Safe-Sora: Safe Text-to-Video Generation via Graphical Watermarking
Authors: Zihan Su
Xuerui Qiu
Hongbin Xu
Tangyu Jiang
Jun-hao Zhuang
Chun Yuan
Ming Li
Shengfeng He
Fei Yu
Venue: NeurIPS 2025 poster ()
Keywords: AI Safety
Copyright-Preservation
Primary area: social_and_economic_aspects_of_machine_learning
TL;DR: We propose Safe-Sora, the first framework that integrates graphical watermarks directly into the video generation process.

Abstract: The explosive growth of generative video models has amplified the demand for
reliable copyright preservation of AI-generated content. Despite its popularity in
image synthesis, invisible generative watermarking remains largely underexplored
in video generation. To address this gap, we propose Safe-Sora, the first framework
to embed graphical watermarks directly into the video generation process. Motivated by the observation that watermarking performance is closely tied to the visual
similarity between the watermark and cover content, we introduce a hierarchical
coarse-to-fine adaptive matching mechanism. Specifically, the watermark image is
divided into patches, each assigned to the most visually similar video frame, and
further localized to the optimal spatial region for seamless embedding. To enable
spatiotemporal fusion of watermark patches across video frames, we develop a 3D
wavelet transform-enhanced Mamba architecture with a novel scanning strategy,
effectively modeling long-range dependencies during watermark embedding and
retrieval. To the best of our knowledge, this is the first attempt to apply state space
models to watermarking, opening new avenues for efficient and robust watermark
protection. Extensive experiments demonstrate that Safe-Sora achieves state-of-the-
art performance in terms of video quality, watermark fidelity, and robustness, which
is largely attributed to our proposals. Code and additional supporting materials are
provided in the supplementary.

Safe-Sora: Safe Text-to-Video Generation via Graphical Watermarking
Zihan Su'
Xuerui Qiu Hongbin Xu Tangyu Jiang' Junhao Zhuang
Chun Yuan 1x Ming Li Shengfeng He Fei Richard Yu²
Tsinghua Shenzhen International Graduate School, Tsinghua University
Institute of Automation, Chinese Academy of Sciences Zhongguancun Academy Bytedance Guangdong Laboratory of Artificial Intelligence and Digital Economy (SZ)
Singapore Management University
zh- 2hhssu24mmall ls. tsinghua. edu. cn
Abstract
The explosive growth of generative video models has amplified the demand for reliable copyright preservation of Al-generated content. Despite its popularity in image synthesis, invisible generative watermarking remains largely underexplored in video generation. To address this gap, propose Safe-Sora, the first framework to emhed graphical watermarks directly into the video generation process. Moti- vated by the observation that watermarking performance closely tied to the visual similarity between the watermark and cover content, we introduce a hierarchical coarse-to-fine adaptive matching mechanism. Specifically, the watermark image is divided into patches, each assigned to the most visually similar video frame, and further localized the optimal spatial region for seamless embedding. To enable spatiotemporal fusion of watermark patches across video frames, we develop 3D wavelet transform-enhan enhanced Mamba architecture with novel spatiotemporal local scanning strategy, effectively modeling long-range dependencies during watermark embedding and retrieval. To the best of our knowledge, this is the first attempt apply state space models to watermarking, opening new avenues for efficient and robust watermark protection. Extensive experiments demonstrate that Safe-Sora achieves state-of-the-arr performance in terms of video quality, watermark fidelity, and robustness, which is largely attributed to our proposals. Code is publicly available https:// htt//ggitti //ggttttbbb..///// com/ Stgewud/Safe--a
Introduction
Recent advances in video generation models have significantly transformed digital content creation [1- 6]. VideoCrafter2 [2] delivers high-fidelity video generation results, while Open-Sora [7] enables eflicient and scalable video generation. However, this rapid progress also raises growing concerns over copyright protection and ownership verification of generated videos.
Invisible watermarking has proven effective for copyright protection in image generation [8-15]. However, its extension to video generation remains relatively underexplored. Recent efforts such VideoShield [16] and LVMark [17] embed watermarks by modifying latent noise applying importance-based modulation strategies. Despite these advancements, existing approaches rely on embedding bitstring- biaseinng-based based identifiers, which fall short of leveraging the high information capacity inherent in video content. Unlike static images, videos offer significantly greater embedding band- width, making them well-suited for graphical watermarks-e. e.g.. logos icons that serve more
"Corresponding authors.
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

Cover
Image
Extracted Watermark
30
Watommrkedd
Extrected Quality
PSNR
Watermarknn
22
20-
0.0
0.2
0.4
0.6
LPIPS 0.556
PSNR 33.12
PSNR 31.16
Image Watermark Similarity
Figure I: Impact of image-watermark, similarity on watermarking performance. We used a pretrained classic image hiding network Balujanet [18] on 1.000 image pairs, each consisting of graphical watermark from Logo-2k [19] and a cover image from ImageNet [20]. Image- Sagge-Watrrmarkk similarity was quantified using 1-LPIPS and the quality of the watermarked image and extracted watermark was evaluated using PSNR. Higher PSNR and lower LPIPS indicate improved performance.
intuitive and visually recognizable evidence of ownership. Such designs enhance both the perceptual
clarity and practical reliability of copyright verification.
Recognizing the untapped potential of graphical watermarking in video generation, propose Safe-Sora, the first framework, to the best of our knowledge, that embeds graphical watermarks elegantly into the video generation process. As illustrated in Fig. 1, we observe that watermarking performance significantly correlates with the visual similarity between the watermark and cover images. particular, embedding becomes significantly more effective when the cover image shares high visual similarity with the watermark content. Motivated by this, we propose a hierarchical coarse-to to-einn fine adaptive matching mechanism, which first divides the watermark image into patches and assigns each patch to the most similar video frame through an inter-frame automatic selection strategy. Subsequently, an intra-frame localization is performed embed the patch into the most visually similar region within the selected frame. To address the challenge of fusing and extracting watermark information distributed across spatiotemporal locations, we further propose 3D wavelet transform-enhancee Mamba architecture with tailored scanning strategy. This design enables bidirectional modeling across frequency subbands in the 3D wavelet transform, effectively and efficiently capturing long-range dependencies in both space and time. To the best of our knowledge, this is the first application of state space models to generative watermarking.
In our experiments, we utilize the widely-used Handa-70N- [21] dataset as the video source due to its extensive scale and diverse video categories. For graphical watermarks, we employ the Logo-2K+ [19] dataset, which offers a wide variety of real-world logos. The quantitative and qualitative comparisons with existing methods demonstrate that the proposed Safe-Sora achieves state-of-the-e performance in terms of video quality, watermark fidelity, and robustness. For instance, our method achieves Fréchet Video Distance of 3.77, far lower than the second- bbst baseline's 154.35, highlighting its superior temporal consistency. Our primary contributions can be summarized as follows:
We introduce the first model specifically designed to embed graphical watermarks in video generation pipelines, directly addressing the pressing need for copyright protection of generated video content.
We propose a hierarchical coarse-to-fing adaptive matching mechanism that strategically embeds watermark patches into visually similar frames and spatial regions, enhancing overall watermarking performance.
We pioneer the application of state space models for watermarking through a novel 3D wavelet transform-enhancel Mamba architecture with a tailored scanning strategy, enabling enhanced fusion and extraction of watermark information across space and time.
Related Work
2.1 Video Diffusion Models
Recently, Al-generated content has been vibrant the community [22-33]. Diffusion models [34-39] class of generative models that synthesize data through gradual denoising process, beginning

---

from randomly sampled Gaussian noise. Latent Video Diffusion Models (LVDMss) [40] perform the diffusion process in the latent space to improve computational efficiency. VideoCrafter2 [2] builds high-quality video generation models by leveraging low-quality video data combined with synthesized high-quality images. Open-Sora [7] introduces the Sempoal-Temporal Diffusion Transformer, an efficient video diffusion framework that separates spatial and temporal attention mechanisms. While LVDMs have shown strong performance in video generation, the integration of graphical watermarks into this framework has not been explored.
2.2 Generative Video Watermarking
Digital watermarking has emerged an essential technique for copyright protection, content authen- tication, and ownership verification across various media types. However, watermarking for video diffusion models represents relatively unexplored area. VideoShield [16] pioneered this space by modifying latent noise during the diffusion process to embed binary watermark information. More recently LVMark [17] introduced an importance-bant visual quality degradation. Nevertheless, these existing approaches primarily focus on embedding low-capacity binary strings, without taking advantage of the segh-capcctyy nature of video media, which is well-suited for embedding richer information such as graphical watermarks.
weight modulation strategy minimize
2.3 State Space Models
State Space Models (SSMs) [41, 42] have emerged as efficient alternatives to transformers [43] for sequence modeling. The Mamba architecture [44] represents a significant advancement in SSMs by introducing selective state space modeling with data-dependent parameters, enabling dynamic resource allocation to important sequence elements while maintaining computational efficiency. Despite Mamba's 's remarkable success in language processing tasks [45, 46] and its growing adoption in computer vision applications [47, 48], its potential for watermarking techniques has remained entirely unexplored until now.
3 Graphical Watermarking for Video Generation
In this section, we present the pipeline of our Safe-Sora framework, which introduces novel approach to embedding graphical watermarks directly within the video generation process (Fig. 2). We first partition the watermark image into patches and optimally assign them to appropriate video frames and regions (Section 3. These patches are then embedded and upsampled to generate the watermark feature map. To embed the watermark, this feature map fused with multi-scale video features using UNet built with 2D SFMamba blocks (Section 3.2), followed by series of 3D SFMamba blocks that leverage our spatiotemporal local scamning strategy (Section 3.3), producing watermarked video. To extract the watermark, the watermarked video is processed through an extraction network built with a degradation layer, a series of 3D SFMamba blocks, and position recovery. The training objectives outlined in Section 3.4, while the preliminaries on latent video diffusion models, state space models, and wavelet transforms are detailed in Appendix A.
3.1 Coarse-to-Fine Adaptive Patch Matching
Motivated by the observation that greater similarity between the watermark and cover content enhances watermarking performance (as shown in Fig. 1), we propose a coarse-to-fin adaptive patch matching mechanism to systematically identify the most semantically similar spatial-temporal regions in a video for watermark embedding, as illustrated in the bottom-left corner of Fig.
First, to enable accurate localization of each patch during the final watermark recovery, we propose simple yet effective method: the position channel. Specifically, represent patch positions using binary encoding (e.g., using 8 bits to represent 256 patch positions). This binary code is then replicated form an additional channel, introducing redundancy that enhances robustness against spatial distortions and degradation. Finally, this position channel is concatenated with the patch content, embedding positional information directly into the input and eliminating the need for additional positional processing during subsequent training.
Then, we adopt two-stage process to adaptively determine the most suitable embedding location for each patch. The first stage operates at the frame level. We extract features from both patches and
3

