SIGMark: Scalable In-Generation Watermark with Blind Extraction for Video Diffusion
Authors: Xinjie zhu
Zijing Zhao
Hui Jin
Qingxiao Guo
Yilong Ma
YUNHAO WANG
Xiaobing Guo
Weifeng Zhang
Venue: ICLR 2026 Poster (2026)
Keywords: watermarking
video generation
Primary area: alignment, fairness, safety, privacy, and societal considerations

Abstract: Artificial Intelligence Generated Content (AIGC), particularly video generation with diffusion models, has been advanced rapidly. 
Invisible watermarking is a key technology for protecting AI-generated videos and tracing harmful content, and thus plays a crucial role in AI safety.
Beyond post-processing watermarks which inevitably degrade video quality, recent studies have proposed distortion-free in-generation watermarking for video diffusion models.
However, existing in-generation approaches are non-blind: they require maintaining all the message-key pairs and performing template-based matching during extraction, which incurs prohibitive computational costs at scale.
Moreover, when applied to modern video diffusion models with causal 3D Variational Autoencoders (VAEs), their robustness against temporal disturbance becomes extremely weak.
To overcome these challenges, we propose SIGMark, a Scalable In-Generation watermarking framework with blind extraction for video diffusion.
To achieve blind-extraction, we propose to generate watermarked initial noise using a Global set of Frame-wise PseudoRandom Coding keys (GF-PRC), reducing the cost of storing large-scale information while preserving noise distribution and diversity for distortion-free watermarking.
To enhance robustness, we further design a Segment Group-Ordering module (SGO) tailored to causal 3D VAEs, ensuring robust watermark inversion during extraction under temporal disturbance.
Comprehensive experiments on modern diffusion models show that SIGMark achieves very high bit-accuracy during extraction under both temporal and spatial disturbances with minimal overhead, demonstrating its scalability and robustness.
Our code is available at https://github.com/JeremyZhao1998/SIGMark-release.

Published as a conference paper at ICLR 2026
SIGMARK: SCALABLE IN-GENERATION WATERMARK WITH BLIND EXTRACTION FOR VIDEO DIFFUSION
Xinjie Zhu"
Zijing Zhao Lenovo Research, Beijing, China zhaozj238 (aaooz223@enovv.ccomm eenvvo.com
Lenovo Research, Beijing, China zhuxj1 11 eneovoo.... com
Hui Jin
Qingxiao Guo
Yilong Ma
Lenovo Research, Beijing, China finhui88 weeoovo..eeeooccoooooomooooooe.o com
Lenovo Research, Beijing, China @xogx2@1enova
Lenovo Research, Beijing, China may19@lenova 1ey199eenovo.co
Yunhao Wang
Xiaobing Guo
Weifeng Zhang
Lenovo Research, Beijing, China (annyy443eenovo.comm com
Lenovo Research, Beijing, China guoxba Lenovo.ccoooooooooo com
Lenovo Research, Beijing, China weifengz& www.eeccccccooo com
ABSTRACT
Artificial Intelligence Generated Content (AIGC), particularly video generation with diffusion models, has been advanced rapidly. Invisible watermarking is a key technology for protecting Al-generated videos and tracing harmful content, and thus plays a crucial role in Al safety. Beyond post-processing watermarks which inevitably degrade video quality, recent studies have proposed distortion- free in-generation watermarking for video diffusion models. However, existing in ge-eeerrrtion approaches are non-blind: they require maintaining all the message- key pairs and performing template- based matching during extraction, which in- curs prohibitive computational costs at scale. Moreover, when applied to modern video diffusion models with causal 3D Variational Autoencoders (VAEs), their robustness against temporal disturbance becomes extremely weak. To overcome these challenges, propose SIGMark, Scalable In nn-Generation watermarking framework with blind extraction for video diffusion. To achieve blind-cxtraction. we propose generate watermarked initial noise using Global set of Frame- wise PseudoRandom Coding keys (GF-PRC), reducing the cost of storing large- scale information while preserving noise distribution and diversity for distortion- free watermarking. To enhance robustness, we further design Segment Group- Ordering module (SGO) tailored to causal 3D VAEs, ensuring robust watermark inversion during extraction under temporal disturbance. Comprehensive experi- ments on modern diffusion models show that SIGMark achieves very high bit- accuracy during extraction under both temporal and spatial disturbances with min- imal overhead, demonstrating scalability and robustness. Our code available at http://ggttbbbcccocccee///////tt
INTRODUCTION
In the field of Artificial Intelligence Generated Content (AIGC), diffusion models have rapidly ad- vanced image and video generation (Croitoru al. 2023 Cao et al. 2024 Latent diffusion models proposed by Rombach et al. (2022) generates images by denoising sampled noise in latent space. Extending from this, video diffusion models generate temporally coherent frame sequences by forcing both spatial and temporal consistency (Ho et al. 2022). With the rapid proliferation of Al-generated videos, privacy and security concerns have become increasingly critical (Wang al. 2024]. On the one hand, as widely used creative tool, Al-generated high-quality videos con- stitute valuable intellectual property (IP) and necessitate reliable copyright identification. On the
Xinjje Zhu and Zijing Zhao contributed equally to this work.
1 "Corresponding author: Weifeng Zhang (we fengz eeovo..com.

---

Published as a conference paper at ICLR 2026
Encrge oample
Martaad
Markad
misssape
Whtermakk
Video Diffusion
Video Diffusion
Dusabase
Video Diffusion
Trammss oo1
Marked
Marted
PITY
Video Inversion/
Video Inversion
video
Matcch & decryst
Decrypt
meeraed
Inverssd
Extraccted
mossinge
mesodge
miseago
(a) Post- Post-processing watermark
(b) Non-blind in-generation watermark
(c) Our proposed SIG Mark
Figure 1: (a) protsprocsssing watermarks: embedding watermarks in pixel-space which inevitably degrades video quality. (b) Existing in-generation methods: maintaining all the message-key pairs for matching, incurring high extraction costs and poor robustness. (c) Our proposed SIGMark: blind watermarking framework with global frame-wise PRC keys which is inherently scalable.
other hand, the ease of producing harmful misleading content calls for strict control mechanisms, requiring effective methods to trace their source of generation.
To meet the demands of privacy and security, watermarking technology (Cox et al. 2007) has been widely applied in AIGC (Luo et al. (025). Invisible watermarking embeds information in a way imperceptible to the human eye, thereby preserving visual quality while remaining robust to various distortions and even malicious attacks (Wang et al., (003). For Al-generated videos, a straightfor- ward approach is to treat them like conventional videos and apply invisible watermarking to each frame after generation (Luo et al. [002 Zhang et al., 2024), known as post-processing watermark- ing (see Figure a)). However, such methods inevitably introduce redundant information, thereby degrading overall video quality. Recently, in-generation watermarking has been explored for both image (Yang et al. 2024: Li et al., 2025) and video generation (Hu al.) 2025a b). As illustrated in Figure [b). these methods embed watermark messages during generation process, typically by sampling a watermarked initial noise in which the message is encoded using secret key. During extraction, the watermarked video is inverted (commonly via Denoising Diffusion Implicit Models (DDIM) inversion) back into latent noise, and then decoded with the key to recover the watermark. These approaches have been theoretically proven to be distortion-fre for diffusion models.
Although in- on-generation video watermarking offers the advantage of being distortion free, still faces two critical challenges: (1) High extraction cost scale. When extracting watermark mes- sages from videos subject to temporal disturbances (e.g., frame removal during compression), cur- rent methods rely template matching with the original latent noise. This requires maintaining all message-key pairs during watermark embedding, and computing matching functions across the entire database, as shown in Figure bb). Such approaches are non-blind, with the extraction cost growing linearly with the scale of users or generation requests, severely limiting scalability. (2) Poor temporal robustness. Modern video diffusion models (Yang et al. 2025 Kong al. 2024) employ causal 3D Variational Autoencoders (VAE), which decode group of adjacent frames from one tem- poral dimension latent features. During extraction, video inversion requires the correct grouping of frames to reconstruct the latent feature. Temporal disturbance which disrupts the grouping will produce unrelated latent features, ultimately leading to very low extracted bit accuracy.
To address these issues and ensure usability at large-scale video generation platforms, introduce SIGMark: scalable in- in-generation watermarking with blind extraction for video diffusion models.
To reduce the high extraction cost at scale, propose Global Frame-wise PseudoRandom Coding (GF-PRC) scheme for watermark embedding, thereby enabling a blind watermarking framework. Specifically, global set of frame-wise PRC keys (pseudorandom error-correction code by Christ &
Gunn (2024) is shared across all generation requests, with each key assigned to a group of temporal frames. Watermark messages encoded into random latent noise with these keys, which preserves
2

