SecureGS: Boosting the Security and Fidelity of 3D Gaussian Splatting Steganography
Authors: Xuanyu Zhang
Jiarui Meng
Zhipei Xu
Shuzhou Yang
Yanmin Wu
Ronggang Wang
Jian Zhang
Venue: ICLR 2025 Poster (2025)
Keywords: 3DGS steganography
copyright protection
watermarking
Primary area: alignment, fairness, safety, privacy, and societal considerations

Abstract: 3D Gaussian Splatting (3DGS) has emerged as a premier method for 3D representation due to its real-time rendering and high-quality outputs, underscoring the critical need to protect the privacy of 3D assets. Traditional NeRF steganography methods fail to address the explicit nature of 3DGS since its point cloud files are publicly accessible. Existing GS steganography solutions mitigate some issues but still struggle with reduced rendering fidelity, increased computational demands, and security flaws, especially in the security of the geometric structure of the visualized point cloud. To address these demands, we propose a \textbf{SecureGS}, a secure and efficient 3DGS steganography framework inspired by Scaffold-GS's anchor point design and neural decoding. SecureGS uses a hybrid decoupled Gaussian encryption mechanism to embed offsets, scales, rotations, and RGB attributes of the hidden 3D Gaussian points in anchor point features, retrievable only by authorized users through privacy-preserving neural networks. To further enhance security, we propose a density region-aware anchor growing and pruning strategy that adaptively locates optimal hiding regions without exposing hidden information. Extensive experiments show that SecureGS significantly surpasses existing GS steganography methods in rendering fidelity, speed, and security.

Published as a conference paper at ICLR 2025
SECUREGS: BOOSTING THE SECURITY AND FIDELITY OF 3D GAUSSIAN SPLATTING STEGANOGRAPHY
Xuanyu Zhang' Jiarui , Xu', Shuzhou Yang', Yanmin Wu', Ronggang Wang Jian Zhangl.21 School of Electronic and Computer Engineering, Peking University
=Guangdong Provincial Key Laboratory of Ultra High Definition Immersive Media Technology, Shenzhen Graduate School, Peking University
ABSTRACT
3D Gaussian Splatting (3DGS) has emerged as premier method for 3D repre- sentation due to its real-time rendering and high-quality outputs, underscoring the critical need to protect the privacy of 3D assets. Traditional NeRF steganography methods fail to address the explicit nature of 3DGS since its point cloud files are publicly accessible. Existing GS steganography solutions mitigate some issues but still struggle with reduced rendering fidelity. increased computational demands, and security flaws, especially in the security of the geometric structure of the visu- alized point cloud. To address these demands, we propose SecureGS, a secure and efficient 3DGS steganography framework inspired by Scaffold-GS's anchor point design and neural decoding. SecureGS uses hybrid decoupled Gaussian encryption mechanism to embed offsets, scales, rotations, and RGB attributes of the hidden 3D Gaussian points in anchor point features, retrievable only by authorized users through
neural networks. To further enhance security, propose a density region-aware anchor growing and pruning strategy that adaptively locates optimal hiding regions without exposing hidden information. Extensive experiments show that SecureGS significantly surpasses existing GS steganography methods in rendering fidelity, speed, and security.
INTRODUCTION
Benefiting from its real-time rendering capabilities and impressive rendering quality, 3DGS has become mainstream 3D representation approach. Since optimizing a 3D scene requires a large amount of computing resources and 3D tampering approaches are developing rapidly, protecting the copyright and privacy of 3D assets is particularly important. As an emerging research field, 3DGS steganography aims to embed bits, images, 3D content into 3D Gaussian points invisibly, and extract them losslessly in the decoding end. It has great potential for application in encrypted communications, copyright protection, identity verification, and forensic analysis.
As a preliminary work for 3DGS steganography, previous works on NeRF watermarking have achieved excellent results. For instance, StegaNeRF (Li et al. 2023a) jointly finetuned the weights of NeRF and a decoder so that each 2D rendered view Copy (Luo et al., (2235) and WateRF (Jang et al. 2024a) focused on bit hiding and robust decryption and can achieve copyright traceability of NeRF via 2D view. However, these methods cannot be effectively applied to 3DGS steganography, since 3DGS is an explicit representation and its point cloud files are often made public and transparent for online real-time rendering.
decode the pre-defined watermark.
To achieve this demand, GS-Hider (Zhang et al. 2024b) used a coupled feature field and neural decoders to simultaneously render the original and hidden scene, as shown Fig. [a). However, presents several shortcomings in terms of fidelity, security, and rendering speed. Fidelity: Represent- ing the original scene and hidden information using the same of Gaussian points with a compact
Equal contributions. i Corresponding author. This work was supported in part by Guang- dong Provincial Key Laboratory of Ultra High Definition Immersive Media Technology (No. 2024B1 221000006) and Shenzhen General Research Project (No. 22022221222222500000

---

Published as a conference paper at ICLR 2025
Vemppane
Boodder
Luid
F
End
Overall Framework of GS-Hider
(b): Visualized Point cloud
Figure 1: Analysis of previous 3DGS steganography method GS-Hider (Zhang et al. 2024b).
feature attribute will easily lead mutual interference, especially when the geometry of the hidden information inconsistent with that of the original scene, resulting in suboptimal rendering fidelity. Rendering Speed: Due to the use of convolutional networks to decode the rendered coupled feature fields, there is an increase in computational complexity, which affects the rendering speed of 3DGS steganography certain extent. Security: We categorize the security of GS steganography into two types, namely file format security and geometric structure security. Format security means that the published 3DGS point cloud does not add any additional attributes that could arouse suspicion or lead to deletion by malicious abusers. Geometric structure security denotes when visualizing the Gaussian point cloud, no traces of the hidden scene's 's geometric structure are revealed. The latter is what GS-Hider cannot achieve, which may pose risk of leaking hidden messages (such as Fig. Ib)).
Our insight for solving these problems comes from a successful variant of 3DGS, namely Scaffold- GS (Lu et al. 2023)). Scaffold-GG GS uses anchor points to establish a hierarchical 3D scene representa- tion. Then, set of neural Gaussians with learnable attributes are dynamically predicted from the anchor feature via several simple MLPs. Scaffold-GS is naturally suited for steganography for two reasons: First, it uses implicit MI.Ps store Gaussian point attributes, allowing encryption focus on MLPs rather than explicit Gaussian points. Second, it maintains comparable rendering quality and real-time performance to 3DGS, preserving its high fidelity and fast rendering benefits.
To address the above limitations, we propose more secure and efficient GS steganography frame- work, dubbed SecureGS. Fig. presents our application scenario. Specifically, we design a hybrid decoupled Gaussian encryption representation capable of decoding two sets of dense Gaussian points from a sparse set of anchor points, which are used for rendering the original scene and the hidden object, respectively. Note that we specifically introduce of the hidden Gaussian points. Furthermore, to prevent the geometric structure of the hidden object from being exposed, we innovatively propose density region-aware anchor growing strategy. Based on the gradient of the joint rendering loss, it can adaptively find the location of hidden 3D objects, thereby lowering the splitting threshold in that region and allowing the original scene's 's anchors to cover the hidden anchor points safely. In nutshell, our contributions are summarized as follows.
offset predictor to conceal the positions
O (1) We present a novel attempt to introduce neural voxelization into the 3DGS steganography, realizing more secure, high-fidelity, and efficient framework SecureGS, It can effectively hide 3D objects, images, and bits within the original 3D scene and precisely extract them.
O (2) We develop a bybrid decoupled Gaussian encryption representation that can hide and predict the location and attributes of the hidden Gaussian points via a set of neural decoders, ensuring that the overall framework maintains a format consistency in the point cloud files and is efficient in rendering hidden message and preserving the original scene.
O (3) We propose region-aware density optimization that can locate hidden 3D positions and promote anchor growth in that region while inhibiting pruning, thereby significantly enhancing the geometric structure security of the point cloud within the overall framework.
D (4) Extensive experiments demonstrate that our method significantly outperforms existing 3D steganography methods in terms of the fidelity of container 3DGS, rendering speed, and security.
2 RELATED WORKS
2.1 3D GAUSSIAN SPLATTING
3D Gaussian Splatting (3DGS) (Kerbl et al. 2023) has emerged as a highly effective approach for 3D scene reconstruction, utilizing millions of 3D Gaussians. Starting from set of cenecture-rroo-oone
2

