CompMarkGS: Robust Watermarking for Compressed 3D Gaussian Splatting
Authors: Sumin In
Youngdong Jang
Utae Jeong
MinHyuk Jang
Hyeongcheol Park
Eunbyung Park
Sangpil Kim
Venue: ICLR 2026 Poster (2026)
Keywords: 3D Gaussian Splatting
Digital Watermarking
Privacy
Primary area: alignment, fairness, safety, privacy, and societal considerations
TL;DR: Robust Watermarking for Compressed 3D Gaussian Splatting

Abstract: As 3D Gaussian Splatting (3DGS) is increasingly adopted in various academic and commercial applications due to its high-quality and real-time rendering capabilities, the need for copyright protection is growing. At the same time, its large model size requires efficient compression for storage and transmission. However, compression techniques, especially quantization-based methods, degrade the integrity of existing 3DGS watermarking methods, thus creating the need for a novel methodology that is robust against compression. To ensure reliable watermark detection under compression, we propose a compression-tolerant 3DGS watermarking method that preserves watermark integrity and rendering quality. Our approach utilizes an anchor-based 3DGS, embedding the watermark into anchor attributes, particularly the anchor feature, to enhance security and rendering quality. We also propose a quantization distortion layer that injects quantization noise during training, preserving the watermark after quantization-based compression. Moreover, we employ a frequency-aware anchor growing strategy that enhances rendering quality by effectively identifying Gaussians in high-frequency regions, and an HSV loss to mitigate color artifacts for further rendering quality improvement. Extensive experiments demonstrate that our proposed method preserves the watermark even under compression and maintains high rendering quality.

Published as a conference paper at ICLR 2026
COMPMARKGS: ROBUST WATERMARKING FOR COM- PRESSED 3D GAUSSIAN SPLATTING
Sumin In', Youngdong Jang', Utae Jeong', MinHyuk Jang', Hyeongchhol Park',
Eunbyung Park², Sangpil Kim 1+
'Department of Artificial Intelligence, Korea University, Republic of Korea
*Department of Artificial Intelligence, Yonsei University, Republic of Korea
ABSTRACT
As 3D Gaussian Splatting (3DGS) is increasingly adopted in various academic and commercial applications due to its high-quality and real-time rendering capa- bilities, the need for copyright protection growing. At the same time, its large model size requires efficient compression for storage and transmission. However, compression techniques, especially crantization-basee methods, degrade the in- tegrity of existing 3DGS watermarking methods, thus creating the need for novel methodology that is robust against compression. To ensure reliable watermark detection under compression, we propose a compression-tolerant 3DGS water- marking method that preserves watermark integrity and rendering quality. Our approach utilizes an anchor-based 3DGS, embedding the watermark into anchor attributes, particularly the anchor feature, to enhance security and rendering qual- ity. We also propose quantization distortion layer that injects quantization noise during training, preserving the watermark after quantization based compression. Moreover, employ frequency-awand anchor growing strategy that enhances rendering quality by effectively identifying Gaussians in high-frequency regions, and an HSV loss to mitigate color artifacts for further rendering quality improve- ment. Extensive experiments demonstrate that our proposed method preserves the watermark even under compression and maintains high rendering quality.
INTRODUCTION
3D Gaussian Splatting (3DGS) (Kerbl et al. 2023) has recently emerged as an impactful method for novel view synthesis, offering real-time and photorealistic rendering capabilities. Since its in- troduction, 3DGS has undergone rapid advancements in the field of image-based 3D reconstruc- tion (Charatan et al. 2024 Lin et al. 2024 Zhang et al. 2024), attracting significant attention from academia and industry. One drawback of 3DGS is that it is composed of a vast number of 3D Gaus- sians, requiring substantial storage space. This limitation has motivated the development of 3DGS compression techniques to reduce storage requirements and facilitate efficient transmission of 3DGS models. In parallel, its growing commercial adoption in areas such as digital twin construction and AR/VR applications has raised critical concerns regarding the copyright protection of trained 3DGS models. These concerns have led to increased research interest in 3DGS watermarking. However, to the best of our knowledge, no prior work has specifically addressed the challenge of creating 3DGS watermark that can withstand model compression, scenario illustrated in Fig. [
Existing 3DGS watermarking methods (Chen et al. 2024b Guo et al. 2024 Huang et al. 2025 Jang et al. 2025 Tan et al. 2024) embed watermarks by directly modifying Gaussian attributes, which makes the watermark vulnerable to loss when those attributes are altered during compression. In particular, quantization- based compression shifts the distribution of model parameters during the compression process, severely degrading watermark performance. As result, existing methods fail to provide adequate copyright protection for compressed 3DGS models.
To handle this problem, we propose CompMarkGS, an based 3DGS watermarking method. Our method leverages the anchor- based 3DGS architecture, which dynamically predicts Gaussian attributes from anchor points via multiple implicit multi-layer perceptrons (MLPs). This implicit
"Corresponding author.

---

Published as a conference paper at ICLR 2026
Training SDGS Embedding Watermark
Malicious Use & Identification
Image Destrtion
Intial Points
Watermar ked 3DGS
Compressed 3DGS
Training
Compression
Watemark Decoder
Depio
1011011...
Cosa
Succassful
Identification
Application scenario of CompMarkGS. Owners embed the watermark into 3DGS asset using our proposed method, then compress and distribute the model across various digital environ- ments. Owners can extract the hidden message to verify ownership even if an unauthorized user alters the distributed model or its rendered images.
Figure I:
representation makes it extremely difficult for malicious user to detect the presence of a water- mark by directly analyzing the point cloud Gaussian attributes. We seamlessly integrate the watermark by embedding a learnable watermark feature into the anchor feature, which is one of the anchor attributes, while keeping the rendering backbone unchanged. Unlike prior work focusing on image-domain distortions, we tackle the novel challenge of watermark robustness against model quantization. We propose quantization distortion layer (QDL) that injects quantization noise into anchor attributes during training, teaching the watermark to be resilient. As a result, our model achieves both high rendering quality and robust watermark integrity after compression.
To further improve rendering quality, we introduce a frequency- anchor growing strategy. Specifically, we identify high-frequency regions in the rendered image, map them to Gaussian coor- dinates, and selectively apply anchor growing in those regions. In addition to this structural enhance- ment, we design an HSV loss to address color artifacts that occur when embedding the watermark. This loss function operates by constructing binary mask over regions with noticeable color arti- facts, identified by analyzing the hue (H), saturation (S), and value (V) components. This mask guides the loss computation by focusing these specific regions, improving the rendering quality.
Our extensive experiments on the Blender (Mildenhall et al., 202T), LLFF (Mildenhall et al. 2019). and Mip-NeRF 360 (Barron et al., 2022) datasets show that CompMarkGSS preserves watermark integrity and rendering quality more effectively both before and after compression. Each compo- nent of our method-anchor-baase 3DGS watermarking, the quantization distortion layer, and the frequency-ane
anchor growing stratey--independentt enhances watermark fidelity while pre- serving rendering quality, even under compression and various watermarking attacks. Furthermore, our method outperforms state-of-the-arg approaches across various watermark message lengths. Our main contributions are as follows:
We propose CompMarkGS, a compression-tolerant anchor-based watermarking method for 3DGS that embeds a learnable watermark embedding feature into the anchor feature, preserving the model structure while ensuring high rendering quality and bit accuracy.
We introduce quantization distortion layer that injects quantization noise during training, en- abling 3DGS watermarking remain robust against quantization- based compression while main- taining high rendering quality.
We propose a frequency- anchor growing strategy that selectively expands anchors in high- frequency regions, which enhances rendering quality, and an HSV loss that mitigates color arti- facts to further improve rendering quality.
2 RELATED WORKS
3D Gaussian Splatting representation. 3D Gaussian Splatting (3DGS) (Kerbl et al. 2023) an innovative 3D representation technique that models scenes using explicit primitives. It renders im- ages by projecting these primitives into arbitrary viewpoints and seamlessly blending pixel colors via a-blending, achieving high-quality results while substantially accelerating real-time rendering. Thanks to these advantages, 3DGS has been widely adopted in various research areas, including avatars (Abdal et al.
2024 Chen et al. 2025a: Qian al.] 2024 Yuan et al. 2024), dynamic Zhu et al. 2025), and 3D generation (Tang 2024). Recently, Scaffold-GS (Lu et al.
scenes (Li ct al. 2024
Wu et al. 2024
Yan et al. 2025
et al. 2023 Xie al.
2024bb Yi
2024 /hou
2

---

Published as a conference paper at ICLR 2026
2024 has advanced the 3DGS framework by introducing anchor points to construct hierarchical 3D representation. Anchor- methods (Lee et al., 2024b] Ren et al. 2024 Wang et al. 2024b) effectively minimize redundant Gaussians, enhancing rendering quality and increasing robustness against view changes. This representation approach is promising for 3DGS compression optimiza- tion, it reduces parameter counts while maintaining high-quality rendering.
3D Gaussian Splatting compression. To achieve high-quality rendering images, 3DGS generates considerable number of Gaussians, leading to significant storage overhead. To address the storage overhead, vector quantization methods (Fan al. 2025 Lee et al. 22024a] Navaneet et al. 2024 Xie) et al. 2024a) have been widely explored. These methods prune Gaussians with minimal impact on
rendering quality and use codebooks to encode the attributes of Gaussians compactly. More recently,
anchor-based representations have gained significant attention in 3DGS (Chen al. 2024a Lu ct al.
2024 Wang et al. 2024a). Compression methods (Chen et al. 20256 2024a Wang et al. 2022a Zhan et al. 2025) that leverage the structural relationships between anchors have shown superior performance. For example, HAC (Chen et al., 2024a) reduces spatial redundancies among anchors by utilizing hash grids for parameter quantization and enabling entropy modeling. ContextGS (Wang) et al. (0224)) introduces a unified compression framework with factorized prior, enabling entropy modeling of anchor features while leveraging hierarchical anchor relations to reduce redundancy among anchors. CAT-3DGS (Zhan et al. 2025) projects Gaussian primitives onto PCA- -Cl-aligned triplanes and applies spatial autoregressive coding to capture spatial correlations, thereby enhancing entropy coding efficiency. Given their compression efficiency, anchor-based representations are especially advantageous for real-world applications.
Steganography and digital watermarking. Information hiding research is primarily divided into two categories: digital watermarking and steganography, which differ in their core objectives. Steganography aims to conceal information in digital assets with invisibility as the primary met-
ric. Driven by advances in deep learning, various methods (Tancik et al. 2020 Biswal et al.) 2024) have been proposed to hide information in media such as images and videos, with recent work (Dong 2024| Li et al., 2023) extending into 3D scene representation. For example, GS-Hider (Zhang
ct al.
et al. 2025a) introduces the first steganography technique for 3D Gaussian Splatting (3DGS), and SecureGS (Zhang et al.] (2025b) proposes an anchor-based steganographic framework that hides in- formation using private MLP. In contrast, digital watermarking embeds ownership data to protect assets and prioritizes robustmess to distortions. Early watermarking research focused on the pixel domain (Van Schyndel et al. [994; Wolfgang & Delp 1996) or the frequency domain (Barni al, Navas et al. (2008). Subsequently, deep learning- based methodologics (Luo et al.] 2020 Zhu 2018) demonstrated superior robustness against variety of distortions. This research has
2001
et al.
cently expanded to protect radiance field models like NeRF (Mildenhall et al.]
al]] (202T). WateRF (Jang 2024) proposes plug-and-play method that uses the frequency domain for robust watermark-
al.
ing. With the advent of 3DGS, GaussianMarker (Huang et al.] 2025) embeds the watermark by estimating Gaussian uncertainties and integrating specific Gaussians. 3D-GSW (Jang et al., 2025 embeds the watermark by selectively removing Gaussians to minimize the impact on rendering qual- ity. GuardSplat (Chen al. 2024b) introduces an SH-aware embedding mechanism. However, these works only consider traditional distortions and do not account for real-world attacks such as model compression, In this paper, we propose a watermarking method that is robust to model compression.
PRELIMINARIES
Scaffold-GS. Scaffold-GS (Lu et 2024 clusters adjacent Gaussians using anchor points, re- ducing redundancy. Initial anchor points are placed at voxel centers, and the attributes for each an- chor consist of an anchor feature f E Rd, scaling factor E R and K learnable offsets O R Kx3 Visible anchor points within the viewing frustum generate K' Gaussians, with their positions com- puted as follows:
A = Ta + +0 L
where xa E R3 is the anchor point position, O E IR3 denotes the k-th offiet vector, Me is the gen- erated k-th Gaussian position, and @ represents the element-wise product. The Gaussian attributes opacity a; color c, quaternion di and scale 8; are predicted using separate MLPs:
{ai, C, qi 1 = MLP(f, &av, dav):
(2)
where 6.v =11 x. Fy l|2 and da - llz denote the relative distance and viewing direction between the camera (xr) and the anchor (x.,) positions.
3

---

Published as a conference paper at ICLR 2026
Anchor Attributes
Generate Gaussians
D+
MILPH
Sealing
Officts
Poetion
Aedior Canme
Opersiio fi
+
Mort Adficc
Trashellgne
011...0
Grudiant
1) Widemann Decader
Fiequerey-our Anchor
Inagaricy paasea
Irveere Tou T contottmm (EaFT)
Diaanto Foutter
Teans (DFT)
Nandered trage
High Pazz
Figure 2: Overview of CompMarkGS. First, learnable watermark embedding feature f' is added to the anchor feature f to create a watermarked anchor feature f". This feature is processed by the quantization distortion layer simulate quantization noise before being fed into MLPs to predict Gaussian attributes. For watermark extraction, a pre-trained decoder retrieves the message from the low-frequency band of the rendered image. For rendering quality, our frequency-aware anchor growing strategy selectively densifies anchors in high-frequency regions. The entire framework is optimized using the total loss Ciotals incorporating HSV loss Chee and frequency loss C Lireq.
METHOD
4.1 ANCHOR-BASRR 3DGS WATERMARKING
Anchor-based 3DGS (u et al. 2024 enhances the security of embedded watermarks by hiding explicit Gaussian attributes behind anchor features processed by implicit MLPs. This property of anchor-based 3DGS makes it more difficult for attackers to directly manipulate embedded water- marks and Gaussian attributes. Moreover, the anchor feature f influences the rendering quality indirectly through MLPs rather than directly controlling Gaussian attributes. On the other hand, attributes such position x, scaling factor I, and offsets O directly determine Gaussian attributes, and modifying them leads to visible distortions in the rendered images. To embed a watermark into the anchor feature while preserving rendering quality, we introduce learnable watermark embed- ding feature/ I' E Rd, with the same dimension as the anchor feature f E TRd.. This design aims achieve an optimal balance between rendering quality and watermark robustness. The resulting watermarked anchor feature f is defined as follows:
f + Lanh(J"), where S.
where the watermarked anchor feature f is generated by the element-wise sum of the anchor fea- ture f and a learnable watermark embedding feature f'. The term tanh(-) denotes the element-wise hyperbolic tangent function, which we apply to the watermark embedding feature f' to bound its values within the range [-1, 1] before addition. This bounding process is crucial for stabilizing gradients and preserving rendering quality. In a well-trained unchor-based 3DGS model, the com- ponents of the anchor attributes are known to follow a normal distribution (Lu et al. 2024). Adding an unbounded feature would increase the variance of this distribution, leading to unstable gradients, slower convergence, and degraded rendering quality. While sigmoid function could be used, its [0, output range would introduce directional bias by only adding positive values. The symmet- ric [- range of the tanh function prevents this bias, ensuring the watermark is added with a consistent magnitude. As result, our method achieves stable convergence and efficient embedding without degrading rendering quality. detailed analysis is provided in Appendix E.
4.2 ROBUSTNESS TO QUANTIZATION BASED COMPRESSION
In digital watermarking research, differentiable distortion layers have long been used to enhance robustness by simulating traditional distortions, such as JPEG and cropping, during training (Zhul ct al., 2018). However, this method has not been applied in existing 3DGS watermarking research to the problem of model compression, leading to significant watermark loss during quantization.
4

