Asymmetric Phase Coding Video Watermarking

arXiv:2608.29212v1 [cs.CR] 29 Aug 2026

Asymmetric Phase Coding Video Watermarking Guang Yang Phi Lab Foundation

Fengchen Liu University of California, Berkeley

guang.yang@philab.fund

fengchenliu@berkeley.edu

Abstract

ing method it evaluates, with both false-negative and falsepositive rates driven to one under small perturbations, and attributes this to training that anticipates removal but not forgery [26]. Recent theory reaches the matching conclusion from the other side: robustness and public detectability are jointly hard to achieve, and schemes that publish their detector give the attacker the removal oracle for free [12].

Existing video watermarking systems are symmetric: the party that can verify a mark holds the extractor weights or generator secret and can therefore also embed one. Benchmarks confirm the consequence, reporting that whitebox forgery defeats all evaluated methods. We present a training-free video watermark that removes the shared secret. The signer embeds a complete Ed25519 signature into the phase spectrum of the chroma plane; any party holding the 32-byte public key and public per-video metadata verifies offline, with no model, no registry, and no network. The payload, 1024 bits of signed message with error correction, is an order of magnitude above common learned payloads and is carried by three design elements: a run-length temporal layout whose decoder identifies payload groups by correlation and never reads a frame index, a payload-free search that recovers scale, rotation, and translation from the carrier itself, and a closed-loop signing procedure that selects each video’s embedding strength by self-verification through the unchanged public verifier. On 1000 uncurated real-world clips the system ships a verifying signature for 99.3% of the corpus and accepts a wrong public key zero times in 1000 attempts. An attack-aware acceptance gate yields embeddings that survive H.264 re-encoding at 100% and 50% rescaling at 97.4% on gated clips. The signature also verifies through a real display and capture loop, an axis absent from published evaluations.

Public-key cryptography resolved this exact problem for messages half a century ago: signing is private, verification is public, and verification grants no signing power. This paper carries that separation into video pixels. The signer embeds a complete Ed25519 signature into the chroma phase spectrum of the video. Any party holding the 32-byte public key, a public per-video nonce, and the message length verifies offline. There is no extractor secret to leak, because the extractor is public by design. Forging a mark that verifies under the target key requires forging Ed25519, not probing a neural detector [4]. The obstacle is capacity under distortion. A signature payload with framing and error correction is 1024 bits, an order of magnitude above the 96 to 128 bits common in learned systems [3, 15], and it must survive transform coding, frame-rate changes, and rescaling without any learned decoder to absorb the damage. A wrong answer is also worse than a missing answer: a signature that “almost verifies” does not exist, so the transport layer must deliver the payload essentially intact or the check fails. Four design choices meet these constraints, and each was selected by measurement. First, the payload rides on mid-band phase of the Cr chroma plane, where codecs spend few bits and the eye tolerates change; the embedding amplitude is set from a per-frame distortion target. Second, a run-length temporal layout holds each payload group for a run of consecutive frames, and the decoder identifies groups by correlation without ever reading a frame index, which is what survives frame-rate conversion and real screen recording. Third, a payload-free synchronization search recovers scale, rotation, and translation from the carrier itself before decoding. Fourth, the distortion target is not fixed: a closed-loop signing procedure descends a small ladder of targets and accepts the first embedding that verifies through the public

1. Introduction Video watermarking has made rapid progress on robustness. Learned systems survive strong compression, rescaling, and editing, and ship in production pipelines [15, 35]. Yet nearly the entire field shares one structural property: verification is symmetric. Whoever can check a mark holds the extractor weights or the generator secret, and that party could equally embed a mark of its own. Detection capability and signing capability are the same capability. The consequence is measurable. VideoMarkBench reports that white-box forgery succeeds against every video watermark1

SIGNER

fail: descend one rung 42 → 40 → 38 → 36 dB (reserve 34/32)

holds the private key

message m (32 B)

Ed25519 sign

m k Sig sk (m)

private key: never leaves

VERIFIER

embed: Cr mid-band phase run-length groups at rung PSNR target

framing + RS parity

→ 1024-bit payload

H.264 encode

public nonce → SHA-256 → bins & phases

public verify (own output)

pass

signed video + {nonce, mode, length}

video file + public metadata channel: CRF, rescale, 24 fps, recording

public key only; anyone can run it

VERIFIED NOT VERIFIED

Ed25519 verify public key (32 B)

RS decode

run-length decode (no frame index)

→ m k Sig

sync search: scale, rotation, translation (payload-free)

received video (possibly attacked)

Figure 1. System overview. The signer (top) signs the message with its private Ed25519 key, frames it with Reed–Solomon parity into a 1024-bit payload, and embeds it into mid-band Cr phase in run-length groups; bin positions and phases derive from a public per-video nonce. Signing is closed-loop: the encoded output is checked with the public verifier, and on failure the signer descends one rung of the PSNR-target ladder and re-embeds. The verifier (bottom) is fully public: payload-free synchronization, index-free run-length decoding, Reed–Solomon decoding, and the Ed25519 check yield VERIFIED or NOT VERIFIED. No secret crosses the boundary between the two lanes.

