Pith. sign in

REVIEW 5 major objections 9 minor 62 references

FlowMark: Mask-Guided Video Watermarking

T0 review · 5 major / 9 minor · reviewed 2026-07-07 · glm-5.2

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Learned mask placement eliminates flicker in video watermarks

desk verdict Solid engineering advance in video watermarking; the 'flicker elimination' claim needs a real temporal metric. read the letter →

arxiv 2607.05261 v1 pith:XJVZQ6H2 submitted 2026-07-06 cs.CV

Vishal Asnani , Shruti Agarwal , John Collomosse This is my paper · ORCID
classification cs.CV
keywords videowatermarkingmask-guidedembeddingtemporalconsistencycontent-adaptivemediaprovenancetamperdetectionperceptualquality
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

FlowMark is a video watermarking system that learns, frame by frame, where in the image to hide a 128-bit watermark signal. Instead of spreading the watermark uniformly across every pixel or relying on a human to draw a region mask, a small neural network predicts which spatial regions of each frame are most perceptually tolerant of added signal — typically high-texture or motion-stable areas — and confines the watermark there. The watermark residual is further attenuated in dark regions where compression artifacts would make it visible. A temporal change consistency loss forces the watermark to move with the video's natural motion rather than jittering independently from frame to frame, which is the primary cause of the flicker that plagues prior frame-by-frame watermarking methods. The paper also introduces a structured bit layout: 112 bits encode a persistent video identifier and 16 bits encode a frame index, so each frame carries a unique, traceable signature without sacrificing temporal smoothness. Trained through a three-stage curriculum that escalates from clean frames to image-level distortions to real video codec compression (H.264, H.265, VP9, AV1), FlowMark achieves perfect bit recovery under identity conditions, up to 50.41 dB PSNR on video, 100% detection of temporal tampering (frame swap, insertion, deletion, resampling, interpolation), and competitive robustness after YouTube and Facebook re-encoding, outperforming all tested baselines on the SA-V video benchmark.

What carries the argument

Mask Predictor (straight-through-estimated binary spatial mask), dark-region adaptive residual modulation (BT.601 luminance thresholding), temporal change consistency loss (Eq. 8), structured 128-bit embedding (112-bit video ID + 16-bit frame index), three-stage training curriculum (clean → image distortions → video codec compression)

What would settle it

A video sequence with rapid, irregular texture changes (e.g., fireworks, fast camera motion through foliage) where the temporal change consistency loss cannot keep the watermark residual co-moving with natural motion, producing measurable flicker under a temporal SSIM variance metric.

Watch

Extended reading notes

Core claim

The central mechanism is the combination of a learned spatial mask predictor with a temporal change consistency objective. The mask predictor outputs a binary embedding map via a straight-through estimator, localizing watermark energy in perceptually resilient regions. The temporal change consistency loss (Eq. 8) minimizes the discrepancy between the frame-to-frame difference of watermarked frames and the frame-to-frame difference of original frames, forcing the watermark residual to co-move with natural video dynamics rather than oscillate independently. Together with luminance-adaptive dark-region attenuation and a residual total variation regularizer, this produces watermark residuals the

Load-bearing premise

The paper asserts that flicker is eliminated, but the evidence for temporal stability is primarily qualitative (residual visualizations, difference maps) or proxied by L1 residual norm. No formal flicker metric — such as temporal variance of SSIM or a perceptual flicker index — is reported across frames, so the claim may not hold for high-motion or texture-changing scenes outside the SA-V test distribution.

Editorial extensions

If this is right

  • Per-frame unique watermarks with temporal coherence enable fine-grained provenance: each frame in a video can be independently authenticated and ordered, supporting forensic analysis of manipulated video.
  • The learned mask predictor could be extended to prioritize embedding in semantically meaningful regions (e.g., faces, text) for targeted provenance or to avoid sensitive regions entirely.
  • If the structured bit scheme scales beyond 16-bit frame indices, it could support longer videos or hierarchical provenance chains encoding editing history within the watermark itself.
  • The three-stage curriculum strategy (clean → augmentation → codec) may generalize to other media watermarking domains where distortion severity must be introduced gradually.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The claim of 'eliminating perceptual flicker' rests on qualitative visualizations and L1 residual norms rather than a dedicated temporal flicker metric; high-motion scenes with rapid texture changes could expose cases where the temporal consistency loss is insufficient.
  • The 128-bit capacity ceiling (112 video ID + 16 frame index) limits frame indices to 65,536 frames — roughly 45 minutes at 24 fps — which may constrain long-form video provenance without re-keying or segmented identifiers.
  • The mask predictor's ratio regularization toward 50% coverage may be suboptimal for scenes where the perceptually resilient region is much smaller or larger than half the frame; an adaptive ratio target could improve quality in extreme content.
  • Social media robustness was tested on 20 videos from a validation set; broader platform coverage (TikTok, Instagram, WhatsApp) with their specific compression pipelines would strengthen the real-world deployment claim.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

5 major / 9 minor

Summary. FlowMark proposes a mask-guided video watermarking framework that learns spatial embedding regions via a Mask Predictor network, rather than requiring user-supplied masks. The system combines dark-region adaptive residual modulation, a temporal change consistency loss, and a three-stage curriculum training strategy (clean → image augmentations → video codec distortions). A structured 128-bit per-frame embedding (112-bit video ID + 16-bit frame index) enables temporal tamper detection (frame swap, insertion, deletion, resampling, interpolation). Experiments compare against 7 baselines on SA-1B (image) and SA-V (video) datasets across valuemetric, geometric, compression, and combined distortions, plus social media pipeline tests (YouTube, Facebook), temporal edit detection, adversarial attack resilience, and 3 ablation studies. FlowMark reports up to 50.08 dB PSNR, perfect bit accuracy under identity conditions, 100% temporal tamper detection, and VMAF of 98.95 on SA-V.

