Paper deep dive
SKeDA: A Generative Watermarking Framework for Text-to-video Diffusion Models
Yang Yang, Xinze Zou, Zehua Ma, Han Fang, Weiming Zhang
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 85%
Last extracted: 7/20/2026, 7:48:31 AM
Summary
The paper introduces SKeDA, a generative watermarking framework for text-to-video diffusion models designed to address limitations in existing methods regarding frame alignment and robustness against video-specific distortions. SKeDA utilizes a Shuffle-Key-based Distribution-preserving Sampling (SKe) module to decouple watermark extraction from strict frame-level alignment by using permutation-tolerant set-level aggregation. Additionally, it employs a Differential Attention (DA) module to enhance robustness against temporal distortions by computing inter-frame differences. The framework aims to provide high fidelity, strong robustness against compression and frame manipulation, and effective traceability for copyright protection.
Entities (52)
Relation Signals (34)
SKeDA → containscomponent → SKe Module
confidence 95% · SKeDA consists of two components: (1) Shuffle-Key-based Distribution-preserving Sampling (SKe)
SKeDA → containscomponent → DA Module
confidence 95% · and (2) Differential Attention (DA)
SKeDA → targets → Text-to-Video Diffusion Models
confidence 95% · SKeDA, a generative watermarking framework tailored for text-to-video diffusion models
Yang Yang → affiliatedwith → Anhui University
confidence 90% · Yang Yang and Xinze Zou are with the School of Electronic and Information Engineering, Anhui University
Han Fang → affiliatedwith → National University of Singapore
confidence 90% · Han Fang is with the School of Computing, National University of Singapore
Weiming Zhang → affiliatedwith → University of Science and Technology of China
confidence 90% · Zehua Ma and Weiming Zhang are with... University of Science and Technology of China
Zehua Ma → affiliatedwith → University of Science and Technology of China
confidence 90% · Zehua Ma and Weiming Zhang are with... University of Science and Technology of China
Xinze Zou → affiliatedwith → Anhui University
confidence 90% · Yang Yang and Xinze Zou are with the School of Electronic and Information Engineering, Anhui University
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:The rise of text-to-video generation models has raised growing concerns over content authenticity, copyright protection, and malicious misuse. Watermarking serves as an effective mechanism for regulating such AI-generated content, where high fidelity and strong robustness are particularly critical. Recent generative image watermarking methods provide a promising foundation by leveraging watermark information and pseudo-random keys to control the initial sampling noise, enabling lossless embedding. However, directly extending these techniques to videos introduces two key limitations: Existing designs implicitly rely on strict alignment between video frames and frame-dependent pseudo-random binary sequences used for watermark encryption. Once this alignment is disrupted, subsequent watermark extraction becomes unreliable; and Video-specific distortions, such as inter-frame compression, significantly degrade watermark reliability. To address these issues, we propose SKeDA, a generative watermarking framework tailored for text-to-video diffusion models. SKeDA consists of two components: (1) Shuffle-Key-based Distribution-preserving Sampling (SKe) employs a single base pseudo-random binary sequence for watermark encryption and derives frame-level encryption sequences through permutation. This design transforms watermark extraction from synchronization-sensitive sequence decoding into permutation-tolerant set-level aggregation, substantially improving robustness against frame reordering and loss; and (2) Differential Attention (DA), which computes inter-frame differences and dynamically adjusts attention weights during extraction, enhancing robustness against temporal distortions. Extensive experiments demonstrate that SKeDA preserves high video generation quality and watermark robustness.
Tags
Links
- Source: https://arxiv.org/abs/2603.00194v1
- Canonical: https://arxiv.org/abs/2603.00194v1
Trouble viewing inline? Open PDF directly →
Full Text
59,305 characters extracted from source content.
Expand or collapse full text
1 SKeDA: A Generative Watermarking Framework for Text-to-video Diffusion Models Yang Yang , Xinze Zou , Zehua Ma , Han Fang and Weiming Zhang Abstract—The rise of text-to-video generation models has raised growing concerns over content authenticity, copyright protection, and malicious misuse. Watermarking serves as an effective mechanism for regulating such AI-generated content, where high fidelity and strong robustness are particularly crit- ical. Recent generative image watermarking methods provide a promising foundation by leveraging watermark information and pseudo-random keys to control the initial sampling noise, enabling lossless embedding. Meanwhile, the invertibility of DDIM further allows robust watermark extraction. However, directly extending these techniques to videos introduces two key limitations: (1) Existing designs implicitly rely on strict alignment between video frames and frame-dependent pseudo- random binary sequences used for watermark encryption. Once this alignment is disrupted, subsequent watermark extraction becomes unreliable; and (2) Video-specific distortions, such as inter-frame compression, significantly degrade watermark reliability. To address these issues, we propose SKeDA, a generative watermarking framework tailored for text-to-video diffusion models. SKeDA consists of two components: (1) Shuffle-Key-based Distribution-preserving Sampling (SKe) em- ploys a single base pseudo-random binary sequence for water- mark encryption and derives frame-level encryption sequences through permutation. This design transforms watermark ex- traction from synchronization-sensitive sequence decoding into permutation-tolerant set-level aggregation, substantially im- proving robustness against frame reordering and loss; and (2) Differential Attention (DA), which computes inter-frame differences and dynamically adjusts attention weights during extraction, enhancing robustness against temporal distortions. Extensive experiments demonstrate that SKeDA preserves high video generation quality and significantly improves watermark robustness under compression, frame deletion, and noise, out- performing existing baselines in both fidelity and traceability. Index Terms—text-to-video, copyright protection, pseudo- random key, generative watermark, diffusion model This work was supported in part by the National Natural Sci- ence Foundation of China under Grant 62272003, in part by the Quantum Science and Technology-National Science and Technology Major Project under Grant 2021ZD0302300, in part by the Science and Technology Major Project of Anhui Province under Grant 202423s06050001. (Corresponding authors: Han Fang; Zehua Ma.) Yang Yang and Xinze Zou are with the School of Electronic and Information Engineering, Anhui University, Hefei, Anhui 230601, China (e-mail: sky yang@ahu.edu.cn; p23201049@stu.ahu.edu.cn). Zehua Ma and Weiming Zhang are with Anhui Province Key Laboratory of Digital Security and the CAS Key Laboratory of Electromagnetic Space Information, University of Science and Tech- nology of China, Hefei 230026, China (e-mail: mzh045@ustc.edu.cn; zhangwm@ustc.edu.cn). Han Fang is with the School of Computing, National University of Singapore, Singapore 117417 (e-mail: fanghan@nus.edu.sg). Detection Traceability Generated by Model-A Generated it Bob Alice Dave Bob Watermarked T2V Model-B Video-A Video-B Prompt Prompt Stolen Watermarked T2V Model-A Fig. 1: Application scenarios. The proposed method can detect the source of the model that generated the video, as well as