verifier, so every video is signed at its own operating point. We evaluate end to end, with the actual signature check as the acceptance criterion and wrong-key controls in every run. On a controlled three-clip benchmark with eleven attacks, the signature verifies through H.264 at CRF 23 and 28, 50% downscaling, 30 to 24 fps conversion, noise, and brightness change, with bit accuracy at or near 1.0, while a matched-payload learned baseline decodes at chance on several of these axes. On 1000 uncurated real-world clips, closed-loop signing ships a verifying signature for 993 clips (99.3%), and a wrong public key is accepted zero times in 1000 attempts. An attack-aware acceptance gate produces embeddings that survive H.264 re-encoding at 100% and rescaling at 97.4% on gated clips. The same configuration survives a real display and capture loop through a video player and screen recorder, an evaluation axis absent from prior video watermarking evaluations. Scope is stated as precisely as the claims. VERIFIED means the extracted message carries a valid signature under the given key; failure means the check could not complete and nothing more. The signature binds the message bytes, not the surrounding pixels. We additionally evaluate, at small scale, a fuzzy-commitment-style extension that associates the signed message with a robust content feature [8, 29], and we report its tested scope explicitly. Visible geometric edits such as cropping are outside the design threat model: an edit the eye can see does not need cryptography to be noticed. Our contributions are: • a training-free video watermark that embeds and publicly verifies real Ed25519 signatures; to the best of our knowledge, it is the first video watermarking system in which verification confers no embedding capability;

• a run-length temporal coding layer whose decoder never consults the received frame index, verified against framerate conversion where a frame-indexed layout fails at chance; • closed-loop signing: because verification is public and self-contained, the signer selects each video’s embedding strength by running the true acceptance test locally; on 1000 uncurated clips this ships verifying signatures for 99.3% of the corpus with zero wrong-key accepts, and an attack-aware gate turns attack survival into a signing-time decision; • an end-to-end evaluation protocol whose acceptance criterion is the cryptographic check itself, including wrongkey negatives in every configuration, a corpus-scale study, and a real screen-recording loop.

2. Related Work Learned video watermarking. Deep encoder-decoder systems descend from image models such as HiDDeN and MBRS [25, 46] and now span two families. Post-hoc systems mark existing pixels: RivaGAN uses attention to place bits [42], DVMark embeds at multiple scales [33], Video Seal scales training to production and reaches 96 bits [15], Pixel Seal refines it with adversarial-only objectives [35], FlowMark masks embedding by motion [3], DINVMark uses an invertible network [24], SPDMark displaces network parameters [13], and ItoV adapts image models to video and reports simulated screen-recording robustness [40]. In-generation systems mark the sampling process of a video diffusion model: VideoShield maps watermark bits into the initial noise [19], and Stable Signature and Gaussian Shading are the image ancestors [14, 39], with VidStamp, LVMark, VideoMark, Video 2

host frame

Cr residual (× amplified)

signed frame (42 dB)

mean residual spectrum

Figure 2. A signed frame produced by the shipped implementation. The payload, a 1024-bit Ed25519-signed message, modulates midband phase of the Cr chroma plane; this clip accepted the mildest 42 dB rung of the signing ladder. The residual is visually structureless, and its spectrum averaged over 48 frames concentrates in the public carrier band of 0.05 to 0.12 cycles per pixel (dashed annulus), where transform coding preserves it. Any holder of the 32-byte public key verifies offline.

Signature, and SIGMark extending capacity and blind extraction [20, 21, 23, 37, 47]. Payloads range from 32 to a few hundred bits in the post-hoc family; SIGMark reaches 8192 bits but requires the generation-side latent pathway. In every one of these systems the verifier’s artifact, extractor weights or generator secret, suffices to embed, so verification implies signing capability. Our system differs at that root: verification uses a public key that confers no embedding power, and the payload is a real signature rather than an identifier looked up elsewhere.

able schemes exist with cryptographic guarantees [11, 32], and Puppy provides public verifiability through interactive protocols [22]; none of these transports a signature through video pixels. Copy attacks and content binding. Kutter, Voloshynovskiy, and Herrigel showed that a watermark estimated from one asset can be re-embedded into another [30], and the template attack removes synchronization patterns [17]. Deguillaume et al. answered with hybrid schemes that bind the robust mark to content through a fragile layer [6, 7], and Adelsbach, Katzenbeisser, and Veith gave provable constructions against copy and ambiguity attacks [1]. Our optional binding layer follows the fuzzy commitment and secure sketch line of Juels and Wattenberg and Dodis et al. [5, 8, 28, 29]: a public helper string lets the verifier reproduce a content digest from received pixels, and the digest sits inside the signed message. We evaluate this extension at small scale and state its limits in Section 4.6.

Attacks and benchmarks. WAVES standardizes image watermark stress-testing [2], and VideoMarkBench extends it to video, finding that forgery, not removal, is the undefended direction [26]. Regeneration attacks remove invisible marks with provable guarantees by re-synthesizing the content [44]; such attacks erase marks but cannot create a signature that verifies under someone else’s key, which is the property this paper adds. The SoK of watermarking for AI-generated content frames these threat models systematically [45]. Asymmetric and publicly verifiable watermarking. The goal of detaching detection from embedding is old. Furon and Duhamel proposed asymmetric detection where the detector does not hold the embedding key [16], and Eggers, Su, and Girod built public detection from eigenvectors of linear transforms, noting themselves that published detectors invite targeted removal [9]. Hopper, Molnar, and Wagner formalized strong watermarking against arbitrary channels [18], and recent analysis shows robustness plus public detectability remains fundamentally difficult when the detector must also resist removal [12]. Our position differs from classical asymmetric detection in what is public: we publish the entire decoding path and rest security only on signature unforgeability, accepting that an adversary who sees the decoder can attempt removal, which is the visible-damage regime the threat model already concedes. In language models, publicly detectable and publicly verifi-

Phase-domain embedding. Phase carriers for video are nearly unexplored. Meenakshi et al. modulate DFT phase per frame with BPSK but report no modern codec results [34]; classical codec-robust designs stay in magnitude or transform-coefficient domains [10, 41]. PhaseMark, concurrent work on images, injects phase patterns in the latent frequency domain of a generator’s autoencoder [31]. To our knowledge no prior system transports a cryptographic signature on video phase through H.264, frame-rate conversion, and screen recording.

