GS-Hider: Hiding Messages into 3D Gaussian Splatting
Authors: Xuanyu Zhang
Jiarui Meng
Runyi Li
Zhipei Xu
Yongbing Zhang
Jian Zhang
Venue: NeurIPS 2024 poster (2024)
Keywords: 3D Steganography
3D Gaussian Splatting
Copyright Protection
Primary area: privacy

Abstract: 3D Gaussian Splatting (3DGS) has already become the emerging research focus in the fields of 3D scene reconstruction and novel view synthesis. Given that training a 3DGS requires a significant amount of time and computational cost, it is crucial to protect the copyright, integrity, and privacy of such 3D assets. Steganography, as a crucial technique for encrypted transmission and copyright protection, has been extensively studied. However, it still lacks profound exploration targeted at 3DGS. Unlike its predecessor NeRF, 3DGS possesses two distinct features: 1) explicit 3D representation; and 2) real-time rendering speeds. These characteristics result in the 3DGS point cloud files being public and transparent, with each Gaussian point having a clear physical significance. Therefore, ensuring the security and fidelity of the original 3D scene while embedding information into the 3DGS point cloud files is an extremely challenging task. To solve the above-mentioned issue, we first propose a steganography framework for 3DGS, dubbed GS-Hider, which can embed 3D scenes and images into original GS point clouds in an invisible manner and accurately extract the hidden messages. Specifically, we design a coupled secured feature attribute to replace the original 3DGS's spherical harmonics coefficients and then use a scene decoder and a message decoder to disentangle the original RGB scene and the hidden message. Extensive experiments demonstrated that the proposed GS-Hider can effectively conceal multimodal messages without compromising rendering quality and possesses exceptional security, robustness, capacity, and flexibility. Our project is available at: https://xuanyuzhang21.github.io/project/gshider.

GS-Hider: Hiding Messages into 3D Gaussian Splatting
Xuanyu Zhang 12r, Jiarui Mengl Runyi Li!2, Zhipei Xu! Yongbing Zhang', Jian Zhang
School of Electronic and Computer Engineering, Peking University
2 Guangdong Provincial Key Laboratory of Ultra High Definition Immersive Media Technology, Peking University Shenzhen Graduate School School of Computer Science and Technology, Harbin Institute of Technology (Shenzhen)
Abstract
3D Gaussian Splatting (3DGS) has already become the emerging research focus the fields of 3D scene reconstruction and novel view synthesis. Given that training 3DGS requires a significant amount of time and computational cost, is crucial to protect the copyright, integrity, and privacy of such 3D assets. Steganography, a crucial technique for encrypted transmission and copyright protection, has been extensively studied. However, it still lacks profound exploration targeted at 3DGS. Unlike its predecessor NeRF, 3DGS possesses two distinct features: 1) explicit 3D representation; and 2) real-time rendering speeds. These characteristics result in the 3DGS point cloud files being public and transparent, with each Gaussian point having clear physical significance. Therefore, ensuring the security and fidelity of the original 3D scene while embedding information into the 3DGS point cloud files is extremely challenging task. To solve the above-mentioned issue, first propose steganography framework for 3DGS, dubbed GS- GS-Hider, which can embed 3D scenes and images into original GS point clouds in an invisible manner and accurately extract the hidden messages. Specifically, we design coupled secured feature attribute to replace the original 3DGS's spherical harmonics coefficients and then use a scene decoder and message decoder to disentangle the original RGB scene and the hidden message. Extensive experiments demonstrated that the proposed GS-Hider can effectively conceal multimodal messages without compromising rendering quality and possesses exceptional security, robustness, capacity, and flexibility. Our project is available at: https: htttps://xuan: h/t::///zaauuuug1 wwtp:/iecpro/////eeeeeooo gghider///
1 Introduction
As frontier in computer vision and graphics, 3D scene reconstruction and novel view synthesis are crucial fields such as movie production, game engines, virtual reality, and autonomous driving. Specifically, thanks to its high fidelity and fast rendering speeds, 3D Gaussian Splatting (3DGS) [2] has become mainstream approach for 3D) rendering. Considering that rendering 3DGS is extremely costly, protecting the copyright and privacy of 3D assets should be priority. As widely studied technique in copyright protection, digital watermarking, and encrypted communication. steganography aims to hide messages like audio, images, and bits into digital content in an invisible manner. In its reveal process, only possible for the receivers with pre-defined revealing operations to reconstruct secret information from the container. Therefore, a natural idea arises: Can design a steganography method tailored for 3DGS to protect the copyright and privacy of 3D scenes?
1 Equal contribution. b:: Corresponding author, Shangjian.sz(pku.eede
38th Conference on Neural Information Processing Systems (NcurIPS 2024).

---

Training Views Original Scene
Original 3D Scere
Bub
Rendering
Training
Message
Upload
Deceder
Alice
Alice
Private
Public
Public
Internet
Extraction
G3-Hider
Alice
Training Views of Hidden Scene
(With Message Decoder)
Hidden Scene
Figure I: Application scenario of the proposed GS-Hider. The 3DGS trainer (Alice) requires the training views of the original and hidden scenes to train our GS-Hider, comprising a 3DGS point cloud file, a scene and message decoder. Then, Alice will upload the 3DGS point cloud file and the scene decoder online. 3DGS users (Bob) can render the original 3D scene, while only the trainer is authorized to extract the hidden 3D scene, realizing copyright protection or secret communication.
Previous research on 3D steganography has already attracted significant attention. Classical 3D steganography methods [88 20 [55 often use Fourier and wavelet transforms to embed messages into explicit 3D representations such as meshes and point clouds. During extraction, the receiver must obtain the complete 3D representation. Considering that sometimes only few views of a 3D scene are publicly available online, the 3D-to-2D watermarking mechanism [60] is designed via a deep encoder-decoder framework, enabling to extract the copyright embedded in the mesh from any 2D) perspective. Recently, steganography methods for implicit representations, such as NeRF [35], have emerged. These methods modify the weights of the NeRF (24) or replace the color representation of the NeRF B3]. ensuring that each rendered view contains hidden copyright information.
However, the methods mentioned above do not effectively apply 3DGS due its unique properties. First, since 3DGS is an explicit 3D representation where the attribute of each point has clear physical meanings, we cannot treat it as an implicit representation like NeRF, where the message can be directly and seamlessly embedded into the model weights via optimization [24]. This approach could disrupt the fidelity of the rendered RGB views and compromise the integrity of the embedded message. Meanwhile, it is difficult for a single message decoder to faithfully memorize large-capacity hidden messages, such as an entire 3D scene. Second, since 3DGS is a real-time time renderable 3D representation, users might upload the entire 3DGS point cloud file online and allow others to render it. Thus, the various attributes of the 3DGS are transparent and public, making it difficult to effectively conceal information by simply adding an attribute. Such approaches could lead to significant security concerns. Third, similar image steganography [64 19), we aspire for 3DGS steganography to conceal versatile messages (such as 3D scenes, and images) and to explore the capacity limits. Hiding multiple messages allows various users to extract distinct information from the same 3D scene, thereby enhancing the adaptability and engagement of the transmission process. The application scenario of the proposed GS-Hider is presented Fig. [
To solve the above challenges in security, fidelity, and functionality, we propose an effective and flexible steganography framework, dubbed GS-Hider. It aims embed 3D scenes or images into the original scene, and accurately extract the hidden message via meticulously designed modules. Specifically, it replaces the original 3DGS's spherical harmonics coefficients with a coupled secured feature attribute. Subsequently, a scene decoder and private message decoder are used to decouple the scene and hidden view from the coupled features in parallel. In a nutshell, the contributions and advantages of our GS-Hider can be summarized as follows.
(1) We present the first attempt design 3DGS steganography framework GS-Hider. It allows to hiding of messages into a 3D scene in an invisible manner, as well as the exact extraction from the container 3DGS point cloud files. This technology has a broad range of applications in copyright protection of 3D asserts, encrypted communication, and compression of 3DGS. D (2) Our GS-Hider exhibits robust security and high fidelity. We ensure the security of GS- Hider by rendering a coupled scene and message feature, supported by a private message decoder. Meanwhile, method minimally alters the structure of the original 3DGS, while using two parallel decoders that ensure the recovery of original scenes hidden messages do not interfere with each other.
D (3) Our GS-Hider exhibits large capacity and strong versatility. For the first time, we have realized the ability to hide multiple 3D scenes into a single 3D scene, and the same time, our GS-Hider can hide a single image into specific viewpoint of a 3D scene.
2