---

Published as a conference paper at ICLR 2026
diversity and generative performance. During extraction, the global frame-wise PRC directly de- codes the inverted noise without matching with the original messages. Throughout this process, the system only needs to maintain the global frame-wise PRC keys, reducing extraction complexity from linear in the numher of generation requests to constant, and achieving strong scalability.
To enhance temporal robustness, we introduce Segment Stroup-Ordering (SGO) module tailored to causal 3D VAEs modern video diffusion models. Specifically, for a video potentially affected by temporal disturbances, first partition into motion-consistent segments using Farnebäck optical flow; within each segment, a sliding-window grouping detector infers the original causal frame groups. This procedure recovers the correct grouping and, in turn, yields accurate inverted latents for watermark extraction under temporal disturbances.
We conduct comprehensive experiments on modern video diffusion models (Hunyuan Video by Kong et al. (2024) and Wan-2.2 by Wan et al. (2025), )) covering both text-to-video (T2V) and image- to-video (12V) pipelines. subset of VBench - Zhenn et al., 2025) under 18 evaluation dimen- sions is sampled to generate 400 videos for evaluation. Results show that our method achieves very high bit accuracy with high watermark capacity with minimal extraction cost. Our method maintains high accuracy under spatial and temporal disturbances, demonstrating strong robustness. Our code available at https///ithuu..oo//ereeee Shann//ermyyZao 1998//1G9rr/tr release..
In conclusion, the main contributions of this paper
We identify two critical issues in existing in in-generation video watermarks: high extraction cost and poor temporal robustness, which hinder their scalability to large platforms.
We propose SIGMark, scalable in-generation watermarking framework with blind extrac- tion for video diffusion, effectively addressing the limitations of scalability and robustness.
We conduct extensive experiments for SIGMark on modern video diffusion models and comprehensive evaluation benchmarks, demonstrating its effectiveness and robustness.
RELATED WORKS
2.1 DIFFUSION MODELS
In the field of Artificial Intelligence Generated Content (AIGC), diffusion models have rapidly ad- vanced image and video generation. Latent diffusion model (LDM) (Rombach et al. 2022) synthe- sizes content by denoising sampled noise in latent space and decoding through Variational Au- toencoder (VAE). Building on LDM,, works such as SDXI. (Podell et al. 2024). ControlNet (Zhang et al. 2023) and DIT (Peebles & Xie 2023) further improve image generation with stronger photore- alism and higher resolution, fine-grained structural control, and greater scalability. Extending from images, video diffusion models tackle the task of generating temporally coherent frame sequences (Ho et al. 2022). Following the success of Sora [OpenAT] (2024), wave of open-source video dif- fusion models including KLING (Kuaishou Technology (024). Hunyuan Video (Kong al. 2024), and Wan (Wan et al. (2025) has emerged. They adopt causal 3D VAEs that compress videos along spatial and temporal dimensions to form compact latent sequences for diffusion, enabling longer, higher-quality videos with improved temporal consistency. Our research focuses on watermarking for inffussionggneraan videos and evaluates on Hunyuan Video and Wan-2.2.
2.2
VIDEO WATERMARKING
Video invisible watermarking embeds imperceptible, durable signals in video to enable rights man- agement and piracy deterrence (Asikuzzaman & Pickering[2011 Aberna & Agilandeeswari (202)). The straightforward image-based watermarking approaches operate frames individually (Hartung
& Girod 1998b) Hernandez et al., 2000). while video-based works explicitly exploit temporal in- formation via compressed domain (Biswas et al. 2005 Noorkami & Mersereau (0077) and motion vectors produced during compression (Mohaghegh & Fatemi, 2008). Recently, deep learning has been applied to watermarking for images (Zhu et al.) 2018)) and videos (Ben Jabra & Ben Farah, 2024): Zhang et al. (2019) introduced RivaGAN, training encoder-decoder framework for robust watermarking Subsequent work further advances robustness and capacity through curriculum learn- ing (Ke al. 2022), low-order recursive Zemiike-momett embedding (He et al. 2023), multiscale
3