---

Published as a conference paper at ICLR 2025
Hiddin Message
Recovered Hidden Message
0
Hädden lits
Authorized Users
Hidden Bits
ICLR
Extraction
ICLR
Troining views of Hidden Object Hidden
Hidden Object
Hidden Image
Rendering
Points
File Formet
Gecmetncc Structure Security
Training views of Original Scene
Security
Common Users
Rendered 3D Scone
Overall Pipeline our SecureGS. 3D objects, images, and bits can be hidden in the original 3D scene, and only authorized users can decode these hidden messages. The core of our method is to ensure both the file format and geometric structure security of the public anchor points.
Figure 2:
(SfM) points, each point is assigned as the center (mean) μ of 3D Gaussian distribution:
(xx) = - [x--1) (x--)) Σ RSS R
where x is position within the 3D scene and E denotes the covariance matrix of the 3D Gaussian, which is formulated using a scaling matrix S and rotation matrix R. Instead of using the resource- intensive ray- marching,, 3DGS efficiently renders the scene via tile-based rasterizer. Specifically, the 3D Gaussian ((x) are first transformed 2D Gaussians G' (x) on the image plane via the projection mechanism (Zwicker et al. 2001). Let C E R#x x3 represent the color of the rendered image where H and W represent the height and width of images, the a-blending process of a tile-based rasterizer is outlined as follows:
N
C[p] = Σ CO. II - oz), a. = a= (p) j=1
where p (u, v) is the queried pixel position and N denotes the number of sorted 2D Gaussians associated with the queried pixel. &; and a; respectively denote the color and opacity component of the Gaussian point. In contrast to previous implicit representations, 3DGS dramatically improves both training speed and rendering efficiency. To further elevate 3DGS's rendering capabilities, Mip- Splatting Yu et al.. (023b) introduced 2D and 3D filtering, enabling high-quality, alias-free rendering across arbitrary resolutions. Moreover, Scaffold-GS (Lu et al. (2023) integrated structured neural anchors enhance the rendering quality from diverse perspectives. The exceptional performance of 3DGS has extended its utility to broad range of applications, including SLAM (Keetha et al. 2023
Matsuki et al. 2023). ) 4D reconstruction (Li al., 2023b Luiten al. 2023 Wu et al. 2023
Yang
et al. 2024b), and 3D content generation (Tang et al. 2023 Yi et al.
2024
Yang et al. 2024a)
2.2 3D STEGANOGRAPHY
Steganography has undergone significant evolution over the decades (Provos & Honeyman, 2003
Cheddad al. 2010). With the rise of deep learning, deep steganography methods have been
developed to invisibly embed messages into various carriers and reliably extract them, spanning
2D images (Zhang et al. 20244a] Zhu al. 2018 Baluja 2019; Yu al. 2023a Xu al. 2024
Zhang et al. 2024c), videos (Zhang et al. 2024d] Luo et al. 2023a). audio (Liu et al. |023a b Chen
al. 2023 Roman et al. 2024). and generative models (Wen et al. 2024; Fernandez al. (023).
Traditional 3D steganography has focused on watermarking explicit 3D representations, such as
meshes (Ohbuchi al., 2002 Praun al., 1999 Wu al. 2015), typically by perturbing vertices or
transforming data into the frequency domain. Additionally, Yoo et al. (Yoo et al.) 2022 proposed
method to extract copyright information from individual 2D views, even without the full 3D mesh.
Recently, NeRF watermarking has garnered increased attention (Luo et al.)
2023b Jang et al.)
2024a| Li al. 2023a). For instance, StegaNeRF (Li et al. 2023a) embedded images or audio within 3D scenes by fine-tuning NeRF's weights, while CopyRNeRF (Luo et al. (023b) introduced a watermarked color representation and a distortion-resistare rendering strategy to ensure robust message extraction. WaterRF (Jang et al. 2024a) leveraged deferred backpropagation with patch loss and employed discrete wavelet transform to enhance fidelity and robustness. NeRFProtector (Song al. 2024) utilized watermarking base model and progressive global distillation explore relations
3

---

Published as a conference paper at ICLR 2025
between rendering strategies and watermark embedding. Targeted at 3DGS, GS- (Zhang et al. 2024b) used coupled feature fields and neural decoders to render the original and hidden scene, achieving high-quality 3D scene hiding. Mcanwhile, GaussianStego (Li et al. 2024) proposed generalized pipeline for information hiding and recovery in the 3D) generation model. 3D-GSW (Jang al., 2024b) presented frequency-guided Densification strategy for robust watermarking in 3DGS. However, these methods do not take into account the security of point clouds, and the fidelity of container 3DGS is unsatisfactory.
METHODOLOGY
3.1 ANALYSIS OF THE PREVIOUS 3DGS STEGANOGRAPHY METHOD
We first review the recent 3DGS steganography work GS-Hider. As shown in Fig. Ta). GS-Hider follows "coupling-decoupling process. It replaces the spherical harmonic coefficients in 3DGS with a coupled feature attribute f: E R and utilizes high-dimensions render as a coupled feature field F coup "R x Furthermore, we use a public scene decoder and a private message decoder to decouple Lors R x3 and Inid R #gxxxx from F cooup. respectively. Finally, we use the combination of fori and fhid to constrain the optimization of the learaalle attributes of Gaussian points and the weights of two decoders.
rendering pipeline to
Although GS- GS-Hider achieves good rendering quality and the public point cloud file does not exhibit suspicious attributes in terms of format, when we visualize GS- ES--Hier'ss point cloud, the geometric structure of the hidden information is exposed in the public point cloud. For example, in Fig. [b), we observe that when attempting to hide the "mic" in the "bonsai", the shape of the microphone appears in the public point cloud file. This is because GS-Hider uses the same set of points to represent both the original scene and the hidden object, inevitably resulting in geometric and spatial position overlap. Moreover, GS GS-Hider does not implement appropriate optimization strategy to control the growth of Gaussian points used to render the hidden message, which exacerbates the compromise of point cloud security.
shown
3.2 TASK SETTINGS AND OUR OBJECTIVES
Following the setup of GS-Hider Zhang et al. 2024b), we aim for the SecureGS framework to maintain transparency and generalization. Transparency denotes that after users embed information into the original 3D scene, they can openly publish the container 3DGS for online rendering, while preventing unauthorized users from decrypting the hidden information. Generalization refers to the framework's 's ability to adapt to hiding information in 3D objects, images, and bits. To be noted, unlike GS-Hider, we aim to ensure both the file format security and the geometric structure security of the container 3DGS point cloud file. Considering that hiding large-scale 3D scene makes it difficult to ensure that the point cloud structure remains confidential, we only hide a 3D object within the 3D scene. Fig. 2 presents our task settings and realized functions.
3.3 HYBRID DECOUPLED GAUSSIAN ENCRYPTION R REPRESENTATION
Similar to previous approaches (Lu et al. 2023), we use the sparse point cloud produced by COLMAP as the initial input and voxelize the scene, forming the voxel centers V E Nx3, Each voxel center E V is treated as an anchor point and equipped with a local context feature fo E 3 scaling factor 4. 3 and two groups of learnable offsets (Oors jim1 and {Orid 1 which respectively generates the dense Gaussian points representing the original scene and hidden object. To avoid the format inconsistency between the container point cloud file and the original Scaffold-GS caused by explicitly storing {Olit ar j=1 we design an explicit-implicit hybrid Gaussian encryption
me
representation, as shown in Fig. 3 For the Gaussian points representing the original scene, we explicitly store & learnable offsets O -= for each anchor point x., and use scaling factor 4y determine the position of each Gaussian point ori (estee
{ P
1)} X, + (0% ................................ Ort (1- bys
Additionally, we adopt an implicit neural decoder Fi to store the offsets of Gaussian points that render the hidden object. Following (Lu al. 2023). also extend f. to be multi-resolution and
4

---

Published as a conference paper at ICLR 2025
Openitoo Flov
Cradian Flow
Virppiii
[ JATTi
Le2'
Paintts
MILPs
Gausslan Rasterizer
S.ER"
Otfer Prediar
[M fiot R
Lasa
Each Noxel
Attributes of Each Anchor Point
Iac
Ganesian Points
Wright
Bagioneacare Dendity Optimization
Figure 3: Overall framework of our SecureGS. We first voxelize the scene, where each voxel contains an anchor point with the position Xx, feature fv. scaling factor L, and offsets {Oori vgiJi=1- Then, we explicitly compute the positions puss via Eq and predict attributes {c 0 q s via a series of public MLPs. Mcanwhile, position and attributes of the Gaussian points representing the hidden object. Finally, we design region-aware density optimization control the Gaussian point growing and pruning.
ort
private offset predictor Fi and MLPs to store the
view-dependent blended feature fu. Given the camera located at x, and an anchor at x,, the hidden offsets are computed as follows:
(pogo....
hid ( =x + Ft Svc. doe):
(4)
where 8'c ||x, Xel12 denotes the relative distance and doe (x. xx) ||,,- Xella denotes the viewing direction. The offset predictor F/ will only be accessible to authorized users.
Furthermore, use set of public MLPs (Fr: Fq. F&} to predict the opacity a E RR,, quater- nion P0 Rd,, scaling sori IR3 and color cori E R of the Gaussian points representing the original scene and adopt the private MLPs (FL, Fl. F FF} produce {are) qugj svej c that render the hidden object. We take the color component as example.
(
ors (k- 1)) Folfo. dve dve), (chid
c ( 1)) F! 8 Jze).
(5)
Similarly, other attributes of SecureGS can also be produced by these MLPs based on the blended features, the distance, and the viewing direction. Finally, all 3D Gaussian points are rendered into 2D views of the original scene Tori and the hidden object hia via the rasterizer and alpha blending mechanism similar to 3DGS (Kerbl et al. 2023)
3.4 REGION-AWARE DENSITY OPTIMIZATION
Motivation: Although our hybrid Gaussian cryption mechanism can securely represent the hidden Gaussian points in format, by visualizing the anchor point cloud, the clues of the hidden object can still be discovered from the geometric structure, as shown in Fig. 4 For instance, since the anchor point cloud rela- tively sparse, when we hide the 3D object "hot dog" the "bicycle" scene, the geometric struc- ture of the hot dog is completely exposed, which seriously poses significant security risk. To address this issue, straightforward solution is to increase the density of Gaussian points, allowing the Gaussian points of the original scene to obscure those of the hidden object. However, this indiscriminate approach of promoting Gaussian point splitting significantly increases the number of anchor points, leading to slower rendering speeds and higher storage costs.
"Hetdaf" 'Bicycle"
"Lags" "loaert'
"Wic" in "Benta"
find that
Figure 4: Visualization of the point cloud produced by our SecureGS without region-aware density op- timization (RDO) strategy. The RGB reference of the hidden scene placed on the left bottom.
To overcome the trade-off between the storage size and geometry structure security of the container point cloud, we propose a region-awar density optimization strategy to control the splitting and pruning of the Gaussian points adaptively. It can change the threshold of anchor point splitting that
5