track which user created the video. I. Introduction T HE rapid advances in generative AI, especially text- to-video diffusion models such as CogVideo [ 1], Make-A-Video [2], and Video Diffusion [3], have trans- formed digital content creation. These systems can synthe- size visually compelling and semantically coherent videos directly from natural language prompts, dramatically lowering the barrier to video production. However, the same capabilities have also intensified concerns surround- ing copyright protection, provenance verification, and the large-scale dissemination of synthetic or misleading media. AI-generated videos may replicate copyrighted materials or fabricate photorealistic content, leading to risks of misattribution and misuse [ 13], [52]. In response, regulatory frameworks such as the EU AI Act [5] and the U.S. COPIED Act [6] increasingly mandate traceability mechanisms for synthetic media. Ensuring that generated videos carry strong, verifiable authenticity signals has thus become essential for safeguarding intellectual property and maintaining trust in digital ecosystems. Digital watermarking provides a principled mechanism for verifying the authenticity and provenance of generated content by embedding imperceptible signals during the generation process. As illustrated in Fig.1, a watermark enables reliable attribution in both benign and adversarial scenarios—for example, allowing a user like Alice to prove that a video originates from Model A, or preventing an adversary such as Dave from misappropriating Bob’s generated content. For a watermarking system to function effectively in such real-world cases, two properties are essential: fedility and robustness. Fedility requires that the embedded watermark remain imperceptible to human viewers and introduce no degradation to the visual quality of the generated video. Robustness ensures that the arXiv:2603.00194v1 [cs.CV] 27 Feb 2026 2 watermark can still be faithfully recovered after the video undergoes common transformations such as compression, resizing, noise corruption, transmission artifacts, or tem- poral manipulations. These two properties jointly ensure that watermarking can provide trustworthy attribution while preserving the intended viewing experience. Traditional video watermarking methods typically ap- plied a post-hoc embedding procedure to embed water- mark signals into the pixel domain or the compressed domain. For example, compressed-domain approaches modify AC coefficients in H.264/AVC streams [51] to embed bits during encoding, while deep models such as VideoSeal [43] and DVMark [49] use neural encoders to in- ject watermark information into spatial-temporal features. Although these methods can achieve moderate robustness, they suffer from two fundamental drawbacks. First, post- hoc embedding inevitably introduces perturbations to completed video frames, often causing visual artifacts or compression-induced distortion that compromise invisibil- ity. Second, robustness remains limited: watermark signals are fragile under strong video-specific operations such as high-rate compression, temporal cropping, frame deletion, or re-encoding. Consequently, traditional watermarking schemes struggle to simultaneously maintain impercepti- bility and resilience in modern generative video pipelines. Recent progress in generative image watermarking offers a compelling alternative by embedding watermark infor- mation directly in the latent noise of diffusion models. Techniques such as Gaussian Shading [25] achieve prov- ably lossless visual fidelity because watermark signals in- fluence only the initial noise distribution rather than per- turbing the generated pixels. Their deterministic inversion procedures further enable reliable watermark extraction without retraining the generative model. However, extend- ing these image-based generative watermarking techniques to video generation introduces two structural limitations. First, existing designs implicitly rely on strict align- ment between video frames and frame-dependent pseudo- random binary sequences used to encrypt watermark bits prior to noise sampling. Common video operations such as frame deletion, reordering, or re-encoding can easily disrupt this alignment, causing bit-level desynchro- nization and unreliable watermark extraction. Second, video-specific distortions, such as inter-frame compression, frame reordering, or temporal jitter, destroy the temporal alignment required for inversion-based extraction, causing the watermark signal to desynchronize across frames. These issues make naïve extensions of image watermarking unsuitable for the temporal and structural characteristics of text-to-video diffusion. To address these challenges, we introduce SKeDA, a generative watermarking framework designed specif- ically for text-to-video diffusion models. SKeDA con- tains two complementary components. The Shuffle-Key distribution-preserving sampling (SKe) module generates a single base pseudo-random binary sequence for water- mark encryption, while frame-level variations are intro- duced solely through permutation. By constraining frame- wise encryption masks to permutations of a shared base sequence, SKe decouples watermark extraction from strict frame-level alignment and transforms synchronization- sensitive sequence decoding into permutation-tolerant set- level aggregation, enabling robust watermark recovery under temporal desynchronization. Importantly, this de- sign preserves the Gaussian noise sampling distribution required by diffusion models while maintaining sufficient randomness across frames. The Differential Attention (DA) module enhances extraction robustness by com- puting inter-frame differences to identify stable regions and adaptively reweighting temporal attention during inversion, allowing the system to remain reliable under compression, frame deletion, and temporal distortions. Together, these modules embed watermark information directly within the diffusion trajectory, achieving high invisibility, temporal robustness, and scalable traceability for long videos. The experimental results show that SKeDA achieves deep fusion of watermark and content at the latent space level of the diffusion model, taking into account invisibility, traceability and robustness. The robustness in common video compression scenarios such as H.264/H.265 is improved by 5%-20% on the basis of mainstream meth- ods, while maintaining excellent performance in visual fidelity. The framework provides an efficient and robust technical solution for copyright protection and traceability of generated video content. The contributions of this paper are as follows: •We propose a novel generative video watermark- ing method that simultaneously preserves genera- tion quality and enhances robustness. To maintain the native fidelity of text-to-video diffusion models, we introduce the Shuffle-Key distribution-preserving sampling (SKe) module. SKe employs a single base pseudo-random sequence and derives frame-level vari- ations through permutation, preserving the Gaussian noise sampling distribution while enabling impercep- tible latent watermark embedding and robust water- mark extraction under severe temporal misalignment. •We propose an inter-frame difference attention DA module for the extraction phase, which adaptively assigns the extraction weight for each frame by using the difference of each frame of the video over time. The DA module enhances the stability of water- mark retrieval under various distortions (including compression, frame loss, and noise), thereby greatly improving robustness without any retraining of the text-to-video model. •Extensive experiments have proven that our solution is able to withstand a variety of attacks, including video compression, frame manipulation, and noise addition, while maintaining high video quality and high extraction accuracy. 