What question did this study set out to answer?

The aim is to develop a watermarking system for video diffusion models that detects unauthorized usage without needing access to model weights.

April 1, 2026Open Access

VideoShield: Adversarially Optimized Latent Space Injection for Architecture-Agnostic Video Diffusion Model Watermarking with Complete Dilution Curve Detection and Unified Proactive/Retroactive Invariant

Key Points

The aim is to develop a watermarking system for video diffusion models that detects unauthorized usage without needing access to model weights.
Injected cryptographic directional vectors into VAE latent tensors with specific strength for secure watermarking.
Employed gradient ascent for adversarial optimization to enhance detection across dilution levels.
Achieved architecture-agnostic detection by focusing on ultra-low-frequency PSD bands.
Created a unified method for proactive and retroactive watermarking and inference attack detection.
Achieved effective detection at dilution levels ranging from 1% to 20%, with significant improvements in detection capability.
Documented a 254x increase in detection effectiveness at 20% dilution and a 653x increase at 2%.
Established a non-monotonic cross-contamination amplification effect in watermark detection.
Successfully generated compliant forensic reports for legal admissibility.

Abstract

We present VideoShield, a system for detecting unauthorized use of specific video works in video diffusion model training corpora, without requiring model weight access. Four contributions are made: (C1) Latent space injection — per-video cryptographic directional vectors injected into VAE latent tensors at LATSTRENGTH=0. 15, validated at 1% corpus dilution across 3 independent sessions (t = +997, p = 2. 67e-46) ; (C2) Adversarially optimized DELTAₒpt — gradient ascent produces detection at all dilution levels 1%-20%, eliminating two previously blind spots, with gains of 254x at 20% and 653x at 2%; (C3) Architecture-agnostic cross-VAE injection — restricting injection to ultra-low-frequency PSD bands 0-2 enables detection across 3 independent video VAE architectures: Wan 2. 1 (Alibaba), CogVideoX (Tsinghua), HunyuanVideo (Tencent) ; (C4) Unified proactive/retroactive invariant — PSD bands 0-2 (DELTABB2) are simultaneously optimal for proactive watermarking (B6) and retroactive Membership Inference Attack detection (B7, t = 11, 431, p = 8. 28e-126), revealing that video DiTs preferentially memorize quasi-DC latent spatial components regardless of injection mechanism. A non-monotonic cross-contamination amplification effect is documented. The system generates ISO/IEC 27037-compliant forensic reports admissible under EU AI Act Article 53. v2 (March 30, 2026): Added citation and discussion of concurrent work by Hu et al. (arXiv: 2501. 14195, ICLR 2025) in Related Work (Section 2. 4) and Discussion (Section 5. 2). No changes to scientific content, experiments, or claims.

VideoShield: Adversarially Optimized Latent Space Injection for Architecture-Agnostic Video Diffusion Model Watermarking with Complete Dilution Curve Detection and Unified Proactive/Retroactive Invariant

Key Points

Abstract

Cite This Study