---

0 (4) We conducted extensive experiments on the 3DGS dataset to demonstrate the security, robust- ness, fidelity, and flexibility of our method.
2 Related Works
2.1 3D Representation
The Neural Radiance Fields (NeRF) 35 marked a significant leap in novel view synthesis and multi-
View reconstruction. Efforts have focused on improving reconstruction quality [2] 3 4 enhancing computational efficiency [50 37 48
15 43 I.]. and developing dynamic scene representations [42]
6 [9] [2). In recent advancements, 3D Gaussian Splatting (3DGS) [21] has emerged as powerful method for reconstructing and representing 3D scenes using millions of 3D Gaussians. Compared to previous implicit representations such as NeRF, 3DGS offers significant improvements in both training and rendering efficiency. To further enhance the rendering performance of 3DGS, Mip- Splatting
62] achieves high-quality alias-free rendering at arbitrary resolutions by incorporating 2D and 3D filtering. Additionally, Scaffold-GS [30] introduces structured neural anchors, further enhancing the rendering quality of 3DGS from different viewpoints. The superior performance of 3DGS has expanded its applicability to wide range of fields [54] 46). including SLAM (20 34] 4D
reconstruction
25 31 53 57],
and 3D content generation 49 58
2.2 3D Steganography
Steganography has been evolving over the decades [1 7 Thanks to advancements in deep learning,
many deep steganography efforts aim to invisibly embed messages into containers and accurately
extract them, including 2D images [64] 67 1 [56 611, videos [36] 65 32]. audio [26 27 g
and generation models [52 13. Traditional 3D steganography approaches focus watermarking
explicit 3D representation such as mesh [38 40 55 via perturbing these vertices or transforming
to the frequency domain. Meanwhile, Yoo et al. (60] aims to extract copyright from each 21) perspective, even when the complete 3D mesh is unavailable. Recently, watermarking implicit neural
representations like NeRF have attracted increasing attention [33] 18 24
I6
28 39 68 47 [7).
For example, StegaNeRF [24] embedded images or audio into the 3D scene via fine-tuning the NeRF weights. CopyRNeRE
built a watermarked color representation and introduced distortion- resistant rendering strategy to ensure robust message extraction. WaterRF [18] introduced deferred back proppppppanttion technology with patch loss and resorted discrete wavelet transform enhance the fidelity and robustness of NeRF steganography. However, steganography for novel explicit representations 3DGS has not yet been explored.
Methods
3.1 Preliminaries
As shown in Fig. 2. 3DGS an innovative and state-of-the-art approach in the field of novel view synthesis. Distinguished from implicit representation methods such NeRF [35], which utilize volume rendering. 3DGS leverages the splatting technique [59] to generate images, achieving remarkable real-time rendering speed. Specifically, 3DGS represents the scene through set of anisotropic Gaussians, defined with its center position μ E R.3 covariance Σ E R3x3 which can be decomposed into scaling factor IR3 and rotation factor q RA, color defined by spherical harmonic (SH) coefficients h E (x++1))) (where represents the order of spherical harmonics), and opacity a e R!. Then, the 3D Gaussian can be queried as follows:
g(x) = + (x==x) (xx-14)
(1)
where x represents the position of the query point. Subsequently, an efficient 3D to 2D Gaussian mapping [69] is employed to project the Gaussian onto the image plane:
PWH, JJWWW
where ja and E separately represent the 2D mean position and covariance of the projected 3D Gaussian. P. W and J denote the projective transformation, viewing transformation, and Jacobian
3

---

Varpain
Pojrtio
Grerte
Seodeing
Lyee
Aypker
Adglis
Iyoe
Typs
Mys
Beakerig Prodlee
Opection Feee
Graders Nony
Opersion Flne
Gasdans Flley
Opeadio Flae
Gurlerr Plea
( Original SDGS
(b): Adding an SH coeflicient
(c) Optimiziig 3DGS and message decoder
Figure Comparison of original 3DGS and two intuitive approaches of 3DGS steganography, namely adding SH coefficient, and optimizing 3DGS and message decoder.
of the affine approximation of P, respectively. The color of the pixel on the image plane, denoted by = (u, v), uses a typical neural point- based rendering [22]23] 23). Let E IR 1x" 2xx x3 represent the
color of the rendered image where H and W represent the height and width of images, the rendering
process is outlined as follows:
N Cipl = Σ C II
(1))))) a,e ((P-)) - ((p-A) 1=1 ==1
(3)
where represents the number of sample Gaussians that overlap the pixel p. c; E R and a; E R' denote the color calculated from h; and opacity of the i-th Gaussian, respectively.
3.2 Task Settings and Some Intuitive Approaches
Task Settings: Due to the slow rendering speeds the implicit representation in NeRF, users often only access few discrete rendered viewpoints online, rather than obtaining the entire NeRF weights. Consequently, NeRF trainers typically need to embed messages within the model weights and ensure that the same image bit be extracted from each rendered 2D viewpoint 24
However, for 3DGS steganography. due to its real-time rendering capabilities, the trained point cloud files may be directly uploaded online. Therefore, our fask setting hiding messages during fitting the original 3D scene to create a container 3DGS, and then extracting embedded messages from it. The difference between ours and the NeRF steganography setup is that: 1) Our extraction requires getting the entire 3DGS point cloud file. 2) Rather than just seeking to extract messages from the rendered 2D view, we focus more on the hiding and extraction in the intrinsic 3DGS point cloud files. Particularly, depending on different purposes, our hidden message can be divided into:
33 18
O Encryption Communication: Hiding 3D scenes in original 3D scene. We use the original 3D scene to protect secret 3D scenes from malicious theft and extraction by stealers. (Sec. 3.3 Sec. 4.6
O Copyright Protection: Hiding image in fixed view of the original 3D scene. By comparing pre-added copyright image with the decoded one, the ownership of the 3DGS is verified. (Sec. (.6)
In this section, we treat the hidden message as a single 3D scene for clarity. To achieve this task, we first review existing or some potential solutions.
Original 3DGS: As shown in Fig. 2 (a), the original 3DGS renders RGB views from learned Gaussian points via rendering pipeline, including projection, adaptive density control, and Gaussian rasterizer. The learnable attributes of i-th 3D Gaussian are represented as 0;= Gi 8;, Os, h: Here, h; denotes the SH coefficients which are transformed c; and represent the RGB color.
3DGS+SH: To embed messages within a 3DGS, as plotted Fig. 2 (b), an intuitive idea to introduce another SH coefficient h² to fit the hidden 3D scenes, namely learnable parameters ( q; 8;, Q; h,, h/). While this approach may achieve moderate fidelity for both the original and the hidden 3D scenes, it compromises security significantly. This is because stealers can easily detect the newly added h in the publicly available point cloud files and simply remove it.
Similar to StegaNeRF (24). another intuitive approach is to add decoder D,, to forcibly ensure that the output RGB original views can reveal the corresponding views of the hidden Q;, h:) and D,.. However, considering scene. Thus, the learnable parameters are O [14: 9;, 8;,0;,
3DGS+Decoder:
that each Gaussian point has specific physical significance, jointly optimizing the decoder could potentially compromise the optimization of the 3DGS, decreasing the fidelity of the original scene.