3 I. Related Work A. Text to Video Generative Models Text-to-Video Generation [1], [18], [30] is a cutting- edge direction in the field of generative AI, which aims to generate video content that conforms to the description based on natural language descriptions. In recent years, significant progress has been made in the development of text-to-video models based on diffusion models, which generate high-quality, time-consistent videos by modeling the video generation process as a denoising process from noise to data. The text-to-video model is usually based on the diffusion model, which extends the image diffusion model to the video generation task. CogVideo is an early open-source text-to-video model, which achieves continuity between video frames by adding Temporal Attention Modules on the basis of the pre-trained Wen- sheng image model. Make-A-Video proposed Pseudo-3D Convolution and Temporal Self-Attention to capture the temporal dynamics of video. Imagen Video uses Cascaded Diffusion Models to generate low- to high-resolution videos in multiple stages to improve the quality of the video. VideoCrafter [4] and Lumiere [7] further optimize the temporal modeling, introduce Spatio-Temporal Decompo- sition and efficient sampling strategies, and significantly reduce the computational cost. Recently, architectures based on a combination of variational autoencoder (VAE) and diffusion model have become mainstream. Sora [9] is an advanced AI video generation tool that can create realistic and imaginative scenes based on text instructions. Open-source models such as Open-Sora [ 10] and Latte [14] borrow from Sora’s architecture to provide more efficient training and inference methods. These models typically operate in Latent Space, where the video is compressed into a low- dimensional representation by a variational autoencoder, which is then denoised by the diffusion model. While significant progress has been made in the gen- eration of text-to-videos, several challenges remain. First, computationally expensive and requiring a lot of GPU resources for training and inference. Efficient Video Dif- fusion [ 26] and FastVideo [27] attempt to alleviate this problem through model compression and efficient sam- pling algorithms. Secondly, the temporal consistency and semantic accuracy of the generated video still need to be improved, especially in the generation of long videos. LongVideoBench [ 28] provides a benchmark for long video generation, highlighting the limitations of existing models in complex scenarios. In addition, there is a growing concern about the copyright and ethics of generated content, and initiatives such as Hoshiar [ 29] have examined the concept of authorship, a cornerstone of copyright, and its applicability to AI. B. Video Watermarking Video watermarking technology aims to achieve copy- right protection, content authentication, and source track- ing by embedding invisible identification information in videos [25], [36], [40], [53]. Traditional video watermarking technology is mainly used to protect the copyright of digi- tal media and prevent unauthorized copying. Asikuzzaman and Pickering [31] provide a comprehensive overview of embedding methods based on domains such as discrete cosine transform (DCT) [61], discrete wavelet transform (DWT) [62], and singular value decomposition (SVD) [63]. These methods typically embed watermark information into the Frequency Domain or Spatial Domain of the video to ensure that the watermark is robust to attacks such as compression, cropping, and noise. For example, Cox et al. [32] proposed a DCT-based watermarking scheme to achieve a balance between concealment and robustness by embedding watermarks in the low-frequency components of the video frame. Hartung and Girod [ 33] developed a watermarking method based on the MPEG compression domain for real-time video streaming. In recent years, deep learning technology has been introduced into traditional video watermarking. Zhang et al. [ 34] proposed a robust watermarking method based on attention mechanism to enhance resistance to geometric attacks by embedding watermarks in high-information areas in video frames. Fernandez et al. [43] developed a comprehensive framework for neural video watermarking and a competitive open-sourced model. These methods significantly improve the robustness of watermarks, but they still focus on traditional video content rather than the dynamic nature of AI-generated videos. The limitation of traditional video watermarking is that it is often embedded in a post-hoc processing manner, which can lead to degraded quality or insufficient adapt- ability to complex transformations. In addition, tradi- tional methods often assume that video content is static and difficult to adapt to the generation process of text-to- video models, which prompted researchers to turn to new methods of embedding watermarks in the generation pro- cess. The diffusion model is the mainstream architecture of text-to-video generation, so many methods for generating video watermarks are directly designed for the diffusion model. VideoShield [ 36] is a watermarking framework specifically designed for diffusion video generation models, which embeds watermarks directly during the generation process by mapping watermark bits to template bits and generating watermark noise during denoising. This method does not require additional training and supports tamper detection in time and space, which is highly relevant to our method in terms of embedding timing. DiffuseTrace [37] proposes a transparent watermarking scheme, which unifies the watermark information with the initial latent variable through the encoder-decoder model and embeds it into the sampling process of the diffusion model. The proposed method shows strong resistance to attacks based on Variational Autoencoder (VAE) and diffusion model. Latent space watermark is another important direction to generate video watermarks. Fernandez et al. [ 38] pro- posed a Stable Signature method to achieve stability in model updates by embedding binary signatures during the 4 Sampling V' Shuffle key Watermark Embedding s Repeat 1010 Reverse Sampling Watermark Extraction s' E DDIM Inversion Z' T Z' 0 D Denoising Z T Z 0 Motion Module V Prompts: detailed modern office space... 1010 1010 m s d Reordering 1010 1010 Sorting Video Noise Layer 1010 Decision Input Diff & Similarity Attention DA Module 10101010 acc(s, s') 1010 1010 m' s' d 1010 1010 1010 1010 SKe Module SKe Module Equalizing key Fig. 2: The framework of SKeDA. Our method consists of four main components: encryption, embedding, extraction, and decryption. In the encryption and embedding stages, the SKe module uses random shuffle key to distribute and rearrange in the latent space to realize the hidden embedding of watermark information without affecting the video quality. In the extraction and decryption stage, the DA module adaptively assigns weights based on the inter-frame difference in the extraction stage, to improve the robustness and retrieval accuracy of the watermark under various distortion conditions. sampling process of latent diffusion models. Wen et al. [39] proposed Tree-ring Watermarks, which generate invisible and robust watermarks by embedding specific patterns in the latent space of the diffusion model. These methods are primarily aimed at image generation, but their ideas can be extended to video generation. For example, Dvmark proposed by Luo et al. [ 49] is a deep learning-based video watermarking framework that enhances robustness to video editing and compression by embedding watermarks through multi-scale features, but in some cases, watermark embedding may have a slight impact on the visual quality of the video. I. Proposed Method In this section, we elaborate on our proposed water- marking scheme for text-generated videos. This method embeds a watermark into the