---

Published as a conference paper at ICLR 2025
Gaussian anchor points only grow in large quantities the location of hidden objects while having a small impact on the rendering and storage efficiency of the overall framework. Specifically, our anchor growing strategy can be divided into three steps: 1) Asynchronous Gradient calculation: As shown in Fig. 3] for the optimization of both the original scene and the hidden 3D object, we separately accumulate the gradients of the neural Gaussian points involved in backward with different frequencies, denoted as V and Viid- We aim to slow down the accumulation of Void. thereby suppressing the splitting of the hidden anchor points and enhancing security. Obtain high-density region: Since we calculate V and Widd separately, we can also perform anchor growing based on V or: and Wid in a decoupled manner. For example, if hid Tfixs we will split new anchor points, forming the point set hiid Note that Tfir denotes pre-set splitting threshold. Similarly, we can construct I or; using Vori > Tfim as the trigger condition. Afterward, we apply a point cloud clustering algorithm DBSCAN (Ester et al. 1996p on these hidden anchor points I' hid to obtain bounding box Sybw where the hidden anchor points are densely distributed. 3) Growing and pruning for I ori and I'ad: For the growing of I orii replace the fixed threshold Tye with an adaptive threshold Tada for splitting based on whether the points are within the bounding box Saiz-
Tada = Tfir/ / (downs if (I, 2, E Sibs or Tfir else,
(6)
where (ar, y. z) denotes the spatial coordinates of an anchor point. Idown denotes gradient down- sampling ratio. Then, we prune some of the anchor points in I orr U
UT hid an anchor fails to pro duce neural Gaussians with satisfactory level of opacity. Note that we still use Tysz as the threshold for the growing of T hid in this stage. The complete algorithm is presented in Alg. I
3.5 TRANING DETAILS AND LOss FUNCTIONS
To train the proposed SecureGS, we use the pixel-level E loss, SSIM term Lasim and volume regularization loot (Lu et al. 2023) to optimize the learnable attributes of anchor points and the weights of MLPs Fe. Fg. Fe.. Ft Fi. Fi F.). Given the ground truth of the original training view Iori and its corresponding hidden view Insa the supervision is expressed as follows.
Cori = (1 - a) E (Tori, Tore) + a Easim (Tori, Tori) + +B- Enea (1 (10r)), Eiid (1 (1-a) E1 (Inid, Inia) + a LeeimmIhid Inia) + 3 Lool (s
(8)
where a and / are used to balance the components of each loss. The volume regularization Gvo! prompts the neural Gaussians to be compact with minimal overlapping via constraining the product of the scale in each Gaussian. Finally, our total loss is Esotal lors + X Epids where X denotes the trade-off factor to balance the rendering of the original scene and hidden object.
4
EXPERIMENTS
4.1 EXPERIMENTAL SETUP
Dataset Preparation: We respectively conducted experiments on hiding 3D objects, 2D images, and bits in 3D scenes or objects. For 3D object and 2D image hiding, the original scene includes the bicycle (BI.). flowers (FL.). garden (GA.), stump (ST.). trechill (TR.), room (RO.), counter (CO.). kitchen (KI.), bonsai (BO.) from Mip-NeRF 360 (Barron et al. 2021). The hidden 3D object is obtained from the Blender dataset (Mildenhall et al. 2020). We use Supersplat[[as to embed hidden 3D objects into 3D scenes. For bit hiding, we hide 48 bits into the 3D objects (Mildenhall et al. 2020). which is the maximum number of bits that other comparison methods can support.
For 3D object and 2D image hiding, we compare our SecureGS with existing 3DGS steganography method GS-Hider (Zhang et al.) 2024b). Meanwhile, similar to StegaNeRF (Li et al. 2023a), feed the output of the original 3DGS to a U-shaped decoder and constrain it to output hidden objects, thus implementing a variant called StegaSste For bit hiding, since there is still no 3DGS steganography work for bit hiding available, we compare our method with two SOTA NeRF watermarking methods (Luo et al. 2023b Song et al.) 2024).
Comparison Methods:
Evaluation Metrics: We utilize PSNR, SSIM, LPIPS of the original scene, and hidden message to measure the rendering quality of different methods. Meanwhile, FPS and storage size (MB) are
http:://llaycaaaaasscom/mspppppp

---

Published as a conference paper at ICLR 2025
Table 1: Comparison of the PSNR(dB), storage size, and FPS performance of the original scenes and hidden message. "Scene-Level" denotes hiding complete RGB image where the objects are embedded in the original scene, and "Object-level" means hiding isolated objects without background. The best results are highlighted in pink and the second- ones are in yellow
Size
Method
Type
BO.
Avg
(MB)
Scaffold-GS
Ori.
161.46
142.91
25.01
21.26
27.19
26.49
22.96
32.26
29.48
31.35
32.61
27.62
3DGS
Ori.
24.05
27.28
26.00
22.56
28.95
27.46
29.39
31.13
26.53
1106.67
35.09
SSeegaNeRF
Hid.
29:03
29.28
32.38
27.60
28.32
31.35
27.06
32.21
31.20
29.82
Ori.
24.42
20.85
27.28
25598
22.01
30.20
27.88
29.90
84
26.59
GS Hider
468.63
48.28
Hid.
32.96
28.13
27.97
32.95
32.33
30.62
SecureGS
Ori.
25.33
21.34
27.28
26.73
22.93
32.36
29.94
31.51
32.33
27.75
267.39
131.71
(Scene-Level)
Hid.
34.47
30.24
29.38
35.93
32.99
32.28
SecureGS
Ori.
25.31
21.37
27.51
26.75
22.91
32.51
30.28
31.70
33.05
27.93
290.54
106.98
(Object-Level)
Hid.
48.04
40.70
38.23
29.77
50.96
38.45
30.77
33.22
33.75
38.21
GB-Ilider
Seatro (Sean Leeel
Seair Chaed-Laved
Figure 5: Rendering quality comparison of the hidden message between the proposed SecureGS, previous GS-Hider, and 3DGS+StegaNeRI. For our SecureGS, we also present the decoupled original scene and hidden object on the 4thh and 5th row, which cannot be achieved by other methods.
used to evaluate rendering speed and memory efficiency. Bit accuracy (%) is adopted to verify the decoding precision of our framework.
Implementation Details: À set to 10 when hiding 3D objects and set to 0.1 when hiding a single image. and 3 in Eq. X are respectively set 0.2 and 0.01. Tykz and Tdown are respectively set to 0.0002 and 4. We consistently set & = 10 across all experiments and the MLPs used in our approach consist of 2 layers with ReLU activations with each hidden layer having 32 units. We conduct all experiments on the NVIDIA RTX 4090Ti server and use the same rasterizer as the original 3DGS.
4.2 COMPARISON WITH EXISTING 3DGS STEGANOGRAPHI METHODS
To verify the superiority of our method, we compare the proposed SecureGS with two state-of-the-art 3DGS steganography methods in hiding 3D objects in 3D scenes. Our SecureGS has significant advantages in at least the following three aspects.
Higher rendering fidelity: As reported in Tab. 5 our method improves the rendering quality of the original scene by 1.16dB and the fidelity of the hidden object by 1.66dB compared to GS- AS--iierr. Furthermore, due to the utilization of more Gaussian points, the PSNR of our rendered original scene can even slightly surpass that our baseline Scaffold-GS, which proves that our decoupled Gaussian encryption representation ensures the rendering of the hidden object and the original scene do not