---

Vidro Recossiructin Less
Frecie
Ensoder
Tatintt Decoddrr
Multi-Scale
Loss floo
Lunr
Feature Injection
Multi-Scale Feature
F
Pust-l Dec Cuase
Video Latent
20 20390% Muatee
Spiaatto
20 W0htet
23 Spnitrr
Original Video
Dove
Door
Dore
Pash Cain
Mapeive Patch
CoersotonFFi
Watermarieed
Extracted
Marrhing
Vidco
Watermark
Watermark
Watermark Recenstrattion Laws
Coursesto Adastive Marching
SFMambe
Frequency Mania
Tonward Scarning
Rarsouss Scarning
1igh Iripancc
2007
Moets
Cone Reats
0827
Wetemakk
1.
1200
Caran
Tranaionss
Parc Puttion Pusiion Chanel
Sparionesporal Local Scanning Stranggy
Figure 2: Overview of our Safe-Sora framework. Our method consists of three main components: (I) Coarse-to- Fine Adaptive Patch Matching: partitioning the watermark image into patches and optimally assigning them to appropriate video frames and regions, followed by patch embedding and upsampling to generate the watermark feature map; (2) Watermark Embedding: the watermark feature map fused with multi-scale video features via a UNet with 2D SFMamba blocks, followed by series of 3D SFMamba blocks that implement our spatiotemporal local scanning strategy, to produce the watermarked video; (3) Watermark Extraction: recovering the embedded watermark using an extraction network built with distortion layer, a series of 3D SF blocks, and position recovery. The difference between different types of Mamba blocks lies their scanning strategies.
the latent representations of video frames using a convolution layer followed by ReLU and global average pooling (GAP). Similarity between each patch i and frame is computed via dot product of these feature vectors, and normalized using Softmax:
(1) Here, Wi.j denotes the similarity score between patch p. and the latent representation 2, of frame j. Each patch is then assigned to the frame with the highest similarity score. To ensure balanced distribution, impose maximum capacity for each frame. If the top-ranked frame is full, the patch redirected to the next highest available candidate. Having selected frame, we proceed to the fine stage, which determines the optimal spatial position within that frame. Each frame is subdivided into spatial regions according to its patch capacity. Feature representations of these regions are computed similarly, and the similarity between patch and region & in the assigned frame j is given by:
Wiy = Softmax (GAP(ReT.UCoovvpp)
GAP(ReI.U(Conv(z.)
S,A Softmax (GAP(Rel.(Conv(p))
GAP (CC.eELL((Cnr(r))))))
(2)
where S;,k is the similarity score between the i-th patch and the k-th region rj.k in the latent representation of frame j. Note that we take full advantage of the inherent feature properties of latent variables in video generation models. Since latent variables can already be viewed as feature extractions of the original frames, we use only single convolutional layer for feature extraction, which significantly reduces the computational overhead.
3.2 Spatial-Frequency Mamba for Spatial Fusion
Mamba [44] has demonstrated strong capabilities in modeling long-range dependencies with high efficiency, making it well-suited for spatiotemporal modeling in video tasks. Meanwhile, frequency domain information has been applied in various domains [49-51]. In watermark embedding, it has proven effective in capturing structural patterns and resisting distortions [50, 51]. To incorporate both advantages, we propose the Frequaly Mamba (SFMamba) block, as shown in Fig. 2.
SFMamba adopts a dual-stream design with separate spatial and frequency branches. It comes two variants: 2D version and 3D version, differing primarily in the wavelet transform and scanning

---

Sponil Dirrenior
Low Frequency
High Frequency
LEC
LLH
Soanning
3D Wavelet Transfom
Bockward Scanning
Figure 3: For 3D frequency scanning, we propose spatiotemporal local scanning strategy for 3D wavelet transform, which processes the frequency components hierarchically from low frequency to high frequency and high frequency to low frequency.
strategy. The 3D SFMamba will be introduced Section 3.3. We next introduce the 2D SFMamba block for efficient spatial fusion of watermark and video content. It consists of separate 2D spatial and 2D frequency branches.
2D Spatial Branch.
The spatial processing begins with a LayerNorm operation on the input feature map iin- yielding normalized features Fx. In the first path, FN undergoes a simple SiLU activation function. In the second path, FN passes through a 1 xx1 convolution layer, followed by our 2D) spatial Mamba module. The 2D spatial branch output F, computed
F. (Ix)(Fx)) @ 2DSpatialMannba (aoooaCoo (Fx)).
where @ denotes element- multiplication of the two pathway outputs.
2D Frequency Branch. For frequency domain processing, we transform FN using a 2D Discrete Wavelet Transform (DW')), which decomposes the signal into four frequency subbands: LL (low-low), LH (low-high), HL (high-low), and HH (high-high) Each subband has spatial dimensions reduced by half compared to the original. Inspired by Freq [52], we rearrange these components from top-left to bottom-right to restore the original resolution. The wavelet features are then divided into four blocks and scanned block by block. The output is projected back to the spatial domain via a 2D Inverse DWT (IDWT), followed by element-wise multiplication with (ix) The 2D frequency branch output y is computed as:
F (FN. IDWT(2DDrrgMaamsDDVVT...
(4)
The spatial branch output is enhanced with residual connection from Fin- Finally, concatenate the outputs from both branches and apply 1 x convolution to produce the integrated output.
3.3 3D Frequency Scanning for Spatiotemporal Interaction
To address the challenges of fusing and extracting watermark information distributed across spa- tiotemporal locations, we propose an efficient architecture-311 SFMamba, 3D Wavelet Mamba mansform--nhaneee design with a customized scanning strategy. This architecture enables bidirec- tional modeling across frequency subbands within the 3D wavelet transform, effectively capturing longerange dependencies in both spatial and temporal domains to accurately recover watermark information embedded the temporal dimension. 3D SFMamba consists of separate 3D spatial and 3D frequency branches.
The 3D spatial branch employs vanilla 3D scanning strategy, which processes features across all three dimensions (temporal, height, width) to capture both spatial and temporal dependencies effectively.
3D Spatial Branch.
3D Frequency Branch. In the frequency domain branch, input features F,, undergo a 3D Discrete Wavelet Transform (3D DWT), decomposing them into eight subbands: LLL, LLH, LHL, LHH, HLL, HLH. HHL, and HHH. Each subband has half the original dimensions in frame, height, and width. To address the complexity of 3D tavelee-transfommed features, we propose novel spatiotemporal local scanning strategy as shown in Fig. 3. This approach first rearranges the eight subbands to restore the original video resolution, then divides them into eight distinct parts for separate scanning. For forward scanning, the order follows LLL, LLH, LHL, HLL, LHH, HLH, HHL, and proigesinggg systematically from low to high frequencies. Additionally, we implement reverse scanning mechanism that processes the subbands in the opposite direction-from HHH to e.I.-enalling the model to capture information from high to low frequencies. Within each part, employ spatial-first, temporal-secone scanning pattern. This spatiotemporal local scanning
5

---

strategy is specifically designed for 3D wavelet transforms, allowing the model to process frequeney information hierarchically across multiple scales.
3.4 Training Objectives
Our training framework combines video reconstruction loss and watermark reconstruction loss. The video reconstruction loss uses mean squared error (MSE) to ensure the watermarked video V closely resembles the original video V:
Lvidas MSE(V, V).
(5)
Similarly, the watermark reconstruction loss measures the extraction accuracy by comparing the extracted watermark W with the original watermark W:
Lastermark
MSE(W. W. W).
(6)
During training, provide the correct positions reconstruct the watermark image properly, while during testing, the model utilizes the embedded position channels to predict the correct arrangement of patches. The final loss function is:
Loui Lvideo
Coutermakk
(7)
where the watermark weighting hyperparameter À balances video quality against watermark fidelity.
4 Experiments
4.1 Experimental Setting
Datasets. For the video dataset, we use the Panda-70M [21] dataset for training, which is a large- scale dataset containing 70 million high-quality videos across diverse content types. Specifically, randomly download 10,000 videos from Panda-70M. sample 8 frames from each video, and resize each frame to a resolution of 320 x 512 for training purposes. For the watermark dataset, we use the Logo-2K dataset [19], which contains 167, 140 watermark images at a resolution of 256 x 256, spanning wide range of real-world logo classes. For the evaluation of text-to-video generation, we employ the VidProm [53] dataset as the source of prompts. The prompts in VidProm are generated by GPT-4 [54], and we randomly select 100 prompts from the dataset for evaluation.
Implementation Details, We use VideoCrafter2 [2] as our backbone model to generate videos at resolution of 320 x 512. Our method is compatible with various video generation backbones, with additional results provided in Appendix C. The patch size is set to 16 x 16. Patch Embedding maps each patch to a 1024-dimensional feature space. The model is trained for 30 epochs on NVIDIA RTX 4090 GPUs. We adopt the AdamW optimizer [55]. with the initial learning rate set to 5e-4, which is gradually decayed 1e-6 following cosine decay schedule. The watermark embedding network uses M = 2 3D SFMamba Blocks, while the watermark extraction network uses N 4 3D SFMamba Blocks. The hyperparameter À in Eq. is set to 0.75. The distortion layer simulates various real-world distortions, including H.264 video compression, rotation, and other common transformations. Since H.264 non-differentiable, we follow DVMark [56] and use a 3D CNN to mimic its effects. For position recovery, we propose confidence-guided greedy assignment algorithm, with detailed descriptions provided in Appendix B.
Baselines. To the best of our knowledge, no existing method embeds graphical watermarks directly into video generation models. To provide a comprehensive comparison, we select five representative state-of-the-art methods spanning three distinct paradigms of graphical watermarking: (1) Post- processed image watermarking methods: Balujanet[ 18] classic image steganography network: UDH[57] - A classic graphical watermarking network; PUSNet [58]- A state-of state-of-the-ar image steganography network. (2) Generative image watermarking: Safe-SD [59] - A generative graphical watermarking approach. (3) Video steganography: Wengnet [60] A method that hides one video within another. For a fair comparison, we retrain all baseline methods using the same training dataset as ours. For image-based methods, we embed a complete watermark image into each frame. For video-based methods, each frame of the secret video acts as a watermark and embedded into the corresponding frame of the cover video.

---

Original
Ours
Balujanet
Wengnet
UDH
PUSNet
Safe-SD
Frame
Difference (x5)
Watermart
Jaa O | Oea
O
Oee
O
O6
av
E L
A
Paye
Paye
Pay
Aige
Difference (x5)
D
O
Vevi
"Kitten Max flies among clouds and stars." "
Frame
Difference (x5)
Watermark
ARGO Q ARGO O
ARGO
ARGO
ARGO
ARGO
ARGO
Difference
(x5)
ARGG
A ARCO
ARGO
"A gray and white cat is playing with butterfly in beautiful garden."
Figure 4: Qualitative comparison results on the first frame of each video. Difference maps show absolute differences between the watermarked and original videos, and between the recovered and original watermarks. More examples are shown in Fig. 10 of Appendix. Best viewed with zoom in.
4.2 Comparison with State-of-the-art Methods
Qualitative Comparison. Fig. 4 shows the qualitative comparisons on the first frame of each video, while Fig. presents visual results of Safe-Sora across multiple frames. As illustrated, Balujanet introduces clearly visible artifacts in the watermarked video, UDH suffers from stripe-like distortions, and Safe-SD presents noticeable color shifts. From the difference maps, it is evident that both WengNet and PUSNet introduce considerable degradation fidelity. In contrast, our method produces watermarked videos with high visual fidelity, exhibiting minimal differences from the original vidcos. Morcover, the recovered watermark images closely resemble the originals, demonstrating high reconstruction accuracy.
both video quality and watermark
Quantitative Comparison. To evaluate the accuracy of watermark recovery and the invisibility of the watermark (i.e., video quality), we adopt standard metrics including PSNR, MAE, RMSE, SSIM [61], and LPIPS [62]. To assess temporal consistency in videos. we employ tLP [63] and Fréchet Video Distance (FVD) [64]. Quantitative results are summarized in Tab 1. As shown in the table, our method achieves state-of-the-art performance across all evaluation metrics. We observe that image watermarking methods inject watermarks by embedding them independently into each frame, which leads to poor temporal consistency and higher FVD scores. In contrast, our method leverages Mamba's long-range modeling capability across space and time, along with the proposed