---

Published as a conference paper at ICLR 2026
distribution modeling (Luo et al. 2023 complex wavelet transforms Yasen et al. 2025 Huang jet al., ).25). adversarially optimization under frequency domain Huang et al. (2024a). and spa- tiotemporal attention (Li et al. 2024 Yan et al., (025). However, embedding extra signals inevitably degrades visual quality. We instead pursue in-generation watermarking for diffusion models, which training-free free and provably distortion-free.
2.3 IN-GENERATION WATERMARKING FOR DIFFUSION MODELS
With the rapid progress of image and video diffusion models, watermarking for diffusion-gee -effusion-generatedd content has likewise gained traction. Recent work integrates watermark embedding into the genera- tive process to reduce performance degradation. [ernandez et al. (2023) fine-tune the LDM decoder using a pre-trained watermark extractor, enabling reliable extraction from images produced by the fine-tuned model. Yang et al. (2024) introduce Gaussian Shading, the first approach to sample wa- termarked initial noise for image generation, which is provably distortion-free Subsequent studies further enhance robustness during the embedding and inversion phases (Li et al., 2025 Fang et al., 2025). In-generation watermarking has also been extended from images to videos: Liu et al. (2025) propose two-stage implanting scheme during the diffusion process. Other works encrypt the wa- termark message into the initial latent noise via Gaussian sampling (Hu et al.) 2025a) or dynamic tree-ring (Zeng et al. 2025), preserving video generation quality. [uu et al. (2025b) adopt PRC for watermark encryption and decryption, maintaining generative diversity across messages. Despite being distortion-free free, advanced in- in-generation methods by Hu al. (2025a b) still face high extrac- tion costs at scale and poor temporal robustness. We are the first to identify and address these issues in modern video diffusion models, achieving strong scalability and temporal robustness.
3 METHOD
3.1 PROBLEM FORMULATION
This paper focuses on in- generation watermarking for video diffusion models. We first formalize the problem. Given diffusion model M. our goal is embed watermark message m into generated video frames (F(m) = Embed(M:; m)) without degrading the performance of the diffusion model. The watermarked video frames may undergo temporal disturbances (e.g., frame drops) or spatial disturbances (e.g., cropping), yet the tampered frames VF' should still permit reliable watermark extraction. We adopt the blind-watermark setting: during extraction, neither the original message m the original generated video frames VF is available, and the message is recovered solely from the tampered video frames and the model, i.e., m Extract VF'). We emphasize robustness: even under strong disturbances VF', the recovered message rn remains close m..
During watermark embedding, we follow the in-generation scheme of Yang et al. (022)) Hu et al. (025a). The watermark message is encrypted into the initial latent noise without altering its distribution, i.e., (m)) ~ (0, I). The model then denoises this noise with text prompts to gen- erate videos, thereby preserving generative performance. However, existing methods require the original message m for template matching during extraction, limiting scalability in real-world de- ployments. Moreover, when applied to modern diffusion models with causal 3D VAEs, they exhibit poor robustness under temporal disturbances.
3.2 FRAMEWORK OVERVIEW
An overview of our scalable in-generation watermarking framework. SIGMark, is shown in Fig- ure [ We follow the in-generation watermarking scheme which embeds the watermark message into the initial latent noise to generate distortion-free watermarked video through diffusion (left part of Figure 2), and then process the video through inversion to obtain inverted latent noise for water- mark extraction (right part of Figure 2) To enable blind watermarking and reduce extraction cost at scale, we introduce Global Frame-wiss encryption and decryption. During embedding, the watermark message is encoded into the initial la- tent noise using global set of frame-we wise PRC keys, each key assigned to one temporal dimension of latent features. During extraction, given a possibly tampered video, a Segment Group- Ordering (SGO) module restores the correct causal frame grouping by Farnehäck optical flow segmentation
Seeudo-Random Coding (GF-PRC) scheme for message
4

---

Published as a conference paper at ICLR 2026
GF-PRC keys
8888
Wistermrrkd video
Disturbed
Ro- proggouped video
Video
Watermarked latents
Inverted Iaterits
GF- GF-PRC
Recovered
messogge
Watamarik massaga
GR-PRC Encoding
Video Diffusion
SGO
Video Inverau
TAOEE TEM 10,1
me [OLI] [OLI)
Watermark embedding
Vi'ell VF'ee/4oooo
VT;
Watermark extraction
Overview our proposed SIGMark. Embedding: We encode the watermark message into the initial latent noise using Global set of Frame-wise Rando- Coding (GF-PRC) keys. The diffusion model then denoises this noise into video frames that carry the embedded messages. Extraction: A (possibly disturbed) video is first processed by our proposed Segment Crroup-Odeering (SGO) module recover the correct causal frame grouping, then inverted to obtain the latent noise, from which the message is decoded using the GF-PRC keys. The system stores only the GF-PRC keys for both embedding and extraction, enabling blind watermarking.
Figure 2:
and sliding-window window grouping detector. We then perform inversion recover the watermarked la- tent and decode the message with the GF-PRC keys. GF-PRC enables blind extraction where only the global keys stored in the system, while maintaining high-accuracy message recovery under disturbances. We elaborate the details of our proposed modules in the following sections.
3.3 WATERMARK EMBEDDING
Following the in-generation watermarking scheme Yang et al. 2024 Hu et al. 2025a). we map the watermark message bits into the initial latent noise without affecting the Gaussian distribution of the noise for watermark embedding. To achieve blind watermarking, we propose to utilize a Global set of Frame-wise
coding (GF-PRC) scheme for watermark embedding.
3.3.1 VIDEO GENERATION BY MODERN DIFFUSION MODELS
For modern video diffusion model(Kong al. 2024 Wan al. 2025) M, which consists of text prompt encoder Etext. a denoising diffusion transformer T,, and the encoder ESD and decoder DAD of the causal 3D Variational Autoencoders (VAE), the denoising steps happen latent-space features E R Xcx xcxxhy Xwi where fi, ct, h1, denote the frame, channel, height, and width di- mensions in latent space. The diffusion transformer T denoises randomly initialized latent noise 20 ~ ~N, I) guided by the text prompt: 2, = Denoise (T; zni E (prompt)), where denotes the number denoising steps. The denoised latent feature 2, is then processed by the causal VAE decoder to generate video frames VF E x where f. h, w denote the frame, chan- nel, height, and width the generated video. The whole process can formulated as:
VF Diffusion(MM =. prompt))
DaD Denoise [T;; zo; Erext (prompt))
(2)
The causal 3D VAE introduces information compression along both spatial and temporal dimen- sions, where f fi x de, h = ht x d,, and w wi d,, with de, d, denoting the temporal and spatial compression ratios, respectively. As a result, a group of de frames decoded from one tem- poral dimension of the latent features. Our proposed SIGMark embeds the watermark message into the latent noise via the GF-PRC scheme, yielding a sequence of watermark bits carried by a causal group of video frames, detailed in the next paragraph.
3.3.2 GLOBAL TRAME-WISE PSEUDOR CODING SCHEME
We propose embedding all watermark messages using a global set of frame-wise pseudorandom coding keys, as shown in Figure 3 Specifically, for watermark message m E {0, 1 where fi is the number of latent frames and M is the bit length carried by each causal frame group, we encode into random template bit sequence TP (0, fix x Xwr) using the pseudorandom
5