---

Published as a conference paper at ICLR 2025
Hotdog
Lego
Drums
Mic
ficus
Figure 6: Visualization of the anchor point cloud of our SecureGS produced based on hid-
(d): RGB Image Reference Figure 7: Visualization of the point cloud generated by GS-Hider, SecureGS without RDO strategy. and the proposed SecureGS, Clues of hidden objects cannot be found in our anchor point cloud, while the security of other methods is poor.
(M): GS-Hider
(b): SecureGS w/o RDO
(c): SecureGS
interfere with each other. To be noted, since GS-Hider and 3DGS+StegaNeRF decode the hidden message from a feature map or RGB image, they often suffer loss collapse when directly decoding objects with black/white backgrounds. To ensure fair comparison with previous methods, retained the content of the original scene when hiding objects, thus forming a complete RGB image as the Insd and we refer to this type of hiding as "scenc-level". Meanwhile, "object-level" means that we use isolated 3D objects, without any background, as hidden content I,id for the training of our SecureGS. As shown in Fig. our SecureGS demonstrates a clear advantage in scene-level hiding compared previous methods, rendering the texture structure of hidden objects more clearly and realistically, better integrating them with the surrounding background, and producing fewer artifacts and noise. These results prove that our method achieves higher rendering quality in both subjective effects and qualitative metrics.
Lower storage size and faster rendering speed: As shown in Tab. I SecureGS reduces storage space by 201.24MB compared to GS-Hider, and its rendering speed is nearly 3 times faster, verifying that our rendering mechanism is significantly more efficient. Compared the original Scaffold-GS the FPS of our SecureGS decreases by only 7% at the scene level and 25% at the object level, which acceptable and still maintains good real-time capability.
Decoupled original scene and hidden message decoding: advantages, SecureGS can decouple the original and hidden RGB views and separate the anchor point clouds produced based on V Vori and Viid- As shown in Fig. 6 the hidden anchor point decoded by our method retains a good geometry structure and is very close the input hidden object, which greatly increases the flexibility and practicality of our framework.
In addition to the above two performance
4.3 SECURITY ANALYSIS
We analyze the security of SecureGS from three aspects. From the view of the point cloud file format, SecureGS only stores the feature of anchor points fr, along with the offset (Oori 1== and
8

---

Published as a conference paper at ICLR 2025
Table 2: Robustness analysis under different pruning ratios. PSNR, and PSNR; denote the fidelity of original and hidden message.
Table 3: Rendering quality and bit accuracy comparison between our SecureGS and other competitive methods on Blender dataset.
Pruning Ratio
PSNR.
SSIM.
PSNR,
SSIM,
Methods
Bit Acc.
PSNR 1
SSIM
LPIPS
5%
27.41
0.814
37.45
0.985
CopyRNeRF
62.15
25.50
0.907
0.089
15%
26.30
0.794
35.43
0.983
NeRFProtector
92.69
29.26
0.939
0.048
20%
24.96
0.765
33,90
0.981
SecureGS
100.00
33.84
0.968
0.003
scaling factor Ly of the Gaussian points used for rendering the original scene, which is identical to the file format of the original Scaffold-GS. From the view of the visualized point cloud structure, as shown in Fig. 7 almost no traces of the hidden scene can be detected in our anchor points, whereas other methods fail to achieve this. For instance, when we hide microphone in the "bonsai" scene (the third line in Fig. 7. GS-Hider, lacking explicit control of point cloud growing, reveals the shape of the microphone in the visualized point cloud. Similarly, if SecureGS does not employ our region-awes aware density optimization (RDO), the hidden message would also be exposed due to the use of sparse anchor point clouds. From the view of rendered images, as shown in Fig. [ not reveal any artifacts or edges of the hidden object and maintains a high fidelity. Therefore, we can conclude that our SecureGS secure and reliable.
the rendered scene does
4.4 ROBUSTNESS ANALYSIS
To evaluate the robustness of our SecureGS, We perform random pruning on the anchor Gaussian points. To be noted, random pruming denotes randomly pruning proportion of anchor points, PSNR and SSIM results of the original scene (PSNR,, SSIM,) and hidden object (PSNR,, SSIM,) are reported Tab. 2 We can find that randomly pruning 5% of anchors has almost no effect on the rendering quality of SecureGS. Even at larger pruning rate of 25%, method can still achieve 24.96 dB/ / 33.90 dB on PSNR, PSNR,, which verifies that our method is robust enough to the degradation of point clouds. More visualized results are presented in the appendix.
4.5 ABLATION STUDIES
We conduct ablation studies on two key modules of our SecureGS: hybrid decoupled Gaussian and region-
Table 4: Ablation studies on two key modules of our SecureGS, namely HDGER and RDO.
encryption representation aware density optimization (RDO). Since both HGDER and RDO are essential components for ensuring the security of SecureGS, cus on exploring how adding these two modules affects the rendering fidelity of the hidden mes-
Size(B)
PSNR.
SSIM.
PSNR.
Our who IIDGER and RDO
185.79
27.85
0,817
40.51
0.992
only fo-
Ours wio HDXIER
254.91
27.81
0.814
38.68
0.888
Ours RDO
168.55
27.49
40.42
0.991
Ours
290.54
27.93
0.822
38.21
0.985
sage and the original scene. By removing HGDER, we directly use an explicit Ohid to store the offsets of the hidden Gaussian points, referred to "Ours w/o HGDER". As reported v Tab. T "Ours w/o HGDER" has almost no significant impact on the rendering quality of SecureGS. Meanwhile, when RDO is removed, we observe a 2.21dB gain on PSNR of the hidden scene due to the lack of restrictions on the splitting of hidden Gaussian points. However, the rendering quality of the original SecureGS remains satisfactory when weighed against the security enhancements provided by RDO. Removing both modules, although the fidelity of the hidden object further improves, the security of our method is significantly compromised (as shown in Fig. of the appendix).
4.6 EXTENSIONS
In addition to hiding 3D objects in 3D scenes, our SecureGS is also applicable to hiding bits, and single images in the original scene.
Hiding bits in 3D Scene: To achieve efficient hiding and lossless decoding of bit information, introduce additional, private MLP Fi based on the original Scaffold-GS. F/ takes the feature fo E 32 of each voxel as input convert the nigh-dimensiooal features into specific bit length. Finally, we use the average of the bit sequences decoded from all voxels as the final copyright. The bit accuracy and rendering quality of our method and other competitive methods presented in

---

Published as a conference paper at ICLR 2025
Table 5: Rendering quality comparison (PSNR (dB)) of the original scene and hidden image.
Size
Method
Type
FPS
BI.
FL.
GA.
ST:
TR.
RO.
CO.
KI.
BO.
Avg
(MB)
3IGGS
Ori.
18.44
15.95
21.93
20.86
18.25
23.94
23.21
21.58
24.52
20.96
842.51
52.94
+StegaNeRF
Hid.
37.95
35.82
37.23
36.21
38.85
40.92
38.79
39.51
40.16
38.38
Ori.
24.38
20.74
26.84
25.91
21.92
30.49
28.75
29.72
31.05
26.64
GS- SS-Hider
385.41
57.35
Hid.
40.25
45.19
40.28
41.54
40.19
40.56
42.72
42.06
46,66
42.16
24.86
21.02
27.07
26.21
22.86
31,96
29.13
30.52
31.70
27.26
SecureGS
Hid. 155.09
144.46
45.40
47.11
38.87
42.99
39.70
41.27
42.95
41.92
46.76
42.99
Rendering View
Hidden View
Recovered Image
30GG
Seree
SECUREGS
SECUREGS
SECUREGS
SemnrSS
SECUREGS
Figure 8: Visualization of the rendered scene and recovered image produced by our SecureGS and other methods. Hidden view denotes the specific view that used hide the image.
Tab. 3 Compared CopyRNeRF (Luo al. 2023b) and NeRFProtector (Song et al. 2024), can achieve 100% bit decoding accuracy because we can decode directly from the point cloud and the bits decoded from each voxel can be cross-validated. However, other methods decode bits from the 2D view with certain errors. Mcanwhile, after adding bits, the fidelity of our method can still reach 33.84 dB PSNR, which far exceeds CopyRNeRE and NeRFProtector, Note that both these methods use message decoder for image watermarking, they possess unique advantages in the generalization of message extraction.
Hiding single image in 3D Scene: Hiding single image is special case of hiding 3D objects. Here, our task to embed copyrighted image in a specific view of 3D scene. Similar GS- Hider (Zhang et al. 20244), during the fitting of the original scene, only encourage the rendering result at this specific view to be close to the hidden image in each iteration, without constraining other views. The results reported in Tab. 5 It can be seen that method outperforms GS Hider by 0.62dB and 0.83dB on the PSNR of the original scene and restored image with a smaller storage space and faster rendering speed. As plotted in Fig. our rendered original view achieve more detailed reconstruction, especially in some areas with complex textures such as grass, while GS-Hider often appears blurry in these areas. Meanwhile, 3DGS+StegaNaa the embedded copyright image because it is decoded from the rendered RGB view, which will cause severe aliasing and interference of the rendered view and copyright image.
is more inclined to remember
CONCLUSION
In this paper, we propose SecureGS, novel and efficient 3DGS steganography framework. SecureGS successfully addresses the challenges of security and fidelity in previous 3DGS steganography approaches by incorporating anchor point-based neural decoding, a hybrid Gaussian encryption mechanism, and region-aware density optimization. Our approach allows for secure embedding and retrieval of hidden 3D content, copyright images, and bits, ensuring high fidelity in rendering both the original and hidden message. Extensive experiments confirm that our SecureGS outperforms existing methods in rendering speed, fidelity, and security, showcasing its potential for real-time applications. Furthermore, work lays a promising foundation for advancements in copyright protection and encrypted transmission of 3D assets, offering a new avenue for safeguarding 3D content in various digital media landscapes.
10