---

Original Frame
Watermarked Frame
Difference
(x5)
"Spaceships traverse vibrant cosmos filled with planets and stars."
Figure Visual results of Safe-Sora on multiple frames. For each frame, we show the original image, the corresponding watermarked image, and their residual difference. Best viewed with zoom in.
Table 1: Quantitative results watermark quality and video quality metrics. Watermark quality is measured by comparing the recovered watermark image with the original watermark, while video quality is evaluated by comparing the watermarked video with the original video.
Watermark quality
Video quality
Method
PSNR
MAE
RMSE
SSIM
IPIPS
PSNR
MAE
RMSE
SSIM
LPIPS
t.P
FVD
Ralujanet
25.28
9.61
15.10
0.91
0.11
25.26
10.09
14.58
0.87
0.25
1.32
512.22
Wengnet
33.18
3.71
5.82
0.96
0.06
28.09
6.27
10.69
0.85
0.21
1.27
265.82
UDH
22.90
11.29
19.29
0.77
0.24
27.75
8.16
10.72
0.73
0.32
2.09
1075.62
PUSNet
28.86
7.45
9.57
0,93
0.12
29.98
4.50
8.72
0.92
0.11
0.98
154.35
Safe-SD
24.24
9.78
17.39
0.84
0.11
22.32
11.65
20.64
0.75
0.24
1.87
849.83
Ours
37.71
2.22
3.61
0.97
0.04
42.50
1.36
1.96
0.98
0.01
0.38
3,77
spatiotemporal local scanning strategy, resulting in superior temporal consistency. Specifically, our method achieves FVD of 3.77, significantly outperforming all baselines.
4.3
Robustness
To rigorously evaluate the robustness of our method, we apply variety of distortion types. For random erasing, randomly select an erasure ratio from the range [5%. 10%, 15%, 20%]. For Gaussian blur, we randomly choose kernel size from 3, 5, 7. For Gaussian noise, we add noise with standard deviation randomly sampled from uniform distribution (4(O, 0.2). For rotation, the degree is randomly sampled from the range (-30-, 30%). Specifically for video, we adopt H.264 compression with a fixed CRF value of 24. We PSNR, SSIM. and LPIPS evaluate the robustness of watermark reconstruction under these distortions. As shown in Fig. 6, our method consistently achieves the best performance across all types of attacks, demonstrating strong robustness. In particular, under H.264 compression, all baseline methods suffer significant drop in performance, whereas our method maintains high watermark quality.
4.4 Abltionn Study
We conduct ablation study two key components- Coarse-to-Fine Adaptive Patch Matching and Spatiotemporal Local Scanning. Additional ablation studies can found Appendix
Impact of Coarse-to-Fine Adaptive Patch Matching. This strategy matches the most similar frame and spatial location for each watermark patch, based on similarity computed with the video latent representations. To evaluate the effectiveness of each component, we investigate three ablated variants of our method: w/o CFAPM, which completely removes
Coarse-to-Fin to-Fine Adaptive Patch Matching mechanism; w/o RtL. which replaces the Routing by Latent strategy with direct pixel-frame similarity computation; and w/o FS, which removes the Fine Stage responsible for spatial location refinement.

---

PSNR1
S5IM
LPIPS
0.8
25
0.5
0.4
0.4
0.2
10-
0.2
Frase
Blur
Noise
Rotate
H.264
Erase
Blur
Noise
Rotate
H,264
0.0
Frase
Blur
Noise
Rolate
H264
Our
Baligenet
Wengret
JON
-
PUttue
Sadt
Figure 6: Watermark reconstruction quality under various distortions. Distortion settings include: Random Erasing (5%-20%) Gaussian Blur (kernel size 3/5/7), Gaussian Noise (a u1(0, 0.2)), Rotation (-30", 30%), and H.264 Compression (CRF= 24).
Table Comprehensive ablation study on key components of our method. CFAPM: Coarse-to-Fine Fine Adaptive Patch Matching; RtL: Routing by Latent; FS: Fine Stage; SLS: Spatiotemporal Local Scanning: SFS: Spatial First Scanning within each subband.
Watermark quality
Video quality
Method
PSNR
MAE 1
RMSE
SSIM
LPIPS
PSNR
MAE
RMSE
SSIM
LPIPS
ILP
FVD
wla CFAPM
36.71
2.53
3.99
0.96
0.05
39.68
1.94
2.76
0.97
0.03
1.14
16.87
w/o RIL.
36.36
2.67
4.13
0.95
0.05
40.23
1.79
2.54
0.97
0.04
1.30
6.37
w/o
36.88
2.45
3.94
0.97
0.04
41.25
1.58
2.26
0.97
0.03
1.17
4.82
ST.S
35.96
2.98
4,02
0.94
0.08
38.42
1.98
2.12
0.92
0.03
1.01
13.16
w/o STS
36.41
2.59
4.17
0.96
0.05
42.21
1.38
2.05
0.98
0.01
0.24
5.24
37.71
2.22
3.61
0.97
0.04
42.50
1.36
1.96
0.98
3.77
The results in Tab. clearly demonstrate that each component of the CFAPM strategy plays a critical role in enhancing overall performance. Computing the similarity between watermark patches and video latents leverages the compressed semantic information encoded in the latent space, enabling more accurate matching; the fine stage further refines this process by identifying the most visu- ally similar spatial location for each patch. Overall, the Coarse-to-Fine Adaptive Patch Matching mechanism consistently improves both watermark fidelity and video quality.
Impact of Spatiotemporal Local Scanning. This strategy traverses the eight subbands the 3D wavelet transform in frequency awwaee hierarchical order. Within each subband, patches are selected following a spatial-first, temporal-second scanning pattern. To evaluate the effectiveness of this design, we ablate two key components: w/o SLS, which replaces the structured traversal with vanilla 3D scanning strategy; and w/o SFS, which applies a temporal-firs: scanning order within each subband instead of the proposed spatial-first policy.
Results Tab. demonstrate that the full SLS strategy significantly improves both watermark and video quality. While the temporal-frrs scanning achieves slightly better tLP, it consistently underperforms in watermark fidelity metrics. In summary, SLS enables more effective fusion and extraction of watermark signals distributed across spatiotemporal regions, thereby enhancing the overall performance of watermark embedding.
Conclusion
Our work introduces Safe-Sora, the first framework embedding graphical watermarks directly into generated video. We propose hierarchical coarse-to-fine adaptive matching strategy that optimally maps watermark patches to visually similar frames and spatial regions. Our 3D wavelet transform- enhanced Mamba architecture with novel spatiotemporal local scanning strategy, effectively models spatiotemporal dependencies for watermark embedding and retrieval, pioneering the application of state space models to watermarking. Experiments demonstrate that Safe-Sora achieves superior performance in video quality, watermark fidelity, and robustness. This work establishes a foundation for copyright protection in generative video and opens new avenues for applying state space models to digital watermarking.

---

Acknowledgments
This work supported by the National Key R&D Program of China (2022YFBB470114047770404 SSTIC Grant (KJZD220330931 15122011210002 KIZD200330921119 14916032, GJHZ202242111116000000 and the National Natural Science Foundation of China (62502317).
References
[1] A. Blattmann, T. Dockhorn, S. Kulal, D. Mendelevitch, M. Kilian, D. Lorenz. Y. Levi, Z. English, V. Voleti, A. Letts et al., "Stable video diffusion: Scaling latent video diffussio models to large datasets," arXiv preprint arXt::3311.55227 2023.
[2] H. Chen, Y. Zhang, X. Cun, M. Xia, X. Wang, C. Weng. and Y. Shan, "Videocrafter2: Overcoming data limitations for high-quality video diffusion models," in CVPR, 2024, pp. 7310-7320.
[3] J. Wang, H. Yuan, D. Chen, Y. Zhang, X. Wang. and S. Zhang, "Modelscope text-to-video technical report," arXiv preprint arXiv:2308.06371 06571, 2023.
[4] X. Wang, Jia, Chen, Z. Liu, Yi, C. Chen, and Y. Qiao, "Latte: Latent diffusion transformer for video generation," " arXiv preprint 2xXiv:2401.03066 2024.
[5] Xing. M. Xia, Y. Zhang. H. Chen, W. Liu, Liu, X. Wang. Shan, and T.-T. Wong. "Dynam- ierafter: Animating open-domain images with video diffusion priors," in ECCV. Springer, 2024, pp. 399-417.
[6] C. Chen, J. Zhu, X. Feng, N. Huang, M. Wu, F. Mao, J. Wu, X. Chu, and X. Li, "S" -uuidanne Stochastic self guidance for training-free enhancement of diffusion models," 2025. [Online]. Available: https//anniv.org/aa//2588 12880
[7] Z. Zheng, X. Peng, T. Yang. C. Shen, S. Li, H. Liu, Zhou, T. Li, and Y. You, "Open-sora: Democratizing efficient vidco production for all," arXiv preprint arXiv:2412.20404, 2024.
[8] Y. Zhao, T. Pang, C. Da, X. Yang, N.-M. Cheung, and M. Lin, "A recipe for watermarking diffusion models," arXiv preprint arXiv:2303. 10137, 2023.
[9] P. Fernandez, G. Couairon, H. Jégou, M. Douze, and T. Furon, "The stable signature: Rooting watermarks in latent diffusion models," in ICCV, 2023, pp. 22 466-222777
[10] R. Min, S. L.L H. Chen, and M. Cheng, "A watermark-condiingn diffusion model for ip protection," in ECCV. Springer, 2024, pp. 104-120.
[11] C. Xiong, C. Qin, G. Feng, and X. Zhang, "Flexible and secure watermarking for latent diffusion model," in ACM MM, 2023, pp. 1668-1676.
[12] L. Lei. K. Gai, J. Yu, and L. Zhu, "Diffusetrace: A transparent and flexible watermarking scheme for latent diffusion model," arXiv preprint arXiv:2405.02666 2024.
[13] Z. Meng, B. Peng, and J. Dong, "Latent watermark: Inject and detect watermarks in latent diffusion space," IEEE Transactions on Multimedia, 2025.
[14] Z. Yang. K. Zeng. K. Chen, H. Fang, W. Zhang, and N. Yu, "Gaussian shading: Provable performance- lossless image watermarking for diffusion models." " CVPR, 2024, pp. 12 162-12 171.
[15] H. Ci, P. Yang, Y. Song, and M. Z. Shou, "Ringid: Rethinking tree-ring watermarking for enhanced multi-key identification, " ECCV. Springer, 2024, pp. 338-354.
[16] R. Hu. Zhang, Li. Li, Q. Guo. Qiu, and T. Zhang. "Videoshield: Regulating diffusion-based video generation models via watermarking." arXiv preprint arXiv:2501.14199 2025.
[17] M. Jang. Y. Jang, J. Lee, K. Kawamura, F. Yang, and S. Kim, "Lvmark: Robust watermark for latent video diffusion models," arXiv preprint ar 2412:2241. 2024.
[18] S. Baluja, "Hiding images within images," JEEE irunsactions on puttern analysis and muchine intelligence, vol. 42, no. 7, pp. 1685-1697, 2019.
[19] J. Wang. W. Min, Hou, S. Ma, Y. Zheng, H. Wang, and S. Jiang, "Logo-2K+: a lcrge-scale logo dataset for scalable logo classification." in AAAI, 2020.
10