3. Method Figure 1 shows the full system: a signing lane that holds the private key and runs the closed loop, and a public verification lane that anyone can execute. This section specifies each stage. 3

run-length layout: 30-frame runs, decoded by correlation

3.1. Threat model and verification semantics We separate two roles that symmetric watermarking merges. The signer holds an Ed25519 private key. The verifier holds the 32-byte public key and public decoding metadata: a per-video nonce, the embedding mode, and the message length. The verifier runs offline. It needs no shared secret, no model weights, no original video, no registry, and no network service. The system covers transformations that preserve the visible content of the frame: re-encoding, frame-rate conversion, rescaling, additive noise, and brightness change. Visible geometric edits such as cropping are out of scope by design. A verifier that tolerated a 20% crop would certify a frame missing one fifth of its content; for evidentiary use the correct answer to a visibly edited video is NOT VERIFIED, and that is the answer the system gives. Verification returns one of two answers. VERIFIED states that the extracted payload carries a valid signature under the given public key. NOT VERIFIED states that the check could not be completed. A failed check is not evidence of forgery. It can result from heavy degradation, a wrong key, or an unmarked video. This asymmetry is deliberate. The verifier never promotes a damaged decode into a positive answer, because the signature check either passes exactly or fails. Security rests on the signature, not on secrecy of the carrier. The layout nonce is public. Knowing it allows decoding. It does not allow signing, because creating a payload that verifies under the target public key requires the private key. Unforgeability is the standard computational property of Ed25519 under correct implementation [4, 27].

group 1

bit accuracy

0

40

group 3 60

frame index

80

group 4 100

120

frame-indexed, recording run-length, recording run-length, fps 30 → 24

1.00 0.75 0.50

chance

bbb

sintel

jelly

Figure 3. Top: the run-length layout cycles G = 4 payload groups in 30-frame runs; the decoder assigns each received frame to a group by correlation and never reads a frame index. Bottom: measured consequence. After real screen recording, a frame-indexed layout decodes at chance while run-length recovers the payload on all three clips; frame-rate conversion behaves the same way.

avoid the DC region where the eye tracks color casts. We embed in chroma because H.264 and H.265 allocate fewer bits there, and because luma phase carries edge structure that the eye notices first. The amplitude of each modification is set per frame from a target embedding distortion expressed as PSNR, so quality is a controlled input rather than an outcome; the target itself is selected per video by the closed loop of Section 3.6. The bin positions and carrier phases for every slot derive from a public per-video nonce through SHA-256. The nonce provides domain separation: two videos signed by the same key place their carriers on different bins, so residual averaging across a collection of signed videos does not accumulate a common pattern. The nonce travels as plain metadata next to the file, in the same way a provenance manifest travels with an asset.

3.2. Payload construction The payload frames a message m of known length with its signature: b = flag ∥ len(m) ∥ m ∥ Sigsk (m),

20

group 2

(1)

3.4. Run-length temporal coding

where Sigsk (m) is the 64-byte Ed25519 signature. A Reed– Solomon code with 30 parity bytes protects the framed bytes against residual bit errors. For the 32-byte messages used in our experiments the coded payload is 1024 bits. This is an order of magnitude above common neural payload sizes, which sit near 96 to 128 bits [3, 15], and the signature is the reason: a real signature cannot be shortened below 64 bytes, so a signature-carrying watermark must solve the capacity problem, not avoid it.

A layout keyed to the frame index fails whenever frame timing changes, because frame t after conversion is not frame t before it. Our decoder therefore never consults the received frame index. The payload is split into G = 4 groups. Each group occupies K = 30 consecutive frames, and the cycle repeats for the duration of the video. Every frame is marked. At the decoder, each received frame is correlated against the four candidate group layouts, and the bestmatching group claims the frame. Soft evidence accumulates per group, the groups concatenate into the coded payload, and Reed–Solomon decoding plus the signature check complete verification. Group identity is recoverable from content alone because the four layouts are orthogonal by construction: they draw disjoint bin subsets from the carrier band. Frame drops,

3.3. Chroma phase carrier Each payload bit modulates the phase of a set of mid-band frequency bins of the Cr chroma plane. A radial band of 0.05 to 0.12 cycles per pixel carries all slots. The band is low enough to survive transform coding and high enough to 4

duplications, and rate conversion shift which frames land in a group but do not change which group a frame belongs to. Section 4.3 measures this property directly against a frameindexed alternative on identical clips.

and has not been altered. The signature by itself does not bind the surrounding pixels: in the classical watermark copy attack [30], an adversary estimates the mark carried by one asset and re-embeds it into another, transplanting a valid signature onto footage the signer never saw. Where deployment requires tying the signed statement to the carrying content, the payload can additionally carry a public helper string that associates the message with a robust content feature in the spirit of fuzzy commitment [8, 29]. We evaluate such an extension at small scale in Section 4.6 and state its scope there. Characterizing that association against a searching adversary at corpus scale remains open, and none of the claims in this paper depend on it.

