NGS-Marker: Robust Native Watermarking for 3D Gaussian Splatting
Authors: Hao Qin
Yukai Sun
Luyuan Chen
Mengxu Lu
Feng Zhang
Ming Kong
Zhenhong Du
Qiang Zhu
Venue: ICLR 2026 Poster (2026)
Keywords: 3D Gaussian Splatting
digital asset watermarking
copyright protection
Primary area: applications to computer vision, audio, language, and other modalities

Abstract: With the rapid development and adoption of 3D Gaussian Splatting (3DGS), the need for effective copyright protection has become increasingly critical. Existing watermarking techniques for 3DGS mainly focus on protecting rendered images via pre-trained decoders, leaving the underlying 3D Gaussian primitives vulnerable to misuse. In particular, they are ineffective against **Partial Infringement**, where an adversary extracts and reuses only a subset of Gaussians. In this paper, we propose **NGS-Marker**, a novel native watermarking framework for 3DGS. It integrates a jointly trained watermark injector and message decoder, and employs a gradient-based progressive injection strategy to ensure full-scene coverage. This enables robust ownership decoding from any local region. We further extend NGS-Marker with hybrid protection (combining native and indirect watermarks) and support for multimodal watermarking. Extensive experiments demonstrate that NGS-Marker effectively defends against partial infringement while offering practical flexibility for real-world deployment.

Published as a conference paper at ICLR 2026
NGS-MARKER: ROBUST NATIVE WATERMARKING FOR 3D GAUSSIAN SPLATTING
Hao Qin', Yukai Sun', Luyuan Chen', .Menxuu Lu', Feng Zhang Ming Kong" Zhenhong Du 122 Qiang Zhu 1+
'Zhejiang University
ZZhejiang Key Laboratory of Geographic Information Science
{haoqin, 3220101205, chenluyuan Lumengxu, z zfcarnation, z jjukongming, duzhenhong, zhuq @ ju. edu.
3D Protection
Ownership Verification
Malicious
Q
Indirect Protection
Watermarking in the 2D domain
User
(Traditional Methods)
Rendering
"I want to insert this bear into my 3D scene without autorization.
000000
Detection in 21)
Image
Image
Image
N
Indirect: infringement detected
Watermank:
Partial Infringement
3D Scene vía 3DGS
Water Water marking in the 3D domain
001001
Sampling
Native Protection
Detection
(NGS-Marker)
Local
Local
Local N
Native: It's copy!
Figure 1: Comparison between native and indirect protection. Due the explicit nature of 3DGS, malicious users may partially plagiarize protected assets during 3D content creation. When the rendered image distribution shifts significantly, existing indirect protection methods often fail to detect such infringement, whereas NGS-Marker provides reliable protection in these scenarios.
ABSTRACT
With the rapid development and adoption of 3D Gaussian Splatting (3DGS), the need for effective copyright protection has become increasingly critical. Existing watermarking techniques for 3DGS mainly focus on protecting rendered images via pre-trained decoders, leaving the underlying 3D Gaussian primitives vulnerable to misuse. In particular, they are ineffective against Partial Infringement, where adversary extracts and reuses only a subset of Gaussians. In this paper, we propose NGS-Marker, a novel native watermarking framework for 3DGS. It integrates a jointly trained watermark injector and message decoder, and employs a gradient- based progressive injection strategy to ensure full-scene coverage. This enables robust ownership decoding from any local region. We further extend NGS-Marker with hybrid protection (combining native and indirect watermarks) and support for multimodal watermarking. Extensive experiments demonstrate that NGS- Mar-Mr effectively defends against partial infringement while offering practical flexibility for world deployment.
INTRODUCTION
Recent advances in 3D representations have sparked transformative progress across computer vision and graphics. Among them, 3D Gaussian Splatting (3DGS) Kerbl et al. (2023) has emerged mainstream technique due to its efficiency, real-time rendering capabilities, and photo-realistic quality. As 3DGS continues gain traction in applications such as virtual reality, digital content creation,
"Corresponding author

---

Published as a conference paper at ICLR 2026
and robotics Tu al. (2025); Fu et al. (2025), concerns about copyright protection have become increasingly pressing.
A widely adopted strategy for protecting digital assets involves embedding imperceptible watermarks, which has matured significantly in 2D image domains. Recent efforts have sought to extend such protections 3D assets by leveraging pre-trained decoders from the image domain /huu al. (2025) ;
Luo et al. (2025): Chen et al. (2025). Despite substantial progress, these methods rely on rendered images as intermediate carriers in the watermark embedding and extraction process, thereby protecting Gaussian primitives only indirectly; we refer to this protection paradigm as indirect watermarking.
The indirect watermarking paradigm suffers from critical limitations: rendering- -based extraction inevitably introduces visual degradation, undermining the fidelity of the protected 3D content. More importantly, watermark extraction depends on rendered images, making vulnerable to appearance shifts such as changes in viewpoint or scene content.
In this paper, we highlight a practical yet underexplored misuse scenario in 3DGS applications: Partial Infringement. Due to tile-based rasterization and the independence of Gaussian primitives, 3DGS models are naturally modular, making them susceptible to component-wise extraction and reuse. As illustrated in Figure adversaries can easily isolate objects or characters from a 3D asset and reassemble them into new scenes Chen et al. (2024d). Our study in Section 3 reveals that existing mased watermarking methods fail under such conditions, where rendering distributions are significantly altered and detection accuracy drops close to random chance.
To avoid the risks associated with extracting watermarks from rendered images, we aim to develop native watermarking framework that dispenses with rendered images as intermediaries and operates directly on Gaussian primitives. A natural approach is to adapt image watermarking techniques ZZhu iet al. (2018) by training a 3D encoder-decoder network to embed and extract invisible watermarks from Gaussian primitives. However, the number of primitives varies significantly across scenes, which poses challenge for standard feed-forward networks. Moreover, such a global encoder-decoder strategy remains inadequate against partial infringement.
To this end, we propose NGS-Marker, the first watermarking framework capable of embedding and fully decoding copyright information from local Gaussian primitives. NGS-Marker consists of two key components: a perturbation-bast extractor. Specifically, we first jointly train both components. The injector takes fixed-size subset of local Gaussian primitives as input and predicts subtle perturbations to produce watermarked primitives; the extractor then decodes the embedded watermark from these modified inputs, After training, we embed watermarks into the target 3D scene. We find that naive block boic- application of the injector causes boundary inconsistencies, while repeated random injections lead to cumulative distortion. To address this, we discard the rigid one-shot injection scheme and instead design soft, progressive optimization strategy. Using the frozen extractor as guidance, we optimize the target scene via gradient descent to ensure uniform watermark distribution and high rendering quality.
local Gaussian watermark injector and a corresponding
NGS-Marker is almost non-conflicting with indirect protection strategies, enabling hybrid protection at both the native and rendering levels to address concerns about image infringement. Additionally, beyond basic bit- bated messaging, NGS-Marke supports flexible watermarking with multimodal inputs such as images, allowing identity-aware copyright claims. Experiments on public datasets demonstrate that NGS-Marker not only effectively addresses partial infringement but also exhibits strong robustness against common real-worls distortions such as noise, rotation, and sparsification. Our key contributions can be summarized as:
We investigate the potential risks associated with existing indirect 3DGS protection methods and identify Partial Infringement, a prevalent but underexplored misuse scenario in 3D content production.
We propose NGS-Marker, the first framework that enables native protection for local 3DGS. It achieves fine- -raiind protection of the 3D scene while preserving high rendering qual- ity. Compared with image-based indirect protection approaches, -Gr-Mrrker effectively mitigates partial infringement issues.
We extend based personalized watermarking, demonstrating its potential for applications in privacy- sensitive scenarios. Comprehensive experiments confirm its robustness under various distortions.
enable integration with indirect approaches and support image-
2

---

Published as a conference paper at ICLR 2026
2 RELATED WORKS
3D Gaussian Splatting Recently, 3DGS Kerbl et al. (2023) achieved remarkable success in real-
time, high-fidelity rendering, inspiring series of extensions: Dynamic 3D Gaussians Luiten et al.
(2024). 4D Gaussian Splatting [Wu et al. (2024a), and Deformable 3D Gaussians Yang et al. (2024)
introduce temporal modeling: SuGaR Guédon & Lepetit (2024) and 2D Gaussian Splatting Huang et al. (2024)) improve surface reconstruction; Feature 3DGS et al. (2024) and LangSplat Qin al. 2024) enhance scene understanding via feature fields. Meanwhile, 3DGS has been adopted as foundational representation in tasks such as 3D generation [Tang et al. (2024); Chen et al. (2024e); Zou et al. (2024): Tang et al. (2025); /Zang et al. (2025a). editing Fang et al. (2024); Chen al.]
(2024c); Wu et al. (2024c), and segmentation Ye et al. (2025); Cen et al. (2025) As its use grows,
concerns around intellectual property protection become increasingly prominent.
Watermarking for 2D Digital Assets Embedding imperceptible watermarks into 2D digital assets (e.g., images) for copyright protection has been extensively studied Barni et al. (2001); Cox et al.] (2008). Traditional methods use handcrafted signal processing techniques such as DCT, DWT, and SVD to ensure robustness to distortions Cox et al. 1997); Raval & Rege (003). A major shift occurred with HiDDeN Zhu et al. (2018). which first applied end-to-end neural networks to image watermarking. Subsequent work has improved capacity, generalization, and robustness against adversarial attacks Wan al. (2022); Tancik et al. (2020). making 2D watermarking increasingly mature and practical Wu et al. (2020); Fermandez et al. (2023); Wen et al. al. (2023). These developments have also inspired progress in 3D watermarking Jang et al. (2024): Yoo et al. (2022 Luo et al. (2025).
Watermarking for 3D Digital Assets 3D assets have diverse structures and require format-specific watermarking, For point clouds, methods perturb coordinates, adjust density, or apply spectral graph techniques to ensure visual fidelity and robustness Li et al. (2021); Yang al. (2021) Wei et al. (202)). Mesh watermarking leverages vertex shifts, spectral bases, or topology, with deep learning methods enhancing imperceptibility and resistance attacks like smoothing simplification Wang eet al. (022); Zhu et al. (2024, 2025). Some studies Narendra et al.] (2024); /aaaan et al.) (2025) have begun to investigate the robustness of watermarks under large-scale cropping; however, they have not thoroughly examined scenarios in which portion of the protected 3D asset is extracted and embedded into another asset. Radiance fields, encoded implicitly (NeRF) or explicitly (3DGS), are typically watermarked via image modification or radiance regularization Li et al. (002); Luo et al. (2025) 2023). MarkNeRF [Chen et al.) (2023) applies image watermarking, while NeRFProtector (Son et al.) (2024) embeds binary strings via model fine-tuning. Crucially, most current 3DGS watermarking methods Tan et al. (2024): Li et al. (2025) adhere to this pseudo-3D paradigm. These image-space techniques exclusively protect rendered outputs. leaving the underlying native 3D Gaussian primitives susceptible to misuse. GS-Hider Zhang et al. (2024) and WaterGS Guo et al. (2024) achieve the injection of hidden scene into the global 3DGS, while SecureGS Zhhng et al. (2025)) achieves direct protection of Scaffold-GS Lu et al. (004)) by training separate MLPs for each scene. However, native protection mechanisms for local 3DGS data remain largely unexplored.
PROBLEM ANALYSIS
Impact of Explicitness on 3D Gaussian Asset Creation 3DGS explicitly represents the radiance field as a mixture of anisotropic 3D Gaussians g = (H4, 0i2 8s, Ct2 r where 14 E R² is the mean, 0₁ E R is the opacity, s; E Rö is the scale vector, C, E R is the view-dependent RGB color computed from Spherical Harmonic coefficients, and r; Rº is the rotation quaternion. During rasterization, 3D Gaussians are splatted to screen-space 2D Gaussians following EWA Splatting Zwicker et al. (2002). This process is implemented with tile-based CUDA rasterizer, which allows real-time differentiable rendering of 3DGS.
Crucially, the independence between Gaussian primitives and the tile-based rasterizer facilitates selective extraction of primitive subsets from arbitrary scenes. With the rapid advancement of 3DGS segmentation techniques Cen et al. (2025), the creation of 3D assets through the free combination of components from multiple sources has become increasingly common Chen et al. (024d).
3