---

Published as a conference paper at ICLR 2026
To overcome this limitation, propose quantization distortion layer (QDL) that simulates quantization-induees distortions, encompassing losses in watermark robustness and rendering fi- delity. Our QDL leverages quantization techniques from prior anchor-based 3DGS compression methods (Chen et al. 2024a). While the original method uses this mechanism for model compres- sion, our work is the first to adapt it form of data augmentation to train robust watermark. During watermark training, the QDL simulates the quantization process by injecting noise into the watermarked anchor feature f By integrating the QDL into the embedding stage, the watermark is thus optimized to remain robust against subsequent compression attacks. The quantized water- marked anchor feature for the i-th anchor ft" is defined as follows:
= (
1)
q: - where q: = Qu - tanh(r:)). rs Tx=MiN (f.", (4)
2'2)
where 9: R denotes the quantization scale restricted to [0, 2Qo], and r, R the refinement output from an MLP,, that takes f as input to adjust the initial quantization scale Qo. By scaling a randomly generated d-dimensional noise vector from a uniform distribution over [- 2: 2 by qi and adding it to the watermarked anchor feature f", we simulate the rounding errors caused by quantization. This process forces the watermark to become resilient to the specific distortions it will encounter during a real compression attack.
4.3 FRFQUENCY-AWARE ANCHOR GROWING
We apply Discrete Wavelet Transform (DWT) to the rendered image and feed its low- low-frequency Low-Low (LL) subband, ILL into the pre-trained HiDDeN (Zhu et al.] 2018) decoder D to ex- tract the watermark message M' (TLL)). Therefore, we embed the watermark in the LL sub- band to ensure robustness, while optimizing the overall rendering quality via the reconstruction loss L fold- However, since fold is computed in the LL band as an error relative to the ground truth. This creates a trade-off between the wa- termark loss and the reconstruction loss. In other words, improving image quality tends weaken watermark robustness, while preserving the watermark can degrade rendering quality.
the entire image, it treats the watermark signal
Based on this insight, we propose a frequency- aware anchor growing (FAG) strategy. To selectively grow anchors in detail-rich, high-frequence regions, our method first transforms the rendered image I' and the ground truth image I into the frequency domain using the Discrete Fourier Transform (DFT), as shown in Fig. 2 We then apply high-pass filter to isolate the high-frequency components and reconstruct the corresponding high-frequency images k/y. and Ins using the Inverse Discrete Fourier Transform (IDFT). To generate a binary mask that selects pixels in these high- frequeryy regions, we construct an SSIM- based eтror map Perror. Let N (InJ. P) and N NN p) denote local 1 x k patches of In and F,o centered at pixel p. We define as follows:
(5) where SSIM(.,.) is standard window-based SSIM computed over patches. This SSIM-based er- map is used both in the frequency loss Lyreg and in FAG. After computing the median of all error values, denoted as P Perror, we create binary mask by selecting pixels within the range [Perror - Perror + e]. This mask is then used to extract the 2D coordinates of high-frequency regions. Subsequently, each 3D Gaussian is projected onto the 2D image plane, and its continuous coordinates are rounded to obtain integer pixel-level coordinates. By matching these 2D Gaus- sian coordinates with the high-frequency pixel coordinates, we generate a boolean mask Fmask that identifies anchors located in the high-frequency regions. Only the Gaussians selected by Fmask are activated for the anchor growing process. More implementation details are in Appendix C.4 C.5
Perror (p) = (N D), N (Tr,,))),
4.4 OBJECTIVE FUNCTION
Watermark message loss. As described in Sec 4.3 we use the pre-trained HiDDeN Zhu et al.) 2018) decoder to produce the watermark message M' and the watermark message loss Lmag is defined as a binary cross entropy (BCE) loss:
Lisg
Mlog(o(M)) + (1 M,)log(1- - (M)))) (M))
(6)
where M {0, 13 is the ground truth message, and sigmoid function constrains M' to [0. 1].
5

---

Published as a conference paper at ICLR 2026
Ground Trush
Ours
3D GSW
GaussianMarker
Wutere
GuardSpiat
Dh-Aco: D1-Acc-93..11 2TNR:
B1Acs: PSNI 022
DR-Acc: 93.11 (PNNR 20.45
BI-Ace: 56.42 17
DIAce: 7A /PSR: 13
AE 33-677 PONR 50131
BEAC do 2017
BA 59.55/ PONA, 28.19
Ar EENEE 2801
Ac (HS.R 1908
Figure 3: Qualitative comparison of rendering quality after compression between our method and baselines. For each method, the rendered image (left) and the difference map (right) are shown. Note that the difference maps are magnified five times. All results are based 48-bit messages.
HSV Loss. We incorporate the HSV loss Chsv term to minimize color artifacts during watermark embedding. Previous studies (Huang et al. 2025 Jang et al. 2024 2025) typically computed image loss the RGB space improve rendering quality. However, since the RGB space calculates loss based on independent pixel-level color information. it does not accurately reflect the human visual system. Therefore, we compute image loss in the HSV space, which represents colors in a manner more similar to the human visual system. First, we construct binary masks based on hue ranges for each color to localize color artifacts. Binary mask defined as follows:
[1, Ma(p) = 0, otherwise
Hue(p) E He
where He denotes the hue range corresponding to color C, with C. = (R, R. G. and B represent the red, green, and blue color channels, respectively. The HSV loss Lasv defined as the mean squared error (MSE) between the pixel values of rendered image (p) and ground truth Igr (p):
Lass
Σ MMM(p) (T(p) - I (p))
1
DEC PEN
where the [S2] is the total number of pixels, and only pixels with (p) = are penalized. The overall color loss defined as the average of the losses for each target color in the set C. More implementation details are in Appendix C.6
Total Loss. Additionally, we employ frequency loss firee to reduce high-frequency distortions during watermark embedding. The overall training loss for our method given by:
Liota! (Lmg(Sseaffoll fold + AnsuChan + Afreg freq) Amsg Emag:
(9)
Epep Perror (p) is the mean of all values in the SSIM-based error map. Lseaf represents the reconstruction loss defined in Seaffold-GS (Lu et al. 2024). which con- sists of one scale regularization and two rendering fidelity terms.
where Lireg 1
5 EXPERIMENTS
5.1 EXPERIMENTAL SETTING
Datasets.
Following previous works (Huang al. 2025 Jang al. 2025). we evaluate method using the Blender (Mildenhall et al.) (02T). LLFF Mildenhall et al, 2019), and Mip- NeRF 360 (Barron al. 2022) datasets, comprising total of 25 scenes. These include 8 synthetic bounded scenes from Blender, forward-facing real-world scenes from LLFF, and 9 bounded real- world scenes from Mip-NeRF 360. We evaluate performance using 200 test images from Blender. For the LLFF and Mip-NeRF 360 datasets, we adopt the same data split strategy as Mip-NeRF 360.
Implementation details. Our method trains end-to-end on single A6000 GPU. We conduct ex- periments for watermark bit-lengths of 32, 48, and 64, focusing on the 48-bit case, where we evaluate performance both before and after compression. For the decoder, use pre-trained HiDDeN (Zhu) et al. 2018) decoder for each bit-length and keep its parameters fixed during watermark training. We use the following parameters: Aing 10. Arse 0.6, Xfreg 0.1, Amag 0.45. For the quantization scale and anchor growing range in high-frequency regions, we set Qo = 1, 0.3.
More implementation details are in Appendix C.3

---

compression Published as a conference paper at ICLR 2026
Table 1: Quantitative comparison of before (left) and after (right) compression bit accuracy and rendering quality. Evaluations are performed using a 48-bit setting, averaged over the Blender, LLFF, and Mip-NeRF 360 datasets. Baselines are tested within an anchor-based 3DGS framework with HAC and ContexIGS compression. The best results are in bold.
Methods
Bit Accuracy(95)
PSNR 1
SSIM 1
Size(MB)
HAC + WatcRF
91.02/ 54.40 54,40
27.36/ 13.63
1850/0.455
0,174 0.574
207.72/ 13.66
HAC + GaussianMarker
92.00/ 58.34
27.05 / 13.54
0,840/ 0,,4000,400 0.460
0.193 0
341.30 24.33
IACC+ + 3D-GSW
90.96/ / 53.48
19.57 13.13
0.628 / 0.439
0,295 0.572
173.64 12.93
HAC GuardSplat
79:77 52.72
16.29 / 12.28
0.584/ 0.425
0,417 /
215.69/ 13.15
HAC + CompMarkiSS
95.95 / 95,92
27.68 / 27.65
0.856 / 0.852
0.171 / 0.177
208.96 12.23
ContextGS WateRF
92.01 / /90.36
26.64 / 26.47
0.843/ 0.832
0.183 11183/0.100 0.818
219:48 9.88
ContextS Gaussianarkerr
91.24/ 87.95
26..54
0.839
0.195 0.2000
342.38 17.86
ContextGS 3D-GSW
88.28 / 779.75
19:50/ 19.83
0.627 / 006617
0,294 / 0.299
177.19/ 9.24
ContextGS GuardSplat
/
16.90/ 16.86
0.6628
0.353
219.82/
ConEextS CompMarkGS
94.36 / 94.03
27.60 27.55
0.845 / 0.844
0.172 / 0.173
73.39/ 5.72
ContextGS
Table 2: Robustness to model distortion. Based on 48-bit, results are averaged over three datasets with both HAC& before (left) and af- ter (right) compression.
Delarion
Deg
Coalio
Cep
Rossion
Rit Accuncy (S)
No
Gaussian Noise
Clone
Prune
Distontion
(o=0.005)
(20%)
WiteRFF
91.52 77..88
81.70 63.27
90.23 67.45
87.81 66.25
Mlantzza
MarssimMarkar
91.62/ 73.15
73,01 /65,07
89,83
72.17
$7.43/85.73
Figure 4: Robustness to image distortion. Based 3D-GSW
78.56/
62.14
59.76
on 48-bit, the results are averaged over three datasets.
GuardSplar
76.49 /.59999
65.28/ 55.53
73.76 63.20 69.19 65.19
CompMarkiS
95.16 94.99 84.58 80.10
94.35 99.16 93.33/ 93.42
Baselines. To validate our method, we evaluate watermark extraction before and after quantization- based compression in an anchor-based 3DGS framework. For comparison, we eval- uate against the following four baselines: 1) WateRF (Jang et al., (202)): Embedding water- mark into NeRF (Mildenhall et al., 202T] via frequency-domain (DWT) techniques; 2) Gaussian- Marker (Huang et al. 2025): Integrating watermark-specifee Gaussians into the 3D Gaussian Splat- ting (3DGS) (Kerbl et al. 2023) based on per-Gaussian uncertainty estimates; 3) 3D-GSW (Jang ct al. 2025): : Embedding the watermark message by selectively removing Gaussians with low im- pact on rendering quality; 4) GuardSplat (Chen et al.) 2024b): Leveraging Spherical Harmonics (SH) coefficients to embed the message. All baselines originally designed for NeRF or 3DGS are adapted to the anchor-based 3DGS framework for our experiments. Notably, GuardSplat requires specific modifications due to architectural incompatibilities, which are detailed in Appendix D. We compare performance before and after compression using two quantization schemes: HAC (Chen al. 2024a) and ContexiGS (Wang et al. 2024a).
Evaluation. We evaluate the watermark performance of our proposed method, CompMarkGS, and the baselines according to three aspects: 1) Fidelity: We measure PSNR, SSIM, and LPIPS (Zhang al. (2018) to assess the rendering quality of watermarked models before and after compression by comparing rendered images to the original images. 2) Robustness: We evaluate bit accuracy under various distortions before and after compression. We evaluate performance under distortions for rendered images, including Gaussian noise, rotation, scaling, Gaussian blur, cropping, and JPEG compression. We assess robustness against Gaussian noise, cloning, and pruning attacks for water- marked models. 3) Capacity: We measure bit accuracy for 32, 48, and 64-bit message lengths.
5.2 EXPERIMENTAL RESULTS
Fidelity of before and after compression. We compare rendering quality and bit accuracy be- fore and after compression against baselines. The compression technique compresses anchor-based 3DGS models using quantization and entropy encoding. As shown in Tab our proposed method
7

