Forensic Watermarking

Introduction

Forensic watermarking is a content protection technology that embeds an invisible, imperceptible identifier directly into the video frames during encoding. Unlike DRM, which controls access to content, forensic watermarking enables tracing — if a protected video is leaked or redistributed illegally, the embedded watermark can be extracted to identify the specific viewer session that was the source of the leak.

The watermark is designed to survive common attacks such as re-encoding, cropping, scaling, screen recording, and analog capture (e.g. camcording).

Qencode supports forensic watermarking on advanced_hls output format using DoveRunner forensic watermarking technology.

How it works

DoveRunner forensic watermarking uses an A/B variant approach:

1. Preprocessing (encoding time). The video is encoded twice using a special watermark filter: once with symbol=0 (variant A) and once with symbol=1 (variant B). Each variant has a different, invisible watermark pattern embedded into every frame. Both variants are complete, independent HLS outputs stored under separate paths (/0/ and /1/).
2. Embedding (playback time). When a viewer starts a playback session, a CDN-side embedder (session manager) converts a unique session identifier into a binary sequence and selects segments from variant A or B accordingly. The viewer receives a stream that is a mix of A and B segments, forming a unique binary pattern tied to that specific session.
3. Detection (if content is leaked). The leaked video is submitted to the DoveRunner detection API, which analyzes the frames, recovers the embedded binary pattern, and maps it back to the original viewer session.

Qencode handles step 1 (preprocessing). Steps 2 and 3 are handled by your CDN integration and DoveRunner services respectively.

Prerequisites

• A DoveRunner account is required. Visit doverunner.com to sign up or contact the DoveRunner helpdesk to obtain your commercial credentials.
• You will receive two credentials from DoveRunner:
• Watermark key — a base64-encoded key file used by the watermark filter. Passed as doverunner_wm_key.
• Access key — an authorization string for the watermark service. Passed as doverunner_access_key.
• The encoding request must use "encoder_version": 2 (v2 encoder). Forensic watermarking is not supported with the v1 encoder.

1

Create a Qencode job with forensic watermarking

Add a forensic_watermark object inside your advanced_hls format item with the two DoveRunner credentials:

{
  "query": {
    "source": "https://example.com/input.mp4",
    "encoder_version": 2,
    "format": [
      {
        "output": "advanced_hls",
        "forensic_watermark": {
          "doverunner_wm_key": "YOUR_DOVERUNNER_WM_KEY",
          "doverunner_access_key": "YOUR_DOVERUNNER_ACCESS_KEY"
        },
        "stream": [
          {
            "size": "1920x1080",
            "bitrate": "5000"
          },
          {
            "size": "1280x720",
            "bitrate": "2500"
          }
        ],
        "destination": {
          "url": "s3://your-bucket/output/path/",
          "key": "your-s3-key",
          "secret": "your-s3-secret"
        }
      }
    ]
  }
}

forensic_watermark parameters

2

Output structure

When forensic watermarking is enabled, the system produces two complete HLS outputs under the destination path, each in its own subdirectory:

output/path/
  0/                          <- variant A (symbol=0)
    playlist.m3u8
    video_0/
      chunklist.m3u8
      segment-0.ts
      segment-1.ts
      ...
    audio_0/
      chunklist.m3u8
      segment-0.ts
      ...
  1/                          <- variant B (symbol=1)
    playlist.m3u8
    video_0/
      chunklist.m3u8
      segment-0.ts
      segment-1.ts
      ...
    audio_0/
      chunklist.m3u8
      segment-0.ts
      ...

Both variants share the same segment structure and timing, allowing the CDN embedder to freely mix segments from /0/ and /1/ on a per-segment basis.

Identifying variants in job status

When the job completes, each video output in the status response includes a wm_symbol field in its meta object. Use this field to identify which variant (A or B) each output belongs to:

• wm_symbol: 0 — variant A
• wm_symbol: 1 — variant B

Example from a completed job with two stream profiles (1080p and 720p):

{
  "videos": [
    {
      "tag": "video-0-0-0",
      "url": "https://storage.example.com/0/.../playlist.m3u8",
      "meta": {
        "width": 1920,
        "height": 1080,
        "wm_symbol": 0
      }
    },
    {
      "tag": "video-0-0-1",
      "url": "https://storage.example.com/0/.../playlist.m3u8",
      "meta": {
        "width": 1280,
        "height": 720,
        "wm_symbol": 0
      }
    },
    {
      "tag": "video-1-0-0",
      "url": "https://storage.example.com/1/.../playlist.m3u8",
      "meta": {
        "width": 1920,
        "height": 1080,
        "wm_symbol": 1
      }
    },
    {
      "tag": "video-1-0-1",
      "url": "https://storage.example.com/1/.../playlist.m3u8",
      "meta": {
        "width": 1280,
        "height": 720,
        "wm_symbol": 1
      }
    }
  ]
}

The full example Python script that launches a Qencode job with DoveRunner forensic watermarking is available here.

Warning:

Enabling forensic watermarking effectively doubles the video encoding work, since the source is encoded twice (once per symbol variant). Both variants are processed in parallel on separate encoder instances. Billing is based on actual encoding minutes consumed.

3

Constraints

• Only supported with advanced_hls output format.
• Requires "encoder_version": 2. Submitting a request with forensic watermarking and v1 encoder returns a validation error.
• Currently supports H.264 (libx264) video codec only.
• GOP structure is automatically enforced (2-second closed GOPs with scenecut=0) to ensure segment-level A/B compatibility.

4

Related resources

• DoveRunner Forensic Watermarking Documentation
• DoveRunner Getting Started Guide
• DoveRunner Watermark Embedding Guide (CDN-side session mixing)
• DoveRunner Watermark Detection API (leak investigation)