All That Glitters Is Not Gold: Key-Secured 3D Secrets within 3D Gaussian Splatting
Authors: Yan Ren
Shilin Lu
Adams Wai-Kin Kong
Venue: ICLR 2026 Poster (2026)
Keywords: Gaussian Splatting
3D Steganography
Primary area: alignment, fairness, safety, privacy, and societal considerations

Abstract: Recent advances in 3D Gaussian Splatting (3DGS) have revolutionized scene reconstruction, opening new possibilities for 3D steganography by hiding 3D secrets within 3D covers. The key challenge in steganography is ensuring imperceptibility while maintaining high-fidelity reconstruction. However, existing methods often suffer from detectability risks and utilize only suboptimal 3DGS attributes, limiting their full potential. We propose a novel end-to-end key-secured 3D steganography framework (KeySS) that jointly optimizes a 3DGS model and a key-secured decoder for secret reconstruction. Our approach reveals that Gaussian attributes contribute unequally to secret hiding. The framework incorporates a key-controllable mechanism enabling multi-secret hiding and unauthorized access prevention, while systematically exploring optimal attribute update to balance fidelity and security. To rigorously evaluate steganographic imperceptibility beyond conventional 2D metrics, we introduce 3D-Sinkhorn distance analysis, which quantifies distributional differences between original and steganographic Gaussian parameters in the representation space. Extensive experiments show that our method achieves state-of-the-art performance in 3D reconstruction while ensuring high levels of steganographic security. The framework is highly efficient and readily extensible to multi-GPU training. Our code will be publicly available.

Published as a conference paper at ICLR 2026
ALL THAT GLITTERS IS NOT GOLD: KEY-SECURED 3D SECRETS WITHIN 3D GAUSSIAN SPLATTING
Yan Ren, Shilin Lu & Adams Wii-Kin Kong
Nanyang Technological University Singapore
ABSTRACT
Recent advances in 3D Gaussian Splatting (3DGS) have revolutionized scene re- construction, opening new possibilities for 3D steganography by hiding 3D se- crets within 3D covers. The key challenge in steganography is ensuring impercep- tibility while maintaining high-fidelity reconstruction. However, existing meth- ods often suffer from detectability risks and utilize only suboptimal 3DGS at- tributes, limiting their full potential. We propose a novel end-to-end key-secured 3D steganography framework (KeySS) that jointly optimizes 3DGS model and a key-secured decoder for secret reconstruction. Our approach reveals that Gaus- sian attributes contribute unequally secret hiding. The framework incorporates a key-controllaale mechanism enabling multi-secret hiding and unauthorized ac- cess prevention, while systematically exploring optimal attribute update bal- ance fidelity and security. To rigorously evaluate steganographic imperceptibility beyond conventional 2D metrics, we introduce 3D-Sinkhorn distance analysis. which quantifies distributional differences between original and steganographic Gaussian parameters in the representation space. Extensive experiments show that our method achieves state-of-the the--rt performance in 3D reconstruction while en- suring high levels of steganographic security. The framework is highly efficient and readily extensible to multi-GPU training. The code and dataset are released at https: / /ttp://gttttt com Paape/ /KeySs.
INTRODUCTION
Steganography (Cheddad et al., 2010; Hu et al., 2024; Yu al., 2023) constitutes security method- ology that conceals secret information within seemingly innocuous carriers such as images (Kadhim et al., 2019; Hamid al., 2012; Subramanian al., 2021), text (Majeed et al., 2021; Delina, 2008; Wu et al., 2024), audio (Dutta et al., 2020; Djebbar et al., 2011; 2012) and videos (Kunhoth et al., 2023; Mou et al., 2023; Liu et al., 2019; Sadek et al., 2015), which has demonstrated widespread applications in copyright protection (Megías et al., 2021). secure digital communications (Vargh- ese & Sasikala, 2023), and e-commerce systems (Kumbhakar et al., 2023). The rapid advancements in 3D reconstruction technologies, such nerual radiance fields (NeRF) (Gao al., 2022; Bian et al., 2023; Metzer et al., 2023) and 3DGS (Fei et al., 2024; Qin et al., 2024; Yu et al., 2024), have catalyzed the development of 3D steganography, which has emerged as a promising paradigm for safeguarding 3D digital assets (Girdhar & Kumar, 2018; Zhang et al., 2023; Zhou et al., 2021; Zhu al., 202 l). Analogous conventional steganographic techniques. 3D steganography aims to ensure that both the existence and content of secret messages remain imperceptible to unauthorized observers while maintaining reliable recovery.
Despite advancements in 3D steganography with the emergence of 3DGS, existing 3DGS-bass based methods still face substantial limitations in practical applications. GS-Hider (Zhang et al., 2024) modifies the standard 3DGS pipeline for the secret embedding: the coupled color features are uti- lized to replace the standard spherical harmonics (SH) coefficients and a scene decoder is introduced to replace standard rendering, introducing deviations from the standard GS pipeline (Figure 1(a)). While this approach achieves high fidelity for both cover and secret scenes, these modifications introduce noticeable artifacts that may raise suspicion among unauthorized users, ultimately com- promising the system's 's imperceptibility and security. WaterGS (Guo et al., 2024) enhances imper- ceptibility through importance-grader SH encryption and autoencoder-assisted opacity mapping.

---

Published as a conference paper at ICLR 2026
Scene Decoder
oxt action
Cover 3D Scene
plly Files coupled colar features
Message Decoder
extraciion
Scone1
Secret 3D Scone2
Files
(h)
rendering
SHI
Er -DeDrppetitonn
SH-
rendering
opacity
AutoFrroder
opaciyy
muttipla sceness?
Dijointed Trainice
ply with standard fewturen
rendering
ail features
key?
rendering
Secret Scene
Key- Decoder
key2
standard
Secrul 3D Scare2
rendering
key-
rendering
standard
Cover 3D Scone
Figure 1: Compared to existing methods like (a) GS GS-Hider (Zhang et al., 2024) and (b) Wa- terGS (Guo et al.. 2024), (c) KeySS maintains the standard 3DGS format compatibility while achiev- ing superior performance through fully exploiting inherent features for fidelity and implementing key-controllable scheme that enables both multi-secret hiding and defense against incorrect keys.
Secret
Hide
Opacity=
Scalewo"
PositionsO
SHeO
Reveal
Opacitye1
Scale=1
Rotations1
Positions!
SH
Figure 2: 3D Gaussians provide rich steganographic potential through multiple attributes: opacity, scale, rotation, position, and spherical harmonics (SH). However, naive approaches that simply zero specific attributes hide secrets pose fundamental security risks. The presence of hidden content can be easily detected by simply restoring the zero-value attribute, instantly revealing the hidden content. This limitation motivates our exploration of optimal for both effective hiding and security.
However, the separate concealment of SH coefficients and opacity results in a disjointed, non-end- to-end pipeline, limiting practical deployment. Additionally, the complexity of its secret embedding process prevents the encoding of multiple secret scenes within a single cover scene, reducing its flexibility and practicality real-world scenarios.
To overcome these challenges, we introduce Key-Secured 3D Steganography (KeySS), a novel framework that directly transforms cover 3D Gaussians secret 3D Gaussians while preserving standard attribute formats and rendering processes, Our approach integrates seamlessly with exist- ing 3DGS pipelines while providing robust security through key-controlled mechanism without compromising visual fidelity. This key-control is critical for practical scenarios such as multi-user access, where different users retrieve distinct secrets from the same cover using unique keys, and secure content sharing, enabling selective disclosure in collaborative environments. By guarantce- ing privacy and flexibility, KeySS opens opportunities for applications like personalized AR/VR experiences, secure 3D asset distribution, and controlled access in cloud-based rendering systems.
Our comprehensive analysis reveals a critical insight: Gaussian attributes contribute unequally to steganographic effectiveness all that glitters is not gold. As demonstrated in Figure 2, opacity modifications effectively enable secret hiding while SH coefficients produce minimal impact or even destabilize the embedding process. However, relying solely opacity creates significant security
2

---

Published as a conference paper at ICLR 2026
compired chinecs
combiteed
standard
cuppue
renderig
cover
combined denetication
conwbet d
ESR 3X0 WORLL
stanfaad fendering
120
125
3D In Tewen
Lowoet
CoTY 1xl RULU 128
transtormed
cit senared
Decoder
2ety
Geclet?
GOTN
RELUI
nomalizaioon
standlrd
AugProll
covor- Like
Sparity ribatinn
CLIP encoodrrr
[b]
Figure 3: (a) Our end-to-end 3D steganography framework jointly trains the cover 3D Gaussians and the key-secured decoder from scratch. To enhance training, introduce combined camera poses for diverse training samples, combined SfM points for optimal initialization, and combined densifi- cations for refinement. (b) The key-secured decoder features a decoupled architecture with feature- specific layers for different Gaussian attributes. A key-controlled scheme enables multi-secret hiding and strengthens defenses against unauthorized extraction. Additionally, the feature-specific layers al- low systematic exploration of the optimal attribute update for secret embedding.
vulnerability, as hidden information can be easily exposed by simply detecting and restoring zero- valued opacity attributes, compromising the entire steganographic system (Figure 2). Based these findings, we systematically explore optimal attribute update combinations that strategically balance reconstruction quality and steganographic imperceptibility (Table 4). This exploration identifies that combining Gaussian attributes of opacity with rotation, position and scale significantly improves both security and fidelity over single-attribus approaches (Figure 4).
To quantitatively evaluate security beyond conventional 2D metrics, we propose DD-Sinkhorn se- curity evaluation metric, which analyzes distributional differences in the Gaussian parameter space itself. Our security analysis (Table 4, Figure 7) confirms that while the opacity-only approach achieves reasonable rendering fidelity, they create distinctive statistical signatures that are invisi- ble conventional 2D metrics but detectable through our proposed distribution analysis, as shown Figure 6. To summarize, KeySS makes the following contributions:
End-to-End 3D Steganography Framework: An end-to-end learning framework that jointly learns cover 3D Gaussians and key-secured decoder for 3D secret hiding, while maintaining compatibility with standard 3DGS format and rendering pipeline.
Key-Secured Decoder: a key-controllable scheme enables high-fidelity multi-secret recov- ery while ensuring security against unauthorized access.
-idelity-Security Balance Analysis: We are the first to conduct systematic exploration of optimal 3D Gaussian attribute update combinations and introduce Di--hinhoom distance as a novel security evaluation metric to balance fidelity and steganographic imperceptibility.
Extensive Experimental Validation: Experimental results demonstrate that KeySS achieves superior visual quality, high reconstruction fidelity, strong robustness against unauthorized extraction, and efficient multi-GPU scalability.
PRELIMINARIES ON 3DGS
We briefly describe essential preliminaries. The rest of related work is deferred to the Supplemen- tary. Built upon the splatting technique, 3DGS (Kerbl et al., 2023) models 3D scenes using a set of A anisotropic Gaussians: G (G) These Gaussians are learned capture the scene's 's structure and appearance, with attributes including center position E R3, opacity a E R., ro- tation RR, scale E R and color RR 16633 Specifically, μ4, r, and together describe the
3

