A Lightweight Deep Learning Framework for Robust Video Watermarking in Adversarial Environments ^†

Abstract

The widespread distribution of digital videos in social networks, streaming services, and surveillance systems has increased the risk of manipulation, unauthorized redistribution, and adversarial tampering. This paper presents a lightweight deep learning framework for robust and imperceptible video watermarking designed specifically for cybersecurity environments. Unlike heavy architectures that rely on multi-scale feature extractors or complex adversarial networks, our model introduces a compact encoder–decoder pipeline optimized for real-time watermark embedding and recovery under adversarial attacks. The proposed system leverages spatial attention and temporal redundancy to ensure robustness against distortions such as compression, additive noise, and adversarial perturbations generated via Fast Gradient Sign Method (FGSM) or recompression attacks from generative models. Experimental simulations using a reduced Kinetics-600 subset demonstrate promising results, achieving an average PSNR of 38.9 dB, SSIM of 0.967, and Bit Error Rate (BER) below 3% even under FGSM attacks. These results suggest that the proposed lightweight framework achieves a favorable trade-off between resilience, imperceptibility, and computational efficiency, making it suitable for deployment in video forensics, authentication, and secure content distribution systems.

1. Introduction

Video watermarking is increasingly recognized as a fundamental security mechanism for ensuring content authenticity and provenance in the digital era. In cybersecurity contexts, such as digital forensics, surveillance data integrity, and copyright protection, watermarks serve as an invisible trace that can verify ownership or detect unauthorized manipulation [1,2,3]. However, recent developments in adversarial machine learning and generative video synthesis (e.g., deepfakes, AI-based recompression) have exposed the limitations of traditional watermarking schemes.

Conventional spatial- or frequency-domain techniques such as DCT, DWT, or DT-CWT [4,5,6] are effective against standard distortions (e.g., compression, noise) but remain highly vulnerable to adversarial perturbations designed to remove or distort embedded patterns without perceptible changes to the visual content. Deep learning has emerged as a powerful alternative, enabling adaptive and trainable watermarking systems [7,8]. Nevertheless, most existing deep watermarking models fall into two extremes: lightweight designs that ignore temporal coherence (e.g., ItoV [9]) or highly complex frameworks requiring heavy training pipelines and high-end GPUs (e.g., DVMark [10]).

To address these challenges, this work proposes a lightweight, adversarial resilient video watermarking framework optimized for cybersecurity applications. The design emphasizes efficiency, modularity, and robustness under both conventional and adversarial attacks. Unlike prior deep learning–based systems that focus solely on signal fidelity, our model explicitly integrates adversarial training routines to enhance resilience against perturbations generated by deep neural attackers.

2. Methodology

2.1. Overall Arquitecture

The proposed framework, shown conceptually in Figure 1, is composed of five main modules trained end-to-end:

Figure 1. Conceptual overview of the proposed lightweight watermarking architecture.

• Frame Encoder: A MobileNetV3-based lightweight encoder extracts semantic features from each input frame V_t, reducing spatial redundancy while preserving key structural information.
• Attention Map Generator: A shallow U-Net estimates a block importance map M_t, which highlights perceptually redundant and temporally stable regions suitable for watermark insertion.
• Watermark Encoder: A compact multilayer perceptron (MLP) converts the binary watermark vector $z\in {\{0,1\}}^{256}$ into a spatial tensor $Z\in {\mathbb{R}}^{C\times H\times W}$, aligned with the video frame dimensions.
• Spatiotemporal Injection Module: The encoded watermark is embedded additively into the selected regions following $V_t^{\prime }=V_t+\lambda {\mathsf{\Omega }}_t\odot Z$, where ${\mathsf{\Omega }}_t$ is the binary mask derived from M_t. Temporal redundancy is introduced by spreading the watermark across T = 8 consecutive frames.
• Decoder and optimization: A mirrored MobileNet decoder reconstructs the watermark from possibly distorted frames. The network is optimized using multi-objective loss:

$$\mathcal{L}={\lambda }_1{\mathcal{L}}_{BER}+{\lambda }_2\left(1-SSIM\left(V,V^{\prime }\right)\right)+{\lambda }_3{‖\mathsf{\Omega }‖}_1,$$

(1)

where ${\mathcal{L}}_{BER}$ ensures watermark fidelity, the SSIM term enforces imperceptibility, and the sparsity term limits embedding regions.

2.2. Adversarial Training and Attack Simulation

To improve resilience under malicious manipulation, the model incorporates adversarial training where both encoder and decoder are jointly optimized under perturbations generated via the Fast Gradient Sign Method (FGSM) and Projected Gradient Descent (PGD). During training, frames are also subjected to H.264 compression (QP = 28–40), Gaussian noise (σ = 5), and frame dropping (20%), simulating real-world degradation in surveillance or streaming systems.

2.3. Computational Efficiency

The total model size is 4.3 M parameters (≈1/8 of DVMark [10]) and processes 42 frames per second on an RTX 3060 GPU (NVIDIA, Santa Clara, CA, USA), making it deployable in real-time forensic or streaming pipelines.

3. Results and Discussion

3.1. Evaluation Setup

Experiments were conducted on a reduced version of the Kinetics-600 dataset [11], using 2000 clips (16 frames each, 224 × 224 pixels). The benchmark compared the proposed model with ItoV [9] and DVMark [10] under five representative attack conditions:

• H.264 compression (QP = 28);
• Gaussian noise (σ = 5);
• Frame drop: 20%;
• FGSM perturbations (ε = 8/255); and
• Deepfake recompression simulated with a GAN-based encoder.

3.2. Quantitative Results

Under standard conditions, as shown in Table 1, the model achieves an average PSNR ≈ 39 dB and SSIM ≈ 0.97, comparable to more complex architectures but with substantially fewer parameters. Against adversarial perturbations (FGSM, GAN-based recompression), the proposed system maintains BER < 3%, confirming its ability to recover watermark bits even after targeted attacks.

Table 1. Comparative performance of video watermarking models under various attack conditions.

Attack	BER (%)			PSNR (dB)	SSIM
	ItoV [9]	DVMark [10]	Proposed
None	2.9	2.1	1.2	38.9	0.967
H.264 (QP 28)	5.4	3.2	1.5	36.7	0.951
Gaussian Noise	3.6	2.7	1.4	37.5	0.955
$\mathrm{FGSM} (\epsilon =8/255)$	7.8	5.9	2.8	35.2	0.944
Deepfake Recompression	8.5	6.3	3.0	34.7	0.939

3.3. Qualitative Analysis

Visual inspection confirms that watermarked frames remain indistinguishable from originals. The adaptive mask avoids high-saliency regions such as faces and edges, while temporal redundancy mitigates degradation due to frame loss or adversarial reordering. The model’s lightweight design also reduces overfitting to specific attacks, improving generalization.

4. Conclusions and Future Work

This paper introduced a compact deep learning framework for adversarial-resilient video watermarking, explicitly oriented toward cybersecurity applications. By combining lightweight convolutional backbones, attention-guided block selection, and adversarial training, the system achieves a strong balance between invisibility, robustness, and real-time efficiency.

Compared to prior works such as DVMark and ItoV, the proposed model achieves comparable imperceptibility with up to 80% fewer parameters and higher robustness under adversarial perturbations and deepfake recompression. These features make it particularly suitable for edge-based forensic verification, distributed video authentication, and online copyright monitoring.

Future research will explore the integration of self-supervised attack generation, dynamic payload watermarking, and transformer-based temporal modeling to further enhance resilience in large-scale, adversarial compromised multimedia environments.