GaussianMarker: Uncertainty-Aware Copyright Protection of 3D Gaussian Splatting
Authors: Xiufeng Huang
Ruiqi Li
Yiu-ming Cheung
Ka Chun Cheung
Simon See
Renjie Wan
Venue: NeurIPS 2024 poster (2024)
Keywords: 3D Gaussian splatting; Uncertainty estimation; Digital watermarking;
Primary area: privacy

Abstract: 3D Gaussian Splatting (3DGS) has become a crucial method for acquiring 3D assets. To protect the copyright of these assets, digital watermarking techniques can be applied to embed ownership information discreetly within 3DGS mod- els. However, existing watermarking methods for meshes, point clouds, and implicit radiance fields cannot be directly applied to 3DGS models, as 3DGS models use explicit 3D Gaussians with distinct structures and do not rely on neural networks. Naively embedding the watermark on a pre-trained 3DGS can cause obvious distortion in rendered images. In our work, we propose an uncertainty- based method that constrains the perturbation of model parameters to achieve invisible watermarking for 3DGS. At the message decoding stage, the copyright messages can be reliably extracted from both 3D Gaussians and 2D rendered im- ages even under various forms of 3D and 2D distortions. We conduct extensive experiments on the Blender, LLFF, and MipNeRF-360 datasets to validate the effectiveness of our proposed method, demonstrating state-of-the-art performance on both message decoding accuracy and view synthesis quality.

GaussianMarker: Uncertainty-Aware Copyright Protection of 3D Gaussian Splatting
Xiufeng Huang 1.2, Ruiqi Li', Yiu-ming Cheung', Ka Chun Cheung,,
Simon See², Renjie Wan
Department of Computer Science, Hong Kong Baptist University
2 NVIDIA Technology Center
xi xiufenghuang@liffe hkbu. edu. hk, {esrqli, ymcm)comp. hkbu. hk
{chcheung, (see)@nvidia com, renjiewan@hkbu.c edu. hh
Abstract
3D Gaussian Splatting (3DGS) has become a crucial method for acquiring 3D assets. To protect the copyright of these assets, digital watermarking techmiques can be applied to embed ownership information discreetly within 3DGS mod- els. However, existing watermarking methods for meshes, point clouds, and implicit radiance fields cannot be directly applied 3DGS models, as 3DGS models use explicit 3D Gaussians with distinct structures and do not rely neural networks. Naively embedding the watermark on a pre-trained 3DGS can cause obvious distortion in rendered images. In our work, we propose an uncertainty- based method that constrains the perturbation of model parameters to achieve invisible watermarking for 3DGS. At the message decoding stage, the copyright messages can be reliably extracted from both 3D Gaussians and 2D rendered im- ages even under various forms of 3D and 2D distortions. We conduct extensive experiments on the Blender, LLFF, and MipNeRF-360 datasets to validate the effectiveness of our proposed method, demonstrating state-of-the-arf performance on both message decoding accuracy and view synthesis quality. Project page: https://teinnhungxffgtbbbb wwwpp//wwwwh..bboooaaaaaaaaaaaaa
Introduction
3DGS has introduced new category of 3D assets that can be readily created and extensively distributed online (2]. However, the ownership of these created 3D assets can be vulnerable if malicious users distribute and manipulate the 3DGS without authorization. How can we effectively protect the ownership of those created 3DGS models?
3DGS represents the scene via 3D Gaussian parameters, which can be standardized into point cloud formats. Such formats can be easily shared and show strong compatibility with the mainstream 3D assets processing pipeline 3 However, unauthorized users can exploit this convenience to distribute 3DGS models and maliciously alter the 3D) Gaussian parameters. These unauthorized 3DGS models can then be easily used to produce 2D images. Since ownership of 3DGS models can be compromised through unauthorized manipulations of 3D Gaussian parameters and 2D images, an effective ownership solution should enable owners to assert their rights over both the 3D Gaussian parameters and the corresponding 2D images.
Similar to copyright protection for digital assets such videos and images, protecting copyright for 3DGS models can be achieved via digital watermarking, Aligned with the established principles in digital watermarking 4 55, effective copyright protection methods for 3DGS models should satisfy
Cooresponding author.
38th Conference on Neural Information Processing Systems (NcurIPS 2024).

---

Copyright embedding
Unauthorized manipulation
Copyright verification
Binary message
Decoder
Bob
GarkeianMarkeer
Malicious user
Noise
Blur
JPEG_
Bob
"Bob model"
Edited rendered images
0
3DGS model
Watermarked model
Edited
Cropout
Rolation
Scale
Message extraction
model
Edited Gaussians
Figure I: Our proposed scenario for copyright protection over the 3DGS assets. Once users have created 3DGS assets, they can apply our proposed 3DGS watermarking method to create watermarked 3DGS models. If unauthorized users maliciously apply 3D editing or different volume splatting settings on the watermarked 3DGS model, the 3DGS model owners can reliably retrieve the copyright message from the altered 3D Gaussian parameters or rendered 2D images to verify ownership.
two key standards. First, they should maintain invisibility, ensuring that the embedded copyright messages do not cause significant distortion in both 3D Gaussian parameters and the rendered 2D images. Second, they should exhibit robustness, enabling reliable extraction of the copyright messages even under various 2D or 3D distortions.
Although several methods 4 have been investigated to protect the copyright of radiance fields, these methods are specifically designed for Neural Radiance Field (NeRF) [7]. framework known for its implicit property. For example, CopyRNeRR 4 embeds copyright messages via multilayer perceptrons (MLPs) into the implicit neural parameters in NeRF 7 and extracts the copyright messages from rendered 2D images. However, embedding messages into 3D Gaussian parameters via MLPs can easily undermine the 3D Gaussian positions and lead to noticeable geometry distortions in the rendered images, thereby degrading the invisibility. Additionally, since current copyright solutions for NeRF only extract messages from rendered images, 3DGS model owners lack approaches to directly extract ownership messages from the 3D Gaussian parameters. This hinders the direct assertion of ownership over 3DGS model, thereby undermining the robustness.
Rather than directly embedding the copyright messages into the Gaussian parameters, we propose an uncertainty-io aware watermarking method to optimize the embedded copyright messages. We apply Laplace approximation to estimate the uncertainty [S] in the radiance fields for determining how large we can add perturbations different 3D Gaussian parameters. From Bayesian inference perspective (9. 3D Gaussian parameters with high uncertainty can tolerate larger perturbations. Thus, we keep the original 3D Gaussian parameters unchanged and densify 3D Gaussian parameters with high uncertainty. These newly densified 3D Gaussians are regarded as the perturbations for embedding copyright messages. Such perturbations can be transmitted into rendered 2D images with unperceivable distortion, which ensures invisibility.
To ensure robust copyright message extraction on both 3D Gaussian parameters and rendered 2D images, we utilize both 3D and 2D message decoders. The 3D message decoder extracts the copyright messages on the 3D Gaussian parameters based PointNet [T] architecture. The 2D message decoder based on the image watermarking method HiDDeN II extracts the copyright messages on rendered 2D images. We incorporate 3D and 2D distortion layers into our training process to ensure robustness of copyright message extraction against various malicious manipulations. The 3D distortion layer is designed to defend against malicious 3D editing, such as noise, translation, rotation, and cropping. Mcanwhile, the 2D distortion layer is designed to withstand significant degradation in the rendered images, such as noise, JPEG compression, scaling, and blurring.
Our whole framework is shown in Figure we estimate the uncertainty for the 3DGS model to add perturbations to different 3D Gaussian parameters. Then, we keep the original 3D Gaussian parameters unchanged and densify 3D Gaussian parameters with high uncertainty. These newly densified 3D Gaussians are regarded as the perturbations for embedding copyright messages and can be verified via 3D Gaussian parameters and 2D images. Our contribution can be summarized as follows:

---

A novel method to help claim the ownership of 3D Gaussian Splatting models.
A uncertainty-aware message embedding strategy to incorporate 3D perturbations into selected 3D Gaussian parameters to achieve invisibility.
The copyright messages can be extracted from both 3D Gaussian parameters and rendered 2D images, showing robustness to different 3D and 2D distortions.
2
Related works
3D Gaussian Splatting. 3DGS has been rapidly adopted across multiple domains and has demon- strated remarkable results. Unlike NeRF (77 and its variants [12 reply on the implicit neural representation (INR) to reconstruction the 3D scene, 3DGS [T] has an explicit point cloud structure and has been expanded to various developments and applications. Mip-Splatting [15] utilizes a 3D smoothing filter and a 2D Mip filter to address frequency constraints for effective anti-aliasing Dynamic 3DGS [16 represents the dynamic motion of the scene by processing the center location and rotation of each Gaussian over time, which enables dense non-rigid 6-DOF tracking of the entire scene. SuGar 17 reconstructs the mesh surface with a regularization term for the Gaussian Splatting optimization to promote alignment of the Gaussians with the scene's surface. 3DGS avatar [T8] is a brand-new way to create digital humans compared with traditional methods based on 3D human meshes such SMPL [9]. With the rapid development of point-based 3D Gaussian rendering, it is necessary to develop an efficient copyright protection method for 3DGS [ models.
2D digital watermarking, Traditional 2D watermarking methods typically embed information in the least sigmificant bits (LSB) of image pixels (20]. Other advanced methods encode information into the frequency domains based on the Discrete Wavelet Transform (DWT) and Singular Value Decomposi- tion (SVD) [21 22]. Deep-learning [23 26 has made significant progress in image watermarking
27 33 traditional methods. RedMark (5) introduces scalable residual connections for embedding binary images in any transform domain. Robustness is critical requirement for watermarking, ensuring resilience against various distortions and even adversarial attacks 34 35
HiDDeN [ is one of the first deep image watermarking methods that outperformed
Deep-learning-basee
watermarking methods have emerged crucial component in video copyright protection (5] 28 36),
such as RivaGAN [36,, which utilizes an ireetiionbbsee mechanism for embedding hidden messages in videos. However, the 2D digital watermarking methods for images or videos can differ significantly from 3D digital watermarking methods for explicit 3D models.
3D digital watermarking. Most 3D digital watermarking approaches are designed for explicit 3D models [1] J. For example, Deep 3D-to-2D [1 can embed messages in 3D meshes [38] and
retrieve them from 2D rendered views 43)
Recently, several 3D digital watermarking approaches
4 455 have emerged for NeRF 7 to watermark the implicit neural representation (INR) and extract the hidden information from the rendered images. CopyRNeRF 4 generates Watermarked color representations to ensure the invisibility of hidden copyright messages. StegaNeRF [6] designs an optimization framework for steganographic information embedding in NeRF renderings. However, both explicit 3D watermarking [37 38 41 and NeRF watermarking approaches [4, 6 are not applicable for 3DGS simultancously protect the explicit 3D Gaussians and the 2D rendered images. This motivates us to develop digital watermarking for 3DGS models.
Preliminary of 3D Gaussian Splatting
Starting from a sparse set of cennturr-froo-Moone (SIM) [46] points, the goal of 3DGS [ is to optimize a scene representation that enables high-qualit, novel view synthesis. The scene is modeled as a collection of 3D Gaussians:
G(x) e "---d-)"---(------ (
where x is any positions in the 3D scene, is the 3D Gaussian center position, and Σ is the 3D Gaussian covariance matrix. By utilizing a scaling matrix S and rotation matrix Rt we can determine the corresponding Σ R.SST Rº and ensure Σ is positive semi-definite. The 3D Gaussians need to be further projected to 2D Gaussians for rendering by volume splatting [47] method. During rendering, 3DGS follows typical neural point-based approach [48] to compute the color C' of
3

