VideoShield: Regulating Diffusion-based Video Generation Models via Watermarking
Authors: Runyi Hu
Jie Zhang
Yiming Li
Jiwei Li
Qing Guo
Han Qiu
Tianwei Zhang
Venue: ICLR 2025 Poster (2025)
Keywords: video
watermarking
tamper localization
Primary area: alignment, fairness, safety, privacy, and societal considerations

Abstract: Artificial Intelligence Generated Content (AIGC) has advanced significantly, particularly with the development of video generation models such as text-to-video (T2V) models and image-to-video (I2V) models. However, like other AIGC types, video generation requires robust content control. A common approach is to embed watermarks, but most research has focused on images, with limited attention given to videos. Traditional methods, which embed watermarks frame-by-frame in a post-processing manner, often degrade video quality. In this paper, we propose VideoShield, a novel watermarking framework specifically designed for popular diffusion-based video generation models. Unlike post-processing methods, VideoShield embeds watermarks directly during video generation, eliminating the need for additional training. To ensure video integrity, we introduce a tamper localization feature that can detect changes both temporally (across frames) and spatially (within individual frames). Our method maps watermark bits to template bits, which are then used to generate watermarked noise during the denoising process. Using DDIM Inversion, we can reverse the video to its original watermarked noise, enabling straightforward watermark extraction. Additionally, template bits allow precise detection for potential spatial and temporal modification. Extensive experiments across various video models (both T2V and I2V models) demonstrate that our method effectively extracts watermarks and detects tamper without compromising video quality. Furthermore, we show that this approach is applicable to image generation models, enabling tamper detection in generated images as well. Codes and models are available at https://github.com/hurunyi/VideoShield.

Published as a conference paper at ICLR 2025
VIDEOSHIELD: REGULATING DIFFUSION-BASED
VIDEO GENERATION MODELS VIA WATERMARKING
Runyi Hu' Jie Zhang?; Yiming Li', Jiwei Li Qing Guo?, Han Qiu", Tianwei Zhang' "Nanyang Technological University CFAR and IHPC, A A*STAR, Singapore *Zhejiang University "Tsinghua University
frunyi.hm hu, ym.li, tianwel. zhang)entu.edu..... edu.
{ (zhang-jle, jiwei.li@zju edu. en qiuhan@tsinghua edu.
ABSTRACT
Artificial Intelligence Generated Content (AIGC) has advanced significantly, par- ticularly with the development of video generation models such as text-to-video (T2V) models and image-to-video (I2V) models. However, like other AIGC types, video generation requires robust content control. A common approach is to em- bed watermarks, but most research has focused on images, with limited attention given to videos. Traditional methods, which embed watermarks frame-by by-frame in a post-processing manner, often degrade video quality. this paper, we propose VIDFOSHIFLDD novel watermarking framework specifically designed for pop- ular diffusion- baased video generation models. Unlike post-processing methods, VIDEOSHIELD embeds watermarks directly during video generation, eliminating the need for additional training. To ensure video integrity, we introduce a tamper localization feature that can detect changes both temporally (across frames) and spatially (within individual frames). Our method maps watermark bits to template bits, which are then used to generate watermarked noise during the denoising pro- cess. Using DDIM Inversion, we can reverse the video to its original watermarked noise, enabling straightforward watermark extraction. Additionally, template bits allow precise detection for potential temporal and spatial modification. Extensive experiments across various video models (both T2V and I2V models) demonstrate that our method effectively extracts watermarks and detects tamper without com- promising video quality. Furthermore, we show that this approach applicable image generation models, enabling tamper detection in generated images as well. Codes and models are available at http:///gthhb.oommmunnviieeeoo
INTRODUCTION
In the era of Al-Generated Content (AIGC), the generation of images (Saharia et al., 2022), au- dios (Huang et al., 2023), and videos (Blattmann et al., 2023) has become increasingly accessible. Among these, video generation stands out as one of the most challenging applications. Recently, significant breakthroughs have been made in this field. With the development of diffusion models (Sohl-Dickstein et al., 2015; Ho al., 2020) and the scaling law (Kaplan et al., 2020), which shows that increasing the model size and dataset volume enhances performance, modern AI models like Sora (Brooks al., 2024) are now capable of generating high-quality videos with complex motion dynamics and extended temporal spans. However, these advancements raise serious concerns about content control. Al- Al-generated videos are valuable assets used in various industries, from entertain- ment to education. Yet, they are vulnerable to unauthorized use and tampering. This underscores the need for robust methods to regulate the origin and modification of such content. Implementing these safeguards is crucial to ensure the integrity of creative works and protect against potential misuse.
To address these challenges, common solutions involve watermarking (Jia et al., 2021; Hu et al., 2024a; Yang et al., 2024) and tamper localization (Dong et al., 2022). Watermarking embeds invisi- ble information digital content for origin verification, while tamper localization identifies altered
Thhe corresponding author

---

Published as a conference paper at ICLR 2025
areas within the content. However, to the best of our knowledge, there is existing method specifi- cally designed for Al-generated videos. The straightforward approach of embedding and extracting watermarks frame by frame, along with tamper localization, presents several challenges. First, ap- plying image watermarking techniques to individual frames degrades overall video quality. Second, existing image tamper localization methods can only detect spatial tampering within single frames and fail to address the temporal one, such as frame order change. This limitation stems from the inability of image-based methods to process frames collectively. Additionally, most current tamper localization methods are passive and rely on extensive training to identify tampered and original areas, which limits their effectiveness across diverse data distributions, and inducing high overhead.
To remedy these limitations. we propose VIDEOSHIELD, a training-free free watermarking framework specifically designed for diffusion-based video models, which achieves watermark embedding in the video generation process, and can simultaneously perform watermark extraction and tamper localization. Inspired by recent works (Wen et al., 2023; Yang al., 2024), we map watermark bits to Gaussian noise, which is then denoised to generate videos. To enable both watermark extraction and tamper localization, we introduce template bits derived from the watermark bits, which are used to generate watermarked noise. The template bits correspond one-to-one with each pixel, exhibiting local fragility essential for tamper localization, while the watermark bits have a one- to-many correspondence with pixels, offering greater tolerance distortion and ensuring robust extraction. Using Denoising Diffusion Implicit Model (DDIM) Inversion (Song et al., 2020), the denoised video inverted back its initial watermarked noise for extraction. When a video is tampered with, both the inverted watermarked noise and template bits are disrupted. To localize the tamper, we compare these disrupted template bits with the originals, using two modules for temporal and spatial localization. Additionally, when performing spatial tamper localization, we employ a Hierarchical enhancing the overall performance.
Refinmment (HSTR) module to balance accuracy and granularity,
In conclusion, our key contributions are as follows:
We emphasize the importance of protecting content authentication and integrity for Al Al-generated videos. Additionally, we analyze the limitations of directly applying existing image watermarking and tamper localization methods, such as the degradation of video quality caused by embedding watermarks frame by frame via post-processing, and the poor transferability of passive tamper localization methods.
We propose VIDEOSHIELD, a training-free video watermarking framework designed to embed watermarks during video generation. It simultaneously enables watermark extraction and tamper localization based on the inverted template bits through DDIM Inversion on the generated video.
Extensive experiments demonstrate that VIDEOSHIELD effectively extracts watermarks and lo- calizes tamper across various video generation models (T2V and 12V), without compromising video quality. Moreover, VIDEOSHIEILD can be seamlessly adapted to localize tamper in images generated by T21 models.
METHODOLOGY
2.1 DESIGN PRINCIPLES
In general, we aim to utilize the embedded watermark facilitate both subsequent watermark ex- traction and tamper localization. However, traditional watermarking methods often embed a number of watermark bits that are significantly smaller than the total number of pixels in the cover image to ensure fidelity and robustness. This many-to-one relationship between pixels and bits clearly hinders accurate localization.
In order to address the above challenges, we need a template that has a one-to-one, deterministic relationship with the pixels and is fragile enough to be disrupted when the corresponding pixels are tampered with. Instead of introducing a separate template image like EditGuard (Zhang et al., 2023b) which requires extensive training, we aim to incorporate an intermediate template during the process of watermark bits embedding, avoiding any additional overhead. Based this consideration and inspired by Gaussian Shading (Yang et al., 2024), we use the Gaussian noise as the carrier for the watermark. During the transformation of the watermark bits into Gaussian noise, introduce
2

---

Published as a conference paper at ICLR 2025
Watermark Embedding and Extraction
Exsypi
Sumpan
Video Model
Donis
Fame: Sone
Imsgee
Text
VAE Depalkr
Distoctions
Video Diffasion Model
Ianare Susplig
Tevancic
Toeader
Tamper Localization
Sponial Localization
Temponi
Hicneshica Temporl
Grapaalo
ocallontion
Tis
my
Refiocteent
Donader
The overall framework of VIDEOSHIELD. (I) In the Watermark Embedding and Ex- traction stage, we first map the watermark bits m to the initial Gaussian noise Z" via an intermedi- set of random template bits TP, which are derived from m. The video diffusion model M then iteratively denoises z², ultimately generating the video frames F R. For watermark extraction, M uses DDIM Inversion on the tampered or distorted video frames FR recover the inverted noise ZT. This noise is then transformed into inverted bits IV, from which the watermark bits are ex- tracted. (2) In the Tamper Localization stage, TP and IV processed by temporal module to localize temporal tamper and restore their temporal positions. The resulting comparison bits matrix CMP is then passed to spatial module, which incorporates hierarchical spatio-temporal refine- ment (HSTR) module to enhance localization performance. Both stages are training-fre free and can be applied to any diffusion-based video generation model.
Figure 1:
template bits that can be reversibly converted from the watermark bits. On one hand, the template bits have a one-to-one correspondence with the pixels generated by the diffusion model, which makes them locally fragile the spatial tamper. On the other hand, the template bits corresponding to each frame of the video are also different, resulting in sensitivity to position. Based on the aforementioned properties of the template bits, we can achieve both temporal and spatial tamper localization. Next, we provide the design details.
2.2 OVERVIEW
The framework of VIDEOSHIELD is illustrated in Figure consists two key stages: (1) Water- mark Embedding and Extraction and (2) Tamper Localization. Overall, VIDEOSHIELD establishes a reversible conversion chain consisting of watermark bits m, template bits TP, Gaussian noise Z", and video frames F achieve watermark embedding, watermark extraction and tamper localiza- tion. The chain can be expressed as m + TP e ZT e FR. Watermark embedding corresponds the rightward transformation, watermark extraction and tamper localization correspond the left- ward transformation. We briefly explain the rationale behind the choice of each reversible conversion algorithm. The conversion between m + TP employs encryption and decryption algorithms, while TP + ZT relies on truncated sampling and inverse sampling. The encryption algorithm ensures that the template bits are completely random, and the noise generated through truncated sampling based on these bits follows Gaussian distribution. The conversion between zT < F FR involves the denoising and noising processes. For noise addition, we use DDIM sampling, which guarantees the reversibility of the process through the corresponding denoising step, known DDIM Inversion. Next, we explain the details each step.
2.3 WATERMARK EMBEDDING EXTRACTION
Inspired by Gaussian Shading (Yang et al., 2024), we map the watermark bits to Gaussian noise to achieve watermark embedding and use the inverted watermarked noise by DDIM Inversion on the denoised video for watermark extraction.