---

Published as a conference paper at ICLR 2026
Partial Infringement We highlight com- mon yet underexplored misuse scenario in 3DGS termed partial infringement, in which ad- versaries extract and reuse part of a protected asset without triggering image-based watermark detectors (as shown in Figure D.. To simulate this, we embed a watermark into Scene A using an indirect method and then transplant a primi- tive subset into scene B, creating hybrid scene B Images rendered from НAΛ are used to recover
Table I: Results of existing 3DGS watermarking methods under the partial infringement scenario.
Methods
8 bits
16 bits
24 bits
32 bits
3D-GSW
50.35
49.17
50.52
51.60
Marker
50.10
50,00
49.85
50.34
GuardSplat
51.08
50.83
50.30
51.16
the watermark and are compared against the ground-truth message. As shown in Table 1 all tested methods Jang et al. (2025); Huang al. (2024b); [hen et al. (2025) achieve ~50% accuracy, which is equivalent to random guessing and indicates complete failure. Moreover, reducing embedded bits yields no improvement, implying that the watermark signal introduced via indirect methods is entirely disrupted to the extent that even minimal information cannot be preserved.
Feasibility Analysis To handle partial in- fringement and support scenes of arbitrary scale, propose embedding watermarks into arbi- trary local regions of the 3D scene, enabling comprehensive asset protection. This raises key question: can a neural network reliably em- bed and extract watermarks from local sets of Gaussian primitives? To investigate, we replace the image input in HiDDeN Zhu al. (2018) with random noise and conduct preliminary ex- periments in 2D domain. As shown Fig- 2 the neural network successfully learns to embed and retrieve watermark informa- tion from random noise. Although unstruc- tured, Gaussian primitives exhibit spatial distribution patterns, making them more tractable for neural networks than pure noise. This provides preliminary evidence for our approach's feasibility. In App. N, we provide a more theoretical explanation, grounded the properties of 3DGS, for why watermarks can be embedded into Gaussian primitives.
Bit Accuracy: 96.7%
Input
Output
Diff.
Figure 2: HiDDeN successfully embeds and tracts watermarks from random noise with minimal distortion, demonstrating potential for extension to unstructured data such as 3D Gaussian primitives.
NGS-MARKER
We propose NGS-Marker, a watermarking strategy designed for 3DGS assets. embeds watermark information into a source scene G* to generate watermarked version G The method satisfies the following properties: 1) the watermark can directly verified from GD without requiring rendering, 2) the subset of G" still reveals the owner's 's identity, 3) the rendered images of G" visually similar to those of g" and 4) the embedded watermark remains robust under common distortions. The overall schematic of NGS-Marker is shown in Figure In the following, phase and the watermark embedding process in detail. Next, we explain the ownership verification method. Finally, we discuss the image-basee based watermarking strategy and how NGS-Marker can be coordinated with indirect protection methods.
first describe the model training
4.1 JOINT TRAINING OF INJECTOR AND EXTRACTOR
We first jointly train a local 3D Gaussian watermark injector and a corresponding message extractor. To embed watermarks into local Gaussians, we apply perturbation based strategy by adding small modifications to Gaussian primitives, ensuring the rendering quality remains unaffected. The extractor then used to recover the embedded message from these perturbed primitives.
As depicted in Figure 3 we first sample local patch ğ" by randomly selecting À nearest Gaussian primitives from the source scene go based on pairwise center distances. Then, perturbation feature generator pg. composed of stacked PoineTransformer Wu et al. (2024d) layers, used to generate the latent perturbation feature fa- The patch g" is converted into tokens via a tokenizer (FPS + KNN) and used as the query in Py- The watermark message M is mapped into text prompt (with 1 as
4

---

Published as a conference paper at ICLR 2026
Joint Training Injector and Extractor
Progressive Watermark Embedding
w
Vanilla K-NN Sampling
Distorted
Neighborhood Sampling
9
Watermark Injector
Secret Midd 0,0,0 I.O...
Gradient
Message M 1,0, 1,0, I...
Message Extractor
Message Extractor
1,0, I....
Watermark Injector
[
Message Extractor
Self-Attention
True, Haise, True,
Cross-Atention
CLIP
g
FPS
364
5
Pa x4
Apply Perturbations
w
FPS KNN
MT
M
Foed-Forward
KNN
fm
Figure 3: Overview of NNGS-Marker The watermark injector (Ps + Pa) is jointly trained with the message extractor &. The trained extractor can guide gradient-based optimization to protect the target 3D scene. Once the private watermark is embedded in g", users can verify copyright ownership directly from the native 3D data without rendering.
"True" and 0 as "False") and encoded using a CLIP text encoder Radford al. (2021) to obtain fns which is used as key and value in Pg:
fa Pa (tokenizer(""): CL).(M)).
(I)
To decode the perturbation for each primitive, we design a perturbation decoder Pa. consisting primarily of cross-attention layers. For each Gaussian primitive Gū, Pa takes it as query while using fa as key and value to predict its corresponding perturbation. Since primitives processed independently, Pa decode all perturbations in parallel. The watermarked patch G" is obtained by adding the decoded perturbations to the original primitives:
G"L 9" + Pa(g";
To extract and supervise the watermark embedded I", we design the message extractor E, whose architecture mirrors that of Pg and consists of stacked PointTransformer layers. uses 9"V as the sole input (serving query, key, and value), and the output of the final PointTransformer layer passed through MLP produce prediction M with the same dimensionality the watermark message M. Detailed architectural configurations of Pg. Pa. and & are provided in App. C
The injector and extractor are jointly optimized with two objectives: 1) imperceptibility. the rendered appearance of 9" should resemble that of g+; and 2) accuracy, the decoded message M should match the original M. The overall loss is defined as:
= + L. = MSE( 0), R(ğ", A)) + A BCH(M,
where, R denotes differentiable rendering, is the camera parameters, X a hyperparameter, and MSE and BCE refer mean squared error and binary cross entropy, respectively.
4.2 PROGRESSIVE WATERMARK EMBEDDING
Equipped with the pretrained watermark injector and message extractor, we proceed to protect target scenes. naive solution is divide the scene into patches and embed watermarks into each via the local injector. However, this does not ensure uniform distribution across the scene. A more sophisticated method iteratively samples local regions and sequentially embeds the watermark until all areas contain the desired message. Yet, this approach conflicts with the injector's one-shot design: repeated modifications to the same primitives may introduce conflicting perturbations, causing cumulative distortion and degraded rendering quality.
To address this, we adopts a progressive optimization strategy based on the fundamental goal: any randomly sampled local region from the protected scene allows accurate recovery of the identity
5

---

Published as a conference paper at ICLR 2026
Socne
Scene 2
Secne 3
Figure 4: Simulated partial infringement scenarios on public datasets. It can be observed that NGS-
Marker enables precise and fine-grained copyright protection.
message. As shown in Figure 3 we omit the injector and use the extractor to guide embedding via gradient descent. Specifically, we first randomly sample a patch ÿ" consisting of ó neighboring Gaussian primitives from the target scene G Unlike nearest-neighbor sampling used training, we introduce some distortions to boost watermark robustness. The sampled patch G" then passed through the extractor to produce a predicted message M. Finally, we optimize G such that any sampled G" enables accurate decoding of the predefined identity message M
The objective also consists of two parts: 1) the rendered image of the watermarked scene G should remain visually similar to the source G"; and 2) the predicted message M should be close as possible to the target identity M The loss function is formulated as:
Lww = Lww + Aw - = MSE(R((" ,), R("", + Aw BCE(M" M).
(4)
4.3 OWNERSHIP VERIFICATION
When suspecting unauthorized use of their assets in 3D scene, the users select suspicious region and input into the extractor & to retrieve embedded watermark information, which is then compared with their private ID to determine ownership. To mitigate potential noise in the watermark extracted from a group of primitives, we propose a visualization method for intuitive assessment. We sample multiple primitive groups, determine the most probable owner for each, and assign a unique color associated with the inferred owner onto the SH coefficients of each primitive. This enables intuitive visual localization of regions potentially originating from the user's private assets. Examples demonstrating the applicability of our method are provided in Figure 4 and App. G
4.4 EXTENDED APPLICATIONS
Cooperating with Indirect Protection Methods NGS-Marker extracts watermark directly from native 3D Gaussians. However, protecting the rendered images of 3D assets is also important in practice. We can integrate the objectives both methods to achieve comprehensive protection:
Lecoperate
Lus Xindireat
Lindirects
where Lindisect denotes the optimization objective of the indirect protection method, which encourages the watermarked renderings remain decodable while keeping the change in rendering quality small. L.p is the objective we propose, which enforces that the desired watermark can be decoded from any local Gaussian primitives, again without noticeably degrading rendering quality. In the cooperative protection setting, we optimize these two objectives simultancously. In Section 5.4] we empirically demonstrate the feasibility of integrating MGS-Mrrker with indirect protection methods.
Image-based Watermarking NGS-Marker is not specifically tailored to binary messages, and in principle, can handle messages of other modalities. We can replace the CLIP text encoder and the final MLP in the extractor with the incoder-decoded of the target modality, and then fine-tune the model and embed the watermark in target scenes:
- CT', - + -
Cm'
(6)
where E and C/ denote losses for model fine-tuning and watermark embedding under the target modality, respectively, LTT and Cm' represent the losses for message extraction. In Section we empirically show the feasibility of applying (GS-Marker embed image messages in 3D scenes.

