Explainable and proactive fragile watermarking for medical Deepfake detection

Medical deepfakes and adversarial manipulations threaten AI-based diagnosis and telemedicine security. Existing watermarking methods for image authentication do not reliably distinguish clinically neutral transformations from semantic tampering, offer no interpretability of detected alterations, and often exceed latency constraints of clinical workflows. We propose Proactive Forensic Fragile Watermarking (PFF-WM), a framework that embeds two complementary watermarks: a fragile watermark in wavelet detail coefficients (pixel-level sensitivity) and a semi-robust watermark in the DCT domain whose embedding strength is modulated by a multi-scale attention map that prioritises diagnostically relevant regions. At the receiver side, a stacked autoencoder trained exclusively on authentic images detects manipulations via reconstruction error, a lightweight refinement network produces a tamper localisation mask, and a gradient-based explainability layer estimates the clinical impact of any alteration. Experiments on CheXpert (resampled to 512 × 512), LiTS, and ISIC 2019 show that PFF-WM achieves 97.6% detection accuracy and an AUC of 0.989, with tamper localisation IoU of 83.2%, with a false positive rate below 0.5% under each tested non‑geometric benign transformation (JPEG, resizing, contrast, blur) and below 0.7% under chained non‑geometric transformations. Geometric transformations (rotation, translation) are a recognised limitation, reaching 18.7% FPR at 15° rotation.The method shows competitive or superior performance against existing watermarking‑based forensic methods under the tested conditions, although direct comparability is limited for methods designed for different resolutions or modalities. Inference time is 44 ms per 512 × 512 image, making it computationally feasible for real‑time verification under the tested conditions.