latent space of a diffu- sion model prior to video generation, ensuring seamless integration with the content. The approach is designed to achieve robustness against various attacks, maintain high visual fidelity, and eliminate the need for retraining the underlying text-to-video model. The framework of our method as shown in Fig. 2. They are respectively the watermark embedding and watermark extraction stages, each comprising distinct steps detailed below. A. Watermark Embedding 1) Message Encoding: In the initial stage of water- mark embedding, we embed the watermark information seamlessly into the latent space of the video while en- suring imperceptibility and robustness. The watermark is represented as a binary string within the set0,1. This binary string can encode various identifiers, such as copyright notices, authentication tokens, or unique ownership tags, which are customized for specific use cases. And the initial size is defined as ( f k f , c f c , h f h , w f w ) bits. Among them,frepresents the feature dimension,c represents the number of channels,handwcorrespond to the height and width of the latent space, respectively. The scaling factorsk f ,f c ,f h andf w are the corresponding hyperparameters, which are used to adjust the size of the watermark to be consistent with the structure of the latent space(f, c, h, w). Then we use a randomly generated equalizing key of 0,1 uniformly distributed to convert the watermark information into a uniformly distributed sequence through XOR operation, to prevent the impact of uneven distribution of watermark information on the embedding process. The extended process involves copying the watermark bits into the target dimension, and make it adapt to the input size of the model while maintaining the integrity of the original information. This step can ensure that the watermark is evenly distributed throughout the latent representation, and enhance its ability to resist local distortion or attack. m=s d [k i ]|k i ∈key, i= 1,2, . . . , n(1) 2) SKe Module: Next, we introduce the SKe mod- ule, which includes scrambling operations for extended secret messages and sampling of encrypted messages, using random keys to ensure lossless visual quality, and embedding watermark information into each video frame. First, we employ an Equalizing key to uniformly distribute the original message, ensuring an approximately uniform statistical distribution. Then, we use a randomly shuffled 5 sequence as the encryption key, this key enables the re- ordering watermark information to maintain a high degree of randomness while maintaining an even distribution, which is convenient for subsequent sampling to conform to the Gaussian distribution and achieve lossless generation quality. Furthermore, this design minimizes the depen- dence on multiple keys while preserving the visual fidelity of the generated frames, thereby enabling generation for long video sequences. The encryption process is performed by reordering the elements of the secret informations d using the generated keykey, which generates an encrypted messagem, as shown in Eq. (1). This encryption method ensures that the embedded information remains hidden even if the hidden space is intercepted or analyzed. To map the encrypted messageminto the latent space, as shown in Fig.2, for any biti∈0,1in message m , which corresponds to the α in Z T , here we use f ( · ) , ppf(·)to represent the probability density function and percentile function of the Gaussian distributionN(0,1), then we have: p(α|i) = 2f(α), ppf( i 2 )< α≤ppf( i+1 2 ) 0,otherwise .(2) At this point,Z T is also a standard Gaussian distribution, and we can get the probability distribution ofαas: p(α) = 1 ∑ i=0 p(α|i)p(i) = 1 2 (p(α|0) +p(α|1)) =f(α).(3) After that, we perform iterative denoising on noise state Z T to obtain the latent representationZ 0 after denoising. Here we adopt the DPMSolver [ 65] algorithm, which can accelerate convergence while maintaining or enhancing the quality of the generated output. Due to its ability to optimize step size and sampling trajectory, it is very suitable for real-time or resource-constrained applications. Text embedding is used to adjust the direction of each de- noising step, ensuring that the generated image conforms to the text description. 3) Video Generation: After denoising, we utilize the Stable Diffusion (SD) decoder [ 11] and AnimateDiff’s Motion Module [ 12] to convert the latent representation Z 0 into coherent video. The SD decoder maps spatial latent features to pixel space, generating high-quality images that retain semantic and structural information. However, as SD processes frames independently, the resulting sequence lacks temporal consistency. To ad- dress this, AnimateDiff’s motion module incorporates a temporal attention mechanism and trajectory-consistent transformations to ensure inter-frame coherence. This two- stage pipeline completes the process from latent space to image decoding and then to motion-aware video synthesis, ultimately resulting in effective watermark embedding in the latent space while maintaining high visual quality and temporal smoothness for text-to-video generation. B. Watermark Extraction 1) DDIM Inversion: In the watermark extraction stage, we begin by processing the attacked watermarked videoV ′ to recover the embedded watermark. The first step is to encode V ′ back into the latent space using the Stable Dif- fusion Encoder, which maps the high-dimensional visual content into a compact latent representationZ ′ 0 . This encoding process effectively inverts the original decoding path and enables us to operate directly in the latent domain, where the watermark was originally embedded. To retrieve the latent watermark information, we further reconstruct the noisy latent representationZ ′ T corre- sponding to the initial stage of the forward diffusion process. This is achieved using the DDIM (Denoising Diffusion Implicit Models) inversion technique [58], which simulates the forward diffusion steps in a deterministic and controllable manner. By progressively adding noise toZ ′ 0 over a predefined number of time steps, the DDIM inversion produces a noisy implicit representation ofZ ′ T that approximates the initial Gaussian noise state. This inversion is crucial for watermark recovery, as it restores the latent conditions under which the water- mark was originally embedded. Unlike stochastic diffusion models, DDIM provides a deterministic inversion path, which enhances consistency and fidelity in watermark extraction. Moreover, by operating entirely in the latent space, our approach remains robust to a wide range of distortions and video-level attacks, ensuring that the embedded watermark features are preserved and remain recoverable under adverse conditions. 