Geometry Cloak: Preventing TGS-based 3D Reconstruction from Copyrighted Images
Authors: Qi Song
Ziyuan Luo
Ka Chun Cheung
Simon See
Renjie Wan
Venue: NeurIPS 2024 poster (2024)
Keywords: Copyright protection
Image cloaking
single-view image to 3D model
Primary area: privacy

Abstract: Single-view 3D reconstruction methods like Triplane Gaussian Splatting (TGS) have enabled high-quality 3D model generation from just a single image input within seconds. However, this capability raises concerns about potential misuse, where malicious users could exploit TGS to create unauthorized 3D models from copyrighted images. To prevent such infringement, we propose a novel image protection approach that embeds invisible geometry perturbations, termed ``geometry cloaks'', into images before supplying them to TGS. These carefully crafted perturbations encode a customized message that is revealed when TGS attempts 3D reconstructions of the cloaked image. Unlike conventional adversarial attacks that simply degrade output quality, our method forces TGS to fail the 3D reconstruction in a specific way - by generating an identifiable customized pattern that acts as a watermark. This watermark allows copyright holders to assert ownership over any attempted 3D reconstructions made from their protected images. Extensive experiments have verified the effectiveness of our geometry cloak.

Geometry Cloak: Preventing TGS-based 3D Reconstruction from Copyrighted Images
Qi Songl.?, 1.2, Ziyuan Luo!:2, Ka Chun Cheung?, Simon See Renjie Wan
'Department of Computer Science, Hong Kong Baptist University NVIDIA AI Technology Center, NVIDIA {qisong 2iyuanluo) hábu. edu. hk
{chcheung, ssee)sseeeeeieeee com, renjiewan@hkbu. edu.
Abstract
Single-view 3D reconstruction methods like Triplane Gaussian Splatting (TGS) have enabled high-quality 3D model generation from just single image input within seconds. However, this capability raises concerns about potential misuse, where malicious users could exploit TGS to create unauthorized 3D models from copyrighted images. To prevent such infringement, protection approach that embeds invisible geometry perturbations, termed "geom- etry cloaks", into images before supplying them to TGS. These carefully crafted perturbations encode a customized message that is revealed when TGS attempts 3D reconstructions of the cloaked image. Unlike conventional adversarial attacks that simply degrade output quality, our method forces TGS to fail the 3D reconstruction in specific way by generating an identifiable customized pattern that a watermark. This watermark allows copyright holders to assert ownership over any attempted 3D reconstructions made from their protected images. Extensive experiments have verified the effectiveness of our geometry cloak. Our project is available htttt::t/ htttps://gsong20011 .oroo....iii githu....... io/ www.iiioetryy..ooooooo geemetry_cloaad
propose novel image
Introduction
With the increasing importance of 3D assets, several methods have been proposed reconstruct or generate 3D models from single 2D images. Combining with Tensorial Radiance Fields [2]. Triplane-base based Gaussian Splatting (TGS) [52] presents a compelling approach for producing 3D models from single-view images. However, malicious users could potentially exploit TGS [52 to
generate 3D models from single-view images without authorization, posing a threat to the interests of image copyright owners. To address this issue, it is essential for image owners to implement measures that can safeguard their copyrighted images from being used by TGS [52]
Digital watermarking 6 [5]) is an effective way of claiming the copyright of digital assets. Thus, one potential method for safeguarding copyrighted images to embed unique messages within images intended for building 3D model and then extract the embedded messages from the reconstructed 3D model. However, previous methods have proven is difficult to transfer the embedded copyright messages in 2D images into 3D models [i [9]. Moreover, even if we can embed and extract copyright messages, the 3D models might have already been used by others before the copyright being claimed.
To prevent unauthorized 3D reconstruction from copyrighted images via TGS 52 possible approach is to incorporate adversarial perturbations [1] 28 into input images intended for TGS.
*Corresponding author.
38th Conference on Neural Information Processing Systems (NcurIPS 2024).

---

(a) Without Protection
Novel View
Point Cloud
(b) Digital Watermark
Enc.
Extr.
Fail
TGS
TGS
01011...
(o) Geometry Cloak
Protection Phase
Unauthorized Reconstruction Phase
Used for verification
TGS
9
9
Original Image
Cloaked Image
Stolen Image
Rendering
9
Pre-defined Pattern Geometry Cloak
Image Sharing
Reconstructed model
Figure 1: Overview of scenario. (a) Images without protection. Images be easily recon- structed into 3D models by malicious users with TGS [52]. posing a threat to the copyright of the image owner. (b) Digital Watermarking offers solution by embedding copyright messages into the view-image before 3D reconstruction. However, the embedded message cannot be extracted from novel rendered views. (c) Geometry Cloak. Our geometry cloak utilizes the disturbance prone components of TGS, achieving view-specific watermark embedding, Our method can compromise the unauthorized reconstructed 3D model while providing verifiable pattern for copyright claim.
have already achieved promising results by introducing disturbances into input images to prevent neural models from functioning correctly. When it comes to TGS [52). straightforward solution is to incorporate such adversarial perturbations into input images by maximizing the difference between rendered and ground truth views like previous methods 9 [3] However, those methods 3 intuitively focus on disturbing rendered results, ignoring perturbation- prone components of TGS 522. As result, those conventional adversarial perturbations can only lead limited changes to the reconstructed results D which may still be used for several illicit applications. Besides, simple adversarial perturbations can only disrupt the results of 3D reconstruction an uncontrollable manner but do not support traceability. The users have difficulties claiming copyright after the disturbance-affee 3D generation of images.
Adversarial methods 11
We envision novel scenario where copyrighted images can induce TGS to generate compromised content with an identifiable pattern. To achieve this goal, a naive solution is to employ image cloaking. Traditionally, image cloaking techniques [23 355 are used prevent the image from malicious editing by diffusion models 333 The cloaking integrated into images can shift image features into another domain through adversarial perturbations. Consequently, this manipulation directs diffusion models to generate predetermined specific outcomes. If malicious users attempt to create 3D models using these protected images, the resulting compromised 3D models will be unusable. Besides, the identifiable pattern exhibited can help the image owner assert their copyrights in the event of legal inquiries.
against diffusion models 33 simply perturbing image features cannot effectively induce TGS (as shown in Fig. []. Image features in TGS show strong robustness against disturbances, even under relatively strong attack settings. Thus, the key becomes how identify perturbation-pron components in TGS (52) and capitalize this weakness to induce reconstructed results. TGS 52 contains image and geometry features during its 3D model reconstructions. Previous works Splatting (18) is easier to be manipulated with external operations. Therefore, we wonder it is possible to manipulate the estimated point cloud process with an invisible disturbance. Based on this simple observation, we propose embedding invisible adversarial perturbations geometry cloak on images intended for TGS [52], which can affect and manipulate estimated point clouds in the process of T 3D reconstruction.
However, unlike image cloak methods 35 23
have shown the geometry feature in 3D Gaussian

---

As shown in Fig. 2 we introduce a geometry cloak, which is carefully crafted to induce TGS [52] to fail 3D model generation and reveal our embedded pattern. To induce the TGS reveal the embedded patterns, we propose a view-specific Projected Gradient Descent (28] (view-specific PGD) strategy by optimizing the distance between the projected point cloud view and predefined patterns. The PGD iteratively updates the geometry cloak by minimizing CD loss, ultimately revealing the desired view and uncovering the hidden patterns within the TGS [52]. When malicious users reconstruct 3D models using the protected images with TGS, the compromised geometry information causes TGS to reveal the embedded message. Unlike traditional copyright protection methods like digital watermarking [25 [1 [39], which typically entail additional procedures for extracting the watermark post-use. Our approach directly transforms TGS [52] into a message disclosure tool by inducing it to yield specific stylistic outcome, facilitating the verification of image ownership rights. In summary, our main contributions are threefold:
We propose the concept of "geometry cloaking". which can prevent unauthorized image-to- 3D generation by TGS [52]. and it also leaves verifiable copyright pattern.
Our geometry cloaking technique explores the perturbation-pee prone components of Triplane- based Gaussian Splatting and utilizes this vulnerability to achieve the protection of images.
We propose view-specific PGD strategy, which can embed identifiable patterns into a specific view of the reconstructed 3D model.
As our approach attacks the geometry features that are widely used in various single-image-to-23 approaches, it demonstrates generalization capability to other GS-based single-view to 3D approaches like LGM 40) The results can be found in our experiments.
2 Related work
2.1 Building 3D models from single images
There has been surge of research on learning generate novel views from a single image 47 36 52 This task aims to infer the 3D structure of a scene from a single 2D image and render new perspectives, enabling applications in virtual reality, augmented reality, and computer-aided design. One approach is NeuralLift- -60 [4]]. which incorporates a CLIP loss 32 to enforce similarity between the rendered
image and the imput image. Another method, 3DFuse (36), fine-tunes the Stable Diffusion model (33 with LoRA [14] layers and a sparse depth injector. Recent work like Zero123 [24] takes a different
approach by fine-tuning the latent stable diffusion model (33 to generate novel views based on relative camera pose. Recently, Triplane- neural rendering methods 2
52 12 adopt novel
approach to model and reconstruct radiance fields. Unlike NeRF, which uses pure MLPs, Tensorial Radiance Fields (TensoRF) 2 consider the full volume field as a 4D tensor and propose to factorize the tensor into multiple compact low-rank tensor components for efficient scene modeling. Combing TensoRF 2 with novel 3D Gaussian Splatting
[18) Zou et al.proe a Triplane- Gaussian Splatting [5], which can obtain a 3D model from single-view image within seconds (52]. With continued research and development, more impressive and realistic 3D reconstructions in the future will enable immersive experiences and streamlined design workflows. The advancements in creating 3D models from single-view view image offer significant potential for diverse applications and digital assets. Consequently, it is essential to address the protection of copyrighted images to prevent their misuse in generating 3D models.
2.2 Adversarial attacks for neural rendering
Adversarial attacks [1 28 have become a significant concern in the field of computer vision (22 16]. These attacks aim to deceive machine learning models by introducing adversarial perturbations to the input data, leading to incorrect predictions such as misclassification [1.. While initially studied in the context of image classification models, adversarial attacks have also been explored in other domains 35] 23 For Neural Radiance Fields (NeRFs) (29] several works have proposed methods to perturb or enhance the original NeRF framework. NeRFs are class of models that can synthesize high-quality 3D scenes from 2D images by learning the scene's volumetric representation and appearance. However, NeRFs are also vulnerable adversarial attacks. Several recent works have investigated different techniques to perturb enhance the original NeRF framework using adversarial
3

