Safe-Sora: Safe Text-to-Video Generation via Graphical Watermarking

Thank you for your valuable comments and recognition on our novel method for embedding graphical watermarks into the video generation process, well-structured methodology with intuitive illustrations, and pioneering introduction of state space models to video watermarking. We hope the following discussion can address your concerns!

Q1: It is recommended to clearly elaborate on how the proposed method differs from post-processing watermarking methods.

A1: Typical post-processing watermarking methods [1,2,3] inject watermarks into ready-made visible images or videos. For example, the classic post-processing method UDH [2] concatenates the watermark image and cover image, then inputs them into a UNet to produce a watermarked image.

However, Our method embeds watermarks during the VAE decoding process within video generation, when the video has not yet been exposed. This approach aligns with common practices in generative watermarking [4,5,6]. For instance, the pioneering generative watermarking work Stable Signature [4] embeds watermarks in text-to-image generation by fine-tuning the VAE decoder. Similarly, WOUAF [5] injects watermark information into the VAE decoder through weight modulation techniques.

Unlike previous generative image watermarking methods [4,5,6], for generative video watermarking, we propose coarse-to-fine adaptive patch matching to segment watermark images into patches and embed them into the most similar video frames. We also introduce a spatiotemporal local scanning strategy to enable enhanced fusion and extraction of watermark information across space and time.

Q2: A detailed analysis of the time or computational complexity should be provided.

A2: We provide comprehensive computational cost analysis covering both training and testing phases, along with performance metrics to demonstrate cost-effectiveness. Training experiments are conducted on four RTX 4090 GPUs, while testing is performed on a single RTX 4090 GPU. Results are presented in the table below:

Table 1: Computational speed between different methods.

Testing Time: During watermarked video generation, the video generation process dominates the computational cost (46.8980s per video using VideoCrafter2 [7] on an RTX 4090), while watermark embedding time remains negligible across all methods. Our method's testing time (0.3678s) is competitive with state-of-the-art approaches.

Training Time: Although Safe-Sora requires the second-longest training time, it demonstrates strong cost-effectiveness when compared to competitive baselines. To properly assess this trade-off, it's important to note that FVD (Fréchet Video Distance) [8] serves as a key metric for evaluating watermarked video quality. The results reveal compelling evidence of efficiency: compared to HiNet (the best-performing baseline with FVD 125.74), Safe-Sora requires only 1.6× training time while achieving dramatically superior performance—reducing FVD to just 3% of HiNet's value (3.77 vs. 125.74). This substantial performance gain at modest computational overhead demonstrates a highly favorable performance-to-cost ratio, validating the practical efficiency of our approach.

Q3: It is advisable to include comparisons with methods specifically designed for image steganography, such as HiNet, and to replace unsuitable baselines PUSNet.

A3: We appreciate this suggestion and have conducted comprehensive comparisons with HiNet, a state-of-the-art image steganography method. The detailed experimental results are presented below:

Table 2: Watermark Quality Comparison with HiNet

Table 3: Video Quality Comparison with HiNet.

The experimental results demonstrate that Safe-Sora significantly outperforms HiNet across all evaluation metrics. We will include HiNet in the final version to provide more comprehensive and appropriate comparisons.

Q4: In the robustness experiments, additional tests should be conducted under distortions such as random crop, frame insert, frame drop, and frame swap. Relevant experimental setups can refer to VideoShield.

A4: Due to time constraints, following VideoShields [9], we adopt temporal tamper (Frame Swap) and spatial tamper (Random Crop) to validate robustness, comparing our method against six baselines (including the additional HiNet baseline). We will include more comprehensive robustness experimental results in the final version. The preliminary results are shown below:

Table 4: Watermark Reconstruction Robustness under Frame Swap

Table 5: Watermark Reconstruction Robustness under Random Crop

The experimental results demonstrate that our method exhibits strong robustness, outperforming all baselines across evaluation metrics.

Q5: While the impact of Multi-Scale Feature Injection is explored, the strategy used for feature injection after removing this component is not mentioned. This should be clarified.

A5: In our implementation, the VAE decoder produces multi-scale features F1, F2, F3, and F4 at different resolution levels.

With Multi-Scale Feature Injection: All multi-scale features (F1, F2, F3, and F4) are fused with the watermark feature maps, enabling comprehensive integration across different spatial scales.

Without Multi-Scale Feature Injection: Only the final layer feature F4 is fused with the watermark feature maps, representing a single-scale injection strategy.

We will polish this technical detail in the final version to ensure greater clarity.

Q6: In the right subfigure of Fig. 1, it is suggested to revise the y-axis label from "watermarking performance" to PSNR.