---

pixel by blending / depth ordered points:
C=
E G;a: II IEN
(1-a,), j=1
(2)
where o is the color estimated by the spherical harmonics (SH) coefficients of each Gaussian, and ag is given by evaluating 2D Gaussian with covariance Σ' [49 multiplied with per-point opacity. Consequently, the 3D Gaussians g contain parameters A including five different properties {μ,, R. S, a to represent 3D scene.
4 Proposed method
Our scenario is shown in Figure We propose embedding copyright messages into 3D Gaussian parameters protect the copyright of 3DGS models. These messages can extracted from both the 3D Gaussian parameters and the rendered 2D images. The proposed uncertainty-aware watermarking method can claim ownership over both 3D and 2D assets derived from 3DGS models. As mentioned in Section [ an effective watermarking algorithm for 3DGS models should achieve both invisibility in rendered novel views, and robustness in decoded messages, via the optimization goal of:
L= d1 i} + d2( M).
(3)
rendered view
message decoding
where I is the rendered novel view, i is the ground truth image, D is the message decoder and M is the copyright message. We can use appropriate distance metrics dN and dy to estimate and minimize the error in rendered views and decoded messages. A straightforward method could be embedding the copyright messages as perturbations into the 3D Gaussian parameters. However, directly embedding perturbations into 3D Gaussian parameters without constraints can easily undermine the position and geometry of 3D Gaussians and cause obvious distortion in the rendered images. To solve this issue, we propose uncertainty-aware perturbation strategy to embed copyright messages, illustrated below.
4.1 Uncertainty-aware 3DGS watermarking
Estimating the uncertainty of Gaussian parameters. To ensure the invisibility of embedded messages in both the 3D and 2D domains, we allow only a subset of the 3D Gaussian parameters where ownership messages that the Gaussian parameters with high uncertainty are more tolerant to external perturbations, we select parameters with high uncertainty incorporate ownership messages. If we estimate the model parameter posterior p0 D), where 0 is the model parameters of the 3D Gaussians model G and D is the training dataset, then the predictive distribution p([[V, D) can be computed by marginalize over the model posterior:
be embedded. Specifically, as previous works 9 have already shown
P(VV = p(I V, ()) EE- (p(I V, 0)..
where I is rendered image at test view V. In this inference integration, for converged model, parameters 0" with larger uncertainty quantified by posterior variance can tolerate greater perturbation. Therefore, we densify only the parameters above uncertainty threshold Tune to add perturbations for less impacting the rendered images. Laplace approximation provides an analytical expression for posterior distribution in the form of a Gaussian distribution with the mean equal to the maximum a posterior (MAP) estimation 0 = 0 [50). and the covariance equal to the reciprocal observed Fisher information: DD) N (0) r). Thus, the uncertainty of the 3DGS parameters can be
estimated by the Hessian matrix H [I V, 0*] as the approximated Fisher information [5T]:
H II 0 Vof (V V2 H [I] f (V:0") Vef (V;0"),
(5)
where / /V; 0*) is the rendered image with the converged 3D Gaussians parameters 0* view V and V /iv.or) H [ (V:0") as we assume the covariance of RGB in images is equal to one
8.. Hence, the Hessian matrix can be simplified as: H [I V, 1 = Vef (V:0*) Vof (*)

---

Uncertenoy-4arr 1005 vatermarking
lighh uinceraaity
Originl Gaussian
Original Gaussion
perturbation
Density
Low uncertainty
Watermareed 3D Geussiars
3DG5 model
Uncertainty estimation
3D G Gaussions
U Unceriainty aware mejermarking
Orgintience
L
Cooriggt
Cauncin Salating
Taasages
Dj
resiox ERccke
Origial 2005
Waterrureed 1015
30 dettrtions
20 masage
decoder briiiigg
D
D
BiLr
Scaling
Cozyrigt mensages
Figure 2: The overview of our proposed uncertainty 3DGS watermarking. We apply uncertainty estimation to the created 3DGS model. The 3D Gaussians with high uncertainty will be densified. These new densified Gaussians will be regarded as the 3D perturbations and embedded into the original Gaussians to create watermarked 3D Gaussians. The copyright messages can be retrieved from the watermarked 3D Gaussians via the 3d message decoder under various 3D editing. The copyright messages can also be retrieved from the watermarked images via the 2D message decoder against various 2D distortions.
As Fisher Information is additive, compute the model uncertainty U by summing the Hessians of model parameters across all different views in the training dataset D:
U Σ H HIIV 1=1
where is the index and N is the total samples in D. and all Gaussian parameters are used to calculate
the uncertainty of the 3DGS model: [I V, 0*] H V 0 HI V, V. + V V.
H[ I V. 0% H [ V.0%).
Marker As shown in Figure 2 we demonstrate the overall framework of our proposed uncertainty-awer 3DGS watermarking, aka GaussianMarker. By leveraging the quantified uncer- tainty U of the created 3DGS model, we can effectively distinguish between parameters that are resilient to perturbations and those that are vulnerable. Parameters exhibiting low uncertainty are identified as highly sensitive to perturbations. Conversely, parameters characterized by high un- certainty are more tolerant to perturbations, implying that perturbations can be embedded in these areas with negligible impact on the quality of the final rendered images. By targeting 3D Gaussians with high uncertainty, we can incorporate effective 31) perturbations that remain detectable by our designated message decoders, and maintain invisibility on the 3D Gaussians and rendered images. To achieve this, we retain the integrity of the original 3D Gaussians, denoted as G. We then densify those 3D Gaussians with high uncertainty. The new densified Gaussians are regarded the perturbations G for copyright message embedding:
g (g( G, E U, Tane),
where g(G.) is the densified Gaussian with the densify function g(-) on the 7th Gaussian G, by random sampling new position jú, under the distribution jú NN E.) and other Gaussian parameters are cloned, U, is the uncertainty of G, and Tane is the threshold for uncertainty. We compute the average uncertainty value of all original 3D Gaussians G as the default uncertainty threshold:
Tune U/L. where L is the total number of the 3D Gaussians in G We dub as proposed GaussianMarker for embedding the copyright messages. Similar to image watermarking methods apply 2D perturbation on the cover images, we directly embed GarssianMarker Ò into the original Gaussians G to compose the watermarked Gaussians Č = U ğ. Under the position sampling distribution of 14 N(,, Ex), GaussianMarker have a subtle geometry difference with the
TTh influence of different uncertainty thresholds is further discussed the supplementary materials.
5

---

Original 3DGS
Watermarked 3DGS
Difference (x10)
aarer
Figure 3: Visualization the results obtained by our proposed approach. For each row, we display the original rendered image, the watermarked rendered image, the difference (x 10) between the watermarked and original rendered images, and our proposed GaussianMarker as 3D perturbations for copyright message embedding. The scalings of MarseianMarker are adjusted for better visualization. We provide more visualization examples in the supplementary material.
original Gaussians Moreover, GaussianMarker 9 can be effectively transmitted into the rendered images based on the point-basse rendering in Equation (2). We optimize GaussianMarker Ç in the Section 4.3 that such 3D perturbations be effectively detected by both 2D and 3D message decoders. In Figure 3 we present visualization results, which demonstrate its capability to embed copyright messages imperceptible 3D perturbations.
4.2 Message decoders
2D message decoder rendered images. select the classical HiDDeN [1] as the 2D message decoder Dx to retrieve copyright messages from the rendered 2D images. The HiDDeN [I] encoder takes a cover image V,, and a binary message M with length N,, as the inputs. The HiDDeN [TT] decoder outputs a residual image of the same size as 2D perturbation applied on the original image to produce watermarked image Tu = Io - 8. Specifically, we first pre-train HiDDeN [IT] encoder and decoder to obtain comprehensive understanding of image watermark embedding and extraction processes. During training, similar to the settings in HiDDeN [1]] for the robustness at the image level, we apply several types of 2D distortions including Gaussian noise, random rotation, random cropping, and JPEG compression. After training, the HiDDeN [I]] encoder and the adversarial network are discarded. We then use this pre-traine pre-trained HiDDeN decoder to optimize our GaussianMarker I mentioned in Section 4.3
3D message decoder for Gaussians. The inherent complexity of the implicit neural representation in NeRF ?7] presents significant challenges for copyright message extraction directly from the neural network parameters. On the contrary, 3DGS [1] represents the 3D scene by 3D Gaussian parameters with explicit geometry. Traditional 3D watermarking embeds and retrieves messages from 3D meshes. The deep learning-based 3D watermarking methods utilize networks such as PointNet [10] to enhance the message embedding process in 3D meshes[4]] Although 3D Gaussians have different geometrical representations from the 3D meshes, the PointNet [10] architectures can be easily adapted to 3D Gaussians by regarding the 3D Gaussian mean μ the point position and other parameters as the associated point features. Thus, we adopt the PointNet 10] as our 3D message decoder D to retrieve copyright messages from the watermarked 3D Gaussians G. In specific, we randomly sample subset Gaussians (from 10k 50k) from the watermarked Gaissians & and treat these

