Source-linked AI summary
Asymmetric Phase Coding Video Watermarking
Guang Yang, Fengchen Liu
TL;DR
Existing video watermarking makes verification and signing symmetric, leaving white-box forgery possible. This paper embeds a complete Ed25519 signature in chroma phase and verifies it publicly using a key and metadata, with high-capacity error correction and closed-loop strength selection. On 1000 real-world clips, it verifies 99.3% of signatures, accepts no wrong-key attempts, and survives tested codec, scaling, and display-capture conditions.
Problem
Existing video watermarking systems give verifiers extractor weights or generator secrets, so verification also confers embedding capability and white-box forgery defeats evaluated methods.
Method
The system embeds a 1024-bit Reed–Solomon-protected Ed25519 signature in chroma phase and uses public, index-free verification with closed-loop per-video strength selection.
Results
On 1000 uncurated clips, 99.3% ship verifying signatures and wrong-key acceptance is zero times; gated embeddings survive H.264 re-encoding at 100% and 50% rescaling at 97.4%.
Takeaways & Limitations
Public verification no longer implies signing capability, while the signature check itself provides the end-to-end acceptance criterion across tested distribution transformations.
Takeaways & Limitations
Visible geometric edits are out of scope, camera recapture and platform round-trips remain untested, and large-scale security of content association remains open.
Abstract
from arXiv · showhide
Existing video watermarking systems are symmetric: the party that can verify a mark holds the extractor weights or generator secret and can therefore also embed one. Benchmarks confirm the consequence, reporting that white-box forgery defeats all evaluated methods. We present a training-free video watermark that removes the shared secret. The signer embeds a complete Ed25519 signature into the phase spectrum of the chroma plane; any party holding the 32-byte public key and public per-video metadata verifies offline, with no model, no registry, and no network. The payload, 1024 bits of signed message with error correction, is an order of magnitude above common learned payloads and is carried by three design elements: a run-length temporal layout whose decoder identifies payload groups by correlation and never reads a frame index, a payload-free search that recovers scale, rotation, and translation from the carrier itself, and a closed-loop signing procedure that selects each video's embedding strength by self-verification through the unchanged public verifier. On 1000 uncurated real-world clips the system ships a verifying signature for 99.3% of the corpus and accepts a wrong public key zero times in 1000 attempts. An attack-aware acceptance gate yields embeddings that survive H.264 re-encoding at 100% and 50% rescaling at 97.4% on gated clips. The signature also verifies through a real display and capture loop, an axis absent from published evaluations.
1. Introduction
The paper introduces a training-free video watermark that separates private signing from public verification by embedding complete Ed25519 signatures into video chroma phase. Its design combines high-capacity error-corrected payloads, index-free temporal decoding, closed-loop strength selection, and end-to-end cryptographic evaluation.
- Symmetric watermarking lets anyone who can verify a mark also embed one, and white-box forgery succeeds against every evaluated method in VideoMarkBench.
- The system embeds a complete Ed25519 signature into chroma phase, while verification uses only a public key, public metadata, and no extractor secret.
- Its signer uses a 1024-bit Reed–Solomon-protected payload and a public verifier to select the mildest embedding strength that passes self-verification.
- The evaluation uses signature acceptance and wrong-key controls, with verification near 1.0 across compression, rescaling, frame-rate conversion, noise, and brightness attacks on three clips.
- On 1000 uncurated clips, closed-loop signing ships verifying signatures for 99.3% of the corpus and accepts a wrong public key zero times.
- The stated scope excludes visibly altered geometry, while the signature binds message bytes rather than surrounding pixels.
2. Related Work
Related work spans learned video watermarking, asymmetric detection, attack benchmarks, content binding, and phase-domain embedding. The paper positions its contribution as public-key verification of a real signature transported through video phase rather than a detector artifact or externally resolved identifier.
- Learned post-hoc video watermarking systems offer payloads from 32 to a few hundred bits, while SIGMark reaches 8192 bits through a generation-side latent pathway.
- Existing learned systems generally let the verifier’s extractor weights or generator secret also confer embedding capability.
- VideoMarkBench identifies forgery as an undefended direction, whereas regeneration attacks remove marks but cannot create signatures valid under another key.