---

Published as a conference paper at ICLR 2026
5 EXPERIMENTS
5.1 EXPERIMENTAL SETUP
Dataset: We use standard public 3D datasets to train and evaluate NGS-Marker, with 24 scenes for training and 4 held out for testing. Thanks to the localized watermark injection strategy. small number of scenes suffices generate abundant training data. To simulate partial infringement scenarios, we first embed watermark information into test scenes and then extract different subsets of Gaussians from these watermarked scenes. These extracted subsets are inserted into an unwatermarked scene to construct the test dataset. Dataset details are provided in App. D
For fair comparison, we evaluate NGS-Marker against five baselines, including three existing 3DGS protection methods and two variants based on our trained local watermark injector: 1) 3D-GSS [aang et al. (2025), 2) GaussianMarker Huang et al. (2024b), 3) GuardSplat [Chen et al. (2025). 4) WI-Naive: the target scene is divided into patches, each independently watermarked using the watermark injector, 5) WI-Iterative a subset of the scene is randomly selected and watermarked, followed by repeated sampling and injection over multiple iterations.
Baselines:
Implementation Details: The watermark injector and message extractor are trained on two A100 GPUs with &- = 8192 and A 5 for 150 epochs. Watermark embedding is performed via progressive optimization of the target 3D scene on a single A100 GPU, using 8 = 8192 and A, = 5. The number of optimization iterations is adapted scene complexity and stops once evaluation metries stabilize. During random sampling, the applied distortions include densification. noise, rotation, dropout, and translation. Unless stated otherwise, the embedded message length is 16 bits.
Evaluation Metrics: We evaluate NGS-Marker from three standard aspects of digital watermarking: (i) Capacity (Bit-Acc and 3D-Acc): Measures bit-level accuracy and primitive-level accuracy across different message lengths. 3D-Acc is calculated as follows: Gaussian primitive is randomly selected, and its 6-nearest neighbors are used as input to the message decoder. The decoded message is then compared with the ground truth ID). If the similarity exceeds fixed threshold т, the Gaussian is classified as belonging to a protected asset; otherwise, is not. We set T to 75% in all experiments in this paper, and the final accuracy is obtained by averaging the correctness over all test Gaussians. For further discussion on т, please refer to App. (ii) Imperceptibility (PSNR, SSIM, LPIPS): Perceptual similarity between rendered images before and after watermarking. (iii) Robustness (Gaussian Noise, Rotation, Scaling, Densification, Dropout, Translation): Testing whether the embedded watermark remains decodable under various distortions.
5.2 EXPERIMENTAL RESULTS
bit accuracy (Bit-Ace), which measures the similarity between the extracted and injected bit sequences, and 3D accuracy (3D-Acc), which reflects the average classification accuracy at the level of individual Gaussians. For Bit-Acc, our method directly decodes information from the Gaussians, whereas other baselines rely rendered images for watermark extraction. As shown in Table 2] existing public methods achieve near-random performance (~-50%) under partial infringement, demonstrating their inability to cope with this scenario. The two variants using our local watermark injector can recover part of the embedded message, but still fall short compared to NGS-Marker in terms of decoding accuracy.
Accuracy We evaluate two metrics:
Since existing methods cannot perform detection at the per-Gaussian level, we report their 3D-Acc as 'N/A'. Notably, GaussianMarker includes a decoder that extracts information directly from Gaussian properties, but it scene-specific, tied to a fixed watermark, and does not generalize. When Gaussians from a watermarked scene are partially inserted into a new scene, the boundary regions contain a mixture of watermarked and non-watermarker elements, significantly increasing the detection difficulty. As shown in Table 2 NGS-Marken achieves over 95% 3D-Acc, demonstrating strong robustness under mixed watermark conditions. Moreover, we observe that 3D-Acc does not degrade as the number of embedded bits increases. This demonstrates NGS-Marker's ability to maintain high localization accuracy even with longer, more secure watermarks. We hypothesize that although Bit-Ace may drop slightly with longer messages, the overall robustness of the watermark improves, which results in fewer false positives caused by accidental matches. Interestingly, when fewer bits are embedded (e.g., 8 bits), 3D-Ace tends to decrease, likely due to the higher chance that unmarked Gaussians are misclassified as protected assets due to random coincidence.
7

---

Published as a conference paper at ICLR 2026
Table 2: Quantitative comparison with baselines in partial infringement scenarios. Results are reported for 8-, 16-, and 24-bit messages and averaged over all test scenes. "N/A" indicates that the corresponding method does not support this functionality. Superscripts *** and "S" denote watermark extraction from rendered images and Gaussian primitives, respectively.
bits
bits
Methods
PSNR/SSIMT LPIPS
PSNR/SSIM" LPIPS,
3D-Acc PSNI/SSIM LPIPS,
50.35
31.88
0.027
50.52"
N/A
GaussianMarker
50.10"
0.031
50.00"
N/A
30.75 /0.961
49.85"
N/A
GuardSplat
51.08"
N/A
40.74/0.996
0.010
50.83*
N/A
39.22/09994
0.013
50.30"
N/A
37.96 00991
WI-Naive
65.325
68.50
30.15
0.970
0.041
57.54
55.90
27.07
/0.962
0,060
$4.29i
53.70
25.36
00911
Wi-fterative
77.93
80,70
26.36
0.904
0.092
69.251
72.30
25.54 0.8
0.105
60, 383
61.50
24.47
00.822
0.136
NGS-Marker
99.14
95.20
41.77 0.996
0.004
97.941
96.60
40.17
0.995
0.007
94.68
96.50
39.61 / /0.993
0.013
3D-GSW
MarkeianMarker
GuardSplat
Original
WI-Naive
WI-Iterative
NGS-Marker
Figure Visual comparisons in the bear scene with 16-bit watermark embedding. For better visualization, the difference images are amplified by a factor of 5. It can be seen that our method introduces negligible visual distortion.
Rendering Quality Since NGS-Marker does not require extracting watermark information from rendered images, it is theoretically capable of embedding watermarks without compromising render- ing quality. In contrast, existing methods inevitably alter the rendered images to encode watermark signals. As shown in Table [ and Figure [] provide both quantitative and qualitative comparisons of rendering quality before and after watermark embedding. While existing approaches are able to preserve visual fidelity high degree, our method consistently achieves the best results. Moreover, direct watermark injection using only the local injector significantly degrades rendering quality, further validating the necessity and effectiveness of the progressive optimization strategy.
Robustness for Distortions In practical scenarios, watermarked 3D assets are often subject to various distortions. To evaluate the robustness of watermarks embedded by NGS-Marken we conduct experiments
100
1024
2048
90
6:44
8192
Bit-Acc (%)
80
simulating range of such distortions. We first embed watenmarks into the test scenes,
70
then apply different types of distortions, and finally assess whether the extractor still recover the watermark from the altered assets. For distortions that degrade render- ing quality, such as Gaussian noise, den- sification, and dropout, we cap distortion intensity to preserve visual integrity of the rendered images, since excessive distortion would typically be avoided in real-world misuse cases. As shown in Table 3 NGS-Marker exhibits strong robustness against most types of plausible distortions. Additionally, because we normalize spatial positions before feeding the local Gaussians into the injector and extractor by scaling all Gaussian centers into unit sphere, our method inherently invariant to global scaling and translation of the Gaussians.
60
50
100
15
20
25
30
35
40
45
Time (min)
Figure 6: Impact of different ò values on convergence time and Bit-Ace in bear scene. NGS-Marker remains effective even high watermarking granularity.
8

---

Published as a conference paper at ICLR 2026
Table 3: Quantitative robustness evaluation under various attacks. 'Combined' denotes concurrent exposure to all attack types. Results are averaged over five runs to account for attack randomness.
Gaussian Noise
Rotation
Scaling
Densification (0%-50%%
Dropout (0%-50%%
Translation (#oc)
Metrics
None
Combined
(a=00.015)
(=#)
(d:o0
Bit-Acct 98.35
97.06
98.31
98.35
97.93
97.41
98.35
96.28
3D-Ace 97.90
96.80
97.80
97.90
97.40
97.50
97.90
96.30
Table 5: Results of combining NGS-Marker with indirect protection methods. 'Indirect' refers indirect watermarking; 'Native' indicates native protection using Equation 4 'Hybrid' combines both optimization in Equation
3D-GSW
GarkeianMarker
GuardSplat
Type
PSNR/SSIM/ LPIPS) 3D-Acc Bit-Ace PSNR/SSIM1 LPIPS|
3D-Acc Bit-Ace PSNR/SSIM) LPIPS,, 3D-Ace Bit-Acc
Indirect 30.37 /09960
0.051
N/A
99.07
30.75
00.91
0.046
N/A
98.85*
39.22 / 0.994
0.013
N/A
99.51
Native
40.17 /.999
0.007
97.90
98.35
40.17 00.995
0.007
97.90
98.35
00,979
0.007
97.90
98.35
98.68"
98.21*
99.14"
Hybrid 33.96/0.980 0.039
97.10
35.09
00.983
0.022
97.40
39.46/ 0,994
0.011
97.00
97.591
97.848
97.38
5.3 ABLATION STUDIES
We set the default value of to 8,192; how- ever, in some scenarios, users may wish to detect watermark information from few Gaussians as possible. To evaluate the effectiveness of method under varying numbers of local Gaussians, we conduct ablation study. Using the bear, scene, we test how different 5 values affect the convergence time of watermarking and the final Bit-Acc. As shown Figure 6 reducing I leads slower convergence and slight drop in final accuracy. Nevertheless, our method performs reliably when ö is 2,048 or higher, demonstrating its potential for detecting watermarks in small-scale infringement scenarios.
Table 4: Watermarking time for different scenes and the number of primitives contained therein.
Scene
person
chair
bear
garden
Time (min)
4.0
9.3
28.7
35.2
Number
42512
116713
418979
588946
Additionally, we report the time required to embed watermarks into each test scene, as shown in Table It can be observed that the embedding time positively correlated with the number of primitives.
5.4 COOPERATING WITH INDIRECT PROTECTION METHODS
We employ Equation to examine the feasibility of integrating NGS-Marker with indirect protection methods, with the parameter Aindirect set to 0.1. For 3D-GSW [aang et al. (2025) and Gaussian- Marker Huang et al. (2024b), first expand or prune the primitives according to their respective original procedures, tollowed by watermark embedding. As presented in Table NGS-Marker does exhibit notable conflicts with uaddring-bassed indirect protection methods. Their joint application enables comprehensive protection of 3DGS. More results are shown in App. E
5.5 IMAGE-BASED WATERMARKING
Without Watermark Eimeeddin
We design a simple experiment to test whether users can inject image-basee water- marks into 3D scenes using NGS-Marker. We replace the CLIP text encoder (origi- nally used to encode bit messages) with the CLIP image encoder, and substitute the final MLP in the extractor with an image decoder composed of transposed convolu- tional layers. All components except the image encoder are fine-tuned. The opti- mization objectives during fine-tuning and
With Watermark Embedding
Decoded Message
Private Image Message
PSNR: 38.75
(Original Watermarked Rendering) Figure 7: Our method successfully embeds and recovers image watermarks in 3D scenes.