---

selected Gaussians as watermarked points Pw. A PointNet-like 3D message decoder De: is used to decode the copyright message M from these watermarked points M = (P. Similarly, also randomly sample same number subset Gaussians on the original Gaussians Ç and treat these selected Gaussians original points P.. A PointNet-like discriminator Dg is used to distinguish the original points Po and the watermarked points P... The 3D message decoder D, uses a PointNet [T0] architecture, with a modified fully connected layer predict the copyright messages. The 3D discriminator De also uses PointNet [10] architecture with a fully connected output layer for binary classification.
4.3 Optimization
Our optimization contains two phases. In the first phase, we distill the watermarking knowledge from the 2D message decoder to the embedded GaussianMarkker for predicting copyright messages on rendered 2D images. In the second phase, optimize the 3D message decoder with the watermarked Gaussians & for predicting copyright messages on 3D Gaussian parameters.
Distilling watermarking knowledge. We keep the original 3D Gaussians G unchanged, and optimize the embedded GaussianMarker & via teacher-student knowledge distillation. As discussed [52], the pre-trained feature from 2D space can be distilled to the 3D space. Thus, 2D message decoder Dx as the teacher network to distill watermarking knowledge from the 2D perturbation on images to the 3D perturbation in GaussianMarker S. During the optimization for the embedded GaussianMarker 9. the copyright messages can be decoded from the watermarked image I, via the 2D message decoder Dx as M = Dx (Iw), where M is the copyright messages decoded by Dx and L is rendered by the watermarked Gaussians G. We compute binary cross entropy (BCE) between the original message M and the decoded message M as the message loss Lusg to ensure watermarking capability:
the pre-trained
mmag - (Mlog(M) (1 log(1 (M))
(8)
We also use the photometric loss Cree - 1.1l2 between the watermarked image I, and the original images I, for multi-view consistency. We combine the Lmsg and free into the final 2D watermarking loss L2D d Lung Agfreee where λ1, A2 are the weights for adapting the losses.
Optimizing 3D message decoder. Once the embedded GaussianMarker ② is optimized, to train the 3D message decoder D, with the watermarked Gaussians S. To make our 3D message decoding robust to different 3D distortions, we add a 3D distortion layer 7 during the 3D message decoder optimization. Several commonly used 3D distortions are used: 1) additive random Gaussian noise with parameter a; 2) random axis-angle rotation with parameter r;; 3) random translation with parameter t; and 4) random cropout with parameter cr. The copyright messages M' can be decoded from the randomly selected watermarked points P,, from the watermarked Gaussians & via the 3D message decoder Di M' (T((.,.))) ).). We compute the BCE between the original message M and extracted message M' as the 3D message loss Lmag'' (M log(M') ) (1- MM) log()olg)))))) M' )). We also apply the adversarial loss Ladu to optimize the 3D discriminator Dę for classifying the original points P, and watermarked points P.:
proceed
Ladv log(1 De(T((P))) + Iog(D)
We combine mag' and Ludv into the final 3D watermarking loss LSD = X Xif + X2 Ladvv where Xj. X₂ are the weights for adapting the losses.
Experiments
5.1 Experimental settings
Dataset. We use three benehmark datasets for evaluation: Blender (8 detailed synthetic objects),
LLFF 53 (9 real-world scenes), and Mip-NeRF360 [54] (9 real-world scenes). For Blender (
we directly follow the dataset splitting to use 100 viewpoints for training and 200 views for testing.
For LLFF [53), we follow the dataset splitting in NeRF [7]. In general, 1/8 images in each scene
7

---

used for testing and others for training. For Mip-NeRF360 [54], we use train/test split suggested by Mip-NeRF360, taking every 8th photo for testing and others for training. All testing viewpoints are used to compute the average values during the evaluation session.
Implementation details. As our motivation is protect the copyright of 3DGS that has already been created, we define our training into two stages. In the first stage, we create 3DGS models by training them on Blender 77, LLFF [53], and Mip-NeRF360 [54] datasets following standard settings M. We also train HiDDeN M to obtain the pre-trained 2D message decoder. In the second stage, we apply our proposed uncertainty-aware watermarking method to generate GarseianMarker via Equation 7 We then freeze the original Gaussians and use the pre-trained 2D message decoder to supervise the training of our GaussianMarker G. We then train our 3D message decoder retrieve the copyright message from the watermarked 3D Gaussians G. We apply several types of 2D and 3D distortion layers on the watermarked 2D images and 3D Gaussians to achieve robustness. We use the default optimization setting in 3DGS [ to optimize our Marker G. We use the Adam optimizer (24] optimize the 3D message decoder Du and classifier Dę with default values 3, = 0.9, 32 0.999, 10-8 and a learning rate 1 10-1 that decays following the exponential scheduler during optimization. We set λ = 10.0, A2 = 1.0 for 2D watermarking loss Cnn and X = 2.0, X = 1.0 for 3D watermarking loss CaD to adapt the training losses. The training takes 1000 (Blender, LLFF) or 2000 steps (MipNeRF360) and can finish within 20 minutes using single NVIDIA V100 GPU.
Baselines. We design experiments to validate the message extraction on both rendered 2D images and 3D Gaussian parameters, demonstrating the effectiveness of our proposed method. For 2D message extraction, compare our proposed method with four baselines for fair comparison: 1) CopyRNeRF A state-of-the-art method for protecting the copyright of NeRF (7] by using watermarked color representation; 2) HiDDeN M + 3DGS M. Preprocessing images with the classical image watermarking method HiDDeN (II] before the training of 3DGS [1]: 3) 3DGS with message: Creating message embedding by MLPs and concatenating the message embedding with 3D Gaussian parameters; 4) 3DGS with fine-tuning: Fine-tuning all of the 3D Gaussian parameters for embedding copyright messages. For 3D message extraction, since NeRF watermarking methods do not have explicit 3D parameters, we compare our methods with the 3DGS baselines, including HiDDeN + 3DGS, 3DGS with message, and 3DGS with fine-tuning
Evaluation methodology. We evaluate the performance of our proposed method by comparing with other digital watermarking baselines using the standard of capacity, invisibility, and robustness for both 2D images and 3D Gaussians. For capacity, we set the bit length of copyright messages to 48 bits, aligning with the maximum length previously employed in 3D model watermarking methods 4.. For invisibiliiyy, we evaluate the reconstruction quality with PSNR, SSIM, and LPIPS [55] for 2D images, and we evaluate geometry difference with the L1 norm of position difference Diff, and signal-to hignal-tonoisse ratio (SNR) for 3D Gaussian positions. For robustness, we evaluate whether the copyright messages in 2D images can remain consistent against various distortions, including 2D Gaussian noise, JPEG compression, scaling, and Gaussian blur. We also evaluate whether the copyright messages in 3D Gaussians can remain consistent against various 3D attacks, including 3D Gaussian noise, translation, rotation, and crop-out.
Ground truth
CopyRNoRF
HIDDeN 3DGS
3DGS wi fine tuning
3DGS message
Ours
PSNR 24.03 /Acc 60.41%
PSNR 27.17 AAc 48.33%
PSNR 26 62/ /Ac 62.50%
PSNR 24.87 /cc 83.33%
PSNR 28.61. /Acc 98.33%
PSNR 30.29 / Acc 60.83% PSNR 28.96/ Acc 50.19%
PSNR 28.17 / Acc 67.13%
PSNR 26.65/ Acc 80.22%
PSNR 31.53/ Acc 97.91%
Figure 4: Comparisons between each baseline and our proposed method. We display the differences (x 10) between the synthesized results and the ground truth for each method. Our proposed Gaussian- Marker demonstrates superior reconstruction quality and bit accuracy.
8

---

accuracy 1 (R)
Daraset
Method
PSNR/SSIM)
LPIPS.
None
Noise
JPEG
Scaling
Blur
(er 0.1)
(Q 50)
S 25%)
(c 0.1)
CoRy
f
30. 88829
0.0813
60.83
59.92
58.52
57.44
60.22
HiDDeN
3DGS L
28.9640.8812
49. 99.84
12
16
Blender
3DGS
w/ messages
22.65/0.8066
0.1584
80,22
78.66
75.80
78.08
79.64
3DGS
line-tuning
28.17/0.9047
67.06
Ours
31,53/0.99822
0,0759
97,91
96,93
91.66
96.17
97.43
CopeRNeRF
24.03/0.7747
0.2575
60.77
58.89
HiDDeN
I
3DGS M
17.1770.8543
0.1210
48,26
48. 14
46.26
46.89
48. 12
LLFF
3DGS
messages
3DGS
1
w/ line line-tuning
26.62/0.8566
0.1117
60.61
59.99
$5.49
57.52
60.40
28.61/0.89.30
0,0999
98.33
97.83
98.23
CopyRNeRF
4
22.47/0.8053
0.4825
58.55
57.22
$5.26
$5.80
$7.59
HiDDeN
II
3DGS i
27.20/0.115
MipNoRF300
3DGS
Ry messages
14.8440.7992
0. 0.1505
77.08
76.75
74.26
75.54
77:00
3DGS
line-tuning
27.04/0.86
61.45
Ours
29.16/0.8808
0.1197
97.32
97.01
90.77
95.32
97.18
Table 1: Reconstruction qualities and bit accuracy compared with different baselines. PSNR/SSIM and LPIPS are computed between the original and watermarked rendered images. The results are computed on the average of all examples.
Geometry difference
Bit accurscy 1 (%)
Method
C,DifTL SNRt
Nome
Noise
Translation
Rotation
Cropout (or = 0.1)
(o 0.1)
(t [0, 1000]*)
(r -
HiDDeN 1
3DGS
0.00912
40.90
68.20
67.65
67.32
66.67
64.24
3DGS messages
0.10513
32.93
85.41
84,91
85.35
81.52
79.57
3DGS 1 w/ fine-tuning
0.01829
37.24
69.79
69.70
68.78
65.88
64. 84
decoder
0.00003
43.23
97.85
$7.05
59.07
53.88
48.23
Ours w/ 3D decoder
0.00003
43.23
100
99.91
98.95
95.83
92.70
Table 2: Geometry difference and bit accuracy compared with different baselines. L. distance and SNR computed between the original and watermarked 3D Gaussians. The results computed on the average of all examples from Blender, LLFF,, and MipNeRF360.
5.2 Experimental results
Messages extraction with 2D images. We compare the reconstruction qualities and bit accuracies with all baselines, and the qualitative and quantitative results shown in Figure 4 and Table [ CopyRNeRF [4] can limitedly extract hidden messages from the renderings and show undermined
robustness different image distortions. Although HiDDeN [I]] + 3DGS (1] achieve high reconstruction quality, it fails to extract the copyright messages from the rendered 2D images. This result aligned with the previous method 4 and proves the message can not be transmitted from the 2D images into the 3D Gaussians. 3DGS [1] with messages directly embed copyright messages into 3D Gaussian parameters. It can retrieve the copyright message with relatively high accuracy, but the reconstruction quality is poor and shows obvious distortions in the rendered images. 3DGS M with fine-tuning shows better reconstruction quality, but the message extraction accuracy is limited. This is because 3D Gaussians usually contain millions of parameters, and directly fine-tuning all of the parameters without proper regularization can be less effective for message extraction. Our method can achieve both high reconstruction quality and high decoding accuracy. Even with different distortions to the rendered images, our method can still achieve high decoding accuracy to reliably safeguard the 3DGS models.
Messages extraction with 3D Gaussians. We evaluate the geometry differences and the bit accuracies with all 3DGS baselines, and the results are shown in Table HiDDeN [II] + 3DGS (I] has small geometry difference, but it has limited message decoding accuracy. 3DGS with messages shows reasonable message decoding accuracy, but it displays high geometry differences. 3DGS with fine-tuning shows a relatively small geometry difference, but struggles to decode the message. Our method has the smallest geometry difference, obtains accurate decoding accuracy, and shows robustness to different 3D attacks. Furthermore, 3DGS can be easily edited in the 3D space to influence the rendered 2D images. We conduct experiments to apply 3D attacks and then render the 2D images. As shown in Table the 3D attacks can easily fool the 2D message decoder, while our 3D message decoder is robust to such 3D attacks and can reliably extract copyright messages.

