LoT-Pass: Long-term-robust Image Watermarking for Image to Video Generation¶

Conference: ECCV 2026
arXiv: 2509.17773
Area: Self-Supervised Learning
Keywords: Image Watermarking, I2V Generation, Long-term Robustness, Temporal Inversion, Copyright Protection

TL;DR¶

LoT-Pass proposes a bidirectional robustness strategy: simulating temporal evolution during training to actively expand the watermarking robustness distance, and employing optical flow inversion during inference to "pull back" severely drifted frames into an extractable state. This achieves a video-level watermark extraction accuracy of over 95% for the first time in image-to-video (I2V) generation scenarios.

Background & Motivation¶

With the rapid adoption of image-to-video (I2V) generation models like Stable Video Diffusion, Wan, and Hunyuan, copyright infringement risks have risen sharply: attackers can easily utilize copyrighted images or personal photos as input conditions to generate infringing derivative videos or even deepfakes. Digital watermarking offers a viable post-hoc tracing solution for such scenarios by embedding invisible holder information into the original image, which can later be extracted and verified from downstream outputs. However, existing watermarking methods reveal a fatal bottleneck in I2V scenarios: due to the semantic and structural drift (semantic drift) inherent to the generative process, the watermark signal exists reliably only within the first few frames close to the original input, being almost entirely lost in subsequent frames. This allows attackers to easily obtain clean, untraceable infringing videos through simple "temporal cropping"—discarding the first few frames to extract drifted later frames.

The fundamental contradiction of this short-lived survival lies in the fact that simply increasing the forward embedding strength cannot combat the non-linear semantic divergence in I2V generation; every watermarking method has a signal saturation point beyond which any embedded watermark signal, regardless of its strength, will be completely destroyed by the generation process. Therefore, achieving long-term robustness requires a fundamental strategy shift. The core insight of this paper is that rather than passively allowing the watermark signal to suffer in extreme forward drift, it is far more effective to perform an "inverse operation" on frames that have drifted outside the extractable range, pulling them back to a state friendly to the watermark decoder. Based on this idea, LoT-Pass proposes a bidirectional robustness framework: during the training phase, it simulates typical I2V distortions (VAE compression/reconstruction and random pixel shifting) to train the encoder and decoder to reliably embed and extract watermarks under these distortions, thereby expanding the robust distance in the forward path; during the inference phase, it utilizes optical flow estimation to backward-align severely drifted later frames to the coordinate system of the initial reference frame before feeding them to the decoder, thus backward-recovering unextractable frames. Core Idea: Shift the long-term robustness of image watermarking from "unidirectional resistance to distortion" to a bidirectional strategy of "forward expansion of robust distance + backward temporal recovery", using simulated temporal evolution during training to expand the forward robust radius, and utilizing the optical flow inversion module during inference to backward-align shifted frames.

Method¶

Overall Architecture¶

LoT-Pass adopts an encoder-decoder watermarking architecture. Its core innovations lie in introducing two targeted modules during the training and inference phases, respectively. During training, the watermark encoder receives the original image \(I_o\) and the watermark message \(w \in \{0,1\}^M\), generates the encoded image \(I_E\) via a message projection layer and a MUNIT-based feature fusion network, and then fuses it with the original image through a JND (Just Noticeable Difference) module to produce the watermarked image \(I_{Wm} = I_o + \lambda \times JND(I_E - I_o)\). \(I_{Wm}\) is processed by a noise layer (incorporating temporal evolution simulation and various general distortions) and then fed into the decoder to reconstruct the watermark. A ResNet-based discriminator is also introduced during training to constrain the visual quality of the watermarked image via adversarial training. During inference (video mode), after the watermarked image generates a video via an I2V model, each frame is first processed by the temporal inversion module to align with the first frame's coordinate system using optical flow, and then sent to the decoder to extract the watermark frame-by-frame. Finally, a bit-majority voting scheme aggregates the extraction results from all frames to yield the final watermark.