---

Published as a conference paper at ICLR 2026
exhibits strong robustness compression. While some baselines achieve excellent rendering quality and over 90% bit accuracy before compression, conventional methods not designed for compression robustness suffer from severe degradation in both watermark and scene information after compres- sion (See Fig 3) The performance degradation is particularly noticeable the HAC (Chen et al.) (024a) compression. HAC suffers
significant performance drop because it uses anchor- Gaussian interpolation. This is because previous methods failed to account for errors introduced not only during quantization but also during the interpolation step, creating compounding problem. Moreover, 3D-GSW (Jang et al. 2025) selectively removes components based on their rendering contributions before watermark training. This process eliminates both anchors and their associated Gaussians, significantly degrading rendering quality. These results confirm that our proposed water- marking method better suited to model compression than existing methods.
Robustness for the image distortion. We evaluate the robustness of our method against the loss of the embedded watermark when the rendered image is subjected to various distortions. We test robustness against six different image post-processing techniques: Gaussian noise (o 0.1), rota- tion (random selection within = /6), scaling (75% of the original), Gaussian blur (a = 0.1), crop (40% of the original area), and JPEG compression (50% with a quality factor 50), As shown in 4 assess the watermark bit accuracy after post-processing and observe decrease in bit curacy, but the performance degradation is relatively minor compared to the baselines. These results demonstrate that our proposed watermark embedding technique is robust against image distortion.
Robustness for the model distortion. We evaluate our method's robustness against three model distortion attacks designed to alter the embedded watermark: adding Gaussian noise (a 0.005) to the model parameters, randomly cloning 50% of the anchors, and randomly pruning 20% of the an- chors. As shown in Tab our method demonstrates superior bit accuracy and robustness compared to existing approaches under these attacks. These results confirm that our proposed method reliably preserves the watermark even when the model itself is directly manipulated. A detailed analysis is provided in Appendix [E.6]
Capacity. Increasing a watermark message capac- ity leaves less embedding budget per bit and makes more vulnerable to noise and compression, which lowers the bit accuracy. We test bit accuracy for mes- sage lengths of 32, 48, and 64 bits. As shown in Tab. while the accuracy for all methods decreases with longer messages, our method maintains signifi- cantly higher bit accuracy. contrast to other meth- ods, the minimal performance drop even at 64-bit messages demonstrates our method's higher effec- tive message capacity and greater robustness.
Table 3: Comparison of bit accuracy for our method and baselines at 32, 48, and 64-bit. Results averaged over three datasets with both HAC&:ConteXISS before compression.
Bit Accuracy(S)) f
Methods
bits
48 bits
64 bits
GausianMarker
95.07
91.62
79.81
3D.GSW
GuardSplat
79.64
76.49
72.83
CompMarkGS
Ground Truth
Feature (Ours)
Position
Scaling
Offsets
Bit 16 SSIM:0.892 0.892
Act 62.82
BitAco: 51.03
Alt 93.85
SSIM : 0.686
SSIM : 0.573
SSIM : 0.805
Figure 5: Qualitative comparison of rendered images with watermarks embedded into different
anchor attributes. Rendered images obtained with bi watermark emhedding.
Ground Truth
Ours
wio FAG
Ground Truth
Ours
w/o C....
Bit Acc: 97. 02 PSNR 30.62
Bi. Acc: 94.29
Bil Acc: 91.98 Bit Aco: 89.88 P
PSNR 28 28.6
Figure 6: Qualitative comparison of rendering quality with full method (ours), without FAG (left),
without Crev (right). Rendered images are obtained with 48-bit watermark embedding.
8

---

Published as a conference paper at ICLR 2026
Table Ablations of watermark embedding into different anchor attributes. Results are reported for 48-bit messages and averaged over three datasets using HAC and ContexiGS after compression.
HAC
ContextiS
Tarel Parameler
Bit Ace (Xy)
PSNR 1
SSIM 1
LPIPS $
Bit Ace (5e)
PSNR f
SSIM 1
LPIPS J
Position
67.91
12.05
0.625
0.350
82.37
18.49
0.632
0.432
Scaling
19.35
0.615
0.323
64.68
13.40
0.466
0.474
Offscts
94.88
24.61
0.792
0.226
93.98
25.32
0.755
0.322
Anchor Feature (Ours)
95.92
27.65
0.852
0.177
94.03
27.55
0.844
0.173
Table 5: Ablation studies fwequency-aware anchor growing (FAG), quantization distortion layer (QDL), and HSV loss Lhav- Results are reported for 48-bit messages and averaged over three datasets under HAC and ContexIGS after compression.
HAC
ContextGS
QDL
Bit Acc(SE)f
SSIM
LPIPS
Acc(Se)
SSIM 1
26.44
25.56
V
<
93.95
27,54
0.819
0.178
90.35
27.15
0.811
0.198
90.75
26.75
0.844
0.182
88.09
25.04
0.801
0.229
92.57
27.49
0.852
0.179
90.23
27.19
0.841
0.200
95.92
27.65
0.852
0.177
94.03
27.55
0.844
0.173
5.3 ABLATION STUDY
Anchor-based 3DGS watermark embedding. We embed the watermark into different anchor attributes (position, scaling, and offsets) and compare the rendering quality and bit accuracy. As discussed in the previous section (SecI4.I). since the watermark embedding feature shares the same dimensions the anchor feature, when embed the watermark into different attribute, set the watermark feature to match the dimensions of that specific attribute for the experiment. As shown in 3 Tabl4 embedding the watermark into anchor attributes such as position and scaling leads to significant quality degradation, as these attributes directly adjust the Gaussian pose and shape. In contrast, our method embeds the watermark into the anchor feature, seamlessly concealing it without significantly degrading scene information.
Effectiveness of our contributions. We conduct ablation study to analyze the individual con- tribution of our key components: frequency-awarc anchor growing (FAG), quantization distortion layer (QDL), and the HSV loss Laso. The experiments performed under HAC and ContextGS compression settings, with the results reported in Tab Removing QDL causes the most signifi- cant drop in bit accuracy, demonstrating its crucial role preventing watermark loss during quan- tization. Removing FAG degrades both rendering quality and bit accuracy. This indicates that by growing anchors exclusively in high-frequency regions, FAG mitigates conflicts between low- frequency watermarks and quality enhancement algorithms, thereby securing both rendering quality and watermark robustness (See Fig Finally, removing the HSV loss worsens the LPIPS score and introduces subtle color artifacts. This suggests that the HSV loss effectively mitigates color artifacts that are difficult to handle with an RGB-space loss function alone (See Fi Effective watermarking must strike balance among three competing goals: robustness, invisibility, and ca- pacity. Our experiments show that FAG, QDI,, and the HSV loss not only serve unique roles but also work complementarily significantly improve this balance between bit accuracy and rendering quality in compressed environments.
6 CONCLUSION
We propose CompMarkGS, compression-robust watermarking method. By integrating quanti- zation distortion layer, we train the watermark to withstand quantization-base compression, and we introduce a learnable watermark embedding feature for anchor-based insertion, achieving both high security and high fidelity. Additionally, our frequency-awar preserve high-quality rendering performance. To the best of our knowledge, CompMarkGS is the first compression- robust watermarking framework for 3DGS, making it well-suited for protecting 3D assets on resource-constrained devices.
anchor growing and HSV loss

---

Published as a conference paper at ICLR 2026
7 ACKNOWLEDGMENTS
This work was supported by Culture, Sports and Tourism R&D Program through the Korea Cre- ative Content Agency grant funded by the Ministry of Culture, Sports and Tourism (International Collaborative Research and Global Talent Development for the Development of Copyright Man- agement and Protection Technologies for Generative AI, RS-2024-00345025, 25%; Research on neural watermark technology for copyright protection of generative AI 3D content, RS-2024- 00348469, 25%), the National Research Foundation of Korea(NRF) grant funded by the Korea (STT
48%). Institute of Information & communications Tech- nology Planning & Evaluation (ITP)) & ITRCCInformation Technology Research Center) grant funded by the Korea govermeen((MSTT) School Program(Korea University), 1%; LITT-2202--R--22244444---636 1%).
Artificial Intelligence Graduate
ETHICS STATEMENT
Provenance. We only used publicly released datasets from academic publications (Blender (Mildenhall et al. 2021). I.IFF (Mildenhall et al.] 2019), and Mip-NeRF 360 (Bar- ron al. (.22)). Additionally, the Blender and LLFF datasets are distributed under the CC BY 3.0 Unported license, while the Mip-NeRF 360 dataset is available under the Apache License 2.0.
Anonymous. The Blender (Mildenhall et al., 2021). LLFF (Mildenhall et al., 2019), and Mip- NeRF 360 (Barron et al.) 2022) datasets represent synthetic and real-world data, respectively. The Blender dataset consists of 3D object scenes, while LLFF and Mip-NeRF 360 comprise indoor and outdoor real-world scenes. None of these datasets contains any human subjects. The details of each dataset are as shown in Tab
Table 6: Dataset composition used for evaluation. Blender is synthetic, whereas LLFF and Mip- NeRF 360 real-world scenes, with human subjects included.
Dataset
Scenel
Scene2
Scene3
Scene4
Scene5
Scene6
Scene7
Scene8
Scene9
Blender
chair
drums
ficus
hotdog
lego
matcrials
mic
ship
LLFF
fern
flower
furtress
horns
leaves
orchids
room
trex
Mip-NeRF 360
bicycle
bonsai
counter
flowers
garden
kitchen stump
treehill
THE USE OF LARGE LANGUAGE MODELS
We used an LLM in limited manner for grammar and style polishing only. It did not contribute to research ideation, experimental design, and analysis. The authors take full responsibility for all content.
REFERENCES
Rameen Abdal, Wang Yifan, Zifan Shi, Yinghao Xu, Ryan Po, Zhengfei Kuang, Qifeng Chen, Dit-Yan Yeung, and Gordon Wetzstein. Gaussian shell maps for efficient 3d human generation. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 9441-9451, 2024.
Mauro Barni, Franco Bartolini, and Alessandro Piva. Improved wavelet-based watermarking through pixel-wise masking. IEEE transactions on image processing, 10(5):783-791, 2001.
Jonathan T Barron, Ben Mildenhall, Dor Verbin, Pratul P Srinivasan, and Peter Hedman. Mip-nerf 360: Unbounded anti-aliased neural radiance fields. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 5470-5479, 2022.
Monsij Biswal, Tong Shao, Kenneth Rose, Peng Yin, and Sean Mecarthy. Steganerv: Video steganography using implicit neural representation. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pp. 888-898, 2024.
10

---

Published as a conference paper at ICLR 2026
David Charatan, Sizhe Lester Li, Andrea Tagliasacchi, and Vincent Sitzmann. pixelsplat: 3d gaus- sian splats from image pairs for scalable generalizable 3d reconstruction. In Proceedings of the IEEE/CVF conference computer vision and pattern recognition, pp. 19457-19467, 2024.
Jianchuan Chen, Jingchuan Hu, Gaige Wang, Zhonghua Jiang, Tiansong Zhou, Zhiwen Chen, and Chengfei Lv. Taoavatar: Real-time lifelike full-body talking avatars for augmented reality via 3d gaussian splatting. arXiv preprint arXiv:2503. 7032, 2025a.
Yihang Chen, Qianyi Wu, Weiyao Lin, Mehrtash Harandi, and Jianfei Cai. Hac: Hash-grid assisted context for 3d gaussian splatting compression. In European Conference on Computer Vision, pp- 422-438. Springer, 2024a.
Yihang Chen, Mengyao Li, Qianyi Wu, Weiyao Lin, Mehrtash Harandi, and Jianfei Cai. Pegs: Progressive compression of 3d gaussian splatring. arXiv preprint arXiv:2503.085// 2025b.
Zixuan Chen, Guangcong Wang, Jiahao Zhu, Jianhuang Lai, and Xiaohua Xie. Guardsplat: Robust and efficient watermarking for 3d gaussian splatting. arXiv preprint arXiv2241..19895, 2024b.
Weina Dong, Jia Liu, Lifeng Chen, Wenquan Sun, and Xiaozhong Pan. Stega4nerf: cover selection steganography for neural radiance fields. Journal of Electronic Imaging. 33(3)003031--033011, 2024.
Zhiwen Fan, Kevin Wang, Kairun Wen, Zehao Zhu, Dejia Xu, Zhangyang Wang, et al. Lightgaus- sian: Unbounded 3d gaussian compression with 15x reduction and 200+ fps. Advances in neural information processing systems, 37:140138-14011 2025.
Pierre Fernandez, Alexandre Sablayrolles, Teddy Furon, Hervé Jégou, and Matthijs Douze. Wa- termarking images in self-supervised latent spaces. In ICASSP 2022-2022 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 3054-00000 IEEE, 2022.
Pierre Fernandez, Guillaume Couairon, Hervé Jégou, Matthijs Douze, and Teddy Furon. The sta- ble signature: Rooting watermarks in latent diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 22466 22477, 2023.
Rafael C Gonzalez. Digital image processing. Pearson education india, 2009.
Yijia Guo, Wenkai Huang, Yang Li, Gaolei Li, Hang Zhang, Liwen Hu, Jianhua Li, Tiejun Huang, and Lei Ma. Splats in splats: Embedding invisible 3d watermark within gaussian splatting. arXiv preprint arXiv:2412.031211 2024.
Xiufeng Huang, Ruiqi Li, Yiu-ming Cheung. Ka Chun Cheung, Simon See, and Renjie Wan. Gaus- sianmarker: Uncertainty-aware copyright protection 3d gaussian splatting. Advances Neural Information Processing Systems, 37:33037-33060. 2025.
Youngdong Jang, Dong In Lee, MinHyuk Jang, Jong Wook Kim, Feng Yang, and Sangpil Kim. Waterf: Robust watermarks in radiance fields for protection of copyrights. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 12087-12097, 2024.
Youngdong Jang, Hyunje Park, Feng Yang. Heeju Ko, Euijin Choo, and Sangpil Kim. 3d-gsw: 3d gaussian splatting for robust watermarking. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2025.
Lih-Jen Kau and Tien-Lin Lee. An hsv model-based approach for the sharpening of color images. In 2013 IEEE International Conference Systems, Man, and Cybernetics, pp. 150-155. IEEE, 2013.
Bernhard Kerbl, Georgios Kopanas, Thomas Leimkühler, and George Drettakis. 3d gaussian splat- ting for real-time radiance field rendering. ACM Transactions on Graphics, 12, 2023.
Joo Chan Lee, Daniel Rho, Xiangyu Sun, Jong Hwan Ko, and Eunbyung Park. Compact 3d gaussian representation for radiance field. In Proceedings the and Pattern Recognition, pp. 21719-21725 2024a.
the IEEE/CVF Conference on Computer Vision

