Methods, devices, and computer program products enable the embedding of forensic marks in a host content that is in compressed domain. These and other features are achieved by preprocessing of a host content to provide a plurality of host content versions with different embedded watermarks that are subsequently compressed. A host content may then be efficiently marked with forensic marks in response to a request for such content. The marking process is conducted in compressed domain, thus reducing the computational burden of decompressing and re-compressing the content, and avoiding further perceptual degradation of the host content. In addition, methods, devices and computer program products are disclosed that obstruct differential analysis of such forensically marked content.