---

Published as a conference paper at ICLR 2025
REFERENCES
Shumeet Baluja. Hiding images within images. IEEE transactions on pattern analysis and machine intelligence, 42(7):1685-169) 2019.
Jonathan T Barron, Ben Mildenhall, Matthew Tancik, Peter Hedman, Ricardo Martin-Brualle and Pratul P Srinivasan. Mip-nerf: A multiscale representation for anti-aliasing neural radiance fields. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 5855-5864, 2021.
Abbas Cheddad, Joan Condell, Kevin Curran, and Paul Mc Kevitt. Digital image steganography: Survey and analysis of current methods. Signal processing. 90(3):22-7522, 2010.
Guangyu Chen, Yu Wu, Shujie Liu, Tao Liu, Xiaoyong Du, and Furu Wei. Wavmark: Watermarking for audio generation. arXiv preprint arXiv:2308. 2.Xiv:2308.1277000 2023.
Martin Ester, Hans-Peter Kriegel, Jörg Sander, Xiaowei Xu, et al. A density-based algorithm for discovering clusters in large spatial databases with noise. In kdd, volume 96, pp. 226-231, 1996.
Pierre Fernandez, Guillaume Couairon, Hervé Jégou, Matthijs Douze, and Teddy Furon. The stable signature: Rooting watermarks in latent diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 22466-22477, 2023.
Youngdong Jang, Dong In Lee, MinHyuk Jang, Jong Wook Kim, Feng Yang, and Sangpil Kim. Waterf: Robust watermarks in radiance fields for protection of copyrights. In Proceedings of the IEEE conference on computer vision and pattern recognition, 2024a.
Youngdong Jang, Hyunje Park, Feng Yang, Heeju Ko, Euijin Choo, and Sangpil Kim. 3d-gsw:
3d gaussian splatting watermark for protecting copyrights in radiance fields. arXiv preprint arXiv:2409. 1 13222, 2024b.
Nikhil Keetha, Jay Karhade, Krishna Murthy Jatavallabhula, Gengshan Yang, Sebastian Scherer, Deva Ramanan, and Jonathon Luiten. Splatam: Splat, track & map 3d gaussians for dense rgb-d slam. arXiv preprint arXiv:2312.02122 2023.
Bernhard Kerbl, Georgios Kopanas, Thomas Leimkühler, and George Drettakis. 3d gaussian splatting for real-time radiance field rendering. ACM Transactions Graphics, 42(4):1-14, 2023.
Chenxin Li, Brandon Y Feng. Zhiwen Fan, Panwang Pan, and Zhangyang Wang. Steganerf: Em- bedding invisible information within neural radiance fields. In Proceedings of the IEEE/CVF International Conference Computer Vision, pp. 441-453, 2023a.
Chenxin Li, Hengyu Liu, Zhiwen Fan, Wuyang Li, Yifan Liu, Panwang Pan, and Yixuan Yuan. Gaussianstego: A generalizable stenography pipeline for generative 3d gaussians splatting. arXiv preprint ar arXiv:2407.00 301, 2024.
Zhan Li, Zhang Chen, Zhong Li, and Yi Xu. Spacetime gaussian feature splatting for real-time dynamic view synthesis. arXiv preprint arXiv:2312.168122 2023b.
Chang Liu, Jie Zhang, Han Fang, Zehua Ma, Weiming Zhang, and Nenghai Yu. Dear: A deep- learning-based audio re-recording resilient watermarking. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 37, pp. 13201-13209, 2023a.
Chang Liu, Jie Zhang, Tianwei Zhang, Xi Yang, Weiming Zhang, and Nenghai Yu. Detecting voice cloning attacks via timbre watermarking, arXiv preprint arXhv:2312.03410 2023b.
Tao Lu, Mulin Yu, Linning Xu, Yuanbo Xiangli, Limin Wang. Dahua Lin, and Bo Dai. Scaffold-gs: Structured 3d gaussians for adw-tivee rendering. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, 2023.
Jonathon Luiten, Georgios Kopanas, Bastian Leibe, and Deva Ramanan. Dynamic 3d gaussians: Tracking by persistent dynamic view synthesis. arXiv preprint arXiv:2008.097/3 2023.
Xiyang Luo, Yinxiao Li, Huiwen Chang, Ce Liu, Peyman Milanfar, and Feng Yang. Dvmark: a deep multiscale framework for video watermarking. IEFF Transactions Image Processing, 2023a.
11

---

Published as a conference paper at ICLR 2025
Ziyuan Luo, Qing Guo, Ka Chun Cheung, Simon See, and Renjie Wan. Copymerf: Protecting the copyright of neural radiance fields. In Proceedings of the IEEE/CVF International Conference on Computer Vision. pp. 22401-22411, 2023b.
Hidenobu Matsuki, Riku Murai, Paul HJ Kelly, and Andrew Davison. Gaussian splatting slam. arXiv preprint arXhh:2312.067//4 2023.
Mildenhall, PP Srinivasan, M Tancik, JT Barron, R Ramamoorthi, and R Ng. Nerf: Representing scenes neural radiance fields for view synthesis. In European conference on computer vision, 2020.
Ryutarou Ohbuchi, Akio Mukaiyama, and Shigeo Takahashi. A frequency-domain approach to watermarking 3d shapes. In Computer graphics forum, volume 21, pp. 373-382. Wiley Online Library, 2002.
Xuran Pan, Zhuofan Xia, Shiji Song, Li Erran Li, and Gao Huang. 3d object detection with point- former. In Proceedings of the IEEE/CVF conference on computer vision and paltern recognition, pp. 7463-7472, 2021.
Emil Praun, Hugues Hoppe, and Adam Finkelstein. Robust mesh watermarking. In Proceedings of the 26th annual conference on Computer graphics and interactive techniques, pp. 49-56, 1999.
Niels Provos and Peter Honeyman. Hide and seek: An introduction steganography. IEEE security & privacy, 1(3):22-44, 2003.
Robin San Roman, Pierre Fernandez, Alexandre Défossez, Teddy Furon, Tuan Tran, and Hady Elsahar. Proactive detection of voice cloning with localized watermarking, arXiv preprint arXiv:2401.17264 2024.
Qi Song, Ziyuan Luo, Ka Chun Cheung, Simon See, and Renjie Wan. Protecting nerfs' copyright via plug-and-play watermarking base model, arXiv preprint arXiv:2407.07735. 2024.
Jiaxiang Tang, Jiawei Ren, Hang Zhou, Ziwei Liu, and Gang Zeng. Dreamgaussian: Generative gaussian splatting for efficient 3d content creation. arXiv preprint arXiv:2309. 2023.
Yuxin Wen, John Kirchenbauer, Jonas Geiping, and Tom Goldstein. Tree-rings watermarks: Invisible fingerprints for diffusion images. Advances Neural Information Processing Systems, 36, 2024.
Guanjun Wu, Taoran Yi, Jiemin Fang, Lingxi Xie, Xiaopeng Zhang, Wei Wei, Wenyu Liu, Qi Tian, and Xinggang Wang. 4d gaussian splatting for real-time dynamic scene rendering. arXiv preprint arXiv:2310.08528, 2023.
Zhirong Wu, Shuran Song, Aditya Khosla, Fisher Yu, Linguang Zhang, Xiaoou Tang, and Jianxiong Xiao. 3d shapenets: A deep representation for volumetric shapes. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 1912-1920, 2015.
Zhipei Xu, Xuanyu Zhang, Runyi Li, Zecheng Tang, Qing Huang, and Jian Zhang. Fakeshield: Explainable image forgery detection and localization via multi-modal large language models. arXiv preprint arXiv:2410.0276.. 2024.
Shuzhou Yang, Yu Wang, Haijie Li, Jiarui Meng, Xiandong Meng. and Jian Zhang. Fourier123 One image to high-quality 3d object generation with hybrid fourier score distillation. arXiv preprint arXiv:2405.2066 2024a.
Ziyi Yang, Xinyu Gao, Wen Zhou, Shaohui Jiao, Yuqing Zhang, and Xiaogang Jin. Deformable 3d gaussians for high-fidelit monocular dynamic scene reconstruction. Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition (CVPR), 2024b.
Taoran Yi, Jiemin Fang, Junjie Wang, Guanjun Wu, Lingxi Xie, Xiaopeng Zhang, Wenyu Liu, Qi Tian, and Xinggang Wang. Gaussiandreamer: Fast generation from text to 3d gaussians by bridging 2d and 3d diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2024.
12

---

Published as a conference paper at ICLR 2025
Innfarn Yoo, Huiwen Chang, Xiyang Luo, Ondrej Stava, Ce Liu, Peyman Milanfar, and Feng Yang. Deep 3d-to-2d watermarkingg Embedding messages in 3d meshes and extracting them from 2d renderings. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 10031-10000, June 2022.
Jiwen Yu, Xuanyu Zhang, Youmin Xu, and Jian Zhang, Cross: Diffusion model makes controllable, robust and secure image steganography. Advances in Neural Information Processing Systems, 36, 2023a.
Zehao Yu, Anpei Chen, Binbin Huang, Torsten Sattler, and Andreas Geiger. Mip-splatting; Alias-free 3d gaussian splatting. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2023b.
Xuanyu Zhang, Runyi Li, Jiwen Yu, Youmin Xu, Weiqi Li, and Jian Zhang. Editguard: Versatile image watermarking for tamper localization and copyright protection. In Proceedings of the IEEE conference on computer vision and pattern recognition, 2024a.
Xuanyu Zhang. Jiarui Meng, Runyi Li, Zhipei Xu, Yongbing Zhang, and Jian Zhang. Gs-hider: Hiding messages into 3d gaussian splatting. Advances in Neural Information Processing Systems, 2024b.
Xuanyu Zhang, Zecheng Tang, Zhipei Xu, Runyi Li, Youmin Xu, Bin Chen, Feng Gao, and Jian Zhang. Omniguard: Hybrid manipulation localization via augmented versatile deep image watermarking. arXiv preprint arXiv:2412.01611 2024c.
Xuanyu Zhang, Youmin Xu, Runyi Li, Jiwen Yu, Weiqi Li, Zhipei Xu, and Jian Zhang. V2a-mark: Versatile deep visual-audio watermarking for manipulation localization and copyright protection. In Proceedings of the ACM International Conference on Multimedia (ACM MM), 2024d.
Jiren Zhu, Russell Kaplan, Justin Johnson, and Li Fei-Fei. Hidden: Hiding data with deep networks. In Proceedings of the European conference on computer vision (ECCV), pp. 657-672, 2018.
Matthias Zwicker, Hanspeter Pfister, Jeroen Van Baar, and Markus Gross. Ewa volume splatting. In
IEFE Conference Visualization (VIS), 2001.
13