%%{init: {'flowchart': {'rankSpacing': 24, 'nodeSpacing': 28, 'padding': 6, 'wrappingWidth': 400}}}%%
flowchart TD
    A["Original Image Io"] --> B["Watermark Encoder<br/>Message Projection + MUNIT"]
    B --> C["JND Fusion<br/>Io + λ·JND(IE-Io)"]
    C --> D["Watermarked Image Iwm"]

    E["Watermark Message w"] --> B

    D --> F{"Phase"}

    D --> T["Discriminator<br/>(For Training)"]

    F -->|Training| G["Noise Layer<br/>Inc. Temporal Evolution Sim.<br/>VAE Reconstruction + Rand Warp"]
    G --> H["Noisy Image IN"]
    H --> I["Temporal Inversion<br/>(50% Probability)"]
    I --> J["Aligned Image"]
    J --> K["Watermark Decoder<br/>ConvNeXt + MLP"]
    H --> K
    K --> L["Extracted Watermark ŵ"]

    F -->|Inference| M["I2V Model<br/>(Black-box)"]
    M --> N["Video Frames F1...FL"]
    N --> O["Temporal Inversion<br/>Flow Align to First Frame"]
    O --> P["Aligned Frame Sequence"]
    P --> K
    K --> Q["Frame-wise Watermarks"]
    Q --> R["Bit-majority Voting"]
    R --> S["Final Watermark w"]

Key Designs¶

1. Temporal Evolution Simulation: Anticipating I2V Generation Distortions via Proxy Operations During Training

Traditional watermark training noise layers only include general image operations like cropping, JPEG compression, and Gaussian blur, failing to simulate signal destruction patterns specific to I2V generation. LoT-Pass incorporates two targeted simulation operations into the noise layer. The first is VAE Reconstruction: transporting the watermarked image through a pre-trained Stable Diffusion VAE, which goes through encoding to latent space, noise addition/denoising, and decoding back to pixel space. This precisely replicates the key processing steps of most I2V models (e.g., SVD, CogVideoX)—the diffusion process of I2V gradually "forgets" the input condition in the latent space, and VAE reconstruction perfectly simulates this information dissipation. The second is Random Warping: generating a low-resolution Gaussian grid flow field, upsampling it to the target resolution, and overlaying it onto the standard sampling grid to apply smooth pixel-level shifting to the watermarked image, simulating the pixel motion introduced by temporal consistency layers in I2V models. Neither of the two simulation operations requires actually running an I2V model (which is infeasible during training anyway), acting as lightweight proxies that allow the encoder-decoder to proactively learn to resist I2V-specific signal distortions.

2. Temporal Inversion Module: Pulling Drifted Frames Back to Decoder-Familiar Data Manifold using Optical Flow

Even if the temporal evolution simulation expands the forward robust distance, the drift degree of later video frames might still exceed the extractable range of the decoder. The temporal inversion module fundamentally changes the extraction strategy: instead of forcing the decoder to extract directly from severely drifted frames, it transforms the frame back to a pose close to the reference frame (the first frame by default) before extraction. Specifically, the module uses a pre-trained RAFT optical flow model to compute dense optical flow \(F \in \mathbb{R}^{H \times W \times 2}\) between the reference frame \(I_{ref}\) and target frame \(I_{tar}\), representing the displacement vector of each pixel from the reference frame to the target frame. It then performs inverse resampling—mapping each pixel \((u,v)\) in the target frame back to the coordinate system of the reference frame according to the optical flow vector \((F_x,F_y)\): \(I_{inv}(u,v) = \text{Interpolate}(I_{tar}, (u+F_x, v+F_y))\). Since the reference frame (the first frame) is directly generated from the watermarked input image, it is highly compatible with the encoder's latent space. Aligned later drifted frames are mapped back onto the data manifold familiar to the decoder, dramatically improving the watermark extraction rate. The elegance of this module lies in its execution entirely within the pixel domain, independent of any internal information of the I2V model, making it a plug-and-play general component for black-box models.

3. Two-Stage Training with Adaptive Noise Reweighting

Training adopts a two-stage strategy. In the first stage, the noise layer is disabled, allowing the encoder-decoder-discriminator to quickly converge to a stable state. In the second stage, the noise layer containing the temporal evolution simulation and various general distortions is activated, with noise weights adaptively adjusted at fixed intervals based on validation set performance for each type of noise. The weight \(w_i\) for each noise is updated according to \(w_i = \max(e_i, 0.01) / \sum_j \max(e_j, 0.01)\), where \(e_i\) is the extraction error rate under that specific noise type. Even if the error rate of a certain noise falls below 1%, a minimum weight of 0.01 is retained to ensure the model does not forget learned robust features while adapting to new noises. Additionally, there is a 50% probability that the noisy image passes through the temporal inversion module (using the original watermarked image as a reference) before entering the decoder, training the decoder to extract watermarks from backward-aligned standard images.

