My guess is it will be similar to how Genius watermarked lyrics, using things like variants of punctuation
https://www.pcmag.com/news/genius-we-caught-google-red-hande...
https://www.pcmag.com/news/genius-we-caught-google-red-hande...
> total = calculate(items)
> result = calculate(items)
> value = calculate(items)
> amount = calculate(items)
All of them are reasonable options. If we bias the model's output so that one of them is more likely than the others, then we can reconstruct that watermark if enough of these frames are present.