2) Watermark Decoding based on DA Module: In the decoding phase, our goal is to recover the watermark messages ′ from the noisy latent representationZ ′ T . Firstly, the embedded bitm ′ is reconstructed by reverse sampling and analyzing the noisy latent representation. In order to improve the extraction accuracy, especially in the case of distortion, we have added DA module. The module utilizes the temporal information in the video by evaluating the similarity between the first frame and the rest of the video (cosine distance), dynamically assigning weights to each frame. Frames with high similarity have a lower degree of variation in motion and are given greater weights to amplify their contribution to the watermark recovery process, while frames with low similarity are given less weight to mitigate the potential impact. The cosine similarityS t between the first framef 1 and thetframe f t is calculated as follows: S t = f 1 ·f t ∥f 1 ∥f t ∥ (4) Then, the attention scoreA j,i is calculated by the simi- larity betweenjframe andiframe based on [ 24]. Finally, the final weightw t is calculated by combiningS t andA t,i as follows: w t = exp(S t + ∑ T i=1 A t,i ) ∑ T j=1 exp(S j + ∑ T i=1 A j,i ) (5) 6 After that, the weighted frame contributions are aggre- gated to calculate the encrypted messagem ′ , wherem t is the encrypted message obtained by reverse sampling the tframe: m ′ = j ∑ t=1 w t ×m t (6) Thenm ′ is decrypted using the same shuffle key used during embedding. Based on the information of keys, the elements ofm ′ are reversed to restore it to the states ′d where the secret information is repeatedly aggregated. After that,s ′d is aggregated after being divided into k f ×f c ×f h ×f w blocks by dimension, which are the scaling factors in the previous encoding process. M= N ∑ k=1 s ′ d k , N=k f ×f c ×f h ×f w (7) Here,Mdenotes the aggregate score for each block, the threshold (set at 0.5) determines the equalizing message. The final binary watermark messages ′ is obtained by performing a XOR operation with the equalizing key: s ′ = 1, M >0.5 0, M≤0.5 (8) This chunked aggregation improves robustness and allows watermarks to be reconstructed even if parts of the video are lost or distorted, as redundant embedding across frames and spatial regions ensures sufficient data for accurate recovery. IV. Experiments A. Implementation Details All experiments were conducted on an NVIDIA RTX 4090 GPU equipped with 24GB of virtual memory, using its high computing power to handle the intensive needs of video watermarking and diffusion-based generation. We used a combination of Stable Diffusion version 1.5 and Animatediff’s Motion Module to implement our water- marking scheme. The SD model is the basis for generating video frames based on latent representations, while the motion module ensures temporal consistency between frames. Here we used the same parameter settings as most video watermarking methods such as Gaussian Shading [25]. The final video output is3×16×512×512, 2 seconds long, a total of 16 frames, and each frame has watermark information embedded. The latent space dimension of the embedded watermark is16×1×4×64×64. During the inference process, we configured the diffusion model into 25 time steps and 8 guidance scales to balance the generation quality and watermark embedding efficiency. During watermark detection, we evaluate performance by calculating the true positive rate (TPR) at a fixed false positive rate (FPR)(1×10 −6 ), and at the same time calculate bit precision to measure the accuracy of hidden information extraction. (a)(b)(c) (d)(e)(f) Fig. 3: One frame in the video is attacked by different noises. (a) Watermarked frame. (b) 50% Random Crop. (c) Brightness, factor=4. (d) Gaussian Blur, std=2.0. (e) Gaussian Noise, std=0.04. (f) H.264, CRF=30. TABLE I: Quality metrics for different video watermark- ing methods. MethodsFVD↓ CLIP-score↑ Video Quality↑ HiDDeN [35]436.10.30770.7436 REVMark [ 40]369.30.32870.7884 Video Seal [43]365.10.33020.7799 WAM [48]379.20.31460.7846 DVMark [ 49]382.80.32740.7742 ours 361.30.33450.7898 For evaluation, we randomly sampled a subset of videos from the WebVid-10M dataset [15], a large-scale video- text corpus. We calculated the evaluation metrics – Fréchette Video Distance (FVD) [ 20], CLIP score [64], and video quality [21] for 10 batches of data (each containing 100 videos) to ensure statistical robustness. B. Comparative Experiments We selected HiDDeN [35], REVMark [40], Video Seal [43], WAM [48] and DVMark [49] as baselines. HiDDeN is a representative image watermarking model from recent years. It achieves good concealment and robustness while maintaining high payload. When adapted for video, it typ- ically embeds the watermark frame-by-frame. VideoSeal, developed by Meta, is an efficient and open-source video watermarking framework known for its comprehensive performance. REVMark, Watermarking Anything Model (WAM) and DVMark are all models with good per- formance in recent years. Image watermarking methods typically employ a frame-by-frame embedding approach, embedding the watermark into the entire video, then extracting it frame by frame, averaging the weights of each frame, and finally fusing them together to form the final watermark information. Video watermarking methods, on the other hand, directly embed and extract watermarks from the video’s multi-degree features or latent space. 1) Visual Quality Comparison: To measure the impact of watermark embedding on video quality, we use FVD, CLIP-score, and Video Quality indicators to test, as 7 TABLE I: Comparison results. We control the FPR at10 −6 , and evaluate the bit accuracy for SD V1.5. Methods Frame Average (N=3) Frame Drop (p=0.5) Frame Swap (p=0.5) Random Crop (p=0.7) Gaussian Noise (std=0.04) Gaussian Blur (std=2.0) H.264 (CRF=30) Average HiDDeN [35]0.96910.99030.99100.77270.91270.72700.7008 0.8662 REVMark [40]0.99980.99810.99980.96310.99970.99820.8577 0.9738 Video Seal [43]0.99310.99190.99310.93560.98870.99040.8556 0.9632 WAM [48]0.98640.99030.99080.99120.98220.99980.8612 0.9717 DVMark [49]0.98100.98990.99350.97060.99010.98090.7996 0.9579 Ours0.98880.99900.99980.95850.98900.99320.9687 0.9853 reported in TableI. In order to calculate the FVD, we use 1000 videos from the dataset Webvid-10M. The CLIP score measures the cosine similarity between each frame of the generated video and its prompt in the coding space of the CLIP model. We use VBench for video quality. It is a comprehensive benchmark test suite for video generation models, which can decompose “video generation quality” into multiple well-defined dimensions to promote fine- grained and objective evaluation. Fréchet Video Distance (FVD): This metric measures the similarity between the distributions of generated and real videos, with lower values indicating better quality. Our method achieves an FVD of 361.3, outperforming baselines such as DVMark (382.8) and hidden (436.1), suggesting minimal impact on video quality. CLIP-score: This evaluates the semantic alignment between the video content and the text prompt. Our method scores 0.3345, higher than baselines like REVMark (0.3287) and WAM (0.3146), indicating strong consistency with the input prompt. Perceptual Video Fidelity: Assessed using VBench, it includes dimensions such as image quality, temporal con- sistency, and aesthetic quality. All metrics were positive, i.e., higher scores indicated better video quality in that dimension, and finally a composite score was taken. Our method achieved a score of 0.7898, surpassing all base- lines, including REVMark (0.7834) and DVMark (0.7742), demonstrating a higher perceptual quality. 2) Robustness Comparison: To assess robustness, we measured bit accuracy, given by the percentage of bits correctly decoded. As a result, we report bitrate ac- curacy for each model on a large number of common distortions, including H.264, random frame drops, and averaged frames. Here we have the largest payload, WAM (32 bits), ours 256 bits, and the others are all 96 bits. We explain each type of distortion and its respective parameters in detail. H.264 refers to standard H.264 video compression with a fixed constant rate factor (CRF). In frame averaging, we average all frames within a time window, whereNrefers to the size of the window. For example, forN= 3, the warp frame for timeTis Avg(F T−1 , F T , F T+1 ). For dropped frames and frame swaps,prefers to the probability of dropped frames (or swapping with their immediate neighbors). Random cropping refers to the random cropping of a common rectangular area (for all frames) in the case of a given video.prefers to the width and height ratio of the cropped frame. For example, a cropped video withp= 0.7would haveh ′ =h×0.7andw ′ =w×0.7. The standard deviation in Gaussian fuzzy and Gaussian noise refers to the standard deviation of the Gaussian kernel and the standard deviation of the random normal distribution that produces the noise. An example of a warped frame is shown in the image. As shown in TableII, we tested 1000 videos for each method, and our method performed well on almost all tested distortions, with an average bit accuracy im- provement of 1.15% over the best-performing baseline, especially on H.264 compression. Therefore, we further conducted comparative experiments with different com- pression ratios on H.264 compression, which we will explain in detail in later sections. As can be seen in TableII, our method can still obtain good extraction accuracy under CRF=30, 10.75% higher than the next best method; The video size at CRF=30 is only 8.3% of CRF=0. This can be attributed to the widespread diffusion of watermarks throughout the latent space. 