---

Published as a conference paper at ICLR 2025
A APPENDIX
A.1 MORE IMPLEMENTATION DETAILS
Dataset Construction: To make the training view set of the hidden object and the original scene correspond to each other, we use the Supersplat to align the position of the original scene and hidden object and render the training set of the hidden object according the viewpoints in the training set of the original scene. The correspondence between the hidden object and original scenes is listed in
Tab.
Table 6: Correspondence between hidden objects and original scenes.
Original Scene
Bicycle
Flowers
Garden
Stump
Trechill
Room
Counter
Kitchen
Bonsai
Hidden Object
hotdog
lego
ficus
drums
ficus
chair
lego
ship
mic
Implementation Details and Network Structure:
Feature bank: We follow the design of the feature bank introduced in Scaffold-GS (Lu et al. 2023) to extend fu to be multi-resolution and view-dependent feature fu. Specificallyy, for each anchor v, we generate feature bank {fv: fv., ferz J, which is then fused using view depeedeend weights to obtain
a combined anchor feature fu. Given the camera located at x and an anchor at X,, we compute their relative distance and viewing direction follows:
8ee = X - Xell2, dop
X, X.
| Xell2
The feature bank is then blended through weighted sum, with the weights predicted by a small MLP Fu. The integrated anchor feature fo is then calculated as:
[w. w1, w/2 = Softmax (dvee
(10)
f = w- fo + w1 fer, + W22 friz'
(11)
The structure of MLPs: The structure of our MLPs follows a "Linear - RELU + Linear" style with the hidden dimension of 32. The structure of F1, Scaffold-GS. Note that for the offset predictor Fj. the last linear layer is to transform intermediate tensors from N32 x32 to (38), where N and respectively denote the number of anchor points and hidden Gaussian points generated by each voxel.
is identical to F,, Fe) in
The algorithm our RDO Strategy: To more clearly demonstrate our region-aware density optimization (RDO) algorithm, we have provided the pseudocode in Alg. [
A.2 RELATIONSHIPS AND DIFFERENCES WITH EXISTING 3D STEGANOGRAPHI METHODS
Comparison with GS-Hider: Our SecureGS and GS- GS-Hider (Zhang et al. 2024b) follow similar task setups, assuming that the point cloud file needs be publicly available while hiding information. At a high level, SecureGS and GS-Hider adopt a coupling-deecupling process. The main differences between them lie in the implementation architecture: First, GS-Hider is built on the original 3DGS and embeds information through coupled feature attributes, using a CNN-based neural network decode the feature maps. The decoding mechanism from feature maps is the root cause of its deficiencies in security, fidelity. and rendering speed. In contrast, our SecureGS is built on the efficient Scaffold-GS. which naturally generates Gaussian points from anchor points specifically for rendering hidden information. Additionally, we use several MI.ss to efficiently and in parallel decode the anchor point cloud in batches. Thanks to our efficient mechanism of decoding from anchor points and the proposed region- density optimization, method improves fidelity by over 1dB, renders scenes twice as fast as GS-Hider and requires less storage space while ensuring both the format and geometric structure security of the point cloud files. Additionally, GS-Hider does not support bit embedding and decoding, a limitation that we have addressed in approach.
outperform GS-Hider in all aspects. Our
Comparison with HiDDeN- --DseN- Methods: Most previous SOTA 3D watermarking methods (Luo
et al. 2023b Jang et al. 2024a b Song et al. 2024) typically use watermark decoder pre-trained
14

---

Published as a conference paper at ICLR 2025
Table 7: Comparison of 3D scene hiding between GS-Hider and SecureGS.
Method (dNRo(dB)
SSIM,
LPIPS,
(dBR,
SSIM,
LPIPS,
GS-Hider
25.82 27.20
0.783 0.796
0.246 0.235
25.18
0.780
0.306
SecureGS
29.75
0.858
0.211
on the image domain (e.g., HiDDeN (huu al. 2018)). This watermark decoder is tasked with extracting bits from rendered views by NeRF or 3DGS, offering excellent generalization message extraction. In contrast, our SecureGS aims to decode bit information directly from the point cloud, which aligns better with the explicit representation features of 3DGS and is more direct and efficient. Currently, there are deep networks capable of embedding and decoding bits from point clouds, which makes it infeasible for us to adopt HiDDeN-basee methods for generalized message extraction. However, our message extraction MLP is lightweight enough that it does not increase training time or cost. We plan to explore the development of generalized method for extracting bits directly from point clouds in future work.
A.3 LIMITATIONS AND FUTURE WORKS
First, to enhance the geometric security of our method, have promote anchor point splitting to some extent through our RDO strategy, which results in slightly larger storage space compared to the original Scaffold-GS when hiding 3D objects. Second, better ensure the security of our steganography framework, the hidden object is required to partially overlap with the point cloud of the original scene some extent. Hiding a 3D object without leaving traces in areas where the original point cloud is sparse is extremely difficult and remains an area for further exploration.
Limitations:
Future works: Our future work will focus primarily on improving the robustness of 3DGS steganog- raphy, ensuring that the hidden object's integrity and fidelity are preserved even under more severe damage and aggressive pruning strategies. Additionally, we will explore leveraging 3D backbone networks, such as PointFormer (Pan al. 2021), directly decode the hidden point cloud from the original Gaussian points, further enhancing the security 3D steganography through structured and network-basee approaches.
A.4 RESULTS ON HIDING 3D SCENE INTO 3D SCENE
Following the setup of GS-Hider, we compare our SecureGS with GS- on hiding 3D scenes into 3D scenes. Here, we do not use the bounding box in the RDO strategy, as it is not meaningful for high-capacity scene hiding. The results are reported Tab. 7 It can be observed that the rendering fidelity of the original scene and the hidden scene in our method is 1.38 dB and 4.57 dB higher than that of GS-Hider, respectively, demonstrating significant advantage.
A.5 MORE ROBUSTNESS ANALYSIS
To further validate the robustness of our method, we apply several 3D degradations to the anchor point cloud, including Gaussian noise of varying intensities and point cloud denoising. The metrics reported on Tab. The Gaussian noise intensities are set to 0.05, 0.1, and 0.15, and the denoising method Statistical Outlier Removal. can be observed that our method demonstrates strong resistance to Gaussian noise. Moreover, when dealing with point cloud denoising. although the original scene's 's rendering quality decreases, the hidden object's 's rendering quality remains almost unchanged. Fig. 10 further illustrates the robustness of our method under different degradations.
A.6 MORE ABLATION STUDIES
To further clarify the independent contributions of our region-aware density optimization (RDO), we further conduct ablation studies on RDO and realize two variants, namely globally reducing the gradient threshold and using the same gradient to grow anchor points representing both the original and hidden scenes. The results are reported on Tab. 9 We find that globally lowering the gradient threshold increases the memory size by 1 11.76 MB, significantly reducing rendering speed
15

---

Published as a conference paper at ICLR 2025
Table 8: PSNR (dB) and SSIM under different degradation conditions.
Condition
PSNR,
SSIM,
PSNR,
SSIM,
Clean
27.93
0.822
38.21
0.986
Gaussian noise (a=0.05)
27.87
0.820
37.52
0.984
Gaussian noise (o=0.1)
27.74
0.817
37.04
0.983
Gaussian noise (o=0.15)
27.55
0.857
36.18
0.981
Point cloud denoising
24.02
0.794
38.20
0.986
Table 9: Ablation study on different key steps in the region-aware density optimization.
Method
Memory Size (MB)
PSNR, (dB)
SSIM,
PSNR, (dB)
SSIM,
Globally reducing the gradient threshold 405.27
28.11
0.831
38.36
0.987
Using the same gradient for anchor growing SecureGS (Ours)
252.49
27.73
0.815
37.95
0.977
290.54
27.93
0.822
38.21
0.986
while only resulting in a 0.18 dB gain in PSNR. Additionally, if a shared gradient is used instead of our asynchronous gradient accumulation, the rendering the original scene and the hidden object interferes with each other, leading reduction in rendering quality for both and failing to ensure security. Thus, our region-aware density optimization achieves well-balanced trade-off between rendering quality, security, and rendering efficiency.
Furthermore, we also present the visualized results of point cloud produced by our baseline "Ours w/o RDO and HDGER" in Fig. 9 "Ours w/o RDO and HDGER" denotes directly adding the offset Obid to the point cloud file and using series of encrypted MLPs to predict the attributes of the hidden Gaussian points. Mcanwhile, the anchor growing and reduction strategy the same as Scaffold-GG GS. Quantitative metrics are reported in Tab. 4 Although this method achieves acceptable fidelity for both the hidden object and the original scene, its point cloud completely exposes the information of the hidden object, failing to meet the security requirements of 3DGS steganography. This indicates that simply combining the framework design GS-Hider with the rendering method Scaffold-GS cannot achieve steganography with strong security.
"Hotdog" in "Bicycle"
"Mic" in "Bonsai"
"Lego" in "Flowers"
Figure 9: Visualized results the point cloud produced by "Ours w/o RDO and HDGER".
A.7 MORE VISUALIZATION RESULTS
We present more visualization results of our rendering results under different degradations in Fig the rendering results of bit hiding in Fig. 12 the rendering results of single image hiding in Fig. 13
and the results of 3D object hiding in Fig. 14
16