Significance. The paper addresses a practically important problem: achieving per-frame unique watermarks in video without introducing perceptual flicker, which is a known limitation of frame-independent embedding. The learned mask predictor removes the need for manual mask selection required by prior region-based methods (WAM, MaskWM), which is a meaningful practical contribution. The structured bit embedding for temporal provenance (frame-level traceability) is a useful design choice for content authenticity applications. The experimental evaluation is extensive in scope, covering multiple distortion categories, real-world social media pipelines, and temporal edit scenarios. The three-stage curriculum and the dark-region adaptive modulation are reasonable engineering contributions. However, the central differentiating claim of 'flicker-free temporal consistency' lacks a dedicated quantitative metric, which weakens the evidentiary support for the paper's primary contribution claim.

major comments (5)
  1. §4.2, Table 1, and §1 (abstract): The claim that FlowMark 'effectively eliminates perceptual flicker' (abstract) and achieves 'flicker-free temporal consistency' (§4.2) is the primary differentiator from VideoSeal, yet no quantitative temporal flicker metric is reported. The L1 residual norm (||R||_1 = 0.005, Fig. 4) measures embedding magnitude, not temporal variation — a method could have low residual norm yet still flicker if the residual pattern shifts spatially across frames. VMAF (98.95) is a general video quality metric, not a flicker-specific measure. The secret-invariance comparison (Fig. 9) is conducted on SA-I images, not video frames, so it demonstrates spatial stability across secrets but not temporal flicker during video playback. The ablation (Table 3) shows removing L_tcm drops PSNR to 37.19 dB and robust accuracy to 0.79, but neither metric directly measures flicker. The
  2. claim would be substantially strengthened by reporting a temporal stability metric such as temporal SSIM variance, a perceptual flicker index, or frame-to-frame residual difference norms on actual video sequences. Without such a metric, the 'eliminates perceptual flicker' claim is supported only by qualitative visualizations and proxy metrics.
  3. §3.2 and §4.3: The structured bit embedding (b_vid || b_frm with 16-bit frame index) supports at most 65,536 unique frame indices. The paper does not discuss what happens for videos exceeding this length, nor whether the frame index wraps or resets. For practical deployment in long-form video or continuous streaming, this limitation should be acknowledged and the handling of overflow specified.
  4. Table 3 (ablation): Removing the dark mask improves robust accuracy from 0.80 to 0.86 while reducing PSNR from 50.41 to 40.18 dB. The paper frames this as a fidelity-robustness trade-off, but the robustness improvement (0.80 → 0.86) is non-trivial and suggests the dark mask may be overly conservative. The paper should discuss whether a less aggressive dark mask (e.g., higher d_min or τ) could achieve a better operating point, or provide justification for the chosen parameter values beyond the single setting reported.
  5. §4.3 (social media robustness): The social media robustness test uploads 20 videos to YouTube and Facebook, but no quantitative bit accuracy numbers are reported in the main text — only a qualitative statement that 'FlowMark maintains high bit accuracy.' Figure 5(b) appears to show this result, but the exact bit accuracy values under YouTube and Facebook compression are not tabulated. Given that social media robustness is a headline claim (Fig. 1b), the specific numbers should be reported in a table or explicitly in the text.
minor comments (9)
  1. §3, Eq. (2): The dark-region mask D(x,y) uses a sigmoid with argument (L(x,y) - τ)^s. When L < τ, (L - τ)^s may be problematic for non-integer s (here s=10 is fine, but the formulation should clarify the sign convention or use an absolute value to avoid ambiguity for general s).
  2. Table 1: MaskWM is cited as [30] in the table but [31] in the related work text. Please reconcile.
  3. Table 1: FlowMark's mask accuracy (0.95 on SA-1b, 0.96 on SA-V) is lower than MaskWM (1.00 on both). This is not discussed. A brief note on why FlowMark's mask accuracy is slightly lower would be helpful.
  4. §4.1: The Adobe Stock video dataset used for training is not described (size, resolution, duration). Since training data composition can affect generalization, a brief description would be appropriate.
  5. Fig. 9 caption: 'SA-I images' should likely be 'SA-1B images' for consistency with the rest of the paper.
  6. §6 (Full Resolution Watermarking): The claim that upscaling a 256×256 learned residual to full resolution preserves robustness and perceptual quality is stated without quantitative evaluation at multiple resolutions. Fig. 10 shows qualitative examples but no PSNR/SSIM/bit-accuracy numbers at native resolution. Adding even a small quantitative table would strengthen this section.
  7. References [23] and [24] both cite VideoSeal but with slightly different formatting (one as 'Video seal', one as 'VideoSeal'). Please consolidate.
  8. Table 4: The caption mentions 'following VideoSeal [23] evaluation' for GFLOPs, but the reference number should be checked for consistency (VideoSeal is cited as [16] in §3 and [23] elsewhere).
  9. §4.4: The watermark strength ablation (Fig. 8) uses parameter α, but α is not defined in the method section. It should be clarified whether α corresponds to µ in Eq. (3) or is a separate inference-time parameter.

Simulated Author's Rebuttal

4 responses · 0 unresolved

We thank the referee for a thorough and constructive report. The core concern—lack of a dedicated quantitative flicker metric—is well-taken, and we will address it with new experiments. The remaining comments identify legitimate gaps in discussion and reporting that we will incorporate in revision.

read point-by-point responses

  1. Referee: The claim that FlowMark 'effectively eliminates perceptual flicker' and achieves 'flicker-free temporal consistency' is the primary differentiator from VideoSeal, yet no quantitative temporal flicker metric is reported. The L1 residual norm measures embedding magnitude, not temporal variation. VMAF is a general video quality metric, not a flicker-specific measure. The secret-invariance comparison is on SA-I images, not video frames. The ablation does not directly measure flicker. The claim would be substantially strengthened by reporting a temporal stability metric such as temporal SSIM variance, a perceptual flicker index, or frame-to-frame residual difference norms on actual video sequences.

