Title: Safe-Sora: Safe Text-to-Video Generation via Graphical Watermarking
Venue: NeurIPS 2025
Accepted: yes
Keywords: AI Safety

Copyright-Preservation
Abstract: The explosive growth of generative video models has amplified the demand for
reliable copyright preservation of AI-generated content. Despite its popularity in
image synthesis, invisible generative watermarking remains largely underexplored
in video generation. To address this gap, we propose Safe-Sora, the first framework
to embed graphical watermarks directly into the video generation process. Motivated by the observation that watermarking performance is closely tied to the visual
similarity between the watermark and cover content, we introduce a hierarchical
coarse-to-fine adaptive matching mechanism. Specifically, the watermark image is
divided into patches, each assigned to the most visually similar video frame, and
further localized to the optimal spatial region for seamless embedding. To enable
spatiotemporal fusion of watermark patches across video frames, we develop a 3D
wavelet transform-enhanced Mamba architecture with a novel scanning strategy,
effectively modeling long-range dependencies during watermark embedding and
retrieval. To the best of our knowledge, this is the first attempt to apply state space
models to watermarking, opening new avenues for efficient and robust watermark
protection. Extensive experiments demonstrate that Safe-Sora achieves state-of-the-
art performance in terms of video quality, watermark fidelity, and robustness, which
is largely attributed to our proposals. Code and additional supporting materials are
provided in the supplementary.


Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper presents Safe-Sora, a novel framework that embeds graphical watermark into the video generation process. To minimize the impact of watermark embedding on video quality, the authors propose a coarse-to-fine adaptive matching mechanism. In addition, a state space model is employed to fuse watermark and video features, effectively preserving the spatiotemporal consistency of the generated video. Experimental results demonstrate that the proposed method can embed image watermarks while maintaining high visual quality for both the video and the watermark, and exhibits strong robustness against various distortions.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\n1. This paper proposes a novel method that embeds graphical watermark into the video generation process, which diverges from methods that typically embed binary watermark. The novelty of adaptively embedding block-wise graphical watermark into generated video offers a meaningful contribution to the field of video watermarking.\n2. The proposed framework is described in detail. The paper employs intuitive illustrations to clearly convey the motivation behind the adaptive matching mechanism, and the method section is well-structured and easy to understand.\n3. Safe-Sora introduces the state space model into the field of video watermarking for the first time, along with a novel spatiotemporal local scanning strategy that effectively captures both intra-frame and inter-frame dependencies within video.\n\nWeaknesses:\n1. Although the paper claims to “embed graphical watermarks directly into the video generation process”, Fig. 2 and 7 indicate that the watermark embedding actually occurs during the transformation from latent representations to video (i.e., within the decoder). Therefore, I argue that categorizing this method as generative watermarking is somewhat misleading. In fact, the method adds the watermarking process to the decoder of latent diffusion model, which is conceptually closer to a post-processing watermarking method. The authors should more clearly articulate the methodological category to which their method belongs.\n2. The proposed watermarking method requires training before deployment, yet the paper lacks a detailed comparison with baselines in terms of time or computational complexity—for instance, training time or the time required for watermark embedding.\n3. In Section 4.1 on baseline selection, one of the baselines, PUSNet [1], is referred to by the authors as “a state-of-the-art image steganography network”. However, PUSNet is actually a model steganography method, designed to embed a steganography model into another cover model, rather than a method tailored for image steganography. Therefore, this comparison is inappropriate and potentially misleading.\n4. In the robustness experiments presented in Section 4.3, the range of tested distortions is too limited. In practice, common attacks on video watermarking include frame insert, frame drop, frame swap, and random crop, none of which are evaluated in this paper. A more comprehensive robustness evaluation is necessary.\n\n[1] Li, G., Li, S., Luo, Z., Qian, Z., & Zhang, X. (2024). Purified and unified steganographic network. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition (pp. 27569-27578).\n\nQUESTIONS:\n1. In response to Weakness #1, it is recommended to clearly elaborate on how the proposed method differs from post-processing watermarking methods.\n2. In response to Weakness #2, a detailed analysis of the time or computational complexity should be provided.\n3. In the performance comparison experiments (Section 4.2), it is advisable to include comparisons with methods specifically designed for image steganography, such as HiNet[2], and to replace unsuitable baselines PUSNet.\n4. In the robustness experiments (Section 4.3), additional tests should be conducted under distortions such as random crop, frame insert, frame drop, and frame swap. Relevant experimental setups can refer to VideoShield[3].\n5. In Section D of the Technical Appendices: Additional Ablation Studies, while the impact of Multi-Scale Feature Injection is explored, the strategy used for feature injection after removing this component is not mentioned. This should be clarified.\n6. In the right subfigure of Fig. 1, it is suggested to revise the y-axis label from \"watermarking performance\" to PSNR, which would provide a clearer and more precise representation.\n7. Last but not least, given that the watermark embedding occurs at the feature in the decoder, a critical question arises: if a watermarked video is first encoded back into latent space using the same encoder, and then decoded again, would this process effectively remove the watermark? This scenario should be considered and discussed in the paper.\n\n[2] Jing, J., Deng, X., Xu, M., Wang, J., & Guan, Z. (2021). Hinet: Deep image hiding by invertible network. In Proceedings of the IEEE/CVF international conference on computer vision (pp. 4733-4742).\n[3] Hu, R., Zhang, J., Li, Y., Li, J., Guo, Q., Qiu, H., & Zhang, T. (2025). VideoShield: Regulating Diffusion-based Video Generation Models via Watermarking. arXiv preprint arXiv:2501.14195.