  Deepfakes refer to content synthesized using deep generators, which, when
misused, have the potential to erode trust in digital media. Synthesizing
high-quality deepfakes requires access to large and complex generators only a
few entities can train and provide. The threat is malicious users that exploit
access to the provided model and generate harmful deepfakes without risking
detection. Watermarking makes deepfakes detectable by embedding an identifiable
code into the generator that is later extractable from its generated images. We
propose Pivotal Tuning Watermarking (PTW), a method for watermarking
pre-trained generators (i) three orders of magnitude faster than watermarking
from scratch and (ii) without the need for any training data. We improve
existing watermarking methods and scale to generators $4 \times$ larger than
related work. PTW can embed longer codes than existing methods while better
preserving the generator's image quality. We propose rigorous, game-based
definitions for robustness and undetectability, and our study reveals that
watermarking is not robust against an adaptive white-box attacker who controls
the generator's parameters. We propose an adaptive attack that can successfully
remove any watermarking with access to only 200 non-watermarked images. Our
work challenges the trustworthiness of watermarking for deepfake detection when
the parameters of a generator are available. The source code to reproduce our
experiments is available at https://github.com/nilslukas/gan-watermark.

Machine Learning;Cryptography and Security