LTX-2 Marking Pack: Lightricks Adds Opt-In Invisible Watermarks to Open Video Generation

Lightricks has released LTX-2-Marking on Hugging Face, a small weights pack that lets the open LTX-2 video and audio pipelines stamp an invisible watermark on what they generate. The video mark uses Meta's PixelSeal, the audio mark uses Meta's AudioSeal, and both are switched on only if you ask for them. The repository's own caveat is the important part: the marks are "not cryptographic signatures", and a clip with no detectable mark is not proof that it was human-made.

That makes this a modest but useful step for open-weight generation, where nobody can force a provenance layer on users the way a hosted service can. Below is what is in the pack, how marking and detection work, where the limits are, and how it compares with the closed-lab approaches we have covered.

TL;DR: LTX-2 Marking at a glance

What is in the LTX-2-Marking pack?

The repository is weights only. The five files the loader requires are pixelseal.pth (embedder and extractor), pixelseal.yaml (the model card with a 256-bit payload and 256 px processing size), videoseal_attenuation.yaml (a just-noticeable-difference channel map), plus audioseal_generator.pth and audioseal_detector.pth (the 16-bit AudioSeal base models). SHA-256 checksums are listed for every file.

Provenance is spelled out. The PixelSeal checkpoint is Meta's public one from the facebookresearch/videoseal repo, repacked to keep only the model state dict. Lightricks dropped the optimizer, discriminator, EMA and scheduler state, and states that the model tensors are unchanged. The AudioSeal files are the unmodified 16-bit base models from Meta's audioseal project. Licenses are the upstream MIT ones, with the LTX-2 code licensed separately.

One practical safety note from the card: .pth files are PyTorch pickles, so verify the checksums and load them only from this repository. That is good advice for any checkpoint you download.

How does marking work in the LTX-2 pipelines?

The LTX-2 library never downloads the weights itself. You fetch the pack to a local folder with hf download Lightricks/LTX-2-Marking --local-dir path/to/marking, install the extras (pip install 'ltx-pipelines[videoseal,audioseal]'), and then add one flag to the video or audio CLIs:

python -m ltx_pipelines.distilled \
  ... \
  --marker-root-path path/to/marking \
  --output-path out.mp4

Leave the flag off and the output is untouched. According to the marking documentation in the LTX-2 repository, the same flag works across the video generation and editing CLIs, the HDR IC-LoRA and the text-to-audio pipeline. The behavior differs by pipeline:

The video mark targets SDR H.264 output. Audio is stamped on stereo PCM, with each channel processed as its own mono signal, at the native 24 or 48 kHz rate with no resampling.

How do you check whether a clip is marked?

There is no inspect command line tool; detection is a Python call. You load both markers with create_markers and run detect_video_mark and detect_audio_mark. Each returns a MarkDetectResult with detected, bit_accuracy, p_value and payload.

The decision rules are different for each medium:

• Video: every 8th decoded frame is resized to 256 by 256 and run through the extractor, and the bit logits are averaged. A clip counts as marked when log10(p_value) is below -6. The p-value comes from a binomial test of the decoded bits against the payload, which is fixed in the LTX-2 code rather than in the weights.
• Audio: the full track is scanned, and the clip counts as marked when at least half of the samples have a watermark probability above 0.5.

On speed, the card reports about 15 to 30 ms per 5 to 10 second clip at up to 4K on a single B200, versus 0.6 to 3 seconds on CPU, both excluding file decoding. So a platform could screen uploads cheaply, provided the uploads still carry the mark.

What the mark does not prove

A faint pattern in the corner of a sheet, like an LTX-2 invisible watermark that is easy to miss

The honest framing in the model card is what makes this release worth reading. Three limits stand out.

First, it is not a signature. Nothing here binds a clip to a named creator, a date or a device. It only says a pipeline with marking enabled probably produced it. Compare that with content-credential approaches, which attach signed metadata, a topic we covered in Google's public SynthID verification tool.

Second, detection is open. Anyone holding the weights and code can run it. That is good for transparency and bad for secrecy: an attacker can test their own edits against the detector until the mark disappears. Lightricks says plainly that a determined adversary may be able to weaken or remove it. The VideoSeal repository also lists WmForger, a NeurIPS 2025 spotlight, among its research updates; work on forging and attacking watermarks is active, so treat any mark as removable.