    Authors: The referee is correct that none of our currently reported metrics directly isolate temporal flicker. The L1 residual norm, VMAF, and secret-invariance analysis are all proxy measures that do not specifically capture frame-to-frame spatial variation of the watermark residual during video playback. We agree this is a genuine gap given that flicker-free temporal consistency is our primary differentiating claim. In revision, we will add a dedicated quantitative flicker metric computed on actual SA-V video sequences. Specifically, we will report frame-to-frame residual difference norms (||R_t - R_{t-1}||_1) and temporal SSIM variance across consecutive watermarked frames for FlowMark and all baselines. This will directly measure whether the residual pattern shifts spatially across frames, which is the mechanism by which frame-independent embedding produces visible flicker. We will also soften the absolute language in the abstract from 'effectively eliminates perceptual flicker' to a more precise claim grounded in the new metric, e.g., 'significantly reduces temporal flicker as measured by [metric].' revision: yes

  2. Referee: The structured bit embedding (b_vid || b_frm with 16-bit frame index) supports at most 65,536 unique frame indices. The paper does not discuss what happens for videos exceeding this length, nor whether the frame index wraps or resets. For practical deployment in long-form video or continuous streaming, this limitation should be acknowledged and the handling of overflow specified.

    Authors: This is a valid observation that we failed to address. The 16-bit frame index does limit unique frame indexing to 65,536 frames (approximately 45 minutes at 24fps). For longer content, the index would wrap, which could create ambiguity in frame ordering for tamper detection. We will add a paragraph to Section 3.2 acknowledging this limitation and describing the trade-off: allocating more bits to the frame index (e.g., 24 bits, supporting ~18 hours at 24fps) reduces the video ID capacity correspondingly. We will note that for the vast majority of practical use cases—social media clips, short-form video, and typical streaming segments—the 16-bit index is sufficient, and that the allocation is configurable based on deployment requirements. We will also note that for continuous streaming, a segment-based approach with periodic video ID rotation can be used. revision: yes

  3. Referee: Removing the dark mask improves robust accuracy from 0.80 to 0.86 while reducing PSNR from 50.41 to 40.18 dB. The paper frames this as a fidelity-robustness trade-off, but the robustness improvement (0.80 to 0.86) is non-trivial and suggests the dark mask may be overly conservative. The paper should discuss whether a less aggressive dark mask could achieve a better operating point, or provide justification for the chosen parameter values beyond the single setting reported.

    Authors: The referee raises a fair point. The 6-point robustness gain from removing the dark mask is indeed non-trivial, and our current treatment does not adequately justify the chosen parameters (d_min=0.2, tau=0.3, s=10) or explore intermediate settings. We will address this in two ways. First, we will add discussion acknowledging that the dark mask represents a deliberate fidelity-first operating point chosen for provenance applications where visual quality is paramount and the 0.80 robust accuracy is already strong. Second, we will add an ablation over d_min values (e.g., d_min in {0.0, 0.1, 0.2, 0.4, 0.6}) to show the trade-off curve and demonstrate that intermediate settings exist. We note that d_min=0.0 effectively disables the dark mask (matching the current ablation row), so this sweep will characterize the full spectrum the referee requests. revision: partial

  4. Referee: The social media robustness test uploads 20 videos to YouTube and Facebook, but no quantitative bit accuracy numbers are reported in the main text—only a qualitative statement that 'FlowMark maintains high bit accuracy.' Figure 5(b) appears to show this result, but the exact bit accuracy values under YouTube and Facebook compression are not tabulated. Given that social media robustness is a headline claim, the specific numbers should be reported in a table or explicitly in the text.

    Authors: The referee is correct. For a headline claim, reporting only a qualitative statement without explicit numerical values is insufficient. We will add a small table reporting bit accuracy for FlowMark under YouTube and Facebook compression separately, alongside the number of videos tested and the corresponding PSNR after platform re-encoding. If space permits in the main text, this will be a dedicated table; otherwise it will appear as explicit numerical values in the text of Section 4.3 with the full table in the supplementary material. revision: yes

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity found: FlowMark is trained end-to-end against external benchmarks and compared to independently developed baselines.

full rationale

FlowMark's derivation chain is self-contained. The model is trained end-to-end on the Adobe Stock video dataset and evaluated on external benchmarks (SA-1B, SA-V) against independently developed baselines (HiDDeN, MBRS, CIN, TrustMark, WAM, MaskWM, VideoSeal). The distortion module is adopted from VideoSeal [23], which is external work by different authors. The GAN-based adversarial loss follows TrustMark [14], authored by Bui et al. — a collaborator, but the cited work is an independently published, externally verifiable result, not an unverified self-citation chain. Self-citations to Asnani et al. (ProMark, CustomMark, proactive manipulation detection) appear only in the related work for context, not as load-bearing premises for any derivation or prediction. The temporal consistency loss (Eq. 8), residual TV loss (Eq. 7), mask predictor, and structured bit embedding are all novel components defined within the paper and validated by ablation (Table 3) against external metrics. No equation or prediction reduces to its own inputs by construction. The 'flicker elimination' claim may be insufficiently validated by quantitative flicker-specific metrics (a correctness concern), but this is not a circularity issue — the loss function (Eq. 8) is a genuine constraint on temporal dynamics, not a tautological restatement of the evaluation metric. The evaluation metrics (PSNR, SSIM, VMAF, bit accuracy) are standard external measures, not quantities defined in terms of the model's own outputs.