---

attacks. NeRFool [9 presents an approach to manipulate NeRFs by perturbing the scene's s geometry and appearance using adversarial attacks. NeRFTargeted [13] focuses on targeted perturbations in NeRFs, allowing for the optimization of scene parameters to generate desired target images. ShieldingNeRF [46] introduces technique to protect sensitive information NeRF-generated views by introducing obfuscating perturbations. These works demonstrate the potential of perturbing NeRFs for various objectives, including adversarial attacks, targeted image manipulation, and privacy protection, contributing to the advancement of NeRF-based models (2) 29 27 in computer graphics and computer vision tasks. However, with the promising developments in 3DGS [8], research on defending against attacks Gaussian Splatting renderings remains an area that requires further investigation.
2.3
Image cloaking
With the rapid advancement of Al models, the risk of misuse has raised concerns, particularly in the malicious of public data [3
50 17). Researchers advocate a proactive approach to prevent such misuse by adding subtle noise to images prior to publication. This technique aims to disrupt attempts at exploitation [21 prevent privacy violations from face recognition systems [8 153. By introducing noise patterns to facial regions, these methods degrade face recognition model performance while maintaining visual quality. Image cloaking can also thwart image manipulation through GAN-based techniques like DeepFakes [30] by corrupting latent representations. Recent image cloaking methods [37 23 411
42
26 20). An important application of image cloaking is to
focus on protecting the copyrighted image from misuse by stable diffusion models. These methods disrupt artistic mimicry and harmful personalized images, aiming to prevent unauthorized exploita- tion. For example, GLAZE (37] and AdvDM (3 primarily focus on disrupting artistic mimicry and harmful personalized images generated by text-to-image models [0]. anti-Dreambooth [41 concentrates fine-tuning DreamBooth (34) for malicious face editing. These techniques aim to cloak input images in way that disrupts the model's ability to generate personalized content while preserving the overall visual quality. Existing methods focus protecting the copyrighted image from misuse by disturbing image features. By contrast, our method focuses on preventing copyrighted from being 3D reconstructed by TGS [52] without authorization, facing 3D scenes and complex copyright validity verification settings.
Preliminaries of TGS
TGS [52
introduces a novel hybrid 3D representation that integrates an explicit point cloud with an implicit triplane, enabling efficient and high-quality 3D object reconstruction from single-view images. As shown in Fig. 2 the representation consists of a point cloud P E IR Nx3 providing explicit geometry, and triplane T R3xCxxXX encoding
implicit feature field, where T (Try, Te,, Tyz) comprises three orthogonal feature planes. For given position x e IR3 from the point cloud, the corresponding triplane feature fe is obtained by trilinear interpolation and concatenation of features from the three planes:
ft interp(Tzy, Pay) interp(TTz... Pax) @ interp(TTy:.P. Py=).
(1)
Utilizing this hybrid representation, the 3D Gaussian attributes like opacity a, anisotropic covariance (scale and rotation q). and spherical harmonics coefficients sh are decoded from fi augmented with projected local image features fi using an MLP Φg:
(Ax', a, 8, q, sh) = 0y (2, jr, fc ① ft)-
(2)
Together, these parameters parameterize the 3D Gaussian kerel attributes around the point enabling differentiable Gaussian splatting for rendering.
TGS represents a cutting-edge approach to 3D object reconstruction from single-view images, combining explicit and implicit representations to achieve accurate and detailed reconstructions. By leveraging advanced decoding mechanisms and efficient rendering techniques, the model demonstrates superior performance in generating realistic 3D models with intricate geometry and textural details.
4 Methodology
Overview. With the increasing capabilities of 3D reconstruction techniques like TGS 522. there is a risk of malicious users exploiting these methods to generate 3D models from copyrighted images

---

Y (b) Pre-detined Pattem
Point Cloud
Point Cloud
(c) View-
specific PGD
Grad flow
Image Encoder
Protected Image
(x.y2))
Geometry Cloak
Single-view in Image
Splatting
Camera
Triplane Decoder
Embedding
Triplane Latent T
Goussian
Decoder
Novel Views
TGS Encoder-Decoder
(a) Core representation of TGS
Figure 2: Overall of our proposed method. We propose to induce the 3D reconstruction process with our geometry cloak. (a) The core representation of TGS [52] includes an explicit point cloud and an implicit triplane-based feature field. The features of the novel view image extracted through the coordinates the point cloud. (b) The target patterns (Section [41 are designed to induce the final reconstruction result. (c) In order to make the reconstruction result show some distinguishable characteristics, we use projected gradient descent (PGD) [28] to iteratively optimize the reconstructed
point cloud that it has consistent characteristics with the target point cloud (Section 4.2)
without authorization, infringing the rights of image owners. We propose geometry cloak, novel solution by embedding invisible perturbations on the input images intended for TGS [52]. These perturbations crafted to induce TGS to fail the reconstruction in distinct way, producing identifiable pattern in the corrupted 3D output.
This section presents the methodology of inhibiting 3D reconstruction of TGS [52] via the introduced geometry cloak. Our method consists of two stages: (1) Building verifiable geometry patterns (Section 4.1. and (2) Optimizing geometry cloak with view-specific PGD (Section 4.2
4.1 Building verifiable geometry pattern
As illustrated in Fig.
obtain a 3D model from single-iiew images, TGS 52 encodes the
single-view image I and its associated camera parameters into image features. Following this, point cloud decoder is adopted project image features onto the point cloud. Then, triplane decoder converts the image feature into the triplane latent T. Finally, 3D Gaussians are decoded from triplane feature fe for novel view synthesis.
Our methodology diverges by targeting the explicit geometry features of the point cloud. Perturbing the point cloud directly is inherently more effective due the inherent vulnerabilities in the TGS reconstruction process. In TGS (52). the point cloud offers distilled and direct representation [8] of the scene's structure, making modifications them quite evident N 3. Besides, the point cloud only foundational geometry information but also typically helps subsequent processing to obtain the final output. Point clouds provide essential geometry information that instrumental in the sampling of features from the latent triplane representation (Eq. (.) Moreover, by introducing strategic alterations to the geometry feature, we bypass some of the inherent robustness found in image-level features (Table Th and avoid the complex transformations between image and geometry spaces. This direct manipulation allows for more precise control over the adversarial impact, exploiting specific vulnerabilities in TGS and leading to more pronounced disruptions in its output.
Different types of target geometry pattern. Based the inherent vulnerabilities of point clouds, we propose two types of verifiable pattern (Fig. 3) including (1) Pre-defined patterns and (2) Customized patterns. Through these patterns, the reconstructed 3D model undergoes consistent changes in geometry and visual appearance (novel views).
Pre-defined putterns are 2D point clouds that are transformed from alphanumeric characters images, creating direct and straightforward representation of watermarks. To obtain these point clouds, segment the image of alphanumeric characters and record the coordinates of these alphanumeric
5

---

A A
E1
E2
Pre-defined patterns
Customized patterns
Figure Two different target geometry patterns. (1) Pre-defined patterns: we directly convert alphanumeric characters into a 2D point cloud as watermarks. (2) Customized patterns: In Eú, we first extract the point cloud of the image that needs to protected. In Ez, we edit the acquired point cloud through text- text-guided methods like instructP2P 48 or open-source software meshlab [
characters' segmentation. Then, sample the point from segmentation coordinates and form 2D point cloud as pre-defined patterns.
Customized patterns
more personalized approach where users selectively protect certain part of an image. this setting, we first extract a point cloud from the image that requires safeguarding. We adopt the same methods from TGS [52 to obtain the point cloud P in E1. In E2, users can refine this point cloud to select the area they wish protect. Users can employ text-guided editing techniques like instructP2P [88] or turn to open-source software like MeshLab [5] to further shape and customize the point cloud. This process only enhances the visual appeal of the point cloud but also embeds layer of security by aligning it with specific textual instructions or user intents.
4.2 Optimizing geometry cloak with view-specific PGD
In this section, by exploiting the vulnerability TGS 52 we present view-specific PGD to determine geometry cloak 8, which can minimize the distance between reconstructed point clouds in TGS and target pre-defined patterns.
Geometry Cloak 8. Geometry cloak is crafted to mislead the TGS into a controlled 3D reconstruction with imperceptible perturbations into single-view images. It minimizes the difference to the target geometry pattern while preserving image fidelity perceptible to the human eye through adversarial training (28)
Specifically, our geometry cloak aims to minimize the Chamfer Distance LCD between point cloud from image I via TGS and target geometry pattern Pur in a certain view. The overall objective can be expressed follows:
Geometry Cloaked I
Pro-defined Pvr
Pattem
Y
8 = arg min (ED(E(I + 8), Pin),
E
||
where E denotes the network that maps image into point cloud in TGS [52], and represents the pertur- bation budget.
Chamler Distance
Projecting
Point Cloud p(
Grad flow
View-specific PGD. To embed pre-defined patterns in specific viewing direction, we develop a view- specific PGD. The optimization iteratively adjusts the geometry cloak 5 to make the projected point cloud closer the pre-defined patterns while keeping the image visually similar to the source. The updates use gradient decent (8 on LCD with learning rate a, moving the cloaked image towards the target. This iterative process manipulates the TGS's perception while maintaining visual similarity as below:
Figure 4: Example View-specific PGD. We use 2D point cloud pre-defined pattern P.. as the target geometry pattern. The watermark is embedded at the viewing direction zy.
T(+1] = ( + a sgn VzLcv Pw)),
(4)
where P)j = Proja + 5(0), denoting the projected point cloud at viewing direction from cloaked image (Z 5(0), and P., stands a 2D point cloud watermarks. We encapsulate the geometry cloaking process in Algorithm