---

5.3
Ablation study
Perturb low-uncertainty Gaussians. We design ablation experiments to add perturbations into 3D Gaussian parameters with low uncertainty. We show qualitative results in Figure 5, the low- uncertainty Gaussians corresponding to the fine details the 3D scene, such as the halyard on the ship. Adding perturbations to these areas can easily make the perturbation visible, thus undermining the image quality. We evaluate the quantitative results in Table 3. Adding perturbations to 3D Gaussian parameters with low uncertainty can easily undermine the reconstruction quality and degrade the decoding accuracy. Our method preserves 3D Gaussians with low uncertainty, maintaining the geometric structure ensure imperceptible perturbations and high message extraction accuracy.
Metric PSNR
Low
High
26.61
28.71
SSIM
0.8782
0.9016
LPIPS
0.0948
0.0763
Acc
76.56
97.07
Noise
75.51
95.83
Blur 76.27
96.30
Resize 73.92
93.22
(a) Origin
(b) High-uncertainty
(c) Low-uncertainty
Table 3:
Quantitative results of adding perturbation into low-
Figure 5: Qualitative results of applying perturbation into (b) high uncertainty Gaussians and (c) low uncertainty Gaussians.
uncertainty Gaussians and high- uncertainty Gaussians.
Conclusion
In conclusion, protecting the copyright of 3D Gaussian Splatting (3DGS) assets is crucial due to their vulnerability unauthorized distribution and manipulation. Existing methods for copyright protection in the radiance field are not directly applicable to 3DGS. Our proposed method involves using uncertainty estimation add invisible 3D perturbations to the 3D Gaussian parameters, ensuring both invisibillity and robustness. Overall, our proposed approach introduces an effective solution with a positive societal impact on the copyright protection of the 3DGS models.
Limitations. Our method is an effective technical solution for the copyright protection of 3DGS models. However, operations. More measures should be implemented for such malicious attacks beyond the technology. Furthermore, we will explore enhancing the robustness of Marker in dynamic 3DGS scenarios, via the motion transfer-basee data augmentation approach, to maintain high bit accuracies while improving robustness [66] in future work.
discussed before, mechanism may still face threats from some malicious
7 Acknowledgement
This work was done at Renjic's s Research Group at the Department of Computer Science of Hong Kong Baptist University. Renjie's Research Group is supported by the National Natural Science Foundation of China under Grant No. 62302415, Guangdong Basic and Applied Basic Research Foundation under Grant No. 2022A1 11511 10692, 201421515012822. and the Blue Sky Research Fund of HKBU under Grant No. BSRF/21- This work was supported in part by the RGC Senior Research Fellow Scheme under the grant: SRFS2324-2802.
References
[1] Bernhard Kerbl, Georgios Kopanas, Thomas Leimküihler, and George Drettakis. 3D Gaussian Splatting for Real-Time Radiance Field Rendering. ACM Transactions on Graphics (TOG), 2023.
[2] Jonathon Luiten Georgios Kopanas, Bernhard Kerbl and Antoine Guedon. 3D Gaussian Splatting 3DV Tutorial. https://3dgstutort wwwp:tttrrrr....a........ot 1o/3dv__r irrepaart.ppp 2024.
10

---

[3] Yiwen Chen, Zilong Chen, Chi Zhang, Feng Wang, Xiaofeng Yang, Yikai Wang, Zhongang Cai. Lei Yang, Huaping Liu, and Guosheng Lin. GaussianEditor: Swift and controllable 3d editing with gaussian splatting. In Proceedings of Conference on Computer Vision and Pattern Recognition (CVPR). 2024.
[4] Ziyuan Luo, Qing Guo, Ka Chun Cheung, Simon See, and Renjie Wan. CopyRNeRF: Protecting the Rigy of Neural Radiance Fields. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), 2023.
[5] Mahdi Ahmadi, Alireza Norouzi, Nader Karimi, Shadrokh Samavi, and Ali Emami. ReDMark: Framework for Residual Diffusion Watermarking based on Deep Networks. Expert Systems with Applications, 2020.
[6] Chenxin Li, Brandon Y Feng, Zhiwen Fan, Panwang Pan, and Zhangyang Wang. StegaN- cRF: Embedding Invisible Information within Neural Radiance Fields. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), 2023.
[7] Ben Mildenhall, Pratul P Srinivasan, Matthew Tancik, Jonathan T Barron, Ravi Ramamoorthi, and Ren Ng. NeRF: Representing Scenes as Neural Radiance Fields for View Synthesis. Communications of the ACM, 2021.
[8] Wen Jiang, Boshu Lei, and Kostas Danilidis. FisherRF: Active View Selection and Uncertainty Quantification for Radiance Fields using Fisher Information. In Proceedings of European Conference on Computer Vision (ECCV), 2024.
[9] Christopher M Bishop. Pattern Recognition and Machine Learning. Springer google scholar, 2:1 2.1122-1128. 2006.
[10] Charles R Qi, Hao Su, Kaichun Mo, and Leonidas J Guibas. Pointnet:Deep Learning on Point Sets for 3D Classification and Segmentation. In Proceedings of Conference on Computer Vision and Pattern Recognition (CVPR), 2017.
[11] Jiren Zhu, Russell Kaplan, Justin Johnson, and Li Fei-Fei. HiDDeN: Hiding data with deep networks. Proceedings of the European Conference on Computer Vision (ECCV), 2018.
[12] Chengxuan Zhu, Renjie Wan, and Boxin Shi. Neural Transmitted Radiance Fields. In Advances in Neural Information Processing Systems (NeurIPS), 2022.
[13] Chengxuan Zhu, Renjie Wan, Yunkai Tang, and Boxin Shi. Occlusion- Scene Recovery via Neural Radiance Fields. In Proceedings of the IEEE/CVF Conference on Computer Vision and Puttern Recognition (CVPR), 2023.
[14] Ziyuan Luo, Boxin Shi, Haoliang Li, and Renjie Wan. Imaging Interiors: An Implicit Solution to Electromagnetic Inverse Scattering Problems. In Proceedings of European Conference Computer Vision (ECCV), 2024.
[15] Zehao Yu, Anpei Chen, Binbin Huang, Torsten Sattler, and Andreas Geiger. Mip-Splatting: Alias-free 3D Gaussian Splatting. Proceedings of Conference on Computer Vision and Pattern Recognition (CVPR), 2024.
[16] Jonathon Luiten, Georgios Kopanas, Bastian Leibe, and Deva Ramanan. Dynamic 3D Gaussians: Tracking by Persistent Dynamic View Synthesis. In Proceedings of International Conference on 3D Vision (3DV), 2024.
[17] Antoine Guédon and Vincent Lepetit. SuGaR: Surface-Aligned Gaussian Splatting for Efficient 3D Mesh Reconstruction and High-Quality Mesh Rendering. Proceedings of Conference on Computer Vision and Pattern Recognition (CVPR), 2024.
[18] Zhiyin Qian, Shaofei Wang. Marko Mihajlovic, Andreas Geiger, and Siyu Tang. 3vGS-Avatar: Animatable Avatars via Deformable 3D Gaussian Splatting. In Proceedings of Conference on Computer Vision and Pattern Recognition (CVPR), 2024.
[19] Matthew Loper, Naureen Mahmood, Javier Romero, Gerard Pons-Moll, and Michael J. Black. SMPI: skinned multi-person linear model. ACM Trans. Graphics (Proc. SIGGRAPH Asia), 2015.
11

---

[20] Ron G Van Schyndel, Andrew Z Tirkel, and Charles F Osborn.. A digital watermark. In Proceedings of International Conference on Image Processing (ICIP), 1994.
[21] Chih-Chin Lai and Cheng-Chih Tsai. Digital Image Watermarking Using Discrete Wavelet Transform and Singular Value Decomposition. IEEE Transactions on Instrumentation and Measurement, 2010.
[22]
Thottempudi Pardhu and Bhaskara Rao Perli. Digital image watermarking in frequency domain. In Proceedings of International Conference on Communication and Signal Processing (ICCSP), 2016.
[23] Kaiming He, Xiangyu Zhang. Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of Conference on Computer Vision and Pattern Recognition (CVPR), 2016.
[24] Diederik P Kingma and Jimmy Ba. Adam: A method for stochastic optimization. arXiv preprint arXiv:1412.6980, 2014.
[25] Zhikai Hu, Yiu-ming Cheung, Mengke Li, and Weichao Lan. Cross-modal hashing method with properties of hamming space: A new perspective. IEEE Transactions on Pattern Analysis and Machine Intelligence (TPAMI), 2024.
[26] Mengke Li, Yiu-Ming Cheung, and Zhikai Hu. Key point sensitive loss for long-tailed visual recognition. IEEE Transactions on Pattern Analysis and Machine Intelligence (TPAMI), 2022.
[27] Matthew Tancik, Ben Mildenhall, and Ren Ng. StegaStamp: Invisible Hyperlinks in Physical Photographs. In Proceedings of the IEEE/CVF Conference on Computer Vision and Puttern Recognition (CVPR), 2020.
[28] Xinyu Weng, Yongzhi Li, Lu Chi, and Yadong Mu. High- Cigh-Capaccty Convolutional Video Steganography with Temporal Residual Modeling. In Proceedings of the International Confer- ence on Multimedia Retrieval (ICMR), 2019.
[29] Eric Wengrowski and Kristin Dana. Light Field Messaging with Deep Photographic Steganogra- phy. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2019.
[30] Peng Yang, Yingjie Lao, and Ping Li. Robust watermarking for deep neural networks via bi-level optimization. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), 2021.
[31] Chaoning Zhang, Philipp Benz, Adil Karjauv, Geng Sun, and In So Kweon. UDH: Universal deep hiding for steganography, watermarking, and light field messaging. In Advances in Neural Information Processing Systems (NeurIPS), 2020.
[32] Kevin Alex Zhang, Lei Xu, Alfredo Cuesta Infante, and Kalyan Veeramachaneni. Robust invisible video watermarking with attention. arXiv preprint
01285, 2019.
[33] Ruofei Wang, Renjie Wan, Zongyu Guo, Qing Guo, and Rui Huang. Spy-Watermark: Ro- bust Invisible Watermarking for Backdoor Attack. In Proceedings of the IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), 2024.
[34] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. Proceedings of International Conference on Learning Representations (ICIR), 2018
[35] Ruofei Wang, Qing Cuo, Haoliang Li, and Renjie Wan. Event Trojan: Asynchronous Event- based Backdoor Attacks. In Proceedings of European Conference on Computer Vision (ECCV), 2024.
[36] KevinAlex Zhang, Lei Xu, Alfredo Cuesta-Infante, and Kalyan Veeramachaneni. Robust invisible video watermarking with attention. arXiv: Multimedia, arXiv: Multimedia, 2019.
[37] Emil Praun, Hugues Hoppe, and Adam Finkelstein. Robust mesh watermarking. In Proceedings of the Conference Computer Graphics and Interactive Techniques (PACMCGIT), 1999.
12