---

[20] J. Deng, W. Dong. R. Socher, L.-J. Li. K. Li, and L. Fei-Fei, "Imagenet: A large-scale hierarchical image database," " in CVPR. Icee, 2009, pp. 248-255.
[21] T.SS. Chen, A. Siarohin, W. Menapace, E. Deyneka, H.-w. Chao, B. E. Jeon, Y. Fang, H. Lee, Ren, M.-H. Yang. and Tulyakov, "Panda-70m. Captioning 70m videos with multiple modality teachers." in CVPR, 2024.
[22] T. Hc, L. Gao, J. Song, and Y.-F. Li, "Towards open- vocabulary scene graph generation with prompt-based finetuning," in ECCV, Springer, 2022, pp. 56-73.
[23] T. He, I.. Gao, J. Song, J. Cai, and Y.-F Li, "Semantic compositional learning for low-shot scene graph generation." arXiv preprint 10Xiv:2108.000 108,08600 2021.
[24] T. He. L. Gao. J. Song. and Y.-F. Li, "Toward unified transformer-basel framework for scene graph generation and human-object interaction detection." IEEE Transactions Image Processing, vol. 32, pp. 6274-6288, 2023.
[25] Li, P. Zhou, J. Liu, J. Keppo, Lin, Yan, and X. Xu, "Instant3d: instant text-to-3d generation." IJC,, 2024.
[26] H. Xu, C. Yu, F. Xiao, J. Xing. H. Ci, W. Chen, F. Wang, and M. Li, "Cyc3d: Fine-grained controllable 3d generation via cycle consistency regularization," arXiv preprint arXiv:2504. 14975, 2025.
[27] S. Liu, J. Li, G. Zhao, Y. Y.Zhang, X. Meng, F. R. Yu, Ji, and M. Li, "Eventgpt: Event stream understanding with multimodal large language models," in CVPR, June 2025, pp. 29 139-29 149.
[28] F. Zhao, M. Li, L. Xu, W. Jiang, J. Gao, and D. Yan, "Favehat: Unlocking fine- ane-grained facial vidco understanding with multimodal large language models," arXiv preprint wrXiv:2503.09/8, 2025.
[29] J. Li, X. Qiu, L. Xu, L. Guo, D. Qu, T. Long, C. Fan, and M. Li, "Unifaace: Fine-grained face understanding and generation with unified multimodal models." arXiv preprint arXiv:2503.081: 081200 2025.
[30] Y. Shi. W. Yan, G. Xu, Y. Li, Chen, Z. Li, F. Yu, M. Li, and Yeo, "Pvchat: Personalized video chat with onc-shot learning" arXiv preprint arviv 1706,, 2025.
[31] Z. Su, J. Zhuang, and C. Yuan, "Texturediiffuion: Target prompt disentangled editing for various texture transfer," in ICASSP. IEEE, 2025, pp. 1-5.
[32] S. Tan, X. Qiu, Y. Shu, G. Xu, L. Xu, X. Xu, H. Zhuang, M. Li, and F. Yu, "Wmarkgpt: Watermarked image understanding via multimodal large language models."
[33] Y. Wei, Z. Hu, I. Shen, Z. Wang, C. Yuan, and D. Tao, "Open-vocabulary customization from clip via data-free knowledge distillation," The Thirteenth International Conference Learning Representations, 2025.
[34] Ho, A. Jain, and Abbeel, "Denoising diffusion probabilistic models," NewrlPS, vol. 33, pp. 6840-6851, 2020.
[35] A. Q. Nichol and P. Dhariwal, "Improved denoising diffusion probabilistic models." in ICML. PMLR, 2021, pp. 9162-8171.
[36] J. Song, C. Meng, and S. Ermon, "Denoising diffusion implicit models," arXiv preprint arXiv:2010.02502, 2020.
[37] J. Sohl-Dickstein, F. Weiss, N. Maheswaranathan, and S. Ganguli, "Deep unsupervised learning using nonequilibrium thermodynamies," in ICMI.. PMIRR 2015, pp. 2256-2265.
[38] P. Dhariwal and A. Nichol, "Diffusion models beat gans image synthesis." " NeurlPS, vol. 34, pp. 8780-8794, 2021.
[39] Y. Wei, Z. Hu, I.. Shen, Z. Wang. L.. Li, Y. Li, and C. Yuan, "Meta-learning without data via unconditional diffusion models," IEEE Transactions on Circuits and Systems for Video Technology, 2024.
[40] R. Rombach, A. Blattmann, D. Lorenz, P. Esser, and B. Ommer, "High-resolution image synthesis with latent diffusion models," in CVPR, 2022, pp. (684-10695,
[41] A. Gu, K. Goel, and C. Ré, "Efficiently modeling long sequences with structured state spaces," arXiv preprint arXiv:2111.00333 2021.
11

---

[42] J. T. Smith, A. Warrington, and S. W. Linderman, "Simplified state space layers for sequence modeling." arXiv preprint (FXiv:2208.04333, 2022.
[43] A. Vaswani. N. Shazeer, N. Parmar. J. Uszkoreit, L. Jones, A. N. Gomez, L. Kaiser, and L. Polosukhin. "Attention is all you need," NeurlPS, vol. 30, 2017.
[44] A. Gu and T. Dao, "Mamba: Linear-time sequence modeling with selective state spaces," arXiv preprint
arXiv:2312.00752. 2023.
[45] J. Wang, T. Gangavarapu, J. N. Yan, and A. M. Rush, "Mambabyte: Token-free selective state space model," arXiv preprint arXiv:2401. 13660, 2024.
[46] R. Waleffe, W. Byeon, D. Riach, B. Norick, Korthikanti, Dao, A. Gu, A. Hatamizadeh, S. Singh, D. Narayanan et al,, "An empirical study of mamba-based language models," arXiv preprint arXiv:2406.00 07887, 2024.
[47] Y. Liu, Y. Tian, Y. Zhao, H. Yu, L. Xie, Y. Wang. Q. Ye, Jia,, and Y. Liu, "Vmamba: Visual state space model," NewrlPS, vol. 37, pp. 031031-33 003031-10360 103 063, 2024.
[48] K. Li, X. Li, Y. Wang, Y. He, Y. Wang, L. Wang, and Y. Qiao, "Vidcomamba: State space model for efficient vidco understanding," in ECCV, Springer, 2024, pp. 237-255.
[49] X. Tan, H. Wang, X. Geng, and I.. Wang, "Frequency-guideed diffiusion model with perturhation training for skeleton-based video anomaly detection," arXiv preprint arXiv:2412.03044 2024.
[50] S. A. Al-Taweel and Sumari, "Robust video watermarking based on 3d-dwt domain," " in TENCON 2009-2009 2009 IEEE Region 10 Conference. IEEE, 2009, pp. 1-6.
[51] X. Li and R. Wang. "A vidco watermarking scheme based on 3d-dwt and neural network," in Ninth IEEE International Symposium on Multimedia Workshops (ISMW 2007). IEEE, 2007, pp. 110-115.
[52] Z. Zhen, Y. Hu, and Z. Feng. "Freqmamba: Viewing mamba from frequency perspective for image deraining," arXiv preprint arXiv:2404.09477, 2024.
[53] W. Wang and Y. Yang. "Vidprom: A million-scale real gaanery dataset for text-to-video diffusion models," in NewrIPS, 2024.
[54] J. Achiam, S. Adler, S. Agarwal, L. Ahmad, I. Akkaya, F. L. Aleman, D. Almeida, J. Altenschmidt, S. Altman, S. Anadkat al., "Gpt-4 technical report," arXiv preprint urXiv:2303.08774, 2023.
[55] I. Loshchilov and F. Hutter, "Decoupled weight decay regularization," arXiv preprint arXiv.771.051001 2017.
[56] X. Luo, Y. Li, H. Chang, C. Liu, P. Milanfar, and F. Yang, "Dvmark: deep multiscale framework for video watermarking." IEEE Transactions Image Processing, 2023.
[57] C. Zhang, P. Benz, A. Karjauv, G. Sun, and I. Kweon, "Udh: Universal deep hiding for steganography, watermarking, and light field messaging," NeurlPS, vol. 33, pp. 10 223-10234, 2020.
[58] G. Li, S. Li, Z. Luo, Z. Qian, and X. Zhang, "Purified and unified steganographic network," in CVPR, 2024, pp. 27 2756675622 579-6699777 578.
[59] Z. Ma, G. Jia, B. Qi, and B. Zhou, "Safe-sd: Safe and traceable stable diffusion with text prompt trigger for invisible generative watermarking." in ACM MM, 2024, pp. 711--7122.
[60] X. Weng, Li, L. Chi, and Mu, "High-capacity convolutional video steganography with temporal residual modeling," in Proceedings of the 2019 on international conference on multimedia retrieval, 2019, pp. 87-95.
[61] Z. Wang, A. C. Bovik, H. R. Sheikh, and Simoncelli, "Image quality assessment: from error visibility to structural similarity," IEEE transactions on image processing, vol. 13, no. 4, pp. 600-612, 2004.
[62] R. Zhang, Isola, A. A. Efros, Shechtman, and O. Wang. "The unreasonable effectiveness of deep features as perceptual metrie," in CVPR, 2018, pp. 586-595.
[63] M. Chu, Y. Xie, J. Mayer, Leal- Taixé, and N. Thuerey, "Learning temporal coherence via self supervuuervi for gan-based video generation." ACM Transactions on Graphics (TOG), vol. 39, no. 4, pp. 75 1, 2020.
[64] T. Unterthiner, S. Van Steenkiste, K. Kurach, R. Marinier, M. Michalski, and S. Gelly. "Towards accurate generative models of video: A new metric challenges." arXiv preprint arXiv: 1rX.001112.01717. 2018
12

---

NeurIPS Paper Checklist
1. Claims
Question:
Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: We mention in the abstract that we propose the first framework that integrates graphical watermarks directly into the video generation process.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
It is fine to include aspirational goals as motivation as long as is clear that these goals attained by the paper.
2. Limitations
Question:
Does the paper discuss the limitations the work performed by the authors?
Answer: [Yes]
Justification: We mention in the Section E that although our method can successfully embed image watermarks, embedding more information-rich video watermarks remains limitation.
Guidelines:
The answer NA means that the paper has limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect the scope of the claims made, e.g., if the approach was only tested on a few datasets or with few runs. In general, empirical results often depend implicit assumptions, which should be articulated.
The authors should reflect the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low or images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't 't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory assumptions and prool's
Question: For each theoretical result, does the paper provide the full of assumptions and complete (and correct) proof?
13

---

Answer:
[NA]
Justification:
The paper does not include theoretical results.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced in the statement of any theorems.
The proof's can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch provide intuition.
Inversely, any informal proof provided in the core of the paper should complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results the paper to the extent that affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided not)?
Question:
Answer: [Yes]
Justification: We describe the experimental details in Section 4.1 and include the code in the supplementary materials.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, descríbing the architecture fully might suffice, or if the contribution is specific model and empirical evaluation, it may be necessary to either make possible for others to replicate the model with the same dataset, provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., g., in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) the contribution is primarily a new algorithm, the paper should make clear how reproduce that algorithm. (b) If the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) the contribution is new model (e-g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should possible for other researchers to have some path reproducing verifying the results. 5. Open access to data and code
14

---

Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, as described in supplemental material?
Question:
Answer: [Yes]
Justification:
The data and code are provided in the supplementary materials.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (https://nips.cm cc/
for more details.
While we encourage the release of code and data, we understand that this might be possible, so "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurlPS code and data submission guidelines (https: cccppublc//aaeccccccccccccc http//uuiiee//oooeeee
iobbbmisssionni ssionPolicy) for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the proposed method and baselines. only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing much information possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: Section 4.1 describes the experimental setups and parameters in detail.
Guidelines:
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, or as supplemental material.
7. Experiment statistical significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer: [No]
Justification: We followed the experimental setup of prior works in generative watermarking, which do not report statistical significance or error bars. As our results show consistent and large margins over all baselines, we believe statistical testing would not affect the validity of our main claims.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by emor bars, confi- dence intervals, or statistical significance tests, least for the experiments that support the main claims of the paper.
15

---

The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g.. Normally distributed errors).
It should be clear whether the error bar is the standard deviation the standard error of the mean.
It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not show in tables figures symmetric error bars that would yield results that are out range (e.g. negative error rates).
error bars are reported in tables or plots, The authors should explain the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed reproduce the experiments?
Question:
Answer: [Yes]
Justification: Section 4.1 describes the computational resources required to reproduce the experiments.
Guidelines:
The answer NA means that the paper does include experiments.
The paper should indicate type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (c.g., preliminary or failed experiments that didn't 't make into the paper).
9. Code of ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurlPS Code of Ethics https http://eeeipp..eee http///urpps.ccppppllee/e/etaaaa hctpppppbl.cccticcccccceeeeeeee.
Answer: [Yes]
Justification:
This research complies with the NeurIPS Code of Ethics in all aspects.
Guidelines:
The answer NA means that the authors have reviewed the NeurIPS Code of Ethics.
the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (c.g.. if there special consid- eration due to laws or regulations in their jurisdiction..
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification: Section F discusses the socictal impacts of this work.
Guidelines:
The answer NA means that there is no societal impact of the work performed.
16