---

Published as a conference paper at ICLR 2026
Randomly naise
Abs()
Watermarked ked latents
Watermarked video VFünjeR (sesheww
Vida Viffusion
GF-PRC keys
1018
PRC
Watermark message
Sga0
*u(m) e Macyssppu
Carry message m=(0]
Carry message m[1]
Template bits
me FOKM
TPc (0,1
Figure 3: Watermark embedding with GF-PRC scheme. We set fi 2 with compression ratio d; = f/ = as an example. Orange and purple denote message m|0] and m[1] respectively.
error-correction code (simplified pseudorandom code, PRC) proposed by Christ & Gunn (2024)
TP = PRC.Encode Emfcdddddddmmi:::e. K(t), E {0, 1,2, .... 11-11
Here, K denotes the pscudorandom error-correction coding keys; [1] is the key for frame dimen- sion latent space, with m m {0, 1 and TP]] E {0, 1) Xw)) We allocate one PRC key per causal frame group in latent space, enhancing robustness and enabling causal frame grouping and ordering information recovery (detailed in the next section). Given the randomized template TP, map the watermark message into the initial latent noise by element wise modulation:
20(m) = (TP 1) * |zol
(4)
With the random absolute value from Gaussian sampling and the randomized template bits as the modulation signal, the embedded initial noise remains Gaussian, zo(m) ~ (O, 1), and thus does not degrade the diffusion model's ' generative performance. Consequently, the generated video frames are watermarked with m via:
(m Diffusion (M; zu (m(m: prompt)
(5)
Note that in our GF-PRC scheme, the frame-wise PRC keys are global: every generation request shares the same key set, and each latent frame dimension carries one watermark sequence encoded by its corresponding PRC key. The total number of GF-PRC keys can be set to the maximum frame capacity of the video generation system, enabling watermarking for videos arbitrary length. PRC by Christ & Gunn (2024) introduces pseudo-random mapping that encode
the same message into different random template bits, thereby preserving randomness in the initial latent noise under global keys, which traditional stream eiphers (e.g., ChaCha20 Bernstein (e
al., 2008)) used in prior in in-generation non-blind methods(Yann Yang et al. 2024) Hu et al.) (025a) cannot provide with the fixed keying material. The detailed explanation be seen in Appendix A.
3.4 WATERMARK EXTRACTION
As shown in Figure given a test video, we first apply the Segment Group-Ordering module to recover the grouping and ordering information of video frames, enhancing robustness against tem- poral disturbances, then perform diffusion-based inversion to obtain the inverted latent noise, and finally apply PRC decoding to recover the message.
3.4.1 SEGMENT GROUP- ORDDRRG MODULE
watermarked video may encounter various disturbances, among which temporal disturbances are particularly critical for modern diffusion models with causal 3D VAEs. As shown on the left of Figure the original frames (F are generated in causal groups of 4 (frames sharing the same color). After video clipping or frame drops, the disturbed video VF' loses both grouping and order- ing information. If such frames are fed directly into the causal 3D VAE encoder, the mis-grouping (e.g., differently colored frames within group) produces latent features that inconsistent with those of VF VF(m), thereby preventing reliable recovery of the message bits via inversion. To address the issue of weak temporal robustness, propose Segment Group- Ordering (SGO) module as shown in the right part of Figure to recover the grouping and ordering information of the disturbed video for correct encoding.

---

Published as a conference paper at ICLR 2026
Watermar Vijeejegg hocear
Disturbed VF'cc//"<
G mame diop
Sectpp
Optical sagmentation
Disturr
VF "ineesse
Sliding window
Fio grouped viceo Wiyee
Causal
Incorrectly
Encoded Intents fisoneen
Segment Group-Ordering
Without re-ordering
ancoded Lnhends
Figure 4: Segment Group-Ordering (SGO) module. We compression ratio d, = S/J 4 an example. When temporal disturbances (e.g., clipping or frame drops) occur, the causal grouping is disrupted; without re-ordering, this leads to incorrectly encoded latent features. Our SGO module restores the correct grouping and ordering, yielding robust latent features for video inversion.
Optical flow segmentation: We propose a optical-flow method to partition a video into maximally contiguous subsequences with consistent temporal dynamics. For each adjacent pair (VF(4), [F[++ I]), we compute bidirectional Farneüück flow and derive three indicators of temporal consistency: (i) median flow magnitude, (ii) forward-backward consistency, and (iii) candoon-comensatted residual. These are normalized via median absolute deviation and combined with a weighted sum to form discontinuity score. The score is smoothed with a Gaussian filter, and temporal cut points are detected using hysteresis thresholding. The procedure runs near real time and outputs contiguous frame segments. Within each segment, we then perform sliding- winddw grouping detection. Further details of the optical-fie floow segmentation algorithm are provided in Appendix C.
Sliding-window detection: Given contiguous frame segment, we only need to identify the first frame of causal group, and the subsequent frames can then be grouped correctly. To this end, we leverage the global frame-wise PRC keys. Specifically, we pad (de - frames at the beginning of the segment and apply sliding window
the padded sequence. At sliding index j, invert frames Ij j + 2 * de] to obtain two latent frame dimensions 2/[ii and 26.5 + 1]. Using the global PRC keys, the frame index of each latent can be determined by:
[dxiي] argmmax (PW.. (PRC.Detect
K 10 1,.,, fil)), [dx[] {0, f. fi}
(6)
We stop sliding when the detections are consecutive, i.c., Idxjj] + 1 Idxlʃ 1]. indicating that the current grouping yields the correct segment start for inversion. The results from all segments
are then merged to produce the re-grouped frames VF shown in Figure 4 Note that empty slots within each group filled preferentially with available frames; any remaining slots are then padded. If an entire group contains no frames (caused by frame drop), we assign padding based on the nearest available frame. This procedure recovers correct ordering and grouping information and robust to frame insertion, swapping, dropping, and clipping. Further details the blddng-windoww detection algorithm provided in Appendix C.
3.4.2 MESSAGE BITS EXTRACTION
Following the in-generation watermarking paradigm Yang et al., 2024 Hu et al. 2025a). we perform inversion on the re-grouped frames to extract the watermark bits. The latent features z E Xe are first obtained via the causal 3D VAE encoder, and then inverted through the diffusion transformer (the flw-matching Euler discrete inversion for HunyuanVideo( Video et al.
2024) and Wan Wan et al. 2025)):
2/ EVD()F')
2 Lnversion[M;dd p prompte)
where promple denotes an empty prompt, since no original generation information is available. Given the inverted latent noise 2/ xhx decode the GF-PRC keys K by applying