---

f.
Virepeat
Docoder
Scene
eygs
Projection
Coupled
pred
Gousdan Rattecitor
Adeptive
Bendered Coupled Feuture F
Fooup
Meaage
Densty Contral
Decodes
Operation Flow
Gradient Flow
Private
M pieed
Figure 3: Overview framework of the proposed GS-Hider. It uses a coupled secured feature attribute f; and the rendering pipeline to fuse hidden and original information, obtaining rendered coupled feature F coup. Then, the scene and message decoder is adopted to decouple the rendered RGB scenes and hidden messages.
3.3 The Proposed 3DGS Steganography Framework GS-Hider
Motivation: As depicted in Sec. 3.2 simply adding attributes or treating the 3DGS black box and jointly optimizing with a decoder fails to meet the requirements for 3DGS steganography in security and fidelity. Thus, aspire have coupling and decoupling process between the hidden and original information that are no longer presented independently. Inspired by the "Encoder+Decoder" structure in classical image steganography framework [1] 67) and combined with the characteristics of 3DGS, we find that the rendering and training process of 3DGS can be regarded as the "Encoder" for 3D scene fusion, and we can resort additional deep networks as the "Decoder" disentangle the original and hidden scene. Furthermore, exploring 3DGS attributes that can securely represent both the original and hidden scenes is challenging. As have demonstrated in Sec. 3.2 merely adding a SH coefficient is unsafe. Inspired by 666 25), we find that rendering a high- high-dimensional feature map, as opposed to merely rendering an RGB image, can contain more information and provide greater confidentiality. Thus, we design coupled secured feature attribute, coupled feature rendering pipeline, and two parallel decoders to construct our GS-Hider.
Defining Coupled Secured Feature Attribute: Different from h; in Fig, 2 (a). which has a fixed define more flexible attribute f; E R
replace h; IR48 as shown in Fig. 3 where feature dimension M is arbitrary and adjustable. For i-th Gaussian, except for the center position μ4 E R scaling factor 8; R3 rotation factor q, E IK and opacity a; E IR,, the coupled secured feature attribute f; E IR serves to represent the color and textures of both the original 3D scene and the embedded message simultaneously. Defining f, has two sigmificant benefits. 1) can effectively fuse the original scene and hidden scene via adaptive learning without the need to introduce separate encoder additional parameters. 2) It is safe and unified representation. which is impossible for stealers to distinguish which part of the feature represents the original 3D scene and which part represents the message scene.
physical meaning,
Constructing Coupled Feature Rendering Pipeline: Furthermore, we develop a coupled feature rendering pipeline shown in Fig. Similar to the original 3DGS, follow the 3D Gaussian initialization via initial set of sparse points from SfM [45) and use the same projection strategy [69 to map the 3D Gaussians the image plane in given camera view. Unlike directly rendering an image, we do not need to convert h; into color component e, Instead, inspired by Eq.3 3 we use coupled feature Gaussian rasterizer to directly render f f. M into the coupled feature F coou E //x/x
F coup [p]
Σ f.a (1- j=1
where N denotes the number of Gaussians that overlap the pixel p= v). Specifically, the coupled feature rasterizer uses the tile-based rasterization technique, dividing the screen into 16 x 16 tiles, with each thread handling a single pixel. Different from the integration of e; E R33 in Eq. 3 the feature map F Coou is directly rendered in higher dimension M with greater information capacity. Finally, the coupled feature Gaussian rasterizer enables us to effectively blend the original scene and hidden message via the attribute f., ensuring the hidden information remains confidential and high-fidelity.
Disentangling Original and Message Scene: As plotted in Fig. 3 after obtaining the rendered coupled feature F Fooup ER HWW XM introduce the scene decoder D. to produce the rendered view of the original scene Ip HxW x3 and design the message decoder Dm extract the hidden
XxW
5

---

Table Comparison of the PSNR(dB) performance of the original and hidden message scenes. We also report the average storage size of 3DGS point cloud files and the weights of decoders (if any).
We are not directly comparing with 3DGS. In fact, 3DGS is the ideal upper limit of our performance.
Method
Type
Size (MB)
Bicycle
Flowers
Garden
Stamp
Trechill
Room
Counter
Kitchen
Bonsai
Average
3DGS
Scene
796.406
25. 246
21.520
27.410
26.550
22.490
30.632
28.700
30.317
31.980
27.205
Scene
23.365
18,998
24.897
22.818
21.479
29.311
26,893
28.150
26.286
24.689
3DGS+SH
804.541
Message
23. 548
25.080
28.450
24.067
20.619
22.231
20.997
22.758
21.340
23.232
Scene
23.914
19.877
24.284
24.134
21.200
27.502
26.561
26.013
27.674
24.573
3DGS+Deoddr
891.844
Message
20.611
20.540
25.287
19.933
19.848
21.668
20.670
22.367
20.318
21.249
Scene
24.018
20.109
26.753
24.573
21.503
28, 865
27.445
29.447
29.643
25.817
GS-Hider
411.356
Message
28.219
26.389
32.348
25. 16.
20:276
22. 885
20.792
26,990
23, 84.
25.179
message scene M Mpred HRW as follows.
Ipred (F Mpred Dm (F coup).
(5)
To be concise and ensure real-time rendering, both D. and Dm consist solely of five stacked layers of convolution followed by ReLU activation functions. During deployment, D, will be public with the trained 3DGS point cloud file, while D,, will be kept private as special protocol, available only to users who are authorized to extract hidden information from the rendered feature F Fowup. In nutshell, we use the attribute f; and rendering pipeline to couple the original and hidden information, and employ two decoders for disentangling the original and hidden scenes.
3.4 Training Details
To train our method, a training set of original scenes {I that correspond one-to-one in view are required, where T denotes the number of training views. The learnable parameters of our GS-Hider are O = {14 Lz 86, 0z, fi), D., and Dm Finally, the training objective of our GS-Hider is defined
In= and hidden scenes {M (M)) TT gf Jn=l
(I (Ipred; Igt) + ESSIM (I Irred Igt); Ergh = (1 7)) E
(6)
mmes (1 3) & (Mpred, Mgt) + 3 ESSIM (Mpred, Mgt),
where y and |3 respectively denote the balancing weight of ej loss and SSIM loss. Finally, our total loss is leotal = Lgg + Xemes. where À is used to trade off the optimization between the original scene and the message scene. Similar 3DGS, during the optimization process, we employ an adaptive density control strategy to facilitate the splitting and merging of Gaussian points.
4 Experiments
4.1
Experimental Setup
We conduct experiments on 9 original scenes taken from the public Mip-NeRF360 dataset (2]. The correspondence between the hidden and original scene are listed Tab. 7 X set to 0.5 when hiding 3D scenes and set to 0.1 when hiding single image. i and y in Eq. 6 and Eq. are respectively set to 0.2. The feature dimension is set to 16. We conduct all our experiments on a NVIDIA RTX 4090 Server. Additionally, we modify the original CUDA rasterizer to support the rendering of feature maps of arbitrary dimensions.
Table 2: Rendering time (s) of our proposed GS-Hider.
Method
Bicycle
Flowers
Garden
Stump
Trechill
Room
Counter
Kitchen
Bonsai
Average 0.0222
GS-Hider
0.0226
0.0145
0.0191
0.0218
0.0218
0.0254
0.0252
0.0255
0.0241
4.2 Property Study #1: Fidelity
Considering that we are the first to implement 3DGS steganography, we compare the fidelity of our method with the original 3DGS and some intuitive approaches in Sec, Sec. As shown in Tab. T compared to "3DGS+SH" and "3DGS+Decoder" method achieves 1..877dB and 25.179 dB

---

3DGS SSS
3DCS- Decoler
GS-Ildder (Ours)
Figure 4: Comparison visualization results of our proposed GS-Hider and other potential methods. The first row of each group: original scene, the second row of each group: hidden scene.
on PSNR for original and hidden scenes, far surpassing other intuitive methods. Compared to the original 3DGS, our method utilizes less storage space (half of the storage size) and incurs only minimal decrease in rendering performance, while simultaneously possessing the capacity to conceal an entire 3D scene. Note that the performance of the original 3DGS is indeed the upper bound of our method. As plotted in Fig, it is evident that methods like "3DGS+Decoder" or "3DGS+SH" suffer from overlap artifacts between the recovered hidden and original scenes, resulting limited fidelity and security. However, our method can distinctly reconstruct the two scenes without interference. To analyze on rendering speed of our GS-Hider, We test our GSSHidder on public scenes using NVIDIA RTX 4090 Server. The resolution of each scene is consistent with the experimental settings of the original 3DGS. The rendering time of the original scene via our GS-Hider is listed in Tab, / can be observed that our method can achieve a rendering speed of 45 fps, which is much greater than the real-time rendering requirement of 30 fps. This proves the practicality and efficient rendering capabilities of our GS-Hider.
4.3 Property Study #2: Security
First, we claim that our coupled feature represen- tation F Fooup is secure. This is because it is high- dimensional, complex, and chaotic feature, and only through our specific message decoder D,, can the hidden message M Mrrdd be extracted from "coup- Fig. 6 visualizze three random channels PR #xwxx M and its corresponding original scene. It can be noticed that the geometric and tex- ture of the feature map are almost consistent with the original scene, and no traces of the hidden in- formation scene can be detected from it. suggests that the coupled feature field hides messages more
ROC
Posttiva Rate
Figure 5: ROC curve of different methods der StegExpose. The closer the curve is to the reference, the method is better in security.