---

Published as a conference paper at ICLR 2025
Point cloud denoising
Gaussian noise (a=D 05)
Gous noise (a=0.))
Gaussion noise (o=0.15) 15)
Figure 10: Rendered results of the original scene and hidden object produced by our SecureGS under Gaussian noise and point cloud denoising.
17

---

Published as a conference paper at ICLR 2025
Algorithm 1 Overall Pipeline of Our Proposed Region-Aware Density Optimization
i 0
> Iteration Count
Tori f- SIM points
Initalization of the anchor point set produced based on ori Initalization of the anchor point set produced based on Vhid
This Thid 0
while not converged do
ltotal fors Alhid
> Computed via Eq.
Vori f AccumulatcGraaicnn (tota)).
if % step 0 then:
hid f AccumulateGraaiient Lotal))
Accumulate gradients different intervals
end if
(sRefinemenntceaatonn()) then
if LiBoundingBoxllerattonn)))) then
Sybe + PointCloudChusterrI.aa hed) > Using the clustering method to get bounding box
end if
for all anchor points v(xo, Sur Lu Oart) in Pori U UTdi do
if Sibz then
Tada Tfiz / Tdoown
Lower the threshold if the anchor in the bounding box
end if
if V
ori
Tada then
T Tori < AnchorGrowingg orl)
Toris Thid AnchorPruning(T ori, Trid)
end if
if V
had Tfk then
I' hid + AnchorGrooing((Naa kia)
end if
end for
end if i +- i ++1
end while
ratio=5% 5%
ratio 15%
ratio=25%
Figure 11: Rendered results of the original scene and hidden object produced by our SecureGiS under different degradations.
18

---

Published as a conference paper at ICLR 2025
Figure 12: Rendered object and error maps produced by the proposed SecureGS on the blender dataset. After embedding the bit message, the rendering quality our original scene will hardly be affected.
Readering View
Hidden View
Recovered Image
ICLR
SECUREGS
Figure 13: Rendered view and recovered different copyright images produced by our SecureGS.
19

---

Published as a conference paper at ICLR 2025
Figure 14: Rendered original scene and the hidden object produced by our SecureGS. The first row of each group is the original scene and the second row is the hidden object.
20