3.5. Blind geometric synchronization Phase carriers are sensitive to coordinate changes: a rescale moves every bin, and a translation rotates every phase in proportion to its frequency. Before decoding, the verifier runs a payload-free search over scale, rotation, and translation. The search maximizes carrier energy at the noncederived bin positions, using the embedded carrier itself as the alignment target rather than a separate template. Local spectral whitening precedes the search, which flattens host energy so that textured clips do not dominate the objective. The recovered transform is inverted and decoding proceeds on the aligned frames. The alignment stage reports its estimate, which makes failures visible: a wrong scale estimate produces a near-chance bit accuracy rather than a silent wrong answer, and the signature gate converts near-chance decodes into NOT VERIFIED.

4. Experiments 4.1. Setup Implementation. The full system is a single training-free program. Signing embeds the payload of Section 3.2 into the Cr plane at a per-frame PSNR target chosen by the closed loop of Section 3.6 and re-encodes with H.264 at CRF 23. Verification decodes with the public key, the public nonce, and the message length. No stage contains a learned component, and one verifier binary produces every number in this section.

3.6. Closed-loop signing No single embedding strength suits all content. The host’s own energy inside the carrier band varies by more than an order of magnitude across real footage and acts as a noise floor for the carrier (Section 4.8), so a target that is generous on flat content is insufficient on saturated, textured content. The signer therefore selects the operating point per video. It embeds at the mildest target of a fixed ladder of per-frame PSNR targets (42, 40, 38, 36 dB, with reserve rungs at 34 and 32 dB), runs the public verifier on the encoded result, and descends one rung on failure. The first rung that verifies is shipped, along with the same public metadata as before. The acceptance test is the exact verification of Section 3.1 under the signer’s own public key; the verifier binary never changes, and the shipped file carries no record of the search. The acceptance check extends to attacks. An attackaware gate re-encodes the candidate under an attack of interest, for example conversion to 24 fps, and accepts a rung only when both the clean file and the attacked file verify. Because the gate discards low-margin embeddings, the clips it accepts survive other attacks at high rates (Section 4.7). Closed-loop signing is possible precisely because verification is public and self-contained. The signer runs the true acceptance test locally, with no oracle problem and no heldout secret. The cost is one sign-and-verify pass per rung, paid once at signing time. Verification cost and semantics are unchanged.

Controlled benchmark. Mechanism-level results use three 1280×720 clips of 240 frames each, drawn from open cinematic and photographic test material and re-encoded at high quality as sources. The payload is 1024 bits: a 32byte message, the 64-byte Ed25519 signature, framing, and Reed–Solomon parity. All attacks run through ffmpeg on the encoded output. Every table cell states bit accuracy in the extracted coded payload and whether the Ed25519 signature verified. A wrong-key control runs in every configuration: across all 33 clip and attack combinations, a mismatched public key was accepted zero times. Corpus-scale study. System-level results use 1000 uncurated UHD clips from Inter4K [36], downscaled to 720p at 120 frames, disjoint from the three development clips. Each clip is signed with a unique public nonce and verified end to end through the CLI; every signed clip is additionally checked against a mismatched public key. Rotation search is disabled in this protocol because no rotation attack is applied; rotation evidence comes from the controlled benchmark. Baseline. We compare against ChunkySeal, a re-trained high-capacity variant of the VideoSeal architecture [15], configured to the same 1024-bit payload on the same clips and attacks. Its in-memory round trip reaches 0.995 to 1.000 bit accuracy on these clips, so the comparison starts

3.7. What the signature does and does not bind The signature binds the message bytes. Any party can therefore check that the message was signed by the key holder 5

4.4. Screen recording

from a healthy operating point. The two systems answer different questions: ChunkySeal detects with a learned private extractor, while our verifier is public. We therefore report per-axis numbers and no aggregate winner.

We evaluate a full display and capture loop: the signed video plays in a real video player on a virtual X11 display, a screen recorder captures the display at its own clock, and the capture is re-encoded. The recorded streams gain frames relative to the source (255 recorded for 240 played), shift alignment by roughly 35 frames, and lose 4 to 12 dB PSNR. The run-length configuration verifies on all three clips at bit accuracies 0.9990, 1.0000, and 0.9941. Unmarked recordings are rejected in every case. To our knowledge, published video watermarking evaluations do not include a real display and capture loop; the closest reported axis is softwaresimulated recording [40].

4.2. Robustness of the shipped configuration Table 1 reports the benchmark, and Figure 4 plots the same measurements. Bit accuracy is 1.000 or within rounding of it for H.264 CRF 23 and CRF 28, 50% downscale with restoration, frame-rate conversion from 30 to 24 fps, additive noise, and brightness change, on all three clips, and the signature verifies in each of these cells. CRF 32 verifies on one clip of three: compression noise at that level begins to exceed the Reed–Solomon budget on textured content. Cropping and rotation without resynchronization sit at or near chance, which matches the design scope of Section 3.1; rotation becomes recoverable when the synchronization search of Section 3.5 includes the rotation axis. Figure 5 isolates that axis: with the axis enabled, bit accuracy is 1.000 at every tested angle up to 2 degrees on both measured clips, while the same decodes without the axis fall from 1.000 to chance.

4.5. Perceptual cost Embedding distortion is a controlled input: each accepted embedding meets its rung’s per-frame PSNR target by construction, and Figure 7 reports exactly which rung every corpus clip received, so the quality operating point of each signed video is known rather than estimated. Table 2 reports full-reference metrics at the mildest rung on six 720p clips of 96 frames: 35.52 to 40.79 dB PSNR, 0.9657 to 0.9777 SSIM [38], MS-SSIM at least 0.9772, and 0.0335 to 0.0887 LPIPS [43]. Inter-frame flicker decreases on every clip, by 0.056 to -0.160 absolute difference units, because the added carrier is temporally coherent within each group.