---

Feature map
Original Scone
Figure 6: Visualization of the rendered coupled feature map F Feoup and the rendering view of the original scene. It can be observed that only the information the original scene retained in the feature map, while it is difficult to detect the trace of hidden message scene.
Table Robustness analysis under different pruning methods. PSNRs, SSIMs and LPIPS are used to evaluate the fidelity of the original scene, and P and SSIM are for the hidden scene.
(a) Comparison of sequential pruning ratio.
(b) Comparison random pruning ratio.
Ratio
ISNR,,
SSUM,
LPIPS]
PSNR
SSIM
Roni
PSNR,
SSIM,
L.908]
PSNR,,
SSIM.,
5%
25
0.781
0.365
25.179
0,780
25.197
0:773
0.257
24.923
0.714
10%
25.804
0.783
0.345
25.179
24.518
0.740
24,633
0.767
15%
25,804
0.783
0.245
25,179
0.780
15%
24.041
0,727
0.292
24.371
0.700
25R
25.771
0.783
0.332
25.167
0,780
23,041
0,477
23461
Table 4: Ablation studies on some key typer-parametent of the proposed GS-Hider.
(a) Ablation of the balancing weight X.
(b) Ablation of feature dimension M.
(c) Ablation of the number of Conv layers.
PSNRy
95IM;
LMMS))
PSNKs
SS0M
PSNK,
SSIMs
LIGPS)
PSNRa
S58M
PSNK
SSIM
LMPS)
PSNRu
SS0M
0.25
26.166
0.793
0.31
19837
0658
25.617
0.775
0.259
25,100
0.705
25:390
0.77
0.257
24.366
0.111
0.5
25.917
0.73
0.245
25,179
0.700
16
25.877
0.793
0.345
25,179
0.780
25,817
0.783
0.246
25.179
0.750
to the edges of the object and some imperceptible regions in the artifacts. Furthermore, verify the security of our GS-Hider, we perform antistteganography detection via StegExpose [5] on the
rendered images of different methods. Note that the detection set is built by mixing rendered images of the original scene and the ground truth with equal proportions. We vary the detection thresholds in a wide range in StegExpose [5] and draw the ROC curve in Fig. [ The ideal case represents that the detector has a 50% probability of detecting rendered images from equally mixed detection test, the same as a random guess. Evidently, the security of our GS-Hider exhibits a significant advantage compared to all competitive methods.
4.4 Property Study #3: Robustness
To evaluate the robustness of GS-Hider, we have subjected the Gaussians to degradation using both sequential pruning and random pruning methods. Sequential pruning refers pruning in ascending order of Gaussian's 's opacity, specifically removing Gaussians with lower opacity first. Random pruning, the other hand, involves randomly pruning a proportion of Gaussians. Quantitative metrics are shown in Tab. 3] Sequential pruning has minimal impact on the performance of our model, and random pruning also shows minimal effect on the watermarked images. The results indicate that our method effectively withstands the degradation process.
4.5 Ablation Studies
Ablation studies on key hyper-parameters of our GS-Hider are presented in Tab. 4 For the parameter X, we observe that when A=1, the GS-Hider could reconstruct the hidden scene with higher fidelity, making more suitable for encrypted communication. Conversely, when A=0.5, the GS-Hider was better at balancing the recovery of both the hidden and original 3D scenes. Regarding the feature channel M of F coupp we find that the optimal fidelity for both the original and hidden scenes is achieved when M was set to 16. Although the performance with M-8 is close to that of M=16, lower-dimensional features may result in hidden messages being more easily leaked, compromising security. Regarding the structure of the decoders D,, and D.. we test various numbers of "Conv=Rel.U" layers. Ultimately, we find that a configuration with five convolution layers allowed the Hider to best balance the reconstruction accuracy of both the original and hidden scenes.
8

---

Table 5: PSNR (dB) comparisons between GS- Hider and 3DGS+Decoder single image hiding.
Method
Type
Bicycle
Flowers
Garden
Stump
Trechill
Room
Counter
Kitchen
Bonsai
Avcrage
3DGS
Scene
25.246
21.520
27.410
26.550
22.490
30.632
28.700
30.317
31,980
27.205
Scene
18.320
15.224
20.901
21.884
17.435
23.878
23.322
21.174
22.481
20.513
3DGGSDeeodder
Message
37.210
35.564
36.228
36.548
35.844
36.924
38.833
39.261
36.157
36,952
GS Hider
Scene
24.140
20.660
26.971
25.569
22.077
30.274
28.267
29.8 29.844
30.115
26. 26.440
(Image)
Message
39,900
43.363
39,923
39.828
39.795
39.857
42.290
47,300
50.530
42.532
Rendering View
Recovered Image
JDGS Deender
NO NEORVATION PROCUSINGSSS INS
NEL INFORMATION PROCESIING SYSTEMS
NEURAL INFORMATION PROCOSSING STETEMS
GS-Hiddr
PROCESING DYSTEMS
PROCISEIN SYSTIMS
Figure 7: Rendering views and recovered copyright image of our GS-Hider and 3DGS+ The fifth column of each row represents the rendering view that hides single image.
4.6 Further Applications
Hiding an image into a single scene: Embedding an image is a specific case of hiding 3D scene. For a hidden image Ming EIR xWx3 we treat it as a fixed viewpoint in the training set {M (n) 17" gt J==1
During the fitting of the original scene, we encourage the rendering result of the hidden message at this specific viewpoint to be close to Ming in each iteration, without constraining other views, which makes the D, focus on hiding single image and achieving better fidelity.
To validate the effect of our method for hiding images, we embed an image ("Boat.png")) into a specific viewpoint of the original 3D scene. Tab. reeports the PSNR (dB) of the original 3D scene with the accuracy of the decoded copyright image. It is evident that "3DGS+ to maintain the fidelity of the original scene when embedding an image. However, struggles achieves a copyright image reconstruction performance of 42.532 dB, with only a minor decrease of 0.765 dB in PSNR compared the original 3DGS. Furthermore, we present the rendered views and recovered hidden copyright image in Fig. 7 Our GS-Hider can accurately reconstruct two different copyright images while causing almost no degradation to the original scene's 's rendering quality, which proves our method's 's potential for copyright protection of 3D assets. Note that we show the rendered view of the original scene with an image embedded in the fifth column of each row. Obviously, 3DGS+Decoder is completely overfitted to the hidden image (GT) at the specific viewpoint, but our method is immune the influence of the hidden message.
method
Hiding multiple scenes into single scene: To embed L hidden scenes into the original 3D scene, need modify the last convolution layer of D m to L x 3. Then, we jointly optimize L secret scenes and the original scene according to Eq. 7 and 6 which ensures each hidden scene, as well as the original scene, closely approximates the ground truth. To verify the effectiveness of our method for multiple 3D scene hiding, we conceal two groups of hidden scenes into two original scenes. As plotted in Fig. g our method can store diverse results of 3D editing [1O] within the original 3D scene, reducing the bandwidth load for transmission and presenting different content to different users. Additionally, the GS- Gidei capable of hiding two completely different scenes without interference. maintaining high fidelity.
5 Conclusion
We propose a high-fidelity, secure, large-capacity, and versatile 3DGS steganography framework, GS- Hider. By utilizing coupled secured feature representation with dual-decoder decoding, our method