Reviews:
[{"review_id": "OaZYJdUuwy", "reviewer": "Reviewer_FjJF", "summary": "The paper introduces SecureGS, an innovative framework aimed at enhancing the security and fidelity of 3D Gaussian Splatting (3DGS) steganography. It addresses critical challenges in embedding hidden information within 3D scenes, focusing on copyright protection and privacy. SecureGS employs a hybrid decoupled Gaussian encryption mechanism that allows for the secure embedding and retrieval of 3D objects, images, and bits, while maintaining high rendering quality. Key contributions include a density region-aware anchor growing and pruning strategy that enhances security and experimental results demonstrating significant improvements over existing 3DGS methods in rendering fidelity, speed, and overall security. This framework lays a strong foundation for future advancements in 3D steganography, balancing efficiency and security in digital asset management. However, this paper lacks innovation, and the security verification is not sufficient.", "questions": "Please list up and carefully describe any questions and suggestions for the authors. Think of the things where a response from the author can change your opinion, clarify a confusion or address a limitation. This is important for a productive rebuttal and discussion phase with the authors.\n\nHow effective is SecureGS in defending against adversarial attacks? Please show the code and ablation experiment parameters of the paper, especially the details of the comparison with GS-hider.", "limitations": "", "rating": 3, "confidence": 4, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "SecureGS showcases originality through its hybrid decoupled Gaussian encryption mechanism and a density region-aware anchor strategy. The paper is technically fine and clear, the algorithm seems to scale well, and the results on the different datasets compare very favorably with the different baselines. The experimental results that clearly demonstrate its advantages over existing methods. The clarity of the paper enhances its accessibility, guiding readers through complex concepts with effective visuals and precise descriptions.", "weaknesses": "A substantive assessment of the weaknesses of the paper. Focus on constructive and actionable insights on how the work could improve towards its stated goals. Be specific, avoid generic remarks. For example, if you believe the contribution lacks novelty, provide references and an explanation as evidence; if you believe experiments are insufficient, explain why and exactly what is missing, etc.\n\n1: SECUREGS and GS-Hider are notably similar, including their formulas, descriptions, and flowcharts. This resemblance suggests that the research content leans more towards optimizing the memory efficiency of GS-Hider rather than introducing substantial advancements. Consequently, the innovative aspects of this work appear insufficient to establish a distinct contribution to the field of 3DGS security.\n\n2: In terms of robustness verification, this paper fails to address the effectiveness of SecureGS against adversarial attacks and lacks experimental results for hiding scenes within scenes. The framework's ability to withstand pruning does not appear to be robust. Furthermore, the source code for the baseline scheme (GS-Hider) has not been made publicly available, and the paper does not provide detailed descriptions of the relevant parameter settings. As a result, the experimental findings lack credibility and may not be convincing to the reader.\n\n3: In terms of memory optimization, many existing memory optimization strategies use less than 20% of the memory of the original 3DGS, while SecureGS still retains a large number of redundant Gaussian points, which may hinder its ability to achieve real-time rendering in future 3DGS applications. This limitation poses a challenge for practical applications, especially in scenarios that require fast processing and high efficiency.\n\n4: It is better to describe the current research status more systematically. The figures in your paper are a bit blurry. Please consider replacing them with clearer ones.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "Uv4KRKuQyM", "reviewer": "Reviewer_Keb4", "summary": "The paper proposes SecureGS, a new 3D Gaussian splatting (3DGS) steganography framework that improves the security and fidelity of hiding information in 3D scenes.  Existing methods struggle with fidelity, speed, and security, especially regarding the point cloud's geometric structure. \nSecureGS uses a hybrid decoupled Gaussian encryption, concealing hidden Gaussian point positions with a privacy-preserving offset predictor only authorized users can access.  A density region-aware anchor growing strategy further enhances security by dynamically adjusting anchor point density to mask the hidden object's geometry without sacrificing speed or storage.  \nExperiments show SecureGS significantly outperforms the existing method GS-Hider, especially for geometry security.", "questions": "1. Is the proposed method compatible with the GS compression method such as LightGaussian or CompactGS? What are the potential challenges in integrating compression with the proposed steganography approach?\n2. Regarding the 3DGS having a point cloud geometry format, how is the 3D robustness towards 3D distortions? Such as Gaussian noise with a Gaussian Kernel $\\sigma$, Dropout operation to randomly remove a fraction of the points, and Cropout operations to remove points in a specific 3D bounding box volume.\n3. What if the attacker knows the encryption method and tries to remove or add perturbations on the anchor points in the 3DGS model?", "limitations": "", "rating": 8, "confidence": 5, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. SecureGS proposes a hybrid decoupled Gaussian encryption to embed information within anchor points, accessible only to authorized users. \n2. A density region-aware anchor growing and pruning strategy improves security by preventing exposure of the hidden object. \n3.  SecureGS achieves this by ensuring both file format and geometric structure security, compared with the existing baselines GS-Hider and 3DGS+StegaNeRF.", "weaknesses": "1. While the proposed region-aware density optimization effectively utilizes growing 3D Gaussian points, it results in an increased model size, which is a key concern in 3DGS.\nActions should be taken to implement specific strategies aimed at mitigating the increased model size. \nAdditionally, the tradeoff between enhanced security and the resulting model size should be thoroughly discussed to provide a clearer perspective on the implications of the proposed approach.\n\n2. The bit accuracy relies on an MLP layer, which is per-scene optimized, which may lead to an unfair comparison setting with the previous baselines CopyRNeRF and NeRFProtector. Why the per-scene optimization-based MLP method is chosen here instead of considering generalizable message extraction methods such as HiDDeN for bit message extraction?", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "FRcZBJCFVY", "reviewer": "Reviewer_6qod", "summary": "The paper presents SecureGS, a novel method for 3D Gaussian splatting (3DGS) steganography that addresses significant security and fidelity challenges in protecting 3DGS-based assets. It proposes a hybrid decoupled Gaussian encryption mechanism and a region-aware density optimization strategy, enabling efficient embedding and retrieval of hidden 3D objects, images, and bits within original 3D scenes.", "questions": "1.\tHow does SecureGS compare to traditional steganography methods in terms of computational efficiency and resource requirements?\n\n2.\tWhat specific measures have you taken to ensure the robustness of your method against various types of attacks or degradation, especially in practical deployment scenarios?\n\n3.\tGiven the complexity of the proposed methods, how do you envision simplifying the implementation for practitioners who may lack advanced technical expertise in 3D steganography?", "limitations": "", "rating": 8, "confidence": 4, "soundness": 4, "presentation": 4, "contribution": 4, "strengths": "(+) Previous steganography lacks a strategy for the explicit point cloud from 3DGS. The paper introduces an interesting and original approach to 3DGS steganography, emphasizing security and fidelity. This innovative framework could pave the way for advancements in the field, inspiring further research into secure 3D content transmission.\n\n(+) Overall, this paper is well-written and has a logical structure. The motivation and contributions are clearly articulated, making it accessible to readers. The figures and diagrams effectively illustrate complex concepts, enhancing reader comprehension.\n\n(+) The authors conduct comprehensive experiments that validate the generalizability and effectiveness of the proposed method across various scenarios. These experiments demonstrate the method's superiority and provide valuable insights into its practical applicability in different contexts.", "weaknesses": "(-) The proposed methods, particularly the hybrid encryption and optimization strategies, may introduce complexity that could hinder practical adoption. This complexity might deter practitioners who require straightforward solutions for embedding and retrieving hidden information.\n\n(-) The enhancements in security and fidelity may come at the cost of increased computational requirements, which could limit real-time applications. If the computational demands are too high, they may negate the benefits of improved rendering fidelity in time-sensitive environments.\n\nMinor suggestions:\n\nMore vspace between Line 65 and Line 66.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "YMXlcX1AGh", "reviewer": "Reviewer_HhF8", "summary": "This paper studies a safe and efficient 3D steganography framework. The proposed SecureGS addresses issues existed in previous NeRF-based steganography solutions through a hybrid decoupled Gaussian encryption representation, which secures both file format and geometric structure while concealing 3D objects, images, and bits within anchor points that can only be decoded by authorized users. SecureGS incorporates a region-aware density optimization (RDO) strategy, dynamically adjusting anchor point growth to avoid leaking hidden content.", "questions": "None", "limitations": "", "rating": 6, "confidence": 2, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. SecureGS provides dual security by protecting both the file format and geometric structure, which reduces risks of hidden information exposure in public files. \n\n2. The SecureGS framework achieves real-time rendering rates, nearly three times faster than GS-Hider, with storage requirements that are substantially lower.\n\n3. Evaluation results demonstrate SecureGS's resilience to anchor point pruning, achieving reliable decoding.", "weaknesses": "1. Although the author mentioned three shortcomings of existing methods in Introduction, the description is not intuitive and difficult to understand. For example, the concepts of format security and geometric structure security are not explained clearly at the part. I suggest that the current Fig. 2 should be shown at the beginning rather than the pipeline of the proposed method, and the relevant concepts should be described in more detail.\n\n2. The authors claimed that the proposed method addresses the issue of rendering quality existing previous methods. However, the experimental results show that the average improvement is only 1.16 dB. In my experience, such slight changes in PSNR values ​​usually result in only negligible subjective differences. Additionally, the $PSNR_o$ values in Table 2 and 4 are relatively low (below 30 dB), so I think the high-fidelity restoration of hidden objects comes at the expense of the quality of the original scene restoration. This further raises concerns about the fairness of the comparison in Table 1 and 5, because the author did not show the results of $PSNR_0$.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "ExfbLvFzgH", "reviewer": "Reviewer_yt9u", "summary": "This paper proposes SecureGS, a 3D Gaussian splatting steganography framework designed to improve fidelity and security in 3D scene steganography. SecureGS combines features from GS-Hider and Scaffold-GS, introducing a hybrid decoupled Gaussian encryption representation where hidden information and original scenes are separately encoded through anchor points. Additionally, a region-aware anchor growth and pruning strategy is introduced to optimize anchor density, enhancing the concealment of hidden information and rendering quality. The experimental results show SecureGS outperforms GS-Hider in rendering speed, fidelity, and security.", "questions": "See weaknesses.\n\nBy the way, I do have a small question, purely out of curiosity and not related to the rating: If we perform point cloud downsampling on the anchor points encrypted by SecureGS, would the hidden scene become more apparent in the resulting sparse point cloud? Could it result in a situation similar to GS-Hider as shown in Fig. 7?", "limitations": "", "rating": 5, "confidence": 5, "soundness": 2, "presentation": 3, "contribution": 1, "strengths": "1. SecureGS effectively combines the strengths of Scaffold-GS and GS-Hider, leveraging anchors and region-aware density optimization to achieve better fidelity and security in information hiding.\n2. The region-aware anchor growth and pruning strategy successfully prevents hidden information from being exposed in the public point cloud by adaptively optimizing anchor density.\n3. SecureGS shows improved rendering quality, fidelity, and speed compared to GS-Hider and 3DGS+StegaNeRF, particularly in reducing interference between hidden content and original scenes.", "weaknesses": "1. SecureGS essentially combines elements of GS-Hider and Scaffold-GS, with limited originality. The core method of SecureGS is to create separate anchor points for the hidden objects and the original scene, which is quite similar to GS-Hider’s approach of creating Gaussian points for both separately—only differing in terms of abstraction level, from points to anchors. While SecureGS introduces a region-aware anchor growth and pruning strategy, these improvements are mostly about implementation details rather than any fundamental innovation. Moreover, the anchor growth and pruning strategies resemble those seen in previous 3D scene optimization work, which makes it hard to classify them as novel contributions. Consequently, the theoretical advancement of SecureGS compared to GS-Hider and Scaffold-GS is not adequately demonstrated, and the overall method feels more like an incremental combination of existing techniques rather than a breakthrough, resulting in relatively weak innovation and technical contributions.\n\n2. The motivation for using Scaffold-GS as the foundational framework is insufficiently explained. Although the paper mentions that using anchor points to generate Gaussian points helps keep their attributes and positions secure since they do not need to be directly stored, these advantages are primarily about rendering efficiency and scalability, rather than any inherent suitability for steganography or encryption tasks. Therefore, directly equating the properties of Scaffold-GS with the encryption encoder-decoder in steganography feels like a logical leap without rigorous backing. The authors need to clarify how Scaffold-GS specifically offers unique advantages for the steganography task and strengthen the rationale for this choice.\n\n3. The ablation studies are too simplistic and fail to convincingly demonstrate SecureGS's unique contributions. Despite claims of outperforming other methods in terms of visual quality (such as PSNR) and file size, the reasons for these improvements are insufficiently explained. As shown in Table 1, much of the performance gain could simply be attributed to the foundation provided by Scaffold-GS, rather than any innovations introduced in SecureGS. Since Scaffold-GS is an upgraded version of Gaussian Splatting, which inherently improves rendering quality and efficiency, directly comparing SecureGS (based on Scaffold-GS) to GS-Hider (based on 3DGS) is insufficient to prove the superiority of the proposed method. The authors need more comprehensive ablation studies to clarify the independent contributions of each new module to ensure that the observed improvements come from their own innovations rather than from Scaffold-GS's inherent advantages. Otherwise, it is difficult to consider these enhancements as unique contributions of SecureGS.\n\n4. SecureGS heavily relies on the Scaffold-GS framework, particularly in the way anchor generation and density optimization are integrated. This deep coupling makes SecureGS less flexible and not readily applicable to other Gaussian splatting models. \n\n5. The effectiveness of the region-aware anchor growth and pruning strategy lacks systematic theoretical support. There is no formal proof or analysis provided to demonstrate whether this strategy is optimal for steganography tasks. Section 3.4's gradient handling and anchor splitting thresholds are mostly based on empirical choices rather than rigorous theoretical derivation. Without a theoretical foundation, the robustness and generalizability of these strategies across different scenes are uncertain, which reduces the reliability and stability of the proposed method in real-world applications.\n\n6. The robustness experiments in SecureGS are insufficient, as they only consider the impact of random anchor pruning, neglecting other significant attack scenarios that could affect the security of steganography. Robustness is critical in evaluating steganographic methods, yet SecureGS lacks tests on important attacks such as point cloud denoising, random point deletion or addition, and geometric transformations. These factors are as crucial as visual quality in the domain of steganography and watermarking, and without proper evaluation of these aspects, the practical security of SecureGS remains questionable.\n\n7. In Table 1, SecureGS shows a significant increase in PSNR compared to Scaffold-GS, which the authors attribute to increased anchor density and the decoupling strategy. However, it seems questionable that the PSNR for the original scene is higher despite SecureGS embedding additional hidden information. Scaffold-GS has no additional hidden data and can focus solely on rendering the scene, while SecureGS introduces extra information that could potentially interfere with the fidelity of the original scene. There is no sufficient core optimization provided in the paper to justify this improvement. This effect seems more likely due to increased anchor density and computational resources rather than a genuine methodological advancement in balancing steganography with scene fidelity. More theoretical analysis or experimental validation is recommended to clarify this observation, ensuring that the PSNR improvements are due to actual innovation rather than just additional resource allocation.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)