---

Algorithm 1: Optimizing Geometry Cloak with view-specific PGD
Input: Input image I, Point cloud encoder & from TGS, pre-defined pattern Pv
number steps N, step size a, perturbation budget e, viewing direction 0
Output: Geometry cloaked image
Initialize geometry cloak 5 + 0, and geometry cloaked image I +-I I for 4- to N do
P + E() // Estimate point cloud representations;
Po t (P) // Project the point cloud at view direction 0; Loss + (cD(Ps. Pw) // Calculate between two 2D point clouds; 6 a..aspp sgm VgLoss) // Update geometry cloak;
I + I+ // Update cloaked image;
Ī clip( e, ()) // clip cloaked image Ī;
end
Return I
4.3
Implementation details
Our method uses the PyTorch framework on single NVIDIA V100 GPU. Our geometry cloak is obtained through optimization (Section 4.2) using projected gradient descent [Л]. We adopt mask version of PGD 28
for calculating geometry cloak, only the object in the image is used for 3D reconstruction without its background. The input image T I is initialized, and iteratively updated for N = 100 steps with a step size of a = 0.001. The loss is defined as the Chamfer
Distance I| between the predicted point cloud P and the target point cloud Prar. For pre-defined patterns, we adopt the proposed view-specific PGD
embed the 2D pre-defined patterns into a certain viewing direction 6. For customized patterns, we directly calculate the distance between customized patterns and predicted point clouds, as both are 3D point clouds. The updated image (() clipped to the valid range [o, 1]. and after N 100 iterations, the final image I I(N) are obtained as the geometry cloaked output.
5 Experiments
5.1
Settings
Dataset. To evaluate the performance of our method, we conduct experiments on the Google Scanned Objects (GSO) [7] and OmniObject3D (Omni3D) [45] datasets. Both datasets embody a large diversity view images and provide a rich and varied set of data for assessing the performance of our method. For GSO 77. select image view for each of the 1030 objects, resulting in 1030 images. For Omni3D [45), we choose 5 image views from each of the 190 classes in Omni3D, resulting in a total of 950 images.
Baselines. To investigate the effectiveness our approach, we evaluate the impact of different per- turbations on the reconstructed results by TGS [2)] We experiment with four types of perturbations strategy: (I) Gauss. noise, ie., random Gaussian noise added to the protected image. (2) Adv. image, i.e. adversarial attacks image feature 19; (3) Geometry cloak w/o target, i.e. adversarial attacks on the point cloud. For Adv. image and geometry cloak w/o target, we directly use the norm value of features 335 the optimizing loss. (4) Geometry cloak. For the geometry cloak, randomly select letters "A-Z" and numbers "1-9" as the pre-defined pattern.
Evaluation methodology. We report the quantitative metric between no perturbation and perturbed reconstructed results. Specifically, for visual quality, we report image similarity metries: PSNR, LPIPS 49 For geometry quality, we report the Chamfer Distance (CD) (1. We further present the qualitative customized 3D reconstruction by inducing the point from the single-view image into another domain.
SSIM -

---

Table 1: Quantitative comparison of perturbation strategies We present the outcomes of four distinct perturbation strategies compared to the non-perturbed results. These strategies include Gaussian noise (random Gaussian noise), Adversarial image (perturbing image features), geometry cloak without target, and geometry cloak. We evaluate the image quality metrics (PSNR/SSIM/LPPIP) and GSO 7 datasets
and geometry quality metric (Chamfer Distance, CD) on the Omni3D 45
perturbation budgets of e 2,4,8.
Omni3D
GSO
Perturb. strategy
PSNR
SSIM
LPIPS f
CD
PSNR 4
SSIM
LPIPS
CD
Gauss, noise
23.35
0.8954
0.1141
4.913
24.24
0.9049
0,1130
5.070
Adv. image
19.32
0.8424
0.1782
13.86
19.94
0.8478
0.1821
21.89
2
Ours w/o target
11.69
0.7513
0.2585
237.7
13.07
0.7849
0.2499
267.5
Ours
12.47
0.7392
0.2669
337.0
14.06
0.7673
0.2578
352.6
Gauss, noise Adv. image Ours w/o target
22.11
0.8788
0.1313
6.424
22.66
0.8847
0.1354
7.940
19.21
0.8417
0.1784
14.84
19.81
0.8466
0.1827
13.60
4
11.49
0.7513
0.2603
260.1
12.94
0.7848
0,2504
284.8
Ours
12.45
0.7400
0.2665
344.9
14.04
0.7669
0,2585
356.5
Gauss. noise Adv. image
20.34
0.8443
0.1651
10.20
20.68
0.8479
0.1724
13.60
19.17
0.8412
0.1786
13.86
19.80
0.8468
0.1824
23.58
8 Ours w/o target
11.44
0.7515
0.2608
273.3
12.89
0.7840
0.2508
296.3
Ours
12.44
0.7396
0.2664
348.4
14.02
0.7661
0,2584
358.7
Reconstructed
Input view
Gauss, noise
Adv. image
Ours wio target
Gauss. noise
Adv. Image
Ours wio target
W/o pertub.
8
Figure 5: Qualitative reconstructed results with different perturbing strategies. Compare to Gauss. noise and Adv. image, method significantly affect the reconstructed results, indicating the explicit geometry features are perturbation- during 3D reconstruction.
5.2 Experiential results
To showcase the effectiveness of our geometry cloak, have conducted experiments using various perturbation strategies to assess their capability in preventing 3D reconstruction. We report the visual (PSNR/SSIM/LPIPS) and geometry (CD distance) differences between 3D models reconstructed from perturbed images and unprotected images.
Perturbing image/geometry features. To identify the perturbation- perpaattio--oonne components of TGS, compare the perturbation of implicit image features (Adv. image) and explicit geometry features (Ours w/o target) at different intensities norms (35). As shown in Table the experimental results show that by attacking the image features, the reconstructed visual and geometry quality is only slightly compromised, with the reconstruction results hardly impacted. However, attacking point cloud resulted in significant changes between the perturbed and the non-perturbed 3D model. We further provide qualitative results in Fig. 5 The image features exhibit strong robustness to perturbations. Even with obvious adversarial perturbations on the image, it is difficult to affect the

---

(a) Pre-defined patterns
(b) Customized patterns
Input image
Reconsiructed novel views and point cloud
Imput image
Reconstructed novel views and point cloud
Original
Original
A
Original
No Body
No Head
Figure 6: Qualitative results of two different target geometry patterns. (a) Pre-defined patterns: The letters "A" and "X" used watermark messages. The embedded watermark be effectively observed from certain perspective. (b) Customized patterns: Users can selectively control the parts that need protection, causing the 3D reconstruction of corresponding parts to fail. More qualitative experimental results are provided in the Appendix.
obtained 3D model. On the other hand, attacks on point clouds only require very small, invisible perturbations to change the reconstructed 3D model greatly.
Pre-defined pattern. Our method is proposed to perturb explicit geometry and develop view- specific pre-defined pattern. To evaluate the impacts of our geometry cloak on reconstructing 3D models via TGS [52], randomly select letters "A-Z" and numbers "1-9" the pre-defined patterns. As shown Table I we can see that after specifying the target point cloud, the reconstructed 3D model is comprised both in vision and geometry results, making the reconstructed model unusable. We further demonstrate the qualitative results in Fig. 6, showing that the watermark message can be re-emerged in the specific view perspective. This indicates that method preserve identifiable embedded information while ensuring the integrity of the 3D model.
Customized pattern. We also demonstrate the performance of method when using customized patterns. In this setting, the users can selectively protect specific parts of the image that need not be reconstructed for customized protection. As shown Fig. 6 users can choose remove certain object parts (e.g., tail, body, head). The results indicate that users can effectively influence the reconstruction results with our geometry cloak, further demonstrating that point clouds in TGS are susceptible to perturbation. We provide more results to show that our geometry cloak can be generalized other GS-based single-view to 3D method 40 in the appendix.
Conclusion
We present a novel geometry cloaking approach protect image copyrights from unauthorized 3D reconstruction with Triplane Gaussian Splatting (TGS). By embedding carefully optimized perturbations in the geometry feature space that encodes a customized watermark message, our method forces TGS to fail reconstruction in distinct way generating the watermarked pattern. Extensive experiments validate our strategy of focusing perturbations on the geometry components of TGS, which can reliably induce watermarks with invisible perturbations. Our geometry cloaking introduces novel method for protecting copyrights tailored the representations of single-view to 3D models.

---

Limitations and broader impacts. The multifaceted nature of copyright protection requires that our method be developed and used responsibly, respecting the delicate balance between innovation and intellectual property rights. Collaboration across technology, legal, and policy sectors is essential address these complexities.
Acknowledgement. This work was done at Renjie's Research Group at the Department of Computer Science of Hong Kong Baptist University. Renjie's Research Group is supported by the National Natural Science Foundation of China under Grant No. 62302415, Guangdong Basic and Applied Basic Research Foundation under Grant No. 2022A1515110692, 2024A151501288 and the Blue Sky Research Fund of HKBU under Grant No. BSRF/21-22/16.
References
[1] M. A. Butt and P. Maragos. Optimum design of chamfer distance transforms. TIP, 1998.
[2] A. Chen, Z. Xu, A. Geiger, J. Yu, and H. Su. TensoRF: Tensorial radiance fields. In ECCV, 2022.
[3] Y. Chen, Z. Chen, C. Zhang, F. Wang, X. Yang. Y. Wang, Z. Cai, L. Yang. H. Liu, and G. Lin. Gaussianeditor: Swift and controllable 3d editing with gaussian splatting. CVPR, 2024.
[4] V. Cherepanova, M. Goldblum, H. Foley, S. Duan, J. Dickerson, G. Taylor, and T. Goldstein. LowKey: Leveraging adversarial attacks to protect social media users from facial recognition. In ICLR, 2021.
[5] P. Cignoni, M. Callieri, M. Corsini, M. Dellepiane, F. Ganovelli, G. Ranzuglia, al. Meshlab: an open-source mesh processing tool. In Eurographics Ital. Chapter Conf., 2008.
[6] I. Cox, M. Miller, J. Bloom, and C. Honsinger. Digital watermarking. J. Electron. Imaging, 2002.
[7] L. Downs, A. Francis, N. Koenig, B. Kinman, R. Hickman, K. Reymann, B. McHugh, and V. Vanhoucke. Google Scanned Objects: A high-quality dataset of 3D scanned household items. In ICRA, 2022.
[8] J. Fang. J. Wang, X. Zhang, L. Xie, and Q. Tian. GaussianEdiior: Editing 3d gaussians delicately with text instructions. In CVPR, 2024.
[9] Y. Fu, Y. Yuan, S. Kundu, S. Wu, S. Zhang, and Y. Lin. NeRFool:
Uncovering the vulnerability of generalizable neural radiance fields against adversarial perturbations. In ICMI., 2023.
[10] R. Gal, Y. Alaluf, Y. Atzmon, O. Patashnik, A. H. Bermano, G. Chechik, and D. Cohen-Or. image is worth one word: Personalizing text-to-image generation using textual inversion. In ICLR, 2022.
[11] J. Goodfellow, J. Shlens, and C. Szegedy. Explaining and harnessing adversarial examples. In ICLR, 2015.
[12] Y. Hong, K. Zhang, J. Gu, S. Bi, Y. Zhou, D. Liu, Liu, K. Sunkavalli, T. Bui, and H. Tan. LRM: Large reconstruction model for single image to 3D. In ICLR, 2024.
[13] A. Horváth and C. M. Józsa. Targeted adversarial attacks on generalizable neural radiance fields. In ICCV, 2023.
[14] E. J. Hu, Y. Shen, P. Wallis, Z. Allen-Zhu, Y. Li, S. Wang, L. Wang, and W. Chen. LoRA: Low-rank adaptation large language models. ICLR, 2022.
[15] S. Hu, X. Liu, Y. Zhang, M. Li, L. Y. Zhang, H. Jin, and L.. Wu. Protecting Facial Privacy: Generating adversarial identity masks via style-robust makeup transfer. In CVPR, 2022.
[16] Z. Hu, Y.-m. Cheung, M. Li, and W. Lan. Cross-modal hashing method with properties of hamming space: A new perspective. TPAMI, 2024.
10