---

Original Neans
Hiiddnn Scroe vi
Iliddnn Scane #2
Orignal Ncans
Hidden Scene A1
Hiddes Scene #2
Original Neane
Hiddea Scone
Hiddeo Sceae
Figure 8: Rendering views of the original 3D scenes, hidden scenes #1, and hidden scenes #2.
can conceal an image, one or multiple 3D scenes in single 3D seene. To the best of our knowledge, GS-Hider is the first attempt to study 3D Gaussian splatting steganography, which can be applied for encrypted transmission, 3D compression, and copyright protection in 3D asserts. In the future, we will continue enhance the fidelity and rendering speed of GS- Hider and expand its application scenarios, striving to advance security, transparency, and authenticity in the 3D community.
References
[1] Shumeet Baluja. Hiding images within images. IEEE transactions on pattern analysis and 2019.
machine intelligence,
[2] Jonathan T Barron, Ben Mildenhall, Matthew Tancik, Peter Hedman, Ricardo Martin-Brualla, and Pratul P Srinivasan. Mip-nerf: A multiscale representation for anti-aliasing neural radiance fields. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 5855-5864, 2021.
[3] Jonathan T Barron, Ben Mildenhall, Dor Verbin, Pratul P Srinivasan, and Peter Hedman. Mip- nerf 360: Unbounded anti-aliased neural radiance fields. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition (CVPR), 2022.
[4] Jonathan T Barron, Ben Mildenhall, Dor Verbin, Pratul P Srinivasan, and Peter Hedman. Zip-nerf: Anti-aliased grid-based neural radiance fields. In Proceedings of the IEEE/CVF International Conference Computer Vision (ICCV), 2023.
[5] Benedikt Boehm. Stegexpose-a tool for detecting Isb steganography, arXiv preprint 1rXiv.1410.6656, 2014.
[6] Ang Cao and Justin Johnson. Hexplane: A fast representation for dynamic scenes. In Pro- ceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2023.
[7] Abbas Cheddad, Joan Condell, Kevin Curran, and Paul Mc Kevitt. Digital image steganography: Survey and analysis of current methods. Signal processing, 90(3):727-752, 2010.
[8] Guangyu Chen, Yu Wu, Shujie Liu, Tao Liu, Xiaoyong Du, and Furu Wei. Wavmark: Water- marking for audio generation. arXiv preprint arXiv:2308, 12770, 2023.
[9] Lifeng Chen, Jia Liu, Yan Ke, Wenquan Sun, Weina Dong, and Xiaozhong Pan. Marknerf: Watermarking for neural radiance field. arXiv preprint arXiv: /1 2023.
[10] Yiwen Chen, Zilong Chen, Chi Zhang. Feng Wang, Xiaofeng Yang. Yikai Wang. Zhongang Cai,
Lei Yang, Huaping Liu, and Guosheng Lin. Gaussianeditor: Swift and controllable 3d editing with gaussian splatting. In Proceedings of the IEEE conference on computer vision and pattern recognition, 2024.
[11] Daniel Duckworth, Peter Hedman, Christian Reiser, Peter Zhizhin, Jean-François Thibert, Mario Lučié, Richard Szeliski, and Jonathan T Barron. Smerf: Streamable memory efficient radiance fields for real-time large-scent scene exploration. arXiv preprint arXiv:2312.0754. 2023.
[12] Jiemin Fang, Taoran Yi, Xinggang Wang, Lingxi Xie, Xiaopeng Zhang, Wenyu Liu, Matthias Nießner, and Qi Tian. Fast dynamic radiance fields with time-aware neural voxels. In SIG- GRAPH Asia, 2022.
[13] Pierre Fernandez, Guillaume Couairon, Hervé Jégou, Matthijs Douze, and Teddy Furon. The sta- ble signature: Rooting watermarks latent diffusion models. In Proceedings of the IEFF/CVF International Conference Computer Vision, pages 12466-22447,20 2023.
10

---

[14] Sara Fridovich- Keil, Giacomo Meanti, Frederik Rahbæk Warburg, Benjamin Recht, and Angjoo Kanazawa. K-planes: Explicit radiance fields in space, time, and appearance. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2023.
[15] Sara Krilovich-Keil, Alex Yu, Matthew Tancik, Qinhong Chen, Benjamin Recht, and Angjoo Kanazawa. Plenoxels: Radiance fields without neural networks. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition (CVPR), 2022.
[16] Qinglong Huang, Yong Liao, Yanbin Hao, and Pengyuan Zhou. Noise-nerf: Hide information in neural radiance fields using trainable noise. arXiv preprint arXiv:2401.01216, 2024.
[17] Xiufeng Huang, Ka Chun Cheung, Simon See, and Renjie Wan. Geometrysticker: Enabling own- ership claim of recolorized neural radiance fields. In Proceedings of the European Conference on Computer Vision, 2024.
[18] Youngdong Jang, Dong In Lee, MinHyuk Jang, Jong Wook Kim, Feng Yang, and Sangpil Kim. Waterf: Robust watermarks in radiance fields for protection of copyrights. In Proceedings of the IEEE conference on computer vision and pattern recognition, 2024.
[19] Junpeng Jing, Xin Deng, Mai Xu, Jianyi Wang, and Zhenyu Guan. Hinet: Deep image hiding by invertible network. In Proceedings of the IEEE/CVF international conference on computer vision, pages
2021.
[20] Nikhil Keetha, Jay Karhade, Krishna Murthy Jatavallabhula, Gengshan Yang. Sebastian Scherer, Deva Ramanan, and Jonathon Luiten. Splatam: Splat, track & map 3d gaussians for dense rgb-d slam. arXiv preprint 23Xi::3312.02/222 2023.
[21] Bernhard Kerbl, Georgios Kopanas, Thomas Leimkühler, and George Drettakis. 3d gaussian splatting for real-time radiance field rendering. ACM Transactions on Graphics, 1214) 2023.
[22] Georgios Kopanas, Thomas Leimkühler, Gilles Rainer, Clément Jambon, and George Drettakis. Neural point catacaustics for novel-view synthesis of reflections. ACM Transactions on Graphics (TOG), 2022.
[23] Georgios Kopanas, Julien Philip, Thomas Leimkühler, and George Drettakis. Point-based neural rendering with per-view optimization. Proceedings of the Eurographics Symposium on Rendering (EGSR). 2021.
[24] Chenxin Li, Brandon Y Feng, Zhiwen Fan, Panwang Pan, and Zhangyang Wang. Steganerf: Embedding invisible information within neural radiance fields. In Proceedings of the IEEF/CVF International Conference on Computer Vision, pages 441 453,, 2023.
[25] Zhan Li, Zhang Chen, Zhong Li, and Yi Xu. Spacetime gaussian feature splatting for real-time dynamic view synthesis. arXiv preprint arXiv:2312. 168/2, 2023.
[26] Chang Liu, Jie Zhang, Han Fang, Zehua Ma, Weiming Zhang, and Nenghai Yu. Dear: A deep-learning- based audio re-recording resilient watermarking. In Proceedings of the AAAI Conference Artificial Intelligence, volume 37, pages 13201-13209 2023.
[27] Chang Liu, Jie Zhang, Tianwei Zhang, Xi Yang, Weiming Zhang, and Nenghai Yu. Detecting voice cloning attacks via timbre watermarking. arXiv preprint arXiv:2312.034100 2023.
[28] Jia Liu, Peng Luo, and Yan Ke. Hiding functions within functions: Steganography by implicit neural representations. arXiv preprint arXiv:2312.04744 2023.
[29] Jia- Jia-Wei Liu, Yan-Pei Cao, Weijia Mao, Wenqiao Zhang, David Junhao Zhang, Jussi Keppo, Ying Shan, Xiaohu Qic, and Mike Zheng Shou. Devrf: Fast deformable voxel radiance fields for dynamic scenes. Proceedings of the Advances Neural Information Processing Systems (NeurIPS), 2022.
[30] Tao Lu, Mulin Yu, Linning Xu, Yuanbo Xiangli, Limin Wang, Dahua Lin, and Bo Dai. Scaffold- gs: Structured 3d gaussians for aiaw-adaptive rendering. In Proceedings of the IEEF/CVF Conference Computer Vision and Pattern Recognition, 2023.
11