---

Published as a conference paper at ICLR 2026
Table 1: Video watermarking results: message recovery bit accuracy and vidco quality score
Diffusion model
HunyuanVidee T2V
Hunyuan Video 12V
Watermarking
512 bits
512x 16 bits
512 bits
512x 16 bits Bit acct
Method
Calegory
Bit acct
V-scoret
Bit accf
V-scoret
Bit ace
V-scoref
V-scoref
No-mark
0.490
0,490
0,463
0.463
DCT
Post
0.889
0.424
0.862
0.423
0.890
0.452
0.858
0.456
DT-CWT
Post
0.619
0.416
0.650
0,436
0,627
0,458
0.611
0,463
VideoMark
None-blind
0.873
0.507
0.758
0.502
0.846
0,483
0.707
0.482
VideoShield
None-blind
1.000
0.497
0.991
0.506
1.000
0.482
0.999
0.482
(IGMark(OUrs)
Blind
0.958
0.506
0.885
0.499
0.981
0.472
0.905
0.488
PRC to the signs of z/:
Sgu (g((=)l1)
m = Pecode
K[ i {0, 1,2, .... 1
(9)
2
where Sgn(-) ()) the sign function. With the global PRC key set, no additional information needs to be stored during generation, and no template matching (as in Hu et al. (2025a b)) is required during extraction. Therefore, our proposed SIGMark enables blind watermarking with minor computation cost and strong scalability. Details of message extraction cost are provided in Appendix B.
4 EXPERIMENTS
In this section, we conduct experiments on modern video diffusion models. We detail the experi- mental setup in Section 4. report bit accuracy comparisons with existing methods in Section 4.2 assess temporal and spatial robustness in Section 4.3 conduct ablation studies in Section 4.4 and
present evidence of scalability Section 4.5
4.1 EXPERIMENTAL SETTINGS
4.1.1 DATASETS AND METRIC
To comprehensively assess modern video diffusion models, we conduct experiments on subset of prompts from VBBecch2.00Zheng et al.] 22025,, which offers more evaluation dimensions and al. 2024b) used by existing researches on earlier diffusion models (Hu et al. 2025a b). Among the 18 dimensions in VBench-2.0, we select 3 prompts for the "diversity" dimension and generate 20 vidcos per prompt; for the remaining 17 dimensions, select 5 prompts each and generate 4 videos per prompt, yielding total of 400 videos. We report bit accuracy between the embedded message m and the recovered message m. Video quality is evaluated using the VBench-2.0 protocols obtain overall quality score. Detailed examples of the constructed prompt set are provided in Appendix D.
more complex prompts than Beench-1.O(Huang
4.1.2 IMPLEMENTATION DETAILS
We evaluate on two open-source video diffusion models: Hunyuan Video(Kong et al.) 2024) and Wan-2.2 (ann et al. 2025). both employing causal 3D VAFs with temporal and spatial compression For each model, we consider both text-to-video (T2V) and image-to- vivvdooo
ratios de = 4 and de (12V) tasks. For T2V, generate videos at resolution h 512, w 512, with 65 frames per video. The first frame processed independently by the diffusion model, so no watermark is embedded in the first frame. The remaining = 64 frames form fi f /dq 16 causal groups, for each group we maintain one frame-wise PRC key globally. For 12V, we use the same text prompt set to generate
We implement DCT and DT-CWT through the open- source code of video-wwtermark/ respectively, and we implement VideoMark and VideoShield by adapting their officially re- leased code and hyper- paramee new diffusion models and prompts.
and blind-
8

---

Published as a conference paper at ICLR 2026
Table 2: Watermark extraction bit accuracy under disturbances on Hunyuan Video I2V.
Spatial disturbance
Temporal disturbance
Method
w/o
G.noisc
emprs
blur
w/o
drop
insert
clip
VideoMark
0.85
0.6410.21
_.22
0.64 21
0.71
0.52
Lo.20
0.51 10
VideoShield
1.00
p.00
0.99_o.0r
g.00
0,99
4.89
0.84
Jo.36
SIGrs)k(OUrr))
0.98
0.89
0.84_o.14
0.95.o.03
0.91
0.81
0.87
0.85
Table 3: Ablation study on our proposed modules on Hunyuan Video I2V
Watermark embedding
Watermark extraction
Method
Single PRC GF-PRC(Ours)
w/o SGO
w/o OF-seg
w/o SW-det SGO(Ours)
Bit acc
0.707
0.905
0.534
0.762
0.823
0.869
the initial image prompt by FLUX(Black Forest Labs et al. 2025) for evaluation. The generated image prompt examples are shown Appendix D.
4.2 WATERMARK EXTRACTION RESULTS
In this section, we compare our watermarking performance with existing approaches. As presented in Table [ report message bit accuracy ("Bit Acc") and the VBench-2.0 score ("V-score") for Hunyuan Video. Additional results for Wan-2.2 are provided Appendix D. We consider two con- figurations: (1) embedding identical 51 512-bit watermark message in every causal frame group of video, and (2) embedding a distinct 512-bit watermark message per causal frame group, correspond- bits per video, respectively.
ing total capacities of 512 bits and 512x16=8199 192
We compare our method against four baselines: (Hrttug & Girod 1998a), DT-CWT((Coria let al. 2008), VideoShield(Hu et al., (025a)), and Vireo | (025b)) DCT and DTT-CWT are widely used post-procesd post-processing watermarking methods for general videos, whereas VideoShield and VideoMark are recent in-generation methods for video diffusion models but are non-blind. For post-processing methods, we first generate a set of standard videos with the diffusion model and then apply watermarking of different settings. As shown in Table [T post-processing watermarking causes notable quality degradation relative to no-watermark videos, while in in-generation methods leave visual quality essentially unaffected. Our proposed SIGMark can proved be performance- lossless. Detailed proof can be found in Appendix A. Our proposed SIGMark with blind extraction attains very high bit accuracy under both lower and higher capacity settings, surpassing VideoMark by large margins and remaining competitive with VideoShield which requires access to the original watermark information, thereby demonstrating the effectiveness of our approach.
4.3 ROBUSTNESS
We assess the robustness of watermarking methods under both spatial and temporal perturbations in Table 2 We apply spatial disturbance under 512 bits watermark and temporal disturbances under 512x16 bits. "wlo" denotes without disturbance. "G.noise", "emprs" and "blur" denotes Gaus- sian noise, mpeg compression and blurring, respectively. In temporal disturbances, we randomly drop, insert or clip out 30 frames. The performance degradation compared with no disturbances marked as subscript. For spatial disturbances, our approach incurs only marginal performance degradation, particularly when compared to VideoMark. Under the challenging temporal distur- bances, VideoMark and VideoShield suffer substantial degradation on diffusion models with causal 3D VAES, primarily due to incorrect grouping of causal frame groups. Our method mitigates this issue, achieving negligible performance loss and thereby improving temporal robustness. It is worth noting that our method does not attain 100% bit accuracy. We attribute this to the relationship of error-toll troortolleaanc characteristics of PRC coding and the accuracy of diffusion inversion for different models. A detailed analysis of PRC coding robustness is provided in Appendix E.