Loss & Training¶

The overall training objective is a weighted sum of four loss terms:

\[L = \lambda_1 L_{enc} + \lambda_2 L_{lpips} + \lambda_3 L_{adv} + \lambda_4 L_{dec}\]

where \(L_{enc} = L_2(I_{Wm}, I_o)\) constrains pixel similarity between the watermarked image and the original image; \(L_{lpips}\) is the LPIPS perceptual loss to maintain human imperceptibility; \(L_{adv} = \log(1 - D(I_{Wm}))\) represents the discriminator adversarial loss to further ensure the visual naturalness of the watermarked image; and \(L_{dec} = L_2(w_{dec}, w)\) signifies the watermark decoding loss. The weights are configured as \(\lambda_1=1, \lambda_2=0.1, \lambda_3=0.1, \lambda_4=50\), prioritizing extraction accuracy with the highest weight assigned to the decoding loss. Training uses the MS COCO dataset at \(256 \times 256\) resolution, a 32-bit random watermark message, a batch size of 16, for 250 epochs, optimized using AdamW with an initial learning rate of 0.0001. During inference, the encoder supports arbitrary resolution inputs via a residual scaling strategy: the input image is first downsampled to the training resolution, the encoded diffusion residuals are computed, and then upsampled to overlay back onto the original dimensions.

Key Experimental Results¶

Main Results¶

LoT-Pass is evaluated across four open-source I2V models (CogVideoX, Hunyuan, Wan2.1, SVD) and two commercial models (Kling, Hailuo), compared against seven baseline methods: SSLWM, CIN, MuST, TrustMark, WAM, VINE, and Robust-Wide. For fair comparison, all methods maintain a watermarked image PSNR > 36dB.

Model	Metric (VACC)	LoT-Pass	Best Baseline	RDD (LoT-Pass)	RDD (Best Baseline)
CogVideoX	Video-level Accuracy	0.966	0.891 (WAM)	49	27
Hunyuan	Video-level Accuracy	0.924	0.832 (WAM)	18	6
Wan2.1	Video-level Accuracy	0.943	0.872 (WAM)	49	20
SVD	Video-level Accuracy	0.823	0.731 (WAM)	1	0

In terms of RDD (Robust Diffusion Distance, defined as the maximum number of frames where extraction accuracy holds \(\geq 0.9\)), LoT-Pass achieves 49 frames on both CogVideoX and Wan2.1 (close to the full 50-frame video length), substantially outperforming all baselines. In classic noise robustness testing, LoT-Pass improves by over 22% compared to the second-best method under random warp attacks.

Ablation Study¶

Configuration	Key Metric	Description
Full model	See Main Results	Full LoT-Pass
w/o Temporal Evolution Sim.	FACC drops significantly across all frames	Without simulating temporal evolution during training, the extraction accuracy across all frames degrades dramatically even if temporal inversion is used during inference.
w/o Temporal Inversion	FACC decays rapidly in middle frames	Without the inversion module for direct extraction, FACC drops sharply starting from the middle frames, and degrades to near-random performance in later frames.

Key Findings¶

In temporal evolution simulation, VAE reconstruction and random warping simulate the two core signal-destruction factors of I2V generation—information dissipation from latent space compression/reconstruction and pixel-level motion drift, both of which are indispensable. Models trained with this module show significantly higher FACC across all I2V models compared to those without it.
Temporal inversion contributes minimally to early frames but significantly to later frames: The difference with and without inversion is negligible in the first 10 frames (due to small drift), but the gap widens drastically after the 20th frame. This indicates that backward alignment of later drifted frames is the critical bottleneck for successful extraction.
Performance on commercial models (Kling RDD=120, Hailuo RDD=47) exceeds that of open-source models, as commercial generators yield higher video quality and better temporal coherence, preserving watermark signals more effectively. Under SVD, the RDD of all methods drops close to 0; since SVD lacks text-prompt priors and generates depending entirely on the input image, the drift spirals out of control.
High-motion scenarios deteriorate extraction precision (VACC drops by approximately 2-4%), but LoT-Pass still maintains VACC > 0.91 in high-motion environments.
LoT-Pass maintains VACC > 0.87 (on CogVideoX) even under frame cropping (discarding the first 20% of frames), demonstrating its innate robustness to temporal cropping attacks.