---

[17] X. Huang, K. C. Cheung, S. See, and R. Wan. Geometrysticker: Enabling ownership claim of recolorized neural radiance fields. ECCV, 2024.
[18] B. Kerbl, G. Kopanas, T. Leimküüller, and G. Drettakis. 3D gaussian splatting for real-time radiance field rendering. ACM Trans. on Graph., 2023.
[19] C. Li, B. Y. Feng. Z. Fan, P. Pan, and Z. Wang. StegaNeRF: Embedding invisible information within neural radiance fields. In ICCV, 2023.
[20] G. Li, S. Li, M. Li, X. Zhang, and Z. Qian. Steganography of steganographic networks. In AAAI, 2023.
[21] G. Li, S. Li, Z. Luo, Z. Qian, and X. Zhang, Purified and unified steganographic network. In CVPR, 2024.
[22] M. Li, Y.-M. Cheung, and Z. Hu. Key point sensitive loss for long-tailed visual recognition. TPAMI, 2022.
[23] C. Liang, X. Wu, Y. Hua, J. Zhang, Y. Xue, T. Song, Z. Xue, R. Ma, and H. Guan. Adversar- ial example does good: Preventing painting imitation from diffusion models via adversarial examples. In ICML, 2023.
[24] R. Liu, R. Wu, B. Van Hoorick, P. Tokmakov, S. Zakharov, and C. Vondrick. Zero-1-to-3: Zero-shot one image to 3D object. In ICCV, 2023.
[25] Z. Luo, Q. Guo, K. C. Cheung, See, and R. Wan. CopyRNeRF: Protecting the copyright of neural radiance fields. In ICCV, 2023.
[26] Z. Luo, S. Li, G. Li, Z. Qian, and X. Zhang. Securing fixed neural network steganography. In ACM MM, 2023.
[27] Z. Luo, B. Shi, H. Li, and R. Wan. Imaging interiors: An implicit solution electromagnetic inverse scattering problems. In ECCV, 2025.
[28] A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu. Towards deep learning models resistant to adversarial attacks. In ICLR, 2018.
[29] B. Mildenhall, P. P. Srinivasan, M. Tancik, J. T. Barron, R. Ramamoorthi, and R. Ng. NeRF: Representing scenes as neural radiance fields for view synthesis. In ECCV, 2020.
[30] Y. Mirsky and W. Lee. The creation and detection of deepfakes: A survey. ACM CSUR, 2021.
[31] W. K. Ong, K. W. Ng. C. S. Chan, Z. Song, and T. Xiang. IPR-NeRF: Ownership verification meets neural radiance field. arXiv:2401.09499
2024.
[32] A. Radford, J. W. Kim, C. Hallacy, A. Ramesh, G. Goh, S. Agarwal, G. Sastry, A. Askell,
Mishkin, J. Clark, et al. Learning transferable visual models from natural language supervision. In ICML, 2021.
[33] R. Rombach, A. Blattmann, D. Lorenz, P. Esser, and B. Ommer. High-resolution image synthesis with latent diffusion models. In CVPR, 2022.
[34] N. Ruiz, Y. Li, Jampani, Y. Pritch, M. Rubinstein, and K. Aberman. DreamBooth: Fine tuning text-to-image diffusion models for subject-driven generation. In CVPR, 2023.
[35] H. Salman, A. Khaddaj, G. Leclere, A. Ilyas, and A. Madry. Raising the cost of malicious ai-powered image editing. ICML, 2023.
[36] Seo, W. Jang, M.-S. Kwak, J. Ko, H. Kim, J. Kim, J.-H. Kim, Lee, and S. Kim. Let 2D diffusion model know 3D-consistency for robust text-to-3D generation. In ICLR, 2024.
[37] S. Shan, J. Cryan, E. Wenger, H. Zheng, R. Hanocka, and B. Y. Zhao. Glaze: Protecting artists from style mimicry by text-to-image models. In ACM SEC, 2023.
[38] S. Shan, Wenger, Zhang, H. Li, H. Zheng, and B. Zhao. Fawkes: Protecting privacy against unauthorized deep learning models. In ACM SEC, 2020.
11

---

[39] Q. Song, Z. Luo, K. C. Cheung, S. See, and R. Wan. Protecting NeRFs' copyright via plug-and and- play watermarking base model. In ECCV, 2024.
[40] Tang, Z. Chen, X. Chen, Wang, G. Zeng, and Liu. LGM: Large multi-view gaussian model for high-resolution 3d content creation. In ECCV, 2024.
[41] T. Van Le, H. Phung, T. H. Nguyen, Q. Dao, N. N. Tran, and A. Tran. Anti-DreamBooth: Protecting users from personalized text-to-image synthesis. In ICCV, 2023.
[42] R. Wang, Q. Guo, H. Li, and R. Wan. Event trojan: Asynchronous event-based backdoor attacks. In ECCV, 2024.
[43] R. Wang, Wan, Z. Guo, Q. Guo, and R. Huang. Spy-watermark: Robust invisible watermark- ing for backdoor attack. In ICASSP, 2024.
[44] Z. Wang, A. C. Bovik, H. R. Sheikh, and E. P. Simoncelli. Image Quality Assessment: From error visibility to structural similarity. TIP, 2004.
[45] T. Wu, Zhang, X. Fu, Y. Wang. J. Ren, L. Pan, W. Wu, L. Yang. J. Wang, C. Qian, D. Lin, and Z. Liu. OmniObject3D: Large-vocabulayy 3d object dataset for realistic perception, reconstruc- tion and generation. CVPR, 2023.
[46] Y. Wu, B. Y. Feng, and H. Huang. Shielding the Unseen: Privacy protection through poisoning nerf with spatial deformation. arXiv:2310.03125 2023.
[47] D. Xu, Y. Jiang, Wang, Z. Fan, Y. Wang, and Z. Wang. NeuralLift-360: Lifting an in-the-wild 2d photo to 3d object with 360deg views. In CVPR, 2023.
[48] J. Xu, X. Wang, Y.-P. Cao, W. Cheng, Y. Shan, and S. Gao. InstructP2P: Learning to edit 3d point clouds with text instructions. arXiv:2306.07155 2023.
[49] R. Zhang, P. Isola, A. A. Efros, E. Shechtman, and O. Wang. The unreasonable effectiveness of deep features perceptual metric. In CVPR, 2018.
[50] X. Zhang, R. Li. Yu, Y. Xu, W. Li, and Zhang. Editguard: Versatile image watermarking for tamper localization and copyright protection. In CVPR, 2024.
[51] J. Zhu, R. Kaplan, J. Johnson, and L. Fei-Fei. HiDDeN: Hiding data with deep networks. In ECCV, 2018
[52] Z.-X. Zou, Z. Yu, Y.-C. Guo, Y. Li, Liang, Y.P. Cao, and S.-H. Zhang. Triplane Meets Gaussian Splatting: Fast and generalizable single-view 3D reconstruction with transformers. In CVPR, 2024.
12

---

A Appendix supplemental material
A.1 Additional experimental results.
To better illustrate the effectiveness of our approach (geometry cloak w/o target and geometry cloak), we provide more qualitative experimental results of our geometry cloak.
Visual results of geometry cloak. As shown in Fig. SI and Fig. S2 geometry cloak w/o target can significantly alter the 3D model generated through TGS without affecting the original visual effect of the image. For the geometry cloak, we embed pre-defined patterns at the top view. As shown Fig. SS3 and Fig, [S4] the geometry cloaks are invisible to humans, and the embedded watermarks can be effectively observed from rendered views and reconstructed point clouds.
Extending LGM
As GS-based 3D scenes, our geometry cloak can also be extended to other GS based single-view to 3D methods [40]. Fig. and Table ST provide the qualitative and quantitative results when implementing our method on LGM 40) Fig. SS presents the reconstructed views and point cloud via LGM under different perturbating strategies. The reconstructed model is undermined and manipulated via our geometry cloak. In Table (ST, we experiment on three default scenes in L.GM and report the reconstructed results when applying Gaussian noise and our method to the input views. The results show that our method can effectively disturb the quality of the reconstructed 3D model.
18 method requires explicit geometry features to represent
Combining adv. tri-plane. Fig. S6 presents the visual results when combining perturbation on the tri-plane feature and geometry feature. Combining the two does not improve the attack performance, as the tri-plane feature is robust part of TGS that difficult disturb. Future work could focus on studying the components in the 3D reconstruction process that vulnerable to disturbances.
Perturbations with smaller/larger budget. Fig. S6 provide the visual results when employing smaller/larger budget. These two figures indicate that method is insensitive larger epsilon values, as high-intensity Gaussian noise struggles to disturb the geometric features of the reconstructed results.
Tendency of performance degradation. Fig. S7 illustrates the quality of the reconstructed 3D results under different epsilon intensities. An obvious decrease in reconstruction quality occurs within the 0 to intensity range.
Convergence status under different budgets. different budgets.
Fig. S8
presents the convergence status under
Quality of protected image. perturbation strategies.
Fig. $9 shows the quality of the protected image under different
Computational resources.
Fig.
S10 presents the time required to finish protection via our method.
Viewing direction. Fig. STT illustrates the visual results of embedding watermark at different angles and observing it from different perspectives.
Table S2 shows the metric results when embedding a watermark at different angles.
Multi-character as watermarks. Fig. the side view.
S12 presents the results when embedding multi-character as
Robustness against image compression. modified via common image operations.
Table S2 presents the results when the protected image is
13

