Paper Accepted at IJCB 2026: A Valid Watermark Is Not a Valid Identity

I’m excited to announce that our paper “A Valid Watermark Is Not a Valid Identity: Spatial-Spectral Adversarial Face Evasion with Watermark Preservation” has been accepted at the IEEE International Joint Conference on Biometrics (IJCB 2026), in the special session When Biometrics Break (WBB): Security Implications of Performance Degradation, Misclassification, and Operational Drift.

What the paper is about

Biometric documents require two independent guarantees: provenance (source, issuer, integrity) and biometric reliability (identity match, authentication). The usual intuition assumes that a valid watermark plus a trusted face image implies both. We challenge this assumption by introducing a watermark-preserving adversarial face evasion attack.

Our proposed PGD-L2 attack uses spatial and spectral preservation terms to reduce face-recognition similarity while limiting distortion to the embedded watermark — all under a black-box watermarking setting, without access to the watermark decoder during optimization. The attack achieves:

• Evasion rates above 92% at operational thresholds (FAR=0.1%)
• Watermark recovery above 93% for StegaFormer and above 99.7% for FaceSigns
• Visual quality above 47 dB PSNR at ε₂ = 2.0

These results expose a structural gap in watermark-based facial certification: a face image can remain watermark-valid and visually faithful while becoming biometrically unlinked.

Presentation

The paper will be presented on September 1, 2026 by my colleague Simone Maurizio La Cava on behalf of our team, as I am unable to attend due to personal reasons.

Authors: Jefferson David Rodriguez Chivata, Davide Ghiani, Simone Maurizio La Cava, Marco Micheletto, Giulia Orrù, Gian Luca Marcialis — University of Cagliari (Italy), sAIfer Lab.

📄 Download the presentation slides (PDF)

This work builds on our ongoing research at the sAIfer Lab on adversarial robustness of watermarking-based certification for biometric images, and follows our previous publications at IJCB 2025 and IJCNN 2025.