---

Published as a conference paper at ICLR 2025
Watermark embedding. We describe how to map the watermark bits to Gaussian noise to achieve watermark embedding. First, we randomly sample watermark bits m E {0, 1 and reshape it to where f.c, h, w are the numbers of frames and channels, height and weight of zT, ks is the corresponding repeat factor. Then we repeat m to m with the shape of (f. c, h, w) and encrypt m² to TP with the same shape using ChaCha20 (Bernstein et al., 2008), which is stream cipher that takes 256-bit key, a 96-bit nonce, and plaintext as input to produce a pseudo-random ciphertext output. The algorithm generates keystream that is XORed with the plaintext for encryption. To get Zz, we use truncated sampling conditioned on TP. Assume that the probability density function and percentile function of the Gaussian distribution (0, 1) are f(.) and ppf() respectively. For every bit X = Tii.i.j. E {0, 1 in TP, the corresponding sampled noise point is 3 = Lg where i, j, k represent the indices in the f, h, w dimensions, respectively. When À is 0, 3 samples from the truncated negative half- interval of (0,, 1), otherwise, 5 samples from the truncated positive half-interval. The conditional probability distribution followed by / can be expressed as:
(E ". Re
[2f(3), > <BS < 00
((
(1)
otherwise
Then determine the probability distribution of B as:
p(B) Σ (((8)))((A)- (0( +(311)) f(3).
Therefore, 3 follows standard Gaussian distribution and will affect the subsequent denoising. Finally, the video diffusion model M peforms iterative denoising on z to get the denoised latents Z", which are decoded as FR by the VAE decoder D.
Watermark extraction. We explain how to extract watermark bits from the generated video using DDIM Inversion. Before watermark extraction, FR can be tampered with or distorted, resulting in FR. We compress FR into latents Z through the VAE encoder E, and then use M to convert Zo into the noised latents ZT via DDIM Inversion. By inverse sampling based on ZT, we get the inverted bits IV:
[0,
7T qija S
TV VV
1,
ZT q.ijj. >
Then we decrypt IV to me.t for watermark extraction. Since each watermark bit m, in m is copied kall ky x k x k2 x kn times in the watermark repeat stage, m; actually corresponds to kall bits in ma.-- When more than half of these kaul bits are 1, the corresponding extracted bit Mext, is set to 1; otherwise it is O. Finally, we retrieve the extracted watermark bits Mext from m
2.4 TAMPER LOCALIZATION
In this section, we provide a detailed explanation of how temporal and spatial tamper localization are achieved by comparing the inverted bits with the template bits.
2.4.1
TEMPORAL TAMPER LOCALIZATION
Capy
Temporal Localization
Inawdd mi
Wi
JV
IV;
IV
MM
511.33
xC3.9)
Companison Dits (Ciq
Torplae Bio
TP
TP,
TP,
(BGx.)))))) +0) (Fqg66)
Original Positions (Eig
Figure 2: The pipeline of the temporal tamper localization module. We use the first frame (/V)) inside the module (cyan area) example show the localization process.
We focus on temporal tamper localization for the following two scenarios: (1) Temporal tamper, including frame swapping, insertion, and dropping, alters the original sequence of frames, resulting
4

---

Published as a conference paper at ICLR 2025
in semantic changes. (2) Changes in frame order prevent the inverted bits from being compared with the corresponding template bits at their original positions, thereby hindering spatial tamper localiza- tion. In general, our idea is to compare the inverted bits of each frame in the reordered video with the template bits corresponding to all frames in the original video, identifying the position with the highest comparison accuracy effectively recall its original position for successful localization and restoration. The temporal localization module's 's pipeline is shown in Figure 2.
Specifically, suppose p and q represent the frame positions in the tampered and original video frames, this module makes f copies of IV, at every position of /V. It then performs a bit-by-bit comparison with TP, corresponding to each frame of the original video. This comparison produces the compar- ison bits Cp.-- = IV, = Pyl which collectively form the matrix C' with a shape of (f', f. c, h, w), where I' indicates the tampered video frames. Then, calculates the average score across the last three dimensions to obtain the comparison score S:
h ΣΣΣ S(p.g) chuc 1=1 j=1k=1
Cp.g..j..-
(4)
S(p q) can be used to measure the matching degree between IV, and TPg. Based on S(p q), we get the position M (p) in the original video frames which has the highest matching degree by:
((p) = argmax,eln.n)((p..
(5)
When tampered frame is not part of the original video (e.g., when a new frame is inserted), there is no corresponding original position. In such cases, we mark these positions as -1 and use tzemp to determine whether a frame belongs to the video. As such, we get the original position P by:
(M)),,
S(p, (p)) > tremp
P(p) 1-1, -1,
S(p, M (p)) S ttemp
Finally, the module produces the comparison bits matrix C which is used for spatial tamper localization and can be described as:
CMPº Cp.M(p)
2.4.2 SPATIAL TAMPER LOCALIZATION
The main process of spatial tamper localization shown in Figure 3. We first introduce the main process of spatial localization, and then introduce the ISTR module in detail.
Main process. First, we average the comparison bits matrix CMP with the shape of (f c, h, w) across the channel dimension obtain the initial predicted mask Mins, The channel average func- tion CAA can be expressed as:
Mini CA(CMP) 1 Σ CMP p.j.k.
(8)
We further use HSTR to refine Mini to achieve more accurate localization performance. HSTR processes Mini different levels to get different level masks [M') where is level. Then we perform average on them to get the refined mask: Mrefined - M Finally, the VAE decoder D converts Mrefined to the pixel space, and then applics grayscale conversion to obtain the final extracted mask M finol
Hierarchical Opatial-Tempprall Refinement (HSTR). Although Méni provides initial assess- ment of watermark at various locations which could indicate potential tampering, its effectiveness limited. Each location is based on only four comparison bits in the channel dimension, increasing the chance of 'fasse positives' and reducing accuracy. As shown in Figure 4, increasing the number of comparison bits reduces the variance of comparison accuracy and false positive rates, and en- hances the distinction between watermarked and original areas. Thus, HSTR aims to refine Mini by using more comparison bits a high level for accurate judgments. Higher-level improves localiza- tion accuracy by gathering more adjacent comparison bits while sacrificing fine granularity, which contrast to lower-level. Next, we detail the three parts of ISTR.
5

---

Published as a conference paper at ICLR 2025
Part I: Divide and Gather. In this part, ex- plain how to segment the entire video into sub- regions containing different numbers of com- parison bits based on different hierarchical lev- els, and calculate the overall prediction accu- racy for each region. Assuming the total hier- archical level is L, for every
CMF
Chamcit Pectee
21, L},
we divide M into a series of sub-regions with the shape of (1, where μ the lo- cal value and μ = 2'-1, indicates the num- ber of adjacent local comparison bits gathered in three dimensions. All the score values con- tained each sub-region are gathered and the averaged value is used as the watermark pre- diction score representing the region. A larger I can increase the number of comparison bits contained in the sub-region, thereby improving the prediction accuracy. Let b(x)) (ar 1)p 1, the above gather and average function GA to convert M with the shape of (f h, w) M with the shape of { : ju ( can be described as:
12
Rnliaie Amarction
Figure 3: The pipeline of the spatial tamper local- ization module containing a Hicrarchical Spatial- Temporal Refinement (HSTR) module. Here, we show the internal workflow of HSTR when the to- tal hierarchical level L = 3.
ip
ky
M P.j.k
GA(M
Mins 2.0..
2.0.2)
b(p) y b(}
b(k)
Part II: Partial Threshold Binarization. To fur- ther differentiate between tampered and non- tampered areas, we utilize partial threshold bi- narization PTB for the transformation of M90, We statistically analyze the comparison accu- racy distributions Aum and Aorig on water- marked and original videos corresponding to different levels and find the overlapping area: Q Awm Aorig- Suppose the predicted value of an area in M is denoted as o M p.j.k" when E Q, it is impossible to make an effective distinction. When E Aorig Aorig Q, it can be concluded with high con- fidence that the area has been tampered with, so o can be polarized to O. For o E A Aum \ Q, according the same principle, is polarized 1. Assuming the lower bound of A'um and the upper bound of Aorig are tum and torig respectively, M can be converted to M as:
Stadii--idee--illllae
Wine Typ
Gorou Crouuum Acuur Acoracy
oelg 0.0
26
Figure 4: Comparison accuracy distributions of different local values on the watermarked and original videos generated by ModelScope and Stable-Video- Video-Diffusion. Each data point in the figure represents the average accuracy of the sub- region with different local values μ (μ = 2/-1), containing different numbers of comparison bits.
0,
if o < lm
Moth P.s.k
PTB (5..)
1, if torig
(10)
o. otherwise
For practical usage, in order to determine fuom and torig, select values corresponding to specific quantile l of Aum and Aorig to represent the distributions: (A), Qx (-A))- This is because points with extremely high or low accuracy in the distribution are rare and can be considered outliers, which do not accurately represent the overall distribution, as shown in Figure 4. Therefore, these points can be discarded. detailed analysis can be found in Sec. 3.4.
Part III: Repeat. Finally, we assign the prediction score of each sub-region to all positions within that region to assess the tamper status different locations. In order convert the shape of // to (f' h, w), each comparison bit in Moth is repeated fr² times and then filled into the corresponding original sub-region to obtain M This operation can be expressed as R:
Ml MaJ. P.. R(M/tb)
M
(11)
1 1

---

Published as a conference paper at ICLR 2025
Table 1: Comparison with other baseline watermarking methods videos generated by Mod- elScope and Stable-Videe of all metric values. The best results are highlighted in bold.
respectively. The video quality reported here is the average
Method
ModelScope
Stable Video Difiusion
Bit Length
Video Quality
Bit Accuracy
Bit Length
Video Quality
Bit Accuracy
RiviGAN MBRS
32
0.8034
0.994
0.83%
0.989
256
0,803
1,000
256
018225
0.999
CTN
30
0.756
1,0000
30
0.7995
1,000
PIMol
0.753
1,000
0.794
0,559
SapMark
0.799
0.999
0.819
0.998
VIDEOSHIELD
0,806
0.836
EXPERIMENTS
3.1 EXPERIMENTAL SETTING
Implementation details. We select two popular open-source models as the default test models: the text-to-video (T2V) model ModelScope (MS) (Wang al., 2023) and the image-to-video (I2V) (SVD) (Blattmann et al., 2023). Videos are generated with 16 frames in FP16 mode for both models. The resolutions of the videos generated by the MS and SVD models are 256 and 512, respectively. We use the default sampler and text (image) guidance, with 25 inference steps and 25 inversion steps for both models. A total of 512 watermark bits are embedded into the generated videos. To achieve this, for SVD. For MS, k in PTB is set to 99, while it is set to 98 for SVD. For both models, teemp and L are set to 0.55 and 3, respectively. For temporal tamper, we evaluate Frame Drop, Frame Insert, and Frame Swap. For spatial tamper, we consider: Crop& (default), STTN (Zeng et al., 2020), and ProPainter (Zhou et al., 2023).
model Seee--iieo-Dfffuue
set kee ka, kw to 8, 1, 4, 4 for MS and 8, 1, 8, 8
The baseline watermarking methods for comparison are: RivaGAN (Zhang et al., 2019), MBRS (Jia et al., 2021), CIN (Ma et al., 2022), PIMoG (Fang & et al., 2022), and SepMark (Wu et al., 2023). For baseline spatial tamper localization, we compare: MVSS-Net (Dong et al., 2022), OSN (Wu et al., 2022), PSCC-Net (Liu et al., 2022), and HiFi-Net (Guo al., 2023b). Except for RivaGAN, all methods are open-source and designed for images, as there is limited open-source research in the video domain. When applied to video, the same watermark is embedded in each frame, and tamper localization is performed frame by frame. More implementation details are in Appendix D.
Datasets. For MS, we choose 50 prompts from the VBench (Huang et al., 2024) test set, covering five categories: Animal, Human, Plant, Scenery, and Vehicles, with 10 prompts per category. For each prompt, we generate videos, resulting in a total of 50 x 4 = 200 videos for evaluation. For SVD, first employ text-to-image (T2I) model, specifically Stable Diffusion 2.1 (AI, 2022), to generate 200 images corresponding to the 200 prompts used in the MS evaluation. These images are then used to create 200 videos for evaluation. Additionally, we gather 5 real images from each of the 5 categories, generating a total of 5 X 5 x 4 = 100 videos for evaluation. Except for evaluating spatial tamper localization with STTN and ProPainter, where we use 1/5 of the generated videos for manual annotation (as detailed in Appendix D.3), we use all the generated videos in other cases by default. To statistically analyze Aum and Aorig to obtain fwo and torig, we further generate 100 watermarked videos and 100 original videos that are not included in the aforementioned dataset for both MS and SVD. More details about our constructed datasets can be found in Appendix C.
Metric. For watermark extraction, we use Bit Accuracy which indicates the ratio of correctly tracted bits. To evaluate the quality of the watermarked videos, we adopt five metrics from VBench (Huang et al., 2024): Subject Consistency, Background Consistency, Motion Smoothness, Dynamic Degree, and Imaging Quality. For temporal localization, we measure accuracy using the formula: Accuracy- = Iv Σm P.- O, where P; and O are the predicted position and original position of frame, and N the total number of test frames. For spatial localization, following Dong et al. (2022); Liu et al. (2022), we evaluate using F1, Precision, Recall, AUC, and IoU metrics computed between the final extracted mask M final and the ground truth mask M When specific metrics not reported, we default to presenting the average values of these metrics.
3.2 MAIN RESULTS
7