Highlights & Insights¶

Paradigm shift in bidirectional robustness strategy: Prior watermarking robustness research almost exclusively focused on the single direction of "enhancing encoding strength." LoT-Pass introduces the bidirectional concept of "forward expansion + backward recovery" for the first time, representing a fundamental paradigm shift at the defense-strategy level. This approach generalizes to any scenario requiring temporal signal persistence, such as audio watermarking and document tracing.
Clever design of proxy temporal evolution simulation: Simulating the core I2V generation distortions using VAE reconstruction and random warping enables the pre-evaluation of perturbations during training without actually running the heavy I2V models, achieving a sweet spot between training overhead and simulation fidelity. This concept of "proxy distortion training" is transferable to other cross-model watermarking applications.
Practical value of plug-and-play optical flow inversion: The temporal inversion module relies on a pre-trained optical flow model and is independent of any I2V model internal prior, allowing plug-and-play deployment onto black-box models, which is highly practical for real-world scenarios.
Design insights of watermark patterns: The paper discovers that high-performing methods (LoT-Pass, WAM, TrustMark) establish watermark patterns that assemble as large-scale blob-like distributions, which exhibit the greatest variance within the VAE latent space. This suggests that the spatial distribution characteristics of watermark patterns under I2V robustness warrant further investigation.

Limitations & Future Work¶

The temporal inversion module is highly contingent on the accuracy of optical flow estimation. When the I2V generation process undergoes severe structural alterations (e.g., objects vanishing/appearing, drastic viewpoint shifts), optical flow estimation can fail, causing degraded imagery after inversion that hampers watermark decoding.
The paper primarily addresses I2V scenarios; its direct adaptation to text-to-video (T2V) generation remains unexplored. In T2V settings, there is no initial watermarked image to serve as a reference frame, leaving the definition of the inversion module's baseline reference an open question.
Scalability of watermark capacity: The current implementation only evaluates 32-bit messages. In practical applications (such as large-scale copyright registries), higher capacity is often demanded, and the trade-off between higher capacity and long-term robustness warrants research.
Computational overhead: Optical flow estimation incurs additional costs during the inference phase, and its scalability on ultra-long videos requires further validation.
Preemptive adversarial robustness remains under-discussed: If an attacker learns about the existence of the inversion module, they could devise targeted attacks (such as adversarial optical flow perturbations) to disrupt alignment.

vs WAM / TrustMark: Although not specifically optimized for I2V, these two methods are relatively robust in I2V scenarios because their watermark patterns exhibit large-scale blob-like distributions, which present the highest variance in the VAE latent space. This indicates that the spatial distribution characteristics of watermark patterns heavily affect cross-model robustness and can guide the watermark design of other generative models.
vs Robust-Wide / VINE: These methods are optimized for image editing scenarios (instruction-guided editing, inpainting) and demonstrate limited generalization in I2V generation since their training distortions do not cover cross-modal distortions like VAE compression and reconstruction.
vs CIN / SSLWM: As traditional image watermarking methods, their training noise layers only incorporate classic geometric or photometric alterations. In I2V settings, their extraction accuracies across nearly all frames rapidly degrade to random guessing levels, indicating that the latent space distortions unique to I2V represent a critical blind spot omitted by conventional training.

Rating¶

Novelty: ⭐⭐⭐⭐⭐ The concept of the bidirectional robustness strategy (forward expansion + backward recovery) represents a major paradigm innovation for the watermarking community in the generative AI era. The combination of temporal evolution simulation and optical flow inversion systematically resolves the long-term robustness challenge in I2V scenarios for the first time.
Experimental Thoroughness: ⭐⭐⭐⭐⭐ Evaluated across four open-source and two commercial I2V models, encompassing various analyses such as robustness to frame cropping, classic noise, and motion intensity. The ablation study comprehensively validates the necessity of each core module.
Writing Quality: ⭐⭐⭐⭐ The problem definition (temporal cropping attacks) is distinct, the motivational reasoning follows a cohesive logical chain, and the methodology is presented in a well-structured hierarchy. One minor area of improvement would be making certain experimental tables and mathematical annotations more self-contained.
Value: ⭐⭐⭐⭐⭐ As I2V models proliferate across creative industries, copyright provenance has become an urgent demand. This work is the first to systematically define and address the long-term robustness issue of image watermarks in I2V scenarios, conveying remarkable practical value and academic contribution.