3) Compression Resistance Comparison: We evaluated the robustness of our method against video compression using two widely adopted codecs, H.264 and H.265. As shown in TablesIIIandIV, we measured watermark extraction accuracy across multiple constant rate factor (CRF) settings, which control compression strength and file size. Under H.264 compression, the visual quality loss is obvious as the CRF increases, and our method still performs well. For example, at CRF=30 in H.264, our method obtained a bit accuracy of 96.87%, which is signif- icantly better than the baseline method, such as DVMark (86.92%) and REVMark (85.77%). For H.265 compression, which achieves more aggressive bitrate reduction at the same CRF, our approach demonstrates similar resilience. While at CRF=30 in H.265, we still obtained an accuracy of 95%, which is 7.66% higher than other methods. When CRF=40, the video size is only about 1% of the original size, and our method still achieves an extraction accuracy of about 80%. These results confirm that SkeDA can accurately extract watermark information even under high compression. C. Performance under Various Distortions 1) Video-level Distortion Impact: To evaluate the ro- bustness of our proposed watermarking scheme, we con- ducted extensive experiments to assess its performance 8 0.20.30.40.50.60.70.8 Frame Drop Ratio 0 0.2 0.4 0.6 0.8 1 Bit Accuracy/True Positive Rate AccTPR (a) Frame Drop 0.10.30.50.70.9 Crop Ratio 0 0.2 0.4 0.6 0.8 1 Bit Accuracy/True Positive Rate AccTPR (b) Crop 0.20.30.40.50.60.70.8 Frame Swap Ratio 0 0.2 0.4 0.6 0.8 1 Bit Accuracy/True Positive Rate AccTPR (c) Frame Swap 123456 Frame Average(N) 0 0.2 0.4 0.6 0.8 1 Bit Accuracy/True Positive Rate AccTPR (d) Frame Average 0246810121416 Brightness Factor 0 0.2 0.4 0.6 0.8 1 Bit Accuracy/True Positive Rate AccTPR (e) Brightness 18222630343842 H.264 (CRF) 0 0.2 0.4 0.6 0.8 1 Bit Accuracy/True Positive Rate AccTPR (f) H.264 Fig. 4: TPR and bit accuracy under various video distortions and distortion strengths. TABLE I: Bit accuracy for different Constant Rate Factor (CRF) in H.264. Methods CRF (video size compared to CRF=0) 18 (25%) 22 (20%) 26 (13.3%) 30 (8.3%) 40 (1.8%) HiDDeN [35]85.4379.8574.6470.0854.67 REVMark [ 40]99.5595.8493.5485.7768.04 Video Seal [ 43]99.9496.0393.1185.5674.65 WAM [48]99.8894.5791.7886.1270.31 DVMark [49]98.8792.9487.7579.9661.97 ours99.8099.0298.2296.8781.05 under various common attacks and distortions that videos and images may encounter in real-world scenarios. These include video compression, frame manipulations, spatial operations, and noise addition. The objective is to ensure that the embedded watermark remains detectable even after significant alterations to the video content. Addition- ally, we assessed the imperceptibility of the watermark to confirm that it does not compromise the visual quality of the generated videos. We first tested the extraction accuracy and TPR of watermarks under video attacks. As shown in Fig.4, we can see that except for Fig.4bCrop, our methods achieved good results in relatively serious cases. And it can be seen that our method performs well in terms of frame dropping, frame swapping and frame averaging. This can be attributed to the fact that we have embedded watermarks in each frame, making it effectively resistant to frame attack operations. 2) Image-level Distortion Impact: In addition, we also make image attacks on each frame of the video, such as JPEG, Median, Gaussian Blur, etc. All the results are shown in Fig. 5. For Gaussian noise and random clipping, the performance decreases significantly as the strength TABLE IV: Bit accuracy for different Constant Rate Factor (CRF) in H.265. Methods CRF (video size compared to CRF=0) 18 (25%) 22 (17%) 26 (10%) 30 (6.7%) 40 (1.2%) HiDDeN [35]84.5280.4774.4468.9752.83 REVMark [ 40]99.5696.3693.1286.4870.09 Video Seal [43]99.8797.0193.7986.4176.05 WAM [ 48]99.6393.8590.6985.5769.98 DVMark [49]98.0890.8985.4577.6761.03 ours99.3298.8396.8094.1480.96 TABLE V: Bit accuracy with different factorsf c ,f h and f w . f c −(f h =f w )(bits)Bit Acc TPR (detection) TPR (traceability) 1-2 (4096)0.70161.00001.0000 4-1 (4096)0.78761.00001.0000 1-4 (1024)0.88981.00001.0000 4-2 (1024)0.87231.00001.0000 1-8 (256)1.00001.00001.0000 4-4 (256)0.99801.00001.0000 1-16 (64)1.00001.00001.0000 4-8 (64)1.00001.00001.0000 increases. However, for the other six attacks, even at high intensity, it can still maintains an accuracy rate of greater than 99.9%. D. Ablation Studies In this section, we perform comprehensive ablation experiments to determine the choice of hyperparameters and modules to validate the effectiveness of our method. Watermark capacity:We obtained different watermark capacity sizes by adjusting the scaling factorsf c , f h , andf w , and the results are shown in Table V. As 9 1030507090 JEPG 0 0.2 0.4 0.6 0.8 1 Bit Accuracy/True Positive Rate AccTPR (a) JPEG 00.20.40.60.81 Resize Ratio 0 0.2 0.4 0.6 0.8 1 Bit Accuracy/True Positive Rate AccTPR (b) Resize 371115 Median 0 0.2 0.4 0.6 0.8 1 Bit Accuracy/True Positive Rate AccTPR (c) Median 0.0250.050.075 0.10.2 Salt Pepper 0 0.2 0.4 0.6 0.8 1 Bit Accuracy/True Positive Rate AccTPR (d) Salt Pepper 2468 Gaussian Blur 0 0.2 0.4 0.6 0.8 1 Bit Accuracy/True Positive Rate AccTPR (e) Gaussian Blur 0.0250.050.075 0.10.2 Gaussian Noise 0 0.2 0.4 0.6 0.8 1 Bit Accuracy/True Positive Rate AccTPR (f) Gaussian Noise 0.30.50.70.9 Random Crop 0 0.2 0.4 0.6 0.8 1 Bit Accuracy/True Positive Rate AccTPR (g) Random Crop 0.10.30.50.70.9 Random Drop 0 0.2 0.4 0.6 0.8 1 Bit Accuracy/True Positive Rate AccTPR (h) Random Drop Fig. 5: TPR and bit accuracy under various image distortions and distortion strengths. TABLE VI: Bit accuracy with different sampling methods. Sampling MethodsBit Acc TPR (detection) TPR (traceability) DDIM [58]0.99831.00001.0000 PNDM [59]0.98221.00001.0000 DEIS [60]0.99831.00001.0000 DPMSolver [65]0.99921.00001.0000 UniPC [66]0.99891.00001.0000 TABLE VII: Bit accuracy of SKeDA with and without DA Module. Video Distortions Image Distortions Average Acc Average TPR DA Module (w/o)0.94310.86470.9039 1.0000 DA Module (w) 0.98530.92740.9564 1.0000 the watermark capacity increases, while the amount of information that can be embedded is larger, it may also conflict with the prior distribution of the generative model, resulting in reduced extraction accuracy. In the end, we chosef c =1 andf h =f w =8 to get the 256-bit watermark capacity, so we were able to strike a good balance between information and visual quality. Sampling Method: We evaluated the effectiveness of different continuous time samplers during denoising, as shown in TableVI. We compare common sampling al- gorithms, including DDIM, PNDM, DEIS, DPMSolver and UniPC. The results show that DPMSolver has the best performance, mainly due to its high-order numerical integration characteristics, which can significantly reduce the accumulation of discretization errors in the multi-step denoising process. Based on this advantage, we finally chose it. DA Module: We evaluated the weight allocator during the extraction process, and its impact is shown in Table VII. The addition of the DA module significantly improved 