Assumptions & free parameters 13 free parameters · 5 assumptions · 3 invented entities

FlowMark introduces 13 hand-tuned hyperparameters (loss weights and mask/dark-region parameters) that are set empirically without sensitivity analysis for most. The JND modulation, STE, and distortion framework are adopted from prior work as domain assumptions. The temporal consistency loss as a flicker proxy and the full-resolution upscaling claim are ad-hoc assumptions specific to this paper. The three invented entities (mask predictor, dark-region modulation, structured bit embedding) are all independently tested via ablation or quantitative evaluation.

free parameters (13)
  • ρ (target mask ratio) = 0.5
    Controls the proportion of pixels activated in the predicted mask; chosen by the authors, not derived.
  • µ (global embedding strength) = 1.0
    Scales the watermark residual globally; set by hand.
  • τ (luminance threshold for dark mask) = 0.3
    Threshold in Eq. 2 for dark-region detection; chosen empirically.
  • d_min (minimum watermark strength in dark regions) = 0.2
    Floor for dark-region modulation in Eq. 2; chosen empirically.
  • s (transition sharpness for dark mask) = 10
    Controls sigmoid sharpness in Eq. 2; chosen empirically.
  • λ_mask = 25
    Weight for mask ratio regularization loss.
  • λ_pix = 1.0
    Weight for pixel reconstruction loss.
  • λ_lpips = 0.3
    Weight for perceptual loss.
  • λ_rtv = 2.0
    Weight for residual total variation loss.
  • λ_tcm = 0.5
    Weight for temporal change consistency loss.
  • λ_bit = 20
    Weight for bit accuracy loss in decoder.
  • λ_GAN = 0.5
    Weight for adversarial loss.
  • λ_M_hat = 0.5
    Weight for mask reconstruction loss in decoder.
assumptions (5)
  • domain assumption JND (Just Noticeable Difference) modulation from prior watermarking work [23,30,43] provides a valid perceptual scaling for watermark residuals.
    Section 3, Encoder: JND modulation is adopted from prior work without re-derivation; the paper assumes it correctly models human perceptual sensitivity.
  • domain assumption The straight-through estimator (STE) provides sufficient gradient flow for training the binary mask predictor.
    Section 3, Mask Predictor: STE is used to binarize the soft mask; the paper assumes gradient approximation is adequate for stable training.
  • domain assumption The differentiable distortion framework from VideoSeal [23] adequately simulates real-world social media compression for training purposes.
    Section 3, Distortion Module: the distortion operator D(·) is adopted from VideoSeal; the paper assumes it covers the relevant degradation space.
  • ad hoc to paper Temporal change MSE loss (Eq. 8) is a sufficient proxy for perceptual flicker reduction.
    Section 3, Encoder: the temporal consistency loss is introduced as the mechanism for flicker elimination, but no formal flicker metric validates this assumption.
  • ad hoc to paper Upscaling a 256×256 learned residual to full resolution preserves watermark robustness and perceptual quality.
    Section 6, Full Resolution Watermarking: the paper claims generalization to arbitrary image sizes by upscaling the residual, supported only qualitatively by Fig. 10.
invented entities (3)
  • Mask Predictor network independent evidence
    purpose: Predicts spatial embedding regions for watermark placement
    The mask predictor is a trainable module whose output is evaluated via Mask Accuracy (Table 1) and ablated in Table 3 (removal degrades PSNR to 38.11 dB). Its contribution is falsifiable and tested.
  • Dark-region adaptive residual modulation (Eq. 2) independent evidence
    purpose: Attenuates watermark strength in low-luminance regions
    Ablated in Table 3 (removal changes robustness from 0.80 to 0.86 and PSNR from 50.41 to 40.18). The effect is measurable and the component is falsifiable.
  • Structured per-frame bit embedding (b_vid || b_frm) independent evidence
    purpose: Enables frame-level traceability and temporal tamper detection
    Tested in Section 4.3 with 100% tamper detection accuracy across swap, drop, insertion, resampling, and interpolation. The frame-count error metrics provide falsifiable evidence.

how reviews work

0 comments
Cite this review

Pith. "Pith review of FlowMark: Mask-Guided Video Watermarking." pith.science (2026). https://pith.science/paper/XJVZQ6H2

@misc{pith2026260705261,
  author       = {Pith},
  title        = {Pith review of: FlowMark: Mask-Guided Video Watermarking},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/XJVZQ6H2}},
  note         = {Machine review of arXiv:2607.05261}
}
abstract

We present FlowMark, a video watermarking framework guided by automatically predicted object masks. In contrast to prior region-based approaches that require user-supplied mask guidance, FlowMark learns to identify optimal regions for watermark embedding through a dedicated Mask Predictor network. Our end-to-end trainable architecture combines region-aware encoding with noise-augmented training to ensure robustness against compression, geometric transformations, and content variation, while preserving high perceptual quality. Our content-adaptive masking keeps watermark signals coherent with natural video dynamics, effectively eliminating perceptual flicker. Beyond compression robustness, FlowMark maintains reliable watermark recovery under video-native temporal edits (e.g., frame swap, insertion, deletion, resampling, and interpolation) and real-world social media distribution pipelines (e.g., YouTube and Facebook re-encoding). Experimental results on both image and video datasets show that FlowMark reliably embeds $128$-bit messages with up to $50.08$ dB PSNR, offering strong performance for content provenance, temporal authenticity verification, and video integrity protection.

Figures

Figures reproduced from arXiv: 2607.05261 by the authors.