---

Published as a conference paper at ICLR 2026
embedding watermarks
C Cimage Cj + 5 MSE(M (M watermarked .M') + MSE( Mariginal .MB),
Cu f. + 20 MSE M Watermarked ,M!"),
where, AWatermarked and Moriiiial denote the decoded images from watermarked and original Gaus- sians, respectively. M is the watermark image, and M is blank image of the size. We select three images from the internet as target watermarks and fine-tune the model. As shown in Figure 7 we extract and visualize the decoded watermark information from two scenes: clean scene (ship) and watermarked scene (chai r). The results show a clear distinction between the two, demonstrating the potential of our method to support image-based watermarking for 3DGS.
CONCLUSION
We highlight a common but previously underexplored misuse scenario for 3DGS assets, namely Partial Infringement. To address this issue, propose NGS-Marker, novel native watermarking framework tailored for 3DGS. Leveraging carefully designed training and embedding strategies, NGS-Marker achieves efficient and robust protection for 3DGS assets. Furthermore, our experiments demonstrate that NGS-Marke supports multimodal watermark messages and can be integrated with traditional indirect protection techniques, thereby enhancing its practical applicability.
Limitations and Discussion Although JGS-Marker achieves fine-grained and stable protection for 3DGS, it still has some limitations. 1) Similar to other native 3D works Chen et al. (2024a). NGS-Marker relies on 3D encoding/decoding techniques that are less mature compared to 2D. 2) Additionally, since our method theoretically supports arbitrarily large scenes, designing an efficient partitioning and traversal strategy could further improve scalability.
ACKNOWLEDCEMENTS
This work was supported by the National Natural Science Foundation of China under Grant 42394060 and 42394064.
REFERENCES
Mauro Barni, Franco Bartolini, and Alessandro Piva. Improved wavelet-based watermarking through pixel-wise masking. IEEE transactions on image processing, 10(5):783-791, 2001.
Jonathan T Barron, Ben Mildenhall, Dor Verbin, Pratul P Srinivasan, and Peter Hedman. Mip-nerf 360: Unbounded anti-aliased neural radiance fields. In Proceedings of the IEEF/CVF conference on computer vision and pattern recognition, pp. 5470-5479, 2022.
Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 ieee symposium on security and privacy (sp), pp. 39-57. Icce, 2017.
Jiazhong Cen, Jiemin Fang, Chen Yang, Lingxi Xie, Xiaopeng Zhang, Wei Shen, and Qi Tian. Segment any 3d gaussians. Proceedings of the AAAI Conference on Artificial Intelligence, 39 (2):1971-1979, Apr. 2025. doi: 10.1609/aaaivv99222219999 index.php/ http:/AAAA//atiiiicc http://atteeeeeeeeeeeeeeeee 32193
httptttss///os.aaaatt org/
Lifeng Chen, Jia Liu, Yan Ke, Wenquan Sun, Weina Dong, and Xiaozhong Pan. Marknerf: Water- marking for neural radiance field. arXiv preprint arXiv:2309. 1747, 2023.
Yihang Chen, Qianyi Wu, Mengyao Li, Weiyao Lin, Mehrtash Harandi, and Jianfei Cai. Fast feedforward 3d gaussian splatting compression. arXiv preprint arXiv:2410.08017, 2024a.
Yiwen Chen, Zilong Chen, Chi Zhang, Feng Wang. Xiaofeng Yang, Yikai Wang, Zhongang Cai, Lei Yang. Huaping Liu, and Guosheng Lin. Gaussianeditor: Swift and controllable 3d editing with gaussian splatting. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 21476-21499 2024b.
10

---

Published as a conference paper at ICLR 2026
Yiwen Chen, Zilong Chen, Chi Zhang, Feng Wang, Xiaofeng Yang, Yikai Wang, Zhongang Cai, Lei Yang, Huaping Liu, and Guosheng Lin. GaussianEditor: Swift and Controllable 3D Editing with Gaussian Splatting. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 2p.2115 21476-21448 485, June 2024c.
Yongwei Chen, Tengfei Wang, Tong Wu, Xingang Pan, Kui Jia, and Ziwei Liu. Comboverse: Compositional 3d assets creation using spatially-aware diffusion guidance. In Computer Vi- sion - ECCV 2024: 18th European Conference, Milan, Italy, September 29-October 4, 2024, Proceedings, Part XXIV, pp. 126,146, Berlin, Heidelberg, 2024d. Springer- Verlag, ISBN 978- 3-031-72690-3, doi: 10. 00107799778--001-726----- URL
978 0--03172691-00
Zilong Chen, Feng Wang. Yikai Wang, and Huaping Liu. Text-to-34 3d using gaussian splatting. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 21401-21412, June 2024e.
Zixuan Chen. Guangcong Wang, Jiahao Zhu, Jianhuang Lai, and Xiaohua Xie. Guardsplat: Efficient and robust watermarking for 3d gaussian splatting. In Proceedings of the Computer Vision and Pattern Recognition Conference, pp. 16325-16335, 2025.
Ingemar J Cox, Joe Kilian, F Thomson Leighton, and Talal Shamoon. Secure spread spectrum watermarking for multimedia. IEEE transactions on image processing, 6(12):1673-1687, 1997.
Ingemar J Cox, Matthew L. Miller, Jeffrey A Bloom, Jessica Fridrich, and Ton Kalker. Digital watermarking, Morgan Kaufinann Publishers, 54:56-59, 2008.
Jiemin Fang, Junjie Wang. Xiaopeng Zhang, Lingxi Xie, and Qi Tian. Gaussianeditor: Editing 3d gaussians delicately with text instructions. In CVPR, 2024.
Pierre Fernandez, Guillaume Couairon, Hervé Jégou, Matthijs Douze, and Teddy Furon. The stable signature: Rooting watermarks in latent diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 22466-22477 2023.
Bin Fu, Jialin Li, Bin Zhang, Ruiping Wang, and Xilin Chen. Gs-lts: 3d gaussian splatting-based adaptive modeling for long-term service robots, 2025. URL http:://ar....or///
25C3.17733
Antoine Guédon and Vincent Lepetit. Sugar: Surface-aligned gaussian splatting for efficient 3d mesh reconstruction and high-quality mesh rendering. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp.
June 2024.
Yijia Guo, Wenkai Huang, Yang Li, Gaolei Li, Hang Zhang, Liwen Hu, Jianhua Li, Tiejun Huang, and Lei Ma. Splats in splats: Embedding invisible 3d watermark within gaussian splatting. arXiv preprint arXiv:2412.03111, 2024.
Ayaan Haque, Matthew Tancik, Alexei Efros, Aleksander Holynski, and Angjoo Kanazawa. Instruct-nerf2nertt Editing 3d scenes with instructions. In Proceedings of the IEEF/CVF interna- tional conference on computer vision, pp. 19740-19750, 2023.
Binbin Huang, Zehao Yu, Anpei Chen, Andreas Geiger, and Shenghua Gao. 2d gaussian splatting for geometrically accurate radiance fields. In ACM SIGGRAPH 2024 Conference Papers, SIGGRAPH '24, New York, NY, USA, 2024a. Association for Computing Machinery. ISBN 9798400705250. doi: 111443/41519.35544444 URL htttp:://dol www..o...........1..1.. 1015519.6667777 3657428
Xiufeng Huang, Ruiqi Li, Yiu-ming Cheung, Ka Chun Cheung, Simon See, and Renjie Wan. Gaussianmarker: Uncertainty-awar copyright protection of 3d gaussian splatting. Advances in Neural Information Processing Systems, 37:33037-33060, 2024b.
Youngdong Jang, Dong In Lee, MinHyuk Jang, Jong Wook Kim, Feng Yang, and Sangpil Kim. Waterf: Robust watermarks in radiance fields for protection of copyrights. In Proceedings of the IEFF/CVF Conference Computer Vision and Pattern Recognition, pp. 12087-12097, 2024.
11