---

Published as a conference paper at ICLR 2026
configuration of the i-th Gaussian:
G2(x) exp (-2(x (x- us)
'x; (x m1)))
(I)
where Σ; = R. is the 3D covariance matrix defined by the scaling matrix S; and rota- tion matrix R, Opacity a controls the transparency level of each Gaussian, and color с represents spherical harmonics (SH) to capture view-dependent appearance. For the standard rendering process from 3D to 2D, the 2D covariance matrix Σ; is formulated as Σ = J, W,W, E, W J, with the given viewing transformation matrix W and the Jacobian J, of the affine approximation of the projective transformation. The final color of a pixel is calculated via alpha compositing:
i-1 ca II (1--a))
C= c=Eor iEN
EGaa
j=1
where of a; exp 1- 14) E (x' u4) represents the final opacity based the projected coordinates x' and μz. Like NeRF, 3DGS initializes with SIM points and employs adaptive density control (clniigg/plittin//prnnng to enhance scene detail capture.
3 PROPOSED KEYSS METHOD
3.1 PROBLEM FORMULATION
We develop end-to-end steganographic framework (Figure 3(a)) that learns the transformation
between cover and secret 3D Gaussians. More precisely, given S + sets of ground truth 2D images stcret 1 M.eeere
{Ti [ /
Meaver and {
} with aligned camera poses, our goal is twofold: (1)
learn 3DGS model Grover {z) fi=1 that reconstructs the cover scene, and (2) learn transfor- mations to decode Geower into multiple 3DGS models Gegertt {G² (ar)} that render as the secret scenes. This transformation is parameterized by decoder D, such that:
Seeeet D(Goover)
To achieve both reconstruction fidelity and steganographic security, we jointly optimize Jower and D) from scratch. This optimization is guided by set of loss functions that enforce accurate recon- struction for both the predicted cover scene and the recovered secret scenes:
Leover = [11 Aeover) Li (Aprod cover; Lgt.cover) + >eover (4peed_cover Lgt. Caecret =(1 Aweered L1 (ppred__seeree: In scc.ece))) > CSSIM (Ipred_socees Is [ (5)
where Ipdd cover and Ipicd_secre rendered from Geover and Gisree respectively. Acover and Asseret the trade-off coefficients between T., and SSIM losses.
3.2 KEY-SECURED DECODING ARCHITECTURE
The overview of our decoding architecture shown in Figure 3(b). Specifically, our decoder is designed to build the transformation between the 3D Gaussians of the cover and secret scenes while maintaining a balance between fidelity and security. To further enhance security, the decoder is conditioned on user-specific key k=, ensuring that only authorized users with the correct key can accurately reconstruct the secret scenes. This can be formulated as:
G D(Gaaver, k=).
The Key-Controllable Scheme enables both multi-secret hiding capabilities and robust defense against unauthorized extraction attempts. We leverage CLIP's text encoder (Radford et al., 2021) to encode the keys, which excels at processing diverse textual inputs into semantic embeddings. The user-spe key is first tokenized and then processed through transformer based encoder E The
followed by average pooling operations to obtain the final key embedding: k AvgPool(E((M)) key embedding is concatenated with the normalized 3D Gaussian attributes as input to the decoder. To mitigate the risk of incorrect key attacks, the training process incorporates key scenarios:
4

---

Published as a conference paper at ICLR 2026
(i) correct keys for secret recovery defined in Eqn. 6, and (ii) randomly generated incorrect keys that force the decoder to reconstruct the original cover scene:
Cincorrect =(1 Aincorrect L1 (4pred.inoooonc 1 cov ACSSIM (iprod_incorrect !gtcover)
The newly introduced Lincorrett ensures that when the decoder is provided with an incorrect key, it re- constructs only the cover scene without revealing any hidden information. This enforces robustness by preventing unauthorized access and strengthens the security of the steganographic system.
The Feature-Contribution Exploration aims investigate the contribution of different 3D Gaus- sian attributes to secret hiding, The proposed decoder consists of shared common branch and multiple feature-specific branches (Figure 3(b)). The common branch captures comprehensive rep- resentations by leveraging the full 3D Gaussian attribute space. Feature-specific decoder branches isolate distinct Gaussian attributes, enabling systematic quantification of each parameter's contri- bution to steganographic efficacy, Concretely, all 3D Gaussian attributes and the user-specific key are normalized and concatenated into: concat (ar, r, S, l4, C, k). Then is input as the common branch MLP commen to get the common feature h MLP common (f). The common feature h and the commen
Gaussian attributes of cover {a, r, μt, c} would passed through feature-specific branches to obtain the updated Gaussian attributes {a ,', c²,,"";
MLP
MLP op
r
ro
s
+ Oo
MLP
(8)
MLP po
MLP
where MLP MLP,o. MLP MLPpo po- and MLP sh represent feature-specific branches for opacity, rotation, scale, position, and SH attributes, respectively. E R is binary vector that enables the selection of update combinations for the corresponding attributes. is the Hadamard product.
3.3 3D-SINKHORN EVALUATION METRIC
While fidelity can be quantified using standard image-space metrics such as PSNR, assessing steganographic security in 3D space requires fundamentally different approach. We introduce new security evaluation metric grounded in the Sinkhorn distance (Cuturi, 2013; Feydy et al., 2019), which measures the distributional disparities between original and steganographic 3D Gaussian pa- rameters directly within the representation space. This approach, inspired by recent advances in optimal transport for 3D applications (Kotovenko et al., 2024), offers significant advantages over traditional 2D image-based metrics by detecting statistical anomalies in the underlying 3D represen- tation that remain invisible in rendered views (Figure 6). The Sinkhorn distance provides ideal balance between computational efficiency through entropic regularization and preservation of geo- metric correspondences critical for analysis (Janati al., 2020; Ghosal & Nutz, 2025). During evaluation, 3D Gaussians from ground truth and stego cover scenes are normalized and projected into feature-specific histograms: 9i = hist(fi), of hjst( allowing us to quantify security across different attribute distributions:
Σ (gin
By analyzing the distributional discrepancy between the ground truth cover and the stego cover in the 3D Gaussian parameter space, the 3D Sinkhorn distance metric quantifies steganographic im- perceptibility at fundamental level. Lower distributional discrepancy indicates that the stego cover maintains statistical properties nearly identical the original, significantly enhancing resistance against both visual inspection and algorithmic detection methods. To systematically evaluate differ- ent attribute update combinations, we employ a composite score that balances reconstruction quality and statistical imperceptibility:
score (PSNR + PSNN (1 d).
(10)
3.4 TRAINING DETAILS
Dataset with Combined Camera Poses: The training dataset consists of both ground truth cover images and hidden secret images, each paired with M corresponding camera poses. To augment
5