Third, absence proves nothing. Because marking is opt-in and the weights are public, anyone can generate with LTX-2 and simply not turn it on. A clean detection result tells you the clip was not marked by this pack, not that it is real. For anyone doing verification work, the safe reading is one-directional: a positive hit is informative, a negative is not.

Why PixelSeal and AudioSeal?

Lightricks did not invent a new watermark. It reused Meta's open models, which are released under MIT. The VideoSeal repository describes PixelSeal as reaching a state-of-the-art balance of robustness and imperceptibility through adversarial-only training and JND-based attenuation, with a 256-bit capacity. JND masking hides stronger marks in textured regions and keeps smooth areas clean, which is why the pack ships an attenuation map alongside the checkpoint. The repo also lists ChunkySeal, a 1,024-bit variant, and the earlier VideoSeal v1.0 as stable options.

Choosing off-the-shelf research models has a trade-off. It saves Lightricks from building and defending its own scheme, and it lets third-party tools adopt the same detector. It also means attackers study the same models. Open watermarks are a shared baseline, not a moat.

How does this compare with closed-lab watermarks?

Hosted services can embed marks on the server side and keep the detector private or semi-private. Open weights cannot, because the user controls the machine. That is why this release leans on opt-in and good-faith use.

We have seen the different shapes this takes recently. Google exposes SynthID checks to the public and has extended the idea to biology with protein watermarking. OpenAI added an opt-in text mark in Textgrain for EU users. And the debate over whether any of this works is covered in our explainer on spymarks versus watermarks. In practice, we have also seen viral fakes spread faster than any detector, as in the synthetic protest image case checked with SynthID.

The LTX-2 pack sits at the soft end of that spectrum: public tooling, user-controlled, no registry. Its value is that teams who want to be responsible with an open video model now have a supported switch rather than a DIY project.

Who should turn it on?

Practical guidance, based on what the documentation says:

1. Studios and agencies shipping LTX-2 output to clients or platforms. Marking gives you a way to later show a clip came from your pipeline.
2. Platforms that accept uploads and want a cheap screening signal. A GPU makes detection nearly free per clip. Treat positives as evidence and negatives as unknown.
3. Researchers studying robustness. The pack, the fixed payload in code and the open detector make attack and defense experiments reproducible.
4. Hobbyists: optional. Marking costs a flag and a five-file download, but you lose nothing by skipping it, and you should not expect it to protect your work from copying.

Remember the scope limits: no video mark on HDR output, no video mark on the audio-to-video audio track, and the video detector samples only every 8th frame at 256 px, so very short or heavily re-edited clips may not carry enough signal.

Caveats and open questions

• No published robustness numbers in the pack. The card does not report how the mark survives re-encoding, cropping or filters in LTX-2 output. Meta's papers cover that for the base models, but results for this specific integration are not stated.
• Image quality impact. The card does not quantify visual degradation either; PixelSeal's design goal is imperceptibility, which you can test on your own footage.
• No standard registry. Nothing connects this payload to a shared directory, so third parties cannot tell which pipeline or user made a clip beyond "an LTX-2 pipeline with marking on".
• Policy pressure. Rules in several jurisdictions are moving toward labeling synthetic media. Whether open-weight releases will be expected to ship marking by default is unsettled.

What this means for builders

If you generate video with LTX-2 for anything public, marking is cheap insurance and a signal of good faith. If you build moderation or verification tools, add this detector as one more weak signal among many and never as a verdict. And if you are choosing an open video model, notice that the tooling around provenance is becoming part of the release, not an afterthought.

Related reading

• LTX-2.5: Lightricks ships a 22B open-weight video and audio model
• Google's SynthID website and public AI media verification
• DeepMind SynthID Bio: protein watermarking
• OpenAI Textgrain text watermark
• Spymarks vs watermarks explained
• Fake AI protest image checked with SynthID

Details are accurate as of October 28, 2026, based on the LTX-2-Marking model card and the LTX-2 marking documentation. Check the repositories for later changes.