SKeDA: A Generative Watermarking Framework for Text-to-video Diffusion Models
Authors: Yang Yang, Xinze Zou, Zehua Ma, Han Fang, Weiming Zhang
Organizations: the School of Electronic and Information Engineering, Anhui University, Hefei, Anhui 230601, China · Anhui Province Key Laboratory of Digital Security and the CAS Key Laboratory of Electromagnetic Space Information, University of Science and Technology of China, Hefei 230026, China · the School of Computing, National University of Singapore, Singapore 117417
The rise of text-to-video generation models has raised growing concerns over content authenticity, copyright protection, and malicious misuse. Watermarking serves as an effective mechanism for regulating such AI-generated content, where high fidelity and strong robustness are particularly critical. Recent generative image watermarking methods provide a promising foundation by leveraging watermark information and pseudo-random keys to control the initial sampling noise, enabling lossless embedding. However, directly extending these techniques to videos introduces two key limitations: Existing designs implicitly rely on strict alignment between video frames and frame-dependent pseudo-random binary sequences used for watermark encryption. Once this alignment is disrupted, subsequent watermark extraction becomes unreliable; and Video-specific distortions, such as inter-frame compression, significantly degrade watermark reliability. To address these issues, we propose SKeDA, a generative watermarking framework tailored for text-to-video diffusion models. SKeDA consists of two components: (1) Shuffle-Key-based Distribution-preserving Sampling (SKe) employs a single base pseudo-random binary sequence for watermark encryption and derives frame-level encryption sequences through permutation. This design transforms watermark extraction from synchronization-sensitive sequence decoding into permutation-tolerant set-level aggregation, substantially improving robustness against frame reordering and loss; and (2) Differential Attention (DA), which computes inter-frame differences and dynamically adjusts attention weights during extraction, enhancing robustness against temporal distortions. Extensive experiments demonstrate that SKeDA preserves high video generation quality and watermark robustness.
Figures & tables
Fig. 1 : Application scenarios. The proposed method can detect the source of the model that generated the video, as well as track which user created the video.
Fig. 2 : The framework of SKeDA. Our method consists of four main components: encryption, embedding, extraction, and decryption. In the encryption and embedding stages, the SKe module uses random shuffle key to distribute and rearrange in the latent space to realize the hidden embedding of watermark information without affecting the video quality. In the extraction and decryption stage, the DA module adaptively assigns weights based on the inter-frame difference in the extraction stage, to improve the robustness and retrieval accuracy of the watermark under various distortion conditions.
Fig. 3 : One frame in the video is attacked by different noises. (a) Watermarked frame. (b) 50% Random Crop. (c) Brightness, factor=4. (d) Gaussian Blur, std=2.0. (e) Gaussian Noise, std=0.04. (f) H.264, CRF=30.
Methods
FVD↓
CLIP-score↑
Video Quality↑
HiDDeN [ 35 ]
436.1
0.3077
0.7436
REVMark [ 40 ]
369.3
0.3287
0.7884
Video Seal [ 43 ]
365.1
0.3302
0.7799
WAM [ 48 ]
379.2
0.3146
0.7846
DVMark [ 49 ]
382.8
0.3274
0.7742
ours
361.3
0.3345
0.7898
TABLE I : Quality metrics for different video watermarking methods.
Methods
Frame Average ( N =3)
Frame Drop ( p =0.5)
Frame Swap ( p =0.5)
Random Crop ( p =0.7)
Gaussian Noise (std=0.04)
Gaussian Blur (std=2.0)
H.264 (CRF=30)
Average
HiDDeN [ 35 ]
0.9691
0.9903
0.9910
0.7727
0.9127
0.7270
0.7008
0.8662
REVMark [ 40 ]
0.9998
0.9981
0.9998
0.9631
0.9997
0.9982
0.8577
0.9738
Video Seal [ 43 ]
0.9931
0.9919
0.9931
0.9356
0.9887
0.9904
0.8556
0.9632
WAM [ 48 ]
0.9864
0.9903
0.9908
0.9912
0.9822
0.9998
0.8612
0.9717
DVMark [ 49 ]
0.9810
0.9899
0.9935
0.9706
0.9901
0.9809
0.7996
0.9579
Ours
0.9888
0.9990
0.9998
0.9585
0.9890
0.9932
0.9687
0.9853
TABLE II : Comparison results. We control the FPR at 10−6 , and evaluate the bit accuracy for SD V1.5.
Fig. 4 : TPR and bit accuracy under various video distortions and distortion strengths.
Fig. 5 : TPR and bit accuracy under various image distortions and distortion strengths.
Methods
CRF (video size compared to CRF=0)
18 (25%)
22 (20%)
26 (13.3%)
30 (8.3%)
40 (1.8%)
HiDDeN [ 35 ]
85.43
79.85
74.64
70.08
54.67
REVMark [ 40 ]
99.55
95.84
93.54
85.77
68.04
Video Seal [ 43 ]
99.94
96.03
93.11
85.56
74.65
WAM [ 48 ]
99.88
94.57
91.78
86.12
70.31
DVMark [ 49 ]
98.87
92.94
87.75
79.96
61.97
TABLE III : Bit accuracy for different Constant Rate Factor (CRF) in H.264.