\n\nLIMITATIONS:\nyes", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 2, "ORIGINALITY": 3, "DATE": "2025-06-24"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper studied the solution to embed invisible graphic watermarks into the AI-generated videos. Specifically, this paper proposed a deep-learning-based method, which utilized and trained deep learning models to embed and extract the watermark. This paper proposed two new techniques. The first is a coarse-to-fine adaptive matching mechanism to select the most suitable frames to embed the watermark. The second is a Mamba-based block integrated into the deep learning models to extract the features of the video. Experimental results demonstrated that the proposed method could surpass existing methods.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\n\n1. The proposed two mechanisms are novel.\n2. This paper designed an effective block based on Mamba.\n3. The experimental results were promising.\n\nWeaknesses:\n\n1. The methodology section of this paper is confusingly written. While the authors focus heavily on their two proposed mechanisms, they lack a clear overall workflow description of the method. For instance, it's unclear how the watermarks are embedded and extracted. Furthermore, Section 3.4 on the loss function fails to specify which parameters are being optimized to minimize the objective. These omissions significantly reduce the readability of the paper.\n2. The method proposed in this paper is a post-processing algorithm, meaning that the watermark embedding and extraction are independent of the video generation model. Therefore, in this context, I believe the paper lacks comparison or discussion with traditional video watermarking methods (those also independent of generation models).\n3. Based on the results of the paper's ablation study, it appears that removing any single component has a minimal impact on the method's effectiveness. Both the watermark and video quality remain significantly higher than the baseline. The authors likely need to conduct further experiments to reveal which module truly contributes to the observed performance.\n4. Potential overclaim: The paper's claim of being the first to embed image watermarks into AI-generated videos might be an overclaim, considering that bitstrings and images are interconvertible (via reshape and flatten operations).\n\nQUESTIONS:\nPlease see the weaknesses.\n\nLIMITATIONS:\nYes", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 3, "CLARITY": 2, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-06-26"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper introduces Safe-Sora, a new framework for embedding graphical watermarks directly into the video generation process to ensure copyright preservation. It leverages a hierarchical coarse-to-fine adaptive matching mechanism and pioneers a 3D wavelet transform-enhanced Mamba architecture to robustly embed and extract watermarks, achieving state-of-the-art performance in video quality, watermark fidelity, and robustness.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\n1. This paper introduces a new method for embedding graphical watermarks directly into the video generation process.\n2. The proposed method achieves superior video quality, watermark fidelity, and robustness against distortions.\nWeaknesses:\n1. The proposed techniques seem to be used in the image watermarking field.\n2. The performance improvement is unclear. Prior methods have already achieved acceptable watermark and video quality.\n3. Insufficient experimental results about the robustness of the watermark.\n\nQUESTIONS:\nI'm not an expert in this field. I will consider raise my score if the authors can address my conserns.\n\n1. The proposed techniques, particularly the method of inserting watermarks by selecting specific video frames, appear to be directly borrowed from established image watermarking methods. The paper needs to clearly clarify which technical components are uniquely designed for video and justify their necessity beyond simple adaptation from the image domain. If the core techniques are indeed image-based, a comparison with state-of-the-art image watermarking solutions is need. Otherwise, the contribution that merely applying image techniques to video does not meet the bar for NeurIPS.\n\n2. While Figure 4 shows an improved invisibility when differences are amplified, it also suggests that several existing methods already achieve near-imperceptible watermark invisibility in their original state. The paper needs to further justify the practical significance of its incremental improvements in invisibility if the baseline methods already satisfy human perception requirements.\n\n3. The robustness evaluation primarily focuses on Gaussian blur and rotation. However, video compression is the most common processing applied to videos during transmission and storage. The authors should provide results about the robustness against various video compression standards to validate the practical utility of the method.\n\n4. How about the computational overhead of the proposed method?\n\nLIMITATIONS:\nPlease see the questions.", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 2, "CLARITY": 2, "IMPACT": 2, "ORIGINALITY": 2, "DATE": "2025-07-05"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper introduces a framework for embedding graphical watermarks into the video generation process of text-to-video diffusion models, called safe-sora. The authors propose a coarse-to-fine adaptive matching strategy that embeds watermark patches into visually similar spatiotemporal locations in the video.\n\nSTRENGTHS AND WEAKNESSES:\nThe problem of watermarking video-generation is important and relevant, it addresses, among others, the question of copyright protection for generated video content. To the best of my knowledge (which is limited in the domain), this seems to be the first application of state space models (Mamba) and 3D wavelet transforms for video watermarking, combined with a sophisticated patch matching mechanism. The evaluation and analysis, as well as the ablations, seem comprehensive; the authors use benchmarks against image watermarking, video steganography, and generative watermarking baselines, showing clear improvements in watermark recovery and video quality, as well as demonstrating resilience to various real-world distortions, including compression, blur, and erasing.\n\nThere is currently no discussion as to whether a knowledgeable adversary could detect or remove the watermark, covering this question seems important to discuss the method in full. Further, the method is currently restricted to static image watermarks; dynamic or more complex watermarks (e.g., videos) are left for future work, and embedding performance relies on matching the watermark to semantically similar video regions, which may limit generalisability.\n\nQUESTIONS:\n* How resilient is Safe-Sora to adversarial attempts to detect or remove the embedded watermark? Have you tested watermark removal attacks (e.g., inpainting, adversarial noise, filtering)?\n* Could Safe-Sora be extended to embed dynamic watermarks (e.g., animated logos or video clips) instead of static images? (Even if not implemented, a discussion of the technical challenges and design considerations for dynamic watermarks would be valuable.)\n\nLIMITATIONS:\nYes", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 1, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-07-05"}