11 1 1 Fig. 6: Bit accuracy with different inference and inversion steps. the model’s extraction accuracy in the presence of dis- torted images and videos. This module can adaptively assign weights according to the correlation of information between frames and quality, emphasizing the retention of more watermark information, so as to realize dynamic weighted fusion in the time dimension. Experiments show that compared with fixed or average weighting strategies, it has a good effect on accurate watermark extraction. Inversion step: The settings for the inference and in- version steps may affect the potential variables obtained through DDIM inversion. We vary the inference and inver- sion steps from 10 to 100, tested in various combinations. The results in Fig. 6show that our method still achieve an accuracy rate of over 99.9% with different settings. V. Conclusion In this paper, we proposed a novel watermarking scheme for text-to-video models to address copyright protection, content authenticity, and misuse prevention 10 in AI-generated content. The method incorporates two key modules: the SKe module for embedding a latent watermark in a concealed and uniformly distributed man- ner while minimizing key overhead, and the DA module for adaptively assigning extraction weights to individual video frames. By embedding the watermark within the diffusion model’s latent space prior to video generation, the watermark becomes inherently fused with the content, enhancing its robustness against various attacks and transformations. Experimental results demonstrate that, compared to existing video watermarking methods, this approach maintains higher visual quality in watermarked videos while ensuring effective watermark extraction. In the future, we aim to extend the method to support larger watermark capacities, longer video sequences, and more complex generation scenarios. References [1]Hong Wenyi, Ming Ding, Wendi Zheng, Xinghan Liu, and Jie Tang. ”Cogvideo: Large-scale pretraining for text-to-video generation via transformers.” arXiv preprint arXiv:2205.15868 (2022). [2]Singer Uriel, Adam Polyak, Thomas Hayes, Xi Yin, Jie An, Songyang Zhang, Qiyuan Hu et al. ”Make-a-video: Text- to-video generation without text-video data.” arXiv preprint arXiv:2209.14792 (2022). [3]Ho Jonathan, Tim Salimans, Alexey Gritsenko, William Chan, Mohammad Norouzi, and David J. Fleet. ”Video diffusion models.” Advances in Neural Information Processing Systems 35 (2022): 8633-8646. [4]Chen Haoxin, Menghan Xia, Yingqing He, Yong Zhang, Xi- aodong Cun, Shaoshu Yang, Jinbo Xing et al. ”Videocrafter1: Open diffusion models for high-quality video generation.” arXiv preprint arXiv:2310.19512 (2023). [5]Council of the EU, (2024, May 21). [Online]. Available: https://w.consilium.europa.eu/en/press/press-releases [6]Cantwell, Blackburn and Heinrich, RIL24710.pdf, U.S. Senate Committee, (2024, July 11). [Online]. Available: https://w.commerce.senate.gov/services/files [7]Bar-Tal Omer, Hila Chefer, Omer Tov, Charles Herrmann, Roni Paiss, Shiran Zada, Ariel Ephrat et al. ”Lumiere: A space-time diffusion model for video generation.” In SIGGRAPH Asia 2024 Conference Papers, p. 1-11. 2024. [8]Yin Bo and Yin Kang, ”Robust Image Watermarking Using Bidirection-Interactive and Context-Aware Networks,” in IEEE Transactions on Circuits and Systems for Video Technology, vol. 35, no. 8, p. 7683-7696, Aug. 2025. [9]Mogavi Reza Hadi, Derrick Wang, Joseph Tu, Hilda Hadan, Sabrina A. Sgandurra, Pan Hui, and Lennart E. Nacke. ”Sora OpenAI’s Prelude: Social Media Perspectives on Sora Ope- nAI and the Future of AI Video Generation.” arXiv preprint arXiv:2403.14665 (2024). [10]Zheng Zangwei, Xiangyu Peng, Tianji Yang, Chenhui Shen, Shenggui Li, Hongxin Liu, Yukun Zhou, Tianyi Li, and Yang You. ”Open-sora: Democratizing efficient video production for all.” arXiv preprint arXiv:2412.20404 (2024) [11]Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. ”High-resolution image synthesis with latent diffusion models.” Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 10684–10695, 2022. [12]Guo Yuwei, Ceyuan Yang, Anyi Rao, Zhengyang Liang, Yaohui Wang, Yu Qiao, Maneesh Agrawala, Dahua Lin, and Bo Dai. ”AnimateDiff: Animate Your Personalized Text-to-Image Dif- fusion Models without Specific Tuning.” In 12th International Conference on Learning Representations, ICLR 2024. 2024. [13]Xiao Xiangli, Zhang Yushu, Hua Zhongyun, Xia Zhihua and Weng Jian, ”Preview Helps Selection: Previewable Image Wa- termarking With Client-Side Embedding,” in IEEE Transac- tions on Dependable and Secure Computing, vol. 22, no. 4, p. 4143-4159, 2025. [14]Ma Xin, Yaohui Wang, Xinyuan Chen, Gengyun Jia, Ziwei Liu, Yuan-Fang Li, Cunjian Chen, and Yu Qiao. ”Latte: Latent diffusion transformer for video generation.” Transactions on Machine Learning Research (2025). [15]Max Bain, Arsha Nagrani, Gül Varol, and Andrew Zisserman. ”Frozen in time: A joint video and image encoder for end-to-end retrieval.” IEEE/CVF International Conference on Computer Vision, 2021. [16]Xue Hongwei, Tiankai Hang, Yanhong Zeng, Yuchong Sun, Bei Liu, Huan Yang, Jianlong Fu, and Baining Guo. ”Advancing high-resolution video-language representation with large-scale video transcriptions.” In Proceedings of the IEEE/CVF Confer- ence on Computer Vision and Pattern Recognition, p. 5036- 5045. 2022. [17]Wang Yi, Yinan He, Yizhuo Li, Kunchang Li, Jiashuo Yu, Xin Ma, Xinhao Li et al. ”Internvid: A large-scale video-text dataset for multimodal understanding and generation.” arXiv preprint arXiv:2307.06942 (2023). [18]Wang Wenjing, Huan Yang, Zixi Tuo, Huiguo He, Junchen Zhu, Jianlong Fu, and Jiaying Liu. ”Videofactory: Swap attention in spatiotemporal diffusions for text-to-video generation.” (2023). [19]Khachatryan Levon, Andranik Movsisyan, Vahram Tadevosyan, Roberto Henschel, Zhangyang Wang, Shant Navasardyan, and Humphrey Shi. ”Text2video-zero: Text-to-image diffusion mod- els are zero-shot video generators.” In Proceedings of the IEEE/CVF International Conference on Computer Vision, p. 15954-15964. 2023. [20]Ge Songwei, Mahapatra Aniruddha, Parmar Gaurav, Zhu Jun- Yan and Huang Jia-Bin, ”On the Content Bias in Fréchet Video Distance,” 2024 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), Seattle, WA, USA, 2024, p. 7277-7288 [21]Ziqi Huang, Yinan He, Jiashuo Yu, Fan Zhang, Chenyang Si, Yuming Jiang, Yuanhan Zhang, Tianxing Wu, Qingyang Jin, Nattapol Chanpaisit, Yaohui Wang, Xinyuan Chen, Limin Wang, Dahua Lin, Yu Qiao, and Ziwei Liu. ”VBench: Com- prehensive benchmark suite for video generative models.” In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2024. [22]Wu Jay Zhangjie, Yixiao Ge, Xintao Wang, Stan Weixian Lei, Yuchao Gu, Yufei Shi, Wynne Hsu, Ying Shan, Xiaohu Qie, and Mike Zheng Shou. ”Tune-a-video: One-shot tuning of image diffusion models for text-to-video generation.” In Proceedings of the IEEE/CVF International Conference on Computer Vision, p. 7623-7633. 2023. [23]Qi Chenyang, Xiaodong Cun, Yong Zhang, Chenyang Lei, Xintao Wang, Ying Shan, and Qifeng Chen. ”Fatezero: Fusing attentions for zero-shot text-based video editing.” In Proceed- ings of the IEEE/CVF International Conference on Computer Vision, p. 15932-15942. 2023. [24]Vaswani Ashish, Noam Shazeer, Niki Parmar, Jakob Uszkor- eit, Llion Jones, Aidan N. Gomez, Łukasz Kaiser, and Illia Polosukhin. ”Attention is all you need.” Advances in neural information processing systems 30 (2017). [25]Yang, Zijin, Kai Zeng, Kejiang Chen, Han Fang, Weim- ing Zhang, and Nenghai Yu. ”Gaussian shading: Provable performance-lossless image watermarking for diffusion models.” In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, p. 12162-12171. 2024. [26]Deng Zijun, Xiangteng He, and Yuxin Peng. ”Efficiency- optimized video diffusion models.” In Proceedings of the 31st ACM International Conference on Multimedia, p. 7295-7303. 