Crop coverage exists elsewhere in the design space, at a measured price. A frame-indexed layout variant, run on the same clips and payload, anchors its carrier to the absolute frame grid, and the synchronization search then recovers the crop window: it verifies after cropping to 90% on 3/3 clips (bit accuracy 0.990 to 0.996) and after cropping to 80% on 2/3. The same variant decodes frame-rate conversion at chance (0.558 at best). Spatial anchoring and temporal robustness trade against each other; the shipped default keeps the temporal axis that Sections 4.3 and 4.4 measure, and whether a verifier should accept a visibly cropped frame at all is the policy question of Section 3.1.

4.6. Content association at small scale The optional binding extension of Section 3.7 carries a public helper string built from a BCH[255, 207] code with correction radius t = 6 over a 255-bit temporally pooled DCT feature. On a six-clip corpus, the association behaves as designed: the feature survives all seven non-geometric channels with zero decoded-feature errors across 42 measurements, re-verification succeeds on all six clips, and all 30 ordered cross-video payload transfers at the protocol level are rejected, because the recovered feature of the receiving video disagrees with the digest inside the signed message. We report this as a protocol-level result on the tested corpus. Its behavior against a searching adversary over a large corpus is not established here, and the claims of Sections 4.2 through 4.5 do not rest on it.

Embedding quality on these clips is 42.35, 43.06, and 43.48 dB PSNR against the unmarked source. Temporal flicker, measured as the mean absolute inter-frame difference relative to the host, changes by +0.08%, +0.04%, and -0.10%, against +8.22%, +1.31%, and -0.34% for the baseline on the same clips.

4.7. Corpus-scale verification

4.3. Temporal layout ablation

Closed-loop signing is evaluated on all 1000 corpus clips end to end through the shipped CLI. Figure 7 shows the outcome as a rung distribution. 700 clips accept at the mildest 42 dB target; 176, 72, and 23 accept at 40, 38, and 36 dB; the reserve rungs recover 22 more. In total 993 of 1000 clips (99.3%) ship a verifying signature, 94.8% of the corpus at 38 dB or milder. The remaining 7 clips are the measured boundary of the phase carrier at the evaluated targets. Across all 1000 wrong-key verifications on this corpus, zero

The run-length decoder of Section 3.4 is the reason framerate conversion in Table 1 verifies at accuracy near 1.0. A frame-indexed layout measured on the same three clips decodes at chance after 30 to 24 fps conversion, because the received frame index no longer matches the embedding index. The same contrast appears end to end in the screen recording study below, where the frame-indexed variant fails on all three clips while run-length verifies on all three. 6

1.0

bit accuracy

0.9 0.8 0.7 0.6 0.5 clean

CRF23

CRF28

CRF32

scale50

fps24

noise

bright

crop90

crop80

rot1 ◦

Figure 4. Bit accuracy per attack on the three benchmark clips: ours (solid blue) against ChunkySeal at the same 1024-bit payload (dashed red); markers denote clips. Shaded columns are attacks where the Ed25519 signature verified on 3/3 clips. The dashed grey line is chance. Crop and plain rotation are outside the design scope; rotation is restored by the synchronization search of Section 3.5. bbb

sintel

jellyfish

Attack

Acc

Sig

CS

Acc

Sig

CS

Acc

Sig

CS

clean H.264 CRF 23 H.264 CRF 28 H.264 CRF 32 scale 50% fps 30→24 Gaussian noise brightness crop 90% crop 80% rotate 1◦

1.000 1.000 1.000 0.978 1.000 1.000 1.000 1.000 0.523 0.811 0.735

✓ ✓ ✓ ✗ ✓ ✓ ✓ ✓ ✗ ✗ ✗

0.498 0.498 0.495 0.497 0.495 0.493 0.500 0.501 0.495 0.502 0.510

1.000 1.000 1.000 1.000 1.000 1.000 1.000 1.000 0.502 0.589 0.797

✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✗ ✗ ✗

0.938 0.938 0.857 0.610 0.939 0.942 0.476 0.935 0.477 0.478 0.800

0.996 0.996 0.990 0.952 0.995 0.997 0.997 0.998 0.499 0.531 0.756

✓ ✓ ✓ ✗ ✓ ✓ ✓ ✓ ✗ ✗ ✗

0.954 0.954 0.601 0.485 0.954 0.960 0.652 0.966 0.504 0.495 0.529

signature verified

7/11

8/11

7/11

Table 1. Bit accuracy (Acc), Ed25519 verification (Sig), and ChunkySeal bit accuracy (CS) under identical attacks, three 720p clips, 1024bit payload for both systems. Crop and plain rotation are outside the design scope (Section 3.1); rotation is restored by the synchronization search when its rotation axis is enabled. A wrong public key was accepted in 0 of 33 runs. 1.0

bit accuracy

0.9 0.8 0.7 0.6

bbb, rotation axis on bbb, rotation axis off sintel, rotation axis on sintel, rotation axis off

0.5 0.0

0.5

1.0

PSNR

SSIM

MS-SSIM

LPIPS

∆flicker

sintel-a sintel-b bbb-a bbb-b jelly-a jelly-b

40.79 40.79 35.52 35.52 38.23 38.29

0.9680 0.9657 0.9685 0.9687 0.9777 0.9760

0.9825 0.9825 0.9772 0.9774 0.9826 0.9821

0.0682 0.0887 0.0359 0.0352 0.0335 0.0378

-0.072 -0.056 -0.143 -0.160 -0.154 -0.150

Table 2. Embedding cost at the mildest rung on six 720p clips: PSNR (dB), SSIM, MS-SSIM, LPIPS against the unmarked source, and the change in inter-frame flicker (mean absolute interframe difference; negative means the signed video flickers less than its host).

chance

rotation angle (degrees)

Clip

2.0

Figure 5. The rotation axis of the synchronization search, isolated on 2 benchmark clips. With the axis enabled (solid), the payload-free search recovers the angle and bit accuracy stays at 1.000 through 2 degrees; with the axis disabled (dashed), accuracy collapses to chance. The signature verified in every solid-line cell and no wrong key was accepted.