---

Published as a conference paper at ICLR 2025
Table 3: Bascline comparison results of spatial tamper localization different tamper types. All evaluation metrics are better when higher. represents an outlier and has no practical meaning. Because find that HiFi-Net correspondence predicts every frame of the video tampered, the Recall value is higher.
Medhod
STIN
PoePaaner
CoppDrop
Presionn
Avargge
Procaion
Recall
Averase
Predsion
Ascrage
MistelScppe
MVSS-N6 Net
0.125
0.333
0.106
(8.50
0.122
0.245
0,812
0.114
0.055
01302
0/066
0.120
0.291
0.350
0.296
0.674
0.248
0.332
0.188
0.000
0.058
0.111
0.391
0.999
0.565
VIDKOSHIEED
0393
1L918
0,88
0,822
0,586
0.989
8,100
0.9TT
(U921
0.841
0,800
0,911
0,942
01946
0.841
0,986
SuNe-
Dimtpsoon
OSN
02113
0.223
0.214
01543
0.15
0.264
0.152
0.24
0.13
0.98
0.301
0.31
0.351
0.396
0.417
0.571
0.52
0.402
ISCE-Sa
0/455
0.577
0.32
01536
0.200
0.866
0.385
0.188
0.25
0.496
0.722
04th
0.501
0.400
0.736
0.571
0.372
0.515
0.00
11126
0.00
00000
0.125
0.355
0.31L
0.892
0.515
0.334
0.380
0:211
0.325
0.224
0.35
0.27%
Orgad Taeporad
GT
Oar
PSCC
OSN
XVSSRa
Digadl
Taqpoad
GC
PSCE
OGS
MVVSSNc HETA-N
ModeSSoppe
Stable- Video- Diffictio
Figure 5: Some visual examples comparison of different spatial localization methods.
Watermark extraction. As shown in Table I, compared to the baseline methods, VIDEOSHIELD offers several significant advantages. First, VIDEOSHIELD embeds substantially more bits which essential for high-capacity applications. Additionally, VIDEOSHIELD achieves comparable Bit Accuracy to the other methods, proving its effectiveness. Furthermore, the watermarked videos generated by VIDEOSHIEED exhibit noticeably higher video quality because it does not require any post-processing which often degrades video quality.
Tamper localization. The temporal tamper localization results of VIDEOSHIELD are presented in Table 2. Note that we are the first to localize temporal tamper in videos, so there is no baseline compare with. We observe that VIDEOSHIELD demonstrates effective localization capa- bilities for three different types of temporal tamper. For spatial tamper localization, we compare VIDEOSHIELD against four baseline methods, with the results presented in Table 3. VIDEOSHIEL.D demonstrates effectiveness across three distinct forms of spatial tamper. In contrast, the baseline methods struggle localize tamper in the generated videos, underscoring their lack of generalization when applied to videos or other datasets with distributions different from those used during training. Visual examples of tamper localization for different methods shown in Figure 5.
Table Results of temporal tamper lo- calization.
Model
Accurscyf
Swap
Doop
Average
1.000
1,000
0.35
0.57
0.936
0.936
The results of VIDEOSHIELD D on videos generated by SVD on real conditional images are shown in Table which further confirms the effectiveness of method.
Table 4: Performance on SVD's generated videos conditioned on different types of images.
Spatial Localization
Temporal Localization
Conditional Image
Video Quality
Bit Accuracy
STTN
ProPainter
Crop&Drop
Frame Swap
Frame Insert
Frame Drop
Generated
0.336
0.999
0.764
0.767 0.790
0.761
0,355
0.377
0.936
Real
0.785
0.755
0696
8

---

Published as a conference paper at ICLR 2025
3.3 ABLATION STUDY
Importance of PTB in HSTR and impact of the quantile k in PTB. shown in Table when PTB is not used, the localization performance is greatly reduced, confirming PTB's importance. In addition, consistent with our previous analysis, the effect is better when l is not 100, that is, when the entire distribution is not used to obtain fum and forig. Specifically, when is set to 99 for ModelScope and 98 for Stable- Gaable-iiee-DDeee Video-Diffusion, the performance is best, which is also default setting. Please refer to Appendix F for the ranges of Awm and Aorig obtained with different k values, along with more detailed analysis.
Impact of the total hierarchical level L of HSTR. We explore the optimal hierarchical level and delve into the importance of HSTR module. As shown in Figure 6, when I, is set to 3, both ModelScope and Stable- Video- Diffusion achieve the highest average across all metrics, indicating optimal performance in spatial tamper local- ization. Additionally, observe that increasing L con- sistently enhances Precision; however, once it surpasses certain threshold, Recall begins to decline (3 for Mod- elScope and for Sieele-Vieo-DDiffie it heightens the accuracy of judgment for the entire area. Consequently, all positions within this area are uniformly classified, which reduces the granularity of the judgment and adversely impacts Recall, The visual spatial tamper localization results of different L are provided in Appendix G.1 (Figure 14).
Table 5: Spatial tamper localization per- formance under different in PTB. None means without the PTB B module.
Model
None
97
98
99
100
MS SVD
0.857
0.902
0.902
0.906
0.887
0.689
0.757
0.761
0.756
0.714
We posit that when the level exceeds this threshold,
MadelScape
Stable-Videe Diffusion
Stade- Euale
085
400.
Newe
000
Figure 6: The line chart depicting the variation of different metrics of spatial tamper localiza- tions hierarchical level L changes.
Figure 7: Comparison of watermark extraction accuracy across different methods under vari- ous distortions.
Impact of different inference and inversion configurations. Through our experiments, we find that VIDEOSHIELD achieves satisfactory results in both watermark extraction and tamper localiza- tion across various inference and inversion settings, with detailed results available in Appendix E. For Hable-Video-Diffusiin increasing the inference steps and reducing image guidance enhance the performance of tamper localization. This improvement likely arises from these settings en- abling the model generate higher-quality dynamic videos, which facilitates better integration of the corresponding template bits into the generated videos for effective tamper localization. For comprehensive analysis and visualization of the results, please refer Appendix G.3.
3.4 GENERALITY
Results on other video models. We test VIDEOSHIELD'S effectiveness on two other popular video models: the T2V model ZeroScope (ZS) (Face & cerspense, 2023), and the 12V model 12VGen-XL (12VGen) (Zhang et al., 2023a). The implementation details can be found in Appendix D.4 and the results are shown in Table 6. It can be seen that VIDEOSHIELD can also achieve effective watermark extraction and tamper localization on both models. However, regarding the tamper localization, VIDEOSHIELD with Stable- Siale--iie---ifuuiii the other three models. We find that this is due to the lower quality of the generated videos (see Appendix G.3), which leads to the watermark bits not integrating well with the generated videos to achieve better tamper localization. More detailed analysis and visual results of this section can be found in Appendix G.2.
exhibits a certain gap in performance compared with

---

Published as a conference paper at ICLR 2025
Table 6: Results on other video models beyond MS and SVD in terms of three test dimensions.
Table 7: Tamper localization results on different versions of Stable Diffusion.
Dimension
MS
12VCien
Version
Precision
Recall
lol:
Averag
Watermark
1.000
0,999
1,000
0.999
0.947
0.211
0.976
0.947
0.901
0.938
Temporal
1,000
0.936
1,000
0.983
15
0.917
0.911
0.977
0.947
0.902
0.939
Spatial
0.906
0.761
0.900
0.867
2.1
0,938
0.946
0.934
0.935
0.887
0.928
Table Spatial tamper localization performance under different spatial distortions. this context, "w/o" refers using from and torig derived from the clean watermarked videos, while "w/" indicates that various distortions are introduced during the distribution testing, leading to adjustments in twr
and lorig.
Model
Adjusiment
MPEG-4
Frame Average
G Notse
G Blur
Mediza Blur
S&P Noise
Resize
Brightness
Average
Clean
MS
w/o
0.801
0.838
0.641
0.559
0.641
0.787
0.644
0.799
0.737
0.537
0.630
0.309
0.797
0,622
0.701
0,740
0.672
0.805
0.906
SVD
0.547
0.587
0,633
0.716
0.713
0.630
0.761
Spatial tamper localization on images generated by T2I models. VIDEOSHIELD can be flexi- bly adapted to T21 models for the purpose of image spatial tamper localization. We test it three different versions of the Stable Diffusion model: 1.4, 1.5, and 2.1. The implementation details can be found in Appendix D.4 and the specific test results are presented in Table 7. It is observed that VIDEOSHIELD achieves high performance tamper localization, further validating the effective- ness of our approach. We provide some visual localization results in Appendix G.2.
3.5 ROBUSTNESS
In this section, we further test VIDEOSHIELD'S performance of watermark extraction and spatial tamper localization in the face of different distortions to verify its robustness, and the results are shown in Figure and Table 8, respectively. For detailed configurations of the distortions, please refer to Appendix D.5.
Watermark extraction. As illustrated Figure 7, our method demonstrates significantly greater robustness compared to all baseline approaches across almost all types of distortions, achieving an average accuracy of 0.983 on MS and 0.955 on SVD, respectively.
Spatial tamper localization. Our tests show that the performance of spatial tamper localization decreases when tampered videos are subjected to further distortions. We attribute this decline to two main factors. First, distortion classified as tampered and reducing precision. Second, distortions affect Awm in PTB,, making the threshold calculated from clean watermarked videos less effective for distinguishing tampered regions in distorted videos. To address this, we introduce random distortions when testing Awm. which allows threshold reduces localization performance for clean tampered videos, it significantly improves ro- bustness against various distortions. We also find that setting L as 4 instead of 3 for SVD enhances robustness, as discussed in Appendix F. This demonstrates the flexibility of our method, allowing for multiple thresholds and L values in practical tamper localization applications.
be seen type of tamper, causing more regions to be
adjust fwom and borig accordingly. As shown in Table 8, while adjusting the
4 CONCLUSION
In this paper, propose VIDEOSUIELD, training-free video watermarking framework that em- beds watermarks during video generation, and achieves watermark extraction and tamper localiza- tion during detection. We map the watermark bits to watermarked Gaussian noise for sampling and innovatively introduce template bits during the mapping process. Through DDIM Inversion, the gen- erated video be converted into template bits, which are then used for both watermark extraction and tamper localization. Extensive experiments demonstrate the effectiveness of VIDEOSHIELD in both tasks and its adaptability across various video and image generation models.
ACKNOWLEDGMENTS
This research/ / project is supported by the National Research Foundation, Singapore and Infocomm Media Development Authority under its Trust Tech Funding Initiative (No. DTCRGC-04). It is
10