Figure 1
Figure 1. (a) VideoSeal [23] embeds watermarks across the full frame, WAM [43] uses segmentation masks, and MaskWM [30] relies on random masks. FlowMark learns content-aware masks that place the watermark in perceptually resilient regions. The residual R is the pixel-wise difference between the original and watermarked frames, and a lower ∥R∥1 indicates less visible change and reduced flickering across consecutive video frame… view at source ↗
Figure 2
Figure 2. FlowMark method. Overview of the FlowMark architecture for mask-guided video watermarking. The Encoder embeds a secret bit sequence b into the input frame I, producing a watermarked frame I enc. Simultaneously, the Mask Predictor gen￾erates a spatial mask M˜ indicating regions suitable for watermark embedding. In the Masking Module, JND-based modulation and dark-region adaptive masking are ap￾plied to the embedding … view at source ↗
Figure 3
Figure 3. Visualization of watermark embedding and mask prediction on SA-1b im￾ages. From top to bottom: original frames I, watermarked frames I wm, full residual R = I enc − I, masked residual , mask predicted by the Mask Predictor, mask re￾constructed by the Secret Decoder, and the luminance-based dark mask. The residual maps illustrate that watermark energy is concentrated in perceptually resilient regions rather than unif… view at source ↗
Figures from the paper (16 more)
Figure 4
Figure 4. Figure 4: Visualization of frame-wise residuals (R = I − I wm) across methods. Flow￾Mark produces the lowest residual magnitude (||R||1), indicating minimal perceptual distortion and the most stable watermark embedding across frames. high-capacity methods such as MBRS and CIN sh…
Figure 5
Figure 5. Figure 5: Robustness performance on the SA-V video dataset. [PITH_FULL_IMAGE:figures/full_fig_p012_5.png]
Figure 6
Figure 6. Figure 6: Ablation studies on (left) bit secret length and (right) mask ratio regularization. CRF levels to simulate practical compression pipelines. FlowMark maintains strong bit accuracy while preserving high PSNR across CRF levels. In (b), we evaluate robustness under tempora…
Figure 7
Figure 7. Figure 7: Ablation on mask sensitivity. We evaluate FlowMark under three comple￾mentary deletion settings. (Left) Masked Area Ablation: a contiguous region covering 10–40 percent of the image is removed, and results are averaged over all fragmentation levels (1–5 regions). (Midd…
Figure 8
Figure 8. Figure 8: Watermark strength ablation. Increasing strength improves robustness while reducing PSNR, highlighting the trade-off between robustness and visual quality. perturbations. These variations manifest as temporal instability, which appears as flicker when watermarked video…
Figure 9
Figure 9. Figure 9: Spatial residual comparison across different secrets on SA-I images. Residuals are visually amplified to reveal differences. For each method, we show residuals for two different secrets along with a difference row that computes the pixel-wise difference between the two…
Figure 10
Figure 10. Figure 10: Full resolution watermarking. Each pair shows the original and water￾marked images at native resolutions. Residuals are spatially upscaled and blended with the original image to embed the watermark. All samples maintain 100% bit recovery accuracy, with imperceptible v…
Figure 11
Figure 11. Figure 11: Visualization of video watermarking across multiple sequences. [PITH_FULL_IMAGE:figures/full_fig_p028_11.png]
Figure 12
Figure 12. Figure 12: Visualization of video watermarking across multiple sequences. [PITH_FULL_IMAGE:figures/full_fig_p029_12.png]
Figure 13
Figure 13. Figure 13: Visualization of video watermarking across multiple sequences. [PITH_FULL_IMAGE:figures/full_fig_p030_13.png]
Figure 14
Figure 14. Figure 14: Visualization of video watermarking across multiple sequences. [PITH_FULL_IMAGE:figures/full_fig_p031_14.png]
Figure 15
Figure 15. Figure 15: Visualization of video watermarking across multiple sequences. [PITH_FULL_IMAGE:figures/full_fig_p032_15.png]
Figure 16
Figure 16. Figure 16: Visualization of video watermarking across multiple sequences. [PITH_FULL_IMAGE:figures/full_fig_p033_16.png]
Figure 17
Figure 17. Figure 17: Visualization of FlowMark on still images. [PITH_FULL_IMAGE:figures/full_fig_p034_17.png]
Figure 18
Figure 18. Figure 18: Visualization of FlowMark on still images. [PITH_FULL_IMAGE:figures/full_fig_p035_18.png]
Figure 19
Figure 19. Figure 19: Visualization of FlowMark on still images. [PITH_FULL_IMAGE:figures/full_fig_p036_19.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

62 extracted references · 62 canonical work pages

  1. [1]

    IEEE Transactions on Circuits and Systems for Video Technology13(8), 787–800 (Aug 2003)

    Alattar, A.M., Lin, E.T., Celik, M.U.: Digital watermarking of low bit-rate ad- vanced simple profile mpeg-4 compressed video. IEEE Transactions on Circuits and Systems for Video Technology13(8), 787–800 (Aug 2003)

    work page 2003

  2. [2]

    In: Proc

    Asnani, V., Collomosse, J., Liu, X., Agarwal, S.: Custommark: Customization of diffusion models for proactive attribution. In: Proc. ICCV Workshop on Authen- ticity & Provenance in the age of Generative AI (APAI) (2025)

    work page 2025

  3. [3]

    In: Proceedings of the IEEE/CVF Con- ference on Computer Vision and Pattern Recognition

    Asnani, V., Collomosse, J., Bui, T., Liu, X., Agarwal, S.: Promark: Proactive diffu- sion watermarking for causal attribution. In: Proceedings of the IEEE/CVF Con- ference on Computer Vision and Pattern Recognition. pp. 10802–10811 (2024) 22 Asnani et al

    work page 2024

  4. [4]

    In: CVPR (2022)

    Asnani, V., Yin, X., Hassner, T., Liu, S., Liu, X.: Proactive image manipulation detection. In: CVPR (2022)

    work page 2022

  5. [5]

    IJCSNS9(4) (2019)

    Baba, S., Krekor, L., Arif, T., Shaaban, Z.: Watermarking scheme for copyright protection of digital images. IJCSNS9(4) (2019)

    work page 2019

  6. [6]

    In: Conference on Vi- sual Media Production (CVMP), 2023 (2023),https://collomosse.com/assets/ pubs/Balan-CVMP-2023.pdf