---

Published as a conference paper at ICLR 2026
Table 1: PSNR scores for comparisons with previous works on single-secret hiding. 3DGS-GTs rep- resent the ground truth 3DGS models used for training, serving the theoretical upper bound for the performance of KeySS and GS-Hider respectively. The results showcase the top attribute update combinations explored based on secret fidelity. For wrong key inputs, PSNR scores are evaluated against cover ("vs. cover") and secret ("vs. secret") scenes are presented to measure effectiveness of unauthorized access prevention, attributes are denoted as: opacity (op), rotation (ro), scale (sc), position (xyz), and SH (sh).
Methods
Seme Type
Bicycle Playroom
Bonsai Counter
Room Garlen
Playrom
Trechill Ricycle
Playroom
Stamp Playroom
Blcycle
Bonsai
Averaget
3DGS-GT (GS Hider)
cover
25.246
$1,980
30.633
21,520
22,490
27 41.
26,550
28.700
30.317
27. 20.2
3DGS-GT (KeySS)
23.395
31,690
31,712
22.579
25. 25,690
24.670
28.702
30.338
26.518
3DGS+SH
23.365
26.286
29.311
18.998
21.479
24.897
22.818
26.893
28.150
24.689
secret
22.231
20.619
24,067
20.997
22.758
23.232
3DGS +Decoder
cover
23.914
27.674
27.502
19.877
21,200
24.284
24.134
26.561
26.013
24.573
secret
20.611
20.118
21.668
20.540
19.848
25.287
19,933
20.670
22.367
21.249
GS Hider
24.018
29.643
28.865
20.109
21.503
26.753
24.573
27.445
29.447
25.817
(Zhang al., 2024)
secrel
23.816
22.885
20.276
25.161
KeySS
cover
23.011
31.081
30.785
19:176
22.433
25.225
23.827
28. 28.120
29.862
25,980
(op.n..t,ayc)
secrel
29.535
25.456
23,877
29.272
22.121
28.179
29.452
20.891
29.064
26.427
KeySS
Y.5. cover
22.959
31,023
30.719
19.625
22.443
25. 120
23.763
28.098
29.495
21.96
(wrong key)
V.s. scunet
11,010
10.190
9.751
9.621
12/158
9.813
11,228
10.373
8,593
10.341
our training dataset, we leverage the combined camera poses from both cover and secret scenes. For camera poses unique to either scene, we generate the corresponding ground truth images using pre-trained models: the cover 3D model (without embedding) for secret-scene poses, and vice versa.
The initialization from the SIM point cloud crucial for learning 3D Gaussians. Our method uniquely employs combined SfM point cloud for initial- ization, preserving the spatial information both cover and secret scenes. This strategy enhances reconstruction quality by capturing the structural context of both datasets during initialization.
Initialization with Combined SfM Points:
Backpropagation with Tripled Losses; Considering both fidelity and security, the overall loss of the proposed method can be summarized as:
= Ceovrr +
Σ Beeceer Specret + Pinconeen
(1I)
where Beovers Beecret and Sincomrect balance the contribution of each loss term.
Refinement with Combined Densification:
During backpropagation, combined densification strategy is employed by leveraging the view-space positional gradients from both the cover and se- cret scenes. This strategy guides the process of cloning or splitting large Gaussians in Gower, allowing for finer control over the representation and improving the accuracy of the hidden information while preserving the integrity of the cover scene.
EXPERIMENTAL RESULTS
Dataset and Implementation Details: Follow- ing GS-Hider (Zhang et al., 2024), use 9 scenes from Mip-NeRF360 (Barron et al., 2022) and 1 from Deep Blending (Hedman et al., 2018), forming cover-secret pairs (Table 1). For multi-secret hiding, we cre- ate (cover, secretl, secret2) triplets from Mip-
Table 2: PSNR scores for multiple-secret.
Type
Scenes
PSNR1
Scenes
PSNR1
Scones
PSNRT
Caver
Flower
18.990
Ricycle
Kitchen
Secreil
Treehills
21.038
Bensaa
29.031
Counter
26.75 75753
Secre12
Garden
21,970
Room
26.544
Stump
21.519
Whong
16.456
Cover
Key
Se.recrtti
10.598
ve.Secteti
12.117
ve.Secreti
NeRF360 scenes (Table 2), demonstrating our method's ability to embed multiple secrets com- plex 3D environments. We follow Mip-NeRF360's official evaluation protocol using its test split. Our results are reported on unseen novel views, adhering to the official Mip-NeRF360 test split and GS Hider evaluation protocol. The training and testing sets contain distinct images, with the test set comprising novel views not observed during training. Our method builds on the 3DGS frame- work (Kerbl et al., 2023) and is fully compatible with recent advances in 3D Gaussian Splatting.

---

Published as a conference paper at ICLR 2026
op. ro
qp. ra
Op. rc, s5, xyz (hest)
secret key. Aisulpituraaaioo
secret
Figure 4: Visualization of decoder outputs across different attribute update combinations using cor- rect and incorrect keys. The last two rows show secret recovery (correct key) and security preserva- tion (incorrect key). Notation follows Table 1.
We adopt the same training hyperparameters and rendering process 3DGS, training for 30,000 iterations on a 24GB NVIDIA RTX 6000 GPU. Due to memory limits, we cap Gaussians in the cover scene 500,000. Ground-truth scenes are also trained with 3DGS. Loss weights Acover, Asecret, and Aincorreat are set to 0.5, following 3DGS defaults. Balance coefficients B and Sseeret are set to 0.5, and Pincorrect to 0.01, balancing reconstruction, secret recovery, and robustness against incorrect-key key attacks. Keys are 16-character alphanumeric strings (uppercase and lowercase), bal- ancing security and computational feasibility, embedded via the pre-trained CLIP ViT-L/14 model. Performance is evaluated with PSNR; SSIM and LPIPS results appear in the Supplementary.
4.1 FIDELITY ASSESSMENT
We compare KeySS against the baseline GS-Hider (Zhang et al., 2024), as shown in Table 1. As the open-source implementations of the existing methods are unavailable, we directly compare our results with the reported figures from their papers. Table presents the quality of our ground truth 3DGS cover, which is trained from scratch (Kerbl et al., 2023) and serves the theoretical upper bound of our performance. However, when compared to the ground truth 3DGS used in Gidei Despite having a lower upper limit, KeySS achieves higher fidelity in cover reconstruction, with minimal fidelity reduction of only 0.511 dB from the upper limit, compared 1.388 dB in the baseline method. KeySS also excels in secret preservation, outperforming the bascline by 4.9%. More single-secret hiding visualizations are provided in Figure
Single-Secret Hiding:
upper bound is lower, indicating differences in the underlying training setups.
To seamlessly embed an additional secret into the cover scene, we extend our model by simply incorporating another secret loss term, without introducing any further archi- tectural modifications. This straigtforward extension highligts the flexibility of our approach, as it naturally scales to multiple hidden secrets without requiring structural changes or additional con- straints. Table presents the PSNR scores for multi-secret hiding, demonstrating that our method preserves high cover scene fidelity while maintaining competitive secret reconstruction quality, com- parable to the fingle-sccret results in Table 1. As illustrated in Figure 5, our model effectively reveals different hidden secrets based on the provided key input.
Multiple-Secre Hiding:
We experimentally evaluate GS- Hider, and assess WaterGS and SecureGS at the framework level, assessing imperceptibility, flexibility, and practicality, for
Table 3: Key element comparison across existing methods
Method
EndToFad
Decoder
Security
MuliSecret
WateeSS
AutoEncoder
SugEspose
SecureGS
GS-Ilider
CNN
StepEspose
Our
MLP4 (125.1))
3D Sinkhorn
Waat to share)

---

Published as a conference paper at ICLR 2026
secret1 w/ key1
secret2 w/ key2:
wrong key XFZ KoukauuppZ
cover
'lowWeud7heyFrr
e
8
Figure 5: Visualization comparison of our method on multiple secret hiding across different attribute update scenarios using both correct and incorrect key inputs. The notation consistent with Table
the following reasons: (1) Neither method is open-sourced, making it impossible evaluate producible metrics such as 3D Sinkhorn distance. (2) Reported PSNR values are not directly com- parable, as the ground truth 3DGS used in their experiments unspecified and potentially differ (Table 3).
4.2 SECURITY EVALUATION
2D Steganalysis with StegExpose: Data security is a fundamental concern steganography, where the objective is conceal information without drawing attention. Following prior work, adopt the 2D steganalysis tool StegExpose (Boehm, 2014) to evaluate the detectability of stego cover scenes. A detection dataset constructed by mixing equal proportions of cover scenes with and without hidden secrets.
The ROC curves in Figure are obtained by varying StegExpose detection thresholds across broad range. In the ideal case, the stegan- alyzer should perform no better than random guessing, achieving classification probability of 50% and an AUC of 0.5, which corresponds to a diagonal ROC curve (Jing et al., 2021; Mou et al., 2023). As shown in Figure 6, method exhibits stronger resistance to steganalysis at- tacks, generating stego covers that signif- icantly less detectable than those from exist- ing approaches. Notably, this high level of curity is preserved even when embedding mul- tiple secrets, highlighting the framework's ef- fectiveness in achieving both secure and imper- ceptible information hiding. Moreover, tradi- tional 2D image-based based metrics are insufficient for evaluating the security 3D steganography. As shown in Figure 6, different attribute update strategies in method produce similar StegExpose results (comparable AUC values), which fail to fully capture the robustness of the 3DGS models. This underscores the need for dedicated 3D-specific evaluation metrics, such as proposed 3D- Sinkhorn metric.
1.0
[singld] KeySS-hoe (AUIC-
[single] KeyS8-ap (AUI)- 0.46)
[singl] KoyS5-ppo
0.46)
0.8
[nuli-] (e 0.35)
GS Hlidrr 0.29)
Thue Posinve Rate
Randoai Guas (AUC--0.5)
0.0
0.0
0.2
0.4
0.8
1.0
False Posilive
Figure 6: ROC curves from StegExpose analysis. 'single' and 'multi-" refer to single- and multi- secret hiding. 'best' denotes the optimal attribute update combination (op, ro, sc, xyz).
Security Against Unauthorized Access: Our decoder employs key-controllable scheme that ef- fectively resists wrong key attacks. Table (last row) reports the impact of the Cincorest loss in preventing unauthorized secret retrieval using randomly generated incorrect keys unseen during
8