---

If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), faimess considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility of ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification:
The paper poses no such risks.
Guidelines:
The answer NA means that the paper poses such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards challenging, and many papers do not require this, but encourage authors to take this into account and make best. faith effort.
12. Licenses for existing assets
Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper. properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification: We cite the original papers of the datasets and base models, and strictly comply with their licenses and terms of use.
Guidelines:
The answer NA means that the paper does
existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset used and, possible, include a URL.
The name of the license (e.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.
17

---

If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswi thcode. com datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided. If this information is available online, the authors encouraged to reach out the asset's s creators.
13. New assets
Question: Are assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [Yes]
Justification: Our code includes documentation with detailed information training, licensing, and usage limitations.
Guidelines:
The answer NA means that the paper does not release assets.
Researchers should communicate the details of the dataset/code/mooel as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsoureing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification:
The paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then much detail as possible should be included the main paper.
According to the NeurlPS Code of Ethics, workers involved in data collection, curation, other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for research with human subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification:
The paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does involve crowdsourcing nor research with human subjects.
Depending the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
18

---

We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors adhere the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
16. Declaration of LLM usage
Does the paper describe the usage of LLMs if it is an important, original, or non-standard component of the core methods in this research? Note that if the LLM is used only for writing, editing, formatting purposes and does not impact the core methodology, scientific rigorousness, or originality of the research, declaration is not required.
Question:
Answer: [NA]
Justification: The core method development in this research does involve LLMs as any important, original, or non-standard components.
Guidelines:
The answer NA means that the core method development in this research does not involve LLMs as any important, original, non-standard components.
Please refer to our LLM policy (https httpaa////eupps... http://p/////oooeeeeeee///////// for what should or should not be described.
19

---

Technical Appendices
Generation
Identification
Deceder
R
'A campfine burning brightl"
Letent Viceo Senerative Medee
Distort
User
Watermarked Video
2
Wotenmorked Video
Distorned Video
Water mork Extracter
Watermerk
Model Owner
Wotermark
Feature Extrector
Figure 7: Application Scenario Safe-Sora: A user provides a text prompt to a video generation model. The model owner's graphical watermark is embedded into the video through feature extractor and decoder. Later, even the video distorted, a watermark extractor can recover the graphical watermark to verify authenticity and ensure copyright protection.
A
Preliminaries
A.1 Latent Video Diffusion Models
Latent Video Diffusion Models (LVDMs) extend the concept of latent diffusion models to the video domain. These models operate in compressed latent space rather than pixel space to improve computational efficiency while maintaining generation quality. The process can be descrihed in three key steps:
First, video encoder maps the input video æ E F x3 to a latent representation z = E(x) E R. Pxhxarxe where F is the number of frames, and the spatial dimensions are reduced: and w < W.
Second, diffusion process gradually adds noise the latent representation through fixed Markov chain:
(=+(==1) = N(zs; v1 3, (<21200) = N((;; Vā,z0, - (1-āa)1)
(8)
(9)
where Br is the noise schedule, = 11- and ā II.
Finally, denoising network Eg is trained to predict the added noise each time step. During generation, the reverse process starts from pure Gaussian noise 2T ~ NO, I) and iteratively denoises produce 2g, which is then decoded to the final video D(20) using a decoder D.
For text-to-video generation, LVDMs incorporate a text encoder that processes a conditioning prompt, which guides the denoising process toward the desired content.
A.2 State Space Models
State Space Models (SSMs) are continuous dynamical systems defined by the following equations:
dh(t)
dt Ah(t) + Bx(t),
(10)
y() Ch(() + Dx(!).
(11)
where x(t) is the input, h(()) is the hidden state, y() is the output, and {A, C.D. are the parameters of the system.
For discrete sequence modeling, these continuous equations are discretized:
h; Áh;-1 Bx
(12)
y: Ch, + Dx,,
(13)
where A and B are the discretized versions of A and B.
20

---

Algorithm Confidence-GGuide Greedy Assignment for Watermark Position Recovery
1: Input: Watermark patches with position channel
2: Output: Reconstructed watermark image W
Stage 1: Position Decoding
3: for each patch i do
4: Normalize position channel to [0,
5:
Compute probability vector pt by averaging binary vectors in the position channel
Compute confidence C ΣØ= p 0.5|
6:
7:
Convert ps to binary b, via thresholding
8:
Decode b, + position index pos; [0, N
9:
end for
Stage 2: Confidence- Prrioiitzedd Assignment
10: Initialize watermark image W <- 0
11: Initialize unassigned patch pool U +-
12: for each patch i do
13:
if pos; is unoceupied in W then
14:
Assign patch position pos; in W else & > confidence of current patch at pos; then
15:
16:
Replace patch pos; with in W
17:
Add the replaced patch to 2
18: else
19:
Add patch to Z
end
21:
end for
Stage 3: Greedy Reassignment of Unassigned Patches
22: Sort LA by descending G;
23:
for each patch j in Li do
24: Find nearest vacant position РA to pos;
25: Assign patch j to position Pj in W
26:
end for
27:
return W
The Mamba architecture extends traditional SSMs by introducing ieput-dependent parameters:
A, B Projection (x),
(14)
h, A @ h B
(15)
yr = Ch,,
(16)
This input-dependent parameterization allows Mamba to dynamically adapt its processing based on input content, making it effective for modeling complex sequential dependencies.
A.3 Wavelet Transforms
Wavelet transforms decompose signals into multiple frequency components with localized time information, making them useful for frequency domain watermarking.
For images, the 2D Discrete Wavelet Transform (DWT) decomposes image into four sub-bands: approximation (LL), horizontal detail (LH), vertical detail (HL), and diagonal detail (HH).
The 3D Discrete Wavelet Transform extends the 2D DWT to the temporal domain for video processing. video sequence is decomposed into eight uub-bands: LLL, LLH. LHL, LHH, HLL, HLH, HHL, and HHH, with L and H representing low and high frequencies across the frame, height, and width dimensions. Each sub-band has half the resolution of the original video
dimensions. The 3D DWT provides a multi-level representation of videos, capturing both spatial and temporal characteristics, which is beneficial for video watermarking by allowing embedding in specific frequency bands while preserving perceptual quality.
21

---

Table 3: Quantitative comparison on VideoCrafter2 and Open-Sora Sora backbones.
Watermark quality
Video quality
Backbone
PSNR
MAE 1
RMSE...
SSIM 7 LPIPS
PSNR
MAE
RMSE
SSIM T
LPIPS
(LP
FVD
VideoCrafte22
37.71
3.61
0.97
0.04
42.50
1,96
0.98
0.01
0.38
3.77
Open-Sorn
35.42
2,93
4,70
0.96
0.06
44.15
1.31
1,75
0.97
0.01
0.31
3,04
Frame
Watermaked frame
Difference (x5)
Watermark
Recovered watermark
Difference (x5)
SUGINS Eaquie Esqube
SONGANBE
"A flock of seagulls flies over the azure and above the red cliffs."
CAR MG
CAR MG CLUB
CLUB
"Numerous hot air balloons float above snow-covered, peculiar landscape."
BRITVIĆ BRITVIĆ
magnificent waterfall cascades amidst the lush forest." "
Figure 8: Qualitative examples on Open-Sora backbone. Best viewed with zoom in.
B Robust Watermark Position Recovery Algorithm
To address cases where multiple watermark patches decoded the spatial location due to distortion or attack, we propose a confidence-guided greedy assignment algorithm. This algorithm ensures reliable and unambiguous recovery of watermark positions by incorporating confidence estimation, conflict resolution, and greedy reassignment of unplaced patches.
The algorithm is follows:
first, compute the confidence score for each patch's 's predicted position. Then, assign each patch to its corresponding position; in case of conflicts, give priority to the patch with higher confidence. Finally, assign the remaining unplaced patches in descending order of confidence to the nearest available positions. The detailed procedure illustrated in Algorithm 1.
The confidence-guiin greedy assignment algorithm effectively handles noisy or partial position corruption and significantly improves the robustness of watermark extraction.
C
More Backbones
While our main experiments are conducted using VideoCrafter2 [2], UNet-based video generation model, we further evaluate our method using Open-Sora [7], DiT-based video generation model. Quantitative results are shown Tab. 3, and qualitative examples are provided in Fig. can be seen, Open-Sora achieves comparable performance to VideoCrafter2 and produces videos with higher visual quality, but slightly lower watermark fidelity. These results demonstrate that our method effective across different video generation models.
22

---

Table 4: Additional Ablation Studies. MSFI: Multi- Scale Feature Injection.
Watermark quality
Vidco quality
Method
PSNR
M
RMSE 4
SSIM
LPIPS
PSNR
MAE
RMSE
SSIM
LPIPS
I.P
FVD
w/o MSFI
36.56
2.56
4.06
0.96
0.05
39.39 42.50
2,02
2.84
0.97
0.03
1.19
14.11
37.71
0.04
1.36
1.6
3.77
Original
w/o MSAI
w/ MSFI
Original
w/o MSFI
w/ MSFI
Figure 9: Visual impact of Multi-Scale Feature Injection. We present difference maps (x5) between watermarked and original videos. After applying Multi-Scale Feature Injection, the differences are significantly reduced, leading to improved video quality.
D Additional Ablation Studies
To further assess the contribution of individual components in framework, we perform extended ablation studies beyond the main experiments. In particular, we examine the impact of Multi-Scale Feature Injection, with quantitative results reported in Tab. 4 and qualitative comparisons shown in Fig. 9. The results demonstrate that incorporating the inherent multi-scale features of the VAE notably improves the visual quality of generated videos.
E
Limitations
While our method demonstrates strong performance in embedding and recovering static graphical watermarks, it is currently limited to image-based watermarks such as logos or icons. Embedding more complex and information-rich video watermarks-e.p animated sequences or temporally dynamic retaerss-remiins challenge.
Societal Impact
The ability to embed graphical watermarks directly into the video generation process carries important social and ethical implications. On the positive side, it provides a practical solution to the growing concerns over ownership verification and copyright protection in generative media. As synthetic content becomes increasingly widespread, methods like ours can help content creators assert their rights and trace misuse, thereby fostering accountability and transparency in digital media ecosystems.
However, like many watermarking techniques, our method may also be misused. For example, it could potentially be employed to falsely claim ownership public material, to embed unauthorized logos into generated videos. We strongly advocate for the responsible use of generative watermarking technologies and recommend that future research explores methods to verify the authenticity of embedded watermarks and prevent abuse.
23

---

Original
Ours
Balujanet
Wengnet
UDH
PUSNet
Sale-SD
Difference Frama
Watermark
TRÉS CRUCES
TRES CRUCES CERVIZA PREMIUM
TRÉS CRUCES
TRES CRUCES
TRES CRUCIS CIRARRA FREMIUI
TRÉS CRUCES
TRÍS CRUCTS
CHRVEZA PREMIUM
CHEVRIA PREMFUM
CERVEEA FRENIUM
CIFVIZA PREMIUM
CERRBIA FRINIUM
Difference
TAS CALACSS
TRES CRUCES PREURII
TERS ICRACC
CREE
TRRS CRUCAS
CANFEEA Pariiumtt
"Batman overlooking the city at dusk." "
Frmee
Difference (+5)
Watermark
MIKASA
MIKASA
MIKASA
MIKASA
IKAAA
MIKASA
MIKASA
Difference
MANCHER
(x5)
A modern beachside cabin with ocean view.
Figure 10: More qualitative examples VideoCrafter2 backbone. Difference maps show absolute differences between the watermarked and original videos, and between the recovered and original watermarks. Best viewed with zoom in.
24