---

[31] Jonathon Luiten, Georgios Kopanas, Bastian Leibe, and Deva Ramanan, Dynamic 3d gaussians: Tracking by persistent dynamic view synthesis. arXiv preprint arXiv:2308. 09008,0991,,, 2023.
[32] Xiyang Luo, Yinxiao Li, Huiwen Chang, Ce Liu, Peyman Milanfar, and Feng Yang. Dvmark: a deep multiscale framework for video watermarking. IEEE Transactions on Image Processing, 2023.
[33] Ziyuan Luo, Qing Guo, Ka Chun Cheung, Simon See, and Renjie Wan. Copymerf: Protect- ing the copyright of neural radiance fields. Pruceedings of the IEEE/CVE International Conference Computer Vision, pages 22401-22411, 2023. 2023.
[34] Hidenobu Matsuki, Riku Murai, Paul HJ Kelly, and Andrew Davison. Gaussian splatting slam. arXiv preprint arXiv:23/2.06741, 2023.
[35] Ben Mildenhall, Pratul P Srinivasan, Matthew Tancik, Jonathan T Barron, Ravi Ramamoor- thi, and Ren Ng. Nerf: Representing scenes as neural radiance fields for view synthesis. Communications of the ACM, 65(1):99-106 106, 2021.
[36] Chong Mou, Youmin Xu, Jiechong Song, Chen Zhao, Bernard Ghanem, and Jian Zhang. Large- capacity and flexible video steganography via invertible neural network. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 22606-22615, 2023.
[37] Thomas Müller, Alex Evans, Christoph Schied, and Alexander Keller. Instant neural graphics primitives with multiresolution hash encoding. ACM Transactions on Graphics (ToG), 2022.
[38] Ryutarou Ohbuchi, Akio Mukaiyama, and Shigeo Takahashi. A frequency-domain approach to watermarking 3d shapes. In Computer graphics volume 21, pages 373-382. Wiley Online Library, 2002.
[39] Win Kent Ong, Kam Woh Ng. Chee Seng Chan, Yi Zhe Song, and Tao Xiang. Ipr-nerf: Ownership verification meets neural radiance field. arXiv preprint arXiv:2401.09449 2024.
[40] Emil Praun, Hugues Hoppe, and Adam Finkelstein. Robust mesh watermarking. In Proceedings of the 26th annual conference on Computer graphics and interactive techniques, pages 49-56, 1999.
[41] Nicls Provos and Peter Honeyman. Hide and seek: An introduction to steganography. IEEE security & privacy, 1(3):32-44, 2003.
[42] Albert Pumarola, Enric Corona, Gerard Pons-Moll, and Francesc Moreno-Noguer. D-nerf: Neural radiance fields for dynamic scenes. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2021.
[43] Christian Reiser, Rick Szeliski, Dor Verbin, Pratul Srinivasan, Ben Mildenhall, Andreas Geiger, Jon Barron, and Peter Hedman. Merf: Memory-efficient radiance fields for real-time view synthesis in unbounded scenes. ACM Transactions on Graphics (TOG), 2023.
[44] Robin San Roman, Pierre Fernandez, Alexandre Défosse7, Teddy Furon, Tuan Tran, and Hady Elsahar. Proactive detection of voice cloning with localized watermarking. arXiv preprint 170774444, 2024.
[45] Johannes L Schonberger and Jan-Michael Frahm. Structure-frome mrottmmr-iro--mooiion ings of the IEEE conference on computer vision and pattern recognition, pages 4104-411 2016.
motion revisited. In Proceed-
[46] Yahao Shi, Yanmin Wu, Chenming Wu, Xing Liu, Chen Zhao, Haocheng Feng, Jingtuo Liu, Liangjun Zhang, Jian Zhang, Bin Zhou, et al. Gir: 3d gaussian inverse rendering for relightable scene factorization. arXiv preprint arXiv:23/2.05133, 2023.
[47] Qi Song, Ziyuan Luo, Ka Chun Cheung, Simon See, and Renjie Wan. Protecting nerfs' copyright via plug-and-play watermarking base model. Proceedings of the European Conference on Computer Vision, 2024.
12

---

[48] Cheng Sun, Min Sun, and Hwann Twann-Tzong Tzong Chen. Direct voxel grid optimization: Super-fast convergence for radiance fields reconstruction. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2022.
[49] Jiaxiang Tang, Jiawei Ren, Hang Zhou, Ziwei Liu, and Gang Zeng. Dreamgaussian: Generative gaussian splatting for efficient 3d content creation. arXiv preprini arXiv:2309. N.Ni::30..16633, 2023.
[50] Krishna Wadhwani and Tamaki Kojima. Squeezenerf: Further factorized fastnerf for memory- efficient inference. In Proceedings of the IEEE/CVF Conference on Computer Vision and Puttern Recognition (CVPR), 2022.
[51] Chen Wang, Xian Wu, Yuan-Chen Guo, Song-Hai Zhang, Yu-Wing Tai, and Shi-Min Hu. Nerf-sr: High quality neural radiance fields using supersampling. In Proceedings of the ACM International Conference on Multimedia (ACM MM), 2022.
[52] Yuxin Wen, John Kirchenbauer, Jonas Geiping, and Tom Goldstein. Tree-rings watermarks: Invisible fingerprints for diffusion images. Advances in Neural Information Processing Systems, 36, 2024.
[53] Guanjun Wu, Taoran Yi, Jiemin Fang, Lingxi Xie, Xiaopeng Zhang, Wei Wei, Wenyu Liu, Qi Tian, and Xinggang Wang. 4d gaussian splatting for real-time dynamic scene rendering. arXiv preprint arXiv:2310.08528, 2023.
[54] Yanmin Wu, Jiarui Meng, Haijie Li, Chenming Wu, Yahao Shi, Xinhua Cheng, Chen Zhao, Haocheng Feng, Errui Ding, Jingdong Wang, et al. Opengaussian: Towards point-level 3d gaussian- based open vocabulary understanding. arXiv preprint arXiv:2406.02056 2024.
[55] Zhirong Wu, Shuran Song, Aditya Khosla, Fisher Yu, Linguang Zhang, Xiaoou Tang, and Jianxiong Xiao. 3d shapenets: A deep representation for volumetric shapes. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 1912-1920, 2015.
[56] Youmin Xu, Chong Mou, Yujie Hu, Jingfen Xie, and Jian Zhang. Robust invertible image steganography. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 7875-7884, 2022.
[57] Ziyi Yang, Xinyu Gao, Wen Zhou, Shaohui Jiao, Yuqing Zhang, and Xiaogang Jin. Deformable 3d gaussians for high-fidelity monoeular dynamic scene reconstruction. Proceedings of the IEEF/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2024.
[58] Taoran Yi, Jiemin Fang, Junjie Wang, Guanjun Wu, Lingxi Xie, Xiaopeng Zhang, Wenyu Liu, Qi Tian, and Xinggang Wang. Gaussiandreamer: Fast generation from text to 3d gaussians by bridging 2d and 3d diffusion models. In Proceedings the IEEF/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2024.
[59] Wang Yifan, Felice Serena, Shihao Wu, Cengiz Öztireli, and Olga Sorkine-Hornung. Differen- tiable surface splatting for point- based geometry processing. ACM Transactions on Graphics (TOG), 2019.
[60] Innfarn Yoo, Huiwen Chang, Xiyang Luo, Ondrej Stava, Ce Liu, Peyman Milanfar, and Feng Yang. Deep 3d-to-2d watermarking: Embedding messages in 3d meshes and extracting them from 2d renderings. In Proceedings of the IEÉE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages (0031-1004)) June 2022.
[61] Jiwen Yu, Xuanyu Zhang, Youmin Xu, and Jian Zhang. Cross: Diffusion model makes con- trollable, robust and secure image steganography. Advances Neural Information Processing Systems, 36, 2023.
[62] Zehao Yu, Anpei Chen, Binbin Huang, Torsten Sattler, and Andreas Geiger. Mip-splatting: Alias-free 3d gaussian splatting. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2023.
[63] Jie Zhang, Dongdong Chen, Jing Liao, Weiming Zhang, Huamin Feng. Gang Hua, and Nenghai Yu. Deep model intellectual property protection via deep watermarking. IEEE Transactions on Pattern Analysis and Machine Intelligence, 40(8):4005-4020, 2022.
13

---

[64] Xuanyu Zhang, Runyi Li, Jiwen Yu, Youmin Xu, Weiqi Li, and Jian Zhang. Editguard: Versatile image watermarking for tamper localization and copyright protection. In Proceedings of the IEEE conference computer vision and pattern recognition, pages 11964-11974, 2024.
[65] Xuanyu Zhang, Youmin Xu, Runyi Li, Jiwen Yu, Weiqi Li. Zhipei Xu, and Jian Zhang. V2a- mark: Versatile deep visual-audio watermarking for manipulation localization and copyright protection. In Proceedings of ACM Conference Multimedia, 2024.
[66] Shijie Zhou, Haoran Chang, Sicheng Jiang, Zhiwen Fan, Zehao Zhu, Dejia Xu, Pradyumna Chari, Suya You, Zhangyang Wang, and Achuta Kadambi. Feature 3dgs: Supercharging 3d gaussian splatting to enable distilled feature fields. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2023.
[67] Jiren Zhu, Russell Kaplan, Justin Johnson, and Li Fei-Fei. Hidden: Hiding data with deep networks. In Proceedings of the European conference on computer vision (ECCV), pages 657-672, 2018.
[68] Xingyu Zhu, Guanhui Ye, Chengdong Dong, Xiapu Luo, and Xuetao Wei. Towards function space mesh watermarking: Protecting the copyright of signed distance fields. arXiv preprint arXiv:2311.12059 2023.
[69] Matthias Zwicker, Hanspeter Pfister, Jeroen Van Baar, and Markus Gross. Ewa volume splatting. In IEEE Conference on Visualization (VIS), 2001.
14