---

Published as a conference paper at ICLR 2026
Yonghan Lee, Jachoon Choi, Dongki Jung, Jaeseong Yun, Soohyun Ryu, Dinesh Manocha, and Suyong Yeon. Mode-gs: Monocular depth guided anchored 3d gaussian splatting for robust ground-vien scene rendering. arXiv preprint arX1v:2410.04646, 2024b.
Chenxin Li, Brandon Y Feng, Zhiwen Fan, Panwang Pan, and Zhangyang Wang. Steganerf: Em- bedding invisible information within neural radiance fields. In Proceedings of the IEEE/CVF international conference on computer vision, pp. 441-453, 2023.
Zhan Li, Zhang Chen, Zhong Li, and Yi Xu. Spacetime gaussian feature splatting for real-time dynamic view synthesis. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pp. 4508-8520, 2024.
Jiaqi Lin, Zhihao Li, Xiao Tang, Jianzhuang Liu, Shiyong Liu, Jiayue Liu, Yangdi Lu, Xiaofei Wu, Songcen Xu, Youliang Yan, et al. Vastgaussian: Vast 3d gaussians for large scene reconstruction. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 2024.
Tsung-Y Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C Lawrence Zitnick. Microsoft coco: Common objects in context. In Computer vision-ECCV 2014: 13th Europeun conference, zurich, Swifzerland, September 6-12, 2014, pro- ceedings, part 13, pp. 740-755. Springer, 2014.
Tao Lu, Mulin Yu, Linning Xu, Yuanbo Xiangli, Limin Wang, Dahua Lin, and Bo Dai. Scaffold-gs: Structured 3d gaussians for view-adaptive rendering. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 20654-20664, 2024.
Xiyang Luo, Ruohan Zhan, Huiwen Chang, Feng Yang, and Peyman Milanfar. Distortion agnostic deep watermarking. In Proceedings of the IEEE/CVF conference computer vision and pattern recognition, pp. 13548-13557, 2020.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. arXiv preprint 10X6v:/706.06000 2017.
Ben Mildenhall, Pratul P Srinivasan, Rodrigo Ortiz-Cayon, Nima Khademi Kalantari, Ravi Ra- mamoorthi, Ren Ng, and Abhishek Kar. Local light field fusion: Practical view synthesis with prescriptive sampling guidelines. ACM Transactions Graphics (ToG), 38(4):1-14, 2019.
Ben Mildenhall, Pratul P Srinivasan, Matthew Tancik, Jonathan T Barron, Ravi Ramamoorthi, and Ren Ng. Nerf: Representing scenes neural radiance fields for view synthesis. Communications of the ACM, 65(1):99-106, 2021.
KI Navaneet, Kossar Pourahmadi Meibodi, Soroush Abbasi Koohpayegani, and Hamed Pirsiavash. Compgs: Smaller and faster gaussian splatting with vector quantization. In European Conference on Computer Vision, pp. 349. Springer, 2024.
KA Navas, Mathews Cheriyan Ajay, M Lekshmi, Tampy S Archana, and M Sasikumar. Dwt-dct-svd based watermarking. 2008 3rd international conference on communication systems software and middleware and workshops (COMSWARE'OS) pp. 27 2-14274. IEEE, 2008
Adam Paszke, Sam Gross, Francisco Massa, Adam Lerer, James Bradbury, Gregory Chanan, Trevor Killeen, Zeming Lin, Natalia Gimelshein, Luca Antiga, et al. Pytorch: An imperative style, high- performance deep learning library. Advances in neural information processing systems, 32, 2019.
Zhiyin Qian, Shaofei Wang, Marko Mihajlovic, Andreas Geiger, and Siyu Tang. 3dgs-avatar: Ani- matable avatars via deformable 3d gaussian splatting. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 5020-5030, 2024.
Kerui Ren, Lihan Jiang, Tao Lu, Mulin Yu, Linning Xu, Zhangkai Ni, and Bo Dai. Octree- gs: Towards consistent real-time rendering with lod-structured 3d gaussians. arXiv preprint 178.:2403..7788, 2024.
12

---

Published as a conference paper at ICLR 2026
Yuqi Tan, Xiang Liu, Shuzhao Xie, Bin Chen, Shu-Tao Xia, and Zhi Wang. Water-gs: To- ward copyright protection for 3d gaussian splatting via universal watermarking, arXiv preprint arXiv:2412.05699, 2024.
Matthew Tancik, Ben Mildenhall, and Ren Ng. Stegastamp: Invisible hyperlinks in physical pho- tographs. Proceedings of the IEEE/CVF conference on computer vision and pattern recogni- tion, pp. 2117-2126, 2020.
Jiaxiang Tang, Jiawei Ren, Hang Zhou, Ziwei Liu, and Gang Zeng. Dreamgaussian: Generative gaussian splatting for efficient 3d content creation. arXiv preprint arXiv:2309.1663: 16653, 2023.
Ron G Van Schyndel, Andrew Z Tirkel, and Charles F Osborne. A digital watermark. In Proceedings of 1st international conference on image processing, volume pp. 86-90. IEEE, 1994.
Yufei Wang, Zhihao Li, Lanqing Guo, Wenhan Yang, Alex C Kot, and Bihan Wen. Contextgs: Compact gaussian splatting with anchor level context model. arXiv preprint urXiv:2405.20721, 2024a.
Yuxin Wang, Qianyi Wu, Guofeng Zhang, and Dan Xu. Learning 3d geometry and feature consistent gaussian splatting for object removal. In European Conference Computer Vision, pp. 1-17. Springer, 2024b.
Raymond B Wolfgang and Edward Delp. watermark for digital images. Proceedings of 3rd IEEE International Conference on Image Processing, volume 3. pp. 219-222. IEEE, 1996.
Guanjun Wu, Taoran Yi, Jiemin Fang, Lingxi Xie, Xiaopeng Zhang, Wei Wei, Wenyu Liu, Qi Tian, and Xinggang Wang. 4d gaussian splatting for real-time dynamic scene rendering. In I Proceedings of the JEEF/CVF conference on computer vision and pattern recognition, pp. 20310-20320 2024.
Shuzhao Xie, Weixiang Zhang. Chen Tang, Yunpeng Bai, Rongwei Lu, Shijia Ge. and Zhi Wang. Mesongs: Post-training compression of 3d gaussians via efficient attribute transformation. In European Conference on Computer Vision, pp. 434 452. Springer, 2024a.
Tianyi Xie, Zeshun Zong, Yuxing Qiu, Xuan Li, Yutao Feng, Yin Yang, and Chenfanfu Jiang. Physgaussian: Physics-integrated 3d gaussians for generative dynamics. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 4389-4398, 2024b.
Jinbo Yan, Rui Peng, Zhiyan Wang. Luyang Tang, Jiayu Yang. Jie Liang, Jiahao Wu, and Ronggang Wang. Instant gaussian stream: Fast and generalizable streaming of dynamic scene reconstruction via gaussian splatting. arXiv preprint arXiv: 16979, 2025.
Taoran Yi, Jiemin Fang, Junjie Wang, Guanjun Wu, Lingxi Xie, Xiaopeng Zhang, Wenyu Liu, Qi Tian, and Xinggang Wang. Gaussiandreamer: Fast generation from text to 3d gaussians by bridging 2d and 3d diffusion models. In Proceedings of the IEEF/CVF Conference on Computer Vision and Pattern Recognition, pp. 6796-6807, 2024.
Ye Yuan, Xueting Li, Yangyi Huang, Shalini De Mello, Koki Nagano, Jan Kautz, and Umar lqbal. Gavatar: Animatable 3d gaussian avatars with implicit mesh learning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 896-905, 2024.
Yu-Ting Zhan, Cheng- Yuan Ho, Hebi Yang, Yi-Hsin Chen, Jui Chiu Chiang, Yu-Lun Liu, and Wen- Hsiao Peng. Cat-3dgs: A context-adaptive triplane approach to aat-ddisorttonn-ppiiizee 3dgs compression. arXiv preprint Sa00i::25530005557 2025.
Kai Zhang, Sai Bi, Hao Tan, Yuanbo Xiangli, Nanxuan Zhao Kalyan Sunkavalli, and Zexiang Xu. Gs-Irm: Large reconstruction model for 3d gaussian splatting. In European Conference on Computer Vision, pp. 1-19. Springer, 2024.
Richard Zhang, Phillip Isola, Alexei A Efros, Eli Shechtman, and Oliver Wang. The unreasonable effectiveness deep features as a perceptual metric. In Proceedings of the IEEE conference on computer vision and patlern recognition, pp. 586-595, 2018.
13

---

Published as a conference paper at ICLR 2026
Xuanyu Zhang, Jiarui Meng, Runyi Li, Zhipei Xu, Jian Zhang, al. Gs-hider: Hiding messages into 3d gaussian splatting. Advances in Neural Information Processing Systems, 37:49780-49805, 2025a.
Xuanyu Zhang, Jiarui Meng, Zhipei Xu, Shuzhou Yang. Yanmin Wu, Ronggang Wang, and Jian Zhang. Securegs: Boosting the security and fidelity of 3d gaussian splatting steganography. arXiv preprint wxXi:25503.06118 2025b.
Junsheng Zhou, Weiqi Zhang, and Yu-Shen Liu. Diffgs: Functional gaussian splatting diffusion. Advances in Neural Information Processing Systems, 37:37535-37560, 2024.
Jiren Zhu, Russell Kaplan, Justin Johnson, and Li Fei-Fei. Hidden: Hiding data with deep networks. In Proceedings of the European conference on computer vision (ECCV), pp. 657-672, 2018.
Ruijie Zhu, Yanzhe Liang, Hanzhi Chang, Jiacheng Deng, Jiahao Lu, Wenfei Yang, Tianzhu Zhang, and Yongdong Zhang. Motiongs: Exploring explicit motion guidance for deformable 3d gaussian splatting, Advances in Neural Information Processing Systems, 37:101790-101811 2025.
14

---

Published as a conference paper at ICLR 2026
APPENDIX
A BROADER IMPACTS
Our proposed CompMarkGS is an invisible watermarking method for 3D assets, such as 3D Gaus- sian Splatting (3DGS), which remains recoverable even after aggressive compression. Our work has three key social impacts:
Security: CompMarkGS enables copyright protection of 3D assets distributed across diverse digi- tal environments without compromising visual quality. This capability supports copyright protec- tion and sustainable revenue generation across wide range of 3D content creators.
Applicability: CompMarkGS ensures watermark robustness under high-ratio compression, en- abling protected 3DGS to be reliably utilized on resource-constrained devices, such as mobile phones and head-mounted displays. These protected 3DGS be safely deployed in virtual reality (VR), augmented reality (AR), medical imaging, and other 3D applications without com- promising watermark integrity.
Sustainability: To the best of knowledge, CompMarkGS is the first watermarking method to achieve watermark robustness against compression. Building on this work, it will provide foundation for other researchers and practitioners to extend the approach, contributing to the advancement of watermarking research across a variety of compression formats.
B
LIMITATIONS AND FUTURE WORKS
B.1 LIMITATIONS
One limitation of our proposed method, CompMarkGS, is its reliance pre-trained decoder for the watermark extraction process. However, this dependency constitutes a manageable, one-time computational cost. The decoder is trained only once for specific message length (e.g.. 32, 48, or 64 bits) and can then be universally applied to any 3D Gaussian Splatting model without the need for model-specific fine-tuning. This design choice significantly enhances the method's practicality and scalability, as the initial training effort is amortized over countless applications.
B.2 FUTURE WORKS
Looking ahead, we have identified several promising directions for future work. First, we plan to extend our method to operate independently of 3D Gaussian Splatting compression, which would broaden applicability
wider range of scenarios. Concurrently, we aim to develop a more lightweight watermarking architecture. This initiative will focus reducing the computational overhead both the embedding and decoding stages, making our solution even more suitable for real-time resource-constrained environments.
C MORE IMPLEMENTATION DETAILS
C.I TARGET COMPRESSION SCHEMES ROBUSTNESS EVALUATION
To test the robustness of our watermark, we use two prominent anchor-based 3DGS compression methods HAC (Chen et al. 2024a) and ContextGS (Wang et al.) 2024a). Both techniques follow similar pipeline, extracting features for each anchor, using MLPs to predict context-based distribu- tion, and then applying differentiable quantization and entropy coding. This approach significantly compresses the model size while minimizing any loss rendering quality.
However, the information loss that occurs during quantization damage destroy watermark. Therefore, our core objective is to achieve robustness specifically against this kind of quantization- based compression.
15

---

Published as a conference paper at ICLR 2026
C.2 OVERVIEW OF THE COMPMARKGS PIPELINE
In this section, we detail the core components of the CompMarkGS pipeline, covering the overall watermark training procedure.
Watermarking embedding stage. The watermarking process begins by combining the original anchor features with a learnable watermark embedding feature to create watermarked anchor fea- tures. These features then passed through quantization distortion layer (QDL), which simulates distortions from quantization by injecting noise, resulting in the quantized watermarked anchor fea- tures. These final features are fed into the MLPs predict Gaussian parameters and render the scene. To recover the watermark message from the rendered image, we apply Discrete Wavelet Transform (DWT) extract the low-frequency band and input it a pre-trained decoder. The entire training process is optimized to minimize the message reconstruction loss Lmag. with an additional HSV-based perceptual loss Lisv used to prevent visual quality degradation.
Frequency-aware anchor growing stage. To further enhance rendering quality, we introduce the frequency-aware anchor growing (FAG) stage, which leverages frequency information to grow new anchors. We apply Discrete Fourier Transform (DFT) and high-pass filter both the rendered and ground truth images to isolate their high-frequency components. A SSIM-based error map is then calculated between these two high-frequency representations. Based on this error map, we identify Gaussians in regions where high-frequene, information is poorly reconstructed and use backpropagation to selectively grow new anchors in those locations.
In summary, CompMarkGGS learns watermark robustness against compression-induued information loss via the QDL, while simultaneously preserving nigh-frequency details that could be degraded by watermarking via FAG. As result, our proposed method achieves high watermark recovery rates and excellent visual fidelity in scenarios both with and without model compression.
C.3 DETAILS OF TRAINING
Our proposed CompMarkGS adopts a per-scene optimization strategy and trains the anchor-based 3DGS from scratch with the watermark, in contrast to existing methods (Huang et al., 2025: Jang ett al.
2024 2025) that rely on fine-tuning pre-trained 3DGS models. For each scene, we train
for 30, 000 iterations with single T-bit watermark message that is kept fixed throughout training- Anchor growing is performed between 1, 600 and 15, 000 iterations, first using conventional an- chor growing and then switching the proposed frequency-aware anchor growing strategy for fine- grained refinement. The loss function for watermark training consists of the original anchor- based 3DGS (Lu al., (024) loss Lscattol and three additional components: HSV loss Lisvs frequency loss Liteg. and message loss Limeg Before watermark training begins, we pre-train a HiDDeN (Zhu eet al. 2018) message decoder on the MS-COCO dataset (Lin et al. 2014) for 32, 48, and 64-bit messages following the strategy from 3D-GSW (Jang et al.) (025) and Stable Signature (Fernan- dez et al.] (023).. During the subsequent watermark training, the pre-trained decoder is kept fixed. Additionally, the compression ratio of the compression method used in all experiments is set to 0.004.
C.4 DETAILS OF HIGH--PSS FILTER
Early digital watermarking studies hide the watermark in the high-frequency bands of an image to keep it imperceptible. However, the watermark embedded in high-frequency regions is vulnerable to image distortions such as JPEG compression. More recent work, therefore, embeds the watermark in the low-frequency bands, which are more robust such attacks. The drawback that low oowffreuenccy components represent essential information, including the global structure and color distribution of the image. Modifying these components can degrade visual coherence and affect the perception of fine details such edges and textures.
The conventional anchor growing strategy computes the mean gradient of the Gaussians within each voxel and places new anchor point only if no anchor already exists in voxels whose mean gradi- ent exceeds a threshold. During anchor- based 3DGS training, voxels with high mean gradients are primarily associated with regions that form the coarse structure of the scene. As result, densifica- tion rarely occurs in fine-detail areas, and when a watermark is embedded, those under-represented regions more susceptible to quality degradation.
16