Reviews:
[{"review_id": "CycCqlYmfq", "reviewer": "Reviewer_xHnf", "summary": "The paper introduces a framework for embedding graphical watermarks into the video generation process of text-to-video diffusion models, called safe-sora. The authors propose a coarse-to-fine adaptive matching strategy that embeds watermark patches into visually similar spatiotemporal locations in the video.", "questions": "* How resilient is Safe-Sora to adversarial attempts to detect or remove the embedded watermark? Have you tested watermark removal attacks (e.g., inpainting, adversarial noise, filtering)?\n* Could Safe-Sora be extended to embed dynamic watermarks (e.g., animated logos or video clips) instead of static images? (Even if not implemented, a discussion of the technical challenges and design considerations for dynamic watermarks would be valuable.)", "limitations": "Yes", "rating": 4, "confidence": 1, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "The problem of watermarking video-generation is important and relevant, it addresses, among others, the question of copyright protection for generated video content. To the best of my knowledge (which is limited in the domain), this seems to be the first application of state space models (Mamba) and 3D wavelet transforms for video watermarking, combined with a sophisticated patch matching mechanism. The evaluation and analysis, as well as the ablations, seem comprehensive; the authors use benchmarks against image watermarking, video steganography, and generative watermarking baselines, showing clear improvements in watermark recovery and video quality, as well as demonstrating resilience to various real-world distortions, including compression, blur, and erasing.\n\nThere is currently no discussion as to whether a knowledgeable adversary could detect or remove the watermark, covering this question seems important to discuss the method in full. Further, the method is currently restricted to static image watermarks; dynamic or more complex watermarks (e.g., videos) are left for future work, and embedding performance relies on matching the watermark to semantically similar video regions, which may limit generalisability.", "was_revised": true, "final_justification": "I appreciate the authors' feedback. My concerns are mostly addressed, hence I will keep my score as I believe it still adequately reflects my evaluation of the paper.", "rebuttal": "Thank you for your valuable comments and recognition on our method novelty combining Mamba and 3D wavelet transforms, comprehensive evaluation and ablations, and clear improvements in watermark recovery and robustness. We hope the following discussion can address your concerns!\n\n---\n\n> **Q1**: Have you tested watermark removal attacks？\n\n**A1**: We conducted robustness experiments on watermarking under various attacks (H.264 compression, Gaussian noise, blur, etc.), with the results presented in Figure 6.  **Our experimental findings consistently demonstrate that Safe-Sora significantly outperforms all baseline methods, showcasing superior robustness capabilities.** Notably, under H.264 compression—a critical real-world scenario—all baseline methods experience substantial performance degradation, while our method maintains consistently high watermark extraction quality, validating its practical applicability for robust copyright protection.\n\n> **Q2**: Could Safe-Sora be extended to embed dynamic watermarks (e.g., animated logos or video clips) instead of static images?\n\n**A2**: Safe-Sora's design principles naturally support extension to dynamic watermarks. Our method leverages content similarity analysis to segment watermark images into patches and adaptively embed them across optimal video positions. Dynamic watermarks (animated logos or video clips) can be conceptualized as multi-frame image sequences. **Our adaptive patch matching technique can similarly decompose these multi-frame sequences into spatial-temporal patches and intelligently select the most suitable embedding positions based on content similarity analysis.** This represents a promising and technically feasible direction that we plan to explore as a key focus in our future research endeavors."}, {"review_id": "z6AhsvT2iA", "reviewer": "Reviewer_B5T6", "summary": "This paper introduces Safe-Sora, a new framework for embedding graphical watermarks directly into the video generation process to ensure copyright preservation. It leverages a hierarchical coarse-to-fine adaptive matching mechanism and pioneers a 3D wavelet transform-enhanced Mamba architecture to robustly embed and extract watermarks, achieving state-of-the-art performance in video quality, watermark fidelity, and robustness.", "questions": "I'm not an expert in this field. I will consider raise my score if the authors can address my conserns.\n\n1. The proposed techniques, particularly the method of inserting watermarks by selecting specific video frames, appear to be directly borrowed from established image watermarking methods. The paper needs to clearly clarify which technical components are uniquely designed for video and justify their necessity beyond simple adaptation from the image domain. If the core techniques are indeed image-based, a comparison with state-of-the-art image watermarking solutions is need. Otherwise, the contribution that merely applying image techniques to video does not meet the bar for NeurIPS.\n\n2. While Figure 4 shows an improved invisibility when differences are amplified, it also suggests that several existing methods already achieve near-imperceptible watermark invisibility in their original state. The paper needs to further justify the practical significance of its incremental improvements in invisibility if the baseline methods already satisfy human perception requirements.\n\n3. The robustness evaluation primarily focuses on Gaussian blur and rotation. However, video compression is the most common processing applied to videos during transmission and storage. The authors should provide results about the robustness against various video compression standards to validate the practical utility of the method.\n\n4. How about the computational overhead of the proposed method?", "limitations": "Please see the questions.", "rating": 4, "confidence": 2, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 2, "significance": 2, "originality": 2, "strengths_and_weaknesses": "Strengths:\n1. This paper introduces a new method for embedding graphical watermarks directly into the video generation process.\n2. The proposed method achieves superior video quality, watermark fidelity, and robustness against distortions.\nWeaknesses:\n1. The proposed techniques seem to be used in the image watermarking field.\n2. The performance improvement is unclear. Prior methods have already achieved acceptable watermark and video quality.\n3. Insufficient experimental results about the robustness of the watermark.", "was_revised": true, "final_justification": "The authors have addressed most of my conserns.", "rebuttal": "Thank you for your valuable comments and recognition on our novel framework for embedding graphical watermarks directly into the video generation process and the superior performance in video quality, watermark fidelity, and robustness against distortions. We hope the following discussion can address your concerns!\n\n---\n\n> **Q1**: The paper needs to clearly clarify which technical components are uniquely designed for video and justify their necessity beyond simple adaptation from the image domain. If the core techniques are indeed image-based, a comparison with state-of-the-art image watermarking solutions is need. \n\n**A1**: A static image does not contain any temporal information. Typical image watermarking methods input both the watermark image and the cover image into the watermark embedding network to generate a stego image [1, 2]. For example, the classic graphical watermarking method UDH [2] concatenates the watermark image and cover image, then inputs them into a UNet, producing a stego image. **Unlike images, videos consist of multiple frames, and Figure 1 shows that watermarking performance significantly correlates with the visual similarity between the watermark and cover images. Therefore, how to appropriately allocate the watermark across the various frames is a key challenge.** \n\nTo address this challenge, Safe-Sora divides the watermark image into multiple patches and adaptively matches them to different positions across the frames. Furthermore, **considering the temporal relationships in videos**, we propose a spatiotemporal local scanning strategy to enhance the fusion and extraction of watermark information across both space and time.\n\nAdditionally, we compare Safe-Sora with state-of-the-art image watermarking solutions, such as PUSNet [3] and HiNet [4]. The comparison with PUSNet is provided in Table 1 of the main paper, and the comparison with HiNet is discussed in the following tables:\n\n| Method | PSNR ↑ | MAE ↓ | RMSE ↓ | SSIM ↑ | LPIPS ↓ |\n|-------|--------------------|-------------------|--------------------|--------------------|---------------------|\n| HiNet | 32.4               | 3.77              | 6.85               | 0.95               | 0.07                |\n| Ours  | **37.71**           | **2.22**          | **3.61**           | **0.97**           | **0.04**            |\n\n*Table 1: Watermark Quality Comparison with HiNet*\n\n\n| Method | PSNR ↑ | MAE ↓ | RMSE ↓ | SSIM ↑ | LPIPS ↓ | tLP ↓ | FVD ↓ |\n|--------|--------|--------|--------|--------|--------|--------|--------|\n| HiNet | 30.35 | 4.33 | 8.33 | 0.91 | 0.11 | 1.01 | 125.74 |\n| Ours     | **42.5** | **1.36** | **1.96** | **0.98** | **0.01** | **0.38** | **3.77** |\n\n\n*Table 2: Video Quality Comparison with HiNet.*\n\n\nExperimental results show that our method outperforms these state-of-the-art image watermarking approaches, highlighting the necessity of our video-tailored architectural innovations.\n\n\n> **Q2**: The paper needs to further justify the practical significance of its incremental improvements in invisibility if the baseline methods already satisfy human perception requirements. \n\n**A2**:  Figure 4 presents single-frame image comparison results. However, **videos fundamentally differ from single-frame images in their temporal dynamics.** Even when watermarks appear nearly imperceptible in individual frames, they can introduce temporal inconsistencies across multiple video frames, significantly degrading overall video quality and failing to meet human perceptual standards.\n\n**Qualitative Analysis:** Due to space constraints, Figure 5 visualizes multi-frame qualitative results exclusively for Safe-Sora. We will include comprehensive multi-frame qualitative comparisons with all baseline methods in the final version to provide a more complete evaluation.\n\n**Quantitative Analysis:** We employ FVD (Fréchet Video Distance) [5] and tLP [6] metrics to quantitatively assess video temporal consistency. As shown in Table 1 of the main paper, Safe-Sora substantially outperforms all baselines across both metrics. Notably, Safe-Sora achieves an FVD of 3.77, dramatically surpassing baseline methods (e.g., PUSNet: 154.35, Wengnet: 265.82). \n\nThese results clearly demonstrate that existing baseline methods exhibit significant limitations in maintaining temporal consistency, while **Safe-Sora effectively preserves temporal coherence in watermarked videos—a critical requirement for practical video watermarking applications.**\n\n> **Q3**: The authors should provide results about the robustness against various video compression standards to validate the practical utility of the method.\n\n**A3**: We follow the experimental setup for video compression robustness from previous literature [7, 8] and use the widely used H.264 compression to validate the robustness of our method, with the results shown in Figure 6. The results show that under H.264 compression, all baseline methods suffer a significant drop in performance, whereas **our method maintains high watermark quality**. In the final version of the paper, we will conduct more video compression robustness experiments to validate the practical utility of our method.\n\n> **Q4**: How about the computational overhead of the proposed method?\n\n**A4**: We provide comprehensive computational cost analysis covering both training and testing phases, along with performance metrics to demonstrate cost-effectiveness.\nTraining experiments are conducted on four RTX 4090 GPUs, while testing is performed on a single RTX 4090 GPU. Results are presented in the table below:\n\n|    | Balujanet | Wengnet | UDH     | HiNet   | PUSNet  | Safe-SD | Ours    |\n|-----------|-----------|---------|---------|---------|---------|---------|---------|\n| Training Time (h) | 8.06 | 8.89 | 7.4 | 23.93 | 29.47 | 43.37 | 38.16 |\n| Testing Time (s) | 0.0432 | 0.0494 | 0.2022 | 0.3441 | 1.1559 | 0.6817 | 0.3678 |\n| FVD↓ | 512.22 | 265.82 | 1075.62 | 125.74 | 154.35 | 849.83 | 3.77 |\n\n*Table 3: Computational speed between different methods.*\n\n**Testing Time**: During watermarked video generation, **the video generation process dominates the computational cost (46.8980s per video using VideoCrafter2 [9] on an RTX 4090), while watermark embedding time remains negligible across all methods.** Our method's testing time (0.3678s) is competitive with state-of-the-art approaches.\n\n**Training Time**: Although Safe-Sora requires longer training time, it demonstrates strong cost-effectiveness when compared to competitive baselines. To properly assess this trade-off, it's important to note that FVD (Fréchet Video Distance) serves as a key metric for evaluating watermarked video quality. The results reveal compelling evidence of efficiency: **compared to HiNet (the best-performing baseline with FVD 125.74), Safe-Sora requires only 1.6× training time while achieving dramatically superior performance—reducing FVD to just 3% of HiNet's value (3.77 vs. 125.74).** This substantial performance gain at modest computational overhead demonstrates a highly favorable performance-to-cost ratio, validating the practical efficiency of our approach.\n\n---\n\n[1] Hiding images within images. IEEE transactions on pattern analysis and machine intelligence 2019.\n\n[2] Udh: Universal deep hiding for steganography, watermarking, and light field messaging. NeurIPS 2020.\n\n[3] Purified and unified steganographic network. CVPR 2024.\n\n[4] Hinet: Deep image hiding by invertible network. ICCV 2021.\n\n[5] FVD: A new Metric for Video Generation. ICLR 2021.\n\n[6] Learning temporal coherence via self-supervision for gan-based video generation. ACM TOG 2020.\n\n[7] ItoV: Efficiently Adapting Deep Learning-based Image Watermarking to Video Watermarking. International Conference on Culture-Oriented Science and Technology 2023.\n\n[8] LVMark: Robust Watermark for latent video diffusion models. Arxiv 2024.\n\n[9] Videocrafter2: Overcoming data limitations for high-quality video diffusion models. CVPR 2024."}, {"review_id": "ogTMAZXNy9", "reviewer": "Reviewer_WgWy", "summary": "This paper studied the solution to embed invisible graphic watermarks into the AI-generated videos. Specifically, this paper proposed a deep-learning-based method, which utilized and trained deep learning models to embed and extract the watermark. This paper proposed two new techniques. The first is a coarse-to-fine adaptive matching mechanism to select the most suitable frames to embed the watermark. The second is a Mamba-based block integrated into the deep learning models to extract the features of the video. Experimental results demonstrated that the proposed method could surpass existing methods.", "questions": "Please see the weaknesses.", "limitations": "Yes", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 2, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths:\n\n1. The proposed two mechanisms are novel.\n2. This paper designed an effective block based on Mamba.\n3. The experimental results were promising.\n\nWeaknesses:\n\n1. The methodology section of this paper is confusingly written. While the authors focus heavily on their two proposed mechanisms, they lack a clear overall workflow description of the method. For instance, it's unclear how the watermarks are embedded and extracted. Furthermore, Section 3.4 on the loss function fails to specify which parameters are being optimized to minimize the objective. These omissions significantly reduce the readability of the paper.\n2. The method proposed in this paper is a post-processing algorithm, meaning that the watermark embedding and extraction are independent of the video generation model. Therefore, in this context, I believe the paper lacks comparison or discussion with traditional video watermarking methods (those also independent of generation models).\n3. Based on the results of the paper's ablation study, it appears that removing any single component has a minimal impact on the method's effectiveness. Both the watermark and video quality remain significantly higher than the baseline. The authors likely need to conduct further experiments to reveal which module truly contributes to the observed performance.\n4. Potential overclaim: The paper's claim of being the first to embed image watermarks into AI-generated videos might be an overclaim, considering that bitstrings and images are interconvertible (via reshape and flatten operations).", "was_revised": true, "final_justification": "The response addresses most of my concerns. I decided to maintain the positive rating.", "rebuttal": "Thank you for your valuable comments and recognition on our novel two mechanisms, effective Mamba-based block design, and promising experimental results that surpass existing methods. We hope the following discussion can address your concerns!\n\n---\n\n> **Q1**: The paper lacks a clear overall workflow description of the method. For instance, it's unclear how the watermarks are embedded and extracted. Furthermore, Section 3.4 on the loss function fails to specify which parameters are being optimized to minimize the objective. \n\n**A1**: The overall workflow of Safe-Sora is described in the caption of Figure 2. In general, our method consists of three stages: (1) **Watermark Preprocessing**: The Coarse-to-Fine Adaptive Patch Matching technique segments watermarks into patches, adaptively matches them to video locations, and upsamples them into feature maps; (2) **Watermark Embedding**: Watermark features integrate with video multi-scale features through a UNet with 2D SFMamba blocks, followed by 3D SFMamba blocks implementing our spatiotemporal scanning strategy; (3) **Watermark Extraction**: An extraction network with distortion layer, 3D SFMamba blocks, and position recovery module recovers the embedded watermark.\n\n**Optimization parameters**: All components are trainable except the frozen VAE encoder/decoder.\n\nWe will polish the paper carefully in the final version to improve the clarity and readability.\n\n> **Q2**: The method proposed in this paper is a post-processing algorithm, meaning that the watermark embedding and extraction are independent of the video generation model. Therefore, in this context, I believe the paper lacks comparison or discussion with traditional video watermarking methods.\n\n**A2**:  Typical post-processing watermarking methods [1,2,3] inject watermarks into ready-made **visible images or videos.** For example, the classic post-processing method UDH [2] concatenates the watermark image and cover image, then inputs them into a UNet to produce a watermarked image. However, our method embeds watermarks **within the video generation process**, when the video has not yet been exposed. This approach aligns with common practices in generative watermarking [4,5,6].