---

Published as a conference paper at ICLR 2026
Table 6: Ablation study on CLIP and user key.
Table Training details of our method.
Pettrised CTIP CTIP-aas lasd Eaceder Varaar
Kry Leegit
PSNR (Ressi, Ooanco
GRC Neesoyy
Clwer BBoona:
Secoe (Covsie)
luge-poohle Ioscptccl
Cover
Type
Settag
Gaasiees
Reraioen
1100
30:835
22-133
Siakle
JQPO-K
IGPU
42344n
3354en
1208
1538
500k
5206
501
301
31,853
30956
27,014
25.456
11.131
23
4G
1950
13886
908
31,953
23,410
31063
25.50
Mill
1GR0
6833m
1838
5006
506
Kikdion Cocotor Sterpg
training. The average PSNR scores against both ground truth cover and secret scenes confirm the decoder's robustness in protecting hidden information. Table 2 extends this evaluation multiple- secret hiding scenarios, further demonstrating security across settings. Visual examples in Figures and show how the decoder responds incorrect keys, ensuring secret content remains inaccessible without the correct key. This key-controllable scheme offers flexibility, allowing seamless integra- tion of additional losses to strengthen security against unauthorized access.
4.3 ABLATION STUDY
Balancing Fidelity and Security: The ablation study in Table 4 evaluates the performance of different attribute update combinations learned by our decoder. The top three combinations for cover and secret fidelity are: a single attribute update with opacity; double update with opac- ity and rotation; and a quadruple update with opacity, rotation, scale, and position. Detailed PSNR results for these are provided in Table 1. Consistent with our intuition (see Figure 2), opacity contributes most significantly to secret hiding, while the complex, high nigh-dimensional color/SH attributes are harder to learn and less effective for concealment. The composite score indicates that updating all four attributes offers the best balance between fidelity and security.
Table 4: Ablation study on different attribute up- date combinations. The top three methods are highlighted in gray.
Count
Updited atmbutes
Sceme PSNR
Sinkhum]
3D
Soore"
op to se xyz sh Covert
Socrett
26,020
26.138
0.181
42.717
21.752
23,754
0.268
33,314
25,080
20.497
0.190
36,921
23,866
182
0.162
0:175
25.99K
26.018
0.208
41,228
25.777
21.615
0.329
31, 705
25,831
24.118
0,213
39.319
v v
25.632
24:743
0.206
30 98.
25.411
25.662
0.219
39,899
0.185
37.729
0:153
25.951
19.970
0.430
26.157
25.832
20.961
0.256
34.810
To further assess security, Figure 7 visual- izes low-opacity regions in cover scenes by marking Gaussians with opacity below 0.05 to detect potential information leakage patterns. The quadruple-attribute update achieves better steganographic imperceptibiliiyy evidenced by lower 3D- Sinkhorn distance. In contrast, relying solely opacity updates results in more concen- trated low-opacity areas, compromising security due to potentially detectable patterns.
Figure 7: Low-opacity areas in the cover image.
Combined Gaussian Optimization: Our method integrates three combination strategies: combined SIM point clouds for initialization, combined camera poses to enrich training samples, and combined densification for refinement. Table 5 summarizes the ablation results. SfM initialization is critical, using SfM points from only the cover secret scene biases reconstruction toward that scene. The combined camera poses strategy balances performance by providing diverse training data for both scenes. Lastly, combined densification improves results by leveraging view-space positional gradients from both scenes during refinement.
Table Ablation study on combined StM initial- ization, camera poses, and densification.
Combined SIM
Combined
Combined Densitication
Camem Poses
Cover
Secret
Average
oover
cover
23,830
29.719
26 27,
cover
V
23.279
27.083
25.181
23.300
26.855
25,077
29.761
secret
secrel
19.789
29.719
21.751
secrel
19.763
29.693
24.728
22,888
29.611
26.249
29.858
CLIP & Key Ablation and Runtime: We conduct an ablation study on key length and CLIP en- coder variants, summarized in Table 6. As shown in Table 7, our framework achieves efficient training and inference, and is readily scalable to multi-GPU setups. When integrated with a dis- tributed Gaussian Splatting backbone such as Grendel-GS (Zhao al., 2024), the system supports

---

Published as a conference paper at ICLR 2026
4K-resolution training with 1.28 million Gaussians in just 30 minutes using 4 GPUs. At inference time, the model renders at 130 FPS per key input.
5 CONCLUSION AND LIMITATIONS
In this paper, we present KeySS, end-to-end 3D steganography framework that jointly optimizes cover 3D Gaussians and a key-secured decoder. Our decoder maintains imperceptibility by adher- ing to the standard 3D-GS format and rendering pipeline, while incorporating key-controllable scheme that enables robust multi-secret hiding and strong resilience against incorrect key attacks. Task-specific decoder branches facilitate systematic exploration of optimal attribute updates for high-fidelity secret concealment. Additionally, we introduce 3D-Sinkhorn, novel metric designed quantify steganographic imperceptibility in 3D, overcoming the limitations of traditional 2D ste- ganalysis metrics and paving the way for future research in 3D steganography. Extensive experi- ments demonstrate that KeySS achieves sfateoof-the-ar performance both fidelity and security.
Limitations:
Trade-off Between Cover Fidelity and Secret Fidelity. Despite strong performance, KeySS ex- hibits an inherent trade-off between cover fidelity and secret fidelity due to the joint optimization of 3DGS and the key-secured decoder (Table 4). Because both tasks share the same Gaussian at- tributes, the model cannot fully optimize cover rendering and secret embedding simultaneously. Improved objective weighting or disentangled representations may help alleviate this limitation.
Potential Secret Leakage. The current key-encoder design encodes 16-character letter-only key (5216 possibilities), while training involves only 30k iterations, preventing effective separation across the full key space. Consequently, nearby keys in the embedding space may decode correlated information, posing a risk of approximate-key leakage. This stems from treating keys as continuous embeddings rather than enforcing discrete cryptographic behavior. Future work may incorporate cryptographic mechanisms, such as hash-based key expansion or discrete key-derivation, to ensure decorrelated outputs for even small key perturbations.
Sensitivity to Gaussian Pruning. Secret reconstruction depends on contributions from all Gaus- sians, making the method sensitive pruning. Removing Gaussians that encode secret-relevant information can degrade or eliminate the hidden message, revealing a tension between robustness and representation compression. Future extensions may focus on concentrating secret information within a small, stable subset of Gaussians, incorporating redundancy or error-correction, or training with pruning- aware constraints.
6 ACKNOWLEGEMENT
This research is supported by the National Research Foundation, Prime Minister's Office, Singapore, and the Ministry of Digital Development and Information, under its Online Trust and Safety (OTS) Research Programme (MDDI-OTS-00)) tions expressed this material are those of the author(s) and do not reflect the views of National Research Foundation, Prime Minister's Office, Singapore, the Ministry of Digital Development and Information, or the Centre for Advanced Technologies Online Safcty.
Any opinions, findings and conclusions
recommenda-
REFERENCES
Jonathan T Barron, Ben Mildenhall, Dor Verbin, Pratul P Srinivasan, and Peter Hedman. Mip-nerf 360: Unbounded anti-aliased neural radiance fields. In Proceedings of the IEEE/CVF conference on computer vision and pallern recognition, pp. 5470-5479, 2022.
Wenjing Bian, Zirui Wang, Kejie Li, Jia-Wang Wang Bian, and Victor Adrian Prisacariu. Nope-nerf: Optimising neural radiance field with no pose prior. In Proceedings of the IEEE/CVF Conference Computer Vision and Puttern Recognition, pp. 4160-4169, 2023.
Benedikt Bochm. Stegexpose-a tool for detecting lsb steganography,
arXiv preprint
arXiv: 1rXiv:1410.6656 2014.
10

---

Published as a conference paper at ICLR 2026
Abbas Cheddad, Joan Condell, Kevin Curran, and Paul Me Kevitt. Digital image steganography: Survey and analysis current methods. Signal processing. 90(3):727-75, 2010.
Marco Cuturi. Sinkhorn distances: Lightspeed computation of optimal transport. Advances in neural information processing systems, 26, 2013.
Delina. Information hiding: A new approach in text steganography. In Proceedings of the Inter- national Conference Applied Computer and Applied Computational Science, World Scientific and Engineering Academy and Society (WSEAS 2008), pp. 689-695, 2008.
Fatiha Djehhar, Beghdad Ayad, Habib Hamam, and Karim Ahed-Meraim. A view on latest au- dio steganography techniques. In 2011 International Conference on Innovations in Information Technology, pp. 409-414. IEEE, 2011.
Fatiha Djebbar, Beghdad Ayad, Karim Abed Meraim, and Habib Hamam. Comparative study of dig- ital audio steganography techniques. EURASIP Journal on Audio, Speech, and Music Processing. 2012:1-16, 2012.
Hrishikesh Dutta, Rohan Kumar Das, Sukumar Nandi, and SR Mahadeva Prasanna. An overview of digital audio steganography. IETE Technical Review, 37(6))6332653 650. 2020.
Ben Fei, Jingyi Xu, Rui Zhang, Qingyuan Zhou, Weidong Yang, and Ying He. 3d gaussian splatting as new era: A survey. IEEE Transactions on Visualizution and Computer Graphics, 2024.
Jean Feydy, Thibault Séjourné, François-Xaviet Vialard, Shun-ichi Amari, Alain Trouvé, and Gabriel Peyré. Interpolating between optimal transport and mmd using sinkhorn divergences. In The 22nd international conference on artificial intelligence and statisties, pp. 2681-2690. 200.-266...... 2019.
Kyle Gao, Yina Gao, Hongjie He, Dening Lu, Linlin Xu, and Jonathan Li. Nerf: Neural radiance field in 3d vision, comprehensive review. arXiv preprint arXiv:2210.00379, 2022.
Promit Ghosal and Marcel Nutz. On the convergence rate of sinkhorn's 's algorithm. Mathematics of Operations Research, 2025.
Ashish Girdhar and Vijay Kumar. Comprehensive survey of 3d image steganography techniques. IET Image Processing. 12(1):1-10, 2018
Yijia Guo, Wenkai Huang, Yang Li, Gaolei Li, Hang Zhang, Liwen Hu, Jianhua Li, Tiejun Huang, and Lei Ma. Splats in splats: Embedding invisible 3d watermark within gaussian splatting. arXiv preprint arXiv:24/2.0031// 2024.
Nagham Hamid, Abid Yahya, R Badlishah Ahmad, and Osamah M Al-Qershi. Image steganography techniques: an overview. International Journal of Computer Science and Security (IJCSS), 6(3): 168-187, 2012.
Peter Hedman, Julien Philip. True Price, Jan-Michael Frahm, George Drettakis, and Gabriel Bros- tow. Deep blending for free-viewpoint image-based rendering. ACM Transactions on Graphics (ToG), 37(6):1-15, 2018 2018
Kun Hu, Mingpei Wang, Xiaohui Ma, Jia Chen, Xiaochao Wang, and Xingjun Wang. Learning- based image steganography and watermarking: A survey. Expert Systems with Applications, pp- 123715, 2024.
Hicham Janati, Marco Cuturi, and Alexandre Gramfort. Debiased sinkhorn barycenters. In Interna- tional Conference on Machine Learning, pp. 4692-4701. PMLR, 2020.
Youngdong Jang, Dong In Lee, MinHyuk Jang, Jong Wook Kim, Feng Yang, and Sangpil Kim. Waterf: Robust watermarks in radiance fields for protection of copyrights. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pp. 12087-12097, 2024.
Junpeng Jing, Xin Deng, Mai Xu, Jianyi Wang, and Zhenyu Guan. Hinet: Deep image hiding by invertible network. In Proceedings of the IEÉE/CVF international conference on computer vision, pp. 4733 2021.
11