---

Published as a conference paper at ICLR 2026
Decoding time per video (s)
100
VideoShield (ours)
80
60
13.7
16.4
1.66
15.2
10.5
13.9
14.2
24
3.4
100
200
400
800
1600
3200
Total number of videos on the platform
Figure 5: The decoding time cost during watermark extraction.
4.4 ABLATION STUDIES
We conduct ablation studies evaluate the contribution of each proposed component in Table "OF-seg" and "SW-det" denotes optical flow segmentation and sliding window detection, respec- tively. For the ablation study of watermark embedding modules, we evaluate 512x16-bit water- mark on generated videos without disturbances. For the ablation study of watermark extraction modules, we evaluate a 512x16-bit watermark under temporal disturbance by inserting 30 random frames. When SGO and OF-seg are removed, we simply truncate the video to the target length. When SW-det is removed, we perform PRC detection by assuming that each segment starts the beginning of frame group. For the GF-PRC scheme, removing it reduces our method to the same coding strategy as VideoMark, which exhibits limited bit accuracy under the blind setting without template matching. In contrast, GF-PRC not only enables blind extraction but also improves bit accuracy by introducing inter-frame redundant error tolerance. For the SGO module, both optical- flow-based segmentation and sliding-window and ordering; omitting either component leads to a noticeable accuracy drop.
window detection critical for recovering frame grouping
4.5 EVIDENCE OF SCALABILITY
Baseline methods such as VideoShield and VideoMark are non-blind watermarking schemes: they require storing all vatermark-relateer information (messages, encoding keys, etc.) during generation and matching against all stored information during extraction. Therefore, extraction cost grows with the total number of generated videos. Our method, SIGMark, is blind: maintains only global set of Tramewwise PRC keys and does not require any sample-specific metadata during extraction. As result, it supports large-scale video generation platforms with constant extraction cost. We analyze extraction time cost under scenarios where the total number of videos generated by the platform varies. Experiments are conducted under Hunyuan Video 12V with 512x16-bit watermark without disturbances. For faimess, we inversion on GPU, and all remaining extraction steps includ- ing decryption and message matching on CPU. As shown in Figure 5 the results demonstrate that the time cost of VideoShield scales linearly with the number of generated videos, which becomes impractical as the platform scales to millions of videos. In contrast, SIGMark remains constant, demonstrating strong scalability.
5 CONCLUSION
Watermarking for video diffusion models is critical for ensuring safety and privacy control in AIGC. In this work, we introduce SIGMark, the first blind in-generation video watermarking method for modern diffusion models, offering strong scalability and practical applicability. To enable blind extraction without storing large-scale watermarking references, we propose Global Frame-wise Pseudo-Random Code (GF-PRC) scheme, which encodes watermark messages into the initial latent noise without compromising video quality or diversity. To further enhance temporal robustness, we design Segment Group-Ordering Ordering (SGO) module tailored for causal 3D VAEs, ensuring correct wa- termark inversion. Extensive experiments demonstrate that our approach achieves high bit accuracy with minimal overhead, validating its scalability and robustness.
10

---

Published as a conference paper at ICLR 2026
REFERENCES
P Aberna and Loganathan Agilandeeswari. Digital image and video watermarking: methodologies, attacks, applications, and future directions. Multimedia Tools and Applications, 83(2):5531-559) 2024.
Md Asikuzzaman and Mark Pickering. An overview of digital video watermarking. IEEE Trans- actions on Circuits and Systems for Video Technology, 28(9):11112215: 2017.
Saoussen Ben Jabra and Mohamed Ben Farah. Deep learning- based watermarking techniques chal- lenges: a review of current and future trends. Circuits, Systems, and Signal Processing, 43(7): 4339 4368, 2024.
Daniel Bemnstcin et al. Chacha, a variant of salsa20. In Workshop record of SASC, volume 8, pp. 3-5. Lausanne, Switzerland, 2008.
Satyendra Biswas, Sunil Das, and Emil M Petriu. An adaptive compressed mpeg-2 video wa- termarking scheme. IEEE transactions Instrumentation and Measurement, 54(5):18331188 2005.
Black Forest Labs et al. Flux. kontext: Flow matching for in-context image generation and editing in latent space, 2025. arXiv preprint Ttt.:2506.157443
Hanqun Cao, Cheng Tan, Zhangyang Gao, Yilun Xu, Guangyong Chen, Pheng-Ann Heng, and Stan 7. Li. survey generative diffusion models. IEEE transactions knowledge and data engineering, 36(7):2814-2830 2024.
Miranda Christ and Sam Gunn. Pseudorandom entor-correcting codes. In Annual International Cryptology Conference, pp. 325-347 Springer, 2024.
Lino E. Coria, Mark R. Pickering, and Panos Nasiopoulos. A video watermarking scheme based on the dual-tree complex wavelet transform. IEFE Transactions on Information Forensics and Security, 3(3):466 474,, 2008. doi: 10.1 1009TTIS..000.92774.
Ingemar J. Cox, Matthew Miller, Jeffrey A. Bloom, Jessica Fridrich, and Ton Kalker. Digital Watermarking and Steganography. Morgan Kaufmann, 2007.
Florinel-Alin Croitoru, Vlad Hondru, Radu Tudor lonescu, and Mubarak Shah. Diffusion models in vision: A survey. IEEE Iransactions on paltern analysis and machine intelligence, 45(9): 10850-10869, 2023.
Han Fang. Kejiang Chen, Zijin Yang. Bosen Cui, Weiming Zhang, and Ee-Chien Chang. Cosda: Enhancing the robustness of inversion-based generative image watermarking framework. In Pro- ceedings of the AAAI Conference on Artificial Intelligence volume 39, pp. 2888-2899 2025.
Pierre Fernandez, Guillaume Couairon, Hervé Jégou, Matthijs Douze, and Teddy Furon. The sta- ble signature: Rooting watermarks in latent diffusion models. In Proceedings of the IEEE/CVF International Conference Computer Vision, pp. 22466-22477, 2023.
Frank Hartung and Bernd Girod. Watermarking uncompressed and compressed video. Signal Processing, 66(3):283-301, 1998a. doi: 10. 10116//05116 65- 1684(98)0001 1-5.
Frank Hartung and Bernd Girod. Watermarking of uncompressed and compressed video. Signal processing. 66(3):283-30) 1998b.
Mingze He, Hongxia Wang. Fei Zhang, Sani M. Abdullahi, and Ling Yang. Robust blind video watermarking against geometric deformations and online video sharing platform process- ing. IEEF Transactions on Dependable and Secure Computing, 20(6)4402-44188 2023. doi:
10.1199/DSC.2222.3333388
Juan R Hernandez, Martin Amado, and Fernando Perez-Gonzalez Det-domain watermarking tech- niques for still images: Detector performance analysis and a new structure. IEEE transactions on image processing, (1):55--68, 2000.