---

Appendix
A
Can our GS-Hider decode copyright from arbitrary 2D RGB viewpoint?
Although this paper focuses on hiding and extracting messages from 3DGS point cloud files, our GS-Hider can also extract copyright from any 2D RGB perspective. In some cases, we may not have direct access to the complete 3DGS point cloud file or the rendering pipeline, but can only extract the copyright of the 3DGS from some sparse publicly available 2D views. Thus, similar the task settings of [24] [3], we design a rendering-resistan traceable watermarking strategy (RTWS) inspired by box-free free watermarking approach [63]. which allows for the decoding of the copyright from any rendered 2D view by fine-tuning the GS-Hider and newly added watermark decoder Dw- Specifically, plotted in Fig- 2
we first use pre-trained watermark encoder Ew to embed
shared copyright watermark Woop into the training set of the original scenes {1 12" Jn=1 obtaining
watermarked view set (I"(n) JT I- Subsequently, we mix (
(I(m) gf Jn=l and {I Jn=1 in a 50% ratio
and use this combined dataset to fine-tune the GS Hider. To minimize the impact on the original rendering quality, we only alter the coupled feature attribute f; of the GS-Hider, without changing positions shape of each Gaussian point. Finally, we fine-tune the watermark decoder D., via the training pairs ppred f constraining it such that when pred is input, the decoder outputs W cop and conversely outputs black image (Wo) when Lgt is input.
eoo = (Tpred) W Woopl -
By adding watermarks and fine-tuning GS-Hider, alter the training data domain, thereby causing the rendered images Ipred to exhibit domain discrepancies compared to natural images Lot- By fine-tuning the Pw, we enable structure of E., and D., are similar to [64]. Note that the proposed RTWS in this section is not only applicable to GS-Hider, but also to original 3DGS, and even other 3D representations such as NeRF.
detect this domain gap and decode exact copyrights. The network
To validate the effect of GS-Hider for extract- ing copyright from RGB viewpoint, we use the pro- posed rendering-resistant traceable watermarking strat- egy (RTWS) to finetune our GS-Hider and newly added watermark decoder Dw- For simplicity, choose the pre-trained GS-Hider that has embedded single image. Tab, reports the PSNR values of the original scene (PSNRs), hidden message (PSNR ) and the watermarked image extracted from RGB viewpoint (PSNRw) ). It can be observed that our method is capable of extracting precise copyright watermark images from 2D view with 39.927dB PSNR via Dw,, without sacrificing the fidelity of the hidden message and the original scene.
Table 6: Copyright Extraction Accuracy of Arbitrary 2D Viewpoints.
Method
PSNRs
PSNR,r
PSNRw
GS-Hider (Image)
26,440
42,532
GiS-Hider (Image) RIWS
25.915
10.513
39.927
Ground
Watemmal Encoder
Decoder
Rusion
Training
Watermarked Views
Gi-Hider
Rendeted View from
Traceable Watermark
Watermark Trainig
65-Hider
Watermark becader
Figure 9: Workflow of the proposed rendering-resistant watermarking strategy.
B Dataset Construction
To make the training view set of the hidden scene and the original scene correspond to each other, we use the trained 3DGS point cloud files and render them according to the viewpoints in the training set of the original scene to get the training view set of the hidden scene. To ensure that there are as many illegal views as possible in the training views of the hidden scene, we set the correspondence between the hidden and original scenes as listed in Tab.
15

---

Table 7: Correspondence between hidden and original scenes. Since for most scenes, "playroom" and "bicycle" have fewer illegal views, they repeated several times.
Original Scene
Bicycle
Bonsai
Room
Flowers
Trechill
Garden
Stump
Counter
Kitchen
Hidden Scene
Playroom
Counter
Garden
Playroom
Bicycle
Playroom
Playroom
Bicycle
Bonsai
C Limitations and Future Works
We present the two main limitations of our GS-Hider and provide some potential improvements in the future works. 1) Compromised rendering quality: Since the feature attribute f, does not consider view-dependency compared to spherical harmonics, and we need to hide the secret scene while representing the original scene, our rendering quality is somewhat inferior 3DGS. In fact, we inevitably need to make a trade-off between rendering quality and steganography capacity. However, our GS-Hider is universal framework that can be integrated with the latest 3DGS variants, such as Mip-splatting [62]. to enhance rendering performance. Meanwhile, the current scene and message decoder designs are relatively simple. Integrating more efficient neural rendering and decoding designs (such as Scaffold-GS (30]) can also help improve the overall rendering quality of the framework. 2) Decreased rendering speed: Due to the rasterization of high-dimensional features and network decoding, although we can still achieve real-time rendering, the rendering speed has decreased compared to the original 3DGS. However, we can easily improve rendering speed by pruning Gaussian points, reducing the dimension of feature attributes, and decreasing the number of convolution layers or feature kernels.
the original
D Discussions
D.1 Can the Wrong Decoder Extract the Correct Hidden Scene?
To further verify the security of our GS-Hider, randomly initialize the message decoder D,,. and use to decode the rendered coupled feature. As shown in Fig. [0] we find that using the wrong message decoder completely unable to reconstruct the hidden scene, which further proves that difficult for unauthorized users to accurately decode our hidden scene.
Original Scene
Hidden Scene
Figure 10: Rendering results produced by the randomly initialized message decoder.
D.2 Does the Decoder Memorize the Hidden Scene?
To verify whether our GS-Hider simply memorizes the hidden scene via the decoder, we conduct experiments of hiding two hidden scenes, as detailed in Sec. [.6] This proves that our decoder is not storing memorizing the secret information. Meanwhile, our message decoder is very lightweight with only convolution layers. It only contains 0.465 M parameters, which is far from enough to memorize complex 3D scenes. In fact, the geometrical and structural information is mainly embedded in the coupled feature, and the role of the decoder is merely to extract and decouple the secret information, not to memorize the scene watermark. show the role of our decoder, we further input the rendered coupled feature from another scene like 'playroom' to the message decoder that is trained to hide the scene 'bicycle'. The results are presented in Fig. TT We find that the rendered scene retains most of the geometric structure of the 'playroom' scene, with only some colors resembling
16

---

those of the 'icycll'' scene. This indicates that our decoder itself cannot memorize secret information.
Figure 11: Visualization of the decoded scene when we input coupled features from other scenes ('playroom') to the message decoder of 'bcccll'..
D.3
Why does the coupled feature attribute work?
First, the hidden scene information is concealed in the spatial high-frequency details of the coupled feature and some visually insensitive areas (such as artifacts, noise, and edges). The invisible hidden information in the coupled feature map will be amplified and decoupled by the message decoder, eventually forming an RGB hidden scene. We visualize the intermediate feature of the message decoder in Fig. 12 to illustrate this process. Second, the secret information is hidden in some redundant feature channels of the coupled feature field F coup. To prove this, we randomly set some channels coup 0, and eventually find that the hidden decoder can not reconstruct the complete secret scene, as presented in Fig. 13 This indicates that multiple feature channels are coupled and interact with each other, collectively storing the hidden information.
Feature map
1st Conv
2rd Conv
Conv
4th Conv
Hidden Sccne
Figure 12: Visualization of intermediate feature maps in the message decoder. 14th- 16th channels of the feature map. Zoom in for best view.
present the
Figure 13: Visualization of the decoded hidden scene when some channels of the coupled feature coup is randomly set to O. Obviously, without some channels, the hidden scene cannot be fully decoded correctly.
E
Additional Quantitative Results
E.1
Additional Metrics
To verify the performance change of coupled secured feature attributes compared to spherical harmonic coefficients, we do not hide the message but only optimize the 3DGS attributes and scene decoder to the original scene. The PSNR, SSIM, and LPIPS of the rendered original scene are listed in Tab. g It can be found that without hiding any message, our method only has PSNR reduction 0.68 compared the original 3DGS (listed in Tab [T. which shows that our rendering performance is comparable to 3DGS. Mcanwhile, plotted in Table half of that 3DGS. By increasing the feature dimension A and the complexity of the decoder network, our rendering performance can be further improved and approach 3DGS. Finally, due to space limitations, we only put our PSNR results in Tab. We also supplement all metrics of our GS-Hider single 3D scene hiding in Tab.
storage size is only about
E.2 Comparison with Recent Steganography Method StegaNeRR
To compare with the recent steganography method, we have tried our best to migrate the pipeline and decoding network of StegaNeRF [24] to the 3DGS steganography task. Specifically, feed the
17