---

[38] Zhirong Wu, Shuran Song, Aditya Khosla, Fisher Yu, Linguang Zhang, Xiaoou Tang, and Jianxiong Xiao. 3D ShapeNets: A deep representation for volumetric shapes. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2015.
[39] Xingyu Chen, Yu Deng, and Baoyuan Wang. Mimic3D: Thriving 3D-Aware GANs via 3D-to- 2D Imitation. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), 2023.
[40] Jeongho Son, Dongkyu Kim, Hak-Yeol Choi, Han-Ul Jang, and Sunghee Choi. Perceptual 3D Watermarking Using Mesh Saliency. In Proceedings of International Conference on Information Science and Applications (ICISA), 2017.
[41] Innfarn Yoo, Huiwen Chang, Xiyang Luo, Ondrej Stava, Ce Liu, Peyman Milanfar, and Feng Yang. Deep 3D-to-2D Watermarking: Embedding Messages in 3D Meshes and Extracting Them from 2D Renderings. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2022.
[42] Lior Yariv, Yoni Kasten, Dror Moran, Meirav Galun, Matan Atzmon, Basri Ronen, and Yaron Lipman. Multiview Neural Surface Reconstruction by Disentangling Geometry and Appearance. In Advances in Neural Information Processing Systems (NeurIPS), 2020.
[43] Yinghao Xu, Sida Peng, Ceyuan Yang. Yujun Shen, and Bolei Zhou. 3D-aware Image Syn- thesis via Learning Structural and Textural Representations. In Proceedings of the IEEF/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2022.
[44] Qi Song, Ziyuan Luo, Ka Chun Cheung, Simon See, and Renjie Wan. Protecting NeRFs' Copy- right via Blug-And-Play Watermarking Base Model. In Proceedings of European Conference on Computer Vision (ECCV), 2024.
[45] Xiufeng Huang, Ka Chun Cheung, Simon See, and Renjie Wan. GeometrySticcker: Enabling ownership claim of recolorized neural radiance fields. In Proceedings of European Conference on Computer Vision (ECCV), 2024.
[46] Noah Snavely, Steven M Seitz, and Richard Szeliski. Photo tourism: exploring photo collections in 3d. ACM Transactions on Graphics (TOG), 2006.
[47] Matthias Zwicker, Hanspeter Pfister, Jeroen Van Baar, and Markus Gross. Ewa volume splatting. In Proceedings Visualization (VIS), 2001.
[48] Georgios Kopanas, Thomas Leimkühler, Gilles Rainer, Clément Jambon, and George Drettakis. Neural point catacaustics for novel-view synthesis of reflections. ACM Transactions on Graphics (TOG), 2022.
[49] Wang Yifan, Felice Serena, Shihao Wu, Cengiz Öztireli, and Olga Sorkine-Horuung. Differen- tiable surface splatting for point-based geometry processing. ACM Transactions on Graphics (TOG), 2019.
[50] M.P. Deisenroth, A.A. Faisal, and C.S. Ong. Mathematics for Machine Learning. 2020.
[51] Andreas Kirsch and Yarin Gal. Unifying approaches active learning and active sampling via fisher information and information-theorete quantities. Transactions Machine Learning Research (TMLR), 2022.
[52] Sosuke Kobayashi, Eichi Matsumoto, and Vincent Sitzmann. Decomposing NeRF for Editing via Feature Field Distillation. Advances in Neural Information Processing Systems (NeurIPS), 2022.
[53] Ben Mildenhall, Pratul P Srinivasan, Rodrigo Ortiz-Cayon, Nima Khademi Kalantari, Ravi Ramamoorthi, Ren Ng, and Abhishek Kar. Local light field fusion: Practical view synthesis with prescriptive sampling guidelines. ACM Transactions on Graphics (TOG), 2019.
[54] Jonathan T. Barron, Ben Mildenhall, Dor Verbin, Pratul P. Srinivasan, and Peter Hedman. Mip- NeRF 360: Unbounded Anti-Aliased Neural Radiance Fields. Proceedings of the IEEF/CVF Conference Computer Vision and Pattern Recognition (CVPR), 2022.
13

---

[55] Richard Zhang, Phillip Isola, Alexei A. Efros, Eli Shechtman, and Oliver Wang. The Unreason- able Effectiveness of Deep Features Perceptual Metric. In Proceeding of the IEEE/CVF Conference Computer Vision and Pattern Recognition (CVPR), 2018.
[56] Xiu-Feng Huang, Lai-Man Po, and Wei-Feng Ou. Motion transfer-driven intra-class data augmentation for finger vein recognition. In IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), 2024.
[57] Zhiwen Fan, Kevin Wang, Kairun Wen, Zehao Zhu, Dejia Xu, and Zhangyang Wang. Light- Gaussian: Unbounded 3D Gaussian Compression with 15x Reduction and 200+ FPS. arXiv preprint arXiv:2311.17245, 2023.
14

---

A
Additional visualization
Origin
Watermarked
Differences (x10)
GaussianMarker
Figure 6: Visualization of our proposed method performance in LLFF and MipNeRF360 datasets. In each line, we display the original rendered image, the watermarked rendered image, the difference (x 10) between the watermarked and original rendered images, and our proposed Gaussian as 3D perturbations for copyright message embedding. The scalings of GaussianMarker are adjusted for better visualization.
15

---

Origin
Watermarked
Differences (x10)
GauseianMarker
Figure 7: Visualization of our proposed method performance in Blender dataset.
16

---

B
Additional quantitative results for real-world datasets
LLFF
PSNR
SSIM
LPIPS
Acc
Noise
JPEG
Scale
Blur
Fern
29.40
0.92
0.0867
1.0
1.0
0.8916
0,9791
1.0
Fortress
30.91
0.9084
0.1227
0.9375
0.9375
0.9166
0,9375
0,9375
Horn
27.46
0.8849
0.1094
0.9791
0.9791
0.9125
0.8958
0.9791
Orchids
25.177
0.8543
0.0853
1.0
1.0
0.9333
0.95833
1.0
Flower
30.09
0.8939
0.0952
1.0
1.0
0.9125
0,9791
1.0
Trex
28.165
0.9109
0.0734
1.0
1.0
0.8541
0.9791
1.0
Table 4: Quantative results on LLFF scenes.
MipNeRF360
PSNR
SSIM
LPIPS
Acc
Noise
JPEG
Scale
Blur
Stump
28.95
0.8521
0.1364
0.9791
0.9791
0.8291
0,9375
0.9791
Bicycle
25.68
0.8028
0.1774
0.9583
0.9583
0.8750
0,9125
0.9583
Kitchen
29.87
0.8937
0.0946
0.9791
0.9791
0.8333
0.9583
0.9791
Counter
28.68
0.8948
0.1300
0.9583
0.9583
0.8916
0.9166
0.9583
Bonsai
30.41
0.9249
0.1002
0.9583
0.9583
0.9125
0,8958
0.9583
Garden
28.58
0.8825
0.0760
1.0
1.0
0.9125
0,9375
1.0
Room
31.97
0.9149
0.1232
0.9791
0.9791
0.8750
0.9583
0.9791
Table 5: Quantative results on MipNeRF360 scenes.
C The correlation between uncertainty and image watermarking
Original
Watermarked
Difference (x10)
Uncertainty
Figure 8: Uncertainty heatmap visualization.
The uncertainty estimation in the 3DGS model inherently identifies model parameters that are more robust perturbations, making it highly suitable for the application of invisible watermarking in 3DGS. Additionally, the HiDDeN decoder (II) primarily focuses on decoding information along the boundary regions. As illustrated in Figure 8 these boundary regions exhibit high uncertainty values. This observation demonstrates the correlation between uncertainty and message embedding, highlighting how areas of high uncertainty can be leveraged for effective watermarking.
D The influence of uncertainty threshold
In our experiments, we set the average uncertainty value as the default threshold. We show more results to verify the influence of the uncertainty threshold. As shown Table 6 we select the ship scene in the Blender dataset to study the influence of the uncertainty threshold. A lower threshold enhance the bit accuracy, though it slightly compromises image quality. Conversely, higher threshold results in better image quality and a more lightweight model but also slightly compromising message decoding accuracy. However, in both situations, the compromises moderate.
noteworthy that our method also compatible with compressing the 3DGS model based on the uncertainty value, similar to how LightGaussian compresses 3DGS using importance values [57).
17

---

Threshold
Original points
Perturbation points
PSNR
SSIM
LPIPS
ACC
average x 3.7
340k
13k
26.44
0,9521
0.0396
92.08%
average x 1.0
340k
27k
26.37
0.9498
0.0397
95.21%
average x 0.24
340k
54k
26.31
0,9490
0,0399
96.88%
average 0.13
340k
108k
26.17
0.9483
0.0399
96.31%
Table 6: The influence of uncertainty threshold.
This compatibility highlights that our approach can work seamlessly with existing 3DGS model compression techniques, effectively mitigating the impact of the increasing number of 3D Gaussians in our method.
E The geometry consistency
Front
Back
Right
Figure 9: Visualization of our proposed MaussianMarrer MipNeRF360 Room scene. We select four camera angles which are never used in the training dataset the font, left, back, right views of the scene to represent the multi-view consistency of incorporated perturbations.
Our method embeds watermarks into the 3DGS model by adding perturbations to 3D Gaussians with high uncertainty. As shown in Figure these areas cover most object boundaries the 3DGS scene. Figure 9 further illustrates geometry consistency by displaying the incorporated perturbations. These perturbations effectively cover the scene's general geometric structure. The geometry of these perturbations remains consistent across different camera angles and can be transmitted into the rendered images, which is essential for robust extraction from different viewing angles.
Time analysis
Datasets
3DGS training
Our message embedding
Synthetic datasets (Blender)
30k steps / 30mins
1k steps / 3 mins
Real-world scenes (LLFF)
30k steps / 40mins
1k steps / 5 mins
Real-world scenes (MipNeRF360)
30k steps / 45mins
2k steps / 10 mins
Table 7: Time analysis on different datasets.
We present time analysis of our method's training efficiency in Table 7 Compared the original 3DGS model training, our method requires only 1,000 to 2,000 steps within span of 10 minutes. This demonstrates that our approach is only efficient but also practical for watermarking 3DGS models.
18