The attack-aware gate of Section 3.6 was evaluated with 24 fps conversion as the gating attack on the clips that reject the mildest rung, the hardest subpopulation of the corpus. The gate accepted 189 of 265 measured clips (71.3%) at a rung whose attacked copy also verifies. On these gated clips, survival under the non-gating attacks is 100% for H.264 CRF 23 re-encoding and 97.4% for 50% rescaling: selecting for margin under one attack yields embeddings

were accepted, and the cumulative wrong-key count across every experiment in this paper is zero. 7

detection ratio

5

rather than fitted laws.

4

5. Discussion and Conclusion

3

What is established. A training-free watermark can carry a complete Ed25519 signature through the transformations that dominate real video distribution: transform coding, rescaling, frame-rate conversion, noise, brightness change, and a real display and capture loop. Verification needs only the public key and public metadata, so detection capability no longer implies signing capability. At corpus scale, closed-loop signing ships a verifying signature for 99.3% of 1000 uncurated real-world clips, with the accepted quality target of every clip known by construction. The acceptance criterion throughout is the signature check itself; wrong-key controls were accepted zero times in every tested configuration, including all 1000 corpus-scale attempts, and degraded inputs produce NOT VERIFIED, never a false positive.

2 1

saturation ×2.5 intervention

detection = wrong-key floor

104

in-band Cr energy of the host (log scale) Figure 6. Host in-band Cr energy against the detection ratio on the 7-clip panel: more host energy inside the carrier band means a worse ratio, so the host is a noise floor, not a carrier. Red: raising one clip’s saturation moved its energy 2.2× and pushed detection to the wrong-key floor.

clips

600

100

99.3%

94.8%

700

80

70.0%

60

400

40 176

200 0

42

40

72 38

23 36

22 34/32

accepted rung (per-frame PSNR target, dB)

20 7 none

cumulative verified (%)

800

Deployment. The verifier needs three public items next to the file: the nonce, the mode, and the message length. These travel like any provenance metadata, for example inside a sidecar manifest. Publishing the decoder is part of the design: security rests on the private key, and the public nonce only separates carrier layouts across videos. The closed loop concentrates all adaptivity at the signer, where the private key already lives: signing pays one sign-andverify pass per rung, the attack-aware gate turns robustness targets into signing-time policy, and the verifier binary is identical for every video regardless of rung.

0

Figure 7. Closed-loop signing over 1000 uncurated Inter4K clips: clips per accepted rung (bars) and cumulative verified fraction (line). Descending the ladder ships verifying signatures for 993 clips (99.3%); a wrong public key was accepted zero times in 1000 attempts.

Limitations. Visible geometric edits are out of scope by design: cropping breaks decoding, and the system reports failure rather than tolerance of a visibly altered frame. A small residue of the corpus (7 of 1000 clips) rejects every evaluated rung and marks the measured boundary of the phase carrier. The signature binds the message bytes; the content-association extension that ties the message to a robust feature is validated on a six-clip corpus, and its behavior against a searching adversary at large corpus scale is an open problem we state rather than claim. Camera recapture of physical displays and platform round-trips remain untested.

robust under others. On a seed-fixed sample of 112 corpus clips whose mildest-rung embedding verifies clean but fails 24 fps conversion, the gate found an accepting rung for every sampled clip, making attack survival a signing-time decision rather than a fixed property of the content.

4.8. Carrier diagnostics Two observed regularities motivate the closed loop and make deployment predictable. First, on a 7-clip panel, the host’s own energy inside the carrier band acts as a noise floor: clips with more in-band Cr energy detect worse, with a strong negative rank correlation, and raising one clip’s saturation to move its in-band energy up by a factor of 2.2 moved its detection ratio from healthy to failing (Figure 6). Because this noise floor spans more than an order of magnitude across real footage, no single embedding strength serves all content, which is exactly the gap the per-video ladder of Section 3.6 closes. Second, synchronization quality improves with resolution: identity recovery rises monotonically from 360p to 1080p in a four-resolution sweep, consistent with the number of usable carrier bins growing with frame area. Both are diagnostics on the tested clips

Outlook. The capacity, corpus-scale coverage, and closed-loop operating points demonstrated here make signature transport a usable primitive for video; per-video content certification at corpus scale and physical-display recapture are the natural next steps.