---

Published as a conference paper at ICLR 2026
Youngdong Jang, Hyunje Park, Feng Yang. Heeju Ko, Euijin Choo, and Sangpil Kim. 3d-gsw 3d gaussian splatting for robust watermarking. In Proceedings of the Computer Vision and Pattern Recognition Conference, pp. 1138-5948, 2025.
Bernhard Kerbl, Georgios Kopanas, Thomas Leimkühler, and George Drettakis. 3d gaussian splatting for real-time radiance field rendering. ACM Transactions Graphics, 42(4), July 2023. URL inria. fr/ http///gggp////g/aaaaa//aa
htt.ts://rer reppo- sam
an sp att ing/
Arno Knapitsch, Jaesik Park, Qian- Yi Zhou, and Vladlen Koltun. Tanks and temples: Benchmarking large-scale seene reconstruction. ACM Transactions on Graphics (ToG), 36(4):1-13, 2017.
Chenxin Li, Brandon Y Feng, Zhiwen Fan, Panwang Pan, and Zhangyang Wang. Steganerf: Em- bedding invisible information within neural radiance fields. In Proceedings of the IEEE/CVF international conference computer vision, pp. 441-453, 2023.
Lijiang Li, Jinglu Wang, Xiang Ming, and Yan Lu. Gs-marker: Generalizable and robust watermarking for 3d gaussian splatting, arXiv preprint arXiv:2503.18718, 2025.
Xinke Li, Zhirui Chen, Yue Zhao, Zekun Tong, Yabang Zhao, Andrew Lim, and Joey Tianyi Zhou. Pointba: Towards backdoor attacks in 3d point cloud. In Proceedings of the IEEE/CVF international conference on computer vision, pp. 16492-16501, 2021.
Tao Lu, Mulin Yu, Linning Xu, Yuanbo Xiangli, Limin Wang, Dahua Lin, and Bo Dai. Scaffold-gs: Structured 3d gaussians for view-adaptive rendering. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pp. 20654-20664 2024.
Jonathon Luiten, Georgios Kopanas, Bastian Leibe, and Deva Ramanan. Dynamic 3d gaussians: Tracking by persistent dynamic view synthesis. In 2024 International Conference on 3D Vision (3DV), pp. 800-809, 2024. doi: 121111/322243332222.000
Ziyuan Luo, Qing Guo, Ka Chun Cheung, Simon See, and Renjic Wan. Copymerrf: Protecting the copyright of neural radiance fields. In Proceedings of the IEEE/CVF international conference on computer vision, pp. 22401-222 12000-22111,111 2023.
Ziyuan Luo, Anderson Rocha, Boxin Shi, Qing Guo, Haoliang Li, and Renjie Wan. The nerf signature: Codebook-aides watermarking for neural radiance fields. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2025.
Ben Mildenhall, Pratul P Srinivasan, Rodrigo Ortiz-Cayon, Nima Khademi Kalantari, Ravi Ra- mamoorthi, Ren Ng, and Abhishek Kar. Local light field fusion: Practical view synthesis with prescriptive sampling guidelines. ACM Transactions Graphics (ToG), 38(4):1-14, 2019.
Ben Mildenhall, Pratul P Srinivasan, Matthew Tancik, Jonathan T Barron, Ravi Ramamoorthi, and Ren Ng. Nerf: Representing scenes neural radiance fields for view synthesis. Communications of the ACM, (5(1):99-106, 2021.
Modigari Narendra, ML Valarmathi, L Jani Anbarasi, and Amir H Gandomi. Levenberg- marquardt deep neural watermarking for 3d mesh using nearest centroid salient point learning. Scientific Reports, 14(1):6942, 2024.
Albert Pumarola, Enric Corona, Gerard Pons-Moll, and Francese Moreno-Noguer. D-nerf: Neural radiance fields for dynamic scenes. In Proceedings of the IEEE/CVF conference computer vision and pattern recognition, pp. 1038--0327, 2021.
Minghan Qin, Wanhua Li, Jiawei Zhou, Haoqian Wang, and Hanspeter Pfister. Langsplat: 3d language gaussian splatting. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 20051-20066 June 2024.
Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agar- wal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, Gretchen Krueger, and Ilya Sutskever. Learning transferable visual models from natural language supervision. arXiv preprint (XXi:22133000022 2021.
12

---

Published as a conference paper at ICLR 2026
Mchul S Raval and Priti P Rege. Discrete wavelet transform based multiple watermarking scheme. In TENCON 2003, Conference on Convergent Technologies for Asia- iia-Pacifiic Region, volume 3, pp. 935-938. IEEE, 2003.
Qi Song, Ziyuan Luo, Ka Chun Cheung, Simon See, and Renjie Wan. Protecting nerfs' copyright via plug-and-ple watermarking base model. In European Conference on Computer Vision, pp. 57-73. Springer, 2024.
Yuqi Tan, Xiang Liu, Shuzhao Xie, Bin Chen, Shu-Tao Xia, and Zhi Wang- Water-gs: To- ward copyright protection for 3d gaussian splatting via universal watermarking. arXiv preprins arXiv:2412.0550 05695, 2024.
Matthew Tancik, Ben Mildenhall, and Ren Ng. Stegastamp: Invisible hyperlinks in physical pho- tographs. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 2117-2126, 2020.
Jaaxiang Tang. Jiawei Ren, Hang Zhou, Ziwei Liu, and Gang Zeng. Dreamgaus- sian: Generative gaussian splatting for efficient 3d content creation. In B. Kim, Y. Yue, S. Chaudhuri. K. Fragkiadaki, M. Khan, and Y. Sun (eds.), International Conference on Representation Learming, volume 2024, pp. 33879-33896. 2024. URL https::/prroceedinnss.ccc 905202e2 B55.0222.3555aaac77225555----000
Jaxxang Tang, Zhaoxi Chen, Xiaokang Chen, Tengfei Wang, Gang Zeng, and Ziwei Liu. Lgm: Large multi-view gaussian model for high-resolution 3d content creation. In Aleš Leonardis, Elisa Ricci, Stefan Roth, Olga Russakovsky, Torsten Sattler, and Gül Varol (eds.), Computer Vision ECCV 2024, pp. 1-18, Cham, 2025. Springer Nature Switzerland. ISBN 978-3-031-73235-5
Xuechang Tu, Lukas Radl, Michael Steiner, Markus Steinberger, Bernhard Kerbl, and Fornando de la Torre. VRsplat: Fast and Robust Gaussian Splatting for Virtual Reality. Proc. ACM Comput. Graph. Interact. Tech., 8(1), 2025.
Wenbo Wan, Jun Wang, Yunming Zhang, Jing Li, Hui Yu, and Jiande Sun. A comprehensive survey on robust image watermarking. Neurocomputing, 488:226-247, 2022..
Feng Wang, Hang Zhou, Han Fang, Weiming Zhang, and Nenghai Yu. Deep 3d mesh watermarking with self-adaptive robustness. Cybersecurity, 5(1):24, 2022.
Cheng Wei, Yang Wang, Kuofeng Gao, Shuo Shao, Yiming Li, Zhibo Wang, and Zhan Qin. Point- nebw: Towards dataset ownership verification for point clouds via negative clean-label backdoor watermark. IEEE Transactions on Information Forensics and Security, 2024.
Yuxin Wen, John Kirchenbauer, Jonas Geiping, and Tom Goldstein. Tree-rings watermarks: Invisible fingerprints for diffusion images. Advances in Neural Information Processing Systems, 36:58047- 58063, 2023.
Guanjun Wu, Taoran Yi, Jiemin Fang, Lingxi Xie, Xiaopeng Zhang, Wei Wei, Wenyu Liu, Qi Tian, and Xinggang Wang. 4d gaussian splatting for real-time dynamic scene rendering. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 20310- 20320, June 2024a.
Guanjun Wu, Taoran Yi, Jiemin Fang, Lingxi Xie, Xiaopeng Zhang, Wei Wei, Wenyu Liu, Qi Tian, and Xinggang Wang. 4d gaussian splatting for real-time dynamic scene rendering. In Proceedings of the IEEF/CVF conference on computer vision and pattern recognition, pp. 20310-20320, 2024b.
Hanzhou Wu, Gen Liu, Yuwei Yao, and Xinpeng Zhang. Watermarking neural networks with watermarked images. IEEE Transactions on Circuits and Systems for Video Technology, 31(7): 2591-2601, 2020.
Jing Wu, Jia-Wang Wang Bian, Xinghui Li, Guangrun Wang, Ian Reid, Philip Torr, and Victor Prisacariu. GaussCtrl: Multi- View Consistent -ext-Driven 3D Gaussian Splatting Editing. ECCV, 2024c.
Xiaoyang Wu, Li Jiang, Peng-Shuai Wang, Zhijian Liu, Xihui Liu, Yu Qiao, Wanli Ouyang, Tong He, and Hengshuang Zhao. Point transformer v3: Simpler, faster, stronger. In CVPR, 2024d.
13

---

Published as a conference paper at ICLR 2026
Jiaqi Yang, Xuequan Lu, and Wenzhi Chen. A robust scheme for 3d point cloud copy detection. arXiv preprint wrXi:22100000772 2021.
Ziyi Yang, Xinyu Gao, Wen Zhou, Shaohui Jiao, Yuqing Zhang, and Xiaogang Jin. Deformable 3d gaussians for high-fidelity monocular dynamic scene reconstruction. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 20331-20341, June 2024.
Mingqiao Ye, Martin Danelljan, Fisher Yu, and Lei Ke. Gaussian grouping: Segment and edit anything in 3d scenes. In Aleš Leonardis, Elisa Ricci, Stefan Roth, Olga Russakovsky, Torsten Sattler, and Güil Varol (eds.), Computer Vision - ECCV 2024, pp. 162-179, Cham, 2025. Springer Nature Switzerland. ISBN 978-3-031--3397-0
Innfarn Yoo, Huiwen Chang, Xiyang Luo, Ondrej Stava, Ce Liu, Peyman Milanfar, and Feng Yang. Deep 3d-to-2d watermarking: Embedding messages in 3d meshes and extracting them from 2d renderings. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 10031-10040, 2022.
Khandoker Ashik Uz Zaman, Mohammad Zahangir Alam, Mohammed NM Ali, and Mahdi H Miraz. Deep neural watermarking for robust copyright protection 3d point clouds. arXiv preprint arXiv:2510.27533 2025.
Chuanrui Zhang, Yingshuang Zou, Zhuoling Li, Minmin Yi, and Haoqian Wang. TranSplat: Gen- eralizable 3D Gaussian Splatting from Sparse Multi- View Images with Transformers. Proceed- ings of the AAAI Conference on Artificial Intelligence, 3999)9989-9887, April 2025a. doi: N0.16609aaai.v399..33377
Xuanyu Zhang, Jiarui Meng, Runyi Li, Zhipei Xu, Yongbing Zhang, and Jian Zhang, Gs-hider: Hiding messages into 3d gaussian splatting. Advances in Neural Information Processing Systems, 37:49780-49805, 2024.
Xuanyu Zhang, Jiarui Meng, Zhipei Xu, Shuzhou Yang. Yanmin Wu, Ronggang Wang, and Jian Zhang. Securegs: Boosting the security and fidelity of 3d gaussian splatting steganography. arXiv preprint ar drXiv:25033.6// 18, 2025b.
Shijie Zhou, Haoran Chang, Sicheng Jiang. Zhiwen Fan, Zehao Zhu, Dejia Xu, Pradyumna Chari, Suya You, Zhangyang Wang, and Achuta Kadambi. Feature 3dgs: Supercharging 3d gaussian splatting enable distilled feature fields. In Proceedings the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 11676-21689 June 2024.
Jiren Zhu, Russell Kaplan, Justin Johnson, and Li Fei-Fei. Hidden: Hiding data with deep networks. In Proceedings of the European conference on computer vision (ECCV), pp. 657-672, 2018
Xingyu Zhu, Guanhui Ye, Xiapu Luo, and Xuetao Wei. Rethinking mesh watermark: Towards highly robust and adaptable deep 3d mesh watermarking. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 38, pp. 7784-7792, 2024.
Xingyu Zhu, Guanhui Ye, Chengdong Dong, Xiapu Luo, Shiyao Zhang, and Xuetao Wei. Mesh watermark removal attack and mitigation: novel perspective of function space. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 39, pp. 1 11004-11012, 2025.
Zi-Xin Zou, Zhipeng Yu, Yuan-Chen Guo, Yangguang Li, Ding Liang, Yan-Pei Cao, and Song-Hai Zhang. Triplane meets gaussian splatting: Fast and generalizable single-view 3d reconstruction with transformers. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition (CVPR), pp. 10324-10335, June 2024.
M. Zwicker, H. Pfister, J. van Baar, and M. Gross. Ewa splatting. IEEE Transactions on Visualization and Computer Graphics, 8(3):223-233 2002. doi: 10.1009/VCC.22022.0115566
14