    Balan, K., Black, A., Jenni, S., Gilbert, A., Parsons, A., Collomosse, J.: DECO- RAIT - DECentralized Opt-in/out Registry for AI Training. In: Conference on Vi- sual Media Production (CVMP), 2023 (2023),https://collomosse.com/assets/ pubs/Balan-CVMP-2023.pdf

    work page 2023

  7. [7]

    In: International Conference on AI and the Digital Economy (CADE), 2025 (2025),https://collomosse.com/assets/pubs/ Balan-CADE-2025.pdf

    Balan, K., Gilbert, A., Collomosse, J.: Content ARCs: Decentralized Content Rights in the Age of Generative AI. In: International Conference on AI and the Digital Economy (CADE), 2025 (2025),https://collomosse.com/assets/pubs/ Balan-CADE-2025.pdf

    work page 2025

  8. [8]

    In: CVPR (2023)

    Balan, K., Agarwal, S., Jenni, S., Parsons, A., Gilbert, A., Collomosse, J.: EKILA: Synthetic media provenance and attribution for generative art. In: CVPR (2023)

    work page 2023

Show all 62 references
  1. [9]

    CoSTAR/DECaDE/Sheridans Technical Report (2025), https://collomosse.com/assets/pubs/Bennett-ACCCT-2025.pdf

    Bennett, J., Collomosse, J., Gregory-Clarke, R., Jones, J., Love, L., Lycett, M., Saunders, W.: Time to ACCCT: Providing Creative Industries and AI De- velopers with a Copyright Framework of Access, Control, Consent, Compensa- tion and Transparency. CoSTAR/DECaDE/Sheridans Tec...

    2025

  2. [10]

    IEEE Trans

    Bharati, A., Moreira, D., Flynn, P., de Rezende Rocha, A., Bowyer, K., Scheirer, W.: Transformation-aware embeddings for image provenance. IEEE Trans. Info. Forensics and Sec.16, 2493–2507 (2021)

    2021

  3. [11]

    IEEE Transactions on Multimedia (TMM), 2020 (2020),https://collomosse.com/assets/pubs/Bui-TMM-2020.pdf

    Bui, T., Cooper, D., Collomosse, J., Bell, M., Green, A., Sheridan, J., Higgins, J., Das, A., Keller, J., Thereaux, O.: Tamper-proofing Video with Hierarchical Attention Autoencoder Hashing on Blockchain. IEEE Transactions on Multimedia (TMM), 2020 (2020),https://collomosse.co...

    2020

  4. [12]

    In: CVPR Workshops (Computer Vision, AI and Blockchain), 2019 (2019),https: //collomosse.com/assets/pubs/Bui-CVPRWS-2019.pdf

    Bui, T., Cooper, D., Collomosse, J., Bell, M., Green, A., Sheridan, J., Hig- gins, J., Das, A., Keller, J., Thereaux, O., Brown, A.: ARCHANGEL: Tamper- proofing Video Archives using Temporal Content Hashes on the Blockchain. In: CVPR Workshops (Computer Vision, AI and Blockcha...

    2019

  5. [13]

    ArXiv e-prints (Nov 2023)

    Bui, T., Agarwal, S., Collomosse, J.: Trustmark: Universal watermarking for arbi- trary resolution images. ArXiv e-prints (Nov 2023)

    2023

  6. [14]

    In: Proceedings of the IEEE/CVF International Conference on Computer Vision

    Bui, T., Agarwal, S., Collomosse, J.: Trustmark: Robust watermarking and water- mark removal for arbitrary resolution images. In: Proceedings of the IEEE/CVF International Conference on Computer Vision. pp. 18629–18639 (2025)

    2025

  7. [15]

    In: CVPR (2023)

    Bui, T., Agarwal, S., Yu, N., Collomosse, J.: RoSteALS: Robust steganography using autoencoder latent space. In: CVPR (2023)

    2023

  8. [16]

    In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) (2024)

    Chang, J., Choi, S., Milanfar, P.: Videoseal: A learned model for robust video watermarking. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) (2024)

    2024

  9. [17]

    Coalition for Content Provenance and Authenticity: Technical specification 2.2. Tech. rep., C2PA (2025),https://c2pa.org/specifications/specifications/ 2.2/index.html

    2025

  10. [18]

    IEEE Computer Graphics and Applications (IEEE CG&A) (2024)

    Collomosse, J., Parsons, A.: To Authenticity, and Beyond! Building Safe and Fair Generative AI upon the Three Pillars of Provenance. IEEE Computer Graphics and Applications (IEEE CG&A) (2024)

    2024

  11. [19]

    IEEE Transactions on Information Forensics and Security3(3), 466–474 (2008) FlowMark 23

    Coria, L.E., Pickering, M.R., Nasiopoulos, P., Ward, R.K.: A video watermarking scheme based on the dual-tree complex wavelet transform. IEEE Transactions on Information Forensics and Security3(3), 466–474 (2008) FlowMark 23

    2008

  12. [20]

    Devi, P., Venkatesan, M., Duraiswamy, K.: A fragile watermarking scheme for image authentication with tamper localization using integer wavelet transform. J. Computer Science5(11), 831–837 (2019)

    2019

  13. [21]

    In: Proceedings of the IEEE International Conference on Computing, Communication and Automation

    Dutta, A., Gupta, S.: A blind and robust video watermarking technique for h.265/hevc encoded video. In: Proceedings of the IEEE International Conference on Computing, Communication and Automation. pp. 1189–1194 (2018)

    2018

  14. [22]

    In: ICCV (2023)

    Fernandez, P., Couairon, G., Jégou, H., Douze, M., Furon, T.: The stable signature: Rooting watermarks in latent diffusion models. In: ICCV (2023)

    2023

  15. [23]

    arXiv preprint arXiv:2412.09492 (2024)

    Fernandez, P., Elsahar, H., Yalniz, I.Z., Mourachko, A.: Video seal: Open and efficient video watermarking. arXiv preprint arXiv:2412.09492 (2024)