---

Published as a conference paper at ICLR 2025
also supported by the National Research Foundation, Singapore, and Cyber Security Agency of Singapore under its National Cybersecurity R&D Programme and CyberSG R&D Cyber Research Programme Office. Any opinions, findings and conclusions recommendations expressed in this material are those of the author(s) and do not reflect the views National Research Foundation, Singapore, Infocomm Media Development Authority, Cyher Security Agency of Singapore well as CyberSG R&D Programme Office, Singapore.
REFERENCES
Stability AL Stable diffusion 2.1. http:///hoggslnfaa....cttttaaais
diffusion 2-12-11--- 2022.
Fan Bao, Chendong Xiang, Gang Yue, Guande Hc, Hongzhou Zhu, Kaiwen Zheng, Min Zhao, Shilong Liu, Yaole Wang, and Jun Zhu. Vidu: a highly consistent, dynamic and skilled text-to- video generator with diffusion models. arXiv preprint vrXiv:2405.04233. 2024.
Daniel Bernstein al. Chacha, variant of salsa20. In Workshop record of SASC, volume 8, pp- 3-5, Citeseer, 2008
Andreas Blattmann, Tim Dockhor, Sumith Kulal, Daniel Mendelevitch, Maciej Kilian, Dominik Lorenz, Yam Levi, Zion English, Vikram Voleti, Adam Letts, et al. Stable video diffusion: Scaling latent video diffusion models to large datasets. arXiv preprint arXiv:231..55122 2023.
Tim Brooks, Bill Peebles, Connor Holmes, Will DePue, Yufei Guo, Li Jing, David Schnurr, Joe Taylor, Troy Luhman, Eric Luhman, Clarence Ng. Ricky Wang, and Aditya Ramesh. Video generation models as world simulators, 2024. URL https: /ttp:s/////a.../// com/ research//////e worlo simulators.
Madeo--eenerathe modeell
Mathilde Caron, Hugo Touvron, Ishan Misra, Hervé Jégou, Julien Mairal, Piotr Bojanowski, and Armand Joulin. Emerging properties in self-supervised vision transformers. In Proceedings of the IEEE/CVF international conference on computer vision, pp. 9650 9660, 2021.
Chengbo Dong, Xinru Chen, Ruohan Hu, Juan Cao, and Xirong Li. Mvss-net: Multi-view multi- scale supervised networks for image manipulation detection. IEEE Transactions on Pattern Anal- ysis and Machine Intelligence, 45(3):353--3553, 2022.
Hugging Face and cerspense. Zeroscope v2 576.. https: http::///huugnggfcc..c/oeeeeeee zeroscope_v2__ 6w, 2023.
Han Fang and et al. Pimog: An effective screen-shooting noise-layer simulation for deep-learning- based watermarking network. In ACM MM, pp. 2267-2275, 2022.
Yuming Fang, Hanwei Zhu, Yan Zeng, Kede Ma, and Zhou Wang. Perceptual quality assessment of smartphone photography. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 3677-3686, 2020.
Guanhao Gan, Yiming Li, Dongxian Wu, and Shu-Tao Xia. Towards robust model watermark via reducing parametric vulnerability. In ICCV, 2023.
Sam Gunn, Xuandong Zhao, and Dawn Song. An undetectable watermark for generative image models, 2024. URL ht tptspp: : arxiv. org/ 20os/24100 07369.
Junfeng Guo, Yiming Li, Lixu Wang, Shu-Tao Xia, Heng Huang, Cong Liu, and Bo Li. Domain watermark: Effective and harmless dataset copyright protection is closed hand. In NeurIPS, 2023a.
Junfeng Guo, Yiming Li, Ruibo Chen, Yihan Wu, Chenxi Liu, and Heng Huang. Zeromark: Towards dataset ownership verification without disclosing watermarks. In NeurIPS. 2024.
Xiao Guo, Xiaohong Liu, Zhiyuan Ren, Steven Grosz, Iacopo Masi, and Xiaoming Liu. Hierar- chical fine-grained image forgery detection and localization. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pp. 3155-31655 2023b.

---

Published as a conference paper at ICLR 2025
Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. In H. Larochelle, M. Ranzato, R. Hadsell, M.F. Balcan, and H. Lin (eds.), Advances in Neural Infor- mation P Processing Systems, volume 33, pp. 6840-6851 Curran Associates, Inc., 2020.
Runyi Hu, Jie Zhang, Yiming Li, Jiwei Li, Qing Guo, Han Qiu, and Tianwei Zhang. Supermark: Robust and training- free image watermarking via diffusion- super- repperresolution.. arXiv preprint arXiv:2412. 10049, 2024a.
Runyi Hu, Jie Zhang, Ting Xu, Jiwei Li, and Tianwei Zhang. Robust-wide: Robust watermarking against instruction-drivee image editing. In European Conference Computer Vision, pp. 20-37. Springer, 2024b.
Rongjie Huang, Jiawei Huang, Dongchao Yang, Yi Ren, Luping Liu, Mingze Li, Zhenhui Ye, Jinglin Liu, Xiang Yin, and Zhou Zhao. Make-an-audio Text-to-audio generation with prompt-enhanced diffusion models. In International Conference on Machine Learning, pp. 13916-13932. PMLR, 2023.
Ziqi Huang, Yinan He, Jiashuo Yu, Fan Zhang, Chenyang Si, Yuming Jiang, Yuanhan Zhang, Tianx- ing Wu, Qingyang Jin, Nattapol Chanpaisit, Yaohui Wang, Xinyuan Chen, Limin Wang. Dahua Lin, Yu Qiao, and Ziwei Liu. VBench: Comprehensive benchmark suite for video generative models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recogni- tion, 2024.
Zhaoyang Jía, Han Fang, and Weiming Zhang. Mbrs: Enhancing robustness of dnn-based water- marking by mini-batch of real and simulated jpeg compression. In Proceedings of the 29th ACM international conference multimedia, pp. 41-49, 2021.
Jared Kaplan, Sam McCandlish, Tom Henighan, Tom B Brown, Benjamin Chess, Rewon Child, Scott Gray, Alec Radford, Jeffrey Wu, and Dario Amodei. Scaling laws for neural language models. arxiv preprint arXhv:2001.08361 2020.
Junjie Ke, Qifei Wang. Yilin Wang, Peyman Milanfar. and Feng Yang. Musiq: Multi-scale im- age quality transformer. In Proceedings of the IEEE/CVF international conference computer vision, pp. 3148-5157 2021.
Kuaishou Large Model Team. Kling Large Model. https://kking: http://kkiigg.kkaiiio...o... www.kkku.iscccooo....oooo com/ 2024. [Online; accessed September 14, 2024].
Boheng Li, Yanhao Wei, Yankai Fu, Zhenting Wang, Yiming Li, Jie Zhang, Run Wang, and Tianwei Zhang. Towards reliable verification of unauthorized data usage in personalized text-to-image diffusion models. In JEEE S&P, 2025a.
Yiming Li, Linghui Zhu, Xiaojun Jia, Yang Bai, Yong Jiang, Shu-Tao Xia, Xiaochun Cao, and Kui Ren. Move: Effective and harmless ownership verification via embedded external features. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2025b.
Zhen Li, Zuo-Liang Zhu, Ling-Hao Han, Qibin Hou, Chun-Le Guo, and Ming-Ming Cheng. Amt: Aai-s multi-field transforms for efficient frame interpolation. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pp.
2023.
Xiaohong Liu, Yaojie Liu, Jun Chen, and Xiaoming Liu. Psce-net: Progressive spatio-channel correlation network for image manipulation detection and localization. IEEE Transactions on Circuits and Systems for Video Technology, 2022.
Xiyang Luo,, Yinxiao Li, Huiwen Chang, Ce Li Peyman Milanfar, and Feng Yang. Dvmark: a deep multiscale framework for video watermarking. IEEE Transactions Image Processing, 2023.
Rui Ma, Mengxi Guo, Yi Hou, Fan Yang. Yuan Li, Huizhu Jia, and Xiaodong Xie. Towards blind watermarking: Combining invertible and non-invertible mechanisms. In Proceedings of the 30th ACM International Conference on Multimedia, pp. 1532-1542, 2022.
William Peebles and Saining Xie. Scalable diffusion models with transformers. In Proceedings of the IEFF/CVF International Conference on Computer Vision, pp. 4195 4205, 2023.
12

---

Published as a conference paper at ICLR 2025
Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervision. In International conference machine learning, pp- 1748-8763. PMLR, 2021.
Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bjöm Ommer. High- resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF confer- ence on computer vision and pattern recognition, pp. 10684-10695, 2022.
Chitwan Saharia, William Chan, Saurabh Saxena, Lala Li, Jay Whang, Emily L Denton, Kamyar Ghasemipour, Raphael Gontijo Lopes, Burcu Karagol Ayan, Tim Salimans, et al. Photorealistic text-to-image diffusion models with deep language understanding. Advances in neural informa- tion processing systems, 35:36479-36444 2022.
Shuo Shao, Yiming Li, Hongwei Yao, Yiling He, Zhan Qin, and Kui Ren. Explanation wa- termark: Towards harmless and multi-bit model ownership verification via watermarking feature attribution. In NDSS, 2025.
Jascha Sohl-Dickstein, Eric Weiss, Niru Maheswaranathan, and Surya Ganguli. Deep unsupervised learning using nonequilibrium thermodynamies. In Francis Bach and David Blei (eds.), Proceed- ings of the 32nd International Conference Machine Learning, volume 37 of Proceedings of Machine Learning Research, pp. 2256-225555 Lille, France, 07-09 Jul 2015. PMLR.
Jaminng Song, Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. In Interna- tional Conference on Learning Representations, 2020.
Zachary Teed and Jia Deng. Raft: Recurrent all-pairs field transforms for optical flow. In Computer Vision-ECCV 2020: 16th European Conference, Glasgow, UK, August 23-28, 2020, Proceedings, Part II 16, pp. 402-419. Springer, 2020.
Jiuniu Wang, Hangjie Yuan, Dayou Chen, Yingya Zhang, Xiang Wang, and Shiwei Zhang. Mod- elscope text-to-video technical report. arXiv preprint arXiv:2308.06571, 2023.
Yuxin Wen, John Kirchenbauer, Jonas Geiping, and Tom Goldstein. Tree-rings watermarks: In- visible fingerprints for diffusion images. In Thirty-sevnnth Conference on Neural Information Processing Systems, 2023.
Haiwei Wu, Jiantao Zhou, Jinyu Tian, and Jun Liu. Robust image forgery detection over online social network shared images. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattem Recognition, pp. 11440-13444 2022.
Xiaoshuai Wu, Xin Liao, and Bo Ou. Sepmark:
Deep separable watermarking for unified source tracing and deepfake detection. In Proceedingy the 31st ACM International Conference on Multimedia, MM '23, pp. 1190-1201, New York, NY, USA, 2023. Association for Computing Machinery. ISBN 9798400701085.
doi: 00.1145/35817833362222 org/10 45 005558118883.17771
URL https://doi.
Zijin Yang, Kai Zeng, Kejiang Chen, Han Fang, Weiming Zhang, and Nenghai Yu. Gaussian shad- ing: Provable perforeance-lossless image watermarking for diffusion models. arXiv preprint arXiv:2404.04956, 2024.
Yanhong Zeng, Jianlong Fu, and Hongyang Chao. Learning joint spatial-temporal transforma- tions for video inpainting. In The Proceedings of the European Conference on Computer Vision (ECCV), 2020.
Kevin Alex Zhang, Lei Xu, Alfredo Cuesta-Infante, and Kalyan Veeramachaneni. Robust invisible video watermarking with attention. arXiv preprint arXiv:1909.00 2019.
Shiwei Zhang, Jiayu Wang, Yingya Zhang, Kang Zhao, Hangjie Yuan, Zhiwu Qin, Xiang Wang, Deli Zhao. and Jingren Zhou. 12vgen-xl: High-quality image-to-video synthesis via cascaded diffusion models. arXiv preprint 1.00::23111.44444 2023a.
13