---

Published as a conference paper at ICLR 2026
APPENDIX
A OVERVIEW OF THE APPENDIX
Here, we supplement some detailed information that is not explained in the main text but may be of interest to the reader, including:
App.
Why is "Nativeness" Important;
*
App.
Detailed Model Architecture;
App.
Detailed Dataset Information;
App.
Cooperating with HiDDeN;
App.
Further Discussion on T;
App.
Additional Visualization Examples;
App.
Use of L.LMs;
App.
Time Comparison;
App.
D
Computational Complexity
App.
More Ablation Studies;
App.
Robustness Against Adversarial Attacks and 3D Editing;
App.
Experimental Results on Complex and Dynamic Scenes;
App.
Why Can Gaussian Primitives be Used for Watermark Embedding?
In addition, we provide the Demo.mp4 in the supplementary materials and simultaneously up- load source code to the anonymous repository: https://annoymoo// wwwp:e...pn.....e..ee....
NGS-Markez/
Ethics Statement This research uses only publicly available datasets that contain no personally identifiable or sensitive information. No human or animal subjects are involved. All experiments are conducted in accordance with institutional and conference ethical guidelines.
Reproducibility Statement We provide detailed descriptions of the model architecture and hyperpa- rameter settings in Section 5.1 and App- C All datasets used are publicly available. Our code will be released to facilitate reproducibility.
B WHY IS "NATIVENESS" IMPORTANT
In this work, we propose copyright protection method tailored for native 3D Gaussian Splatting (3DGS) data. Here, we elaborate on the significance of nativeness in our approach:
(1) Enhanced robustness: Watermarks embedded directly into native 3D data exhibit strong resilience against transformations such as viewpoint changes and resolution variations during detection.
(2) Tight coupling: The watermark is embedded within the core data representation (the parameters of Gaussian primitives), making it difficult to remove or tamper with.
(3) Facilitated detection: Even without rendering, watermarks can be detected from suspect 3DGS models that are potentially infringing, simplifying copyright verification.
C DETAILED MODEL. ARCHITECTURE
the main text, we introduced the overall architecture of the watermark injector and message extractor. Here, we present detailed description of their internal structures. As illustrated in Figure 3 we annotate each module with comprehensive specifications, including input and output details. The numbers enclosed in red parentheses indicate the corresponding dimensional information.
In Section 4.1
15

---

Published as a conference paper at ICLR 2026
(k, 59)
Message
FPS KNN
(128, 7552)
CLIIP
LaverNorm
Self-Att.
2,51) 512)
LaverNorm
A.
(128, 512)
Amss-Att.
Point Transforaoommr 1
x6
LayerNorn
(1288
FFN
Perturbation Feature
(128,
fa
Generator P
(k,59)
LaverNorm
R
Cross-Att.
fa
Point Transformer2
x6
LayerNorm
(k. 64)
Cross-Att.
MLP
LaverNorm
(k,59)
(k, 59)
Si
Perturbation Decoder Pa
(8,59)
FPS KNN
LaverNorm Aulf
(128,7552)
LaverNorm
MI.P
Self-Att.
(128, 2048) g.k.v
LaverNorm
Point 3ransfomer3
x6
FEN
(128, 512)
MI.P
(
M
Message Extractor
Figure 8: Schematic diagram the detailed structure of each module in NGS-Marker.
D DETAILED DATASET INFORMATION
The training and testing datasets used in study are sourced from four main origins: Glender|Midder hall et al. (202T). LLFF Mildenhall et al. (2019). Mip-NeRF 360 Barron et al. (2022). and several commonly used scenes from the 3D editing domain Haque al. (003). The specific scenes include:
16

---

Published as a conference paper at ICLR 2026
Table 6: Experimental results for the clean collaboration baseline.
Type
PSNR/SSIM
LPIPS 4
3D-Ace
Bit-Ace f
Indirect
34.63 0.981
0.034
99.02'
Native
40.17 0.995
0.007
97.90
98.35
98.27'
Hybrid
38.16/ 0.986
0.020
97.20
97.338
drums, ficus, hotdog, lego, materials, mic, ship, bicycle, bonsai, counter, flowers, kitchen, room, stump, treehill, fern, fortress, horns, llff_flower, 1lff room, orchi ds, trex, train, truck, chair, garden, bear, and person-sma 1. Among these, cha garden, bear, and person-smal are designated as testset, while the remaining scenes are used for training.
During testing, we simulate partial infringement different scales using the testset. For the chair scene, the entire scene is treated as a plagiarized segment and embedded into other scenes, In the garden scene, the vase and table are extracted and used as plagiarized content. For the bear r and person-sma 11 scenes, the main foreground objects (the bear and the person, respectively) segmented and considered as the plagiarized portions.
The calculation details of Bit-Acc in Table D and Table are as follows: for each bascline, render the views of the mixed scene A, extract watermark information from these rendered images, and compare it with the ground truth. For NGS-Marker, some primitives are selected from the pirated region to serve as the anchors. These anchors and their k-nearest neighbors are then fed into the message extractor predict the embedded watermark, and the accuracy is subsequently computed. In real-world applications, the protected regions are typically unknown, and users can identify potentially plagiarized areas directly using the method described Section 4.33 determine which primitives may have been misused through the 3D-Acc metric. The over 95% 3D-Acc reported Table demonstrates the practical feasibility our method. In total, we design nine mixed scenes to evaluate, which are illustrated in Figure Figure 4 Figure T0 Figure 11 Figure 12
Figure 13
and Figure [4
E COOPERATING WITH HIDDEN
In Table we present the results of NGS-Marker in collaboration with indirect protection methods. Here, we additionally introduce a clean bascline:
Aelean cooperate
L. 0.1 BCE(H(((("",))) M*
where H denotes the pretrained HiDDeN watermark decoder. Following standard protocol, 1/8 of the camera views are used for testing, while the remainder serve training data. The experimental results are shown in Table
F FURTHER DISCUSSION ON T
The value of r has an impact on 3D-Acc, and we provide additional ablation results in Figure 9 As can be observed, NGS- Mar-er exhibits certain degree of robustness with respect to variations in T. For the sake of comparability, we set to 75%, which lies between random guessing (50%) and perfect accuracy (100%) in our experiments.
G ADDITIONAL VISUALIZATION EXAMPLES
In Figure of the main text, presented several representative cases of our simulated partial infringement scenarios. Here, we provide additional examples for reference, as illustrated in Figure IT Figure [1 Figure 12 Figure 13 and Figure] 14
17

---

Published as a conference paper at ICLR 2026
90
3D-Ace (%)
80
70
60
50
60
70
90
100
The value of (%)
Figure 9: Ablation study of
Table 7: Comparison of the time required to embed watermarks by different methods.
Time (min)
person
chair
bear
garden
Avg.
3D-GSW
12.8
9.5
21.4
27.7
17.9
GaussianMarker
4.2
4.3
12.7
16.5
9,4
GuardSplat
5.5
4.9
15.2
19.5
11.3
NGS-Marker
9.3
28.7
35.2
19.3
NGS-Marken NGSS-Markrr-Paralee
2.7
4.6
12.5
13.9
8.4
Furthermore, also evaluate the performance when objects removed rotated in the scenes, as illustrated in Figure [3 and Figure 16
Moreover, further investigate the detection results when watermarked primitives and non- watermarked primitives overlap. We place the watermarked bear into the bicycle scene and gradually increase the overlap between the bear and the ground; the visualization results shown in Figure 17 As can be seen, our method consistently captures all visually perceivable plagiarized regions. For regions that not visible in the rendered image, plagiarism becomes meaningless, and we therefore do not pursue further analysis.
H USE OF LLMS
In our manuscript, we employed the LLM to perform grammatical checks on the written content.
TIME COMPARISON
We further report a comparison between our method and existing approaches in terms of the time required to embed watermarks native watermarking scheme that operates directly on Gaussian primitives, our method can partition large scenes into subregions during watermark embedding, thereby enabling efficient parallel pro- cessing. By contrast, existing 3DGS watermarking approaches decode the watermark from rendered images, where the sets of primitives influencing different rendered views may overlap, making parallel computation difficult. In Table 7 embedding when using four GPUs in parallel. Specifically, we uniformly divide each 3D scene into four parts along the x-y plane, embed the watermark into each part in parallel on four GPUs, and then recombine the four parts followed by a second-stage optimization of the merged scene. As can be observed, the watermark embedding time of all methods generally increases with complexity, whereas our method, when coupled with the parallelization strategy, achieves the lowest average time cost.
different scenes, summarized in Table 7 Benefiting from
NGS-Marker-PPardn
denotes the time cost of watermark
18