---

Res. x10
Input image
Reconstructed views and point clouds
Original
10 iter
25 iter
50 iter
10 iter
25 iter
50 iter ==4
10 iter
25 Iter 8
50 iter é
Figure S1: Qualitative results of geometry cloak w/o target. We present the reconstructed views and corresponding point cloud at the front view, side view, and top view.
Table S1: Extending our geometry cloak to LGM 40
Reconstructed 3D model
Impact image quality
Scene
PSNRJ
LPIPS
CDt
PSNR
LPIPS
Anya Bird
27.97
0.0871
4.921
31.95
0.0711
Gau. noise
31.01
0.0889
3.506
29.59
0.0907
Catstatue
29.20
0.1084
1.430
29.79
0.1042
Anya
14.17
0.1676
60.52
31.84
0.0712
W/o target
Bird
16.02
0.1950
84.51
29.68
0,0946
Catstatue
14.65
0.2439
36.57
29.61
0.1007
Anya
14.04
0.2746
132.2
31.80
0.0721
Ours
Bird
15.11
0.2449
185.0
29.67
0.0971
Catstatue
14.60
0,3331
125.3
29.59
0.1039
14

---

Res. x10
Input image
Reconstructed views and point clouds
Original
10 iter
25 iter
50 iter =
10 iter
25 iter
50 iter
10 iter
25 iter
50 iter e
Figure S2: Qualitative results of geometry cloak w/o target. We present the reconstructed views and corresponding point cloud at the front view, side view, and top view.
Table S2: Quantitative results of the 3D reconstructed model derived from a compressed protected image and under various embedding directions.
Gous. noise
Brightness
Down-sample
JGPE
Embeediing direction
comp.
Top
PSNRL
11:05
10:97
11:21
12.92
14.72
19.12
18.73
20.13
14.71
15.4
14:37
13.02
SSIME
0,801
0,805
0.79%
0.788
0.810
0.367
0.862
0.861
0.307
0.808
0.797
0.762
CD
155.6
118.7
93.81
9.411
25.56
41.35
10.88
14.75
42.22
138.76
150.43
193.74
15

---

Pattern
Res. x10 Input image
Reconstructed views and point clouds
Original
9
9
2
2
C
X
X
X
K
K
Figure S3: Qualitative results of geometry cloak. We present the reconstructed views and correspond- ing point cloud at the front view, side view, and top view.
Pattern
Res. x10
Input image
Reconstructed views and point clouds
Original
4
4
4
1
1
1
A
A
D
D
D
E
E
E
Figure S4: Qualitative results of geometry cloak. We present the reconstructed views and correspond- ing point cloud at the front view, side view, and top view.
16

---

Geometry cloak target
Baseline
Rand. noise
Input Reconstructed views and point cloud
Input
Reconstructed point
The random noise barely affects the reconstructed results, while our method can effectively manipulate the reconstructed 3D model. Our method can work on LGM explicit geometry features are vulnerable for the GS-based framework (Please zoom for the best review).
Figure S5: Extending our geometry cloak to LGM 40
tri-plane
triplane
64
Combining adv. tri-plane
Ours w/ smaller budget
(c) Perturbation w/ larger budget
Figure S6: Visual results of different perturbation strategies. (a) Different attack strategy combina- tions. (b) The results of our method with smaller c. (c) The results of Gaussian noise with higher (Please zoom in for best review).
PSNR
40
1.00
30V. geometry
gonmetry
0.95
0.90
UFRS
20
0.05
0.80
+ afx geometry
10
Figure S7: Quality of 3D reconstructed results from protected images under different perturbation budget e.
50
30
10
2.0
80
80
100
120
140
160
180
200
Step
Figure S8: Convergence status under different values of budget c.
17

---

PSNR
SSIM
0.055
33.5
MD sageet
23.0
cufs
5.000
image
0.025
32.0
0.85
Figure 89: Quality of protected image under different perturbations strategy.
7e-3
3e-3
14.4
28.8
13.2
time sec
Figure S10: Convergence curve our method with different e values (green line = 2, gray line 4). Our method can complete the protection of images within 50 sec.
Top
Front
Side
Figure S11: Embedding messages at different view direction 6.
CV
NIPS
Input view
Front
Side (CV)
Input view
Front
Side (NIPS)
DHN
Input view
Front
Side (DNN)
Input view
Front
Side
CV)
Figure S12: Embedding multi-character as copyrighted messages within side views. Our method still
ensures identifiable watermark patterns.
18

---

NeurIPS Paper Checklist
The checklist is designed to encourage best practices for responsible machine learning research, addressing issues of reproducibility, transparency, research ethics, and societal impact. Do not remove the checklist: The papers not including the checklist will be desk rejected. The checklist should follow the references and follow the (optional) supplemental material. The checklist does NOT count towards the page limit.
Please read the checklist guidelines carefully for information on how to answer these questions. For each question in the checklist:
You should answer [Yes], [No], or [NA].
[NA] means either that the question is Not Applicable for that particular paper or the relevant information is Not Available.
Please provide short (1-2 sentence) justifiicton right after your answer (even for NA).
The checklist answers are an integral part of your paper submission. They are visible to the reviewers, area chairs, senior area chairs, and ethics reviewers. You will be asked to also include (after eventual revisions) with the final version of your paper, and its final version will be published with the paper.
The reviewers of your paper will be asked to use the checklist as one of the factors in their evaluation.
While "[Yes] " is generally preferable to "[No]", ", it is perfectly acceptable to answer "[No] provided proper justification is given (e.g., "error bars are not reported because it would be too computationally expensive" or "we were unable to find the license for the dataset we used"). In general, answering "[No] or "[NA] is not grounds for rejection. While the questions are phrased in binary way, we acknowledge that the true answer often more nuanced, so please just use your best judgment and write justification to elaborate. All supporting evidence can appear either in the main paper or the supplemental material, provided in appendix. If you answer [Yes] to a question, in the justification please point to the section(s) where related material for the question can be found.
IMPORTANT, please:
Delete this instruction block, but keep the section heading "NeurIPS paper checklist",
Keep the checklist subsection headings, questions/answers and guidelines below.
Do not modify the questions and only use the provided macros for your answers.
Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: The main claims made in the abstract and introduction accurately reflect the paper's contributions and scope.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made the paper and important assumptions and limitations. A No or
NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
It is fine to include aspirational goals as motivation as long as it is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors? Answer: [Yes]
19

---

Justification:
The paper discusses the limitations of our work.
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification. asymptotic approxinations only holding locally). The authors should reflect how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g. if the approach was only tested on a few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low images are taken in low lighting. Or speech-to-text system might be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't 't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory Assumptions and Proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer:
[NA]
Justification: the paper does not include theoretical results.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental Result Reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that affects the main claims and/or conclusions of the paper (regardless whether the code and data are provided or not)?
Answer: [Yes]
Justification: The paper discloses all the information needed to reproduce the main experi- mental results of the paper.
Guidelines:
20

---

The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how replicate the results, access to a hosted model (e.g., in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) the contribution is primarily a new algorithm, the paper should make clear how reproduce that algorithm. (b) If the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) If the contribution is a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source source dataset instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors welcome deseribe the particular way they provide for reproducibilityy In the case of closed-source models, it may be that access to the model is limited in some way (e.g., registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
Answer: [Yes]
Justification:
The main codes provided in supplemental material.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (https://nips... cc/
stweeesuubmssiioooooocco for more details.
While we encourage the release of code and data, we understand that this might not be possible, "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for a new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurlPS code and data submission guidelines (https ctiips.cc/public//uue
CodeeSumiiii wettsbbmmssiiioi ssionPolicy for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
21

---

Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental Setting/Details
Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Question:
Answer: [Yes]
Justification: The paper specifies all the training and test details.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented the core the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, supplemental material.
7. Experiment Statistical Significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer: [NA]
Justification:
The experiment metrics are calculated on large-scale images and point clouds.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results accompanied by error bars, confi- dence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g.. Normally distributed errors).
It should be clear whether the error bar is the standard deviation or the standard error of the mean.
OK to report 1-sigma error bars, but one should state The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that out of range (e.g. negative error rates).
If error bars reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables the text.
8. Experiments Compute Resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification:
The paper provides sufficient information on the computer resources.
Guidelines:
The answer NA means that the paper does include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
22

---

The paper should provide the amount of compute required for each of the individual experimental runs as well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make into the paper).
9. Code Of Ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics http:////aaarppssscpcbp/btt//bta
Answer: [Yes]
Justification:
The research conducted in the paper conforms the NeurIPS Code of Ethics.
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., there a special consid- eration due to laws regulations in their jurisdiction).
10. Broader Impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
The paper discusses potential positive societal impacts and negative societal impacts.
Justification:
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has socictal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA] [TODO]
Justification: Not applicable work is not relevant.
Guidelines:
23

---

The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Question: Are the creators or original owners of assets (e.g.. code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification: Proper credit given to the creators or original owners of assets used in the paper, and the license and terms of use are explicitly mentioned and respected.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name of license (e. CC-BY 4.0) should included for each asset. For scraped data from a particular source (c.g.. website), the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of in the package should be provided. For popular datasets, paperssiiipssiiiiaea... phcerssithcode thcode. com datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of derived asset (if has changed) should be provided. this information is not available online, the authors are encouraged to reach out to the asset's 's creators.
13. New Assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Justification:
The answer NA means that the paper does not release new assets.
Guidelines:
The answer NA means that the paper does not release assets.
Researchers should communicate the details the dataset/code/moodll as part their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset is used.
At submission time, remember anonymize your assets (if applicable). You either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and Research with Human Subjects
For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Question:
Answer: [NA]

---

Justification:
Not related.
Guidelines:
The answer NA means that the paper does not involve crowdsoureing nor research with
human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included the main paper.
According to the NeurIPS Code of Ethics, workers involved data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: The paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsoureing nor research with human subjects.
Depending the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such the institution conducting the review.
25