---

Published as a conference paper at ICLR 2025
Xuanyu Zhang, Runyi Li, Jiwen Yu, Youmin Xu, Weiqi Li, and Jian Zhang. satile image watermarking for tamper localization and copyright protection. arXiv:2312.08883, 2023b.
Editguard: Ver- arXiv preprint
Xuanyu Zhang. Youmin Xu, Runyi Li, Jiwen Yu, Weiqi Li, Zhipei Xu, and Jian Zhang. V2a-mark: Versatile deep visual-audio watermarking for manipulation localization and copyright protection. arXiv preprint 0rXiv:2404.16824, 2024.
Shangchen Zhou, Chongyi Li, Kelvin CK Chan, and Chen Change Loy. Propainter: Improving propagation and transformer for video inpainting. In Pruceedings of the IEEE/CVF International Conference on Computer Vision, pp. 10477-10486, 2023.
A BACKGROUND
A.I DIFFUSION-BASED VIDEO GENERATION MODELS
Diffusion Models (DMs) were first introduced in (Sohl-Dickstein et al., 2015), where the original data is gradually diffused into noise, and the model learns the reverse process. Denoising Diffusion Probabilistic Models (DDPMs(Ho et al., 2020)) improved DMs by framing the reverse process as denoising, streamlining the training and generation phases. Denoising Diffusion Implicit Models (DDIMs (Song et al., 2020)) further enhanced DDPMs, offering faster sample generation with high quality. Due the deterministic and non-Markovian process. DDIMs allow for nearly reversible noising and denoising. Leveraging DDIM Inversion for image reconstruction is a key feature of our method. To reduce memory usage and speed up training and inference, Latent Diffusion Models (LDMs (Rombach et al., 2022)) use a Variational Autoencoder (VAE) to compress data into latent space for noise processing, driving the advancement of diffusion- based models.
Recent popular video generation models are mostly built on LDMs, with Sora (Brooks et al., 2024) marking a major shift in the field. Before Sora, models like ModelScope (Wang et al., 2023) and Stable-Video- Diffuu-Dffuuonn (Blattmann et al., 2023), compress each frame of a video into the latent space using 2D VAEs and employ a U-Net architecture to learn denoising across both spatial and temporal dimensions. However, this approach leads videos with poor temporal consistency, limited motion range, and shorter durations, while it is also difficult to scale the U-Net to achieve better perfor- mance. After Sora, models like Vidu (Bao et al., 2024) and KLING (Kuaishou Large Model Team, 2024) adopt 3D VAEs, which compress the entire video into series of 3D spacetime patches. This enables the model naturally capture both spatial and temporal relationships. These models use the more scalable Diffusion Transformer (DiT) (Peebles & Xie, 2023) architecture, allowing for the generation of longer, higher-qualin videos with smoother motions and better temporal consistency.
A.2 WATERMARKING
Watermarking methods for AIGC can be divided into two main categories: post-procession and in generation. Post-processing watermarking typically uses an encoder-noise layer-decoder training architecture. The encoder embeds invisible watermarks and the decoder extracts them after distor- tions are added to the noise layer. Various works introduce specific distortions for different types of robustness: MBRS (Jia et al., 2021) simulates JPEG artifacts, PIMoG (Fang & et al., 2022) tar- gets physical distortions, SepMark (Wu et al., 2023) addresses Deepfake-induced distortions, and Robust-Wide (Hu et al., 2024b) handles semantic-level changes. While most post-processing meth- ods focus images, RivaGAN (Zhang al., 2019) and DVMark (Luo et al., 2023) extend them to videos by using 3D convolutions. In-generation watermarking, which embeds watermarks during content creation, the focus of this paper and is primarily designed for diffusion models. Tree-Ring (Wen et al., 2023) and Gaussian Shading (Yang et al., 2024) can be classified into this category and show strong robustness. Specifically, Tree-Ring embeds multi-ring shaped watermarks in the initial Gaussian noise to achieve 0-bit watermarking, while Gaussian Shading (Yang et al., 2024) embeds multi-bits into the noise. They both adopt DDIM Inversion acquire the watermarked
Note that watermarking techniques can also be used to protect the copyright of data (Guo et al., 2023a: 2024; Li et al., 2025a) and models (Gan et al., 2023; Li et al., 2025b; Shao et al., 2025) other than solely AIGC. However, these topics are out of the scope of this paper.
14

---

Published as a conference paper at ICLR 2025
noise for watermark extraction. However, to our best knowledge, there is currently no in in-generation watermarking designed for video generation models.
A.3 TAMPER LOCALIZATION
Current tamper localization methods can be divided into two categories: proactive detection and passive detection. Most existing methods fall under passive detection, such as MVSS-Net (Dong al., 2022) and PSCC-Net (Liu al.. 2022), which learn the boundary features between tam- pered and original areas by training on tampered data. However, these methods often exhibit poor generalization, making it challenging to transfer effectively across datasets with different distribu- tions. Proactive detection is an alternative approach to tamper localization, which involves embed- ding additional information into the content to enable tamper localization and is adopted our work. Recently proposed methods like EditGuard (Zhang et al., 2023b) and V2A-Mark (Zhang et al., 2024) fall within this category and share similar functionalities with our approach. Their core concept involves embedding both watermark bits and template images into images or videos by post- pss-processing, enabling simultaneous copyright detection and tamper localization. However, these methods require extensive training, and their post-processing nature lead to resource sumption and degradation of image or video quality. Unfortunately, we cannot use these methods as baselines for comparison due to the lack of open-source access their models.
B RELATIONSHIP WITH GAUSSIAN SHADING
VIDEOSHIELD is not a straightforward extension of Gaussian Shading (GS) (Yang et al., 2024) to the video modality. The distinct contributions of our work are outlined as follows:
1. The Core Role of Template Bits. Template bits form the cornerttone of our framework, concept entirely absent in GS. These bits establish seamless, training-free connection between watermark embedding, extraction, and tamper localization. Furthermore, template bits are highly versatile, applicable to both images and videos, and adaptable to other modalities. This plug-and- play capability paves the way for multifunctional watermarking solutions, making the framework flexible and widely applicable.
2. GS as One Implementation Method Among Others. While GS provides method to im- plement template bits, it is not the only option. For example, PRC (Gunn et al., 2024) also serves alternative implementation. Specifically, PRC employs pseudorandom error-corecting code (PRC) to transform watermark bits into pseudo-randon bits that correspond one-to-one with the content. These pseudo-random bits can then be used template bits. PRC further combines the absolute values of randomly sampled Gaussian noise with the signs of the template bits, embedding the watermark effectively.
3. Innovations in the Video Modality. Our work introduces the novel concept of temporal tamper localization, addressing challenges that traditional methods cannot resolve. Additionally, leverag- ing the unique characteristics of video data, we propose two innovative techniques. Hierarchical Spatial-Temporal Refinement (HSTR) and Partial Threshold Binarization (PTB), which sub- stantially enhance the robustness of spatial tamper localization. These contributions close critical gaps tamper localization for video modalities, setting foundation for more robust and versatile watermarking frameworks.
C DATASETS
C.1 PROMPTS USED FOR T2V MODELS
The five categories of prompts we used for video generation are follows.
Animal
"a red panda eating leaves"
"a squirrel eating nuts"
"a cute pomeranian dog playing with soccer ball"
15

---

Published as a conference paper at ICLR 2025
"curious cat sitting and looking around"
"wild rabbit in a green meadow"
"underwater footage of octopus in coral reef"
"hedgehog crossing road forest"
"shark swimming in the sea"
"an african penguin walking on beach"
"a tortoise covered with algae"
Human
"a boy covering rose flower with a dome glass"
"boy sitting on grass petting dog"
"a child playing with water"
"couple dancing slow dance with sun glare"
"elderly man lifting kettlebell"
"young dancer practicing at home"
"a man hoodie and woman with red bandana talking to "each other and smiling"
"a woman fighter in her cosplay costume"
"a happy kid playing the ukulele"
"a person walking wet wooden bridge"
Plant
"plant with blooming flowers"
"close up view of white christmas tree"
"dropping flower petals on wooden bowl"
"a close up shot of gypsophila flower"
"a stack of dried leaves burning in a forest"
"drone footage of tree on farm field"
"shot of palm tree swaying with the wind"
"candle wax dripping on flower petals"
"forest trees and a medieval castle at sunset"
"a mossy fountain and green plants in botanical garden"
Scenery
"scenery of relaxing beach"
"fireworks display in the sky at night"
"waterfalls in between mountain"
"exotic view of a riverfront city"
"scenic video of sunset"
"view of houses with bush fence under a blue and cloudy sky"
"boat sailing in the ocean"
"view of golden domed church"
16

---

Published as a conference paper at ICLR 2025
Animal
Trss
Human
Plant
Scenery
Vehicles
Figure Real images of five categories used for Image-to- Video models.
"a blooming cherry blossom tree under blue sky with white clouds"
"aerial view of a palace"
Vehicles
"a helicopter flying under blue sky"
"red vehicle driving field"
"aerial view of a train passing by bridge"
"red bus in rainy city"
"an airplane in the sky" "helicopter landing the street"
"boat sailing in the middle of the ocean"
"video of a kayak boat in river"
"traffic on busy city street"
"slow motion footage of a racing car"
C.2 REAL IMAGES USED FOR I2V MODELS
We present 25 real images used by the 12V model in Figure 8.
17

---

Published as a conference paper at ICLR 2025
D MORE IMPLEMENTATION DETAILS
D.1 VIDEO QUALITY METRICS CALCULATION DETAILS
We present the formulas for calculating the five video quality metries from VBench (Huang al., 2024)-Subject Consistency, Background Consistency, Motion Smoothness, Dynamic Degree, and Imaging Quality. Further details are available in the original paper.
Subject Consistency. Subject Consistency is acquired by calculating the DINO (Caron et al., 2021) 1) feature similarity across frames:
Ssubject T Σ (d1 di) + (d--1 de),,
(12)
where de is the DINO image feature of the ith frame, normalized to unit length, and (+) is the dot product operation for calculating cosine similarity.
Background Consistency. Background Consistency evaluates the temporal consistency of the background scenes by calculating CLIP (Radford et al., 2021) feature similarity across frames:
T Σ (fe ce) + (c-1 .a)),
Sbackground T-1
+T-1
(13)
t=
where o represents the CLIP image feature of the jth frame, normalized to unit length.
Motion Smoothness. Motion Smoothness is evaluated by the frame-by-frame motion prior to video frame interpolation models (Li al., 2023). Specifically, given generated video consisting of frames [Jo, fi, S2, Ja, J4..., /2n./_.,,/////. 2, 11,-11,1_ J2n]. the odd-number frames are manually dropped to obtain a lower-frame-rate video [oo /4, .,,,,,,,, f2n 2, s2n]. and video frame interpolation (Li al., 2023) is used to infer the dropped frames [fi, fa. .... f2n-1]. Then the Mean Absolute Error (MAB) between the reconstructed frames and the original dropped frames is computed and normalized into [0, 1]. with a larger number implying smoother motion.
Dynamic Degree. Dynamic Degree designed assess the extent which models tend gener- ate non-static videos. RAFT (Teed & Deng, 2020) used to estimate optical flow strengths between consecutive frames of generated video. Then the average of the largest 5% optical flows (consider- ing the movement of small objects in the video) is taken as the basis to determine whether the video static. The final dynamic degree score is calculated by measuring the proportion of non-static videos generated by the model.
Imaging Quality. Imaging Quality is measured by the MUSIQ (Ke et al., 2021) image quality predictor trained on the SPAQ (Fang et al., 2020) dataset, which is capable of handling variable- sized aspect ratios and resolutions. The frame-win wise score is linearly normalized to [O, 1] by dividing 100, and the final score is then calculated by averaging the frame-wise scores across the entire video sequence.
D.2 TEMPORAL TAMPER
We consider three temporal tamper methods: Frame Drop, Frame Insert, and Frame Swap. The first two types of tamper result in changes to both the total number of frames and their order, while the latter only alters the frame order.
Frame Drop involves randomly selecting position and removing the entire frame that location.
Frame Insert involves choosing a random location and inserting an additional frame, either by selecting the adjacent frame or generating new one with Gaussian noise.
Frame Swap involves selecting frames random and swapping their positions.
18