---

Published as a conference paper at ICLR 2026
To address this limitation, propose frequency-aware anchor growing strategy that selectively densifies Gaussians located in high-frequue fre.uencyyny regions. Specifically, we apply a Discrete Fourier Transform (DFT) to convert the rendered image into the frequency domain. To isolate high- frequency components, we use a high-pass filter mask Mr that emphasizes high-frequency regions while suppressing low-frequency ones in the frequency domain:
Mp(p) exp (- (d(p)-
(00)-7) T)²
(10)
2/3
where d(p) denotes the Euclidean distance between pixel p and the center of the image. T de- fines the cutoff threshold of the mask and 3 determines the degree of attenuation. The resulting mask M, multiplied element-wiss with the Fourier-transformedd image to suppress low-frequency components and preserve only the high-frequency details. Afterward, we apply the Inverse Discrete Fourier Transform (IDFT) to reconstruct the filtered images in the spatial domain, resulting in the high- figh-frequency rendered images f and the high-frequency ground truth images Inf. Further de- tails of the frequency-awer aware anchor growing process can be found in the main paper (See main paper Sec.4.3).
C.5 DETAILS OF FREQUENCY-AWARE ANCHOOR GROWING
We propose frequency-awen aware anchor growing strategy that efficiently identifies and densifies Gaus- sians in high-frequency regions to mitigate visual quality degradation caused by watermark embed- ding. Specifically, we first compute SSIM-based error map Perror (See main paper Sec be- tween the high-frequency rendered image I and the ground truth image Tay- both extracted in the frequency domain (See See C.4). This error map Perror highlights pixel regions where high- frequency information is not faithfully reconstructed. To identify pixel regions that contain visually important fine details, we compute the median value Perror of the SSIM- based error map Perrar- When relying on the maximum value of the SSIM-based error map Perror, a few outlier pixels dominate the selection of high-frequency regions. To mitigate this, instead use the me- dian value Perror, which provides more meaningful identification of high-frequency regions. We then generate a binary mask mask by filtering pixels whose error values fall within the interval [P [Perror- e, e, Perror + e):
I maskk(p) (p) [1, if (Perror(p) Perror Se 0, otherwise
(11)
where p denotes the pixel coordinates in the image. Subsequently, we construct a binary mask Gmask to select the 3D Gaussian points that 2D projections fall within the boundaries of the image:
f1, f1, if 0 W and OSv<H
Gmakk (k) 1 (0 otherwise
(12)
where h: = (xx.)) v) denotes the pixel coordinates of the 2D Gaussian, and W and H represent the width and height of the image, respectively. Using the two binary masks maak and Gmask, generate a boolean mask Fass that identifies Gaussians located in specific nigh-frequency regions by matching their 2D coordinates the high-frequency pixel locations:
Fmask (k) (k)s Gmask(() (k:,
(13)
where k denotes the pixel coordinates of the 2D Gaussian. During the anchor growing process, we calculate the average of Gaussians within the voxel regions selected by the computed boolean mask F Fmask- based on the accumulated sum of their gradients. If the average gradient exceeds the threshold - = 0.00015 and no anchor exists the corresponding voxel, a new anchor added. The threshold for the accumulated opacity used in the subsequent anchor pruning step is set to Lighh = 0.15.
C.6 DETAILS OF HSV LOSS
In the field of digital watermarking, achieving imperceptible watermark embedding is a primary research goal. However, there exists inherent trade-off between invisibility and bit accuracy.
17

---

Published as a conference paper at ICLR 2026
When training model to embed watermark in 3D Gaussian Splatting (3DGS), color artifacts emerge due to the tendency to embed the watermark into specific Gaussians to achieve high bit accuracy. Additionally, these artifacts occur particularly in regions rendered by small number of Gaussians, where even slight modifications to the Gaussians can lead to noticeable distortions.
Although the RGB color space is widely used for image representation, prior work image sharp- ening (Kau & Lee 2013) indicates that the RGB color space does not fully account for the perceptual characteristics of the human visual system. In particular, the human visual system is more sensitive to luminance variations than to chromatic changes (Gonzalez 2009). Unlike the RGB color space, the Hue, Saturation, and Value (HSV) space separates chromatic information (Hue and Saturation) from luminance (Value), enabling more precise detection and suppression of color artifacts. Based on this property, we introduce an HSV loss that enhances rendering quality while preserving high bit accuracy.
To isolate specific regions in the HSV space, we construct binary masks (See main paper Eq.7) by filtering pixels based on predefined hue ranges He, along with threshold conditions saturation r3 and value Te corresponding to color e E C, where = (R, G, B). Each pixel p E Ω2 where P R² denotes the spatial domain of the image, is evaluated based on its HSV values. Let S(p) E [0, 1] and
(p) E [0, 1] denote the saturation and value components at pixel p. respectively. We define the hue range He for each color as follows:
HR E
0,
π
U
5x
2T
if S(p) 2 T and V(p) 2 th
3
3
Hg E
if
S(p)
Tá and Vi)) :o.
(14)
3
5m
HB E
if S()) 2 T and V(p) 2 TB.
where (p) E 00, 2x) denotes the hue value at pixel p. Pixels that do not satisfy the corresponding saturation or value thresholds are excluded from the mask, even if their hue lies within the specified range. We set thresholds for the red with ग = 0.4 and TR = 0, while using relaxed thresholds T 0.2, T 0.2 for the green and blue.
D DISCUSSION
D.1 COMPARISON WITH RELATED WORK
Distinction from anshor-based approaches. Although both CompMarkGS and SecureGS use an mnchr--based structure, they are fundamentally different, starting from their problem definition. SecureGS (Zhang et al.) 2025b) is a steganography method aiming to hide large amounts of data, with invisibility as its key metric. In contrast, CompMarkGS is a digital watermarking method for proving ownership, which prioritizes robustness. Notably, the "robustness" evaluation in SecureGS focuses on preserving the rendering quality of the hidden scene, whereas CompMarkGS aims for the recovery of the hidden message itself under attacks like model compression. To achieve these dif- ferent goals, their information embedding mechanisms are also distinct. SecureGS predicts hidden Gaussian offsets with private MLP, while CompMarkGS directly injects learnable watermark emhedding feature into the anchor feature and extracts the message from the rendered image via a pre-trained decoder. Therefore, CompMarkGS is not an incremental improvement on SecureGS, but a unique solution independently designed for the new objective of verifiable ownership after model compression.
Comparison with 3DGS watermarking techniques. A key difference between our method and existing watermarking methods, particularly frequency- approaches such as 3D-GSW (Jang et al. 2025), lies in our unique approach to utilizing frequency information. While both methods leverage frequency data for Gaussian densification, their core strategies and objectives are funda- mentally different. 3D-GSW measures the frequency intensity of patches, whereas CompMarkGS precisely identifies high-frequency еттоr regions between the rendered image and the ground truth, selectively densifying anchors in those specific areas. However, the most significant distinction the role of compression in the watermarking pipeline. Unlike 3D-GSW, which incorporates model pruning as part of its watermarking process, CompMarkGS is the first define and solve
18

---

Published as a conference paper at ICLR 2026
the novel problem of watermark robustness against external quantization compression applied to fully trained model. To achieve this, we introduce a quantization distortion layer (QDL) that simu- lates quantization noise during training, proposing a unique method specifically optimized to address the previously unexplored challenge of watermark loss during quantization compression. This focus compression robustness also sets CompMarkGS apart from GaussianMarker (Huang et al. 2025) and GuardSplat (Chen et al.) 2024b). These methods address traditional image distortions like Gaussian noise and JPEG com- pression, or model distortions such as pruning. However, they lack mechanism to mitigate the loss of watermark information caused by quantization compression.
component absent in 3D-GSW. Our contribution is
Furthermore, for fair comparison, we adapt the existing vanilla 3DGS-based watermarking tech- niques to the anchor-based 3DGS framework. However, during this process, GuardSplat requires significant adaptation due to core architectural incompatibility. This is because GuardSplat re- lies on adding offsets to explicit Spherical Harmonies (SH) parameters, which do not exist in our anchor-based model. Therefore, we modified its mechanism to apply offsets to the anchor features instead for our experiments.
D.2 MOTIVATION FOR WATERMARKING ANCHOR-BASED 3D GAUSSIAN SPLATTING
As the demand for lightweight and efficiently rendered 3D Gaussian Splatting (3DGS) (erbbl et al. 2023) models grows, anchor-based architectures are emerging key solution. In particular, mod- els like Scaffold-SS (Lu et al., 2024), which combine anchors with an MLP, achieve both high memory efficiency and excellent rendering quality compared vanilla 3DGS. This anchor-based structure is highly practical, making ideal for mobile and AR/VR environments where real-time rendering is essential.
We identified these anchor-based 3DGS models as ideal targets for watermarking due to a signifi- cant security advantage. Instead of directly storing and rendering Gaussian attributes, anchor-based models generate them indirectly by feeding anchor features into an MLP. If we embed a watermark into these anchor features, it undergoes non-linear transformation by the MLP. This process ex- presses the watermark within the Gaussian attributes in complex and concealed manner, making it extremely difficult for an external attacker to directly interpret or remove it.
Therefore, selecting an anchor-based 3DGS model for watermarking is rational approach that secures both practical benefits, such as lightweight structure, and robust security through the MLP.
E ADDITIONAL EXPERIMENTAL RESULTS
E. EFFECTIVENESS OF WATERMARKING EMBEDDING FEATURE
To verify the effectiveness of our proposed watermark embedding strategy, we compare the perfor- mance of two approaches: using only the anchor feature and using dedicated watermark embedding feature. As described See [.1 our method introduces a dedicated watermark embedding feature that shares the same dimension as the anchor feature, combining them via element- sum. This design ensures that the total feature dimension remains constant, regardless of whether a watermark embedded. Therefore, any observed performance increase can be attributed to the effectiveness of the embedding strategy itself, rather than an increase in model capacity.
Table 7: Ablation study the dedicated watermark embedding feature. Results reported for 48-bit messages and averaged over three datasets after ContextGS compression.
Embedking Method
Bit Acc. (
PSNR f
SSIM
LPIPS
Anchor Feature (Ours w/o f')
92.94
26.79
0.834
0.209
Anchor Feature (Ours w/ f')
94.03
27.55
0.844
0.173
As shown in Tab using only the anchor feature creates a conflict between the two tasks of repre- senting the scene and hiding information, which leads to degraded rendering quality. In contrast, our approach introducing a dedicated watermark embedding feature preserves high rendering quality while enabling robust watermark. We conclude that using independent watermark em-
19

---

Published as a conference paper at ICLR 2026
bedding feature is essential for effectively decoupling these two objectives, thereby achieving an optimal balance between rendering quality and watermark robustness.
E.2 EFFECTIVENESS OF HSV LOSS
When only RGB-based loss functions are used for watermark embedding, the optimization of 3DGS fails to consider the characteristics of the human visual system. As a result, 3DGS with a watermark renders color artifacts in the rendered images, particularly in regions with strong chromatic and luminance variations. These artifacts are observed in Fig and Fig despite achieving high bit accuracy. To address this, introduce an HSV loss that aligns more closely with the perceptual characteristics of the human visual system. HSV color space separates chromatic components (Hue and Saturation) from luminance (Value), making it more suitable for detecting and reducing color artifacts. As shown in Fig. 7 binary masks of HSV loss successfully detect color artifacts in each color channel. Moreover, Fig. [ shows that HSV loss allows 3DGS to focus its optimization on min- imizing color artifacts, maintaining high bit accuracy. These results show that HSV loss effectively reduces color artifacts while preserving high bit accuracy and rendering quality.
Ground Truth
Red
Blue
Green
Binary Mask
Rendered Image w/o loss
Masked Image
Figure 7: Visualization of the binary mask and masked image for each color channel (Red, Green, and Blue). The left column shows the ground truth and the rendered image without HSV loss. The right columns present the binary masks (top) and masked results (bottom) for each color channel. This result is based on 48-bit messages.
Rendered Image w/o HSV loss
Rendered Image w/ HSV loss
Visualize HSV loss
Ground Truth
32
Acc 89.53
Bit AcO: 93. LPIPS: 0.059
LPIPS: 0.141
Figure 8: Visualization of HSV loss. The comparison performed between images rendered with and without the HSV loss. This result is based on 48-bit messages.
E.3 ROBUSTNESS UNDER VARIOUS CONDITIONS
Robustness to pruning-basee based compression. To further validate our method's robustness to model compression, we conduct experiment comparing its watermark performance against a represen- tative pruning-based technique. LightGaussian (Fan et al., 2025). On the Mip-NeRF 360 (Barron et al. 2022) dataset, apply 66% pruning to the outputs of models that were already compressed with HAC (Chen et al., (2244) and ContextGS (Wang et al., 2024a). Tabl3 compares the bit accu- racy and model size before and after this pruning. The results show that CompMarkGS experiences
20