- Earlier asymmetric and publicly verifiable schemes detach detection from embedding, but the cited prior work does not transport a signature through video pixels.
- Content-binding research addresses copy and ambiguity attacks through robust or fragile layers, while this paper’s optional fuzzy-commitment-style association is evaluated separately.
- Prior video phase carriers lack modern codec results, and the paper claims no prior system transports a cryptographic signature on video phase through H.264.
3. Method
The method separates private signing from public verification using an Ed25519 signature embedded in chroma phase, with public metadata enabling offline checks. Run-length coding, payload-free alignment, and closed-loop strength selection target robustness without a learned decoder or shared secret.
- The signer uses an Ed25519 private key, while verification uses only a public key and metadata offline, without shared secrets, models, registries, or networks.
- Payload construction: The payload frames a known-length message with a 64-byte signature and Reed–Solomon parity, producing a 1024-bit coded payload for 32-byte messages.
- Temporal layout: The run-length layout cycles four groups in 30-frame runs, and correlation assigns received frames to groups without reading frame indices.
- Chroma phase carrier: Bits modulate mid-band Cr chroma phase, with per-frame amplitude controlled by a PSNR target and carrier positions derived from a public per-video nonce.
- Synchronization: A payload-free search estimates scale, rotation, and translation from carrier energy before decoding, using the embedded carrier as its alignment target.
- Closed-loop signing: Closed-loop signing tests the unchanged public verifier across PSNR rungs and can require attacked outputs to verify before accepting an embedding.
4. Experiments
The experiments evaluate a training-free signer and public verifier end to end on controlled attacks and a separate corpus, using signature verification and wrong-key controls as acceptance criteria.
- Implementation: The implementation is a single training-free program that embeds in Cr, re-encodes at CRF 23, and verifies with public key, nonce, and message length.
- Controlled benchmark: The controlled benchmark uses three 1280×720, 240-frame clips, a 1024-bit payload, ffmpeg attacks, and wrong-key controls in every run.
- Corpus-scale study: The corpus study uses 1000 uncurated UHD clips, each with a unique nonce, end-to-end CLI verification, and mismatched-key checking.
- Baseline: ChunkySeal is retrained for the same 1024-bit payload and begins from 0.995 to 1.000 in-memory bit accuracy on the benchmark clips.
- Baseline: The comparison reports per-axis numbers without an aggregate winner because ChunkySeal uses a private learned extractor while this system uses a public verifier.
4.2. Robustness of the shipped configuration
The shipped configuration remains verifiable across several content-preserving transformations, while cropping exposes a trade-off between spatial coverage and temporal robustness.
- Bit accuracy is 1.000 or within rounding, with signature verification, under CRF 23/28, 50% downscaling, 30-to-24 fps conversion, noise, and brightness change.
- CRF 32 verifies on one of three clips, while cropping and rotation without resynchronization decode at or near chance within the stated design scope.
- With rotation search enabled, bit accuracy is 1.000 at every tested angle up to 2 degrees on both measured clips, whereas disabling it falls from 1.000 to chance.
- A frame-indexed variant verifies after 90% cropping on 3/3 clips and after 80% cropping on 2/3, but frame-rate conversion reaches chance at best 0.558.
- Embedding quality reaches 42.35, 43.06, and 43.48 dB PSNR, while temporal flicker changes by +0.08%, +0.04%, and -0.10%.
4.3. Temporal layout ablation
The run-length layout preserves group identity when frame timing changes, unlike a frame-indexed layout, and remains effective through a real display-and-capture loop.
- The run-length decoder verifies near 1.0 after 30-to-24 fps conversion, while a frame-indexed layout decodes at chance because received and embedding indices diverge.
- In screen recording, the frame-indexed variant fails on all three clips, whereas run-length verifies on all three.
- The display-and-capture loop adds frames, shifts alignment by roughly 35 frames, and loses 4 to 12 dB PSNR, yet run-length verifies at 0.9990, 1.0000, and 0.9941.
4.5. Perceptual cost
At the mildest embedding rung, the watermark incurs measured perceptual costs across six 720p clips while reducing inter-frame flicker on every clip.