Reviews:
[{"review_id": "5fNCdIrnip", "reviewer": "Reviewer_kd52", "summary": "This paper presents a method for copyrights in 3D reconstruction, specifically targeting novel-view synthesis, rather than traditional 2D images. Recently, advancements in 3D reconstruction have been driven by neural radiance fields (NeRFs) and 3D Gaussian splatting (3D GS), both of which maintain 3D consistency. These methods primarily focus on learning RGB values from multiple posed images. Notably, recent developments have shown that single-view 3D reconstruction can be achieved with the support of pre-trained diffusion-based generative models.\n\nUnlike 2D images, privacy preservation in 3D reconstruction has received less attention due to its recent development. This paper introduces a geometry cloak that perturbs 3D point cloud representations instead of 2D images. This perturbation prevents 3D reconstruction from 2D posed images without degrading the visual quality of the 2D images.\n\nThe technique is particularly supportive of 3D GS, enabling real-time novel-view synthesis, a capability not supported by existing NeRFs. To the best of our knowledge, this paper is the first to propose an adversarial attack to preserve copyright in 3D GS from a 3D reconstruction perspective.", "questions": "1. Could you show the slope of performance deviation when $\\epsilon$ is less than 2? When $\\epsilon = \\{0, 1\\}$, does the proposed method also exhibit a negative slope of performance in terms of PSNR, SSIM, and LPIPS?\n\n2. Could you show the performance degradation of random noise when $\\epsilon$ increases beyond 8? It should demonstrate that the proposed approach is more beneficial under strong perturbation. While $\\epsilon=8$ indicates color disturbance, the context and shape in the 2D images do not change.\n\n3. Could you present the ablation study on the influences of PGD?", "limitations": "Please refer to weakness.", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "1. This paper addresses contemporary issues regarding copyright protection in 3D reconstruction. Utilizing the framework of Tri-Plane Gaussian Splatting (TGS), which encodes posed images into tri-plane representations and 3D point clouds before generating 3D Gaussian splatting, the paper proposes a novel perturbation method. This method degrades the quality of 3D geometry without affecting the visual quality of 2D images.\n\n2. This demonstrates that the proposed perturbation method significantly impacts the performance of 3D reconstruction, regardless of the degree of perturbation, unlike simple noise injections. It also shows that this method is robust and not sensitive to hyper-parameter variations.", "weaknesses": "1. This paper heavily relies on the prior work of Tri-Plane Gaussian Splatting (TGS), which explicitly represents 3D point clouds to enhance geometric properties and employs tri-plane representation to encode 3D Gaussians. Without leveraging TGS, this study would not effectively address copyright issues in 3D reconstruction. This dependency indicates that the proposed approach is not applicable to a wide range of novel-view synthesis techniques, highlighting a limitation in its generalizability.\n\n2.  While this paper demonstrates that the proposed method is insensitive to the degree of perturbation, it does not adequately explain this phenomenon in the context of privacy preservation. In the past, understanding the tendency of performance degradation is crucial and be well-explained through probabilistic analysis for the extent of perturbation. However, the experimental results presented in this paper do not support this concept.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Dear reviewer, \n\nWe express our gratitude for your recognition and valuable suggestions.\n\n\n**Response to W1: Extending to other methods**\n\nOur method is designed to utilize the explicit geometry feature in GS-based single views to 3D methods, which is fragile and susceptible to disturbances in the reconstruction process. Thus, our method can work on various GS-based single views to 3D methods as the explicit geometry feature is a necessary element for 3DGS. Before our submission, other GS-based single images to 3D methods were not formally peer-reviewed.  While we primarily focus on TGS as it is peer-reviewed during our research, our approach can be extended to other recent methods. To illustrate this, we evaluate our technique on the recently proposed LGM [1], accepted by ECCV 2024.  The results are appended in Fig. R1 and Tab. R1 of the rebuttal page. By simply adapting key design elements, our approach shows promising results on LGM as well, underscoring its potential in manipulating other GS-based single-image-to-3D reconstruction methods.\n\n\n\n\n\n**Response to W2:  Tendency of performance degradation**\n\nWe are very grateful for you pointing out this phenomenon.  \n\nTab.1 in the main paper aims to demonstrate that even with larger budgets,  other perturbation methods (Gaussian noise and adv. image features)  still do not effectively undermine the reconstruction results.  To understand the tendency of perturbation, we provide more experimental results under a wider range of budget $\\epsilon$.\n\n| $\\epsilon$ | PSNR$\\downarrow$  | SSIM$\\downarrow$   | LPIPS$\\uparrow$ |\n| ---------- | ----- | ------ | ----- |\n| 0.5        | 24.00 | 0.9147 | 0.065 |\n| 0.8        | 20.14 | 0.8711 | 0.102 |\n| 1.0        | 16.64 | 0.8337 | 0.151 |\n| 1.5        | 14.89 | 0.8124 | 0.183 |\n| 2.0        | 13.80 | 0.7996 | 0.198 |\n| 4.0        | 11.71 | 0.7918 | 0.214 |\n| 8.0        | 11.23 | 0.7935 | 0.216 |\n| 16.0       | 11.20 | 0.7914 | 0.218 |\n\nBesides this, we provide visual results of perturbed results in Fig. R2 (b-c) and curves for different  $\\epsilon$  in Fig. R3 of the rebuttal page.   \n\nThe experimental results reveal a sensitivity to smaller budget $\\epsilon$ (<2) values, while larger budget $\\epsilon$ (>2) values demonstrate insensitivity due to the already severe disruptive effects.  We recognize and thank your suggestions that understanding the tendency of performance degradation is crucial; these results will be extended to the next version of our paper.\n\n\n**Response to  Q1:  Slope of performance deviation**\n\nWe provide the slope of performance deviation in Fig. R2 of the rebuttal page, which also exhibits a negative performance slope. \n\n\n**Response to  Q2: Results under stronger perturbation**\n\nWe provide visual results when a random noise ($\\epsilon$ =16, 32) is applied in Fig R2 (c)  of the rebuttal page.  Even with this larger budget $\\epsilon$, The geometry pattern of the reconstructed 3D model has no obvious change.  This indicates that the process of obtaining geometry features through TGS is robust to noise. We will incorporate these results into our paper.\n\nOur method shows unobvious changes in disturbance results after $\\epsilon$ > 4 (as discussed in W1). We present the performance slope in Fig. R3  of the rebuttal page.   \n\n\n**Response to Q3: Ablation study of PGD**\n\nWe demonstrate the convergence of loss under different values of epsilon in PGD (Fig. R3). We also provide the results of PGD attacks from different perspectives (Fig. R5 and Tab. R1) and multiple characters as watermarks (Fig. R5) on the rebuttal page. We look forward to discussing with you in the upcoming discussion phase to clarify things we may neglect.\n\n[1] LGM: Large Multi-View Gaussian Model for High-Resolution 3D Content Creation. In ECCV 2024.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "cL1dc4G2O9", "reviewer": "Reviewer_ykxU", "summary": "The paper introduces a novel image protection approach called \"Geometry Cloak\" to prevent unauthorized 3D model generation from copyrighted images using single-view 3D reconstruction methods like Triplane Gaussian Splatting (TGS). The Geometry Cloak embeds invisible geometry perturbations into images, which are revealed as a customized message when TGS attempts 3D reconstructions, thus acting as a watermark for copyright assertion.", "questions": "Please refer to the weakness.", "limitations": "The authors have clearly presented their limitations.", "rating": 8, "confidence": 5, "soundness": 4, "presentation": 4, "contribution": 4, "strengths": "1. This paper raises a novel question, namely how to protect the copyright in the process of image to 3D, which is very meaningful.\n2. The presentation of this paper is very clear and easy to understand.\n3. A view-specific PGD strategy is proposed to optimize geometry cloak, which is simple but effective.\n4. The authors conduct experiments on two 3D datasets and various types of patterns, and verify the effectiveness of the experimental results via sufficient ablation experiments and visualization results.", "weaknesses": "1. Can the proposed method be extended to other image to 3D models, such as LRM [1], LGM [2]? The author could introduce the advantages of using TGS instead of other image to 3D models in terms of generation speed and quality, so that the readers can better understand its task scenario. \n\n[1] Lrm: Large reconstruction model for single image to 3d. In ICLR 2024.\n\n[2] Large multi-view gaussian model. In ECCV 2024.\n\n2. The robustness of the proposed method should be verified. For example, when Gaussian noise and JPEG compression are added to the protected image, can it still resist illegal theft?", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Dear reviewer,\n\nThank you for your recognition and valuable suggestions.\n\n**Response to W1: Extending to other methods**\n\nOur method is designed to utilize the explicit geometry feature in GS-based single views to 3D methods, which is fragile and susceptible to disturbances in the reconstruction process. Thus, our method can work on various GS-based single views to 3D methods as the explicit geometry feature is a necessary element for 3DGS. Before our submission, other GS-based single images to 3D methods were not formally peer-reviewed. While we primarily focus on TGS as it is peer-reviewed during our research, our approach can be extended to other recent methods. To illustrate this, we evaluate our technique on the recently proposed LGM [1], accepted by ECCV 2024. The results are appended in Fig. R1 and Tab. R1 of the rebuttal page. By simply adapting key design elements, our approach shows promising results on LGM as well, underscoring its potential in manipulating other GS-based single-image-to-3D reconstruction methods. For NeRF-based methods like LRM [2],  our work could inspire more research to study the vulnerability layers in these frameworks.\n\n\nTGS combines explicit geometry features and implicit tri-plane representations to achieve accurate and detailed reconstructions, representing a cutting-edge approach to 3D object reconstruction from **single-view images**. Before our submission, LGM had not been officially peer-reviewed. Thus, we choose TGS as our experiment subject to verify the effectiveness of the geometry cloak.  However, this does not affect the generality of our approach in GS-based methods. As discussed in the paper, GS-based methods require explicit geometric features to represent 3D models. The process of obtaining this geometric feature is easily manipulable with proper adversarial perturbations. We will extend the experimental results in LGM to our paper to further clarify the effectiveness of the geometry cloak.\n\n\n\n **Response to W2: Robustness against image compression**\n\nTo verify the robustness of our method, we experiment with some common image operations, including Gaussian noise, JPEG, etc. Under mild operations, the geometry cloak cannot be removed, and the geometric features of the generated 3D result are still disturbed. With higher operations, the geometry cloak can be affected. However, the quality of the view image has been severely compromised, leading to poor visual effects in the reconstructed results, making these protected images unusable.\n\n|  | no. Comp. | Noise |  |  | JPEG |  |\n|:---:|:---:|:---:|:---:|:---:|:---:|:---:|\n|  | - | 5.0 | 10.0 |  | 60 |  90 |\n| PSNR $\\downarrow$ | 11.05 | 10.97 | 11.21 |  | 20.13 | 14.71 |\n| SSIM $\\downarrow$ | 0.804 | 0.806 | 0.798 |  | 0.861 | 0.807 |\n| LPIPS $\\uparrow$ | 0.194 | 0.194 | 0.197 |  | 0.111 | 0.158 |\n| CD $\\uparrow$ | 155.6 | 118.7 | 93.81 |  | 14.75 | 42.22 |\n\nWe present more results about robustness against common image operations in Tab. R1 of the rebuttal page.\n\n\n[1] LGM: Large Multi-View Gaussian Model for High-Resolution 3D Content Creation. In ECCV 2024.\n\n[2] LRM: Large reconstruction model for single image to 3d. In ICLR 2024.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "QLZINvbLkD", "reviewer": "Reviewer_inRn", "summary": "The paper introduces a novel approach to protect copyrighted images from unauthorized 3D reconstructions using Triplane Gaussian Splatting (TGS). The method involves embedding invisible geometry perturbations, termed \"geometry cloaks,\" into images. These cloaks cause TGS to fail in a specific way, generating a recognizable watermark, thus protecting the original content.", "questions": "See Weaknesses", "limitations": "Mentioned in the manuscript.", "rating": 7, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The concept of protecting images against unauthorized 3D reconstruction using geometric perturbations is novel.\n2. This paper is well-detailed and well-written.", "weaknesses": "1. The approach is tailored specifically to TGS-based 3D reconstruction. Can the geometry cloak technique be adapted or extended to protect against other 3D reconstruction methods beyond TGS?\n2. What are the potential impacts on image quality for legitimate uses when these cloaks are applied?\n3. The optimization process for generating geometry cloaks might introduce significant computational overhead, which is not thoroughly discussed in the paper.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Dear reviewer, \n\nThank you for your recognition and valuable suggestions.\n\n**Response to W1: Extending to other methods**\n\nOur method is designed to utilize the explicit geometry feature in GS-based single views to 3D methods, which is fragile and susceptible to disturbances in the reconstruction process. Thus, our method can work on various GS-based single views to 3D methods as the explicit geometry feature is a necessary element for 3DGS. Before our submission, other GS-based single images to 3D methods were not formally peer-reviewed. While we primarily focus on TGS as it is peer-reviewed during our research, our approach can be extended to other recent methods. To illustrate this, we evaluate our technique on the recently proposed LGM [1], accepted by ECCV 2024. The results are appended in Fig. R1 and Tab. R1 of the rebuttal page. By simply adapting key design elements, our approach shows promising results on LGM as well, underscoring its potential in manipulating other GS-based single-image-to-3D reconstruction methods.\n\n\n**Response to W2: Impact on image quality**\n\nOur geometry cloak is designed to be invisible so legitimate users can have visually consistent results with the original image quality.  All perturbations are controlled within a certain budget $\\epsilon$. Hence, we neglect to provide the impact on image quality.   