---

Published as a conference paper at ICLR 2026
significantly smaller drop in bit aceuracy after pruning compared to the baselines. This is because CompMarkGSS directly integrates both pruning and anchor growing into its training process, which builds resilience the distortions caused by parameter removal. These findings corroborate the sults from 9 where our method maintained over 90% bit accuracy under 50% random pruning, and collectively demonstrate that our technique is highly robust pruning- distortions.
Table 8: Robustness comparison against pruning-basee based compression using LightGaussian. Results for the Mip-NeRF 360 dataset (48-bit messages), showing bit accuracy and model size before
and after 66% pruning.
Method
Bit Acc. (%) f
Size (MB) 4
WateRF
92.65 / 67.29
248.97 84.77
GaussianMarker
92.89/ / 66.67
418.66 141.84
3D-GSW
91.93 / 67.06
228.62 / 77 77.46
CompMarkGS
96.09/ / 83,50
186.71 / 61.61
Robustness general quantization. To validate the robustness of our proposed quantization distortion layer (QDL) beyond 3D Gaussian Splatting (3DGS) specific compression, we conduct an additional experiment
general quantization environment. We use the quantization API from PyTorch (Paszke al. 2019) quantize model parameters from float32 to int8 and evaluate the performance on the Mip-NeRt 360 (Barron et al. 2022) dataset with 48-bit setting. As shown in Tab[9] the results demonstrate that while existing methods suffer an average drop in bit accuracy of about 27%, CompMarkGS with applied shows only about a 5% decrease, proving its superior robustness. These findings are consistent with the stable performance of CompMark(iS compared to the 22% average performance drop of existing methods shown in the main paper's s Tab They also align with the results in Tab where applying QDL improves bit accuracy by more than 5% on average. Therefore, we have conprehensively confirmed that QDL is key component that effectively ensures watermark robustness, not only in 3DGS- -DGS-specific compression but also across diverse quantization scenarios.
Table Robustness comparison against general quantization, showing the bit accuracy drop on the Mip-NeRF 360 dataset (48-bit messages) after quantizing models from float32 to int8.
Method
Bit Acc. (% >
PSNR
SSIM
LPIPS 1
WateRF
93.20 69.20
26.09 12.17
0.788 / 0.135
0.260 / 0.610
GaussianMarker
92.49 / 66.02
26.33 / 15.83
0.775 / 0.407
0.282 / 0.588
3D-GSW
91.08 66.20
18.53 / 14.93
0.667 / 0.374
0.322 / 0.662
CompMarkGS
95.59 90.11
26.56 21.73
0.777 / 0.700
0.248 / 0.336
E.4 GENERALITY AND COMPATIBILITY
Robustness to ad versarial attacks. In addition to the rendered image distortions and 3D Gaussian Splatting (3DGS) model attacks discussed in this paper, we evaluate our method's robustness against a more sophisticated, gradient-based adversarial attack. We performed a projected gradient descent (PGD) (Madry et al. 2017) attack specifically targeting the HiDDeN (Zhu al. (018) decoder. As shown in T0 the bit accuracy of existing methods drops to the 50% range after the PGD attack, whereas CompMarkGS maintains a high accuracy of 84.33%. This result demonstrates that our method is highly robust not only to general distortions but also to sophisticated removal attacks, such as PGD attack that directly targets the decoder.
Decoder independence. To demonstrate that our method's robustness not dependent on a spe- cific decoder architecture, we evaluate its performance by replacing the original HiDDeN (Zhu et al.) 2018) decoder with a DINO-based SSL (Fernandez et al., 2022) decoder. The experiment measures the average performance across three datasets (Blender Miilenhaal et al. 2021). LLFF (Mildenhall ett al. 2019), and Mip-NeRF 360 (Barron et al. (022)) using 48-bit messages, comparing the re- sults before and after HAC (Chen al. 2024a) and ContextGS (Wang al. 2024a) compression.
21

---

Published as a conference paper at ICLR 2026
Table 10: Robustness comparison against PGD adversarial attacks. Results are for 48-bit messages, showing bit accuracy before and after the attack targeting the HiDDeN decoder.
Method
Bit Acc. (None)t
Bit Acc. (PGD e 0.1) 1
WateRF
92.01
56,06
Marker
87.95
57.53
3D-GSW
79.25
57.56
CompMarkGGS
94.03
84.33
As shown in Tab IT despite using the SSL decoder, the drop in bit accuracy from compression is negligible at just -0.04% HAC and -0.09% for ContextGS, indicating highly stable performance. Furthermore, our method outperforms all baselines both before and after compression. Specifically, compared to the strongest baseline, GaussianMarker (Huang et al., 2025), our post-compeession bit accuracy is 16% higher under HAC and 5.05% higher under ContextGS. These results confirm that CompMarkGS possesses truly aggoote-a characteristics.
Table 11: Performance comparison with alternative decoder (DINO-based SSL). Results for 48-bit messages, averaged over three datasets, showing performance before and after HAC and ContexIGS compression.
Methods
Accuracy (%)
PSNR
SSIM
LPIPS
HAC WateRF
91.02/ 54.40)
27.36
13.63
0.850 / 0.457
0.174/0.574
HAC GaussianMarker
92.00/ 58.34
27.05
13.54
0.840 / 00460
0.193 /0.571
HAC 3D-GSW
90,96 / 53.48
19.57 / 13.13
0.628 / /0.499
0.295 / 0.552
HAC+ GuardSplat
79.77 52.72
12.28
0.584 00.45
0.417 0.609
HAC CompMarkGS (SSL)
93.54 / 93,50
27.21 27.16
0.847 / 00884
0.190 / 0.192
HAC CompMarkGS (HiDDeN)
95.95 95.92
27.68 27.65
/ 0.852
0.171 0.177
ContextGS WateRF
92.01 /90.66
26.64/ 26.47
0.843 / 0.832
0.183 / 0.185
ContextGS GaussianMarker
91.24 87.95
26.89 26.54
0.839 /0827
0.195 0.200
ContexiCiS 3D-GSW
88.28/ 79.75
19.50 / 19.83
0.627 / 00617
0.294 / 0.299
ContextGS GuardSplat
73.20 / 67.16
16.90 / 16.86
0.628
0.353 / 00.66
ContexIGS CompMarkGS (SSL)
93.09 / 93.00
25.86 25.82
0.829 0.828
0.220 / 0.221
ContextGS CompMarkGS (HiDDeN)
94.36 94.03
27.60 / 27.55
0.845 / 0.844
0.172/0.1 0.17/
E.5 ROBUSTNESS IMAGE DISTORTION COMPARISON
This section provides the detailed quantitative results for the experiment on robustness to image dis- tortion, which visually summarized in Fig the main paper. We evaluate watermark resilience by applying six post-po post-prcesssig distortions to the rendered images: Gaussian noise, rotation, scaling, Gaussian blur, crop, and JPEG compression. dition, both before (left) and after (right) compression. As the results show, our proposed method, CompMarkGS, consistently exhibits superior robustness to existing methods across most distortion and compression scenarios.
details the bit accuracy for each distortion con-
E.6 ROBUSTNESS MODEL DISTORTION COMPARISON
Fig Paggaandd Fig 9 show the bit accuracy under different levels of model distortion. We conduct three model distortions: 1) adding Gaussian noise to all model parameters, 2) randomly removing anchors, proposed method con-
and 3) randomly cloning anchors. Across different distortion strengths, sistently outperforms the baseline. Notably, under prune and clone distortion settings, our method exhibits less performance degradation, owing the incorporation of both pruning and anchor grow- ing during training in CompMarkGS. These results demonstrate that our method achieves superior performance the baseline, even under severe model distortions.
22

---

Published as a conference paper at ICLR 2026
Table 12: Robustness to image distortion before (left) and after (right) compression. Evaluations are performed using 48-bit bit setting, averaged over the Blender, LLFF, and Mip-NeRF 360 datasets. Baselines are tested within an anchor-basee 3DGS framework with HAC and ContextGS compres- sion. The best results are in bold.
Acpumcy(3)
Canssian Noise
Rotation
Sealing
Ganssian Blur
Crop
JPEC Compression
0
(hr/66)
(75%)
0.1)
(40%)
(50% quality)
HACC - WaseRE
91.02/ $4,40
89.75/ 55.90
84.92 75.16
96.17/55.30 55.38
89.33/ 1 56.34
N7.00/
84,00 55.47
HAC - GiussiaMarker
92.00/ 58.34
50.08/ 58.33
58, 75 58.33
13/33/55 58.33
59. 19.08/ 000008550 58.33
62. (8.
58.25 7 58.33
HAC - 3D-GSW
90.96 53.48
89.50/ 52.50
86.07 52.25
M6.42 52.08
86.67/ 52.25
86.92 52550
83.85 53.25
HAC - GuudSplut
79.77/ 52.72
N0.67 550.17
74.42 53.33
51.33/550.55
81,50/ 50.35
65.08 / 505000
74.85/ 52.67
IAC CompMacKGS
95.95 95.92
96.00 95.59
92.25 992008
91.8391667
95.83/ 95.58
90.67/ 99.83
87.75/ $8.83
WEERF
92.01/
91.50
88.00
89:58
92.75/
W9.50
54.58
MassianMarker
91.24
59.08
59.00 58.75
58.92
58.25
3D
$8.28/
$4.42/ 77.08
$1.42
94.33
GoardSplar
73.23/
73.92/
66.67
61.67
CompMarkGS
85.21/
380
(a) HAC compression.
Wart
(b) ContexiGS compression.
Figure 9: Comparison baselines and our method under Gaussian noise, cloning, and pruning. Results averaged over Blender, LLFF, and Mip-NeRF 360 with 48-bit messages.
E.7 PERFORMANCE ACROSS COMPRESSION LEVELS
Compression plays crucial role in determining the trade-off between model size and performance in terms of bit accuracy and rendering quality. F0 shows the relationship among model size, bit accuracy, and rendering quality under two different compression schemes: HAC (Chen et al.) 2024a) and ContextGS (Wang et al., 2024a). Fig I0 indicates that a lower compression level leads to better bit accuracy and rendering quality. Our method consistently outperforms other methods, achieving the highest bit accuracy and rendering quality across varying model sizes. Notably, for achieve bit accuracy of 90% with model size less than 10 MB, while other methods only reach 60% under the same model size. These results highlight the effectiveness and robustness of CompMarkGS.
HAC compression,
23

---

Published as a conference paper at ICLR 2026
Table 13: Robustness to model distortion before (left) and after (right) compression.
Goussian (ccuracy(3)
Prune
Methoos
No Distortion
(o - 0.005)
(50%)
(205))
HAC + WateRF
91.02/ 54.40
81.03/ / 53.38
89.78 54.04
87.33 53377
HAC GaussiaMMrrkrr
92.00/ 58.34
73.18/ 58.35
90.23 58.29
87.90/ 87.89
HAC 3D-GSW
90.96 53.48
80.17/ 53.11
89.62/
86.80/53.18
HAC + GuandSplat
79.77
67.32/ 51.21
76.12/ 56.28
71.25 559.13
HAC CompMarkGS
95.95 99.92
82.13/ 77..3
95.33 95.09
94.67 94,25
ContextOS WaseRF
92.01 / /90.36
82.36/ 79.91
90.70 88.95
88.29/ 86.20
ContestSS MaussianMarker
72.84 71.78
86.05
ContextSS 3D-GSW
88.28/ 79.75
76.94 / 68.55
86.89 /77.99
82.87 72.70
ContextiS GuandSplat
73:20/67..1
63.24 / 59.84
71.39/ 70.11
67.12/ 65.19
ContextSS CompMarkGS
/94.03
87.03/ 83.08
93.37 /93.23
92.38 99..57
25
01
CompliannG LOunt
30-GOW
Wethr
10
28
20
(a) HAC compression.
100%
65%
2c PM
25%
Complauccs
Crrphandd Duu
Graid
30-GOW
GuarsSatt
12
(b) ContextGS compression.
Figure 10: Performance of bit accuracy and rendering quality under different compression levels. A larger model size corresponds to lower compression level. The blue line represents the results of our method. Results represent the average score across Blender, LLFF, and Mip-NeRF 360 datasets using 48- messages.
F COMPUTING RESOURCES
F.I OVERHEAD AND EFFICIENCY OF FREQUENCY-AWARE ANCHOR GROWING
To quantify the practical overhead introduced by FAG, we compare CompMarkGS with and with- out FAG on the Mip-NeRF 360 (Barron et al. 2022 dataset in terms of model size, number of anchors, training time, and rendering speed. As shown in Tab enabling FAG increases the model size and the number of anchors, while the training time grows only slightly. The rendering speed decreases, but remains well above the 30 FPS real-time threshold. Overall, FAG improves rendering quality and watermark robustness at a modest computational cost, preserving the real-time rendering performance of anchor-based 3DGS.
24

---

Published as a conference paper at ICLR 2026
Table 14: Overhead comparison of CompMarkGS with and without FAG on Mip-NeRF 360.
Method
Sizel (MB)
Number of anchors (K)
FPS
Training time] (Min.)
CompMarkGS (w/ FAG)
319.79
766.4 4
62.27
35.26 36.36
CompMarkGSS (w/ FAG)
377.02
906.6
57.34
F.2
REAL-TIME RENDERING PERFORMANCE
We evaluate the rendering performance of our method and baselines (Huang et al. 2025 Jang al, 2024 (2225) by measuring FPS. As shown in T5b our method exceeds the real-time rendering threshold 30 FPS across the Blender (Mildenhall al., 202T), LLFF (Mildenhall et al. 2019), and Mip-NeRF 360 (Barron et al. 2022) datasets. These results demonstrate the practical applicability and rendering efficiency of our proposed CompMarkGS.
Table 15: FPS results for each of the Blender, LLFF, and Mip-NeRE 360 datasets. Based on 48-bit messages, results averaged with both HAC and ContextGS after compression.
FPS
Methous
Blender
LLFF
Mip NeRR 360
WateRF
199.30
19.31
41.98
GaussianMarker
166.45
16:24
28.54
3D-GSW
220.60
22.67
50.64
GuardSplat
207.56
21.93
41.28
CompMarkGS
230.39
35,30
67.58
G ADDITIONAL QUALITATIVE RESULTS
Fig II visualizes the intermediate state during the frequency- aware anchor growing (FAG) training phase. We compare the fregefrryeency SSIM-based error map, which highlights candidate regions, with the spatial distribution of new anchors produced by FAG. New anchors do not densely cover the entire error map, but instead appear selectively in areas where high-frequency errors are large enough to exceed the gradient threshold high This indicates that FAG does not blindly increase the number of anchors, but focuses anchor growth on structural details that still require refinement.
Ground Truth
High-frequancy 3SIM-based Error Map
Error map with new anchar (FAC)
112
Figure 11: Visualization of an intermediate state of frequency- aware anchor growing (FAG) during training. For the bonsai (top) and garden (bottom) scenes in the Mip-NeRF 360 dataset, we visualize the ground-truth image, the high-frequency SSIM-based error map, and the same error map with anchors (green). New anchors are mainly added along sparse high-frequency structures with large SSIM error, rather than uniformly over the image, demonstrating that FAG selectively refines regions that still exhibit high rendering error.
Fig 22 through Fig 20 visualize all results rendered after compression using method with HAC (Chen et al. 2024a) and ContextGS (Wang et al., 2024a), along with the difference (x5) be- tween the original images and the watermarked images.
25