---

Published as a conference paper at ICLR 2026
Table 8: Comparison of the time required extract watermarks by different methods.
Time (ms)
person
chair
bear
garden
Avg.
3D-GSW
16.2
17.2
18.7
19.1
17.8
Markei
15.0
16.1
17.5
18.0
16.7
GuardSplat
17.2
18.3
19.7
20.2
18.9
Mar-Mrr
20.7
20.7
20.9
21.0
20.8
Table 9: Comparison of the computational complexity.
Method
Params(M)
FLOPs (G)
3D-GSW
0.29
14.48
GaussianMarker
0.29
14.48
GuardSplat
151.48
4.37
NGG-Marker
51.28
6.61
In addition, we evaluate the time required for a single watermark detection. For existing 3DGS watermarking strategies, watermark detection involves rendering images followed by information extraction, whereas for our approach, detection consists of extracting a subset of Gaussian primitives and then performing information extraction. We measure the time cost of single detection pass for different methods on a single A100 GPU, as reported in Table The results show that the time required by our method for single watermark extraction is comparable to that of existing methods, while the additional time incurred by our method grows more slowly as scene complexity increases.
COMPUTATIONAL COMPLEXITY
Although we adopt a Point Transformer, the computational cost of watermark embedding and extraction does increase sharply, mainly for reasons: (1) method does require feeding the entire scene into the Point Transformer; instead, we only process a fixed number of primitives at time; (2) before feeding the Gaussian primitives into the Point Transformer, we use FPS and KNN to convert them into small number of tokens, which significantly reduces the attention cost inside the transformer.
To more intuitively compare the computational complexity of our method with existing approaches, we measured both the number of parameters and the computational cost for a single forward pass. For other methods that extract watermarks from images, we fixed the input image size to 224 224. For our method, we fixed the number of Gaussian primitives to 8192. We used the open-source tools thop and fvcore measure the parameter count and computation, respectively, and the results are summarized in table 9 As can be seen, CNN- methods (3D-GSW, GaussianMarkerr have relatively few parameters but higher computational cost, whereas transformer-basee methods (GuardSplat, NGS-Marker) have more parameters but a lower computational cost. Compared with these existing methods, the computational complexity of our approach does not increase significantly.
K MORE ABLATION STUDIES
K.1 THE EFFECT OF 8 ON ROBUSTNESS
Here, investigate the impact of 8 watermark robustness. We vary the value of and measure the Bit-Acc of watermarked scenes under different types of perturbations, as reported Table I0 Overall, observe that decreasing leads slight reduction in robustness, but the effect remains limited as long as stays within a reasonable range.
When scene is perturbed, 8 also affects the number of corrupted primitives that passed to the information extractor, A smaller makes the detection system appear more fragile; however, also reduces the amount of perturbation each detection is exposed to. Consequently, for scenes subjected
19

---

Published as a conference paper at ICLR 2026
Table 10: Ablation study on the effect robustness.
Gaussian Noise
Rotation
Scaling (#00)
Densification (0%-50%)
Dropout (0%-50%)
Translation
None
(a=0.015)
(#:))
(#o0)
2048
95.62
93.89
95.62
95.62
94.14
93.78
95.62
4096
96.77
95.19
96.77
96.77
95.83
94,94
96.77
6144
96,83
95.30
96.83
96,83
96.22
95,36
96,83
8192
98.35
97.06
98.35
98.35
97.93
97.41
98.35
12288
98.17
97.02
98.17
98.17
97.82
97.26
98.17
Table 11: The influence of using different attributes on performance.
Attributes
Bit-Ace
PSNR
SSIM f
LPIPS +
Position+SUI(()
81.45
31.39
0.968
0,035
position+SSH(3)
92.66
38.50
0.991
0.017
position-SS())oqaccct
96.23
39.74
0.994
0.010
All
98.35
40.17
0.995
0.007
to the same level of perturbation, the robustness of the watermark does not differ substantially across different values of ö.
K.2 THE INFLUENCE OF USING DIFFERENT ATTRIBUTES ON PERFORMANCE
In our watermark embedding and extraction pipeline, we utilize all available attributes of the Gaussian primitives. To investigate how different attribute subsets affect performance, we conducted ablation studies, as shown in table IT] where SH (0) denotes O-order SH coefficients and SH (3) denotes all SH coefficients. We observe that, in general, the lower the total dimensionality of the used attributes, the harder it becomes to strike good balance between watermark accuracy and rendering quality. This empirically supports our design choice of using all available Gaussian attributes for robust and imperceptible watermarking.
L ROBUSTNESS AGAINST ADVERSARIAL ATTACKS AND 3D EDITING
To more comprehensively investigate the properties of NGS-Marker, examine its robustness in the presence of adversarial attacks and 3D editing operations.
L.1 ADVERSARIAL ATTACK
Since existing 3DGS watermarking works do consider adversarial attacks, we designed a dedicated adversarial attack pipeline tailored to 3DGS watermarking methods. Following Kerckhoffs' principle and the C&W (Carlini & Wagner) attack Carlini & Wagner (017)) assume that the attacker knows all details of the watermarking algorithm but does not know the hyperparameters used during watermark embedding (c.g., 'bit len' and 8), and that the message extractor remains private. In the attack process, the attacker first trains a message extractor, then sets the target message to 0.5, and finally uses gradient descent to optimize the attacked scene so that the decoded message approaches the target message:
Cattack = BCE(M Mungee + MSE( R(G"))
where, Mallick denotes the watermark message extracted from the attacked scene by the attacker's extractor, and Murget is a target message sequence whose entries are all 0.5. During the attack process, for the baseline method, the attack gradients are propagated through the rendered images to the Gaussian primitives, resulting in an indirect attack; in contrast, in method, the attack gradients are propagated directly to the Gaussian primitives, enabling a direct attack. For the HiDDeN extractor used in GaussianMarrker and 3D-GSW, from COCO; for GuardSplat, we retrain the extractor using the algorithms their public codebase. For fair comparison, fix the number of attack iterations 300 for all methods. We conduct
train the extractor on 10,000 images sampled
20

---

Published as a conference paper at ICLR 2026
Table 12: Robustness against adversarial attacks.
Attacker
8 hits 6:8192
16 bits 6:4096
16 bits 6:8192
24 hits 6:8192
Avg.
3D-GSW
57.29
58.55
58.55
67.19
60.40
Marker
57.74
57.39
57.39
63.30
59.00
GuardSplat
62.03
65.42
65.42
72.51
66.35
93.50
79.22
65.83
92.16
82.68
Table 13: Robustness against 3D editing.
Bit-Acc
"Turn the bear into grizzly bear"
"Turn him into clown"
3D-GSW
72.40
74.39
GaussianMarker
70.26
69.42
GuardSplat
78.55
77.18
NGS- Marker
91.06
90.53
attacks on the bear scene embedded with a 16-bit message (6=8192), and the experimental results of Bit-Acc are shown in table 12
We observe that MGS-Marker and the baseline methods exhibit clearly different behaviors under adversarial attacks. When the attacker does not correctly guess the hyperparameters we use during watermark embedding, our method is able to effectively withstand the attack; only when the hy- perparameters are exactly matched does the watermark accuracy of our method drop significantly. In contrast, for existing 3DGS watermarking methods that rely rendered images for indirect protection, different hyperparameter choices already cause severe degradation of the embedded watermark.
L.2 3D EDITING
We utilize GaussianEditor Chen et al. (2024b) to edit the watermarked scenes and then detect the watermark information in the edited scenes. Specifically, we select two scenes, bea r and person, and apply the editing prompts "Turn the bear into grizzly bear" and "Turn him into clown," respectively. The Bit-Acc results are reported in Table [3] As can be seen, our method is affected the least even under 3D edits that significantly alter object appearance, whereas the accuracy of existing indirect watermarking approaches drops substantially.
M EXPERIMENTAL RESULTS ON COMPLEX AND DYNAMIC SCENES
In this section, we further present the experimental results of JGG-Marker on the complex scenarios in the T&T dataset Knapitsch et al. (2017) and the dynamic scenes in the D-NeRF dataset Pumarola et al. (0211.
M.1 COMPLEX SCENES
The results of our experiments on four complex scenarios (train, truck, drjohnson, playroom) are presented in T4ble from which we observe that the accuracy of our method in these scenarios is comparable to that of the original evaluation.
M.2 DYNAMIC SCENES
To represent dynamic scenes, we adopt the classical 4DGS method Wu et al. (002b)). 4DGS, the primitives any time step are not explicitly stored but predicted by the deform_netwon Therefore, during watermark embedding we also optimize the weights of the deform network, with the objective that any local region of the decoded 3D scene any time step should contain the
21

---

Published as a conference paper at ICLR 2026
Table 14: Experimental results on complex scenes.
8 bits
16 bits
24 bits
Scene
Bit-Ace
PSNR f
Bit-Acc
PSNR t
Bit-Acc
PSNR 1
Train
98.75
41.07
97.83
40.12
94.50
39.05
Truck
99.03
41.00
97.84
39.61
94.73
39.20
Dr jronnson
98.06
39.48
96.46
39.13
93.22
38.43
Playroom
98.32
40.19
97.59
39.38
93.65
38.71
Original Test Results
99.26
41.77
98.35
40.17
94.79
39.61
Table 15: Experimental results on dynamic scenes. The numbers parentheses denote the results on
static scenes under the corresponding settings.
Bit-Acc
PSNR t
SSIM t
LPIPS 4
bits
98.71 (99.26)
41.50 (41.77)
0.996 (0.996)
0.004 (0.004)
16 bits
98.24 (98.35)
40.29 (40.17)
0.995 (0.995)
0.008 (0.007)
24 bits
95.22 (94.79)
39.48 (39.61)
0.993 (0.993)
0.013 (0.013)
complete watermark information:
Ldynamic = " (SSample(D(G", ,0))) + MSE(R(D(G".O)) R(D(G)
(10)
where, denotes the message extractor, Sample denotes the local Gaussian primitive sampling operation, D denotes the eeform_network, and t is the time step in the dynamic scene. We conduct experiments on the D-NeRF dataset, and the results are shown table [5] (for ease comparison, we also list in parentheses the corresponding results in static scenes). As can be seen, our method can be almost seamlessly extended to dynamic scenes.
N WHY CAN GAUSSIAN PRIMITIVES BE USED FOR WATERMARK EMBEDDING
In Sec. 3 we use simple experiment to demonstrate the feasibility of employing neural networks to embed invisible watermarks into unstructured noise. Here, we provide more theoretical explanation of why neural networks are capable of injecting imperceptible watermark information into Gaussian primitives.
(1) High-dimensional explicit parameters & parameterriiiiinnn Each Gaussian G; (Hi, 0gg, S;, C;, r.) has multiple continuous degrees of freedom (position, scale, opacity, SH coef- ficients, rotation, etc.), so local set of Gaussian primitives forms an extremely high-dimensional explicit vector, while during rendering only affects limited number of pixels. Under a differ- entiable renderer R, in the first-order approximation R(g + Ag) = R(G) JAG, the number of pixels is much smaller than the parameter dimensionality, so the Jacobian J has large "approximate null space." Thus, there exist many directions of AG that leave the rendered image almost unchanged while significantly changing the Gaussian parameters, which precisely the capacity for embedding imperceptible watermarks. The MSE term in the loss encourages AG to lie in these low-sensitivity directions.
(2) Spatial structure & lcarnability. Unlike pure noise, 3D Gaussians are concentrated near object surfaces, and quantities such as centers, scales, and coefficients vary smoothly and are correlated within local neighborhoods. This spatial structure allows networks such PoinTTranfformer to exploit these regularities and learn an invertible embedding/ddcoodin mapping.
22