A6: We will revise it in the final version to provide a clearer and more precise representation.

Q7: If a watermarked video is first encoded back into latent space using the same encoder, and then decoded again, would this process effectively remove the watermark?

A7: We conducted robustness experiments to evaluate watermark preservation under VAE reconstruction (encode-decode process). The experimental results are presented below:

Table 6: Watermark Reconstruction Robustness under VAE Reconstruction

The results demonstrate that while all baseline methods suffer severe watermark degradation under this challenging attack, Safe-Sora maintains superior watermark quality across all metrics. In the future, we will explore the exclusive techniques to improve the watermarking robustness under this attack.

[1] Hiding images within images. IEEE transactions on pattern analysis and machine intelligence 2019.

[2] Udh: Universal deep hiding for steganography, watermarking, and light field messaging. NeurIPS 2020.

[3] Purified and unified steganographic network. CVPR 2024.

[4] The Stable Signature: Rooting Watermarks in Latent Diffusion Models. ICCV 2023.

[5] WOUAF: Weight Modulation for User Attribution and Fingerprinting in Text-to-Image Diffusion Models. CVPR 2024.

[6] LaWa: Using Latent Space for In-Generation Image Watermarking. ECCV 2024.

[7] Videocrafter2: Overcoming data limitations for high-quality video diffusion models. CVPR 2024.

[8] FVD: A new Metric for Video Generation. ICLR 2021.

[9] VideoShield: Regulating Diffusion-based Video Generation Models via Watermarking. Arxiv 2025.

Thank you for your valuable comments and recognition on our novel two mechanisms, effective Mamba-based block design, and promising experimental results that surpass existing methods. We hope the following discussion can address your concerns!

Q1: The paper lacks a clear overall workflow description of the method. For instance, it's unclear how the watermarks are embedded and extracted. Furthermore, Section 3.4 on the loss function fails to specify which parameters are being optimized to minimize the objective.

A1: The overall workflow of Safe-Sora is described in the caption of Figure 2. In general, our method consists of three stages: (1) Watermark Preprocessing: The Coarse-to-Fine Adaptive Patch Matching technique segments watermarks into patches, adaptively matches them to video locations, and upsamples them into feature maps; (2) Watermark Embedding: Watermark features integrate with video multi-scale features through a UNet with 2D SFMamba blocks, followed by 3D SFMamba blocks implementing our spatiotemporal scanning strategy; (3) Watermark Extraction: An extraction network with distortion layer, 3D SFMamba blocks, and position recovery module recovers the embedded watermark.

Optimization parameters: All components are trainable except the frozen VAE encoder/decoder.

We will polish the paper carefully in the final version to improve the clarity and readability.

Q2: The method proposed in this paper is a post-processing algorithm, meaning that the watermark embedding and extraction are independent of the video generation model. Therefore, in this context, I believe the paper lacks comparison or discussion with traditional video watermarking methods.

A2: Typical post-processing watermarking methods [1,2,3] inject watermarks into ready-made visible images or videos. For example, the classic post-processing method UDH [2] concatenates the watermark image and cover image, then inputs them into a UNet to produce a watermarked image. However, our method embeds watermarks within the video generation process, when the video has not yet been exposed. This approach aligns with common practices in generative watermarking [4,5,6].

Unlike previous generative image watermarking methods [4,5,6], for generative video watermarking, we propose coarse-to-fine adaptive patch matching to segment watermark images into patches and embed them into the most similar video frames. We also introduce a spatiotemporal local scanning strategy to enable enhanced fusion and extraction of watermark information across space and time.

In addition, we compared our method with the traditional video watermarking method Wengnet, with results shown in Table 1 of the main paper. Our experiments demonstrate that our approach comprehensively outperforms Wengnet across all metrics, particularly in temporal consistency (FVD [7]: 3.77 vs. 265.82)

Q3: The authors likely need to conduct further experiments to reveal which module truly contributes to the observed performance.

A3: We have conducted ablation studies to evaluate the contribution of our two core components: Coarse-to-Fine Adaptive Patch Matching and Spatiotemporal Local Scanning.

Coarse-to-Fine Adaptive Patch Matching: This component is motivated by our observation that watermark-image similarity significantly impacts watermarking performance. It segments the watermark image into patches and adaptively embeds them at different video locations in a coarse-to-fine manner. When this component is removed, both video quality and watermark recovery degrade substantially. For example, watermark quality deteriorates with RMSE increasing from 3.61 to 3.99, while video temporal consistency drops significantly with FVD increasing from 3.77 to 16.87.