\n\nUnlike previous generative image watermarking methods [4,5,6], for **generative video watermarking**, we propose *coarse-to-fine adaptive patch matching* to segment watermark images into patches and embed them into the most similar video frames. We also introduce a *spatiotemporal local scanning strategy* to enable enhanced fusion and extraction of watermark information across space and time.\n\nIn addition, **we compared our method with the traditional video watermarking method Wengnet, with results shown in Table 1 of the main paper.** Our experiments demonstrate that our approach comprehensively outperforms Wengnet across all metrics, particularly in temporal consistency (FVD [7]: 3.77 vs. 265.82)\n\n> **Q3**: The authors likely need to conduct further experiments to reveal which module truly contributes to the observed performance.\n\n**A3**: We have conducted ablation studies to evaluate the contribution of our two core components: Coarse-to-Fine Adaptive Patch Matching and Spatiotemporal Local Scanning.\n\nCoarse-to-Fine Adaptive Patch Matching: This component is motivated by our observation that watermark-image similarity significantly impacts watermarking performance. It segments the watermark image into patches and adaptively embeds them at different video locations in a coarse-to-fine manner. When this component is removed, both video quality and watermark recovery degrade substantially. For example, watermark quality deteriorates with RMSE increasing from 3.61 to 3.99, while video temporal consistency drops significantly with FVD increasing from 3.77 to 16.87.\n\nSpatiotemporal Local Scanning: This component leverages the frequency domain relationships in 3D wavelet transforms, performing scanning from low-to-high and high-to-low frequencies to enable enhanced fusion and extraction of watermark information across space and time. Without this component, temporal consistency is severely compromised, with FVD degrading from 3.77 to 13.16.\n\nThese ablation results demonstrate that both components are essential for achieving optimal performance.\nWe will include more comprehensive ablation experiments in the final version to provide a more thorough evaluation of each module's contribution.\n\n> **Q4**: The paper's claim of being the first to embed image watermarks into AI-generated videos might be an overclaim, considering that bitstrings and images are interconvertible (via reshape and flatten operations).\n\n**A4**: While bitstrings and images are interconvertible to some extent, **there is a fundamental difference in complexity and scale**. Previous works typically embed binary strings of 48 bits [4,6,8], whereas our method embeds 256×256 RGB images, which convert to 256×256×3×8 = 1,572,864 bits—approximately 32,000 times larger than traditional binary watermarks. **Therefore, embedding images can be viewed as an extremely high-capacity binary embedding task with significantly greater technical challenges.**\n\nMoreover, image watermarks offer distinct advantages over binary strings: they serve as more intuitive and visually recognizable evidence of ownership [2]. Such designs enhance both the perceptual clarity and practical reliability of copyright verification, making them more suitable for real-world applications.\n\nWe acknowledge the reviewer's concern and will carefully revise this claim in the final version to more accurately reflect the technical contributions and significance of our work.\n\n---\n\n[1] Hiding images within images. IEEE TPAMI 2019.\n\n[2] Udh: Universal deep hiding for steganography, watermarking, and light field messaging. NeurIPS 2020.\n\n[3] Purified and unified steganographic network. CVPR 2024.\n\n[4] The Stable Signature: Rooting Watermarks in Latent Diffusion Models. ICCV 2023.\n\n[5] WOUAF: Weight Modulation for User Attribution and Fingerprinting in Text-to-Image Diffusion Models. CVPR 2024.\n\n[6] LaWa: Using Latent Space for In-Generation Image Watermarking. ECCV 2024.\n\n[7] FVD: A new Metric for Video Generation. ICLR 2021.\n\n[8] LVMark: Robust Watermark for latent video diffusion models. Arxiv 2024."}, {"review_id": "c7wOxl8yPc", "reviewer": "Reviewer_VQjW", "summary": "This paper presents Safe-Sora, a novel framework that embeds graphical watermark into the video generation process. To minimize the impact of watermark embedding on video quality, the authors propose a coarse-to-fine adaptive matching mechanism. In addition, a state space model is employed to fuse watermark and video features, effectively preserving the spatiotemporal consistency of the generated video. Experimental results demonstrate that the proposed method can embed image watermarks while maintaining high visual quality for both the video and the watermark, and exhibits strong robustness against various distortions.", "questions": "1. In response to Weakness #1, it is recommended to clearly elaborate on how the proposed method differs from post-processing watermarking methods.\n2. In response to Weakness #2, a detailed analysis of the time or computational complexity should be provided.\n3. In the performance comparison experiments (Section 4.2), it is advisable to include comparisons with methods specifically designed for image steganography, such as HiNet[2], and to replace unsuitable baselines PUSNet.\n4. In the robustness experiments (Section 4.3), additional tests should be conducted under distortions such as random crop, frame insert, frame drop, and frame swap. Relevant experimental setups can refer to VideoShield[3].\n5. In Section D of the Technical Appendices: Additional Ablation Studies, while the impact of Multi-Scale Feature Injection is explored, the strategy used for feature injection after removing this component is not mentioned. This should be clarified.\n6. In the right subfigure of Fig. 1, it is suggested to revise the y-axis label from \"watermarking performance\" to PSNR, which would provide a clearer and more precise representation.\n7. Last but not least, given that the watermark embedding occurs at the feature in the decoder, a critical question arises: if a watermarked video is first encoded back into latent space using the same encoder, and then decoded again, would this process effectively remove the watermark? This scenario should be considered and discussed in the paper.\n\n[2] Jing, J., Deng, X., Xu, M., Wang, J., & Guan, Z. (2021). Hinet: Deep image hiding by invertible network. In Proceedings of the IEEE/CVF international conference on computer vision (pp. 4733-4742).\n[3] Hu, R., Zhang, J., Li, Y., Li, J., Guo, Q., Qiu, H., & Zhang, T. (2025). VideoShield: Regulating Diffusion-based Video Generation Models via Watermarking. arXiv preprint arXiv:2501.14195.", "limitations": "yes", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 2, "originality": 3, "strengths_and_weaknesses": "Strengths:\n1. This paper proposes a novel method that embeds graphical watermark into the video generation process, which diverges from methods that typically embed binary watermark. The novelty of adaptively embedding block-wise graphical watermark into generated video offers a meaningful contribution to the field of video watermarking.\n2. The proposed framework is described in detail. The paper employs intuitive illustrations to clearly convey the motivation behind the adaptive matching mechanism, and the method section is well-structured and easy to understand.\n3. Safe-Sora introduces the state space model into the field of video watermarking for the first time, along with a novel spatiotemporal local scanning strategy that effectively captures both intra-frame and inter-frame dependencies within video.\n\nWeaknesses:\n1. Although the paper claims to “embed graphical watermarks directly into the video generation process”, Fig. 2 and 7 indicate that the watermark embedding actually occurs during the transformation from latent representations to video (i.e., within the decoder). Therefore, I argue that categorizing this method as generative watermarking is somewhat misleading. In fact, the method adds the watermarking process to the decoder of latent diffusion model, which is conceptually closer to a post-processing watermarking method. The authors should more clearly articulate the methodological category to which their method belongs.\n2. The proposed watermarking method requires training before deployment, yet the paper lacks a detailed comparison with baselines in terms of time or computational complexity—for instance, training time or the time required for watermark embedding.\n3. In Section 4.1 on baseline selection, one of the baselines, PUSNet [1], is referred to by the authors as “a state-of-the-art image steganography network”. However, PUSNet is actually a model steganography method, designed to embed a steganography model into another cover model, rather than a method tailored for image steganography. Therefore, this comparison is inappropriate and potentially misleading.\n4. In the robustness experiments presented in Section 4.3, the range of tested distortions is too limited. In practice, common attacks on video watermarking include frame insert, frame drop, frame swap, and random crop, none of which are evaluated in this paper. A more comprehensive robustness evaluation is necessary.\n\n[1] Li, G., Li, S., Luo, Z., Qian, Z., & Zhang, X. (2024). Purified and unified steganographic network. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition (pp. 27569-27578).", "was_revised": true, "final_justification": "Thanks for the detailed rebuttal. The additional experiments and explanations provided by the author have adequately addressed my main concerns about the submission. Therefore, I am inclined to accept it.", "rebuttal": "Thank you for your valuable comments and recognition on our novel method for embedding graphical watermarks into the video generation process, well-structured methodology with intuitive illustrations, and pioneering introduction of state space models to video watermarking. We hope the following discussion can address your concerns!\n\n---\n\n> **Q1**: It is recommended to clearly elaborate on how the proposed method differs from post-processing watermarking methods.\n\n**A1**: Typical post-processing watermarking methods [1,2,3] inject watermarks into ready-made **visible images or videos.** For example, the classic post-processing method UDH [2] concatenates the watermark image and cover image, then inputs them into a UNet to produce a watermarked image.\n\n**However, Our method embeds watermarks during the VAE decoding process within video generation, when the video has not yet been exposed. This approach aligns with common practices in generative watermarking [4,5,6].**  For instance, the pioneering generative watermarking work Stable Signature [4] embeds watermarks in text-to-image generation by fine-tuning the VAE decoder. Similarly, WOUAF [5] injects watermark information into the VAE decoder through weight modulation techniques.\n\nUnlike previous generative image watermarking methods [4,5,6], for **generative video watermarking**, we propose *coarse-to-fine adaptive patch matching* to segment watermark images into patches and embed them into the most similar video frames. We also introduce a *spatiotemporal local scanning strategy* to enable enhanced fusion and extraction of watermark information across space and time.\n\n> **Q2**: A detailed analysis of the time or computational complexity should be provided.\n\n**A2**: We provide comprehensive computational cost analysis covering both training and testing phases, along with performance metrics to demonstrate cost-effectiveness.\nTraining experiments are conducted on four RTX 4090 GPUs, while testing is performed on a single RTX 4090 GPU. Results are presented in the table below:\n\n|    | Balujanet | Wengnet | UDH     | HiNet   | PUSNet  | Safe-SD | Ours    |\n|-----------|-----------|---------|---------|---------|---------|---------|---------|\n| Training Time (h) | 8.06 | 8.89 | 7.4 | 23.93 | 29.47 | 43.37 | 38.16 |\n| Testing Time (s) | 0.0432 | 0.0494 | 0.2022 | 0.3441 | 1.1559 | 0.6817 | 0.3678 |\n| FVD↓ | 512.22 | 265.82 | 1075.62 | 125.74 | 154.35 | 849.83 | 3.77 |\n\n*Table 1: Computational speed between different methods.*\n\n**Testing Time**: During watermarked video generation, **the video generation process dominates the computational cost (46.8980s per video using VideoCrafter2 [7] on an RTX 4090), while watermark embedding time remains negligible across all methods.** Our method's testing time (0.3678s) is competitive with state-of-the-art approaches.\n\n**Training Time**: Although Safe-Sora requires the second-longest training time, it demonstrates strong cost-effectiveness when compared to competitive baselines. To properly assess this trade-off, it's important to note that FVD (Fréchet Video Distance) [8] serves as a key metric for evaluating watermarked video quality. The results reveal compelling evidence of efficiency: **compared to HiNet (the best-performing baseline with FVD 125.74), Safe-Sora requires only 1.6× training time while achieving dramatically superior performance—reducing FVD to just 3% of HiNet's value (3.77 vs. 125.74).** This substantial performance gain at modest computational overhead demonstrates a highly favorable performance-to-cost ratio, validating the practical efficiency of our approach.\n\n> **Q3**: It is advisable to include comparisons with methods specifically designed for image steganography, such as HiNet, and to replace unsuitable baselines PUSNet.\n\n**A3**: We appreciate this suggestion and have conducted comprehensive comparisons with HiNet, a state-of-the-art image steganography method. The detailed experimental results are presented below:\n\n| Method | PSNR ↑ | MAE ↓ | RMSE ↓ | SSIM ↑ | LPIPS ↓ |\n|-------|--------------------|-------------------|--------------------|--------------------|---------------------|\n| HiNet | 32.4               | 3.77              | 6.85               | 0.95               | 0.07                |\n| Ours  | **37.71**           | **2.22**          | **3.61**           | **0.97**           | **0.04**            |\n\n*Table 2: Watermark Quality Comparison with HiNet*\n\n| Method | PSNR ↑ | MAE ↓ | RMSE ↓ | SSIM ↑ | LPIPS ↓ | tLP ↓ | FVD ↓ |\n|--------|--------|--------|--------|--------|--------|--------|--------|\n| HiNet | 30.35 | 4.33 | 8.33 | 0.91 | 0.11 | 1.01 | 125.74 |\n| Ours     | **42.5** | **1.36** | **1.96** | **0.98** | **0.01** | **0.38** | **3.77** |\n\n*Table 3: Video Quality Comparison with HiNet.*\n\nThe experimental results demonstrate that Safe-Sora significantly outperforms HiNet across all evaluation metrics. We will include HiNet in the final version to provide more comprehensive and appropriate comparisons.\n\n> **Q4**: In the robustness experiments, additional tests should be conducted under distortions such as random crop, frame insert, frame drop, and frame swap. Relevant experimental setups can refer to VideoShield.\n\n**A4**:  Due to time constraints, following VideoShields [9], we adopt temporal tamper (Frame Swap) and spatial tamper (Random Crop) to validate robustness, comparing our method against six baselines (including the additional HiNet baseline). We will include more comprehensive robustness experimental results in the final version. The preliminary results are shown below:\n\n| Method   | PSNR↑  | MAE↓  | RMSE↓ | SSIM↑ | LPIPS↓ |\n|----------|--------|-------|-------|-------|--------|\n| Balujanet| 25.33  | 9.56  | 15    | 0.91  | 0.11   |\n| Wengnet  | 33.37  | 3.64  | 5.68  | 0.96  | 0.06   |\n| UDH      | 22.85  | 11.37 | 19.33 | 0.74  | 0.28   |\n| HiNet    | 32.65  | 3.65  | 6.68  | 0.95  | 0.07   |\n| PUSNet   | 29     | 7.33  | 9.42  | 0.93  | 0.12   |\n| Safe-SD  | 25.11  | 8.74  | 15.8  | 0.86  | 0.09   |\n| Ours     | **37.53**  | **2.33**  | **3.69**  | **0.97**  | **0.05**   |\n\n*Table 4: Watermark Reconstruction Robustness under Frame Swap*\n\n| Method   | PSNR↑  | MAE↓  | RMSE↓ | SSIM↑ | LPIPS↓ |\n|----------|--------|-------|-------|-------|--------|\n| Balujanet| 17.46  | 21.9  | 35.58 | 0.62  | 0.31   |\n| Wengnet  | 13.9   | 38.2  | 53.72 | 0.45  | 0.48   |\n| UDH      | 6.53   | 101.2 | 121.58| 0.17  | 0.84   |\n| HiNet    | 9.84   | 75.54 | 84.48 | 0.4   | 0.58   |\n| PUSNet   | 14.98  | 33.55 | 47.39 | 0.49  | 0.45   |\n| Safe-SD  | 13.49  | 42.47 | 55.86 | 0.49  | 0.51   |\n| Ours     | **34.3**   | **3.15**  | **5.28**  | **0.96**  | **0.05**   |\n\n*Table 5: Watermark Reconstruction Robustness under Random Crop*\n\nThe experimental results demonstrate that our method exhibits strong robustness, **outperforming all baselines across evaluation metrics**.\n\n> **Q5**: While the impact of Multi-Scale Feature Injection is explored, the strategy used for feature injection after removing this component is not mentioned. This should be clarified.\n\n**A5**:  In our implementation, the VAE decoder produces multi-scale features F1, F2, F3, and F4 at different resolution levels.\n\n**With Multi-Scale Feature Injection:** All multi-scale features (F1, F2, F3, and F4) are fused with the watermark feature maps, enabling comprehensive integration across different spatial scales.\n\n**Without Multi-Scale Feature Injection:** Only the final layer feature F4 is fused with the watermark feature maps, representing a single-scale injection strategy.\n\nWe will polish this technical detail in the final version to ensure greater clarity.\n\n> **Q6**: In the right subfigure of Fig. 1, it is suggested to revise the y-axis label from \"watermarking performance\" to PSNR.\n\n**A6**: We will revise it in the final version to provide a clearer and more precise representation.\n\n> **Q7**: If a watermarked video is first encoded back into latent space using the same encoder, and then decoded again, would this process effectively remove the watermark?\n\n**A7**: We conducted robustness experiments to evaluate watermark preservation under VAE reconstruction (encode-decode process). The experimental results are presented below:\n\n| Method   | PSNR↑ | MAE↓  | RMSE↓ | SSIM↑ | LPIPS↓ |\n|----------|-------|-------|-------|-------|--------|\n| Balujanet | 16.04 | 24.57 | 42.01 | 0.57  | 0.44   |\n| Wengnet   | 7.27  | 103.1 | 112.76| 0.21  | 0.74   |\n| UDH       | 6.06  | 102.45| 127.65| 0.14  | 0.83   |\n| HiNet     | 9     | 79.98 | 93.21 | 0.33  | 0.65   |\n| PUSNet    | 8.81  | 76.9  | 95.53 | 0.26  | 0.71   |\n| Safe-SD   | 6.67  | 93.37 | 121.42| 0.39  | 0.84   |\n| Ours      | **28.32** | **6.42**  | **10.35** | **0.88**  | **0.15**   |\n\n*Table 6: Watermark Reconstruction Robustness under VAE Reconstruction*\n\nThe results demonstrate that while all baseline methods suffer severe watermark degradation under this challenging attack, **Safe-Sora maintains superior watermark quality across all metrics**. In the future, we will explore the exclusive techniques to improve the watermarking robustness under this attack.\n\n---\n\n[1] Hiding images within images. IEEE transactions on pattern analysis and machine intelligence 2019.\n\n[2] Udh: Universal deep hiding for steganography, watermarking, and light field messaging. NeurIPS 2020.\n\n[3] Purified and unified steganographic network. CVPR 2024.\n\n[4] The Stable Signature: Rooting Watermarks in Latent Diffusion Models. ICCV 2023.\n\n[5] WOUAF: Weight Modulation for User Attribution and Fingerprinting in Text-to-Image Diffusion Models. CVPR 2024.\n\n[6] LaWa: Using Latent Space for In-Generation Image Watermarking. ECCV 2024.\n\n[7] Videocrafter2: Overcoming data limitations for high-quality video diffusion models. CVPR 2024.\n\n[8] FVD: A new Metric for Video Generation. ICLR 2021.\n\n[9] VideoShield: Regulating Diffusion-based Video Generation Models via Watermarking. Arxiv 2025."}]

