to robustness against structurally interfering encoders [2508.17247].

## 5. Experimental evidence and robustness profile

The reported evaluation uses **CelebA-HQ at 256×256 resolution** and compares AIS-enhanced models against six baselines: **SepMark, LampMark, WaveGuard, EditGuard, MBRS, and HiDDeN**. The principal metrics are **BER**, **PSNR**, and **SSIM** [2508.17247].

Under **intra-model MEA**, repeated embedding by the same model drives BER for the original watermark toward approximately 50% when AIS is absent. With AIS, BER remains **below 0.25% even after 5 consecutive attacks**. Under **cross-model MEA**, where the second embedding is performed by another watermarking model, BER also rises sharply without AIS; with AIS, BER is reduced by **an order of magnitude or more**, and the paper also summarizes this effect as roughly **10x to 100x** in cross-model robustness tables [2508.17247].

The ablation study varies the AIS weight $\lambda_A$ and reports a monotonic improvement in robustness as $\lambda_A$ increases, with only minor visual-quality trade-offs at extreme values. The same source states that **$\lambda_A = 10$ is effective**. Visual quality remains high in terms of PSNR and SSIM, and the reported differences from standard models are described as visually indistinguishable [2508.17247].

These results support three claims specific to the evaluated setting. First, MEA is not a marginal corner case: it breaks all evaluated state-of-the-art methods when they are trained conventionally. Second, architecture changes are not required for mitigation, because AIS is formulated as a plug-and-play training paradigm. Third, MEA robustness is proposed as a **new benchmark** for proactive forensic research, rather than a one-off stress test [2508.17247].

## 6. Relation to adjacent security literatures

The term MEA is heavily overloaded in machine-learning security. In model-stealing work, **MEA** commonly means **Model Extraction Attacks**. For example, MEA-Defender proposes a backdoor-based watermark whose watermark samples are designed to be “within” the main task’s input and output domains so that the watermark transfers into a stolen model during extraction; its reported evaluation spans four extraction attacks, five datasets, and six models from supervised and self-supervised learning, with average watermark success rate in extracted models of about 83% [2401.15239]. A later study on **Class-Feature Watermarks** argues that this risk was underestimated because earlier removal attacks were weakened by entanglement, introduces **Watermark Removal attacK (WRK)**, and reports that WRK reduces watermark success rates by at least 88.79% on existing black-box watermark benchmarks, including MEA-Defender [2511.07947].

These model-extraction papers are adjacent because they also concern watermark resilience, but they address a different attacker capability: black-box imitation of model functionality rather than repeated embedding into already protected media. The distinction is substantive. In proactive forensics, the destructive operator is a second watermark encoder acting on an image; in model extraction, the destructive operator is the surrogate-training pipeline acting on API outputs [2508.17247].

A second neighboring literature studies **embedding-space adversarial attacks** against multimodal models. “Jailbreak in pieces” composes benign prompts with adversarial images targeted toward harmful embeddings and requires access only to the vision encoder, not the language model [2307.14539]. CrossFire transforms an attacker-chosen target into the same modality as the original image or audio, then minimizes angular deviation between normalized embeddings to produce perturbations that manipulate downstream tasks, outperforming prior attacks across six datasets [2409.06793]. These attacks target shared representation spaces; they are not Multi-Embedding Attacks in the forensic sense.

Finally, the ambiguity is explicit in speech emotion recognition, where one paper states that **MEA refers to Multiblock Embedding Alignment—not to “Multi-Embedding Attacks” or any adversarial framework** [2510.09072]. For encyclopedia purposes, this makes the 2025 deepfake-forensics definition especially important: it establishes Multi-Embedding Attacks as a distinct attack class centered on repeated watermark insertion, destructive interference, and post-embedding provenance failure [2508.17247].

Source: https://www.emergentmind.com/topics/multi-embedding-attacks-mea