---

Published as a conference paper at ICLR 2026
Jonathan Ho, Tim Salimans, Alexey Gritsenko, William Chan, Mohammad Norouzi, and David J Fleet. Video diffusion models. Advances in neural information processing systems, 35:8633- 8646, 2022.
Runyi Hu, Jie Zhang, Yiming Li, Jiwei Li, Qing Guo, Han Qiu, and Tianwei Zhang. Videoshield: Regulating diffusion-based video generation models via watermarking. In Proceedings of the Thirteenth International Conference on Learning Representations, 2025a. URL https:// openreview net/ http://www.ee//ouumiidi--ee.a http:///mmmdd2222//222222
Xuming Hu, Hanqian Li, Jungang Li, and Aiwei Liu. Videomark: A distortion-free robust water- marking framework for video diffusion models, 2025b.
Huayang Huang, Yu Wu, and Qian Wang. Robin: Robust and invisible watermarks for diffusion models with adversarial optimization. Advances in Neural Information Processing Systems, 37: 3937-3963, 2024a.
I--Chun Huang, Ji- Yan Wu, and Wei Tsang Ooi. Rbmark: Robust and blind video watermark in dt ewt domain. Journal of Visual Communication and Image Representation, 109:104438, 2025. ISSN 1047-3203. doi:
URL https:
// /ww. www.ssiieneedrrett.cccmm com htt.a//cce.....aaaaaaaaaaaaaaaaa
Ziqi Huang, Yinan He, Jiashuo Yu, Fan Zhang, Chenyang Si, Yuming Jiang, Yuanhan Zhang, Tianx- ing Wu, Qingyang Jin, Nattapol Chanpaisit, Yaohui Wang, Xinyuan Chen, Limin Wang, Dahua Lin, Yu Qiao, and Ziwei Liu. VBench: Comprehensive benchmark suite for video generative models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recogni- tion, 2024b.
Zehui Ke, Hailiang Huang, Yingwei Liang, Yi Ding, Xin Cheng, and Qingyao Wu. Robust video watermarking based on deep neural network and curriculum learning. 2022 IEEE International Conference on e-Business Engineering (ICEBE), pp. 80-85, 2022. doi: 10.1 10.1109/4EE5557700
2022.00023.
Weijie Kong, Qi Tian, Zijian Zhang, Rox Min, Zuozhuo Dai, Jin Zhou, Jiangfeng Xiong, Xin Li, Bo Wu, Jianwei Zhang, et al. Hunyuanvideo: A systematic framework for large video generative models, 2024.
Kuaishou Technology. Kuaishou unveils proprietary video generation model 'kling', 2024. URL https://iz kuai shou. www.co/ocooooooo www///ooe////ooccoccoooocooeeeee 9646/pd Press release.
Jian Li, Tao Zuo. Bin Ma, Chunpeng Wang, Peng Zhang. Huanhuan Zhao, and Zhengzhong Zhao. Robust video watermarking network based on channel spatial attention. In 2024 International Joint Conference on Neural Networks (ICNN), pp. 1-8, 2024. doi: 10. 199///CNN008999900000 10650701
Kecen Li, Zhicong Huang, Xinwen Hou, and Cheng Hong. Gaussmarker: Robust dual-domain wa- termark for diffusion models. In The Forty-Second International Conference on Machine Learn- ing, 2025. URL http:ppppp//ppeeeeeeeeeeeeeeeeee wtwp:/wwwwwweeeeenummemmaaoa
net. forum? 7=x11=
Xiaohang Liu, Heng Chang, Jinfu Wei, Lei Zhu, Li Liu, Likun Li, Shiji Zhou, Chengyuan Li, Di Xu, and Wei Gao. Implanting robust watermarks in latent diffusion models for video generation. In ICASSP 2025 2025 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 1-5, 2025. doi: 10.1 109/CASSP44960000000 2025. 900A4999999600002200888899999999
Huixin Luo, Li Li, and Juncheng Li. Digital watermarking technology for ai-generated images: A survey. Mathematics, 13(4):651, 2025. doi: 10.3390/math133440633
Xiyang Luo, Yinxiao Li, Huiwen Chang, Ce Liu, Peyman Milanfar, and Feng Yang. Dvmark: A deep multiscale framework for video watermarking. 4371 4385, 2023. doi: 10.1
IEEE Transactions on Image Processing, 32:
Najla Mohaghegh and Omid Fatemi. H. 264 copyright protection with motion vector watermarking. In 2008 International Conference on Audio, Language and Image Processing, pp. 1389-1389. IEFE, 2008
12

---

Published as a conference paper at ICLR 2026
Maneli Noorkami and Russell M Mersereau. A framework for robust watermarking of h. 264- encoded video with controllable detection performance. IEEE Transactions on information foren- sics and security, 2(1):14-23, 2007.
OpenAl. Video generation models as world simulators, 2024. URL betee//vide--geeette ion-mddelssmmmeeeeemm as world- simulators/ Official model an- nouncement and technical overview.
William Peebles and Saining Xie. Scalable diffusion models with transformers. In Proceedings of the IEEE/CVF international conference on computer vision, pp.
2023.
Dustin Podell, Zion English, Kyle Lacey, Andreas Blattmann, Tim Dockhorn, Jonas Müller, Joe
Penna, and Robin Rombach. Sdxl: Improving latent diffusion models for high-resolution image synthesis. In Proceedings of the International Conference on Learning Representaations (ICLR). http://ewreeeeeeeeeeoeoorrreeeee
OpenReview.net, 2024. URL Spotlight.
Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bjöm Ommer. High- resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF Con- ference on Computer Vision and Pattern Recognition, pp. 10684-10695, 2022.
Team Wan, Ang Wang, Baole Ai, Bin Wen, Chaojie Mao, Chen-Wei Xie, Di Chen, Feiwu Yu, Haiming Zhao, Jianxiao Yang, et al. Wan: Open and advanced large-scale video generative models, 2025.
Tao Wang, Yushu Zhang, Shuren Qi, Ruoyu Zhao, Zhihua Xia, and Jian Weng. Security and privacy generative data in aige: A survey. ACM Computing Surveys, 57(4), 2024. doi: 10.1 3703626.
Zihan Wang, Olivia Byrnes, Hu Wang, Ruoxi Sun, Congbo Ma. Huaming Chen, Qi Wu, and Minhui Xue. Data hiding with deep learning: A survey unifying digital watermarking and steganography. IEEE Transactions on Computational Social Systems, 10(6):2985-4) 2999, 2023. doi: 10.1 109/ TCSS.2023.32689500
Quan Yan, Yuanjing Luo, Zhangdong Wang. Junhua Xi, Geming Xia, and Zhiping Cai. Spatiotem- poral attention- based real-time video watermarking. Data Mining and Knowledge Discovery, 39 (5):62, 2025.
Zhuoyi Yang, Jiayan Teng, Wendi Zheng, Ming Ding, Shiyu Huang, Jiazheng Xu, Yuanming Yang. Wenyi Hong, Xiaohan Zhang, Guanyu Feng, Da Yin, Yuxuan Zhang, Weihan Wang, Yean Cheng, Bin Xu, Xiaotao Gu, Yuxiao Dong, and Jie Tang. Cogvideox: Text-to-video diffusion models with an expert transformer. In Proceedings of the Thirteenth International Conference on Learning Representations, 2025. URLhttpp. /t.//vivii.. www.xii..rgg/ee.. /absg//b///// /2408 06072
Zijin Yang, Kai Zeng, Kejiang Chen, Han Fang, Weiming Zhang, and Nenghai Yu. Gaussian shad- ing: Provable performance-lossless image watermarking for diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 12162- 12171, June 2024.
Kamil Yasen, Guiquan Wan, Li Zhan, Ke Qin, and Ye Li. Dt ewt-based video watermarking robust to recompression attack. In Guangqiang Yin, Xiaodong Liu, Jian Su, and Yangzhao Yang (eds.), Proceedings of the 14th International Conference on Computer Engineering and Networks, pp. 177-188, Singapore, 2025. Springer Nature Singapore. ISBN 978-981-96-4229
Shunyang Zeng, Linlin Yang. Jin Yang, Yezhen Wang, and Tianyu Gao. Dtr: Dynamic tree-ring watermarking framework for diffusion-based video generation. In ICASSP 2025 2025 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 1-5, 2025. doi: 10.1 00.10999CASSP44960222....000
Kevin Alex Zhang, Lei Xu, Alfredo Cuesta- Infante, and Kalyan Veeramachameni. Robust invisible video watermarking with attention. arXiv preprint 1909v01900.000 2019.
13