Author rebuttal:

Meta-review: This work proposed Safe-Sora, the first framework to embed graphical watermarks directly into the video generation process for reliable copyright preservation of AI-generated content. Safe-Sora demonstrates significant potential to advance video watermarking research and protect intellectual property in the era of generative AI. The authors propose a coarse-to-fine adaptive matching strategy that embeds watermark patches into visually similar spatiotemporal locations in the video, pioneering a 3D wavelet transform-enhanced Mamba architecture to robustly embed and extract watermarks.

This work has two significant strengths as follows.

- Novelty. This paper proposes a novel method that embeds graphical watermark into the video generation process, which diverges from methods that typically embed binary watermark. The novelty of adaptively embedding block-wise graphical watermark into generated video offers a meaningful contribution to the field of video watermarking.
- Comprehensive empirical analysis. The evaluation and analysis, as well as the ablations, seem comprehensive; the authors use benchmarks against image watermarking, video steganography, and generative watermarking baselines, showing clear improvements in watermark recovery and video quality, as well as demonstrating resilience to various real-world distortions, including compression, blur, and erasing.

The reviewers mentioned multiple concerns including adversary detection, limited scope, and technical clarity. The authors have addressed most concerns raised by the reviewers to some extent. This is a complete and novel work. 

Given the consensus that three reviewers gave the borderline accept, I recommend Accept (Poster).
Decision: Accept (poster)