CodeFace: A Deep Learning Printer-Proof Steganography for Face Portraits

Original, StegaStamp-encoded, and CodeFace-encoded face portraits side by side — **Figure 1.** Left to right: original image, StegaStamp-encoded, CodeFace-encoded — each hiding a random 100-bit secret message. CodeFace better preserves facial structure and texture.

Abstract

Identity documents that carry a facial portrait remain one of the most widely used forms of personal identification. Yet two closely related attacks continue to undermine their trustworthiness: replacing a genuine photograph with a fraudulent one, and issuing documents that are fraudulent from the outset. Despite continued advances in document security, both attacks remain simple to execute and difficult to detect during in-person verification.

We introduce CodeFace, a deep-learning steganography method that verifies the integrity of a facial portrait by embedding an imperceptible secret message directly into the image and recovering it later from a physically printed copy. Implemented as an end-to-end neural network, CodeFace learns to encode and decode messages that survive the full document lifecycle — printing, environmental lighting, camera capture, and digital compression — while keeping the encoded portrait visually indistinguishable from the original. This robustness stems from two contributions: a loss term that constrains the distance between the facial features of the encoded and original images, and a dedicated architecture that improves message recovery from the small portrait sizes typical of ID photographs. In extensive experiments on physically printed polycarbonate and PVC cards captured with consumer smartphones, CodeFace reliably decodes messages of up to 120 bits, demonstrating that document integrity can be verified without altering the perceived appearance of the portrait.

99.3%face-verification accuracy on CodeFace images (vs. 88.8% for StegaStamp)

≥90%reduction in facial-feature distortion vs. StegaStamp

120 bitsstable message capacity (up to 200 bits with mild quality loss)

100%decode accuracy from printed portraits ≥4 cm wide, with the resize network

Method

CodeFace is the first steganography method optimized specifically for facial images printed on IDs and MRTDs. It comprises two independent pipelines — an encoder that conceals a secret message inside a detected face, and a decoder that recovers it from a photo of the printed, physically captured document.

CodeFace application overview: encoder pipeline issuing an ID document, decoder pipeline validating it with a smartphone — **Figure 2.** The encoder pipeline (left) issues an ID document with the message concealed in the face photo; the decoder pipeline (right) extracts and validates it from a smartphone photo of the printed document.

Face detection

The encoder and decoder both need to locate the exact facial region used to carry the message. After testing BlazeFace, MobileNet V2 (float32/int8), SSD/MTCNN, LBP cascade, and PRNet, the authors chose PRNet for its accuracy under pose variation and occlusion, optimizing and converting it to TensorFlow Lite for mobile deployment.

Error-correcting codes

To stabilize decoding accuracy, the secret message is protected with cyclic error-correcting codes — BCH and Reed–Solomon — before being embedded by the encoder network.

CodeFace encoder network diagram: UNet without pooling, three convolutional layers — **Figure 3.** The encoder is a UNet with the pooling layers removed (to avoid losing message information) and three convolutional layers, taking a 400×400×3 face and a binary message as input.

CodeFace decoder network diagram: two CNNs with a Spatial Transformer Network — **Figure 4.** The decoder combines two CNNs with a Spatial Transformer Network (STN) that corrects warping/rotation from printing and camera capture before recovering the message.

Perturbation simulation

Between encoder and decoder, training images are perturbed with perspective warp, motion/defocus blur, camera sensor noise, color manipulation (hue, saturation, brightness, contrast), and JPEG compression — approximating real printing and smartphone-capture conditions. CodeFace's key novelty is an additional resize network that down-samples images before the decoder during training, letting it read messages from much smaller printed portraits than prior methods.

Loss functions & training

The full generator/discriminator training setup is shown below. The encoder is trained with a weighted sum of five terms: LPIPS perceptual loss, a FaceNet embedding-distance loss (preserving facial identity), Wasserstein loss, residual regularization, and a cross-entropy message loss that trains the decoder.