---

Published as a conference paper at ICLR 2026
Figure 10: Additional visualization examples.
Figure 11: Additional visualization examples.
Figure 12: Additional visualization examples.
23

---

Published as a conference paper at ICLR 2026
Figure 13: Additional visualization examples.
EII
LETREY
Figure 14: Additional visualization examples.
24

---

Published as a conference paper at ICLR 2026
Original Scene
Deletion
Bit-Ace before and after deletion: NGS-Marker: 98.35
GuardSplat: 79.77
Figure 15: Deletion experiment.
Original Scene
Rotation
Bit-Ace hefore and after rotation: NGS-Marker: 98.35 98.30
GuardSplat: 99.51->80.67
Figure 16: Rotation experiment.
25

---

Published as a conference paper at ICLR 2026
Samplel
Sample2
Sample3
Sample4
Figure 17: Visualization results of overlapping Gaussian primitives with and without watermarking.
26


Reviews:
[{"review_id": "UJOFfmXvv6", "reviewer": "Reviewer_ERh9", "summary": "This paper introduces NGS-Marker, a novel native watermarking framework designed to protect 3D Gaussian Splatting assets against partial infringement. The authors identify a critical limitation in existing indirect watermarking methods, which fail when the rendering distribution changes significantly. NGS-Marker addresses this by embedding watermarks directly into the Gaussian primitives using a jointly trained injector-extractor pair and a progressive gradient-based optimization strategy. The method supports hybrid protection and multimodal watermarking, and demonstrates robustness to common distortions.", "questions": "1. How does this method perform in areas with significant overlap, such as when the embedded Gaussians and the watermarked Gaussians interweave with each other?\n\n2. Could the choice of $\\delta$ influence the noise robustness of the proposed method? Especially for densification and dropout.", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The paper clearly identifies and formalizes the partial infringement problem in 3DGS, which is both practical and underexplored. This is a meaningful contribution to the field of 3D asset protection.\n\n2. The proposed framework enable native local watermarking for 3DGS. The use of a perturbation-based injector and extractor, combined with progressive optimization, is well-motivated and technically sound.", "weaknesses": "1. Although the method supports large scenes, the embedding time grows with the number of primitives. Is it possible to add a comparison of watermark embedding time and extracting time with previous methods in the experiment?\n\n\n2. Lack of discussion and comparison on computational complexity. Since the proposed method utilizes Point Transformer as the injector, adding experimental results on this aspect would better reflect the model's characteristics.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "N7yAmDfbQg", "reviewer": "Reviewer_FtXd", "summary": "NGS-Marker proposes a native 3DGS watermark that is embedded and decoded directly from local Gaussian neighborhoods via a progressive optimization pass. The method targets partial infringement (copying only subsets of Gaussians) and reports strong per-Gaussian detection and rendering fidelity, plus optional hybrid protection with indirect, image-domain marks and a proof-of-concept for personalized watermarks.", "questions": "1. Verification cost: What is end-to-end verification latency (per million Gaussians), including neighborhood sampling and similarity computation? Any heuristics to prune the search while maintaining recall? \n\n2. Breadth of validation: Could you add evaluations on larger, diverse benchmarks (e.g., Tanks & Temples) and any dynamic/4DGS content to assess generalization?", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. Composable design. The proposed hybrid objective indicates native marks don’t conflict with rendering-domain watermarks, and the image-message experiment shows the architecture can accommodate non-binary payloads with small changes to encoders/decoders. This extends the method’s use beyond simple IDs. \n\n2. Minimal visual impact with qualitative and quantitative evidence. Difference maps show small, spatially diffuse changes, and PSNR/SSIM/LPIPS metrics remain strong after embedding; this is the right mix of perceptual and pixel-wise indicators for vision papers. The visual comparisons make the progressive optimization design choice more convincing. \n\n3. Clear pipeline and rationale. The progression from local injection to progressive, scene-level embedding is well-motivated: naive block-wise injection yields boundary artifacts, whereas repeated random injection accumulates distortion; the final procedure addresses both issues. This kind of explicit failure-mode discussion is useful for re-implementation.", "weaknesses": "1. White-box resilience not evaluated. The attack suite focuses on stochastic distortions rather than adversarial removal with knowledge of the extractor. With the absence of such results, the robustness to an adaptive attacker remains an open question. \n\n2. Scaling cost and production fit. Embedding time rises from 4 minutes (42k primitives) to 35 minutes (589k), which is acceptable for small scenes but may be significant for game/film assets with millions of Gaussians; the paper notes scalability opportunities but does not provide an algorithmic path or empirical stress test beyond the four test scenes.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "NXjycdshwj", "reviewer": "Reviewer_NYv5", "summary": "To address Partial Infringement of 3D Gaussian Splatting (3DGS), where an adversary extracts and reuses only a subset of Gaussians, this paper presents NGS-Marker, a native watermarking framework for 3DGS by integrating a jointly trained watermark injector and message decoder and adopting a gradient-based progressive injection strategy, to achieve robust ownership decoding from any local region. The NGS-Marker is further extended with hybrid protection (combining native and indirect watermarks) while personalized watermarking is supported to embed image watermark. The experimental results show that NGS-Marker effectively defends against partial infringement while offering practical flexibility for real-world deployment.", "questions": "1. What mostly make the proposed watermarking framework NGS-Maker different from the existing methods?\n\n2. What are the concrete concepts/definitions of “indirect watermarking” and “native watermarking”?\n\n3. What are the methods in the literature most similar to the proposed one?", "limitations": "", "rating": 2, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 1, "strengths": "A new watermarking framework named NGS-Maker is proposed for 3D Gaussian Splatting (3DGS) by integrating a jointly trained watermark injector and message decoder and adopting a gradient-based progressive injection strategy, to achieve robust ownership decoding from any local region. Hybrid protection (combining native and indirect watermarks) and personalized watermarking are both supported. The experimental results show the efficacy of NGS-Marker.", "weaknesses": "First, the concepts of indirect watermarking and native watermarking have not been clearly explained or referred, making it difficult to compare the proposed watermarking framework named NGS-Maker with the related methods. \n\nSimilarly, the definition of Partial Infringement also needs to be referred and compared with terms used in the literature. \n\nThird, the performance comparison between the proposed method with three baselines is not enough and the performance analysis in robustness is very limited.\n\nLast, injecting image-based watermarks into 3D scenes using NGS-Marker is okay but not very personalized.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "vYpITHxGKI", "reviewer": "Reviewer_5NBU", "summary": "This paper proposes NGS-Marker, a native watermarking framework for 3D Gaussian Splatting (3DGS) that addresses the problem of partial infringement. Unlike existing indirect methods that watermark rendered images, NGS-Marker embeds watermarks directly into 3D Gaussian primitives, enabling detection even when only subsets of primitives are extracted and reused. The method uses a jointly trained watermark injector and message extractor with a progressive optimization strategy.", "questions": "## Questions\n\n1. What is the false positive rate? How often does the method incorrectly identify non-watermarked primitives as watermarked?\n\n2. How does the method achieve indirect message encoding and decoding? \n\nDo you optimize the injected with the pretrained frozen message decoder just like the approaches in [1][2]?\n\nHow different is the optimization process for the indirect, native, and hybrid optimization?\n\nDo you first optimize for native and then for indirection protection? Or do you optimize them simultaneously?\n\nI think the explanation for this port should be clearer.\n\n3. The paper focuses on static 3DGS, but many applications involve dynamic content. \n\nCan the proposed method be extended to dynamic scenes?\n\n4.  Only 4 test scenes are quite limited for drawing strong conclusions. \n     Are the injector and extractor pretrained on the 24 training scenes and then only validated on the 4 test scenes?\n    How are the validation results on the training datasets?\n     Beyond the 4 test scenes, how does the method perform on more complex, diverse scenes such as Tanks and Temples Benchmark?\n\n[1] WateRF: Robust Watermarks in Radiance Fields for Protection of Copyrights\n\n[2] 3D-GSW: 3D Gaussian Splatting for Robust Watermarking", "limitations": "", "rating": 6, "confidence": 5, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "## Strengths\n\n1. The paper identifies a critical and underexplored vulnerability in 3DGS assets - partial infringement, where adversaries extract and reuse subsets of Gaussian primitives. The motivation is clearly articulated with concrete examples.\n\n2. The method achieves native watermarking embedding and extraction.\n\n3. The hybrid protection mechanism and personalized watermarking demonstrate practical flexibility.", "weaknesses": "## Weaknesses\n\n1. While the feasibility analysis (Section 3, Figure 2) shows that HiDDeN can embed watermarks in random noise, the theoretical connection to why this should work for structured 3D Gaussian primitives is weak. The paper lacks analysis of what properties of Gaussian primitives make them suitable for watermark embedding.\n\n2. Table 4 shows embedding time increases significantly with scene complexity (4 min for 42K primitives to 35 min for 589K primitives)\n   The authors acknowledge in limitations that \"designing an efficient partitioning and traversal strategy could further improve scalability\" but don't provide solutions.\n   How does the method scale to production-level scenes with millions of primitives?\n\n3. No analysis of adversarial attacks specifically designed to remove native watermarks\n   What if an adversary fine-tunes or re-optimizes the Gaussian primitives?\n   The robustness experiments (Table 3) only test standard distortions, not adversarial removal attempts.\n\n4. Although the method achieves native embedding, the method is built on top of the PointTransformer. What parameters are used in the injection and extraction? Are all parameters used for injection and extraction? There should be an ablation study for different parameters that are selected for injection and decoding.\nFor example, if we can only use the color and position attributes, can we extend the method to become compatible with point cloud data?\n\n5.  The partial infringement simulation may not fully capture real-world misuse scenarios. More challenging infringements should be discussed such as 3D adversarial attacks, Semantic editing[1] or recoloring[2]\n\n[1] GaussianEditor: Swift and Controllable 3D Editing with Gaussian Splatting\n\n[2] GeometrySticker: GeometrySticker: Enabling Ownership Claim of Recolorized Neural Radiance Fields", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)