---

Published as a conference paper at ICLR 2026
Lvmin Zhang, Anyi Rao, and Maneesh Agrawala. Adding conditional control text-to-image diffusion models. In Proceedings of the IEEE/CVF international conference on computer vision, pp. 3836-3847, 2023.
Zhiwei Zhang, Han Wang, Guisong Wang, and Xinxiao Wu. Hide and track: Towards blind video watermarking network in frequency domain. Neurocomputing, 579:Article 127435, 2024, doi: 2.00000f..eucmmm2222...7.55.
Dian Zheng, Ziqi Huang, Hongbo Liu, Kai Zou, Yinan He, Fan Zhang, Lulu Gu, Yuanhan Zhang, Jingwen He, Wei-Shi Zheng, Yu Qiao, and Ziwei Liu. Vbench-2.0: Advancing video generation benchmark suite for intrinsic faithfulness, 2025.
Jiren Zhu, Russell Kaplan, Justin Johnson, and Li Fei-Fei, Hidden: Hiding data with deep networks. In Proceedings of the European conference computer vision (ECCV), pp. 657-672, 2018.
14


Reviews:
[{"review_id": "4qSthcAVI3", "reviewer": "Reviewer_1pSm", "summary": "This paper proposes SIGMark, a training-free, in-generation watermarking framework for video diffusion models. It addresses two issues of prior approaches: (i) non-blind extraction that scales not well because it requires storing message, and (ii) lacking temporal robustness when modern causal 3D VAEs are disturbed by frame edits. Experiments on HunyuanVideo and Wan-2.2 across T2V and I2V pipelines with a 400-video subset of VBench-2.0 show high accuracy with limited quality impact. Under both spatial and temporal perturbations, SIGMark achieves competitive with non-blind baselines, and outperforms prior non-blind in-generation methods.", "questions": "- What is the false-positive rate when decoding regenerations (video-to-video) from different diffusion models?\n- The paper claims O(1) extraction complexity and “near–real-time” segmentation. The appendix provides only a cursory analysis. Could you add end-to-end timings with per-component breakdowns, scaling with (d_t) and payload size, and comparisons to baselines?", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "- The paper is well-organized and clearly writtern. \n- The inituion of the paper is soundness. \n- Experimental results show the effectivness of the proposed method.", "weaknesses": "- Missing references: \n[1] Huang, Huayang et al. “ROBIN: Robust and Invisible Watermarks for Diffusion Models with Adversarial Optimization.” ArXiv abs/2411.03862 (2024): n. pag.\n\nPlease also refer to the \"Questions\" section.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "LEZ74iR0il", "reviewer": "Reviewer_PfP7", "summary": "Video generation with diffusion models is advancing rapidly, and invisible watermarking is essential for provenance and IP protection. Existing in-generation schemes typically require storing message–key (or key–template) pairs and performing template-based matching at inference, which can become costly at scale and tend to be fragile under temporal disturbances. The paper proposes SIGMark, aiming for blind extraction via Global Frame-wise Pseudorandom-Coding keys (GF-PRC) and improved robustness via a Segment Group-Ordering (SGO) module tailored to causal 3D-VAEs, enabling reliable inversion under temporal perturbations.", "questions": "1.\tSGO procedure clarity. In Figure 4, for z_1 there appear to be two candidates: [4, pad, pad, pad] or [pad, pad, 6, 7]. Which one is used for decoding? Or should it be [4, pad, 6, 7]? Please separately explain the frame-drop and clip cases so readers can better understand the SGO workflow.\n\n2.\tMeaning of “w/o” in Table 2. Does “w/o” denote a clean setting with no time disturbance? Please state this explicitly in the caption.", "limitations": "", "rating": 4, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "1.\tThe paper identifies a practical limitation of many video in-generation watermarking systems: they are not truly blind yet require storing large message–key/template tables, which raises efficiency and storage concerns at scale.\n\n2.\tThe proposed design addresses both the blindness/scalability issue (via GF-PRC) and the temporal robustness issue (via SGO).\n\n3.\tThe paper is generally well organized with clear figures, which makes it easy to follow.", "weaknesses": "1.\tLimited novelty (GF-PRC). The GF-PRC component mainly builds on the original PRC method. Moreover, introducing PRC (Appendix E) negatively affects robustness. How to balance the impact of PRC, or improve PRC specifically for watermarking robustness requirements remains an open problem.\n\n2.\tScalability evidence. The paper claims that non-blind approaches incur prohibitive computational costs at scale and raise efficiency/storage issues, but this discussion remains at the level of Appendix B (Computation Overhead). The authors should provide experiments to demonstrate that this is a serious practical problem and to show the operational performance of the proposed method.\n\n3.\tRobustness gap. Although the method claims robustness to temporal disturbance, its performance under frame drop is far below VideoShield, and it is overall worse than VideoShield under spatial disturbances. The paper attributes this to PRC, suggesting that the framework’s robustness is still not fully resolved.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "Pbem63MmMw", "reviewer": "Reviewer_TYUV", "summary": "This paper proposes SIGMark, a watermarking method for diffusion video generation. The key contribution is its \"blind\" feature that doesn't require storing the original watermark message for template matching during extraction. This is in contrast to existing methods such as VideoShield. To achieve this target, the authors build their solution based on the recently proposed PRC (pseudorandom code). Basically, PRC couples the message with some 'testbits' (part of the key) during encoding, and then compare testbits during decoding to verify whether decoded message is correct or not. The authors also propose a SGO module (optical flow segmentation + sliding window detection) to handle the attacks specific to video, e.g., frame adding, dropping, etc.", "questions": "+ In Section 3.4, you should compare your method (optical flow + sliding window) to previous solutions (VideoShield, VideoMark) in a methodological way, in order to better understand your technical contribution. E.g., do they use any method to partition video to continuous subsequences? How? How do they detect the starting of a group (or do they need to detect this)? What's the main advantage of your solution?\n\n+ Line 345: symbol \\hat is at wrong place.\n\n+ In Table 2, we need more details on the setting of drop, insert, and clip. What's the drop ratio? What are inserted frames and insertion ratio?\n\n+ Running time overhead breakdown should be provided for the various steps in their system, e.g., diffusion, PRC encode/decode, optical flow segmentation, sliding window detection, etc.", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "+ I like the \"blind\" feature they add to diffusion-based video watermarking domain. It simplifies the watermarking deployment pipeline. PRC is a cryptographically strong primitive that enables encoding/decoding different messages with a single global key, in contrast to traditional encryption methods used in other watermarking methods that require storing different keying material for different messages.\n\n+ The proposed SGO module is effective in handling various frame-level attacks in videos.\n\n+ The experimental results are good. Although the robustness is not consistently better than existing methods, they have the unique advantage of being blind.", "weaknesses": "- The technical contribution for watermark extraction should be articulated with more methodological comparison. (See my suggestion below)\n\n- Experimental settings are not very clear.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)