References [1] André Adelsbach, Stefan Katzenbeisser, and Helmut Veith. Watermarking schemes provably secure against copy and

8

[16] Teddy Furon and Pierre Duhamel. An asymmetric public detection watermarking technique. In International Workshop on Information Hiding (IH), pages 88–100, 1999. 3 [17] Alexander Herrigel, Sviatoslav Voloshynovskiy, and Yuriy Rytsar. The watermark template attack. In Security and Watermarking of Multimedia Contents III, Proc. SPIE 4314, 2001. 3 [18] Nicholas Hopper, David Molnar, and David Wagner. From weak to strong watermarking. In Theory of Cryptography Conference (TCC), 2007. 3 [19] Runyi Hu, Jie Zhang, Yiming Li, Jiwei Li, Qing Guo, Han Qiu, and Tianwei Zhang. VideoShield: Regulating diffusionbased video generation models via watermarking. In International Conference on Learning Representations (ICLR), 2025. 2 [20] Xuming Hu, Hanqian Li, Jungang Li, Yu Huang, Shuliang Liu, and Aiwei Liu. VideoMark: A distortion-free robust watermarking framework for video diffusion models. arXiv preprint arXiv:2504.16359, 2025. 3 [21] Yu Huang, Junhao Chen, Shuliang Liu, Hanqian Li, Jungang Li, Qi Zheng, and Xuming Hu. Video signature: Implicit watermarking for video diffusion models. arXiv preprint arXiv:2506.00652, 2025. 3 [22] Devriş İşler, Seoyeon Hwang, Yoshimichi Nakatsuka, Nikolaos Laoutaris, and Gene Tsudik. Puppy: A publicly verifiable watermarking protocol. arXiv preprint arXiv:2312.09125, 2023. 3 [23] Youngdong Jang, MinHyuk Jang, JaeHyeok Lee, Feng Yang, and Sangpil Kim. LVMark: Robust watermark for latent video diffusion models. arXiv preprint arXiv:2412.09122, 2024. 3 [24] Jianbin Ji, Dawen Xu, Li Dong, Lin Yang, and Songhan He. DINVMark: A deep invertible network for video watermarking. arXiv preprint arXiv:2509.17416, 2025. 2 [25] Zhaoyang Jia, Han Fang, and Weiming Zhang. MBRS: Enhancing robustness of DNN-based watermarking by minibatch of real and simulated JPEG compression. In ACM International Conference on Multimedia (ACM MM), 2021. 2 [26] Zhengyuan Jiang, Yupu Wang, Moyang Guo, Kecen Li, Yuepeng Hu, Zhicong Huang, Cheng Hong, and Neil Zhenqiang Gong. VideoMarkBench: Benchmarking robustness of video watermarking. arXiv preprint arXiv:2505.21620, 2025. 1, 3 [27] Simon Josefsson and Ilari Liusvaara. Edwards-curve digital signature algorithm (EdDSA). RFC 8032, 2017. 4 [28] Ari Juels and Madhu Sudan. A fuzzy vault scheme. Designs, Codes and Cryptography, 38(2), 2006. 3 [29] Ari Juels and Martin Wattenberg. A fuzzy commitment scheme. In ACM Conference on Computer and Communications Security (CCS), 1999. 2, 3, 5 [30] Martin Kutter, Sviatoslav Voloshynovskiy, and Alexander Herrigel. The watermark copy attack. In Security and Watermarking of Multimedia Contents II, Proc. SPIE 3971, 2000. 3, 5 [31] Sung Ju Lee and Nam Ik Cho. PhaseMark: A posthoc, optimization-free watermarking of AI-generated images in the latent frequency domain. arXiv preprint arXiv:2601.13128, 2026. 3

ambiguity attacks. In ACM Workshop on Digital Rights Management, 2003. 3 [2] Bang An, Mucong Ding, Tahseen Rabbani, Aakriti Agrawal, Yuancheng Xu, Chenghao Deng, Sicheng Zhu, Abdirisak Mohamed, Yuxin Wen, Tom Goldstein, and Furong Huang. WAVES: Benchmarking the robustness of image watermarks. In International Conference on Machine Learning (ICML), 2024. 3 [3] Vishal Asnani, Shruti Agarwal, and John Collomosse. FlowMark: Mask-guided video watermarking. arXiv preprint arXiv:2607.05261, 2026. 1, 2, 4 [4] Daniel J. Bernstein, Niels Duif, Tanja Lange, Peter Schwabe, and Bo-Yin Yang. High-speed high-security signatures. Journal of Cryptographic Engineering, 2(2), 2012. 1, 4 [5] Xavier Boyen. Reusable cryptographic fuzzy extractors. In ACM Conference on Computer and Communications Security (CCS), 2004. 3 [6] Frédéric Deguillaume, Sviatoslav Voloshynovskiy, and Thierry Pun. Hybrid robust watermarking resistant against copy attack. In European Signal Processing Conference (EUSIPCO), 2002. 3 [7] Frédéric Deguillaume, Sviatoslav Voloshynovskiy, and Thierry Pun. Secure hybrid robust watermarking resistant against tampering and copy attack. Signal Processing, 83 (10):2133–2170, 2003. 3 [8] Yevgeniy Dodis, Rafail Ostrovsky, Leonid Reyzin, and Adam Smith. Fuzzy extractors: How to generate strong keys from biometrics and other noisy data. SIAM Journal on Computing, 38(1), 2008. 2, 3, 5 [9] Joachim J. Eggers, Jonathan K. Su, and Bernd Girod. Public key watermarking by eigenvectors of linear transforms. In European Signal Processing Conference (EUSIPCO), 2000. 3 [10] Ali A. Elrowayati, M. A. Alrshah, Mohd Fadlee A. Rasid, and Azizol Abdullah. HEVC watermarking techniques for authentication and copyright applications: Challenges and opportunities. IEEE Access, 8, 2020. 3 [11] Jaiden Fairoze, Sanjam Garg, Somesh Jha, Saeed Mahloujifar, Mohammad Mahmoody, and Mingyuan Wang. Publiclydetectable watermarking for language models. arXiv preprint arXiv:2310.18491, 2023. 3 [12] Jaiden Fairoze, Guillermo Ortiz-Jiménez, Mel Vecerik, Somesh Jha, and Sven Gowal. On the difficulty of constructing a robust and publicly-detectable watermark. arXiv preprint arXiv:2502.04901, 2025. 1, 3 [13] Samar Fares, Nurbek Tastan, and Karthik Nandakumar. SPDMark: Selective parameter displacement for robust video watermarking. arXiv preprint arXiv:2512.12090, 2025. 2 [14] Pierre Fernandez, Guillaume Couairon, Hervé Jégou, Matthijs Douze, and Teddy Furon. The stable signature: Rooting watermarks in latent diffusion models. In IEEE/CVF International Conference on Computer Vision (ICCV), 2023. 2 [15] Pierre Fernandez, Hady Elsahar, I. Zeki Yalniz, and Alexandre Mourachko. Video seal: Open and efficient video watermarking. arXiv preprint arXiv:2412.09492, 2024. 1, 2, 4, 5