---

Published as a conference paper at ICLR 2026
Inas Jawad Kadhim, Prashan Premaratne, Peter James Vial, and Brendan Halloran. Comprehensive survey of image steganography: Techniques, evaluations, and trends in future research. Neuro- computing, 335:299-3222 2019.
Bernhard Kerbl, Georgios Kopanas, Thomas Leimkühler, and George Drettakis. 3d gaussian splat- ting for real-time radiance field rendering. ACM Trans. Graph. 42(4):139-1, 2023.
Dmytro Kotovenko, Olga Grebenkova, Nikolaos Sarafianos, Avinash Paliwal, Pingchuan Ma, Omid Poursaced, Sreyas Mohan, Yuchen Fan, Yilei Li, Rakesh Ranjan, et al. Wast-3d: Wasserstein-2 distance for scene-to-scemt stylization on 3d gaussians. In European Conference Computer Vision, pp. 298-314. Springer, 2024.
Dulal Kumbhakar, Kanchan Sanyal, and Sunil Karforma. An optimal and efficient data security technique through crypto-stegano for e-commerce. Multimedia Tools and Applications, 82(14); 21005-21018, 2023.
Jayakanth Kunhoth, Nandhini Subramanian, Somaya Al-Maadeed, and Ahmed Bouridane. Video steganography: recent advances and challenges. Multimedia Tools and Applications, 82(27): 41943 41985, 2023.
Chenxin Li, Brandon Y Feng, Zhiwen Fan, Panwang Pan, and Zhangyang Wang. Steganerf: Em- bedding invisible information within neural radiance fields. In Proceedings of the IEEE/CVF international conference on computer vision, pp. 441-453, 2023.
Yunxia Liu, Shuyang Liu, Yonghao Wang, Hongguo Zhao, and Liu. Video steganography: review. Neurocomputing. 335:238-255 2019.
Shilin Lu, Zihan Zhou, Jiayou Lu, Yuanzhi Zhu, and Adams Wai-Kin Kong. Robust watermarking using generative priors against image editing: From benchmarking advances. In The Thirteenth International Conference on Learning Representations, 2025. URL pettts::/openreeee
net/forum? id=1 wOwGCmBBGGWCCCC
Ziyuan Luo, Qing Guo, Ka Chun Cheung, Simon See, and Renjie Wan. Copymerf: Protecting the copyright of neural radiance fields. In Proceedings of the IEEE/CVF international conference on computer vision, pp. 12401-22411 2023.
Mohammed Abdul Majeed, Rossilawati Sulaiman, Zarina Shukur, and Mohammad Kamrul Hasan. A review text steganography techniques. Mathematics, 9(21):2829, 2021.
David Megías, Wojeiech Mazurezyk, and Minoru Kuribayashi. Data hiding and its applications:
Digital watermarking and steganography, 2021.
Gal Metzer, Elad Richardson, Or Patashnik, Raja Giryes, and Daniel Cohen-Or. Latent-nerf for shape-guided generation 3d shapes and textures. In Procedingss of the IEFF/CVF conference on computer vision and pattern recognition, pp. 12663-12673, 2023.
Ben Mildenhall, Pratul P Srinivasan, Matthew Tancik, Jonathan T Barron, Ravi Ramamoorthi, and Ren Ng. Nerf: Representing scenes as neural radiance fields for view synthesis. Communications of the ACM, 65(1)999-106, 2021.
Chong Mou, Youmin Xu, Jiechong Song, Chen Zhao, Bernard Ghanem, and Jian Zhang. Large- capacity and flexible video steganography via invertible neural network. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 22606-22615, 2023.
Charles R Qi. Hao Su, Kaichun Mo, and Leonidas Guibas. Pointnet: Deep learning on point sets for 3d classification and segmentation. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 652-660, 2017.
Minghan Qin, Wanhua Li. Jiawei Zhou, Haoqian Wang, and Hanspeter Pfister. Langsplat: 3d lan- guage gaussian splatting. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 20051 2024.
12

---

Published as a conference paper at ICLR 2026
Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervision. In International conference machine learning, pp- 8748-8763. PmLR, 2021.
Mennatallah M Sadek, Amal S Khalifa, and Mostafa GM Mostafa. Video steganography: a compre- hensive review. Multimedia tools and applications, 74:7063-7094, 2015.
Noah Snavely, Steven M Seitz,, and Richard Szeliski. Photo tourism: exploring photo collections in 3d. In ACM siggraph 2006 papers. pp. 335-846.25 2006.
Qi Song, Ziyuan Luo, Ka Chun Cheung, Simon See, and Renjie Wan. Protecting nerfs' copyright via plug-and-plas watermarking base model. In European Conference on Computer Vision, pp. 57-73. Springer, 2024.
Nandhini Subramanian, Omar Elharrouss, Somaya Al-Maadeed, and Ahmed Bouridane. Image steganography: A review of the recent advances. IEEE access, 9:23409-23423, 2021.
Paramasivan Thiyagarajan, V Natarajan, Gnanasekaran Aghila, V Prasanna Venkatesan, and R Anitha. Pattern based 3d image steganography. 3D Research, 4(1):1-8, 2013.
Yuan- Yu Tsai. An adaptive steganographic algorithm for 3d polygonal models using vertex decima- tion. Multimedia tools and applications, 69:859-876, 2014.
Fredy Varghese and Sasikala. A detailed review based on secure data transmission using cryptog- raphy and steganography. Wireless Personal Communications, 299(4):291123116 2023.
Hao-Tial Tian Wu and Luc Dugelay. Steganography 3d geometries and images by adjacent bin mapping. EURASIP Journal on Information Security, 2009: 2009.
Jiaxuan Wu, Zhengxian Wu, Yiming Xue, Juan Wen, and Wanli Peng. Generative text steganogra- phy with large language model. In Proceedings of the 32nd ACM International Conference on Multimedia, pp. 10345-10353, 2024.
Innfarn Yoo, Huiwen Chang, Xiyang Luo, Ondrej Stava, Ce Liu, Peyman Milanfar, and Feng Yang. Deep 3d-to-2d 2d watermarking: Embedding messages in 3d meshes and extracting them from 2d renderings. In Proceedings of the IEEE/CVF conference computer vision and pattern recogni- tion, pp. 10031-10040, 2022.
Jiwen Yu, Xuanyu Zhang, Youmin Xu, and Jian Zhang- Cross: Diffusion model makes controllable, robust and secure image steganography, Advances in Neural Information Processing Systems, 36: 80730-80743, 2023.
Zehao Yu, Anpei Chen, Binbin Huang. Torsten Sattler, and Andreas Geiger. Mip-splatting: Alias- free 3d gaussian splatting. In Proceedings of the IEEF/CVF conference on computer vision and pattern recognition, pp. 19447-19456, 2024.
Xuanyu Zhang, Jiarui Meng, Runyi Li, Zhipei Xu, Yongbing Zhang, and Jian Zhang, Gs-hider: Hiding messages into 3d gaussian splatting. Proceedings of the Advances in Neural Information Processing Systems (NeurIPS), 2024.
Zheyi Zhang, Yinghong Cao, Hadi Jahanshahi, and Jun Mou. Chaotic color multi-image compression-encryptionn/ data type steganography scheme for nft transaction security. Jour- nal of King Saud University-Cmppuerr and Information Sciences, 35(10):10183,, 2023.
Hexu Zhao, Haoyang Weng, Daohan Lu, Ang Li, Jinyang Li, Aurojit Panda, and Saining Xie. On scaling up 3d gaussian splatting training. In European Conference on Computer Vision, pp. 14-36. Springer, 2024.
Hang Zhou, Weiming Zhang, Kejiang Chen, Weixiang Li, and Nenghai Yu. Three-dimensional mesh steganography and steganalysis: A review. IEEE Transactions on Visualization and Computer Graphics, 28(12):50065523 2021.
Jiahao Zhu, Yushu Zhang, Xinpeng Zhang, and Xiaochun Cao. Gaussian model for 3d mesh steganography. IEEE Signal Processing Letters, 28:1729-1733, 2021.
13