    2024 arXiv

  16. [24]

    ArXiv e-prints (Dec 2024)

    Fernandez, P., Elsahar, H., Yalniz, I.Z., Mourachko, A.: VideoSeal: Open and effi- cient video watermarking. ArXiv e-prints (Dec 2024)

    2024

  17. [25]

    In: Proc

    Fernandez, P., Sablayrolles, A., Furon, T., Jégou, H., Douze, M.: Watermarking images in self-supervised latent spaces. In: Proc. ICASSP. pp. 3054–3058. IEEE (2022)

    2022

  18. [26]

    In: TENCON 2011-2011 IEEE Region 10 Conference

    Ghazanfari, K., Ghaemmaghami, S., Khosravi, S.R.: Lsb++: An improvement to lsb+ steganography. In: TENCON 2011-2011 IEEE Region 10 Conference. pp. 364–368. IEEE (2011)

    2011

  19. [27]

    Google DeepMind: Identifying AI-generated images with SynthID.https : / / deepmind.google/discover/blog/identifying- ai- generated- images- with- synthid/(2023)

    2023

  20. [28]

    IEEE Transactions on Circuits and Systems for Video Tech- nology20(8), 1164–1170 (2010)

    Guo, J., Pan, Y.: Motion vector-based watermarking for h.264 video stream with drift compensation. IEEE Transactions on Circuits and Systems for Video Tech- nology20(8), 1164–1170 (2010)

    2010

  21. [29]

    Signal Processing66(3), 283–301 (May 1998)

    Hartung, F., Girod, B.: Watermarking of uncompressed and compressed video. Signal Processing66(3), 283–301 (May 1998)

    1998

  22. [30]

    arXiv preprint arXiv:2405.11135 (2025)

    Hu, R., Zhang, J., Zhao, S., Lukas, N., Li, J., Guo, Q., Qiu, H., Zhang, T.: Mask image watermarking. arXiv preprint arXiv:2405.11135 (2025)

    2025 arXiv

  23. [31]

    In: The Thirty-ninth Annual Conference on Neural Information Processing Systems (2025)

    Hu, R., Zhang, J., Zhao, S., Lukas, N., Li, J., Guo, Q., Qiu, H., Zhang, T.: Mask im- age watermarking. In: The Thirty-ninth Annual Conference on Neural Information Processing Systems (2025)

    2025

  24. [32]

    IEEE Transactions on Multimedia25, 7364–7377 (2022)

    Jia, J., Gao, Z., Zhu, D., Min, X., Hu, M., Zhai, G.: Rivie: Robust inherent video information embedding. IEEE Transactions on Multimedia25, 7364–7377 (2022)

    2022

  25. [33]

    In: Proceedings of the 29th ACM International Conference on Multimedia (2021)

    Jia, Z., Fang, H., Zhang, W.: Mbrs: Enhancing robustness of dnn-based water- marking by mini-batch of real and simulated jpeg compression. In: Proceedings of the 29th ACM International Conference on Multimedia (2021)

    2021

  26. [34]

    In: Proceedings of the IEEE/CVF international conference on computer vision

    Kirillov, A., Mintun, E., Ravi, N., Mao, H., Rolland, C., Gustafson, L., Xiao, T., Whitehead, S., Berg, A.C., Lo, W.Y., et al.: Segment anything. In: Proceedings of the IEEE/CVF international conference on computer vision. pp. 4015–4026 (2023)

    2023

  27. [35]

    IEEE Transactions on Image Processing (2023)

    Luo, X., Li, Y., Chang, H., Liu, C., Milanfar, P., Yang, F.: Dvmark: A deep multi- scale framework for video watermarking. IEEE Transactions on Image Processing (2023)

    2023

  28. [36]

    In: Proceedings of the 30th ACM International Conference on Multimedia

    Ma, R., Guo, M., Hou, Y., Yang, F., Li, Y., Jia, H., Xie, X.: Towards blind water- marking: Combining invertible and non-invertible mechanisms. In: Proceedings of the 30th ACM International Conference on Multimedia. pp. 1532–1542 (2022)

    2022

  29. [37]

    In: BMVC

    Mishra, A., Kumar, S., Nigam, A., Islam, S.: Vstegnet: Video steganography net- work using spatio-temporal features and micro-bottleneck. In: BMVC. vol. 274 (2019)

    2019

  30. [38]

    In: COMSWARE’08

    Navas, K., Ajay, M.C., Lekshmi, M., Archana, T.S., Sasikumar, M.: DWT-DCT- SVD based watermarking. In: COMSWARE’08. pp. 271–274. IEEE (2008) 24 Asnani et al

    2008

  31. [39]

    Netflix, V.: Video multi-method assessment fusion (2019)

    2019

  32. [40]

    In: ICCV (2021)

    Nguyen, E., Bui, T., Swaminathan, V., Collomosse, J.: OSCAR-Net: Object-centric scene graph attention for image attribution. In: ICCV (2021)

    2021

  33. [41]

    Rixhon: An update on JPEG trust.https : / / cawg

    P. Rixhon: An update on JPEG trust.https : / / cawg . io / meeting - notes / _attachments/2025-01-21/jpeg-trust-presentation.pdf(January 2025)

    2025

  34. [42]

    In: Intl

    Petrov, A., Agarwal, S., Torr, P., Bibi, A., Collomosse, J.: On the Coexistence and Ensembling of Watermarks. In: Intl. Conf. Neural Information Processing Sys- tems (NeurIPS), 2025 (2025),https://collomosse.com/assets/pubs/Petrov- NeurIPS-2025.pdf

    2025

  35. [43]

    In: Proc

    Sander, T., Fernandez, P., Durmus, A.O., Furon, T., Douze, M.: Watermark any- thing with localized messages. In: Proc. ICLR (2025)

    2025

  36. [44]

    Journal of Information Security and Applications75, 103515 (2023)

