Erase the Mark, Preserve the Motion: Temporally Consistent Removal of Video Watermarks

Yifan Liao; Zhen Sun; Zhicong Huang; Jiaming He; Zongmin Zhang; Xi Ai; Cheng Hong; Xinhu Zheng

cs.CROct 15, 2026

Erase the Mark, Preserve the Motion: Temporally Consistent Removal of Video Watermarks

Authors: Yifan Liao, Zhen Sun, Zhicong Huang, Jiaming He, Zongmin Zhang, Xi Ai, Cheng Hong, Xinhu Zheng,

Organizations: The Hong Kong University of Science and Technology (Guangzhou) · Ant Group · Nanyang Technological University · National University of Singapore ·

Abstract

Recent advances in video generation have increased the demand for reliable watermarking for copyright protection, yet the robustness of video watermarks against removal attacks remains underexplored. Most watermark-removal methods originate from the image domain: signal optimization injects imperceptible pixel-domain perturbations, whereas generative resynthesis produces a visually similar instance through diffusion synthesis. When extended to videos, the former introduces temporally varying noise that causes visible flickering, while the latter regenerates fine-grained structures inconsistently across frames, leading to structural motion inconsistency. To evaluate video watermark robustness, we propose PoseRegen, a pose-consistent reconstruction framework that removes watermarks while preserving the original content and motion. PoseRegen first applies a temporally shared viewpoint transformation to disrupt watermark-bearing spatial patterns and then jointly reconstructs the transformed sequence with a pose-conditioned video model. A frozen video DiT processes the complete sequence with its reference-video latent, and full-sequence Flow Matching supervision keeps identity and background consistent across frames. To further preserve motion structure, we introduce a lightweight Pose-Conditioned Motion Consistency Adapter that adapts the frozen backbone to temporally ordered pose guidance and constrains body-part trajectories throughout reconstruction. Experiments on eleven video watermarking schemes show that PoseRegen reduces the average bit accuracy to 0.505, near random guessing, while outperforming the strongest baseline by 9.34% on motion-related VBench metrics. These results reveal a practical vulnerability of current video watermarks and highlight the need to evaluate robustness jointly with temporal and motion quality.

Figures & tables

Figure 1: Comparison of video watermark removal methods. Signal optimization introduces frame-varying perturbations that cause temporal flickering around the subject’s head, while generative resynthesis reconstructs fine-grained structures inconsistently across frames, leading to motion inconsistency. In contrast, our method removes the watermark while preserving both temporal coherence and motion structure. Red circles highlight the affected head regions. Please zoom in for better visualization.

Figure 2: Overview of our pose-conditioned motion-consistent video watermark removal framework.

Attack	Post-hoc Watermark									Video Watermark
Attack	dwtDct	dwtDctSvd	RivaGAN	Stable Signature	StegaStamp	TrustMark	MaskWM	VINE	Avg.	VideoMark	VideoShield	SigMark	Avg.
HunyuanVideo
Clean	0.814	0.903	0.972	0.834	1.000	0.997	1.000	0.999	0.940	0.864	0.998	0.961	0.941
Bright.	0.470	0.491	0.934	0.826	0.988	0.953	0.998	0.987	0.831	0.746	0.992	0.905	0.881
Contrast	0.478	0.486	0.921	0.827	0.995	0.959	0.998	0.999	0.833	0.705	0.998	0.906	0.870
JPEG	0.490	0.636	0.877	0.711	0.999	0.985	0.993	0.999	0.836	0.500	0.900	0.502	0.634

Table 1: Bit accuracy of different watermark-removal attacks on HunyuanVideo and Wan2.2. Lower bit accuracy indicates stronger watermark removal. Cells are color-coded by bit accuracy: red denotes values above

