VIDSTAMP: A Temporally-Aware Watermark for Ownership and Integrity in Video Diffusion Models

TL;DR

VidStamp proposes a temporally aware, decoder-integrated watermarking framework for video diffusion models, embedding frame-level messages directly into the latent decoding process to enable provenance and tamper localization with zero inference overhead. The method uses a two-stage fine-tuning of the D-VAE (first on COCO images, then on model-generated videos) to achieve high capacity and temporal consistency, and supports static and dynamic watermarking through a latent message adder. Empirical results across SVD, OpenSora, and Wan show high bit accuracy (≈0.95–0.98) with 48 bits per frame (768 bits per video), robust performance under multiple distortions, and superior log $P$ detectability compared with baselines like VideoSeal and VideoShield. VidStamp also delivers precise frame-level tamper localization (≈0.96 accuracy) and demonstrates negligible perceptual degradation, making decoder-integrated watermarking a practical solution for scalable ownership verification and integrity in AI-generated video systems.

Abstract

Video diffusion models can generate realistic and temporally consistent videos. This raises concerns about provenance, ownership, and integrity. Watermarking can help address these issues by embedding metadata directly into the content. To work well, a watermark needs enough capacity for meaningful metadata. It must also stay imperceptible and remain robust to common video manipulations. Existing methods struggle with limited capacity, extra inference cost, or reduced visual quality. We introduce VidStamp, a watermarking framework that embeds frame-level messages through the decoder of a latent video diffusion model. The decoder is fine-tuned in two stages. The first stage uses static image datasets to encourage spatial message separation. The second stage uses synthesized video sequences to restore temporal consistency. This approach enables high-capacity watermarks with minimal perceptual impact. VidStamp also supports dynamic watermarking through a control signal that selects message templates during inference. This adds flexibility and creates a second channel for communication. We evaluate VidStamp on Stable Video Diffusion (I2V), OpenSora, and Wan (T2V). The system embeds 48 bits per frame while preserving visual quality and staying robust to common distortions. Compared with VideoSeal, VideoShield, and RivaGAN, it achieves lower log P-values and stronger detectability. Its frame-wise watermarking design also enables precise temporal tamper localization, with an accuracy of 0.96, which exceeds the VideoShield baseline. Code: https://github.com/SPIN-UMass/VidStamp

Figures (9)

• Figure 1: Overview of the threat model. VidStamp embeds metadata during generation inside a trusted model environment, while the adversary interacts only with the output video. Two security goals are considered: establishing model ownership and user traceability, and detecting temporal tampering such as frame swaps, insertions, and drops.
• Figure 2: VidStamp training pipeline. The decoder is fine-tuned to embed watermark messages into video frames using per-frame message and perceptual losses. A pretrained extractor supervises recovery. The framework supports static watermarking with fixed messages and dynamic watermarking, where a control signal selects message templates during inference.
• Figure 3: Bit accuracy under 11 video distortions. VidStamp maintains high accuracy across most distortions, and the LDPC variant improves performance.
• Figure 4: LDPC codes improve word accuracy significantly when there is no explicit distortion applied ("none") and when there are other common distortions .
• Figure 5: Tamper Localization Accuracy vs. Number of Frame Swaps. Localization accuracy remains high even as the number of swapped frame pairs increases, showing VidStamp’s robustness to temporal reordering.