SKeDA: A Generative Watermarking Framework for Text-to-video Diffusion Models
Authors: Yang Yang, Xinze Zou, Zehua Ma, Han Fang, Weiming Zhang
Organizations: the School of Electronic and Information Engineering, Anhui University, Hefei, Anhui 230601, China · Anhui Province Key Laboratory of Digital Security and the CAS Key Laboratory of Electromagnetic Space Information, University of Science and Technology of China, Hefei 230026, China · the School of Computing, National University of Singapore, Singapore 117417
The rise of text-to-video generation models has raised growing concerns over content authenticity, copyright protection, and malicious misuse. Watermarking serves as an effective mechanism for regulating such AI-generated content, where high fidelity and strong robustness are particularly critical. Recent generative image watermarking methods provide a promising foundation by leveraging watermark information and pseudo-random keys to control the initial sampling noise, enabling lossless embedding. However, directly extending these techniques to videos introduces two key limitations: Existing designs implicitly rely on strict alignment between video frames and frame-dependent pseudo-random binary sequences used for watermark encryption. Once this alignment is disrupted, subsequent watermark extraction becomes unreliable; and Video-specific distortions, such as inter-frame compression, significantly degrade watermark reliability. To address these issues, we propose SKeDA, a generative watermarking framework tailored for text-to-video diffusion models. SKeDA consists of two components: (1) Shuffle-Key-based Distribution-preserving Sampling (SKe) employs a single base pseudo-random binary sequence for watermark encryption and derives frame-level encryption sequences through permutation. This design transforms watermark extraction from synchronization-sensitive sequence decoding into permutation-tolerant set-level aggregation, substantially improving robustness against frame reordering and loss; and (2) Differential Attention (DA), which computes inter-frame differences and dynamically adjusts attention weights during extraction, enhancing robustness against temporal distortions. Extensive experiments demonstrate that SKeDA preserves high video generation quality and watermark robustness.
Figures & tables
Fig. 1 : Application scenarios. The proposed method can detect the source of the model that generated the video, as well as track which user created the video.
Fig. 2 : The framework of SKeDA. Our method consists of four main components: encryption, embedding, extraction, and decryption. In the encryption and embedding stages, the SKe module uses random shuffle key to distribute and rearrange in the latent space to realize the hidden embedding of watermark information without affecting the video quality. In the extraction and decryption stage, the DA module adaptively assigns weights based on the inter-frame difference in the extraction stage, to improve the robustness and retrieval accuracy of the watermark under various distortion conditions.
Fig. 3 : One frame in the video is attacked by different noises. (a) Watermarked frame. (b) 50% Random Crop. (c) Brightness, factor=4. (d) Gaussian Blur, std=2.0. (e) Gaussian Noise, std=0.04. (f) H.264, CRF=30.
Methods
FVD↓
CLIP-score↑
Video Quality↑
HiDDeN [ 35 ]
436.1
0.3077
0.7436
REVMark [ 40 ]
369.3
0.3287
0.7884
Video Seal [ 43 ]
365.1
0.3302
0.7799
WAM [ 48 ]
379.2
0.3146
0.7846
DVMark [ 49 ]
382.8
0.3274
0.7742
ours
361.3
0.3345
0.7898
TABLE I : Quality metrics for different video watermarking methods.
Methods
Frame Average ( N =3)
Frame Drop ( p =0.5)
Frame Swap ( p =0.5)
Random Crop ( p =0.7)
Gaussian Noise (std=0.04)
Gaussian Blur (std=2.0)
H.264 (CRF=30)
Average
HiDDeN [ 35 ]
0.9691
0.9903
0.9910
0.7727
0.9127
0.7270
0.7008
0.8662
REVMark [ 40 ]
0.9998
0.9981
0.9998
0.9631
0.9997
0.9982
0.8577
0.9738
Video Seal [ 43 ]
0.9931
0.9919
0.9931
0.9356
0.9887
0.9904
0.8556
0.9632
WAM [ 48 ]
0.9864
0.9903
0.9908
0.9912
0.9822
0.9998
0.8612
0.9717
DVMark [ 49 ]
0.9810
0.9899
0.9935
0.9706
0.9901
0.9809
0.7996
0.9579
Ours
0.9888
0.9990
0.9998
0.9585
0.9890
0.9932
0.9687
0.9853
TABLE II : Comparison results. We control the FPR at 10−6 , and evaluate the bit accuracy for SD V1.5.
Fig. 4 : TPR and bit accuracy under various video distortions and distortion strengths.
Fig. 5 : TPR and bit accuracy under various image distortions and distortion strengths.
Methods
CRF (video size compared to CRF=0)
18 (25%)
22 (20%)
26 (13.3%)
30 (8.3%)
40 (1.8%)
HiDDeN [ 35 ]
85.43
79.85
74.64
70.08
54.67
REVMark [ 40 ]
99.55
95.84
93.54
85.77
68.04
Video Seal [ 43 ]
99.94
96.03
93.11
85.56
74.65
WAM [ 48 ]
99.88
94.57
91.78
86.12
70.31
DVMark [ 49 ]
98.87
92.94
87.75
79.96
61.97
TABLE III : Bit accuracy for different Constant Rate Factor (CRF) in H.264.
Methods
CRF (video size compared to CRF=0)
18 (25%)
22 (17%)
26 (10%)
30 (6.7%)
40 (1.2%)
HiDDeN [ 35 ]
84.52
80.47
74.44
68.97
52.83
REVMark [ 40 ]
99.56
96.36
93.12
86.48
70.09
Video Seal [ 43 ]
99.87
97.01
93.79
86.41
76.05
WAM [ 48 ]
99.63
93.85
90.69
85.57
69.98
DVMark [ 49 ]
98.08
90.89
85.45
77.67
61.03
TABLE IV : Bit accuracy for different Constant Rate Factor (CRF) in H.265.
fc−(fh = fw) (bits)
Bit Acc
TPR (detection)
TPR (traceability)
1-2 (4096)
0.7016
1.0000
1.0000
4-1 (4096)
0.7876
1.0000
1.0000
1-4 (1024)
0.8898
1.0000
1.0000
4-2 (1024)
0.8723
1.0000
1.0000
1-8 (256)
1.0000
1.0000
1.0000
4-4 (256)
0.9980
1.0000
1.0000
TABLE V : Bit accuracy with different factors fc , fh and fw .
Sampling Methods
Bit Acc
TPR (detection)
TPR (traceability)
DDIM [ 58 ]
0.9983
1.0000
1.0000
PNDM [ 59 ]
0.9822
1.0000
1.0000
DEIS [ 60 ]
0.9983
1.0000
1.0000
DPMSolver [ 65 ]
0.9992
1.0000
1.0000
UniPC [ 66 ]
0.9989
1.0000
1.0000
TABLE VI : Bit accuracy with different sampling methods.
Video Distortions
Image Distortions
Average Acc
Average TPR
DA Module (w/o)
0.9431
0.8647
0.9039
1.0000
DA Module (w)
0.9853
0.9274
0.9564
1.0000
TABLE VII : Bit accuracy of SKeDA with and without DA Module.
Fig. 6 : Bit accuracy with different inference and inversion steps.