- 35.52 to 40.79 dB PSNR and 0.9657 to 0.9777 SSIM were measured across six 720p clips.MS-SSIM was at least 0.9772, while LPIPS ranged from 0.0335 to 0.0887.
- Inter-frame flicker decreased on every clip, by -0.056 to -0.160 absolute difference units.
4.6. Content association at small scale
The optional content-binding extension associates the signed message with a robust content feature and was evaluated on a six-clip corpus at protocol level.
- Zero decoded-feature errors occurred across 42 measurements, and re-verification succeeded on all six clips.The helper string uses BCH[255, 207] coding with correction radius t = 6 over a 255-bit temporally pooled DCT feature.
- All 30 ordered cross-video payload transfers were rejected because each receiving video’s recovered feature disagreed with the signed-message digest.This result is reported for the tested corpus and protocol level.
- The extension’s behavior against a searching adversary over a large corpus is not established, and the main claims do not depend on it.
4.7. Corpus-scale verification
Closed-loop signing verifies signatures for nearly the entire 1000-clip corpus while wrong-key acceptance remains zero; synchronization and attack-aware selection determine the supported operating range.
- 4.7. Corpus-scale verification: 993 of 1000 clips (99.3%) ship a verifying signature, while zero wrong-key verifications are accepted across the corpus.700 clips accept at 42 dB, 176 at 40 dB, 72 at 38 dB, 23 at 36 dB, and reserve rungs recover 22 more.
- 4.7. Corpus-scale verification: With synchronization rotation enabled, bit accuracy stays at 1.000 through 2 degrees; disabling that axis collapses accuracy to chance.The signature verified in every solid-line cell and no wrong key was accepted.
- 4.7. Corpus-scale verification: 189 of 265 measured clips (71.3%) pass the attack-aware gate when 24 fps conversion is used as the gating attack.The gate targets clips that reject the mildest rung.
- 4.7. Corpus-scale verification: 100% of gated clips survive H.264 CRF 23 re-encoding and 97.4% survive 50% rescaling.Selecting for margin under one attack yields embeddings robust under the other tested attacks.
- 4.7. Corpus-scale verification: More host in-band Cr energy worsens detection, and increasing one clip’s energy 2.2× pushed detection to the wrong-key floor.
4.8. Carrier diagnostics
Carrier diagnostics identify host energy in the carrier band as a noise floor and show why a single embedding strength cannot serve all content.
- Clips with more host energy inside the carrier band detect worse, with a strong negative rank correlation on a 7-clip panel.
- Raising one clip’s saturation moved its in-band energy up by 2.2× and shifted detection from healthy to failing.The host noise floor spans more than an order of magnitude across real footage.
- Because host noise varies substantially across real footage, no single embedding strength serves all content.This motivates the per-video embedding-strength ladder used by the closed loop.
5. Discussion and Conclusion
The system establishes training-free signature transport for video with public verification, while explicitly bounding its claims to tested transformations and corpus conditions. It also identifies visible geometric edits, a small rejection residue, limited content-association validation, and untested recapture as remaining boundaries.
- What is established: Public verification requires only the public key and metadata, so detection capability no longer implies signing capability.The verifier is published and identical across videos; the private key remains with the signer.
- What is established: 99.3% of 1000 uncurated real-world clips received verifying signatures, while wrong-key controls were accepted zero times.The acceptance criterion is the signature check itself, and degraded inputs produce NOT VERIFIED rather than a false positive.
- Deployment: The verifier needs the nonce, mode, and message length beside the video, such as in a sidecar manifest.These are public provenance metadata, while security rests on the private key.
- Limitations: Visible geometric edits are out of scope, and 7 of 1000 clips rejected every evaluated embedding rung.Cropping breaks decoding, and the system reports failure rather than tolerating a visibly altered frame.
- Limitations: Content association was validated on six clips, while large-scale searching-adversary behavior and camera recapture remain untested.These are stated open problems rather than claimed capabilities.
- Outlook: Per-video content certification at corpus scale and physical-display recapture are identified as natural next steps.The paper presents capacity, corpus-scale coverage, and closed-loop operating points as a usable primitive for video.