Video watermarking underpins copyright protection and provenance for generated media, yet almost every video is compressed by a codec before it is stored or shared. A codec discards precisely the perceptually redundant components that most watermarks rely on, so the payload is often lost even when the marked video looked flawless beforehand. Existing methods leave this path open, since they treat compression as one entry in a generic list of distortions, while a real codec is not differentiable and cannot enter gradient-based training. We present COVER, the first learned video watermark built around codec compression as its design target, which survives that compression by embedding the payload in the latent space of a frozen generative video autoencoder and recovering it by re-encoding the received video into that same latent space. To make codec robustness trainable, we build a differentiable codec surrogate bank that simulates the dominant degradation modes of practical compression, and we train the embedder and the latent decoder through three shared recovery paths under a fidelity objective that constrains the residual in the pixel and frequency domains. Across four codecs at 12 settings, COVER attains 93.72% average bit accuracy, ranks first on 11 of the 12, improves the strongest prior method by 2.68 points, and lifts the worst operating point from 68.90% to 73.72% while each marked video stays visually close to the source clip that produced it.
Figures & tables
Figure 1. The gap this paper targets. A watermark is usually verified on the marked video itself, whereas a real video is compressed before it is stored or shared, so a payload that reads back perfectly on the first path can be lost entirely on the second, which is the path that a real viewer sees.
Figure 2. Overview of COVER. The payload is written into the latent of a frozen video autoencoder as a residual, and one shared latent decoder reads it back on three paths that expose it to the autoencoder round trip and to a differentiable codec surrogate.
Figure 3. Effect of each codec surrogate group on an example frame. The strengths are exaggerated for visibility.
Method
AV1 (CRF)
H.264 (CRF)
H.265 (CRF)
VP9 (CQ)
Average
Worst
PSNR
SSIM
45
55
63
23
35
45
26
40
50
35
45
55
VideoMark
17.40
8.10
1.80
56.90
10.30
0.40
42.30
3.90
0.60
38.30
19.50
6.30
17.15
0.40
34.27
0.866
VideoShield
97.80
92.90
77.80
99.80
96.80
75.90
99.40
91.60
68.90
99.40
98.20
93.90
91.03
68.90
34.03
0.860
Video Seal
67.50
60.00
51.30
94.20
62.10
50.50
86.40
55.20
50.20
88.70
77.00
62.10
67.10
50.20
30.55
0.812
VideoSignature
50.90
47.20
44.60
59.30
49.70
44.10
57.40
46.80
45.90
58.70
53.10
49.00
50.56
44.10
25.02
0.808
COVER (Ours)
98.91
97.24
83.23
99.74
97.99
85.29
99.67
96.41
73.72
99.50
98.35
94.55
93.72
73.72
28.30
0.855
Table 1. Bit accuracy (%) under 12 real codec settings from four codec families. Bold and underline mark the accuracy columns only. Training never uses a real codec, so every setting here tests how far the surrogate bank transfers to an unseen encoder.
Figure 4. Qualitative comparison for four clips. Each triplet shows the source frame, the marked frame, and their residual, magnified 20 times and rendered under a color map.
Surrogate bank
Average
Worst
COVER (full)
93.72
73.72
Without quantization and block
89.06
65.32
Without low pass and blur
91.57
70.30
Without resampling
91.99
71.28
Without chroma
92.90
74.66
Table 2. Ablation of the codec surrogate groups, with one group disabled per row. Bit accuracy in %, best in bold.
Objective
Average
Worst
PSNR
T-E1
T-E2
COVER (full)
93.72
73.72
28.30
7.83
11.66
Without spatial
92.63
71.98
24.80
7.39
11.26
Without temporal
92.16
71.23
24.77
7.82
11.59
Without spectral
91.15
68.71
24.82
7.91
11.69
Without adversarial
92.60
71.43
24.78
7.36
11.23
Table 3. Ablation of the loss families, one per row. Bit accuracy in %. T-E1 and T-E2 are the first- and second-order differences of the residual in 10−3 , where lower is better and the best value in each column is in bold.
Appendix figures & tables2 assets
Supplementary material from the paper’s appendix.