---

Published as a conference paper at ICLR 2026
ContextGS + Ours
HAC Ours
Bit Acc 87 50 PSNR : 24.83
Bit Acc: 96.87 PSNR 27.16
Bit Acc: 100.0 PSNR: 25.30
Bit Acc. 85.41 / /PSNR 27.09
Bit Acc 100.0 PSNR -30.9
Acc: 100.0/ PSNR 33.61
Bit Acc 1 PSNR: :29.08
BlI Acc 97.91 : 32.55
PSNR:
PSNR
Bit Acc 96.87 PSNR: 21.80
Blt Acc: 90.62 PSNR 21.28
Acc 95.83/ / PSNR: 21.94
Bit Acc: 95 95.83 PSNR 21
Bit Acc 100.0/ PSNR : 26.80
Bit Acc: 100.0 PSNR 27.82
BR Acc 100.0 PSNR: 26.80
Bit Apc 100.0 100.0/PSNT PSNR 27.33
Bit Acc: 96.87 PSNR 27.49
100.0 0
Acc: 100.0/ PSNR 27.44
Bit Blc PSNR 30.59
BR Acc 100.0 PSNR: 32.46
100.0
Acc: 100.0
Bit Acc : 87.50 PSNR : 23.00
Bi ACD: 90.62/ PSNR 28.60
Bit Acc: 93.75 33.75/PSNR PSNR 23.19 23.19
Bit Acc: 95.83/ PSNN 28.77
96.87 25.48
Acc / PSNN:
Rendering quality various rendering outputs generated by our method on the Mip- NeRF 360 dataset. We show the differences (x 5). The closer to white, the greater the dis- crepancy between the ground truth and the rendered image. The results were obtained using 32-bit messages after compression.
Figure 12:
26

---

Published as a conference paper at ICLR 2026
ContexIGS + Ours
HAC Ours
Bit Acc 96.87 PSNR: 23.28
Bit Acc 96.87 PSNR 22.29
Acc: 96.87 PSNN: 23.73
Bit Acc: 96.87 PSNNR 23.03
Bit Acc: 100.0 PSNR: 24.84
Acc: 100.0 PSNR: 27.73
Bit Acc: 100.0/ PSNR: 25.11
Bit Acc: 100.0 PSNR: 28.15
Bit Acc 96.87 PSNR 28.33
100.0 29.54
Aoc: 100.0 PSNR:
PSNR: 28.96
PSNR:
Acc 100.0 PSNR: 28.76
100.0
Acc 100.0 PSNR: 28.52
Bit Acc: 100.0 PSNR: 18.32
Bit Acc: 100.0 100.0/PM PSNR: 18.59
Acc: 100.0 PSNR: 18.21
Bit Acc 100.0 0/ PSNR: 18.81
Bit Aco: 90.62/ PSNR: 21.45
Bit Acc 84.37 PSNR :18.37
Bit Acc: 100.0 PSNR: 21.62
Bit Acc 90.62/ PSNR: 18.67
100.0 32.73
100.0
Acc: 100.0
100.0
Bit Acc: 100.0 PSNR: 27.
Bit Acc 100.0/ PSNR: 25.21
Bit Acc: 100.0 PSNR: 27.78
Bit Acc: 100.0 PSNN: 25.31
Figure 13: Rendering quality of various rendering outputs generated by method the LLFF dataset. We show the differences (x 5). The closer it is to white, the greater the discrepancy between the ground truth and the rendered image. The results obtained using 32-bit messages after compression.
27

---

Published as a conference paper at ICLR 2026
ContextGS Ours
HAC Ours
Bit Aco 100.0 PSNR
Bit Acc: 100.0/ PSNR: 32.72
Acc: 100.0 PSNR
Bit Acc 100.0/ PSSRR 31.59
Bit Acc: 100.0 PSNR 28.75
Bit Acc 96.87 PSNR:
Acc 100.0/ PSNR: 28.31
Acc: 100.0/ PSNR:
Bit Acc: 96.87 PSNR 335.28
Bit Acc: 90.62 90.62/PSNR PSNR: 33.00
Bit Acc: 100.0 PSNR: 33.65
Bit Acc: 93.75/ PSNR: 32.17
35.76
Bit Acc 93.75 PSNR : 35.60
Bit Acc 90.62
10..2//SNRRR PSNR: 27.79
Bit Acc 100.0 /SS.R/PSNR: PSNR: 34.34
Acc: 93.75 PSNR: 27.52
Bit Acc 96.87 PSNR 33.37
Bit Acc 87.50 PSNR 30.11
Acc: 100.0 PSNR 32.38
Bit Acc: 96.87 87/ PSNR 29.88
Bit 83.75 PSNR :35.05
93.75 32.67
Acc: 75.00 : 26.88
Acc: PSNR:
Bit Acc: 96.87/ PSNR: : 31.33
Bit Acc 100.0 PSNR: 29.77
Acc 100.0 PSNR: 30.64
Acc: 100.0 PSNR: 29.16
Figure 14: Rendering quality of various rendering outputs generated by our method on the Blender dataset. We show the differences (x 5). The closer is to white, the greater the discrepancy between the ground truth and the rendered image. The results were obtained using 32-bit messages after compression.
28

---

Published as a conference paper at ICLR 2026
ContextGS + Ours
HAC Ours
Bit PSNR 25. 12
BR Acc PSNR 27.31
100.0 PSNR:
Aco: 87.50/ PSNR: 27.18
Bit Acc 91 PSNR 33036
Bit Acc 100.0 PSNR: 30.61
Bit Acc: 100. PSNR: 28.63
Bit Acc 100.0 / PSNR: 30.91 300.91
Bit Acc 97.9 PSNN -29.2
BR Acc: 100.0 PSNR: 28.89
ACL .1.91/ PSNR 29.28
B4 Acc 97.91
PSNN: 28.64
Bit Acc 95.83 PSNR 21.13
Acc 83 PSNR: 22.02
Bit Acc: 97.91 PSNR : 26.49
Bit Acc: 100.0 PSNR :27.49
100.0/PSNR
Acc: 100.0 PSNR: 26.79
Bit Acc 97.91 /7.11/PNNR PSNR 27.39
Bit Acc 100.0 0 PSNR 53
Bit Acc 95.9 PSNR 31.25
BiI Acc: 100. PSNR: 27.38
Bit Acc: 97.91 91/ PSNR: 30.80 3066
Bit AcD: 97.7 91 PSNR 30.80
Bit Acc 97 91 PSNR: 36.46
Bit Acc: 100.0 PSNR 29.12
Bit Acc: 97.91 : 31.26
PSNR
PSNR
Bit Ace: 83 PSNR 25.76
Bit Acc: 89.58 PSNR: 24.70
Bit Acc: 95.83 PSNR: 25.55 25.59
Bit Acc: 95.83 83/ PSNR: 24.78
Figure 15: Rendering quality of various rendering outputs generated by method the Mip- NeRF 360 dataset. We show the differences (x 5). The closer it is to white, the greater the dis- crepancy between the ground truth and the rendered image. The results were obtained using 48tbit messages after compression.
29

---

Published as a conference paper at ICLR 2026
ContexIGS + Ours
HAC Ours
Bit Acc 91.66 PSNR: 23.37
Bit 95.83 PSNR 22.06
Acc: 97.91 PSNN: 23.68
Bit Acc: 97.91 /SNNR: 22.77
Bit Acc: 97.91 PSNN:: 24.76
Bit PSD.0 28.07
Bit Acc: 97.91 17.91/PP /SSNR: 24.64
Bit 100.0 100.0/PSNR PSNR: 28.28
Bit Acc 95.83 PSNR 28.24
100.0 29.39
Aoc: 100.0 PSNR: 28.33
PSNR:
PSNR:
Acc 97.91 PSNR: 28.18
100.0
Acc 97.91 PSNR: 28.40
Bit Acc: 97.91 PSNR: 18.27
Bit Acc: 97.9 91 PSNR: 18.58
Acc: 100.0 PSNR: 18.33
Bit Acc 100.0 PSNR: 18
Bit Aco: 97.91 PSNR: 21.38
Bit Acc: 83.33 PSNR: 18.36
Bit Acc: 97.91 PSNN: 21.58
Bit Acc 93.75 PSNN 18.45
95.83 32.36
Acc: 100.0 PSNR
Bit Acc: 95.83 PSNR: 27.69
Bit Acc 97.91 PSNR: 25.31
Bit Acc: 97.91 PSNR: 27.63
Bit Acc: 97.91 91/ /SNNR: 25.03
Figure 16: Rendering quality of various rendering outputs generated by method the LLFF dataset. We show the differences (x 5). The closer it is to white, the greater the discrepancy between the ground truth and the rendered image. The results obtained using 48-bit messages after compression.
30

---

Published as a conference paper at ICLR 2026
ContextGS + Ours
HAC
Ours
Bit Acc 96.83 PSNR 29.05
Bit Acc 95.83 PSNR: 28.85
Bit Acc: 95.83 : 31.17
: 97.91 PSNNS: 31.52
Bit Acc: 0.9583/ PSNR 22.13
Bit Acc 93.75 PSNR: 26.63
Bit Acc: 97.91 PSNR: 28.23
Bitt :
91.099..6 66
PSNR: 26.74
Bit Acc: 93.75/ PSNR 34.93
Bit Acc 97.91 PSNR 35.06
Bii Acc: 95.83 : 33.74
Bit Acc: 97.91 PSSNR 34.02
Bit Acc: PSNR: 34.47
Bit Acc: 89.56 PSNR: 27.73
Acc: 89.58 PSNR: 33.45
Acc: 91.66 86 PSNR: 27.49
Bit Acc 95.83/ PSNR 32.80
Acc: 93.75 PSNR 29.89
Acc: 100.0/ PSNR: 32.14
Acc: 91.66 PSNR:
Bit Acc: 93.75 PSNR: 34.83
Bit Acc: 95.83/ PSNN: 32.06
Bit Acc: 91.66 16.6// PSNR 33.97
Bit Acc: 93.75
2.755/PSRR: PSNR: 31.59
Bit Acc: 97.91 PSNR: :0.090000
Bit Acc: 95.83 PSNR: 29.55
Acc: 95.83 PSNR 30.38
AcC: 93.75 PSNR: 29.08
Rendering quality of various rendering outputs generated by our method on the Blender dataset. We show the differences (x 5). The closer it is to white, the greater the discrepancy between the ground truth and the rendered image. The results were obtained using 48-bit messages after compression.
Figure 17:
31

---

Published as a conference paper at ICLR 2026
ContextGS Ours
HAC Ours
Bit Acc 85.41 PSNR : 24.96
BR Acc 87. 50 PSNR
PPN50/SSR 26 86
Bit Acc: 100.0 100.0/POO /SSNR 25.34
BAt Acc: 87.50 07.50/PE5 PSNN: 27.05
Bit Acc 95.83 PSNR 29.72
Bit Acc
PSNR: 32.51
Bit 100.0 :
Acc 91 PSNR: 32.41
PSNR
PSNR
PSNR:
Bit Acc 93.75 PSNR 21.69
BR ACp: 97.91 PSNR: 21.20
Acc: 95.83 PSNR: 21.99
Bit Acc 95.83 PSNR 21.33
Bit ACc: 96 PSNR 26. $6.56
Bit Acc: 100.0 PSNR 27.50
BIt ADC 97.91 PSNN 26.62
Bit Acc: 100.0 PSNR: : 27.36
Bit Acc: 100.0 PSNR : 27.17
ACD PSNR 31.14
Acc: 100.0 PSNR 27.24
Acc: 100.0 PSNR 30.35
97.91
97.91
100.0/
Bit Acc: 91.66 PSNR 22.92
Bit Acc: 97.91/ PSNR 28.48
Bit Acc: 93.75 PSNR 23.11
Bit Acc: 97.91 PSNR: 28 86
Bit Acc: 95.83/ PSNR: 25.30
Bit Acc: 85.41 PSNR 24.55
Bit Acc 97.91 91/ PSNN 25.63
Acc 95.83 PSNR: 24.95
Figure 18: Rendering quality of various rendering outputs generated by our method on the Mip- NeRF 360 dataset. We show the differences (x 5). The closer to white, the greater the dis- crepancy between the ground truth and the rendered image. The results were obtained using 64-bit messages after compression.
32

---

Published as a conference paper at ICLR 2026
ContexIGS + Ours
HAC Ours
Bit Aco 93.75 PSNR: 23.27
Bit Acc 95.31 PSNR: 22.43
Acc: 96.87 /SNN: 23.88
Bit Acc 95.31 PSNN 22.92
Bit Acc: 98.43 PSNR: 24.75
Bit 98.43 PSNR: 27.41
Bit Acc: / PSSN: 24.96
Acc: 98.49 / PSNR: 27.74
Bit Acc 98.43 PSNR 28.12
96.87 29.24
Aoc: 95.31 PSNR 90
PSNR:
96.43 PSNR:
Acc 96.87 PSNR: 28.47
100.0
Acc 100.0 PSNR: 28.66
Bit Acc: 98.43 PPNN: 18.32
Bit Acc: 98.43/ PSNR: 18.60
Acc: 98.43 PSNN:: 18.32
Bit Acc 98.43 43/ PSNN 18.94
Bit Aco: 96.87/ PSNR: 21.41
Bit Acc: 92. 18 PSNR: 18.42
Bit Acc: 18843/PSNR 21.52
Bit Acc: 93.75 / PSNR: 18.67
96.87
Acc PSNR: 31.55
Bit Acc: 96.87 PSNN: 27.64
Bit Acc: 98.43 PSNR: 25.11
Bit Acc: 98.43/ PSNR: 27.77
Bit Acc: 98.43 PSNR: 25.22
Figure 19: Rendering quality of various rendering outputs generated by method the LLFF dataset. We show the differences (x 5). The closer it is to white, the greater the discrepancy between the ground truth and the rendered image. The results obtained using 64-bit messages after compression.
33