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification:
The abstract and introduction include the claims in the paper.
Guidelines:
The answer NA means that the abstract and introduction do not include the main claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
It is fine to include aspirational goals as motivation long is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification: We create a "Limitation" section in the Conclusion to discuss the limitations of our work.
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't 't acknowledged judgment and recognize that individual actions in favor of transparency play impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
the paper. The authors should use their best
3. Theory Assumptions and Proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [Yes]
19

---

Justification:
We provide complete proof for theoretical results.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the paper's theorems, formulas, and proofs should be numbered and cross- referenced.
All assumptions should be clearly stated referenced in the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but they appear in the supplemental material, the authors are encouraged to provide short proof sketch provide intuition.
Inversely, any informal proof provided in the core of the paper should complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental Result Reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that affects the main claims and/or conclusions of the paper (regardless whether the code and data are provided or not)?
Answer: [Yes]
Justification:
We provide all information for reproduce the experimental results.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g.. in the case of large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) the contribution is primarily a new algorithm, the paper should make clear how to reproduce that algorithm.
(b) the contribution is primarily a new model architecture, the paper should describe the architccture clearly and fully.
(c) If the contribution is new model (e.g., a large language model), then there should either way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome to describe the particular way they provide for reprodueibility. the case of closed-source models, may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
20

---

Answer: [Yes]
Justification:
We provide code implementation in our supplementary materials.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (https://nips... cc/
ceiiioooPolyyyy for more details.
While we encourage the release of code and data, we understand that this might not be possible, so "No" an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https
/ ccpppi.ccppulli//uuuii wwwpc//ggue////eee CoodeSubeiiieeee ssi wswonnolli onnolicy)))) for more details.
The authors should provide instructions on data access and preparation, including how access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental Setting/Details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: Yes, our paper specifies all settings for training and testing.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, or as supplemental material.
7. Experiment Statistical Significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer: [No]
Justification: We don't 't think error bars are necessary for our experimental results.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, statistical significance tests, at least for the experiments that support main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call a library function, bootstrap, etc.)
The assumptions made should be given (e.g.. Normally distributed errors).
should be clear whether the error bar is the standard deviation the standard error of the mean.
21

---

It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out range (e.g. negative error rates).
If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments Compute Resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes] We list training resources and training time.
Justification:
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g.. preliminary or failed experiments that didn't make into the paper).
9. Code Of Ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics https: h/tp::://eerps..eeeee https///c....cc.t.ccccc...d..aa.
Answer:
[Yes]
Justification:
We strictly follow the code of ethics.
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special cireumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., if there is a special consid- eration due to laws or regulations their jurisdiction).
10. Broader Impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification:
We discuss the societal impact in the conclusion and supplementary.
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No. they should explain why their work has no societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that improvement in the quality of generative models could be used to
22

---

generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
there are negative socictal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [Yes]
Justification:
We have described all data and models we use.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Are the creators original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Question:
Answer: [Yes]
Justification:
We have cited all referenced code, data and models.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (e.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (c.g., website), the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, wwppppsiipteeeee www.rrewwthhhe....c. com/ datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if has changed) should be provided.
If this information is not available online, the authors are encouraged to reach out to the asset's is creators.
13. New Assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
23

---

Answer: [NA]
Justification:
Our work does not release new assets.
Guidelines:
The answer NA means that the paper does release new assets.
Researchers should communicate the details the dataset/codeemoodll as part their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and Research with Human Subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?
Answer: [NA]
Justification: Our work does involve crowdsourcing research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included the main paper.
According to the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: Our work does not involve crowdsourcing research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Depending on the country in which research is conducted, IRB approval (or equivalent)
may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and expect authors to adhere the NeurlPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
24