Appendix
Method
AV1 (CRF)
H.264 (CRF)
H.265 (CRF)
VP9 (CQ)
Average
Worst
45
55
63
23
35
45
26
40
50
35
45
55
VideoMark
7.37
0.00
0.00
42.11
4.21
0.00
29.47
0.00
0.00
25.26
10.53
0.00
9.91
0.00
VideoShield
100.00
99.00
90.00
100.00
100.00
92.00
100.00
100.00
82.00
100.00
100.00
100.00
96.92
82.00
Video Seal
67.00
45.00
3.00
100.00
64.00
1.00
99.00
26.00
2.00
99.00
93.00
63.00
55.17
1.00
VideoSignature
0.00
0.00
0.00
2.00
0.00
0.00
2.00
0.00
0.00
5.00
0.00
0.00
0.75
0.00
COVER (Ours)
92.00
81.53
27.43
98.00
86.01
32.13
97.53
76.24
11.11
96.28
88.10
67.20
71.13
11.11
Appendix
Table 4. Detection accuracy (%) under 12 real codec settings from four codec families. Best in bold, second best underlined.
Figure 5. More examples of qualitative comparison. Each video clip is shown by eight frames.
Recent advances in video generation have increased the demand for reliable watermarking for copyright protection, yet the robustness of video watermarks against removal attacks remains underexplored. Most watermark-removal methods originate from the image domain: signal optimization injects imperceptible pixel-domain perturbations, whereas generative resynthesis produces a visually similar instance through diffusion synthesis. When extended to videos, the former introduces temporally varying noise that causes visible flickering, while the latter regenerates fine-grained structures inconsistently across frames, leading to structural motion inconsistency. To evaluate video watermark robustness, we propose PoseRegen, a pose-consistent reconstruction framework that removes watermarks while preserving the original content and motion. PoseRegen first applies a temporally shared viewpoint transformation to disrupt watermark-bearing spatial patterns and then jointly reconstructs the transformed sequence with a pose-conditioned video model. A frozen video DiT processes the complete sequence with its reference-video latent, and full-sequence Flow Matching supervision keeps identity and background consistent across frames. To further preserve motion structure, we introduce a lightweight Pose-Conditioned Motion Consistency Adapter that adapts the frozen backbone to temporally ordered pose guidance and constrains body-part trajectories throughout reconstruction. Experiments on eleven video watermarking schemes show that PoseRegen reduces the average bit accuracy to 0.505, near random guessing, while outperforming the strongest baseline by 9.34% on motion-related VBench metrics. These results reveal a practical vulnerability of current video watermarks and highlight the need to evaluate robustness jointly with temporal and motion quality.
Yifan Liao, Zhen Sun, Zhicong Huang +6
The Hong Kong University of Science and Technology (Guangzhou) · Ant Group · Nanyang Technological University +2
Existing waveform-domain audio watermarks are robust to many conventional distortions but can degrade substantially under neural codec resynthesis. We investigate whether continuous neural codec latents provide a more suitable embedding space using a restricted formulation built around frozen pretrained EnCodec. To test this, a feedforward embedder maps a multi-bit payload to an additive latent perturbation decoded through the unchanged codec decoder. Compared with AudioSeal and WavMark, our latent watermark formulation degrades more gradually under repeated and low-bitrate EnCodec resynthesis, transfers to unseen DAC, and retains high detection under most waveform distortions. Substantial EnCodec robustness emerges even without codec-resynthesis supervision, indicating that this behavior is inherent to our latent formulation and is further strengthened by codec-aware training. Learned perturbations are also preserved more strongly through codec cycling than equal-norm random controls, with preservation depending more on channel-specific allocation than temporal structure. End-to-end perceptual quality remains close to that of the frozen EnCodec reconstruction, indicating that much of the observed degradation originates from the codec carrier itself. Overall, these results show that continuous neural codec latents provide a promising embedding space for watermarks that remain robust to neural codec resynthesis.
Lovro Brulec, Sahil Karawade, Leonard Kinzinger
Munich Music Labs · Technical University of Munich
We present FlowMark, a video watermarking framework guided by automatically predicted object masks. In contrast to prior region-based approaches that require user-supplied mask guidance, FlowMark learns to identify optimal regions for watermark embedding through a dedicated Mask Predictor network. Our end-to-end trainable architecture combines region-aware encoding with noise-augmented training to ensure robustness against compression, geometric transformations, and content variation, while preserving high perceptual quality. Our content-adaptive masking keeps watermark signals coherent with natural video dynamics, effectively eliminating perceptual flicker. Beyond compression robustness, FlowMark maintains reliable watermark recovery under video-native temporal edits (e.g., frame swap, insertion, deletion, resampling, and interpolation) and real-world social media distribution pipelines (e.g., YouTube and Facebook re-encoding). Experimental results on both image and video datasets show that FlowMark reliably embeds 128-bit messages with up to 50.08 dB PSNR, offering strong performance for content provenance, temporal authenticity verification, and video integrity protection.