---

Published as a conference paper at ICLR 2026
ContextGS Ours
HAC Ours
Bit Acc 96 PSNR
Bit Acc 96.87 PSNR: 31.75
Acc: 06.6 PSNR: 31.12
Bit 92.18 PSSNR 31.48
Bit Acc 93.75 PSNR 28.19
Bit Acc
PSNR: 26.40
Acc 90.82 PSNR: 28.15
Acc:
PSNR:
Bit Acc: 85. 93 PSNR :ANN:33.66 33.61
Bit Acc: 76.56 PSNR: 32.00
Bit Acc: 25.83/ PSNR: 33.42
Bit Acc: 93.75 PSNR: 32.15
Bit Acc 93.75 PSNR : 33.58
Bit Acc 89.09/ PSNR: 27.64
Bit Acc 92.18 12//// 33.24
33.22
Acc: 87.50 PSNR: 27.50
Bit Acc: 93.75 PSNR 32.30
Bit Acc 79.66
PSNR 29.59
Bit Acc: 97.91 PSNR 32.09
Bit Acc: 89.50 PSNR 29.70
Bit PSNR 33326
84.37 PSNR:
Acc: 87.50/ : 32.81
Acc: PSNR:
Bit Acc: 93.75 PSNR: : 30.51
Bit Acc 96.87 PSNR 29.29
Acc: 90.62/ /2/ PSNR 30.35
Acc: 95.31 PSNR: 28.94
Figure 20: Rendering quality of various rendering outputs generated by our method on the Blender dataset. We show the differences (x 5). The closer is to white, the greater the discrepancy between the ground truth and the rendered image. The results were obtained using 64-bit messages after compression.
34


Reviews:
[{"review_id": "qhneyEAfy1", "reviewer": "Reviewer_YKCM", "summary": "This paper presents a novel compression-tolerant anchor-based framework for 3DGS watermarking that protects the ownership of 3DGS model. The authors focus on preserving watermark integrity and rendering quality effectively both before and after compression. The framework is evaluated on multiple datasets, demonstrating that it can achieve state-of-the-art performance.", "questions": "See the weakness", "limitations": "", "rating": 6, "confidence": 4, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "1.\tA compression-tolerant anchor-based watermarking method is proposed to embed a learnable watermark embedding feature into the anchor feature, which improves robustness against model compression.\n2.\tThe authors perform experiments on different datasets and investigate robustness by measuring bit accuracy under various distortions before and after compression.", "weaknesses": "1.\tWhat is the true innovation of the quantization distortion layer? Is it merely a transfer of technique from the 3DGS compression method?\n2.\tWhat is the true advantage of HSV loss? Can you compare HSV loss with the effects of using perceptual loss?\n3.\tThe experiments were primarily validated on anchor-based 3DGS. Does it exhibit the same performance for standard 3DGS?\n4.\tIn Table 2, for model distortion robustness, how does the method perform under additional 3D geometric attacks, such as 3D translation, rotation, or crop-out (which is evaluated in GaussianMarker) ?\n5.\tThe text in Figure 2 may need to be revised for clearer expression.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "qdhHmpENjf", "reviewer": "Reviewer_n6dB", "summary": "Targeting on copyright protection of 3D Gaussian Splatting (3DGS) models after compression, this paper proposes an anchor-based 3DGS watermarking framework, CompMarkGS, which directly adds learnable watermark-embedding features to the anchor features to enhance robustness against quantization. During training, a Quantization Distortion Layer (QDL) injects uniform noise with a learnable scale to explicitly simulate quantization rounding errors, aligning the model to be robust against post-compression. In parallel, a Frequency-Aware Anchor Growth (FAG) strategy adds anchors only in high-frequency error regions to balance visual quality, and an HSV loss is used to suppress color artifacts. Experimental results under anchor-based pipelines on Blender, LLFF, and Mip-NeRF360 evaluate performance before and after two mainstream quantization-based compressors (HAC, ContextGS), showing advantages over WateRF, GaussianMarker, 3D-GSW, and GuardSplat in both bit accuracy and visual quality; the trend holds across different message lengths and when swapping in an alternative decoder (self-supervised DINO). It is claimed that this is the first work to systematically address quantization-compression robustness for 3DGS watermarking with end-to-end validation.", "questions": "The frequency-aware anchor growth (FAG) sounds effective, but I’d like a more direct view of its costs and benefits. Could you add a page comparing model size, the number of anchors/Gaussians, and rendering latency (FPS or ms/frame) with and without FAG, and include a few figures showing where the added anchors are placed (aligned with your error/frequency heatmaps)? This would help assess its practical engineering overhead.\n\nFor “unknown/recompression” scenarios, double compression and bitrate switching across platforms are common in practice. I suggest adding a set of black-box re-compression experiments (e.g., compress with ContextGS then HAC, or multiple bitrate chains within the same compressor) to examine changes in bit accuracy and visual quality; also include stronger model-level attacks to help readers understand the method’s resilience under less friendly pipelines.\n\nRegarding baselines, some methods need to be ported from their native representation space to the anchor-feature space. To avoid bias from implementation shifts, could you report the “native setting” (as faithful to the original paper as possible) and the “compatibility-modified” version separately, with key hyper-parameters and implementation details? This would make reproduction easier and fairness easier to judge.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "The paper injects learnable quantization noise into anchor features via QDL, bringing the compressor’s distortion statistics forward into training, which is distinct from prior differentiable perturbation layers that only model image-domain distortions. By focusing squarely on robustness to quantization-based compression, the proposed FAG separates, in the frequency domain, the tension between visual enhancement (high frequencies) and watermark carrying (low-frequency LL), making apt use of anchor-based 3DGS structural priors. Overall, it is a new combination of structural choice + distortion modeling + frequency-aware growth. \nThe work offers comprehensive validation across three datasets and two compressors, evaluates both pre/post compression, covers image- and model-domain perturbations, varies message length, and tests multiple decoders; ablations show QDL/FAG/HSV each contributes substantially. After ContextGS/HAC compression, it outperforms strong baselines in bit accuracy and PSNR/SSIM. \nIn general, the method diagram and the training/extraction flow are explained clearly. As the anchor-based designs and compression are mainstream in the 3DGS ecosystem, addressing compression-induced watermark failure carries clear practical importance.", "weaknesses": "First, compression generalization could be strengthened. The current evaluation mainly covers HAC/ContextGS. The authors may consider adding different quantization bit-widths, per-channel/per-layer non-uniform quantization, and compressors with error feedback or post-entropy coding, to better match industrial diversity. Also, the QDL calibration strategy and mismatch-sensitivity analysis need to be reported for each setting. \nRegarding baseline adaptation, GuardSplat should be moved from the SH space to an anchor-feature bias, which may introduce out-of-domain effects. It would help to report the native setting and a compatibility setting separately, or add a comparison axis of “native 3DGS + native compression”. \nMore targeted model-domain attacks and structural perturbations may be added to assess the limits of QDL/FAG under stronger adversaries.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "OwSmQaKEqS", "reviewer": "Reviewer_MFbA", "summary": "This paper proposes CompMarkGS, a watermarking method for 3D Gaussian Splatting (3DGS) designed to remain robust under quantization-based compression. The method builds upon anchor-based 3DGS architecture by embedding a learnable watermark feature into anchor attributes, which are then processed through MLPs to generate Gaussian parameters. To preserve watermark integrity during compression, the authors introduce a Quantization Distortion Layer (QDL) that simulates quantization noise during training. Additionally, a Frequency-Aware Anchor Growing (FAG) strategy selectively densifies Gaussians in high-frequency regions to mitigate quality degradation, and an HSV loss addresses color artifacts. Experiments on multiple datasets demonstrate that the method maintains high bit accuracy and rendering quality after compression with various quantization schemes, outperforming existing 3DGS watermarking baselines that suffer severe degradation under compression.", "questions": "Q1: How do you map 3D Gaussians to 2D high-frequency pixels? When multiple Gaussians project to one pixel, which determines labeling? When an anchor's K Gaussians partially overlap high-frequency regions, how is growth decided? What are the coverage rates and how sensitive is performance to different mapping strategies?", "limitations": "", "rating": 2, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "S1: The paper identifies a critical gap by tackling watermark robustness against quantization-based compression, which is essential for real-world deployment but has been overlooked by existing methods that focus primarily on image-domain distortions.\n\nS2: The paper validates the method across multiple datasets, compression schemes, image distortions, model distortions, and message capacities, demonstrating broad applicability and robustness.\n\nS3: The method maintains high rendering quality while embedding watermarks, achieving competitive PSNR and SSIM scores compared to baselines, demonstrating that the watermarking process does not significantly degrade the visual fidelity of 3DGS models.", "weaknesses": "W1: The core contribution, the Quantization Distortion Layer (QDL), is a straightforward application of differentiable distortion layers from digital watermarking and quantization-aware training from model compression. Injecting noise during training to simulate downstream distortions is standard practice in watermarking and QAT literature. The adaptation merely changes the noise source from JPEG/cropping to quantization, which is incremental rather than novel. \n\nW2: The paper does not explicitly state whether watermark embedding requires training a new model for each scene or uses a universal encoder. If the method requires per-scene optimization, then for a content creator with 1000 scenes, they must train 1000 separate watermarked models. What is the amortized training cost per scene?\n\nW3: The paper does not clearly specify how watermark messages are sampled during training. Specifically, it remains unclear whether each scene trains with a single fixed message throughout all 30,000 iterations or different random messages sampled at each iteration. If the method requires training each scene with a predetermined fixed message, this introduces significant scalability concerns for real-world deployment.\n\nW4: The QDL (Eq. 4) uses uniform random noise U(-1/2, 1/2)·q_i with per-anchor independent sampling to simulate quantization errors. However, real compression methods (HAC and ContextGS) employ non-uniform quantization with spatial dependencies. This mismatch raises questions about whether the watermark is actually robust to real compression or merely to the specific noise pattern seen during training.\n\nW5: Technically incorrect use of SSIM in Equation 5. The paper computes \"pixel-wise SSIM\" as P_error(p) = 1 - SSIM(I_hf(p), I'_hf(p)), which fundamentally misunderstands SSIM. The SSIM operates over local windows, not individual pixels. Computing SSIM on single pixel values is meaningless and violates the metric's core design. This error propagates through the entire FAG strategy, invalidating the median-based thresholding mechanism that relies on P_error(p).\n\nW6: The paper uses DWT for watermark extraction but switches to DFT for high-frequency detection without justification. More critically, the claimed separation between \"low-frequency watermark\" and \"high-frequency quality enhancement\" is contradictory: all anchor features (including those from FAG) contain the watermark via f^w = f + tanh(f_wf) (Eq. 3), and the resulting Gaussians affect all frequency bands. If FAG-grown anchors in high-frequency regions also embed watermarks in low frequencies, how does this resolve the claimed conflict? The core motivation for FAG appears flawed.\n\nW7: The binary masks M_c(p) are constructed based on whether pixels fall within predefined hue ranges, but the loss penalizes all pixels within these ranges regardless of whether they represent artifacts or legitimate content. A genuinely red pixel in both the rendered and ground truth images still contributes to L_hsv, which seems to be incorrect. Additionally, it remains unclear whether |Ω| in Equation 8 represents total pixels or only those where M_c(p)=1. Most critically, Table 5 shows that removing L_hsv only degrades LPIPS by 0.002, suggesting negligible practical benefit despite the added complexity.\n\nW8: While Appendix E.3 tests one pruning-based method (LightGaussian), the main evaluation (Table 1) focuses exclusively on two quantization schemes from the same architectural family (HAC and ContextGS), both of which are anchor-based compression methods with similar quantization mechanisms. Other vector quantization methods mentioned in related work (Lee et al., 2024a; Navaneet et al., 2024) remain untested, limiting claims about generalizability across diverse compression paradigms.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "UphoDcBvGG", "reviewer": "Reviewer_tMZM", "summary": "This paper proposes CompMarkGS, a watermarking method for 3D Gaussian Splatting (3DGS) that is specifically designed to remain robust under quantization-based compression. The method leverages anchor-based 3DGS, embedding watermarks into anchor features rather than direct Gaussian attributes. Key technical contributions include: (1) a quantization distortion layer (QDL) that simulates quantization noise during training, (2) a frequency-aware anchor growing (FAG) strategy that selectively densifies high-frequency regions, and (3) an HSV loss to mitigate color artifacts. Experiments demonstrate robustness to compression and various attacks.", "questions": "## Questions\n\n1. What is the relationship between noise magnitude in QDL and actual compression distortion?\n\n2. CompMarkGS extracts watermarks from rendered images, but can the message be directly from the 3D Gaussians? What if adversaries extract and reuse anchor subsets without rendering? \n\n3. What happens if adversaries know watermarks are embedded in anchor features and specifically target them, such as adding noise to anchor features, or re-training MLPs?\n\n4.  In Appendix E, can you explain the difference between the robustness toward pruning and quantization? What can be the key property against such two compressions, and why can CompMarkGS outperform the baselines? In addition, the baselines also show some robustness towards these two compressions, which show over 90% accuracy.", "limitations": "", "rating": 6, "confidence": 5, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "## Strengths\n\n1. The paper addresses a critical gap in 3DGS watermarking - robustness to model compression. As the abstract correctly notes, existing watermarking methods fail dramatically under quantization-based compression, making this a timely and valuable contribution.\n\n2. The choice of anchor-based 3DGS for watermarking is well explained - the implicit representation through MLPs provides additional security compared to direct attribute modification. The quantization distortion layer can adapt differentiable distortion layers to the 3DGS compression context.\n\n3. Well-structured paper with clear motivation and problem statement", "weaknesses": "## Weaknesses\n\n1. The method requires a pre-trained HiDDeN decoder, which is a significant limitation and can be vulnerable if any malicious user applies a specific adversarial attack specially effective against the HiDDeN decoder.\n\n2. The choice of the decoder is basically following the current mainstream 3DGS watermark decoder, although the paper tests with the SSL decoder, but it underperforms with the HiDDeN decoder. The contribution of this work on the message decoding side is trivial.\n\n3. At the message embedding side, the anchor-based hiding is built on top of the While the frequency-based growing is similar to the Frequency Guided Densification (FGD) in 3D-GSW. So, although technically the CompMarkGS sounds, it still relies on the existing well-established technology of Scaffold-GS[1] and 3DGSW[2].\n\n4. No capacity analysis. What's the theoretical maximum bit length? Is it limited by the pre-trained message decoder?\n\n[1] Scaffold-GS: Structured 3D Gaussians for View-Adaptive Rendering\n\n[2] 3D-GSW: 3D Gaussian Splatting for Robust Watermarking", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)