---

Published as a conference paper at ICLR 2026
7 APPENDIX
Additional implementation details and comparisons are provided in the supplementary material. Unless stated otherwise, all experiments are conducted using our method with the optimal attribute update combination: (op, ro, xyz).
A RELATED WORK ON 3D SCENE RECONSTRUCTION
3D scene reconstruction aims to generate a 3D scene from a set of images and other data, while rendering projects 3D models into 2D images based on given camera poses. Traditional methods include cructure-from-moott
(SfM) (Snavely et al., 2006) and multi-view stereo (MVS) (Snavely et al., 2006) algorithms. With the rise of deep learning, NeRF (Mildenhall et al., 2021) encodes scene information by overfitting a multi-layer perceptron (MLP), enabling photorealistic novel view synthesis from limited input images. Despite revolutionizing image synthesis, NeRF suffers from high computational costs and limited controllability due to its implicit representation, 3DGS (Kerbl et al., 2023) emerges solution to these challenges, providing explicit representation and highly parallelized workflows for efficient rendering and reconstruction. It represents scenes with learnable 3D Gaussians, which projected onto image planes through a splatring process, enabling high- quality rendering with real-time performance. Our method builds upon the strengths of 3DGS in both reconstruction and rendering while leveraging the high-capacity embedding potential of millions of 3D Gaussians to conceal the secret scenes effectively.
RELATED WORK ON 3D STEGANOGRAPHY
3D steganography, using 3D models to hide secret messages, has been studied for decades (Zhang et al., 2023; Zhou et al., 2021: Zhu et al., 2021; Girdhar & Kumar, 2018). Traditional methods primarily modify 3D mesh geometry or topology for copyright protection, such as adjacent bin mapping (Wu & Dugelay, 2009), triangle mesh reformation (Thiyagarajan et al., 2013), and ver- tex decimation (Tsai. 2014). Other approaches retrieve hidden messages from 2D renderings of 3D distortions (Yoo et al., 2022). Recent advances in 3I) reconstruction have shifted focus to more pow- erful representations, like NeRF and 3DGS, enabling new possibilities for steganography in neural rendering. For example, CopyNeRF (Luo et al., 2023) embeds copyright protection into NeRF mod- els using watermarked color representations and resistant rendering scheme, while WateRF (Jang et al., 2024) applies discrete wavelet transformation to both implicit and explicit NeRF models. NeRFProtector (Song et al., 2024) introduces a plug-and-play strategy for protecting NeRF copy- rights. However, these methods are primarily focused on embedding binary bit messages (Lu et al., 2025) with limited hiding capacity. StegaNeRF (Li et al., 2023) pioneers higher-capacity hiding, in- cluding images and audio, within NeRF rendering. More recently, GS-Hider (Zhang et al., 2024) and WaterGS (Guo et al., 2024) have explored hiding 3D content 31) reconstruction models. GS-Hider replaces 3DGS's SH coefficients with coupled secure features and introduces separate decoders for the cover and secret scenes. However, these non-standard features and rendering process risk arous- ing suspicion and violating the imperceptibility principle of steganography. WaterGS, aligned with standard 3DGS rendering, uses importance-gradee SH coefficient encryption and opacity mapping for secret embedding. However, by focusing primarily on SH and opacity attributes, it underutilizes the full 3DGS attributes and lacks end-to-end training, limiting flexibility in embedding multiple secrets in a single cover. Our proposed method, KeySS, aims to develop an end-to-end learnable 3D steganography framework that has both imperceptibility and flexibility.
IMPLEMENTATION DETAILS
The proposed decoder (Figure (b)) consists of shared common branch and multiple feature- specific branches, ensuring both simplicity and efficiency. The common branch comprises two MLP layers with ReLU activation for general feature extraction. The common branch receives concate- nated features derived from L2-normalized Gaussian attributes as input. Each feature-specific branch contains two additional MLP layers followed by feature- feature-specific activation functions. To enhance training stability and facilitate gradient flow, residual connections are incorporated. For the MLP chitecture, we employ 1x1 convolutional layers instead of standard linear layers, which is motivated by their effectiveness in PointNet (Qi et al., 2017). The of Ixl convolutions enables efficient.

---

Published as a conference paper at ICLR 2026
Table 8; Comparison of Training and Testing Results with PSNR and View Counts
Methods
Scone Type
Ricycle Playroom
Bonsai Counter
Room
Flowers Playroom
Trechill Bicycle
Gurden Playroom
Stump Playroom
Counter Bicycle
Kitchen Bonsai
Average
training views (count)
cover searet
255
255
272
151
123
161
109
210
169
189.444
196
210
161
196
169
196
196
169
253
194.22 24.
37
26 222
testing (count)
secret
30
29
local feature aggregation while maintaining spatial awareness, leading to improved performance in attribute update strategy. Based this architecture, the proposed decoder is equipped with key-controllable mechanism for enhanced security and a selective update scheme to fully explore the hiding potential of various attribute update combinations. During training. we enforce robust- ness by pairing each correct key with wrong key in every iteration, resulting in 1:1 ratio, which we have explicitly highlight in the revised paper. This design ensures both security and practical usability.A A more detailed breakdown of training and testing view counts is provided in Table 8.
D OVERFITTING STUDY
A potential concern is whether shared decoder, when trained reconstruct multiple secrets (e.g.. secrets A and B) from single cover image, might overfit to one particular secret and consequently fail to recover the others. Our results indicate that this issue does not arise in practice. As reported in Table 2 and illustrated in Figure 5, the shared decoder achieves consistently high PSNR across all embedded secrets, suggesting that neither collapses to a single supervision signal nor preferentially reconstructs any particular secret.
This robustness primarily follows from our rey-conditioned architecture. Each secret is associated with distinct key, and the decoder is conditioned on the corresponding key embedding during reconstruction. The key thus provides strong, discriminative signal that guides the decoder toward the appropriate secret. This mechanism is analogous conditioning in modern class- text-guided generative models, where a single generator successfully produces diverse outputs (c.g., images of different classes or text prompts) despite full parameter sharing. In those settings, as in ours, the conditioning input (class label, text description, or secret key) effectively partitions the task space and prevents overfitting to any individual target.
Within our framework, the key embedding steers the shared decoder to the correct reconstruction trajectory and prevents representational collapse toward specific secret. Consequently, the decoder maintains stable performance even as the number of embedded secrets increases.
GEOMETRIC CONSISTENCY
To address geometric consistency, provide depth map visualizations of our reconstructions in Figure 8. Additionally, we will release all trained checkpoints on GitHub to ensure reproducibility and allow independent verification.
F RENDERING SPEED COMPARISON
As shown in Table 9, we assess the adaptability of our method and baselines within the SIBR Viewer rendering engine provided by 3DGS (Kerbl et al., 2023). Unlike GSHider, but similar to WaterGS, our approach maintains full compatibility with the standard 3DGS format and rendering process, allowing seamless integration into the original 3DGS pipeline without requiring modifications. This ensures that our method can be readily deployed existing 3DGS-basee applications without addi- tional engineering overhead.
Furthermore, Table 9 demonstrates that our method preserves the standard rendering efficiency of 3DGS, achieving average rendering speed of 130 FPS. This result indicates that stegano- graphic enhancements do not introduce significant computational overhead, maintaining real-time performance comparable the original 3DGS framework.
2

---

Published as a conference paper at ICLR 2026
cover results
cover depth maps
secret resultss
secret depth map
Figure 8: The depth map for cover and secret scenes varied views.
DETAILED SD-SINKHORN RESULTS
comprehensive breakdown of the 3D Sinkhorn distance analysis, including per-attribute compar- isons, is presented in Table 10. This metric provides fine-grained evaluation of the distributional discrepancy between the ground truth cover and the stego cover in the 3D Gaussian space, offering crucial insights into the imperceptibility of the hidden secret. As we can find, the histogram distance between the scales' histograms are very close which indicates that the scale value tends distribe relatively equally in 3DGS models. The other attribute distribution differs more.
comprehensive breakdown the 3D-Sinkhorn distance analysis, including detailed per-attribute comparisons across opaciy, rotation, scale, position, and spherical harmonics, is presented in Ta- ble 10. This sophisticated metric quantifies the distributional discrepancy between the ground truth cover and the stego cover in the 3D Gaussian parameter space, offering crucial insights into the imperceptibility of the hidden secret. The analysis reveals a notable pattern: the histogram distances between scale distributions parameters tend to distribute relatively uniformly in well-optimized 3DGS models regardless of content. In contrast, other attribute distributions, particularly opacity and rotation, exhibit higher variability between cover and stego models. This disparity suggests that these attributes provide more exploitable degrees of freedom for secret embedding while maintaining perceptual fidelity, aligning with our quantitative performance results. The 3D-Sinkhorn analysis thus provides statis- tical validation for our attribute update combination strategy, confirming that the method optimally utilizes the available feature space for steganographic purposes.
consistently minimal across all tested scenes, indicating that scale
H ADDITIONAL QUANTITATIVE RESULTS
Due to the unavailability of public codebases for existing 3D steganography methods (Zhang et al., 2024; Guo et al., 2024), we independently train the ground-truth cover and secret scenes from scratch using the original 3DGS framework (Kerbl et al., 2023). This approach ensures a fair baseline for comparison while maintaining consistency with standard 3DGS optimization procedures and ren- dering pipelines. The quality metrics (PSNR, SSIM, and LPIPS) of the original scenes prehensively documented in Table 11. Compared with the original scene performance reported by GS-Hider, our baseline models show lower scores across all 3 metrics. This performance gap in
3