Reviews:
[{"review_id": "V0QxqefuEZ", "reviewer": "Reviewer_fyQG", "summary": "This paper proposes an uncertainty-based method to achieve watermarking for 3D Gaussian Splatting. Specifically, the Hessian matrix is used to estimate the parameter uncertainty. Then, the 3D Gaussians with high uncertainty are densified. The densified 3D Gaussians are trained to embed watermarking using a pre-trained 2D message decoder. After that, a 3D message decoder is trained using PointNet. Experimental results show that the proposed method achieves the best performance.", "questions": "See Weakness.", "limitations": "The authors have adequately addressed the limitations.", "rating": 5, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. This paper is well-written and easy to follow. \n\n2. The experimental results show that the proposed method achieves new SOTA results. \n\n3. The proposed method can decode watermarking both in 2D rendered images and 3D assets. \n\n4. An uncertainty-based method is proposed to select trainable 3D Gaussians, which is reasonable.", "weaknesses": "1. One concern about this paper is its novelty. The major contribution of this paper is the introduction of uncertainty into 3D Gaussians watermarking. As the definition of uncertainty using Fisher Information comes from [42], simply using uncertainty for 3D Gaussians watermarking is quite simple and straightforward. Regarding the message decoders, they are all standard operations. HiDDeN [11] is used for the 2D message decoder, and PointNet [43] is used for the 3D message decoder. Therefore, the major contribution of the proposed method should be further justified.\n\n2. The proposed method utilizes the 3D Gaussians with high uncertainty to embed watermarking. What if an attacker also uses this feature? The attacker could first identify the 3D Gaussians (after training/fine-tuning) with high uncertainty and then only attack these 3D Gaussians using techniques such as Noise, Translation, Rotation, or Cropout. Additionally, the attacker might delete some of the identified 3D Gaussians to compromise the 3DGS assets.\n\n3. The influence of the parameter uncertainty threshold should be included in the experiments to assess the sensitivity of the uncertainty threshold on the proposed method. \n\n4. The results with different bit lengths are missing.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Dear Reviewer fyQG,\n\nWe will address your comments below and in the revised paper.\n\n> W1. One concern about this paper is its novelty.\n\nThanks for raising the concern. While our approach incorporates elements from classical techniques, our contributions extend beyond these traditional frameworks.  Besides the **first exploration** to protect the 3DGS via digital watermarking, our primary contributions also lie in developing a framework based on **uncertainty** for embedding invisible perturbations into the 3DGS model, and **message extraction from both 2D images and 3D Gaussians**. \n\n**W1-1. Use uncertainty to achieve invisible watermarking of 3DGS**\n\nOne major contribution is the application of uncertainty estimation in invisible watermarking of 3DGS, an exploration that diverges from its traditional use in active learning [1]. We find that uncertainty estimation can inherently identify model parameters that are more tolerant to perturbations, making it well-suited for the purpose of invisible watermarking in 3DGS.\n\nWithout considering the uncertainty, naively applying the existing watermarking strategies can cause noticeable distortions. As shown in **rebuttal Figure 1**, compared with our method, \"3DGS with message\" and \"3DGS with fine-tuning\" all show poor reconstruction quality and reduced bit accuracy. This further demonstrates the superiority of the proposed uncertainty-based strategy. Besides,  the HiDDeN decoder mainly focuses on the decoding of information along the boundary areas.  From the **left part of rebuttal Figure 2**, such boundary areas are all with high uncertainty values. This can also partly show the correlation between the uncertainty and the message embedding. \n\n**W1-2. Message extraction from both 2D images and 3D Gaussians.**\n\nOur second contribution is a method that enables copyright message extraction from both 2D images and 3D Gaussians.  Existing watermarking techniques for 3D assets (e.g., NeRF) are limited to extracting messages from 2D rendered images, as directly extracting messages from the neural networks used for scene representation in NeRF proves challenging. Consequently, owners of the 3D assets can only assert their ownership through these rendered 2D images, rather than from the underlying 3D neural representation itself. Our approach allows direct message extraction from 3D Gaussians using PointNet. This provides model owners with a novel means of claiming ownership directly from their 3D assets, rather than relying solely on rendered images. This advancement offers a more robust and versatile approach to protecting the copyright of 3DGS model owners.\n\n> W2: The proposed method utilizes the 3D Gaussians with high uncertainty to embed watermarking. What if an attacker also uses this feature?\n\nIn response to your concern about this potential risk, we have conducted additional experiments specifically attacking 3D Gaussians with high uncertainty values to assess the robustness of our approach. We assume a scenario where an attacker directly manipulates the high-uncertainty 3D Gaussians. As demonstrated in the table below, our method maintains relatively high bit accuracy despite this attack.\n\nThis resilience partly stems from the fact that the uncertainty distribution of watermarked 3D Gaussians can differ from that of the original 3D Gaussians, as mentioned in the main paper (lines 168–170). If the attacker conducts the operation based on the original Gaussians, it is still challenging to attack the watermarked Gaussians with new properties. Additionally, our 3D message decoder randomly samples 3D Gaussians (main paper, lines 197-199) so that even if some of the high-uncertainty Gaussians are deleted, messages can still be extracted from other 3D Gaussians. However, it is still suggested that the watermarking strategy be kept private.\n\n\n\n| Method|   Noise \t|   Translation  |   Rotation  |  Cropout | Delete |\n| :----------| :----------: | :----------------: | :------------: | :---------: | ---------: |\n| Normal attack |   99.95%  |   98.32%  |  95.32%  |   91.73%  |   N.A.  |\n| High-uncertainty attack  |  90.80% |  88.75% |  84.42%  | 81.97% |  77.93%  |\n\n> W3: The influence of the parameter uncertainty threshold should be included.\n\nIn our experiments, we set the average uncertainty value as the default threshold. By following your suggestion, we show more results to verify the sensitivity of the uncertainty threshold. As shown in **right part of the rebuttal Figure 2**, a lower threshold can enhance the bit accuracy, though it slightly compromises image quality. Conversely, a higher threshold results in better image quality and a more lightweight model but also slightly compromising message decoding accuracy. However, in both situations, the compromises are moderate.\n\n> W4. The results with different bit lengths are missing.\n\nAs we have discussed in the main paper (lines 273-275), we evaluate the message decoding capacity by setting the bit length to 48 bits, aligned with the maximum length used in 3D model watermarking methods [34, 4]. Shorter message bit lengths typically yield higher decoding accuracy. We evaluate the 16-bit and 32-bit message decoding accuracy on the Blender dataset and show the results in the below table.\n\n| Bit-length |   PSNR     |   SSIM   |   LPIPS  |   None   | Noise  | JPEG |  Scaling  |  Blur  |\n| :------------ | :-----------: | :----------: | :---------: | :---------: | :----------: | :----------: |  :----------: |  ----------: |\n|     16        |   32.25      |   0.9102 |  0.0758  | 99.53% |   98.66%  |  92.35%  |  97.63%  |   98.56% |\n|     32        |   31.97      |   0.9098 |  0.0759  | 98.94% |   98.17%  |  92.41%  |  97.27%  |   98.20% |\n\n[1] Unifying approaches in active learning and active sampling via fisher information and information-theoretic quantities.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "Mpry2oBihw", "reviewer": "Reviewer_QvjQ", "summary": "The paper presents a new method for embedding digital watermarks in 3D Gaussian Splatting (3DGS) models to protect the copyright of 3D assets. Traditional watermarking techniques for mesh, point cloud, and implicit radiance fields are not suitable for 3DGS, as they can cause distortions in rendered images. The authors propose an uncertainty-based approach that constrains perturbations to the model parameters, ensuring that watermarks remain invisible while preserving visual quality. The method allows for reliable extraction of copyright messages from both 3D Gaussians and 2D rendered images, even under various distortions.", "questions": "Please refer weakness.", "limitations": "N/A", "rating": 7, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The proposed method ensures that the embedded watermarks do not cause significant distortions in the rendered 3D scenes or 2D images, maintaining the visual quality of the assets.\n2. The approach is designed to be robust against various forms of 3D and 2D distortions, such as noise, translation, rotation, cropping, JPEG compression, scaling, and blurring. This enhances the reliability of copyright protection.\n3. The method allows for the extraction of copyright messages from both 3D Gaussian parameters and 2D rendered images, providing multiple layers of security and verification.\n4. Extensive experiments demonstrate that the method achieves state-of-the-art performance in both message decoding accuracy and view synthesis quality.", "weaknesses": "The malicious scenarios considered are limited to traditional distortions. \\\nMore sophisticated scenarios should also be explored. \\\nFor instance, a malicious actor could fine-tune the downloaded 3DGS or use an auto-encoder to remove embedded information ([1],[2],[3]). \\\nIn such cases, how would the proposed method perform?\n\nAdditionally, a more complex scenario to consider is when a malicious actor renders Bob's 3DGS and uses it as training data to create their own 3DGS. \\\nHow would the proposed method address these advanced threats?\n\n[1] Fernandez et al., The Stable Signature: Rooting Watermarks in Latent Diffusion Models \\\n[2] Kim et al., WOUAF: Weight Modulation for User Attribution and Fingerprinting in Text-to-Image Diffusion Models \\\n[3] Zhao et al., Invisible Image Watermarks Are Provably Removable Using Generative AI", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Dear Reviewer QvjQ,\n\nThank you for your valuable feedback and constructive comments. We appreciate your suggestion about considering more sophisticated scenarios, and we will address your comments below and in the revised paper.\n\n> W1: Model fine-tuning and auto-encoder attack.\n\nBy following your suggestions, we have designed experiments for both the model fine-tuning scenario and the auto-encoder attack scenario. \n\nFor the **model fine-tuning**, we consider a challenging case where attackers have direct access to the original non-watermarked images used for the creation of the 3DGS. Based on this assumption, we implement the attack by eliminating the message loss and then fine-tuning the model solely through perceptual loss.\n\nAs shown in **Figure 3, left part of the rebuttal paper**, the bit accuracy still remains relatively high even when such fine-tuning compromises the model quality. It indicates that model fine-tuning cannot significantly reduce bit accuracy without undermining image quality.\n\nFor the **autoencoder attack**, we consider two kinds of VAE attacks: VQ-VAE [1], and VQ-GAN [2]. We use different compression rates to alter image quality and evaluate the robustness of the watermarking.\n\nAs shown in **Figure 3 of the rebuttal paper**, the message decoding can maintain relatively high accuracy and achieve good reconstruction quality (PSNR > 31), when the two kinds of auto-encoder use a low compression rate. Then, under a high compression rate, these two auto-encoder attacks can result in lower bit accuracy and degraded image quality. Although these two kinds of auto-encoder attacks can undermine the watermark in the rendered images, as shown in the **Figure 3, right part of the rebuttal paper**, such degraded image quality may lead to multiview inconsistency, making the sharing of the rendered contents difficult. \n\n> W2: Retrain a 3DGS with Bob's rendered images.\n\nWe appreciate your insightful feedback. As shown in the table below, our experiments on retraining a new 3DGS model using Bob's rendered images reveal that, even with a slight reduction in message decoding accuracy, the fully converged retrained model can still maintain a relatively high bit accuracy.\n\n|  Method     |   PSNR   |   SSIM   |   LPIPS  |   None   |  Noise   |  JPEG |  Scaling | Blur |\n| :--------------| :---------: | :----------: | :--------: | :---------: | :---------: | :---------: | :---------: | -----: |\n|  Original    |   31.97   |  0.9098  |   0.0759  | 98.94% |  98.17% | 92.41% |  97.27% | 98.20% |\n|  Retrained |   31.09   |  0.8844  |   0.0781  | 87.21% |  86.98% | 81.35% |  83.88% | 86.76% |\n\nWe appreciate all your valuable suggestions and look forward to discussing them further with you during the discussion session.\n\n[1] Neural Discrete Representation Learning.\n\n[2] Taming Transformers for High-Resolution Image Synthesis.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "OPfQQsNvjO", "reviewer": "Reviewer_VdSM", "summary": "3D Gaussian Splatting(3DGS) has gradually become the mainstream method for acquiring 3D assets, which has led to a demand for copyright protection of 3DGS. In this paper, a watermarking method based on uncertainty called GaussianMarker is proposed. Firstly, 3DGS is partitioned based on uncertainty, and the watermark is only added to the model parameters with high uncertainty. Subsequently, the corresponding parameters are perturbed using both 2D and 3D watermark encoders, enabling the extraction of watermark information from rendered 2D images as well as directly from 3D model parameters. Experimental results demonstrate the robustness of the proposed GaussianMarker method against 2D and 3D distortions.", "questions": "1. In the experimental section, the authors present four baseline methods. How do 3DGS with message and 3DGS with fine-tuning extract messages. \n2. Four types of 3D editing methods are listed in the experiment, which parameters of 3DGS are affected by these distortions?", "limitations": "The authors have addressed the limitations.", "rating": 5, "confidence": 5, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "1. The paper proposes a method that utilizes uncertainty to partition 3D Gaussian. By embedding watermarks specifically in the parameters with high uncertainty, the method aims to mitigate the impact on the quality of the model.\n\n2. The paper considers the extraction of watermarks in both 2D and 3D scenarios, taking into account the robustness of watermark extraction in these two contexts.", "weaknesses": "1. The paper mentions that the calculation of uncertainty is related to the model parameters, and in 3D Gaussian, each point has multiple parameters such as $\\mu, R, S, c, and \\alpha$. It would be helpful if the authors could clarify which specific parameters are used in the proposed method. Additionally, the paper provides a formula for calculating model uncertainty, but it is unclear how the uncertainty of each Gaussian is computed and used for partitioning. The authors should provide further explanation or clarification on this matter.\n2. The description of the densify function $g(\\cdot)$ in the paper states that it randomly samples a new position from a distribution. According to my understanding, the original Gaussian $G_i$ should have been replaced. However, Figure 2 shows that the original Gaussian  $G_i$ still exists, which is confusing to me.\n3. During the watermark embedding process, it is unclear whether the 2D and 3D watermarks are embedded into the same model parameters. It would be helpful if the authors could clarify which specific model parameters of the 3D Gaussian are used for embedding the watermarks.\n4. In the section on \"Distilling watermarking knowledge,\" the authors mention that \"the pre-trained feature from 2D space can be distilled to the 3D space.\" It is important for the authors to provide an explanation of how this is achieved.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Dear Reviewer VdSM,\n\nThank you for your valuable feedback and constructive comments. We will address your comments below and in the revised paper.\n\n### Weakness\n\n> W1: Parameters for uncertainty calculation and partitioning.\n\nAs we have mentioned in the main paper (Section 4.1), the model parameters $\\theta$ are used to compute the uncertainty, including all Gaussian parameters $\\mu$, $R$, $S$, $c$, and $\\alpha$. The uncertainty is estimated by calculating the Hessian matrix as an approximation of the Fisher information. This process can be simplified by computing the gradient for each Gaussian (main paper, lines 148-152) as $\\mathbf{H}\\left[\\mathbf{I} \\mid \\mathbf{V}, \\boldsymbol{\\theta}^*\\right]=\\nabla_{\\boldsymbol{\\theta}} f\\left(\\mathbf{V} ; \\boldsymbol{\\theta}^*\\right)^T \\nabla_{\\boldsymbol{\\theta}} f\\left(\\mathbf{V} ; \\boldsymbol{\\theta}^*\\right)$. Since Fisher information is additive (main paper, lines 153–155), the uncertainty of each Gaussian can be summed by adding the uncertainty of each parameter: $\\mathbf{H}[\\mathbf{I}|\\mathbf{V},\\mathbf{\\theta}^*] = \\mathbf{H}[\\mathbf{I}|\\mathbf{V},\\mathbf{\\theta^*_{\\mu}}] + \\mathbf{H}[\\mathbf{I}|\\mathbf{V},\\mathbf{\\theta^*_{R}}] + \\mathbf{H}[\\mathbf{I}|\\mathbf{V},\\mathbf{\\theta^*_{S}}] + \\mathbf{H}[\\mathbf{I}|\\mathbf{V},\\mathbf{\\theta^*_{c}}] + \\mathbf{H}[\\mathbf{I}|\\mathbf{V},\\mathbf{\\theta^*_{\\alpha}}]$. The high uncertainty 3D Gaussians are partitioned based on the Equation (7). \n\n> W2: The desify function 𝑔(⋅).\n\nAs we have mentioned in the main paper (lines 163-170), we retain the integrity of the original 3D Gaussians, denoted as $\\mathcal{G}$. We densify the 3D Gaussians with high uncertainty, and the newly added 3D Gaussians are our proposed 3D perturbations denoted as $\\mathcal{\\tilde{G}}$. We embed $\\mathcal{\\tilde{G}}$ into $\\mathcal{G}$ to get the watermarked Gaussians: $\\mathcal{\\hat{G}} = \\mathcal{G} \\cup \\mathcal{\\tilde{G}}$. We keep the integrity of the original Gaussians $\\mathcal{G}$ and add 3D perturbations $\\mathcal{\\tilde{G}}$ on the original 3D Gaussian, similar to the 2D watermarking methods apply an invisible 2D perturbation messages on the original cover images: $x_{w} = x_{o} + \\delta$ (main paper, lines 178-180).\n\n> W3: It is unclear whether the 2D and 3D watermarks are embedded into the same model parameters\n\nThe 2D and 3D watermarks are all embedded into the same model parameters. As mentioned in lines 207-210 of the main paper, our training contains two phases. In the first phase, we distill the messages into the model parameters. After this distillation, the messages have already been able to be extracted from 2D rendered images. In the second phase, we only train the 3D message decoder to ensure that the messages embedded in the first phase can be directly extracted from the 3D assets.\n \n> W4: Distilling watermarking knowledge.\n\nAs we have mentioned in lines 211-213 of the main paper, previous methods have shown that the 2D knowledges can be distilled into the 3D radiance fields via additional settings. In our designs, we distill the 2D knowledges from a pre-trained HiDDeN decoder into the Gaussian parameters as the embedded watermarks. Based on our proposed two training phases, such distilled knowledges can be extracted from the 2D and 3D domains. \n\n### Questions\n\n> Q1: Message extraction methods\n\nIn our experimental setting, for a fair comparison, “3DGS with message” and “3DGS with fine-tuning” methods all use the same 2D and 3D message decoders to extract messages. The 2D message decoder is a pre-trained HiDDeN decoder and can extract messages on the watermarked rendered images (main paper, lines 176–177). The 3D message decoder is based on PointNet architecture and can extract messages on the watermarked 3D Gaussians (main paper, lines 196–197).\n\n> Q2. Four types of 3D editing methods are listed in the experiment, which parameters of 3DGS are affected by these distortions?\n\nThe four types of 3D editing (3D Gaussian noise, translation, rotation, crop-out) occur in 3D space and are used to modify the positions $\\mu$ of the 3D Gaussians, while other Gaussian parameters remain unchanged. We treat the 3D Gaussian mean $\\mu$ as the point position and other parameters as the associated point features (main paper, lines 193-196), so that the PointNet-based 3D message decoder can extract the hidden messages directly from the 3D Gaussians and even they are spatially transformed or distorted.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "rm2mF4Uohm", "reviewer": "Reviewer_BKx3", "summary": "This paper proposes GaussianMarker, a novel method for embedding invisible watermarks into 3D Gaussian Splatting (3DGS) models to protect their copyright. The key idea is to use uncertainty estimation to add imperceptible perturbations to 3D Gaussian parameters with high uncertainty. The method enables extraction of copyright messages from both the 3D Gaussian parameters and rendered 2D images, and demonstrates robustness to various 3D and 2D distortions. Experiments on multiple datasets show the effectiveness of the approach in terms of message decoding accuracy and visual quality preservation.", "questions": "My primary concern with this paper stems from a fundamental physical challenge: How can a digital watermark be embedded into the 3D Gaussian Splatting (3DGS) representation of a scene in such a way that it can be reliably decoded from any viewing direction?\n\nThe volume rendering process that converts 3DGS representations into 2D images is designed to produce geometrically consistent views based on the camera pose. However, the requirement to embed and extract a watermark from arbitrary viewpoints seems to conflict with this underlying principle.\n\nOne potential resolution to this contradiction could be as follows: Rather than directly encoding the watermark itself into the 3D representation, the method might embed a geometrically consistent signal that can be detected by a trained network D. This signal could then trigger the generation or retrieval of the actual watermark (be it an image, audio, or text), which has been memorized by the detector D during the training process.\n\nThis hypothesis aligns with the paper's description of F as a detector/classifier rather than a decoder. It also explains the need for a separate classification module to guide whether the detector should produce the stored watermark data.\n\nHowever, this interpretation raises several questions:\n\n* How does the method ensure that the embedded signal remains detectable across different viewing angles and rendering conditions?\nWhat is the information capacity of this approach, and how does it compare to traditional digital watermarking techniques?\n* How robust is the embedded signal to various forms of 3D transformations or edits to the 3DGS model?\n* Is there a trade-off between the strength of the embedded signal and the visual quality of the rendered images?", "limitations": "The authors have included a brief limitations section that acknowledges potential vulnerabilities to malicious attacks beyond their technical solution. However, this discussion could be expanded to consider more specific limitations of the approach, such as potential challenges with very complex scenes or highly dynamic content. The societal impact is briefly mentioned, focusing on the positive aspects of copyright protection. A more thorough examination of potential negative impacts or misuse scenarios would strengthen the paper.", "rating": 4, "confidence": 5, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "* Timely contribution addressing copyright protection for 3D Gaussian Splatting models, an increasingly important 3D asset format\n* Clever use of uncertainty estimation to guide watermark embedding in a way that preserves visual quality\n* Demonstrates robustness to various 3D and 2D distortions/attacks", "weaknesses": "* The decoder is trained per scene, rather than being a generalizable decoder. This makes the watermarking process essentially impractical for real-world use. It's not feasible for people to store a separate watermark encoder and decoder for each scene for the vast number of Gaussians distributed across the internet. Reflecting on the logic of image watermarking, a single watermark encoder and decoder can encode and decode information for any cover image, so the sender and receiver only need to jointly possess one watermark decoder. This is a more reasonable setup.\n* Experiments focus mostly on relatively simple scenes - more complex, dynamic scenes could be challenging\n* The robustness to more sophisticated attacks (e.g. adversarial perturbations) is not explored\n* Discussion of potential negative impacts of the technology could be expanded", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Dear Reviewer BKx3,\n\nWe will address your comments below and in the revised paper.\n\n### Weakness:\n\n> W1: Generalizability of decoders.\n\nWe agree that the generalization ability is very important for practical use. In our designs, we employ a two-layer protection approach to achieve generalizable and specific protection. We have two decoders in 2D and 3D, respectively. The 2D decoder is **never trained per scene** for generalization ability. In our setting, it is pre-trained and can be used across images rendered from different 3DGS models. This can provide protections for **vast number of Gaussians distributed across the internet**. Our second decoder is in 3D and is trained per scene. This is the second protection wall for 3D assets with more specific protection. The 3D asset owners can train their 3D decoder per scene based on the scene property. We believe such two-layer protection with both general and specific protection can make 3D assets safer. \n\n> W2: More complex, dynamic scenes.\n\nIn Table 1 of our main paper, we present evaluations of our method across three datasets, including MipNeRF360, widely regarded as the most challenging static scene dataset. To address your concerns, in this rebuttal, we further test our watermarking strategy on the Simplicits [1], a latest framework for simulating complex motions. In this place, we just need to simply modify the distortion layers in the original designs by incorporating various geometry distortions. From the **left part of rebuttal Figure 4**, our method still shows robustness in such new and complex scenarios. Besides, it also partly shows that our approach can be extended to dynamic 3DGS scenarios.\n\n> W3: Adversarial perturbations.\n\nFollowing your suggestions, we have designed more experiments to evaluate adversarial robustness. A malicious user can employ an adversarial attack, such as PGD, to compromise hidden messages in rendered images. As shown in the **right part of rebuttal Figure 5**, adversarial attacks can indeed reduce bit accuracy, even with minimal visual distortion (PSNR > 30). However, the defense against such adversarial attacks can be easily achieved via adversarial training by generating adversarial samples during the training for HiDDeN decoder. Under adversarial training to the message decoder for 2D images, the bit accuracy can be significantly improved, while the image quality is preserved with a PSNR value larger than 30.\n\n> W4: Potential negative impacts.\n\nAlthough our method demonstrates robustness against many sophisticated distortions,  additional legislative strategies should be implemented to combat such malicious attacks beyond technological measures. We will explore extending our work by integrating legislative actions to provide comprehensive copyright protection for model owners.\n\n### Questions\n\nIf our understanding is accurate, BKx3’s primary concern is whether our watermarks can maintain geometric consistency, which is essential for robust extraction from different viewing angles. Our specific designs have equipped our digital watermarks with such consistency. Our method embeds watermarks into the 3DGS model by adding perturbations to 3D Gaussians with high uncertainty. \nAs shown in Figure 3 of our main paper and supplementary material, these areas cover most object boundaries in the 3DGS scene, regardless of viewing angle. **Rebuttal Figure 6** further illustrates geometry consistency by displaying the incorporated perturbations. These perturbations effectively cover the scene's general geometric structure. The geometry of these perturbations remains consistent across different camera angles and can be transmitted into the rendered images, enabling detection by the 2D message decoder.\n\nThe scenarios envisioned by BKx3 can be achieved by some classical information-hiding techniques [2], which use specific strategies to hide images or even videos in the target data and can employ a specific decoder to extract such hidden data. We try to address the newly raised questions related to this envisioned scenario below：\n\n> Viewing angles, information capacity, and comparison to traditional watermarking.\n\nDuring training, careful selection of training and testing data guarantees that camera angles cover most scene perspectives, enabling successful watermark detection from various viewpoints. The information capacity relies on the model parameters of the decoder since this approach is conducted in an over-fitting manner. Compared with traditional watermarking, the envisioned method can decode different types of watermark data, but it relies on a specific decoder.\n\n> The 3D robustness.\n\nInformation hiding seldom considers robustness. However, this also belongs to a kind of fine-tuning approach, which means the signals are embedded by fine-tuning the original model. In this situation, based on Table 2 of the main paper, such a fine-tuning strategy may show degraded 3D robustness. \n\n> Trade-off.\n\nAs discussed in the **rebuttal Table2** and the previous methods [2], stronger 3D perturbations can enhance watermarking decoding accuracy, while it may affect image quality. Thus, for the envisioned scenario, there should also be a similar trade-off.\n\nHowever, we have to say our method is for digital watermarking, which is a different topic against information hiding, despite their somewhat correlations. We will investigate how to incorporate your suggestions into our future work and feel happy to discuss this point with you during the discussion session. \n\n> Limitations\n\nWe will further incorporate more limitations and potential impacts into our final version by considering the valuable suggestions from each reviewer.\n\n[1] Simplicits: Mesh-Free, Geometry-Agnostic, Elastic Simulation.\n\n[2] StegaNeRF: Embedding Invisible Information within Neural Radiance Fields.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:
Dear Reviewers,