For a more comprehensive evaluation of the method's impact on image quality, we provide quantitative metrics of the similarity between protected and unprotected images as below:\n\n|                 | $\\epsilon$ | PSNR$\\uparrow$  | SSIM$\\uparrow$   | LPIPS$\\downarrow$   |\n|-----------------|-----|-------|--------|---------|\n| Ours                | 2   | 34.28 | 0.9779 | 0.0220  |\n|            | 4   | 34.14 | 0.9758 | 0.0223  |\n|                 | 8   | 33.57 | 0.9668 | 0.0256  |\n|Ours w/o target                | 2   | 33.85 | 0.9717 | 0.0337  |\n|  | 4   | 33.71 | 0.9695 | 0.0352  |\n|                 | 8   | 33.37 | 0.9631 | 0.0337  |\n| Adv. image               | 2   | 32.32 | 0.9558 | 0.0361  |\n|     | 4   | 32.25 | 0.9544 | 0.0354  |\n|                 | 8   | 31.86 | 0.9475 | 0.0383  |\n\nCompared to previous methods of adversarial attacks on image features, our proposed geometry cloak ensures higher invisibility while effectively disturbing the reconstruction results. Besides TGS,  our method yields consistent invisible results in LGM[1], demonstrating the generality and concealment of our method (as shown in Tab. R1 of the rebuttal page).\n\n\n**Response to W3: Computational resources**\n\nOur method only optimizes the invisible cloak, which does not require a lot of computational resources (~8GB GPU memory). We provide the convergence curve of the loss during the optimization process on the rebuttal page.  In less than 50 secs, with a single V100 GPU, we can achieve protection for each image. The computational resources will be incorporated in the next version of our paper.\n\n\n[1] LGM: Large Multi-View Gaussian Model for High-Resolution 3D Content Creation. In ECCV 2024.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "JRYupvqWBv", "reviewer": "Reviewer_rPf4", "summary": "This paper proposes a novel method to protect copyrighted images from unauthorized 3D reconstruction using Triplane Gaussian Splatting (TGS). This topic is very interesting and highly valuable for preventing the misuse of copyrighted images. Their proposed method achieves protection by incorporating invisible geometry perturbations into the image, which is easy to deploy with less cost. The extensive experimental results have demonstrated the effectiveness of their approach in preventing unauthorized 3D reconstructions while embedding a verifiable pattern. This paper can provide a contribution to addressing the growing issue of image abuse and raise the community's attention to this issue.", "questions": "Please see the weakness.", "limitations": "The authors have adequately addressed the limitations", "rating": 7, "confidence": 4, "soundness": 3, "presentation": 4, "contribution": 4, "strengths": "1. The motivation of this paper is well-stated and significant, and the paper is well-written. The idea of using geometry cloaks to protect images from unauthorized 3D reconstruction is novel. This paper is an attempt to address the issue of image abuse in 3D reconstruction. Such an issue has not received sufficient attention, but it is very important, especially when 3D reconstruction technologies are becoming more accessible. This paper can also raise the community's awareness of this issue.\n\n2. Besides significantly distorting the 3D reconstruction from the protected images, the idea of embedding identifiable patterns into output renderings is interesting. This allows the image owners to determine whether the generated 3D models have used their copyrighted images. This traceability property can enhance the practicality of the method for digital copyright protection.\n\n3. The paper provides extensive experimental results, validating the effectiveness of the proposed approach across different datasets and perturbation strategies. This thorough evaluation helps in building confidence in the robustness and reliability of the proposed method. The approach is scalable and can be applied to a wide range of images without requiring significant computational resources. This enables artists and content creators to safeguard from being misused illegally.", "weaknesses": "1. The paper lacks quantitative metrics comparing the similarity between protected and unprotected images, such as PSNR, which would provide a more comprehensive evaluation of the method's impact on image quality.\n\n2. The importance of the view-specific PGD angle has not been thoroughly explored. It would be beneficial to investigate whether the method is effective from different angles, not just the top view. Besides, the effectiveness of combined attacks on point cloud and triplane latent features should be explored to determine if they provide better protection.\n\n3. Minor Issues: \n    a). Add a period at the end of \"Quantitative comparison of perturbation strategies\" in the Table 1 caption.\n    b). Replace \"no perturbation\" with \"not perturbed\" (L255 P7).\n    c). Correct the citation format \"et al\" to \"et al.\" (L95 P3).", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Dear reviewer, \n\nThank you for your recognize and valuable suggestions. \n\n**Response to W1: Impact on image quality**\n\nOur geometry cloak is designed to be invisible so legitimate users can have visually consistent results with the original image quality.  All perturbations are controlled within a certain budget $\\epsilon$. Hence, we neglect to provide the impact on image quality.   For a more comprehensive evaluation of the method's impact on image quality, we provide quantitative metrics of the similarity between protected and unprotected images as below:\n\n|                 | $\\epsilon$ | PSNR$\\uparrow$  | SSIM$\\uparrow$   | LPIPS$\\downarrow$   |\n|-----------------|-----|-------|--------|---------|\n|Ours                 | 2   | 34.28 | 0.9779 | 0.0220  |\n|             | 4   | 34.14 | 0.9758 | 0.0223  |\n|                 | 8   | 33.57 | 0.9668 | 0.0256  |\n|Ours w/o target                 | 2   | 33.85 | 0.9717 | 0.0337  |\n|  | 4   | 33.71 | 0.9695 | 0.0352  |\n|                 | 8   | 33.37 | 0.9631 | 0.0337  |\n| Adv. image                | 2   | 32.32 | 0.9558 | 0.0361  |\n|     | 4   | 32.25 | 0.9544 | 0.0354  |\n|                 | 8   | 31.86 | 0.9475 | 0.0383  |\n\nCompared to previous methods of adversarial attacks on image features, our proposed geometry cloak ensures higher invisibility while effectively disturbing the reconstruction results. Besides TGS, our method also keeps the invisibility for LGM[1], as shown in Tab. R1 of the rebuttal page.\n\n\n**Response to  W2: Viewing direction and Adv. triplane**\n\n(View-specific PGD) We conduct experiments from other perspectives (side/front). The experimental results indicate that the reconstructed results can still be effectively manipulated from these perspectives, demonstrating the effectiveness of our method. We also provide results of embedding multiple letters further to demonstrate the view-specific PGD performance (Fig. R5 and Tab. R1).\n\n| | Front  | Side   | Top    |\n|----------------------------|--------|--------|--------|\n| PSNR $\\downarrow$          | 15.4   | 14.37  | 13.02  |\n| SSIM $\\downarrow$          | 0.808  | 0.797  | 0.762  |\n| LPIPS $\\uparrow$           | 0.170  | 0.172  | 0.213  |\n| CD $\\uparrow$              | 138.76 | 150.43 | 193.74 |\n\n(Effectiveness of  point cloud  + triplane latent features )  Following your suggestions, we conduct experiments by combining attacking point cloud and triplane latent features. The results in Fig. R2 (a) indicate that attacking only the tri-plane will affect the visual quality of the reconstruction. There is no significant change after combining attacks on the point cloud. Future work could focus on studying the components in the 3D reconstruction process that are vulnerable to disturbances.\n\n\n**Response to W3: Minor Issues**\n\nWe appreciate you pointing out these typos. These typos in our paper will be carefully corrected in the next version of our paper. \n\n\n[1]  LGM: Large Multi-View Gaussian Model for High-Resolution 3D Content Creation. in ECCV 2024.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "xkRbKSjOOp", "reviewer": "Reviewer_u5Eb", "summary": "This paper proposed a new image cloaking approach, which adds adversarial noise on single-view image and makes TGS-based 3D reconstruction fail. This can be served as a watermark for protecting copyright image assets.", "questions": "1. How to specify the observation viewing direction? Is it arbitrarily selected?  How will the specified viewing direction affect reconstruction effects? (e.g. when the observation viewing direction is not good, will the algorithm fail?)\n\n2. The example images shown in the paper use only one character or number for pre-defined patterns. If the watermark information is more complexed and needs multiple characters / numbers, how will the results be like?\n\n3. Regarding weakness, can you discuss how this method can generalize to other single image to 3D reconstruction algorithms?  Is there any more generalized way to do watermarking/cloaking ?\n\n4. In method description, the authors mentioned they use \"a mask version of PGD\", but details on how to generate the mask is not given in the text.", "limitations": "The author has discussed the social impacts. Overall this is a work for copyright protection, which does not have direct negative social impacts.", "rating": 3, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 1, "strengths": "The topic is popular and needs more investigation by the community. The paper writing is clear.", "weaknesses": "1. The main weakness lies in the scope of this work is too limited. The motivation is to protect copyright images from unauthorized 3D reconstruction, however the work only targets at TGS-based reconstruction, which is too limited to have practical effects. I suggest the authors should at least do experiments on other single image 3D reconstruction works, for example LRM[1], Gamba[2] or LGM[3]. This work shows fair results on TGS, but TGS itself is not representative among 3D reconstruction works, and does not yield the best single image 3D reconstruction results.  In practice, we cannot assume unauthorized users will use which image-to-3D model, so it only makes sense when the watermarking / cloaking technique can effectively generalize to shield all those image-to-3D reconstruction algorithms.\n\n2. Some typos.\nLine 138, \"preventing copyrighted\"?\n\n\nReference\n[1] LRM: Large Reconstruction Model for Single Image to 3D. ICLR 2024\n[2] Gamba: Marry Gaussian Splatting with Mamba. https://arxiv.org/abs/2403.18795\n[3] LGM: Large Multi-View Gaussian Model for High-Resolution 3D Content Creation. https://arxiv.org/abs/2402.05054", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Dear reviewer,\n\nThank you for your valuable feedback and suggestions.\n\n**Response to W1: Extending to other methods**\n\n\nOur method is designed to utilize the explicit geometry feature in GS-based single views to 3D methods, which is fragile and susceptible to disturbances in the reconstruction process. Thus, our method can work on various GS-based single views to 3D methods as the explicit geometry feature is a necessary element for 3DGS. Before our submission, other GS-based single images to 3D methods were not formally peer-reviewed. While we primarily focus on TGS as it is peer-reviewed during our research, our approach can be extended to other recent methods. To illustrate this, we evaluate our technique on the recently proposed LGM [1], accepted by ECCV 2024. The results are appended in Fig. R1 and Tab. R1 of the rebuttal page. By simply adapting key design elements, our approach shows promising results on LGM as well, underscoring its potential in manipulating other GS-based single-image-to-3D reconstruction methods.\n\n\n\n**Response to W2: Typos**\n\nWe appreciate you pointing out these typos. The typos in our paper will be carefully corrected.\n\n**Response to Q1: Observation viewing direction**\n\n1. In the paper, we present the results from the top view.  In theory, our method can be applied to arbitrarily selected viewing directions. The algorithm will not fail because we are simply mapping the projected point cloud at direction θ, then using this projected point cloud to present the watermark.  We present the results of embedding watermarks at different views in Fig. R5 and Tab. R1 (right). The experimental results indicate that our method can work well when embedding watermarks in different directions. \n\n2. Our watermarks are embedded at a certain location, which is sufficient for copyright verification of **3D** models. As provided visual results of the watermark from a certain angle from Fig. R5 (Left), viewing the 3D model from other unsuitable perspectives will result in low-quality fragmented information. Besides, to verify copyright, users can verify from any angle, as long as it is identitable and consistent with the pre-embedded watermarks that can be matched.   We will incorporate these results in our next version for better clarification of the property of the geometry cloak. \n\n|                   | Front  | Side   | Top    |\n| ----------------- | ------ | ------ | ------ |\n| PSNR $\\downarrow$ | 15.4   | 14.37  | 13.02  |\n| SSIM $\\downarrow$ | 0.808  | 0.797  | 0.762  |\n| LPIPS $\\uparrow$  | 0.170  | 0.172  | 0.213  |\n| CD $\\uparrow$     | 138.76 | 150.43 | 193.74 |\n\n\n**Response to Q2: Multiple characters**\n\n1. Although the geometry cloak was not specifically designed for multiple characters, our method can still ensure identifiable results when the watermarks are multiple characters. We provide visual results in Fig. R5 (left), which remain promising when there are fewer than four characters.  This suggests that the geometry cloak holds promising potential regarding watermark capacity.\n\n\n\n2. Besides, compared to previous methods of image cloaking [2,3] against the diffusion model, which can only use artist-style as watermarks, the watermarks embedded via our method are much more identifiable.\n\n\n**Response to Q3: Generalized way to do watermarking/cloaking**\n\n1. We have discussed how our method can be generalized to other single image to 3D reconstruction algorithms in response to  W1. Preliminary experimental results on LGM [1] are provided in Fig. R1 and Tab. R1, indicating our method is promising in manipulating other GS-based single-image-to-3D reconstruction methods.\n\n2. To the best of our knowledge, this is the first paper to reveal a vulnerability in the GS-based 3D reconstruction and effectively manipulate the generated results using this vulnerability.   The results generated via GS-based methods can be manipulated through adversarial attacks on geometric features, which is an issue worthy of attention as 3DGS are rather popular today.  More studies should be conducted to protect image/model owners' copyrights and prevent potential malicious attackers.   Our method provides a novel perspective on adversarial perturbations, enabling copyrighted images to prevent misuse by GS-based methods. which could potentially encourage related research in enhancing the robustness of 3D reconstruction and addressing AI privacy/safety issues. \n\n\n**Response to Q4: Details of obtaining masks**\n\nWe used SAM to obtain a segmentation of the images to ensure that the perturbations were only added to the objects. We will provide a detailed generation process in our next version of the paper, and experimental codes of geometry cloak will be released to ensure reproducibility.\n\nWe look forward to discussing with you in the upcoming discussion phase to clarify things we may neglect.\n\n\n[1] LGM: Large Multi-View Gaussian Model for High-Resolution 3D Content Creation. In ECCV 2024.\n\n[2] Adversarial Example Does Good: Preventing Painting Imitation from Diffusion Models via Adversarial Examples. In ICML 2024.\n\n[3] Glaze: Protecting Artists from Style Mimicry by Text-to-Image Models. In USENIX 2023.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:
Dear reviewers,