---

Published as a conference paper at ICLR 2026
Table 9: Comparison of the average rendering speed and the adaptability of SIBR viewer (Kerbl et al., 2023).
Methods
Scene Type
SIBR Viewer
Averaged Rendering FPS
3DGS (Kerbl et al., 2023)
cover
130
X
45
GS-Hider (Zhang et al., 2024)
X
45
WaterGS (Guo et al., 2024)
cover
100+
secret
100+
130
KeySS
secret
130
Table 10: Detailed breakdown of 3D-Sinkhorn distances.
Updated attributes
3D Sinkhorn Distance,
Count
op
xyz
SH
Σ
op
xyz
SH
0.181
0.079
4e-4
0.030
0.038
0.034
0.268
0.133
5e-4
0.050
0.042
0.043
0.190
0.060
5e-4
0.041
0.042
0.047
0.211
0.099
4e-4
0.031
0.046
0.034
0.162
0.066
4e-4
0.030
0.040
0.026
2
0.175
0.063
5e-4
0.038
0.034
0.040
0.208
0.093
5e-4
0.038
0.044
0.033
0.329
0.084
4c-4
0.101
0.073
0.071
0.213
0.095
4e-4
0.042
0.041
0.034
3
0.206
0.084
5c-4
0.033
0.054
0.036
0.219
0.102
5e-4
0.048
0.043
0.026
0.185
0.077
4e-4
0.030
0.041
0.037
4
0.153
0.052
5e-4
0.027
0.037
0.036
0.430
0.301
5e-4
0.038
0.038
0.053
5
0.256
0.125
5e-4
0.035
0.037
0.058
the ground truth models should be considered when interpreting the steganographic results, as indicates our method starts from lower baseline across these metrics.
Comprchensive quality metrics (PSNR, SSIM, and LPIPS) for our method with the optimal attribute update combination are presented Table 12. The results demonstrate that our approach achieves strong rendering performance, with only minimal PSNR reduction of 0.78 dB compared to the original 3DGS baseline in Table 11. While our SSIM and LPIPS scores appear lower than those reported by GS-Hider, this discrepancy primarily stems from our ground truth models starting from a lower baseline across these metrics. When evaluating the relative performance degradation from their respective baselines, our method demonstrates comparable reduction margins GS-Hider. This suggests that despite operating under more challenging bascline conditions and incorporating additional security features, our steganographic approach preserves visual quality a similar level. As previously mentioned, our method can be extended to other advanced 3DGS models, ensuring broader applicability and compatibility with recent developments field.
I ROBUSTNESS OF THE DECODER
To rigorously evaluate the robustness of our proposed decoder architecture, we conducted ablation studies comparing performance with and without user-specific key integration. As shown Ta- ble 13, the decoder maintains comparable performance levels when incorporating user-specific keys relative to the baseline model without keys. This demonstrates that our key integration mechanism successfully enables multi-scene hiding capabilities and wrong key defense functionality without compromising the decoder's reconstruction quality. These results validate that the additional secu- rity features do not introduce performance degradation in the primary decoding task.

---

Published as a conference paper at ICLR 2026
Scenes
GS-Hider
KeyS8 (op.ro,texy2)
Coer
PSNK,
SSIM, 1
LPDS,
PSNK,
SSIM,
LPIPS, 1
PSNR1
SSIMI
LPIPS.
PSNR
SSIM-
LPIPS]
Bisycl
23,011
0.566
0.457
29.533
0.855
0.293
Heyele
34.377
0.735
0.254
23.333
0.59%
0.434
Boasai
31,081
0.93
0.167
25.456
0.798
0.350
Bonsai
31.147
0,937
31.294
0.934
0.164
Room
8:19
138877
0.389
Floams
19475
0.533
79.273
0.81
0.301
Treehill
Rowers
21.952
20.897
0.583
0.625
0.361
0.347
19.872
22,510
0,580
0.460
0.449
0.498
Theshll
Gadan
Sump
0.473
0:324
22.122
28.179
0.95
0.320
Garden
26.954
0.855
0.118
25.683
0.757
0.284
Stump
Counter
28.053
0.899
0.202
28.433
0.887
0.189
Average
Kitchen
29.588
0.921
0.129
30.226
0.918
0.146
KryS8
25 25,900
0.726
0.350
26.427
0,770
0.354
26.525
0.500
0.230
26.362
0.744
0.304
Accrage
CS- Hider
25,807
0.782
0.265
25.178
0,780
0.306
Table 11: PSNR, SSIM, and LPIPS scores of the pretrained ground-truth 3DGS models used in the proposed method, compared with those used in GS-HHdee.
Table 12: All metrics of our method on single secret hiding. Secret scene names are omitted for brevity; see Table
Scene
KeySS w/o key
KeySS w/ key
PSNR
PSNR
PSNR
PSNRueree
Ricycle
22,880
669
23.01
20.533
Bonsai
31.117
24.551
31.081
25.156
Room
30.813
23.494
30.75 785
23,877
Ratio
Sequemially
Ramlonly
19.476
PSN
PSNR
PSNR
PSNR
22.121
Garden
25.254
33.382
28.179
5%
25.980 960
267
25.588
26. 102
Sump
23.908
29. 106
23.827
29.452
10%
25.980
26
25.160
25.
Counter
28.189
20.811
28. 120
20.891
15%
25 980
46-427
74-714
25. 341
Kitchen
29.777
20.065
20 862
20.064
25%
25.980
26.418
23.739
24.408
Average
25,981
26.364
25,980
26.427
Table 14: Robustness analysis under different pruning methods.
Table 13: PSNR scores for comparisons be- tween the proposed method with and without user-specific keys. Secret scene names omitted; Table
J ROBUSTNESS OF THE PRUNING
We explore the method's behavior under different Gaussian pruning scenarios, including sequential pruning based on opacity values and random pruning. Sequential pruning removes Gaussians as- cending opacity order, targeting lower-opacity elements first, while random pruning stochastically removes a proportion of Gaussians regardless of opacity. Results in Table 14 suggest reasonable resilience under these modifications, with both pruning strategies showing generally acceptable per- formance. The steganographie information appears to maintain certain levels of stability even with partial Gaussian removal, indicating potential robustness against structural changes.
K MULTI-SECRET HIDING SCALABILITY
Our experiments on multi-secret hiding were limited by hardware constraints (one 24-GB RTX-6000 GPU), so we report results for two secrets under one cover. This extension was achieved without any architectural changes, demonstrating the flexibility of our framework. To explore scalability, we trained 3-secret hiding configuration using the same settings as the 2-secret case. As shown in Table 15 and Figure 10, increasing the number of secrets does not introduce key interference affect training stability. However, we observed a degradation in reconstruction fidelity due to the shared capacity of the cover model. Future work will address this by exploring deeper decoders, longer or curriculum based training schedules, increased model capacity, and regularization strategies to improve scalability.
SEMANTICAL SIMILAR CLIP PROMPTS
We performed experiments using synonyms and minor word-order variations, with visualizations in Figure. 9. The findings show that semantically similar keys substantially degrade the reconstruc- tion of the cover unauthorized access. This effect is due to the sensitivity of CLIP embeddings: even small semantic changes result in distinct embeddings, which our key-controlled decoder correctly interprets in-
without causing any secret leakage, thereby maintaining robustness against
5

---

Published as a conference paper at ICLR 2026
Table 15: Comparison of the average rendering speed and the adaptability of SIBR viewer (Kerbl et al., 2023).
Type
Scenes
PSNR (Tliding 2 secrects in cover)
PSNR (Tidiig 3 secrecis in cuver)
cover
bicycle
22.478
21.8
secret
bonsai
29.031
22.572
secret2
secret3
Counter
20.415
Cover
Secret (Correct Key)
Secret (Wrong Key)
"NubodyssoomooToee
KomwSoddyGonaaao
Figure 9: Visualizations of rendering secrets using the correct key and semantically similar incorrect keys (including synonyms and word-order variations)
valid keys. Moreover, we employ 16-character English codes (case-insense insensitive) as keys, making the likelihood guessing semantically similar key extremely low.
M MORE VISUALIZATION RESULTS
Comprehensive visualization results are provided in Figure 11 and Figure 12, offering deeper qual- itative insights into the method's performance across diverse scene types. Both single and multiple secret hiding scenarios demonstrate exceptional visual fidelity, with the correctly-kyeed reconstruc- tions preserving fine geometric details, texture consistency, and color accuracy, When accessed with incorrect keys, the framework demonstrates robust security properties: unauthorized users receive only the cover-scene-lie idenced by the absence of visual artifacts or structural inconsistencies that might otherwise sug- gest hidden content. These visualizations complement the quantitative metrics by confirming the method's 's practical effectiveness in maintaining the visual-pereeptual balance between high-quality secret reconstruction and security.
visualization with no discermible traces of the embedded secrets, as ev-
N LLM USAGE STATEMENT
We used large language models for text polishing and grammar correction during manuscript prepa- ration. No LLMs were involved in the design of the method, experiments, analysis. All content has been carefully verified and validated by the authors.

---

Published as a conference paper at ICLR 2026
Key1: "NoboddsSommakrooe"
Key2: "HowloldthheyFindd
Keys: "hyS:iTfts1ss
(8) Cover
(b) Secret1
(c) Secret2
(d) Secret3
Figure 10: Visualizations of the results on 3 secret hiding
op
op. ro
xyz.
op. syz (best)
cover
socrro vi cornact key
sec vi wrong key. syoeeaal wot.uuttaa itA.urou
op
xyz
xyz (pest)
cover
Recrid on co May Wellonil aeatoroe
secret an wronn key: Tulooiis
Figure 11: More visualizations of the proposed method on hiding single secert across different at- tribute update combinations using correct and incorrect keys, which show cover recovery, secret recovery (correct key) and security preservation (incorrect key). Notation follows Figure 4.