Spatiotemporal Local Scanning: This component leverages the frequency domain relationships in 3D wavelet transforms, performing scanning from low-to-high and high-to-low frequencies to enable enhanced fusion and extraction of watermark information across space and time. Without this component, temporal consistency is severely compromised, with FVD degrading from 3.77 to 13.16.

These ablation results demonstrate that both components are essential for achieving optimal performance. We will include more comprehensive ablation experiments in the final version to provide a more thorough evaluation of each module's contribution.

Q4: The paper's claim of being the first to embed image watermarks into AI-generated videos might be an overclaim, considering that bitstrings and images are interconvertible (via reshape and flatten operations).

A4: While bitstrings and images are interconvertible to some extent, there is a fundamental difference in complexity and scale. Previous works typically embed binary strings of 48 bits [4,6,8], whereas our method embeds 256×256 RGB images, which convert to 256×256×3×8 = 1,572,864 bits—approximately 32,000 times larger than traditional binary watermarks. Therefore, embedding images can be viewed as an extremely high-capacity binary embedding task with significantly greater technical challenges.

Moreover, image watermarks offer distinct advantages over binary strings: they serve as more intuitive and visually recognizable evidence of ownership [2]. Such designs enhance both the perceptual clarity and practical reliability of copyright verification, making them more suitable for real-world applications.

We acknowledge the reviewer's concern and will carefully revise this claim in the final version to more accurately reflect the technical contributions and significance of our work.

[1] Hiding images within images. IEEE TPAMI 2019.

[2] Udh: Universal deep hiding for steganography, watermarking, and light field messaging. NeurIPS 2020.

[3] Purified and unified steganographic network. CVPR 2024.

[4] The Stable Signature: Rooting Watermarks in Latent Diffusion Models. ICCV 2023.

[5] WOUAF: Weight Modulation for User Attribution and Fingerprinting in Text-to-Image Diffusion Models. CVPR 2024.

[6] LaWa: Using Latent Space for In-Generation Image Watermarking. ECCV 2024.

[7] FVD: A new Metric for Video Generation. ICLR 2021.

[8] LVMark: Robust Watermark for latent video diffusion models. Arxiv 2024.

Thank you for the response, which addresses most of my concerns. I will maintain the positive rating.

Thank you for your valuable comments and recognition on our novel framework for embedding graphical watermarks directly into the video generation process and the superior performance in video quality, watermark fidelity, and robustness against distortions. We hope the following discussion can address your concerns!

Q1: The paper needs to clearly clarify which technical components are uniquely designed for video and justify their necessity beyond simple adaptation from the image domain. If the core techniques are indeed image-based, a comparison with state-of-the-art image watermarking solutions is need.

A1: A static image does not contain any temporal information. Typical image watermarking methods input both the watermark image and the cover image into the watermark embedding network to generate a stego image [1, 2]. For example, the classic graphical watermarking method UDH [2] concatenates the watermark image and cover image, then inputs them into a UNet, producing a stego image. Unlike images, videos consist of multiple frames, and Figure 1 shows that watermarking performance significantly correlates with the visual similarity between the watermark and cover images. Therefore, how to appropriately allocate the watermark across the various frames is a key challenge.

To address this challenge, Safe-Sora divides the watermark image into multiple patches and adaptively matches them to different positions across the frames. Furthermore, considering the temporal relationships in videos, we propose a spatiotemporal local scanning strategy to enhance the fusion and extraction of watermark information across both space and time.

Additionally, we compare Safe-Sora with state-of-the-art image watermarking solutions, such as PUSNet [3] and HiNet [4]. The comparison with PUSNet is provided in Table 1 of the main paper, and the comparison with HiNet is discussed in the following tables:

Table 1: Watermark Quality Comparison with HiNet

Table 2: Video Quality Comparison with HiNet.

Experimental results show that our method outperforms these state-of-the-art image watermarking approaches, highlighting the necessity of our video-tailored architectural innovations.

Q2: The paper needs to further justify the practical significance of its incremental improvements in invisibility if the baseline methods already satisfy human perception requirements.

A2: Figure 4 presents single-frame image comparison results. However, videos fundamentally differ from single-frame images in their temporal dynamics. Even when watermarks appear nearly imperceptible in individual frames, they can introduce temporal inconsistencies across multiple video frames, significantly degrading overall video quality and failing to meet human perceptual standards.

Qualitative Analysis: Due to space constraints, Figure 5 visualizes multi-frame qualitative results exclusively for Safe-Sora. We will include comprehensive multi-frame qualitative comparisons with all baseline methods in the final version to provide a more complete evaluation.