---

Published as a conference paper at ICLR 2025
In experiments, for the first two tamper methods, we randomly choose location and execute the corresponding operation: Op(framey), where p ~ ff.....f} and Op E {Drop, Insert). For Frame Insert, the inserted frame is randomly selected from the adjacent frame generated with Gaussian noise. For Frame Swap, we start from a designated position and swap the frame at that position with the adjacent frame regular intervals: Swap(framep, framep+1). where p 2 + 4k: and &
{0, 1, 7
D.3 SPATIAL TAMPER
We consider two types of spatial tamper on generated videos: Crop&Drop and Inpainting- Crop&Drop involves randomly cropping portion of the video content (ratio 0.5) and flipping the remaining part, or randomly dropping a portion of the content (ratio 0.5) and flipping that part. Crop&Drop simulates outpainting (background changes) and inpainting (subject changes), respec- tively, making it useful for large-scale tamper localization tests on all generated videos. To make the tests more reflective of real-world application scenarios, we also manually mask the main objects in some videos and use inpainting models for tamper. Specifically, we employ STTN (Zeng et al., 2020) and ProPainter (Zhou al., 2023), two video inpainting models capable of removing objects from the masked locations, thereby achieving video tamper.
D.4 GENERALITY TEST
ZeroScope. We generate 200 videos at resolution of 256 using the prompts from ModelScope for watermark evaluation, following the same approach. Default sampling settings are applied, with 50 inference and inversion steps, configuring ky. ke. kn. kn to 8, 1, 4, 4 to embed 512 bits. For tamper localization, we select 40 videos and consider all temporal tamper types along with the Crop& spatial tamper on generated videos, as described in Sec. D.3. For the thresholds twom forig, and the hierarchical level L, we use the same settings as ModelScope.
12VGen-XL. We generate 200 videos at resolution of 512 using images generated by Stable Dif- fusion 2.1 for watermark evaluation, following the same approach with Stable- Video-Diffusiin De- fault sampling settings are applied, with 50 inference and inversion steps, configuring ky. kes kn, kw to 8, 1, 8, 8 to embed 512 bits. For tamper localization, we select 40 videos and consider all tem- poral tamper types along with the Crop&Drop spatial tamper generated videos, described in Sec. D.3. For the thresholds twm. forig. and the hierarchical level L, we use the same settings as Stable-Video-D
Three Versions of Stable Diffusion. We randomly sample 500 prompts from the Stable- Diffusion-Promph dataset² to generate 500 images resolution of 512. Default sampling con- figurations are applied with 50 inference and inversion steps. For spatial tamper localization, we consider the Crop&Drop method. Specifically, for Crop, the areas outside the cropped region are tumned black, and for Drop, the removed parts replaced with black. For the thresholds t tums torig, and the hierarchical level L, we use the same values as in ModelScope.
D.5 DISTORTIONS FOR TESTING ROBUSTNESS
Watermark extraction. We consider the following distortions: three video distortions-MPPr 4, Frame Average (N 3), and Frame Swap 0.25) and eight image distortions applied to each video frame: Gaussian Noise (a = 0.1), Gaussian Blur (r = 4), Median Blur (f 7), Salt and Pepper Noise (p = 0.1), Random Crop (0.5), Random Drop (0.5), Resize (0.3), and Brightness (factor = 6).
Spatial tamper localization. We consider the following distortions: MPEG-4, Frame Average
(N = 3), Gaussian Noise (a = 0.1), Gaussian Blur (r = 4), Median Blur (k 7), Salt and Pepper Noise (p 0.1), Random Crop (0.5), Random Drop (0.5), Resize (0.3), and Brightness (factor 6).
19

---

Published as a conference paper at ICLR 2025
E MORE EXPERIMENTAL RESULTS
E VIDEO QUALITY
Objective metries. We provide the specific metric values video quality in Table 9, As shown in the table, the watermarking method with post-processing causes more significant degradation to the videos in terms of Dynamic Degree and Imaging Quality. However, for Background Consistency and Motion Smoothness, videos with post-processen sometimes show a slight increase in range. We believe this is due to the watermark embedding introducing some blurring to the video, resulting in better smoothness, which leads to slight "anomalous" increase in continuity metrics.
Table 9: Specific metric values for video quality assessment.
Subject Consistency
Background Consistency
Motion Smoothness
Dynamic Degree
Imaging Quality
ModelScope
RivaGAN
0.922
0.951
0.960
0.540
0.648
MBRS
0.923
0.951
0,961
0,540
0.643
CIN
0,922
0.964
0.971
0.520
0.402
PIMoG
0.920
0.960
0,972
0,510
0.405
SepMark
0.919
0.962
0.961
VideoShield
0.923
0.954
0.961
0.545
0.648
RiviGAN
0.938
0.968
0.957
0,710
0.607
MBRS
0.938
0.968
0.960
0.693
0.584
CTN
0.937
0.973
0.965
0.672
0.431
SepMark
0.936
0.968
0.959
0.650
0.585
VidroShicld
0.607
User study. We further conduct user study perform subjective comparison of video quality- We randomly select 10 videos from each of the 200 videos generated by MS and SVD. After wa- termarking these videos by different methods, users with the instruction: "Please choose the video that you consider to have the highest quality, based on Subject Consistency, Background Consistency, Motion Smoothness, Dynamic Degree, and Imaging Quality."
distribute the watermarked videos 24 distinct
The results are shown in Table 10. As observed, VIDEOSHIELD receives the most votes for both MS and SVD, followed closely by RivaGAN with slight gap, while MBRS also garners relatively high votes. Conversely, CIN, PIMoG, and SepMark receive very few votes, indicating more significant visible degradation in video quality.
Table 10: Subjective evaluation results for video quality comparison.
Method
RivaGAN
MBRS
CIN
PIMoG
SepMark
VIDEOSHIELD
MS
78
59
3
2
6
92
SVD
51
8
98
E.2 WATERMARK ROBUSTNESS
The detailed watermark extraction accuracy of various watermarking methods under different dis- tortions is provided in Table 11, offering a comprehensive comparison of their performance across multiple scenarios.
Table 11: Specific extraction accuracy of various watermarking methods under different distortions.
Medie
S0150-4
Frase Arctig
Frase Stop
Okavdan Neac
Modea Blu
Sdi: aal Paper Notic
Rundor Cog
Bander Dogs
Rc-iz
Bigbaaco
Arznge
MediHSopp
NBBS
0.955
1.000
13.144
0.301
[LS0]]
(1.53
11.71
01.32
01:223
11.75
CIN
08903
0.591
0.992
3500
0.58
(1277
0/716
0.571
11955
00990
01354
0188)
11:11
RrstIAN
0.543
0351
0550
03500
01011
0067
0.341
0.555
0200
0.37
0152)
0190)
AIBES
6.50
01533
017
PBAx0
0354)
0.50
0000
01341
07225
0070
0.53
03532
1096
0.581
18.00
0.57)
VIDSOSBEILD
0.944
0.555
0.59
0.365
0992
00755
0.897
0.54
0.96
0.98
0.394
0199)
20

---

Published as a conference paper at ICLR 2025
E.3 IMPACT OF DIFFERENT INFERENCE AND INVERSION CONFIGURATIONS
We provide the detailed results under different inference and inversion configurations in Table 12.
Table 12: Results of different configurations in terms of three test dimensions. Since Stable- Video- Diffusion cannot generate high-quality video using non-default scheduler, omit this part of the test. Gray cells denote the default setting.
ModelScope
Dimension
Step
Step
Schedules
12
DDIM
UniPC
PNDM
DEIS
DPM
Watermark
1.000
1.000
1,000
1,000
1.000
1,000
1,000
1,000
L.000
1.000
1.000
1.000
1.000
0.998
Temporal Spatial
1,000
1,000
1.000
1000
1.000
1,000
1,000
1,000
1,000
1,000
1,000
1.000
1,000
0.981
0,906
0,966
0.895
0.96
0.909
0.907
0,906
0,902
0,906
0902
0307
0,902
0.786
Stable Video Diffissio
Dimension
Inference
Inversion Step
Image Guidunce
Schoduler
25
50
10
25
50
Buler
Waternurk
0,997
009999
00.999
0.999
0.999
0.997
0.9559
0.588
0.959
Temporal
0.929
0.936
0.969
0.934
0.936
0.937
0.972
0.936
0.866
0.936
Spatial
0.730
0,761
0,783
0.761
0.761
0.763
0.810
0.761
0.718
0.761
E.4 WATERMARK EXTRACTION FROM SPATIAL TAMPERED VIDEOS
We evaluate the accuracy of watermark extraction after the video undergoes spatial tampering. As shown in Table 13, even after various types of spatial tampering. the watermark extraction accuracy remains close to 100%, demonstrating its effectiveness in supporting forensics after video tampering.
Table 13: Watermark extraction accuracy on spatial tampered videos.
Model
STTN
ProPainter
Crop&Drop
MS 0.975
0.971 0.975
0.997
SVD
0.976
0.982
E.5 ROBUSTNESS AGAINST MORE DISTORTIONS
To further evaluate the resilience of VIDEOSHIELD, we test its robustness against a range of video compression methods (including extreme compression) and color adjustments, shown in Table 14. For video compression, the typical CRF (Constant Rate Factor) range is 18-28, where 18 corre- sponds higher video quality and 28 lower quality. The results show that only under extreme compression conditions (CRF > 28) do the watermark extraction and localization performance for both MS and SVD start to degrade significantly. However, adjusting the threshold substantially improves spatial localization performance. At this point, the video quality is already severely de- graded, making the performance drop reasonable. For color adjustments, VIDEOSHIELD shows strong robustness, maintaining high performance in both watermark extraction and tamper localiza- tion. Overall, VIDEOSHIELD demonstrates good robustness, making it suitable for most real-world scenarios.
E.6 COMPARISON WITH EDITGUARD
We conduct comprehensive experiments to compare VIDEOSHIELD with EditGuard (Zhang et al., 2023b), recently open-sourced proactive tamper localization model known for its outstanding performance. Our evaluation encompasses both videos and images generated by various models. Specifically, employ the default spatial tamper method, Crop&Drop, to create 200 tampered videos for each video generation model and 500 tampered images for each image generation model. As shown in Table 15, VIDEOSHIELD outperforms EditGuard five models, with the exception of SVD and 12VGen. The relatively lower performance on SVD, in particular, is discussed in Appendix G.3, where attribute this to the quality of the generated content.
21

---

Published as a conference paper at ICLR 2025
Performance under more spatial distortions. As discussed in Sec. 3.5, 'w/o' refers to using turm and forig derived from the clean watermarked videos, while "w/" indicates that various distortions are introduced during the distribution testing, leading to adjustments in tum and torig. Hue=0.5 is the max factor we can configure.
Table 14:
H.264 (CRF)
Dimension
Model
Clean
0.e=00.5
18
23
28
33
38
MS
1.000
0.999
0.999
0.997
0.978
0.907
1.000
Watermark
SVD
0.999
0.988
0.980
0.961
0.933
0.888
0.993
MS w/o
0.906
0.861
0.826
0.746
0.639
0.555
0.842
MS w/
0.806
0.814
0.812
0.788
0.720
0.627
0.815
Spatial
SVD w/o
0.761
0.667
0.635
0.607
0.577
0.547
0.684
SVD w/
0.708
0.718
0.699
0.664
0.639
0.605
0.724
Table 15: Comparison of spatial tamper localization performance between VIDEOSHIELD and Ed- itGuard on videos and images generated by various models. SD stands for Stable Diffusion. The table presents the average values of five metries: FI, Precision, Recall, AUC, and IoU.
Video
Image
Method
MS
SVD
ZS
12VGen
SD 1.4
SD 1.5
SD 2.1
EditGuard
0.890
0,886
0.880
0.882
0,885
0.885
0.885
VIDEOSHEED
0.906
0.761
0.900
0.867
0.938
0.939
0.928
E.7 COMPUTATION OVERHEAD
Results. We provide the computation overhead of VIDEOSHIELD in Table 16. The primary GPU memory usage and runtime overhead are concentrated in the DDIM inversion stage. However, as shown in the table for step 10 and step 255, reducing the number of inversion steps can sig- nificantly decrease the runtime, with only a slight sacrifice in performance as shown in Table 12.
Table 16: Computational overhead of VIDEOSHIELD in terms of GPU memory usage and runtime, evaluated on single NVIDIA RTX A6000 GPU (49 GB) in FP16 mode. The average runtime of different stages is reported based on 50 generated videos, with the batch size set to 1. "Step" refers to the inversion step, while "Watermark," "Spatial," and "Temporal" indicate the average runtime of watermark extraction, spatial tamper localization, and temporal tamper localization. respectively.
Runtime
Model #Params
Resolution
GPU (GB)
Step=10
Step=25
Watermark
Spatial
Temporal
MS
1.83B
256
3.77
1.2408
3.0617
0.0011
0.0019
0.0004
SVD
2.25B
512
5.32
4.3214
10.2027
0.0023
0.0019
0.0004
7S
1.83B
256
3.77
1,2430
3.0492
0.0011
0.0019
0.0004
12VGen
2,48B
512
5.99
4.6700
11.1526
0.0023
0.0019
0.0004
Potential speed-up methods. In practice, the number of inversion steps required for diffusion model inversion aligns best with the number of inference steps. Existing distillation techniques can effectively reduce the inference steps of diffusion models, thereby substantially lowering the infer- explore potential efficiency improvements, we conduct experiments on SD 1.5 and SD 1.5 Turbo (the distilled version of SD 1.5) for image tamper localization, with the results summarized in Table 17. These experiments show that distillation techniques significantly reduce the number of required inversion steps while maintaining comparable localization perfor- mance. This suggests that similar distillation techniques can be adapted for video diffusion models, offering a promising approach to significantly reduce the computational overhead of VIDEOSHIIELD.
ence cost of VIDEOSHIEL.D.
F MORE ANALYSIS
Different distributions based on l in PTB. Table 18 shows that when k is set to 100, there few outliers, leading wider statistical distribution range. For example, in ModelScope
22