Methods
CRF (video size compared to CRF=0)
18 (25%)
22 (17%)
26 (10%)
30 (6.7%)
40 (1.2%)
HiDDeN [ 35 ]
84.52
80.47
74.44
68.97
52.83
REVMark [ 40 ]
99.56
96.36
93.12
86.48
70.09
Video Seal [ 43 ]
99.87
97.01
93.79
86.41
76.05
WAM [ 48 ]
99.63
93.85
90.69
85.57
69.98
DVMark [ 49 ]
98.08
90.89
85.45
77.67
61.03
TABLE IV : Bit accuracy for different Constant Rate Factor (CRF) in H.265.
fc−(fh = fw) (bits)
Bit Acc
TPR (detection)
TPR (traceability)
1-2 (4096)
0.7016
1.0000
1.0000
4-1 (4096)
0.7876
1.0000
1.0000
1-4 (1024)
0.8898
1.0000
1.0000
4-2 (1024)
0.8723
1.0000
1.0000
1-8 (256)
1.0000
1.0000
1.0000
4-4 (256)
0.9980
1.0000
1.0000
TABLE V : Bit accuracy with different factors fc , fh and fw .
Sampling Methods
Bit Acc
TPR (detection)
TPR (traceability)
DDIM [ 58 ]
0.9983
1.0000
1.0000
PNDM [ 59 ]
0.9822
1.0000
1.0000
DEIS [ 60 ]
0.9983
1.0000
1.0000
DPMSolver [ 65 ]
0.9992
1.0000
1.0000
UniPC [ 66 ]
0.9989
1.0000
1.0000
TABLE VI : Bit accuracy with different sampling methods.
Video Distortions
Image Distortions
Average Acc
Average TPR
DA Module (w/o)
0.9431
0.8647
0.9039
1.0000
DA Module (w)
0.9853
0.9274
0.9564
1.0000
TABLE VII : Bit accuracy of SKeDA with and without DA Module.
Fig. 6 : Bit accuracy with different inference and inversion steps.
Artificial Intelligence Generated Content (AIGC), particularly video generation with diffusion models, has been advanced rapidly. Invisible watermarking is a key technology for protecting AI-generated videos and tracing harmful content, and thus plays a crucial role in AI safety. Beyond post-processing watermarks which inevitably degrade video quality, recent studies have proposed distortion-free in-generation watermarking for video diffusion models. However, existing in-generation approaches are non-blind: they require maintaining all the message-key pairs and performing template-based matching during extraction, which incurs prohibitive computational costs at scale. Moreover, when applied to modern video diffusion models with causal 3D Variational Autoencoders (VAEs), their robustness against temporal disturbance becomes extremely weak. To overcome these challenges, we propose SIGMark, a Scalable In-Generation watermarking framework with blind extraction for video diffusion. To achieve blind-extraction, we propose to generate watermarked initial noise using a Global set of Frame-wise PseudoRandom Coding keys (GF-PRC), reducing the cost of storing large-scale information while preserving noise distribution and diversity for distortion-free watermarking. To enhance robustness, we further design a Segment Group-Ordering module (SGO) tailored to causal 3D VAEs, ensuring robust watermark inversion during extraction under temporal disturbance. Comprehensive experiments on modern diffusion models show that SIGMark achieves very high bit-accuracy during extraction under both temporal and spatial disturbances with minimal overhead, demonstrating its scalability and robustness. Our project is available at https://jeremyzhao1998.github.io/SIGMark-release/.
Rapid advancements in video diffusion models have enabled the creation of realistic videos, raising concerns about unauthorized use and driving the demand for techniques to protect model ownership. Existing watermarking methods suffer from two key limitations: they overlook temporal consistency due to conventional watermark decoders and degrade the visual quality of the generated videos. To address these issues, we introduce a robust watermarking method for latent video diffusion models named Latent Video Diffusion Watermarking (LVMark). We propose a novel watermark decoder tailored for generated videos by learning the consistency between adjacent frames. It ensures accurate message decoding, even under malicious attacks, by combining the low-frequency components of the three-dimensional wavelet domain with the color features of the video. Additionally, we train a latent decoder to maintain the visual fidelity of the generated video. Watermarks are embedded into layers with minimal impact on visual appearance using an importance-based weight modulation strategy. We optimize both the watermark decoder and the latent decoder of diffusion model, effectively balancing the trade-off between visual quality and bit accuracy. Our experiments show that our method embeds invisible watermarks into video diffusion models, ensuring robust decoding accuracy with 512-bit capacity, even under distortions.
Youngdong Jang, MinHyuk Jang, JaeHyeok Lee +4
Department of Artificial Intelligence, Korea University, Seoul 02841, Republic of Korea · Google DeepMind, Mountain View, CA 94043, USA
The rapid progress of image-guided video generation (I2V) has raised concerns about its potential misuse in misinformation and fraud, underscoring the urgent need for effective digital watermarking. While existing watermarking methods demonstrate robustness within a single modality, they fail to trace source images in I2V settings. To address this gap, we introduce the concept of Robust Diffusion Distance, which measures the temporal persistence of watermark signals in generated videos. Building on this, we propose I2VWM, a cross-modal watermarking framework designed to enhance watermark robustness across time. I2VWM leverages a video-simulation noise layer during training and employs an optical-flow-based alignment module during inference. Experiments on both open-source and commercial I2V models demonstrate that I2VWM significantly improves robustness while maintaining imperceptibility, establishing a new paradigm for cross-modal watermarking in the era of generative video. Code Released.