We sincerely thank all reviewers for their comprehensive evaluations and valuable feedback. We are pleased to address any additional questions during the discussion period.

Best Regards,

Authors of Paper 3674

Meta-review: To make this decision, AC carefully read the paper, reviewers' comments and author's rebuttal.

Before rebuttal this paper got 1 borderline accept, 1 weak accept, 2 borderline rejects. After rebuttal, 2 of the reviewers raised their score, so the final rating for this paper is 1 accept, 2 borderline accepts and 1 borderline rejects. 

Before rebuttal, Reviewer fyQG raised concerns on novelty of this paper and asked for more experiment. Authors added more experiments in the rebuttal and clarified their contribution. After rebuttal Reviewer fyQG commented that authors have addressed their concerns. 

Before rebuttal, Reviewer QvjQ asked for more experiments. Authors added experiments in the rebuttal and Reviewer QvjQ was happy with that and raised the rating from weak accept to accept. 

Before rebuttal, Reviewer VdSM asked for some clarification and design details. After rebuttal, Reviewer VdSM said that authors have address their concerns and raised rating from borderline reject to borderline accept.

Before rebuttal, Reviewer BKx3 raised concerns on novelty, the decoder is trained per scene, rather than being a generalizable decoder, need more experiments on complicated scenes, etc. AC also echoed that the decoder is trained per scene might be a problem. But as authors explained that 2D decoder is not per scene, only the 3D decoder is per scene, which is acceptable. Reviewer BKx3 also raised concerns that only do bit message embedding probably not enough. But given bit message embedding is enough for the copyright projection which is an important usage for wateramarking, AC think it is acceptable. At the end Reviewer BKx3 kept borderline reject rating. 

Considering all these, AC made the accept decision.
Decision: Accept (poster)