9

Hong, Milad Nasr, Florian Tramer, Somesh Jha, Lei Li, YuXiang Wang, and Dawn Song. SoK: Watermarking for AIgenerated content. In IEEE Symposium on Security and Privacy (S&P), 2025. 3 [46] Jiren Zhu, Russell Kaplan, Justin Johnson, and Li Fei-Fei. HiDDeN: Hiding data with deep networks. In European Conference on Computer Vision (ECCV), 2018. 2 [47] Xinjie Zhu, Zijing Zhao, Hui Jin, Qingxiao Guo, Yilong Ma, Yunhao Wang, Xiaobing Guo, and Weifeng Zhang. SIGMark: Scalable in-generation watermark with blind extraction for video diffusion. In International Conference on Learning Representations (ICLR), 2026. 3

[32] Aiwei Liu, Leyi Pan, Xuming Hu, Shuang Li, Lijie Wen, Irwin King, and Philip S. Yu. An unforgeable publicly verifiable watermark for large language models. In International Conference on Learning Representations (ICLR), 2024. 3 [33] Xiyang Luo, Yinxiao Li, Huiwen Chang, Ce Liu, Peyman Milanfar, and Feng Yang. DVMark: A deep multiscale framework for video watermarking. arXiv preprint arXiv:2104.12734, 2021. 2 [34] K. Meenakshi, Ch. Srinivasa Rao, and K. Satya Prasad. Robust video watermarking schemes in phase domain using binary phase shift keying. arXiv preprint arXiv:1404.1314, 2014. 3 [35] Tomáš Souček, Pierre Fernandez, Hady Elsahar, SylvestreAlvise Rebuffi, Valeriu Lacatusu, Tuan Tran, and Alexandre Mourachko. Pixel seal: Adversarial-only training for invisible image and video watermarking. arXiv preprint arXiv:2512.16874, 2025. 1, 2 [36] Alexandros Stergiou and Ronald Poppe. AdaPool: Exponential adaptive pooling for information-retaining downsampling. arXiv preprint arXiv:2111.00772, 2021. 5 [37] Mohammadreza Teymoorianfard, Siddarth Sitaraman, Shiqing Ma, and Amir Houmansadr. VidStamp: A temporally-aware watermark for ownership and integrity in video diffusion models. arXiv preprint arXiv:2505.01406, 2025. 3 [38] Zhou Wang, Alan C. Bovik, Hamid R. Sheikh, and Eero P. Simoncelli. Image quality assessment: From error visibility to structural similarity. IEEE Transactions on Image Processing, 13(4), 2004. 6 [39] Zijin Yang, Kai Zeng, Kejiang Chen, Han Fang, Weiming Zhang, and Nenghai Yu. Gaussian shading: Provable performance-lossless image watermarking for diffusion models. In IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2024. 2 [40] Guanhui Ye, Jiashi Gao, Yuchen Wang, Liyan Song, and Xuetao Wei. ItoV: Efficiently adapting deep learning-based image watermarking to video watermarking. arXiv preprint arXiv:2305.02781, 2023. 2, 6 [41] Nematollah Zarmehi and Mohammad Javad Barikbin. Robust video watermarking against H.264 and H.265 compression attacks. arXiv preprint arXiv:1708.02991, 2017. 3 [42] Kevin Alex Zhang, Lei Xu, Alfredo Cuesta-Infante, and Kalyan Veeramachaneni. Robust invisible video watermarking with attention. In arXiv preprint arXiv:1909.01285, 2019. 2 [43] Richard Zhang, Phillip Isola, Alexei A. Efros, Eli Shechtman, and Oliver Wang. The unreasonable effectiveness of deep features as a perceptual metric. In IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2018. 6 [44] Xuandong Zhao, Kexun Zhang, Zihao Su, Saastha Vasan, Ilya Grishchenko, Christopher Kruegel, Giovanni Vigna, YuXiang Wang, and Lei Li. Invisible image watermarks are provably removable using generative AI. In Advances in Neural Information Processing Systems (NeurIPS), 2024. 3 [45] Xuandong Zhao, Sam Gunn, Miranda Christ, Jaiden Fairoze, Andres Fabrega, Nicholas Carlini, Sanjam Garg, Sanghyun

10

Related documents

• Watermarking of audio signals using independent component analysis#230081
• Asymmetric Phase Coding Video Watermarking#794025
• Asymmetric Phase Coding Video Watermarking#790006
• Geometry-Aware Localized Watermarking for Copyright Protection in Embedding-as-a-Service#10264
• Information-Theoretic Foundations of the AaroNet Multi-Scale Detector#237194