2023. [27]Zhang, Peiyuan, Yongqi Chen, Runlong Su, Hangliang Ding, Ion Stoica, Zhenghong Liu, and Hao Zhang. ”Fast Video Generation with Sliding Tile Attention.” arXiv preprint arXiv:2502.04507 (2025). [28]Wu Haoning, Dongxu Li, Bei Chen, and Junnan Li. ”Longvideobench: A benchmark for long-context interleaved video-language understanding.” Advances in Neural Information Processing Systems 37 (2024): 28828-28857. [29]Hoshiar Singh, and Sharma Kiran. ”Copyright in the Age of Artificial Intelligence: Unravelling the Complexities For the Protection of AI-Generated Work.” In 2024 ITU Kaleidoscope: Innovation and Digital Transformation for a Sustainable World (ITU K), p. 1-7. IEEE, 2024. 11 [30]Singh Aditi. ”A survey of ai text-to-image and ai text-to-video generators.” In 2023 4th International Conference on Artificial Intelligence, Robotics and Control (AIRC), p. 32-36. IEEE, 2023. [31]Asikuzzaman Md, and Mark R. Pickering. ”An overview of digital video watermarking.” IEEE Transactions on Circuits and Systems for Video Technology 28, no. 9 (2017): 2131-2153. [32]Cox Ingemar, Matthew Miller, Jeffrey Bloom, Jessica Fridrich, and Ton Kalker. ”Digital watermarking and steganography.” Morgan kaufmann, 2007. [33]Hartung Frank H., and Bernd Girod. ”Digital watermarking of raw and compressed video.” In Digital Compression Tech- nologies and Systems for Video Communications, vol. 2952, p. 205-213. SPIE, 1996. [34]Zhang Kevin Alex, Lei Xu, Alfredo Cuesta-Infante, and Kalyan Veeramachaneni. ”Robust invisible video watermarking with attention.” arXiv preprint arXiv:1909.01285 (2019). [35]Zhu Jiren, Russell Kaplan, Justin Johnson, and Li Fei-Fei. ”Hidden: Hiding data with deep networks.” In Proceedings of the European conference on computer vision (ECCV), p. 657- 672. 2018. [36]Hu Runyi, Jie Zhang, Yiming Li, Jiwei Li, Qing Guo, Han Qiu, and Tianwei Zhang. ”VideoShield: Regulating Diffusion-based Video Generation Models via Watermarking.” arXiv preprint arXiv:2501.14195 (2025). [37]Lei Liangqi, Keke Gai, Jing Yu, and Liehuang Zhu. ”Diffuse- trace: A transparent and flexible watermarking scheme for latent diffusion model.” arXiv preprint arXiv:2405.02696 (2024). [38]Fernandez Pierre, Guillaume Couairon, Hervé Jégou, Matthijs Douze, and Teddy Furon. ”The stable signature: Rooting wa- termarks in latent diffusion models.” In Proceedings of the IEEE/CVF International Conference on Computer Vision, p. 22466-22477. 2023. [39]Wen Yuxin, John Kirchenbauer, Jonas Geiping, and Tom Gold- stein. ”Tree-ring watermarks: Fingerprints for diffusion images that are invisible and robust.” arXiv preprint arXiv:2305.20030 (2023). [40]Zhang Yulin, Jiangqun Ni, Wenkang Su, and Xin Liao. ”A novel deep video watermarking framework with enhanced robustness to H. 264/AVC compression.” In Proceedings of the 31st ACM International Conference on Multimedia, p. 8095-8104. 2023. [41]Kirchenbauer John, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. ”A watermark for large language models.” In International Conference on Machine Learning, p. 17061-17084. PMLR, 2023. [42]Zhang Hanlin, Benjamin L. Edelman, Danilo Francati, Daniele Venturi, Giuseppe Ateniese, and Boaz Barak. ”Watermarks in the sand: Impossibility of strong watermarking for generative models.” arXiv preprint arXiv:2311.04378 (2023). [43]Fernandez Pierre, Hady Elsahar, I. Zeki Yalniz, and Alexandre Mourachko. ”Video Seal: Open and Efficient Video Watermark- ing.” arXiv preprint arXiv:2412.09492 (2024). [44]Giboulot Eva, and Teddy Furon. ”WaterMax: breaking the LLM watermark detectability-robustness-quality trade-off.” arXiv preprint arXiv:2403.04808 (2024). [45]Zhao Xuandong, Sam Gunn, Miranda Christ, Jaiden Fairoze, Andres Fabrega, Nicholas Carlini, Sanjam Garg et al. ”SoK: Watermarking for AI-Generated Content.” arXiv preprint arXiv:2411.18479 (2024). [46]Zhao Yunqing, Tianyu Pang, Chao Du, Xiao Yang, Ngai-Man Cheung, and Min Lin. ”A recipe for watermarking diffusion models.” arXiv preprint arXiv:2303.10137 (2023). [47]Zhang Lijun, Xiao Liu, Antoni Viros Martin, Cindy Xiong Bearfield, Yuriy Brun, and Hui Guan. ”Robust im- age watermarking using stable diffusion.” arXiv preprint arXiv:2401.04247 (2024). [48]Sander Tom, Pierre Fernandez, Alain Durmus, Teddy Furon, and Matthijs Douze. ”Watermark Anything with Localized Messages.” arXiv preprint arXiv:2411.07231 (2024). [49]Luo Xiyang, Yinxiao Li, Huiwen Chang, Ce Liu, Peyman Milan- far, and Feng Yang. ”Dvmark: a deep multiscale framework for video watermarking.” IEEE Transactions on Image Processing (2023). [50]Chen Guangyu, Yu Wu, Shujie Liu, Tao Liu, Xiaoyong Du, and Furu Wei. ”Wavmark: Watermarking for audio generation.” arXiv preprint arXiv:2308.12770 (2023). [51]Lotfi ABDi, Faten Ben Abdallah, and Aref Meddeb. ”A robust video watermarking algorithm in H.264/AVC compressed do- main.” In Proceedings of the 30th Annual ACM Symposium on Applied Computing (SAC ’15). Association for Computing Machinery, New York, NY, USA, 1291–1293.(2015) [52]He Mingze, Wang Hongxia, Zhang Fei and Wang Heng, ”Design Principles for Orthogonal Moments in Video Watermarking,” in IEEE Transactions on Dependable and Secure Computing, vol. 22, no. 5, p. 5603-5616, 2025. [53]He Mingze, Wang Hongxia, Zhang Fei, Abdullahi Sani M. and Yang Ling, ”Robust Blind Video Watermarking Against Geometric Deformations and Online Video Sharing Platform Processing,” in IEEE Transactions on Dependable and Secure Computing, vol. 20, no. 6, p. 4702-4718, 2023. [54]Roman Robin San, Pierre Fernandez, Alexandre Défossez, Teddy Furon, Tuan Tran, and Hady Elsahar. ”Proactive de- tection of voice cloning with localized watermarking.” arXiv preprint arXiv:2401.17264 (2024). [55]An Bang, Mucong Ding, Tahseen Rabbani, Aakriti Agrawal, Yuancheng Xu, Chenghao Deng, Sicheng Zhu et al. ”WAVES: Benchmarking the Robustness of Image Watermarks.” Interna- tional Conference on Machine Learning, p. 1456-1492. PMLR, 2024. [56]Jiang Zhengyuan, Moyang Guo, Yuepeng Hu, and Neil Zhen- qiang Gong. ”Watermark-based detection and attribution of ai- generated content.” CoRR (2024). [57]Gunn Sam, Xuandong Zhao, and Dawn Song. ”An unde- tectable watermark for generative image models.” arXiv preprint arXiv:2410.07369 (2024). [58]Jiaming Song, Chenlin Meng, and Stefano Ermon. ”Denoising diffusion implicit models.” International Conference on Learning Representations, 2020. [59]Luping Liu, Yi Ren, Zhijie Lin, and Zhou Zhao. ”Pseudo numerical methods for diffusion models on manifolds.” arXiv preprint arXiv:2202.09778, 2022. [60]Qinsheng Zhang and Yongxin Chen. ”Fast sampling of dif- fusion models with exponential integrator.” arXiv preprint arXiv:2204.13902, 2022. [61]Ahmed Nasir, T Natarajan, and Kamisetty R. Rao. ”Discrete cosine transform.” IEEE transactions on Computers 100, no. 1 (2006): 90-93. [62]Heil Christopher E., and David F. Walnut. ”Continuous and discrete wavelet transforms.” SIAM review 31, no. 4 (1989): 628-666. [63]Stewart Gilbert W. ”On the early history of the singular value decomposition.” SIAM review 35, no. 4 (1993): 551-566. [64]Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. ”Learning transferable visual models from natural language supervision.” In International conference on machine learning, pages 8748–8763. PMLR, 2021. [65]Cheng Lu, Yuhao Zhou, Fan Bao, Jianfei Chen, Chongxuan Li, and Jun Zhu. ”Dpm-solver: A fast ode solver for diffusion probabilistic model sampling in around 10 steps.” Advances in Neural Information Processing Systems, 35:5775–5787, 2022. [66]Wenliang Zhao, Lujia Bai, Yongming Rao, Jie Zhou, and Jiwen Lu. ”Unipc: A unified predictor-corrector framework for fast sampling of diffusion models.” arXiv preprint arXiv:2302.04867, 2023. [67]Yu Huang, Junhao Chen, Shuliang Liu , Hanqian Li, Qi Zheng, Yi R. Fung and Xuming Hu, ”Video Signature: In- generation Watermarking for Latent Video Diffusion Mod- els”,arXiv preprint arXiv:2506.00652, 2025.