---

Published as a conference paper at ICLR 2026
secret1 w key1
secret2 key2:
wrong key
cover
HowWocdkTheyyFrd
'ppOttri wuFmall2
9R- O4
Xxp
36
go
secret1 w key1
secret2 w key2:
wrong key "FrByyFeVEEDAAr2
HowWlouddheyFFrr
8 rr
xyz
Figure 12: More visualizations of the proposed method on hiding multiple secrets across different attribute update combinations using correct and incorrect keys, which show cover recovery, secret recovery (correct key) and security preservation (incorrect key). Notation follows Figure 4.
8


Reviews:
[{"review_id": "nfoEHtDRvO", "reviewer": "Reviewer_6JSy", "summary": "This paper presents KeySS, a 3D scene steganography framework built upon 3D Gaussian Splatting (3DGS). The method embeds complete secret scenes within a cover representation while maintaining high visual fidelity and compatibility with standard 3DGS rendering. A key-conditioned decoder, guided by CLIP-based semantic embeddings, modulates selected Gaussian attributes to securely encode and decode hidden content. To evaluate imperceptibility, the authors introduce a 3D-Sinkhorn distance that quantifies subtle distributional deviations in Gaussian parameter space.The paper’s main strength lies in its innovative integration of key-controlled steganography into 3D Gaussian Splatting, achieving secure multi-scene hiding with high fidelity and full rendering compatibility.", "questions": "Technically, the paper adapts fundamental ideas from information security and steganography to the 3DGS framework. It incorporates a key-controlled access mechanism into a neural decoder, where CLIP text embeddings act as learnable semantic keys that determine whether the model reconstructs the hidden scene or reproduces the visible cover. The classical concept of secure hiding, which reveals the secret only with the correct key and restores the cover otherwise, is reinterpreted in the 3D Gaussian parameter space by modulating attributes such as opacity, rotation, and position instead of image pixels. In addition, the paper extends the notion of distributional detectability from traditional steganalysis to 3D by introducing the 3D-Sinkhorn distance, a metric designed to measure subtle distributional variations among Gaussian parameters. Together, these components represent a careful transfer of established security mechanisms into modern 3D scene representation learning.\n\nThe method jointly optimizes the cover and multiple secret scenes using a shared decoder, which raises potential concerns about overfitting among different supervision signals. It is not explicitly stated whether the reported quantitative results are obtained on training views or unseen novel views. Since the model operates on 3D Gaussian representations, it would be important to clarify this evaluation setting and, if possible, include visualizations of the reconstructed geometry (for example, depth maps or mesh) to verify consistency. \n\nIn addition, The paper demonstrates a two-secret configuration under a single cover but does not discuss scalability beyond this case. It would be valuable for the authors to clarify potential challenges in extending the framework to N > 2 secrets, such as interference between keys, degradation of reconstruction fidelity, or training instability.", "limitations": "", "rating": 4, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "The paper’s main strength lies in its innovative integration of key-controlled steganography into 3D Gaussian Splatting, achieving secure multi-scene hiding with high fidelity and full rendering compatibility.", "weaknesses": "Please see questions.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "kNkxFGqryT", "reviewer": "Reviewer_syDs", "summary": "This paper introduces KeySS, a novel key-secured 3D steganography framework built upon 3D Gaussian Splatting (3DGS) for hiding 3D secrets within 3D scenes. Unlike prior 3D steganographic methods that rely on suboptimal Gaussian features and risk detectability, KeySS jointly optimizes a 3DGS model and a key-protected decoder to balance reconstruction fidelity and steganographic security. The framework enables multi-secret hiding and prevents unauthorized access via a controllable key mechanism. It also proposes 3D-Sinkhorn distance analysis, a new metric to quantitatively evaluate imperceptibility by comparing Gaussian distributions between normal and steganographic scenes. Extensive experiments demonstrate that KeySS achieves state-of-the-art reconstruction quality and strong security guarantees, while remaining efficient and scalable for multi-GPU training.", "questions": "Please refer to the weakness.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. End-to-End 3D Steganography Framework: The paper proposes KeySS, an end-to-end 3D steganographic learning framework that jointly optimizes 3D Gaussian representations and a key-secured decoder, ensuring both high-fidelity rendering and strong steganographic compatibility with the standard 3DGS pipeline.\n\n2. Key-Secured Decoder for Multi-Secret Recovery: A key-controllable decoding mechanism is introduced to enable secure and accurate reconstruction of multiple hidden 3D secrets, effectively preventing unauthorized access.\n\n3. Fidelity–Security Tradeoff Analysis and New Metric: The authors systematically explore how different 3D Gaussian feature combinations affect fidelity and imperceptibility, and propose 3D-Sinkhorn distance, a novel quantitative metric for evaluating steganographic security beyond traditional 2D measures.", "weaknesses": "1. Although KeySS enhances security, its rendering speed is slower than standard 3DGS, which may limit its applicability in real-time scenarios.\n\n2. The authors should provide more illustrative examples and application scenarios to better explain the necessity of introducing key-control, thereby enhancing the motivation, significance, and practical relevance of the paper.\n\n3. The improvement in rendering quality over GS-Hider is relatively limited, while the performance degradation compared to standard 3DGS is significant.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "2idrK9A0R9", "reviewer": "Reviewer_noTZ", "summary": "This paper introduces KeySS (Key-Secured 3D Steganography), a novel end-to-end framework for hiding 3D secret scenes within a 3D Gaussian Splatting (3DGS) cover scene. The core contributions includes (1) a joint optimization framework that learns the 3DGS cover representation and a key-secured decoder simultaneously, (2) a novel security-enforcing loss function ($\\mathcal{L}_{incorrect}$) 1 that trains the decoder to reconstruct the original cover scene when an incorrect key is provided, thus preventing unauthorized access, and (3) a new security evaluation metric, 3D-Sinkhorn distance , which measures the statistical imperceptibility of the steganography directly in the 3D Gaussian parameter space, offering a more robust analysis than traditional 2D render-based metrics.", "questions": "Please refer to Weakness part.", "limitations": "", "rating": 8, "confidence": 3, "soundness": 4, "presentation": 2, "contribution": 2, "strengths": "- This work represents a major step forward for 3D steganography. It provides a solution that is not only effective but also practical: it is secure (multi-key, wrong-key defense), high-fidelity, and computationally efficient (maintains 130 FPS rendering). The ability to hide entire 3D scenes (not just watermarks) opens new application possibilities. Furthermore, the 3D-Sinkhon metric is a significant contribution to the community and will likely become a standard for evaluating future work in 3D representation steganography.\n\n-  The KeySS framework is well-designed, end-to-end, and thoughtfully engineered (e.g., using $1 \\times 1$ convolutions inspired by PointNet in the decoder). The experimental evaluation is comprehensive and convincing.", "weaknesses": "The framework is designed to hide secret 3D scenes within a cover 3D scene ($\\mathcal{G}_{cover} \\rightarrow \\mathcal{G}_{secret}^s$). This is a powerful capability. However, traditional steganography often involves hiding other data types, like text documents, bitstreams, or audio. It is unclear how KeySS would be adapted for this. Would the text file first need to be represented as a 3DGS scene? This seems inefficient. A brief discussion on the framework's adaptability to more conventional steganographic payloads would be beneficial.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "5VnTSYzY1P", "reviewer": "Reviewer_djaB", "summary": "This paper proposes KeySS, an end-to-end 3D steganography framework that hides multiple secret 3D scenes inside a cover scene using 3D Gaussian Splatting, while maintaining compatibility with standard rendering pipelines. It introduces a key-controlled decoder to ensure that only the correct key can reveal the hidden secrets, and develops a 3D-Sinkhorn metric to evaluate imperceptibility in the 3D Gaussian space. Experiments show that KeySS achieves high reconstruction fidelity, strong security against unauthorized access, and flexibility for multi-secret hiding.", "questions": "Refer to the weakness section.", "limitations": "", "rating": 4, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "The paper proposed a novel end-to-end framework for 3D steganography, especially for 3D Gaussian Splatting.\n- Key-secured decoding architecture is utilized to transfer the original Gaussians to a set of secret Gaussians, which also supports multiple-secret hiding.\n- A new metric, the 3D Sinkhorn distance, to measure the distributional disparities between the original and steganographic Gaussians.\n- Extensive Experiments on Mip-NeRF360 and Deep Blending, and ablation studies have shown the effectiveness of the proposed method\n- The paper is well written, and the method clarification is clear.", "weaknesses": "1. **Concept confusion**: The 'features', utilized in Line 015, Line 100, Line 107, etc, should be the 'attributes' of Gaussians. Using the term \"feature\" may cause confusion with the \"feature\" is used in GS-Hider.\n\n2. **Motivation should be further clarified**: \n- Mentioned in Line 48, the rendering strategy in GS-Hider introduces deviations from the standard GS pipeline. It’s unclear what these deviations refer to, and whether any experiments or visualizations support them. The Keyss method also adds extra MLPs; does this not also deviate from the standard GS pipeline?\n- The main motivation of the proposed method is that \"Gaussian Attributes\ncontribute unequally to steganographic effectiveness\", while all attributes are equally learned, a transformation from the original Gaussian via a set of MLPs. However, all attributes are transformed equally via a shared set of MLPs. Moreover, Tab. 4 shows that all attributes except 'SH' are used, which seems inconsistent with the stated motivation. Since the method essentially learns a transformation of the secret scene, it is natural that all attributes are required for rendering in a new scene. Therefore, further clarification is needed on how the method design aligns with the proposed motivation.\n\n\n3. **Clarification of the used metrics**:\n- The proposed 3D Sinkhorn distance is less motivated: The Sinkhorn distance differs from the Wasserstein distance (commonly used Optimal Transport) mainly by the addition of an entropy regularization term. A theoretical justification for choosing Sinkhorn over standard OT is needed, as the motivation behind this choice is not clearly explained.\n- Main results in Tab. 1 show the effectiveness of the proposed method only by PSNR, while the component selection for the proposed are mainly depends on the proposed Score, shown in Tab. 4. This inconsistent use of the two metrics is confusing. Moreover, the ranking of different settings by Score in Table 4 does not align with their PSNR rankings, which calls for more visual evidence to justify that Score is a more effective metric than PSNR.\n\n\n4. **Experimental Details**:\n- The comparison with related work in the experiments is insufficient (only compared with GS-Hider), though clarified in Line 322 WaterGS and SecureGS are both not open-sourced.\n- The input key is embedded with a Clip text encoder. When the input wrong key is semantically similar but not identical to the correct key (e.g., synonyms or slight word order changes), can the model still successfully reconstruct the cover scene? Additionally, the ratio of correct and wrong keys used during training should be clearly described.\n- The scales of the scenes in Mip-NeRF360 and DeepBlending differ, resulting in different camera intrinsics and extrinsics. How these camera details are handled should be clearly explained.\n\n5. **Visualization should be refined**: \n- Fig.1 and Fig.2 are hard to follow due to low-contrast colors and unclear fonts. The color scheme makes it difficult to distinguish key elements, and the font choice affects readability. Improving visual clarity would make the diagram easier to understand. \n- The Visualization in Fig.4, Fig.5 are blurred. The specific resolution settings for MIP-NeRF360 and DeepBlender used in the experiments should be explicitly reported for reproducibility and fair comparison.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)