Decryption and variant processing

A plurality of byte ranges including at least one encrypted byte range forms a variant sample for providing a digital watermark in content output by a player device. The plurality of byte ranges is ordered in a secured memory, and stored in an unsecured memory including one or more encrypted byte ranges for further processing of the ordered plurality of byte ranges. According to another aspect, a plurality of byte ranges forms a sample for content output from a player device, and includes at least one double-encrypted byte range. The plurality of byte ranges is stored in a secured memory, and the at least one double-encrypted byte range is partially decrypted to generate at least one decrypted singe-encrypted byte range. The plurality of byte ranges is stored in an unsecured memory using the at least one decrypted single-encrypted byte range in place of the at least one double-encrypted byte range.