0.7

, orange denotes values between

0.6

and

0.7

, and blue denotes values below

0.6

Method	VBench 1.0				VBench 2.0		Image Fidelity
Method	Temporal Flickering $\uparrow$	Subject Consistency $\uparrow$	Background Consistency $\uparrow$	Motion Smoothness $\uparrow$	Human Identity $\uparrow$	Motion Order $\uparrow$	CLIP-FID $\downarrow$
$\mathsf{PoseRegen}$	0.9878	0.9356	0.9678	0.9913	0.8395	0.1884	0.0823
WEvade	0.9655	0.9203	0.9414	0.9795	0.7924	0.1607	0.0980
UnMarker	0.9643	0.9122	0.9495	0.9787	0.8032	0.1723	0.1050
WatermarkAttacker	0.9685	0.9052	0.9400	0.9762	0.7167	0.1200	0.0825
CtrlRegen	0.9620	0.8967	0.9287	0.9700	0.7662	0.1167	0.1192

Table 2: Comparison of video quality and image fidelity. Higher values are better for VBench metrics, while lower CLIP-FID indicates better content fidelity.

Figure 3: Ablation study of the Pose-Conditioned Motion Consistency Adapter.

Panel of Figure 4 — Figure 4: Ablation studies of the shared viewpoint transformation and reconstruction strength.

Appendix figures & tables2 assets

Supplementary material from the paper’s appendix.

Appendix

Method	Watermark Bit Accuracy $\downarrow$				NJTE $\downarrow$	Motion Order $\uparrow$	Human Identity $\uparrow$	CLIP-FID $\downarrow$
Method	VINE	Stable Signature	SIGMark	Selected Avg.	NJTE $\downarrow$	Motion Order $\uparrow$	Human Identity $\uparrow$	CLIP-FID $\downarrow$
$\mathsf{PoseRegen}$	0.583	0.439	0.500	0.507	0.1424	0.1884	0.8395	0.0823
WatermarkAttacker	0.913	0.430	0.500	0.614	0.1503	0.1200	0.7167	0.0825
CtrlRegen	0.725	0.419	0.500	0.548	0.1446	0.1167	0.7662	0.1192
NFPA	0.516	0.510	0.501	0.509	0.2661	0.0533	0.7829	0.2193

Appendix

Table 3: Additional comparison of watermark removal and articulated-motion fidelity among generative reconstruction and prediction attacks. Bit-accuracy values are taken from the HunyuanVideo results in Table 1 . The selected average summarizes VINE, Stable Signature, and SIGMark, which are included in this additional motion-fidelity evaluation. Lower bit accuracy, NJTE, and CLIP-FID are better, while higher Motion Order and Human Identity are better.

Variant	NJTE $\downarrow$	Temporal Flickering $\uparrow$	Motion Order $\uparrow$	Human Identity $\uparrow$	CLIP-FID $\downarrow$
Zero Pose Diagnostic	0.1436	0.9657	0.1449	0.7592	0.0893
Shuffled Pose	0.1573	0.9591	0.1014	0.7379	0.0927
Reversed Pose	0.2829	0.9540	0.1304	0.7268	0.0904
Frozen DiT w/o Motion Adapter	0.1564	0.9783	0.1645	0.8205	0.0849
Ordered Pose + Motion Adapter	0.1424	0.9878	0.1884	0.8395	0.0823

Appendix

Table 4: Component analysis of temporally ordered pose guidance and the Motion Consistency Adapter. The zero-pose setting is an inference-time diagnostic in which the pose features are replaced with zero features. Lower NJTE and CLIP-FID are better, while higher Temporal Flickering, Motion Order, and Human Identity are better.

Watermark Removal

Watermark removal studies how to erase or evade embedded signals in text, images, and audio while preserving useful content.