We would like to thank all the reviewers for their time and for writing thoughtful reviews of our work.

In this work, we introduce the geometry cloak, which can effectively manipulate the process of 3DGS-based single-image to 3D methods by adding invisible perturbation. We reveal that the explicit geometric features are vulnerable components in the reconstruction process.  Our geometry cloak can work on various methods like LGM[1], as 3DGS requires explicit geometry features for 3D representation. By exploiting this vulnerability, we can effectively manipulate the reconstructed 3D results, which is a noteworthy issue given the popularity of 3DGS today. Our approach offers a fresh viewpoint on adversarial perturbations, preventing copyrighted images from being used by GS-based methods. This could potentially stimulate further research into improving the resilience of 3D reconstruction and addressing AI privacy concerns.

To further clarify our work, we have provided more experimental results on the rebuttal page.

**1. Extending to other methods**

Fig. R1 and Tab. R1 provide the qualitative and quantitative results when implementing our method on LGM [1]. 
Fig. R1 presents the reconstructed views and point cloud via LGM under different perturbating strategies. The reconstructed 3D model is undermined and manipulated via our geometry cloak.
In Tab. R1, we experiment on three default scenes in LGM and report the reconstructed results when applying Gaussian noise and our method to the input views.  The results show that our method can effectively disturb the quality of the reconstructed 3D model.

**2. Combining adv. tri-plane**

Fig. R2 (a) presents the visual results when combining perturbation on the tri-plane feature and geometry feature.  Combining the two does not improve the attack performance, as the tri-plane feature is a robust part of TGS that is difficult to disturb. Future work could focus on studying the components in the 3D reconstruction process that are vulnerable to disturbances.

**3. Perturbations with smaller/larger budget**

Fig. R2 (b-c) provide the visual results when employing a smaller/larger budget $\epsilon$. These two figures indicate that our method is insensitive to larger epsilon values, as high-intensity Gaussian noise struggles to disturb the geometric features of the reconstructed results.

**4. Tendency of performance degradation**

Fig. R3 (1-3) illustrate the quality of the reconstructed 3D results under different epsilon intensities. An obvious decrease in reconstruction quality occurs within the 0 to 4 intensity range.

**5. Convergence status under different budget**

Fig. R3 (4) presents the convergence status under different budgets.


**6. Quality of protected image**

Fig. R4 (1-3) shows the quality of the protected image under different perturbation strategies.

**7. Computational resources**

Fig. R4 (4) presents the time required to finish protection via our method.

**8. Viewing direction**

Fig. R5 (left) illustrates the visual results of embedding a watermark at different angles and observing it from different perspectives.

Tab. R1 (right) shows the metric results when embedding a watermark at different angles.

**9. Multi-character as watermarks**

Fig. R5 (right) presents the results when embedding multi-character as the side view.

**10. Robustness against image compression**

Tab. R1 (right) presents the results when the protected image is modified via common image operations.


[1] LGM: Large Multi-View Gaussian Model for High-Resolution 3D Content Creation. In ECCV 2024.

Meta-review: The paper introduces Geometry Cloak, a method to protect copyrighted images from unauthorized 3D reconstruction using Triplane Gaussian Splatting (TGS). Reviewer kd52 appreciates the novel perturbation technique that degrades 3D geometry without affecting 2D image quality but notes its limited applicability beyond TGS. Reviewer ykxU commends the clear presentation and effectiveness, suggesting extensions to other models like LRM and LGM, and testing robustness under noise and compression. Reviewer inRn acknowledges the novelty but questions adaptability to other methods and potential impacts on legitimate image use. Reviewer rPf4 recognized the significance and thorough experiments but recommends adding quantitative metrics like PSNR. Reviewer u5Eb criticizes the limited scope, urging tests on additional reconstruction methods for broader practical effects.

The rebuttals clarifies the geometry cloak method extends beyond TGS to other 3D reconstruction methods like LGM, as these rely on explicit geometric features. They provide additional experiments demonstrating the method's effectiveness across various settings, addressing concerns about generalizability, robustness, computational resources, and impact on image quality. Overall the reviewers welcomed the changes except u5Eb, who stressed that the paper should be evaluated on the initial submission, not the rebuttal. However, other reviewers (and AC) all feel that the changes in the rebuttal has indeed broadened the scope of the paper and made the point valid.
Decision: Accept (poster)