---

Published as a conference paper at ICLR 2025
Table 17:
Comparison of inversion runtime reduction in the SD 1.5 Turbo model without compro- mising the performance of VIDEOSHIELD. SD 1.5 Turbo is a distilled version of SD 1.5, which single step.
enables image generation in significantly fewer steps, potentially
Model
Step
Runtime (s) Spatial Localization
SDL.5
10 2
0.3146 0.0874
0.912
SDI.5 Turho
0.909
with jr 2, when k 100, Aum and Aorig range from [0.28, 1.00] and [0.06, 0.84), respectively; whereas for k = 99, 99,999... Aum and Aorig are [0.56, 0.93] and [0.28, 0.68J, respectively. Clearly, 100 significantly increases the overlap compared to k 99, and the thresholds (fum and lorig) obtained may cause many points to become indistinguishable, thereby reducing localization performance.
Table 18: The specific distribution of the watermarked and the original videos corresponding dif- ferent values of k in PTB. We bold the distribution range used for calculating the default thresholds bow and lorig-
ModelScope
Video-Diffusiee
Distribution
Local Value
97
98
100
.7
98
99
100
[0.25, 1.00]
[0.25, 1.00]
[0.25, 1.00)
[0.00) 1,00]
[0:25, 1,00]
[0.00] 1.00]
[0.00. 1.03]
[0.00. 1.00]
Aum
[0.59.0.33]
[0.37,
0.54)
[0.69, 0.851
[0.68. 0.86]
[0.66, 0.88]
[0.55, 0.96]
00.48,0.73)
[0.47, 0.74]
[0.45. 0.76]
0..37 0.871
10,00, 1.00]
[0.00, 1.00]
[0.00, 1.00]
[0.00. 1,00]
[0,00, 1.00]
[0.00, 1.00]
[0.00. 1.00]
[0.00. 1.00]
Aarig
[0.28, 0.68]
[0.31, 0.68]
[0.12.0.8
[0.44, 0.55]
[0:43,
[0.42, 0.57]
[0.37, 0.62]
[0.44,
[0.43, 0.56]
[0:42, 0.57]
[0.36,0.0
Accuracy distributions of different local values for seven Models. As shown in Figure 9, observe two key points: (1) The higher the comparison accuracy distribution of a model, the better its spatial tamper localization performance. (2) The distributions for models of the same type (T2V, 12V. and T2I) are similar. These conclusions are consistent with the results presented in Table 6 and Table
1.0
08-
Mode
Stacle Mice Blutonn
Diviier
Stuble Offiatonn 1-4 Stabde Oethaton
08-
Local Velue
Figure 9: Comparison accuracy distributions of different local values on the watermarked and orig- inal videos generated by seven models.
The relationship between VIDEOSHIELD'SS performance and model's inversion accuracy. We further test the average inversion accuracy of the four video generation models we test. As men- tioned before, the performance of VIDEOSHIELD on different models varies. Since the method is based DDIM Inversion, speculate that this difference is related to the inversion accuracy of the model itself and conduct corresponding tests. Figure 10 shows the relationship between VIDEOSHIELD'S performance and average inversion accuracy. It can be seen that the performance of our method is positively correlated with inversion accuracy. The higher inversion accuracy is, the better the performance of our method is.
23

---

Published as a conference paper at ICLR 2025
Temporal Tampering
Spatial Tampering
1,000
10000
12V/ee-XXL ModetScope
I2VCenalL ModelScope
1205ennXL ModelScope
0.590
1,000
1.000
0.970
3,840
0.999
0.360
00.220
0.800
0.999
0.780
0.340
0.999
0,700
Inversion
Inversion
Figure 10: The relationship between inversion accuracy and VIDEOSHIELD'S performance in three dimensions. The inversion acc refers to the average accuracy of points in the comparison bits matrix Cmp.
The relationship between VIDEOSHIELD'S performance and different resolutions. We further investigate the performance of VIDEOSHIELD videos with different resolutions. Since ZeroScope trained on videos various resolutions, we choose to generate videos at different resolutions for this analysis. As shown in Table 19, VIDEOSHIELD 's spatial tamper localization performance improves as the resolution increases. We believe this is because higher video resolutions capture more details and provide better quality, allowing the template bits to better integrate into the gen- erated video. This, in turn, enhances the inversion accuracy, leading to improved spatial tamper localization performance.
Table 19: Performance on videos generated by ZeroScope with different resolutions.
Resolution 256
320
384
448
Watermark
1.000
1.000
1,000
1.000
Temporal
1.000
1,000
1.000
1.000
Spatial 0.900
0.918
0.941
0.948
Importance of adjusting fwo &torio of PTB and L of HSTR, when performing spatial tamper localization on distorted tampered videos. As shown in Figure 11, when distortion is added to the watermarked video, its distribution Aum shifts towards Aorig. reducing the distinction between tampered and original regions. To mitigate the impact of this shift, we can readjust tum and torig derived from Aym and Aorig As depicted in Figure 13, adjusting the threshold effectively enhances robustness of spatial tamper localization against various distortions, although slightly reduces performance on clean tampered videos. Additionally, as shown in Figure 12, we re-test the spatial tamper localization performance corresponding to different values under distortion scenarios using adjusted thresholds. We find that for Stable- Video-Difffun videos with added distortions yields better results. We believe this is because the inversion accuracy of Stable- Video- Diff--Diffuuion is inherently low; thus, after adding distortions, more comparison bits are needed for a more accurate assessment, which enhances robustness.
using larger
4 for tampered
G MORE VISUAL EXAMPLES
G.1
MAIN RESULTS
Spatial tamper localization results under different hierarchical level L. See Figure 14.
More spatial tamper localization results videos generated by ModelScope and Stable- Video- Diffusion for different types of spatial tamper. See Figure 15, Figure 16, Figure 17 and Fig- 18.
24

---

Published as a conference paper at ICLR 2025
ModeSScope
Viddo Diffus
ModelScom
Stable-Viuo Diflann
0.73
Viea byp
distattoms
612
Local Volue
Local value
Figure 12:
The line chart depicting the vari- ation of spatial tamper localization perfor- mance as hierarchical level L changes on clean and distorted watermarked videos.
Figure 11: Comparison accuracy distributions A of different local values μ on the original, watermarked and distorted watermarked videos.
ModelScope Average
Clean Threshold
Geable-Video-Diffusiii
Distortoon Threshold
Average
MPEG-4
Srightness
MPEC-4
Avarago
Framé
Resize
Framé Avorage
Resize
Goussjan
Noise
Sait and Noise
Gaussian
Nose
Salt and Pesper
Noise
Gauzsion
Median
Gauzsian
Filter
Figure 13: Spatial localization performance against distortions using clean and distortion threshold.
Origial
Tarpood
pood
Stuble- Vadeo- Taleo-Diffiiii Diffission
ModelSoope
Figure 14: Some visual examples of spatial tamper localization with different hierarchical level L.
G.2 GENERALITY
Spatial tamper localization results on videos generated by other video models. See Figure 19 and Figure 20.
Spatial tamper localization results images generated by different T2I models. See Fig-
ure 21.
G.3 FAILURE CASES OF STABLE- VIDEO-DIFFUSION
Limitations of the video model restrict localization performance. As shown in Figure 22 and Figure 23, the residual image indicates that the content in the areas where spatial tamper localiza- tion fails (highlighted by the white regions of the predicted mask, which are not actually tampered) closely resembles that of the conditional image (represented by the black areas in the residual). Consequently, the noise corresponding to the template bits in these regions has not been effectively denoised, resulting in content that is merely replica of the conditional image. The inverted bits ob-
25

---

Published as a conference paper at ICLR 2025
Original
Tampered
Original
Tampered
GT
Pred
Figure 15: Some visual spatial tamper localization results on videos generated by ModelScope with STTN tamper.
Original
Tampered
GT
Pred
Original
Tampered
Pred
Figure 16: Some visual spatial tamper localization results on videos generated by ModelScope with ProPainter tamper.
tained through inversion clearly do match the original template bits, leading the entire region being classified as tampered and ultimately reducing localization accuracy. Thus, this limitation stems from the model itself, which struggles generate video where the overall content can move seamlessly.
Enhancing localization performance by improving video quality through sampling configura- tion adjustments. As shown in Figure 24, adjusting the sampling configuration allows the model to generate more original content in the video instead of merely copying from the conditional im- ages. This not only enhances video quality but also enables better integration of the noise corre- sponding to the template bits with the relevant video content. Consequently, this leads to improved reconstruction through inversion, resulting in better localization performance when compared the original template bits.
26

---

Published as a conference paper at ICLR 2025
Original
Tampered
GT
Pred
Original
Tampered
GT
Pred
Figure 17: Some visual spatial tamper localization results on videos generated by Stable- Video- Diffusion with STTN tamper.
Original
Tampered
GT
Pred
Original
Tampered
GT
Pred
Figure 18: Some visual spatial tamper localization results videos generated by Stable-Vidd Diffusion with ProPainter tamper.
27

---

Published as a conference paper at ICLR 2025
Original
Tampered
GT
Pred
Original
Tampered
GT
Pred
Figure 19: Some visual spatial tamper localization results on videos generated by ZeroScope with Crop&Drop tamper.
Original
Tampered
GT
Pred
Original
Tampered
GT
Pred
Figure 20: Some visual spatial tamper localization results videos generated by 12VGen-XI. with Crop&Drop tamper.
28

---

Published as a conference paper at ICLR 2025
Stable Diiffusiff---eeee
Stable- Difffusionvv--3
Stable- Stable-Diffusee Diffiussiii---
Figure 21: Some spatial tamper localization results on images generated by different versions of Stable Diffusion with Crop&Drop tamper.
29

---

Published as a conference paper at ICLR 2025
Original
Tampered
Conditional Image
Figure 22: Examples of poor spatial tamper localization on videos generated using Stable- Video- Diffusion. "Residual" refers to the difference obtained by subtracting the frames of the video from the conditional image.
Original
Residual
Tampered
Pred
Conditiooal Image
Figure 23: Examples of poor spatial tamper localization videos generated using Stable-Video- Diffusion.
30

---

Published as a conference paper at ICLR 2025
Conditional Image
GT
Tampered
Original
Residual
Pred
Figure 24: Some videos generated by Stable- Video-Diffusion based on different sampling config- urations, along with the corresponding spatial tamper localization results. Each row, from left to right, represents frames 1, 6, 11 1, and 16 of the generated video. For the original, tampered, residual, and predicted images, the first to third rows correspond to: default settings, Inference Step 50, and Image Guidance = 2, respectively.
31