CodeFace GAN training diagram with encoder, noise simulation, resize network, and decoder — **Figure 5.** The training network: generator (encoder, noise simulation, resize network, decoder) and discriminator (face detection/cropping, FaceNet, LPIPS/critic losses, and a cross-entropy loss on decoded messages).

Datasets

Training combined seven frontal-face datasets (PICS, Color FERET, AT&T, BioID, Georgia Tech Face Database, and FEI Face Database). After filtering for ICAO identity-document requirements (photo size, framing, uniform background, visible eyes), 1900 images remained for training.

Results

CodeFace is compared against StegaStamp, the only other printer-proof steganography model available at the time, encoding 100-bit messages unless noted otherwise.

Facial-feature preservation (809 images)

Euclidean distance and probability distribution of facial feature differences between original and encoded images — **Figure 6.** (A) Euclidean distance between original and encoded facial features, StegaStamp vs. CodeFace. (B) Probability distribution of that distance. (C) Summary statistics over 809 images.

Samples of CodeFace deployed on printed test ID cards, with correct/false frame counts — **Figure 7.** Real printed ID cards decoded from smartphone video at 10 fps. Green/red counts show frames where the decoded message did/did not match the original.

Metric (809 images)	CodeFace	StegaStamp
Mean Euclidean feature distance	0.0091	0.1346
Std. deviation	0.0028	0.0168
Max	0.0445	0.1853

Perceptual similarity & face verification (VGGFace2)

LPIPS and SSIM plots comparing CodeFace and StegaStamp over 100 face images — **Figure 8.** LPIPS (perceptual distance, lower is better) and SSIM (structural similarity, higher is better) between original and encoded images, over 100 VGGFace2 images.

ROC curves for face verification on original, CodeFace, and StegaStamp images — **Figure 9.** Face verification ROC (DLib, 32,000 image pairs from VGGFace2, threshold 0.6): 99.9% accuracy on original images, 99.3% on CodeFace-encoded, 88.8% on StegaStamp-encoded.

Ablation: message size & the resize network

CodeFace encoded images at message sizes from 80 to 200 bits — **Figure 10.** Encoded images at 80–200 bit message sizes (no resize network). Perceptual quality degrades slightly past 120 bits.

Plot of decoder accuracy vs printed image width, with and without the resize network — **Figure 11.** Handheld HUAWEI P20Pro, in-the-wild video decoding: 100% accuracy above 6 cm without the resize network, vs. above 4 cm with it — roughly the width of a typical ID portrait.

On a regular PC, mean encode time is ≈1.2 seconds per image; mean decode/validation time is ≈0.8 milliseconds. The trained model was converted to TensorFlow Lite and deployed in an Android application.

Patents

CodeFace's encoding/decoding/validation system is protected by two related patent filings.

EP4064095A1 Encoding, decoding and integrity validation systems for a security document with a steganography-encoded image and methods, security document, computing devices, computer programs and associated computer-readable data carrier Inventors: Nuno Gonçalves, Farhad Shadmand · Assignees: INCM – Imprensa Nacional Casa da Moeda, S.A. and University of Coimbra · Filed Mar 19, 2022 · Published Sep 28, 2022 View on Google Patents →

PT117136A Systems for Encoding, Decoding and Validating the Integrity of a Security Document with a Steganography Encoded Image Inventors: Nuno Gonçalves, Farhad Shadmand · Assignees: INCM – Imprensa Nacional Casa da Moeda, S.A. and University of Coimbra · Filed Mar 23, 2021 · Published Sep 23, 2022 View on Google Patents →

Code

The CodeFace implementation is proprietary and licensed by INCM. The source code is private and not publicly available.

🔒 Code — Private

BibTeX

@article{shadmand2021codeface,
  title     = {CodeFace: A Deep Learning Printer-Proof Steganography for Face Portraits},
  author    = {Shadmand, Farhad and Medvedev, Iurii and Gon\c{c}alves, Nuno},
  journal   = {IEEE Access},
  volume    = {9},
  pages     = {167282--167291},
  year      = {2021},
  publisher = {IEEE},
  doi       = {10.1109/ACCESS.2021.3132581}
}