    Shen, X., Yao, H., Tan, S., Qin, C.: Vhnet: A video hiding network with robust- ness to video coding. Journal of Information Security and Applications75, 103515 (2023)

    2023

  37. [45]

    Multimedia Tools and Applications81(18), 25913–25946 (2022)

    Taha, M.S., Rahem, M.S.M., Hashim, M.M., Khalid, H.N.: High payload image steganography scheme with minimum distortion based on distinction grade value method. Multimedia Tools and Applications81(18), 25913–25946 (2022)

    2022

  38. [46]

    In: Proc

    Tancik, M., Mildenhall, B., Ng, R.: Stegastamp: Invisible hyperlinks in physical photographs. In: Proc. CVPR. pp. 2117–2126 (2020)

    2020

  39. [47]

    IEEE Transactions on Circuits and Systems for Video Technology 26(1), 65–76 (2016)

    Tew, Y., Wong, K.: An efficient video watermarking technique for hevc video au- thentication. IEEE Transactions on Circuits and Systems for Video Technology 26(1), 65–76 (2016)

    2016

  40. [48]

    Neurocomputing (2022)

    Wan, W., Wang, J., Zhang, Y., Li, J., Yu, H., Sun, J.: A comprehensive survey on robust image watermarking. Neurocomputing (2022)

    2022

  41. [49]

    Wen, Y., Kirchenbauer, J., Geiping, J., Goldstein, T.: Tree-rings watermarks: Invis- iblefingerprintsfordiffusionimages.In:AdvancesinNeuralInformationProcessing Systems (NeurIPS). vol. 36 (2023)

    2023

  42. [50]

    In: Proc

    Weng, X., Li, Y., Chi, L., Mu, Y.: High-capacity convolutional video steganography with temporal residual modeling. In: Proc. ICMR. pp. 87–95 (2019)

    2019

  43. [51]

    In: Proc

    Wolfgang, R.B., Delp, E.J.: A watermark for digital images. In: Proc. ICIP. vol. 3, pp. 219–222. IEEE (1996)

    1996

  44. [52]

    IEEE Transactions on Image Processing26(6), 2682–2693 (2017)

    Wu, J., Li, L., Dong, W., Shi, G., Lin, W., Kuo, C.C.J.: Enhanced just noticeable difference model for images with pattern complexity. IEEE Transactions on Image Processing26(6), 2682–2693 (2017)

    2017

  45. [53]

    In: Proc

    Xu, R., Hu, M., Lei, D., Li, Y., Lowe, D., Gorevski, A., Wang, M., Ching, E., Deng, A., et al.: Invismark: Invisible and robust watermarking for ai-generated image provenance. In: Proc. Winter Conf. on Appl. of Computer Visoin (WACV) (2025)

    2025

  46. [54]

    In: 2023 International Conference on Culture-Oriented Science and Technology (CoST)

    Ye, G., Gao, J., Wang, Y., Song, L., Wei, X.: Itov: efficiently adapting deep learning-based image watermarking to video watermarking. In: 2023 International Conference on Culture-Oriented Science and Technology (CoST). pp. 192–197. IEEE (2023)

    2023

  47. [55]

    In: Proceedings of the International Conference on Control, Automation, Robotics and Vision

    Yong, M., Yu-Min, T., Yun-Hui, Q.: Adaptive video watermarking algorithm based on mpeg-4 streams. In: Proceedings of the International Conference on Control, Automation, Robotics and Vision. pp. 1084–1088 (2008)

    2008

  48. [56]

    arXiv preprint arXiv:1909.01230 (2019)

    Zhang, H., Dong, J., Forgione, P., Collomosse, J.: Rivagan: Robust video water- marking with attention. arXiv preprint arXiv:1909.01230 (2019)

    1909 arXiv

  49. [57]

    IEEE Transactions on Circuits and Systems II: Express Briefs54(2), 205–209 (2007) FlowMark 25

    Zhang, J., Ho, A.T.S., Qiu, G., Marziliano, P.: Robust video watermarking of h.264/avc. IEEE Transactions on Circuits and Systems II: Express Briefs54(2), 205–209 (2007) FlowMark 25

    2007

  50. [58]

    Zhang, X., Sun, Z.H., Karaman, S., Chang, S.: Discovering image manipulation history by pairwise relation and forensics tools. IEEE J. Selected Topics in Signal Processing.14(5), 1012–1023 (2020)

    2020

  51. [59]

    In: Proc

    Zhang, X., Tang, Z., Xu, Z., Li, R., Xu, Y., Chen, B., Gao, F., Zhang, J.: Omni- guard: Hybrid manipulation localization via augmented versatile deep image wa- termarking. In: Proc. CVPR (2025)

    2025

  52. [60]

    In: Proceedings of the 32nd ACM International Conference on Multimedia

    Zhang, X., Xu, Y., Li, R., Yu, J., Li, W., Xu, Z., Zhang, J.: V2a-mark: Versatile deep visual-audio watermarking for manipulation localization and copyright pro- tection. In: Proceedings of the 32nd ACM International Conference on Multimedia. pp. 9818–9827 (2024)

    2024

  53. [61]

    264/avc compression

    Zhang, Y., Ni, J., Su, W., Liao, X.: A novel deep video watermarking framework with enhanced robustness to h. 264/avc compression. In: Proceedings of the 31st ACM International Conference on Multimedia. pp. 8095–8104 (2023)

    2023

  54. [62]

    In: Proc

    Zhu, J., Kaplan, R., Johnson, J., Fei-Fei, L.: Hidden: Hiding data with deep net- works. In: Proc. ECCV. pp. 657–672 (2018) 26 Asnani et al. Fig. 9:Spatial residual comparison across different secrets on SA-I images. Residuals are visually amplified to reveal differences. For ...

    2018

Pith tools

Reviewed July 7, 2026 · model on record in the stance chip above.