Research map / Video / Video generation
VideoShield: Regulating Diffusion-based Video Generation Models via Watermarking
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes VideoShield, a training-free watermarking framework that embeds multi-bit watermarks into diffusion video noise during generation and uses DDIM inversion plus template bits for extraction and temporal/spatial tamper localization.
Problem
Content control for AI-generated videos: existing watermarks are applied frame-by-frame in post-processing (degrading quality), and existing tamper localization cannot detect temporal tampering and relies on training.
Approach
Map watermark bits to template bits (via ChaCha20 encryption) that condition truncated Gaussian sampling of the initial diffusion noise, so the generated video inverts back to watermarked noise via DDIM inversion; per-pixel template bits enable fragile, position-sensitive tamper localization with a hierarchical spatial-temporal refinement module, all without training.
Key results
- VideoShield embeds 512 bits with bit accuracy 1.000 on ModelScope and 0.999 on SVD, with video quality 0.806 and 0.836, versus 0.753-0.804 for post-processing baselines.
- Temporal tamper localization accuracy is 1.000 on ModelScope and 0.936 on SVD.
- Spatial tamper localization average on Crop&Drop reaches 0.906 (ModelScope) and 0.761 (SVD), well above MVSS-Net, OSN, PSCC-Net and HiFi-Net.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| embed watermarks during generation with VideoShield instead of post-processing watermark methods | Video generation with ModelScope · ModelScope | Video Quality: 0.804 -> 0.806 | Helped |
| use VideoShield rather than image watermark baselines applied frame by frame | ModelScope and Stable-Video-Diffusion video generation · ModelScope and Stable-Video-Diffusion | Bit Accuracy: 1.000 vs 1.000; 0.999 vs 1.000 | No clear effect |
| use VideoShield for temporal localization of frame swaps, insertions, and drops | ModelScope · Frame Swap, Frame Insert, Frame Drop | Accuracy: 1.000 | Helped |
| use VideoShield instead of the strongest reported spatial-localization baseline | ModelScope video localization · ModelScope, STTN / ProPainter / Crop&Drop | Average: 0.561 -> 0.886; 0.563 -> 0.900; 0.529 -> 0.906 | Helped |
| use VideoShield instead of the strongest reported spatial-localization baseline | Stable-Video-Diffusion video localization · Stable-Video-Diffusion, STTN / ProPainter / Crop&Drop | Average: 0.466 -> 0.764; 0.446 -> 0.767; 0.518 -> 0.761 | Helped |
| add PTB to HSTR rather than omitting PTB (ablation) | VideoShield · ModelScope spatial localization | Average: 0.857 -> 0.906 | Helped |
| add PTB to HSTR rather than omitting PTB (ablation) | VideoShield · Stable-Video-Diffusion spatial localization | Average: 0.689 -> 0.761 | Helped |
| set PTB quantile k to 99 instead of 100 (ablation) | VideoShield · ModelScope spatial localization | Average: 0.887 -> 0.906 | Helped |
| set PTB quantile k to 98 instead of 100 (ablation) | VideoShield · Stable-Video-Diffusion spatial localization | Average: 0.714 -> 0.761 | Helped |
| vary HSTR total hierarchical level L (ablation) | VideoShield · ModelScope and Stable-Video-Diffusion spatial localization | Precision | Helped |
| vary HSTR total hierarchical level L beyond the stated threshold (ablation) | VideoShield · ModelScope and Stable-Video-Diffusion spatial localization | Recall | Hurt |
| adjust PTB thresholds using distortions during distribution testing (ablation) | VideoShield · ModelScope spatial localization under distortions | Average: 0.672 -> 0.740 | Helped |
Surprising findings
- Baseline post-processing watermark methods show near-chance spatial localization on generated videos, with HiFi-Net flagging almost every frame as tampered.
- Under distortions, the fixed threshold derived from clean videos degrades localization on SVD (0.761 clean vs 0.616 average distorted), motivating threshold adjustment.
Limitations
- Spatial localization performance on SVD is lower (about 0.76) than on ModelScope, attributed to lower video quality.
- Robustness of spatial localization drops under distortions, requiring threshold re-tuning with random distortions.
- Baselines for proactive tamper localization (EditGuard, V2A-Mark) could not be compared due to lack of open-source code.
Experimental setup
Datasets: VBench prompts Stable-Diffusion-Prompts
Benchmarks: VBench quality metrics on ModelScope and SVD generated videos STTN and ProPainter inpainting tampers Crop&Drop tampers Frame Swap/Insert/Drop temporal tampers
Metrics: Bit Accuracy Video Quality (VBench average) Accuracy (temporal) F1 Precision Recall AUC IoU
Baselines: RivaGAN MBRS CIN PIMoG SepMark MVSS-Net OSN PSCC-Net HiFi-Net
Builds on: Gaussian Shading DDIM Inversion Tree-Ring EditGuard
Closest papers by meaning
- Safe-Sora: Safe Text-to-Video Generation via Graphical Watermarking (NeurIPS 2025 · similarity 0.88)
- Shallow Diffuse: Robust and Invisible Watermarking through Low-Dim Subspaces in Diffusion Models (NeurIPS 2025 · similarity 0.86)
- BitMark: Watermarking Bitwise Autoregressive Image Generative Models (NeurIPS 2025 · similarity 0.86)
- Robust Watermarking Using Generative Priors Against Image Editing: From Benchmarking to Advances (ICLR 2025 · similarity 0.86)
- SleeperMark: Towards Robust Watermark against Fine-Tuning Text-to-image Diffusion Models (CVPR 2025 · similarity 0.86)
- T2SMark: Balancing Robustness and Diversity in Noise-as-Watermark for Diffusion Models (NeurIPS 2025 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.