See all 40 papers

Sep 22, 2025

LoT-Pass: Long-term-robust Image Watermarking for Image to Video Generation

The rapid progress of image-guided video generation (I2V) has raised concerns about its potential misuse in misinformation and fraud, underscoring the urgent need for effective digital watermarking. While existing watermarking methods demonstrate robustness within a single modality, they fail to trace source images in I2V settings. To address this gap, we introduce the concept of Robust Diffusion Distance, which measures the temporal persistence of watermark signals in generated videos. Building on this, we propose I2VWM, a cross-modal watermarking framework designed to enhance watermark robustness across time. I2VWM leverages a video-simulation noise layer during training and employs an optical-flow-based alignment module during inference. Experiments on both open-source and commercial I2V models demonstrate that I2VWM significantly improves robustness while maintaining imperceptibility, establishing a new paradigm for cross-modal watermarking in the era of generative video. Code Released.

Guanjie Wang, Zehua Ma, Han Fang +1

University of Science and Technology of China

Diffusion Model Watermarking Image-to-Video Generation Robust Watermarking

Ask PDF

Sep 20, 2026

An Efficient and Effective Watermarking Scheme for the Protection of the Intellectual Property Rights of Video Generative Models

The rapid development of video generative models (VGMs) has enabled the generation of highly realistic synthetic videos, raising concerns about the intellectual property rights (IPR) of these models. In particular, two closely related forensic tasks remain largely unaddressed: synthetic video verification (determining whether a video was generated by a protected VGM) and model ownership verification (determining whether a suspect VGM is an unauthorized copy of a protected VGM). In this paper, we propose a new in-generation watermarking scheme that can address the two verification tasks. First, a novel video watermarking network named VidMark is presented, which incorporates a two-scale discrete wavelet transform (DWT) decomposition and a global temporal attention block (GTAB) to enhance watermark robustness and imperceptibility. Second, we present a decoder-guided fine-tuning procedure. By leveraging the frozen VidMark decoder, this process enables VGMs to synthesize videos carrying an imperceptible, robust, and model-specific watermark. Finally, two verification frameworks are established to perform synthetic video verification and model ownership verification. Extensive experiments on representative VGMs demonstrate that the proposed scheme achieves over 99% watermark extraction accuracy and 100% verification accuracy on both tasks, with negligible impact on video generation quality. Furthermore, the watermarks exhibit strong robustness against a comprehensive range of video-level and model-level attacks.

Wenhong Huang, Jianwei Fei, Benedetta Tondi +2

School of Cyber Science and Technology, Shenzhen Campus of Sun Yat-sen University, Shenzhen 518107, China · Guangdong Provincial Key Laboratory of Information Security Technology, Guangzhou 510006, China · Department of Information Engineering, University of Florence, Florence 50139, Italy +2

Robust Watermarking

Ask PDF

Jul 6, 2026

FlowMark: Mask-Guided Video Watermarking

We present FlowMark, a video watermarking framework guided by automatically predicted object masks. In contrast to prior region-based approaches that require user-supplied mask guidance, FlowMark learns to identify optimal regions for watermark embedding through a dedicated Mask Predictor network. Our end-to-end trainable architecture combines region-aware encoding with noise-augmented training to ensure robustness against compression, geometric transformations, and content variation, while preserving high perceptual quality. Our content-adaptive masking keeps watermark signals coherent with natural video dynamics, effectively eliminating perceptual flicker. Beyond compression robustness, FlowMark maintains reliable watermark recovery under video-native temporal edits (e.g., frame swap, insertion, deletion, resampling, and interpolation) and real-world social media distribution pipelines (e.g., YouTube and Facebook re-encoding). Experimental results on both image and video datasets show that FlowMark reliably embeds

128

-bit messages with up to

50.08

dB PSNR, offering strong performance for content provenance, temporal authenticity verification, and video integrity protection.

Vishal Asnani, Shruti Agarwal, John Collomosse

Adobe Research · DECaDE, University of Surrey

Robust Watermarking

Ask PDF

Abstract

Watermark Removal

Explore similar work

LoT-Pass: Long-term-robust Image Watermarking for Image to Video Generation

An Efficient and Effective Watermarking Scheme for the Protection of the Intellectual Property Rights of Video Generative Models

FlowMark: Mask-Guided Video Watermarking