Quantitative Analysis: We employ FVD (Fréchet Video Distance) [5] and tLP [6] metrics to quantitatively assess video temporal consistency. As shown in Table 1 of the main paper, Safe-Sora substantially outperforms all baselines across both metrics. Notably, Safe-Sora achieves an FVD of 3.77, dramatically surpassing baseline methods (e.g., PUSNet: 154.35, Wengnet: 265.82).

These results clearly demonstrate that existing baseline methods exhibit significant limitations in maintaining temporal consistency, while Safe-Sora effectively preserves temporal coherence in watermarked videos—a critical requirement for practical video watermarking applications.

Q3: The authors should provide results about the robustness against various video compression standards to validate the practical utility of the method.

A3: We follow the experimental setup for video compression robustness from previous literature [7, 8] and use the widely used H.264 compression to validate the robustness of our method, with the results shown in Figure 6. The results show that under H.264 compression, all baseline methods suffer a significant drop in performance, whereas our method maintains high watermark quality. In the final version of the paper, we will conduct more video compression robustness experiments to validate the practical utility of our method.

Q4: How about the computational overhead of the proposed method?

A4: We provide comprehensive computational cost analysis covering both training and testing phases, along with performance metrics to demonstrate cost-effectiveness. Training experiments are conducted on four RTX 4090 GPUs, while testing is performed on a single RTX 4090 GPU. Results are presented in the table below:

Table 3: Computational speed between different methods.

Testing Time: During watermarked video generation, the video generation process dominates the computational cost (46.8980s per video using VideoCrafter2 [9] on an RTX 4090), while watermark embedding time remains negligible across all methods. Our method's testing time (0.3678s) is competitive with state-of-the-art approaches.

Training Time: Although Safe-Sora requires longer training time, it demonstrates strong cost-effectiveness when compared to competitive baselines. To properly assess this trade-off, it's important to note that FVD (Fréchet Video Distance) serves as a key metric for evaluating watermarked video quality. The results reveal compelling evidence of efficiency: compared to HiNet (the best-performing baseline with FVD 125.74), Safe-Sora requires only 1.6× training time while achieving dramatically superior performance—reducing FVD to just 3% of HiNet's value (3.77 vs. 125.74). This substantial performance gain at modest computational overhead demonstrates a highly favorable performance-to-cost ratio, validating the practical efficiency of our approach.

[1] Hiding images within images. IEEE transactions on pattern analysis and machine intelligence 2019.

[2] Udh: Universal deep hiding for steganography, watermarking, and light field messaging. NeurIPS 2020.

[3] Purified and unified steganographic network. CVPR 2024.

[4] Hinet: Deep image hiding by invertible network. ICCV 2021.

[5] FVD: A new Metric for Video Generation. ICLR 2021.

[6] Learning temporal coherence via self-supervision for gan-based video generation. ACM TOG 2020.

[7] ItoV: Efficiently Adapting Deep Learning-based Image Watermarking to Video Watermarking. International Conference on Culture-Oriented Science and Technology 2023.

[8] LVMark: Robust Watermark for latent video diffusion models. Arxiv 2024.

[9] Videocrafter2: Overcoming data limitations for high-quality video diffusion models. CVPR 2024.

Thank you for your valuable comments and recognition on our method novelty combining Mamba and 3D wavelet transforms, comprehensive evaluation and ablations, and clear improvements in watermark recovery and robustness. We hope the following discussion can address your concerns!

Q1: Have you tested watermark removal attacks？

A1: We conducted robustness experiments on watermarking under various attacks (H.264 compression, Gaussian noise, blur, etc.), with the results presented in Figure 6. Our experimental findings consistently demonstrate that Safe-Sora significantly outperforms all baseline methods, showcasing superior robustness capabilities. Notably, under H.264 compression—a critical real-world scenario—all baseline methods experience substantial performance degradation, while our method maintains consistently high watermark extraction quality, validating its practical applicability for robust copyright protection.

Q2: Could Safe-Sora be extended to embed dynamic watermarks (e.g., animated logos or video clips) instead of static images?

A2: Safe-Sora's design principles naturally support extension to dynamic watermarks. Our method leverages content similarity analysis to segment watermark images into patches and adaptively embed them across optimal video positions. Dynamic watermarks (animated logos or video clips) can be conceptualized as multi-frame image sequences. Our adaptive patch matching technique can similarly decompose these multi-frame sequences into spatial-temporal patches and intelligently select the most suitable embedding positions based on content similarity analysis. This represents a promising and technically feasible direction that we plan to explore as a key focus in our future research endeavors.