Reviews:
[{"review_id": "5CzMR3YmjV", "reviewer": "Reviewer_YUmj", "summary": "The paper addresses the need for the control of integrity and misuse of AI Generated Content. The usual approach is to use watermarks for video domain, but they are underdeveloped and have a post-processing manner, which results in video quality degradation. The authors propose a novel way of watermarking images while generating it (VideoShield). Their method is training-free and works with diffusion-based video models. Authors extract the watermark from the images using DDIM Inversion.", "questions": "1) Results from Table 1 shows that the proposed method is only marginally better than RivaGAN w/o real images conditioning. Did you check RivaGAN with the same setup as the last row? \n2) Why do you compare only to SVD in Table 2? \n3) The authors appeal to decreased visual quality of videos generated with the existing watermarking methods, but did not organise subjective study to show that their method outperforms the others. Video quality metrics are known to have limited capabilities to estimate AIGC. Subjective comparison is required in this work, can you provide one?", "limitations": "", "rating": 6, "confidence": 3, "soundness": 2, "presentation": 1, "contribution": 2, "strengths": "1) The proposed method does not require additional training, which could simplify integration with existing diffusion models.\n2) The framework’s ability to detect tampering both within frames and across the sequence", "weaknesses": "1) Notation T_temp for a threshold in tampering is a bit confusing, considering T_p is a tensor.\n2) No introduction for chacha20\n3) No formula for calculating video quality is given \n4) Figure 2 provides only abbreviations in the legend\n5) Over all paper, formulas and tables seem to have decreased font. Moreover, some tables overlap the text (e.g. Table1). This may be a reason for a possible desk rejection.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "0SzLDvUhii", "reviewer": "Reviewer_Jpgb", "summary": "The paper \"VideoShield: Regulating Diffusion-Based Video Generation Models via Watermarking\" presents VideoShield, a novel framework for embedding watermarks in diffusion-based video generation models, including both text-to-video (T2V) and image-to-video (I2V) models. The paper addresses the need for content control and authenticity verification in AI-generated video content, focusing on integrating watermarks during the video generation process to prevent quality degradation. Key contributions include In-Generation Watermark Embedding, Tamper Localization for Videos, and Watermark Extraction and Robustness.", "questions": "1. Can the author provide more comparative details on how VideoShield compares to other watermarking frameworks or post-processing methods in terms of tamper localization accuracy and robustness?\n2. Can the author share the computational performance of VideoShield, especially regarding the running time of different video resolutions or models?\n3. Will the author consider testing the robustness of VideoShield under other types of distortion, such as extreme video compression, frame rate variations, or color adjustments? These additional distortions are common in real-world applications and can enhance confidence in VideoShield's resilience.\n4. The results indicate that VideoShield has a certain dependence on video quality. Does the performance of VideoShield still vary due to resolution or model complexity? If so, can the author provide more insights or data on these factors?\n5. Can VideoShield adapt to image tampering localization?\n6. Is the watermark capacity of 6 512 bits suitable for all video resolutions, or is the number of bits that can be embedded flexible based on the characteristics of the video?\n7. Placing visual content in the main text seems better.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The paper introduces an innovative approach to watermarking in diffusion-based video generation models by embedding watermarks during the generation process, which diverges from traditional post-processing methods. Compared to image watermarking, this is a less explored field. The originality of embedding watermarks during the generation process, as well as the novel dual tampering localization, is a meaningful supplement to this field.\n2. The technical methods are rigorous and fully described. This paper uses DDIM inversion to provide a solid foundation for watermark embedding and extraction without affecting video quality. The extensive experimental evaluation of multiple T2V and I2V models strongly demonstrates this method's robustness, flexibility, and effectiveness. The author's detailed analysis of different watermark extraction and localization scenarios further strengthens the contribution of this article to this field.\n3. This paper is well-organized and provides a clear understanding of motivation, methods, and experimental setup.\n4. VideoShield's training-free and high-fidelity watermarking method provides a reliable and efficient solution for generating watermarks in video models. This paper addresses a highly relevant issue - ensuring the integrity of content in videos generated by artificial intelligence.", "weaknesses": "1. Although this article introduces relevant watermarking and tampering localization methods, there is no comparative analysis with other video generation or post-processing watermarking methods. For example, including baselines for time tampering localization or using alternative methods to evaluate the robustness of specific types of distortions.\n2. VideoShield is positioned as a non-training and efficient framework, but this paper lacks specific comparisons with baselines regarding time/computational complexity, such as runtime.\n3. Although these experiments covered various distortions, they did not explore broader real-world attack scenarios, including testing with denser video compression techniques, color distortion, or frame rate changes, which could further validate the robustness of VideoShield in various real-world environments. In addition, analyzing the performance of VideoShield under adversarial conditions where attackers actively attempt to bypass watermarks could be an interesting solution.\n4. The author can further discuss the limitations by listing the performance of VideoShield under different video quality and generation settings. This method seems to perform better on higher-quality video output, but further discussion on factors that may affect watermark integrity, such as video resolution or content complexity, will further demonstrate the effectiveness boundary of VideoShield.\n5. This article briefly introduces the adaptability of image watermarking, but can VideoShield adapt to image tampering localization scenarios?", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "Zf6Kwh2qhL", "reviewer": "Reviewer_RSGi", "summary": "The paper introduces VIDEOSHIELD, a novel watermarking framework for diffusion-based video generation models. By embedding the watermark directly during the generation process, VIDEOSHIELD eliminates the need for additional training, providing a cost-effective solution for safeguarding generated videos. Additionally, the model includes a proactive tamper detection mechanism. Using template bits derived from the watermark, the authors enable both temporal and spatial localization of tampering within the video.", "questions": "NA", "limitations": "", "rating": 3, "confidence": 4, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "- This paper is well-written.\n- This paper proposes a novel scheme for proactive video forensics.", "weaknesses": "1.\tThe proposed model may not entirely align with watermarking application scenarios. In its context, verification requires the recipient to compare the watermarked video against the original video's bit template. This requires the verifier to either have access to the original video to generate the bit template using the same encryption method, or to obtain the bit template directly from the video creator. Such requirements differ from standard watermark extraction practices, where verifiers typically can extract watermark information without needing the original video.\n\n2.\tThe model uses the CHACHA20 stream cipher to generate template bits, requiring the algorithm to use the same key with different nonces for each encryption. Does this mean that a unique random number needs to be set for each video? If so, how does the method handle the storage of a large number of video-to-key mappings? Additionally, it’s unclear whether the primary goal of this approach is to protect the model itself or the generated videos.\n\n3.\tThe proposed method uses watermarking for proactive tamper detection; however, the baseline experiments in the paper compare it primarily with passive detection methods (e.g., MVSS-Net, HiFi-Net), which may not be entirely appropriate. It would be more suitable to compare the approach with other active tamper detection methods. Below are references to such methods for consideration:\n[1] Zhang X, Li R, Yu J, et al. Editguard: Versatile image watermarking for tamper localization and copyright protection[C]//Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2024: 11964-11974.\n[2] Zhou Y, Ying Q, Wang Y, et al. Robust watermarking for video forgery detection with improved imperceptibility and robustness[C]//2022 IEEE 24th International Workshop on Multimedia Signal Processing (MMSP). IEEE, 2022: 1-6.\n\n4.\tThere are formatting issues: the bottom line of Table 1 overlaps with the text below, and the font size in Table 3 is too small, making it difficult for readers to follow.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "hbi5G7HwbV", "reviewer": "Reviewer_g7Rd", "summary": "This paper presents a VideoShield, which embeds watermarks directly during video generation. It maps watermark bits to template bits, which are then used to generate watermarked noise during the denoising process. Template bits allow precise detection for potential spatial and temporal modification. Extensive experiments demonstrate its effectiveness.", "questions": "The framework looks heavy, how about the computational overload? \nThe relationship with \"Gaussian Shading\" needs to be further clarified.", "limitations": "", "rating": 8, "confidence": 5, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "The topic is interesting. Using DDIM Inversion, the video can be reversed to its original watermarked noise. The paper is written and organized well. Experiments are plenty and convincing. The ablation study verified the contribution of each design towards the whole framework.", "weaknesses": "No obvious drawbacks are found. However, typesetting needs to be improved, such as keeping the same or similar text size of the table as the text, no overlapping between table and text.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "QSEy6QOEMQ", "reviewer": "Reviewer_WfUe", "summary": "The watermark can actively identify generated content and is currently the primary method used for detection and attribution in diffusion models. However, there has been no watermarking method specifically addressing video generation models based on diffusion models. This paper proposes VIDEOSHIELD to fill this research gap. VIDEOSHIELD introduces a Gaussian Shading watermark embedding method that does not require additional training. In addition to its basic watermarking functionality, VIDEOSHIELD also acts as a fragile watermark, enabling both temporal (across frames) and spatial (within individual frames) tampering localization. Furthermore, it introduces Hierarchical Spatial-Temporal Refinement to enhance accuracy. Experimental results demonstrate that VIDEOSHIELD performs effectively on both T2V and I2V diffusion models.", "questions": "Address the weakness, especially the novelty issue.", "limitations": "", "rating": 5, "confidence": 5, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "1. This paper introduces a Gaussian Shading watermark embedding method that does not require training, thereby avoiding additional computational overhead.\n2. Unlike previous methods that focus solely on spatial tampering localization, VIDEOSHIELD takes into account both temporal and spatial tampering localization during the tampering detection process. The paper introduces Hierarchical Spatial-Temporal Refinement, which enables the generation of more detailed masks for tampering localization, significantly improving the accuracy of the detection.", "weaknesses": "1. The innovation presented in this paper is moderate. It extends Gaussian Shading from images to videos and further explores its potential as a fragile watermark. \n2. The presentation of the text has significant issues, particularly in Section 3.4, \"TAMPER LOCALIZATION.\" In this section, the extensive use of symbols due to the inclusion of formulas creates obstacles to understanding the paper's content. The frequent reuse of subscripts p and q makes reading quite difficult; the matrix subscript notation is inconsistent, such as in C_(p(q=M(p))), which is recommended to be changed to C_(p,M(p)). Additionally, the comparison bits matrix Cmp could be written as CMP to standardize with other matrix symbols and to avoid confusion with the subscript p. In line 334, the letter m is used both for the variable and for watermark information, which may lead to confusion. After reviewing the main text, I found that in Supplementary Material A3.1, the authors provide a simple example of the process. I strongly recommend including Figure 7 in the main text to aid reader comprehension. Furthermore, there is some overlap between Table 1 and the Datasets section.\n3. In my view, the authors have not addressed an important issue regarding the sequence of watermark attribution and tampering localization. The paper does not demonstrate the accuracy of the watermark after spatial tampering. If we assume that a video undergoes spatial tampering and the tampered areas are detected through localization, but the watermark attribution fails, we cannot conclude that a third party maliciously altered the generated video. This raises the question of whether the watermark has become ineffective in such a scenario.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "CtdonvTKfb", "reviewer": "Reviewer_JeCQ", "summary": "This article proposes a zero-shot video generation model with active watermarking for video copyright protection and tampering localization.  Based on the DDIM inversion process, the watermark information hidden in the initial Gaussian noise can be detected again from the generation results, and this active watermark is robust against video tampering,  image degradation, and other attacks. Furthermore, for the task of video tampering localization, the authors have designed a detection method that localizes tampering in both temporal (frame position) and spatial  (image information) aspects. Experiments have proven the performance advantages of VideoShield.", "questions": "- In Table 1 and other tables, the metric \"Video quality\" is mentioned. How is it specifically calculated? The authors mentioned it is the average of a series of metrics; if possible, could you provide the specific values for each metric?\n- Currently, the VideoShield method can hide 512 bits. What is the upper limit for watermark capacity?", "limitations": "", "rating": 8, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 4, "strengths": "- VideoShield leverages the unique properties of active watermarking, innovatively combining the model watermarking task with the tampering localization task, demonstrating significant performance advantages.\n- This method requires no training and follows a zero-shot paradigm, making it easy to reproduce and validate its performance.\n- This method is based on the properties of diffusion and Gaussian distribution, allowing it to be generalized to other diffusion-based models, such as text-to-image models, exhibiting good generalization capabilities.", "weaknesses": "- The threshold and hyperparameter settings in the method section are mostly the result of manual searches. The authors may consider exploring how these thresholds could be adaptively searched in the future.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)