---

Table 8: Rendering performance of the proposed GS GS-Hider without hiding messages.
Metrics
Bicycle
Flowers
Garden
Stump
Treehill
Room
Counter
Kitchen
Bonsai
Average
PSNR
24.377
20.897
26.954
25.565
21.952
30.190
28.053
29.588
31.147
26.525
SSIM
0.735
0.583
0.855
0.731
0.625
0.918
0.899
0.921
0.937
0.800
LPIPS
0.254
0.347
0.118
0.259
0.361
0.209
0.202
0.129
0.191
0.230
Table 9: All Metries of the proposed GS Hider on the single 3D scene hiding. Note that PSNRs.
SSIMs, and g respectively are used evaluate the fidelity of the original scene, while M
M. LPIPS are for the fidelity of the hidden message.
Metrics
Bicycle
Flowers
Garden
Stump
Trechill
Room
Counter
Kitchen
Bonsai
Average
PSNRs
24.018
20.109
26.752
24.572
21.502
28.864
27 27.445
29.446
29.643
25.817
SSIMs
0.721
0.539
0.850
0.676
0.608
0.910
0.894
0.911
0.931
0.782
0.268
0.347
0.126
0.313
0.377
0.223
0.212
0.141
0.202
0.246
P
28.218
26.388
32.348
25.161
20.275
22.885
20.792
26.690
23.845
25.178
ar
0.913
0.908
0.944
0.850
0.464
0.691
0.585
0.874
0.788
0.780
LPIPSM
0,210
0.245
0.137
0.287
0.487
0.350
0.497
0.208
0.328
0.306
Table 10: Comparison between the proposed GS-
Table 11: Rendering quality of the extension to Mip-3GDS, namely Mip-GSHider.
Hider and 3DGS+StegaNeRF:
Methods
PSNKs
SSIM
LPIPS:
PSNKy
SSIMar
LPPPS
Methods
PSNRs
SSIMa
LPIPS,
PSNR
SSIMar
LPIPS
3DGS SaR
26.22
0.31
0.25
19.64
0.67
0.46
Mig- Mig-Splaming
27.29
0.8
0.20
Höler
Mip-OSHfider
output of 3DGS to the decoding network of StegaNerf and let it approximate the hidden 3D scene. The results are reported on Tab, [0] We find that GS-Hider is much better than 3DGS+StegaNeRF in terms of the reconstruction quality of hidden scenes, achieving 5.54dB improvement. This proves that our GS-Hider can effectively avoid the mutual interference between information hiding and scene rendering.
E.3 Extension to Mip-3DGS
To verify the generalizability of our framework, we realize variant of GS-Hider based Mip- splatting. Specifically, we retain the 3D smooth filter and 2D mip filter from Mip-splatting, only replacing the color attributes with high-dimensional features fit the GS-Hider framework. Then, conducted experiments on 3D scenes hiding on the mipnerf-366 dataset. The results are reported in Tab. I0 We also present some visualization results in Fig. 14 This demonstrates that our GS Hider is a universal steganography framework, not limited to specific 3DGS methods.
Figure 14: Visualization result of the original and hidden scene rendered by our MIP-GSHider.
Additional Visualization Results
We present more visualization results in Fig. 15 and Fig. 16 to demonstrate our effectiveness on 3D scene hiding and single image hiding. Moreover, we constructed an HTML file -/gshider/idexxhmml! the supplementary material to display some continuous 3D scenes.
18

---

Rendering View
Recovered Image
INFORMATION PROCESSING SYSTEMS
SIMAA INFORMATION PROCESSING SYSTENS
GS-HIDER
Figure 15: Rendering performance of the original scene and the recovered image produced by GS-Hider. The fifth column of each row denotes the rendering view that hides a single image.
Original Scene
Hidden Scene
Original Scene
Hidden Scene
Original Scene
Hidden Scene
Figure 16: Rendering performance of the proposed GS-Hider on the original and hidden scene.
19

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: The main claims made in the abstract and introduction accurately reflect the paper's contributions and scope.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
It is fine to include aspirational goals as motivation long is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification:
The paper discusses the limitations of the work performed by the authors in
Sec. C
Guidelines:
The answer NA means that the paper has limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (c.g.. independence assumptions, noiseless settings, model sell-speciiiatiinn asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low or images are taken in low lighting. Or speech-to-tex, system might not be used reliably to provide closed captions for online lectures because it fails handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and faimesss.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't 't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community, Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory Assumptions and Proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
20

---

Answer:
[Yes]
Justification:
All the theorems, formulas in the paper are numbered and cross-referenced.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced in the statement of any theorems.
The proof's can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch provide intuition.
Inversely, any informal proof provided in the core of the paper should complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental Result Reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results the paper to the extent that affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided not)?
Question:
Answer: [Yes]
Justification: The paper fully discloses all the information needed to reproduce the main experimental results of the paper in Sec.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, descríbing the architecture fully might suffice, or if the contribution is specific model and empirical evaluation, it may be necessary to either make possible for others to replicate the model with the same dataset, provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g.. g., in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) the contribution is primarily a new algorithm, the paper should make clear how reproduce that algorithm. (b) If the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) the contribution is new model (e-g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should possible for other researchers to have some path to reproducing verifying the results.
5. Open access to data and code
21

---

Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, as described in supplemental material?
Question:
Answer: [No]
Justification:
The paper does not provide open access to the data and code.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (https://nnis.co cc/
for more details.
While we encourage the release of code and data, we understand that this might not be possible, "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for a new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurlPS code and data submission guidelines (https
/ //nips.co. ctipp.ccc/uubli///gr guwdes/ddeeeee CooeeSumeeeeeeeeeeeeee ssi onyylicy) for more details.
The authors should provide instructions on data access and preparation, including how access the raw data, preprocessed data, intermediate data, and generated data,
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only subset of experiments reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental Setting/Details
Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Question:
Answer: [Yes]
Justification: The paper specifies all the training and test details necessary to understand the results Sec.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to a level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, as supplemental material.
7. Experiment Statistical Significance
Does the report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer: [Yes]
Justification:
The paper reports information about the statistical significance of the experi-
ments, c.g. reconstruction accuracy in Sec. 4.2) security analysis in Sec. 4.3 and robustness analysis Sec.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by emoo bars, confi- dence intervals, or statistical significance tests, least for the experiments that support the main claims of the paper.
22

---

The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
It should be clear whether the error bar is the standard deviation or the standard error of the mean.
is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out range (e.g. negative еπτог rates).
If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables text.
8. Experiments Compute Resources
For each experiment, does the paper provide sufficient information the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification:
The paper provides sufficient information on the computer resources in Sec. 4.1
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate type of compute workers CPU or GPU, internal cluster, cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported the paper (e.g., preliminary or failed experiments that didn't make it into the paper).
9. Code Of Ethics
Question: Does the research conducted the paper conform, in every respect, with the NeurlPS Code of Ethics httpss//neuripps http:://wwwrrpps..ppplileleeeeee
Answer: [Yes]
Justification: The research conducted in the paper conform, in every respect, with the NeurlPS Code of Ethics.
Guidelines:
The answer NA means that the authors have not reviewed the NeurlPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., there a special consid- eration due to laws or regulations in their jurisdiction).
10. Broader Impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification: The paper discusses both potential positive societal impacts and negative societal impacts of the work performed Sec.
Guidelines:
The answer NA means that there is no societal impact of the work performed.
23

---

If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), faimess considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point out. For example, out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation.
legal to point
other hand, it is not needed to point out that generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g.. gated release of models, providing defenses in addition attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML).
11. Safeguards
Question:
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Answer: [Yes]
Justification: The paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Question:
Answer: [Yes]
The creators original owners of assets (e.g., code, data, models), used in the paper, are properly credited, and the license and terms of use explicitly are mentioned and properly respected.
Justification:
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package dataset.
The authors should state which version of the asset used and, possible, include URL.
The name of the license (c.g., CC-BY 4.0) should be included for each asset.

---

For scraped data from a particular source (e.g., website). the copyright and terms of service of that souree should be provided.
assets are released, the license, copyright information, and terms use in the datasets.paperssiii paperswi thcode. www.coo//aaaaa datasets package should be provided. For popular datasets,
has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
If this information is not available online, the authors are encouraged to reach out to the asset's s creators.
13. New Assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Justification:
The paper does not release new assets.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/mmodel as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and Research with Human Subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given participants and screenshots, if applicable, as well as details about compensation (if any)?
Answer: [NA]
Justification:
The paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According to the NeurlPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification:
The paper does not involve crowdsoureing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsoureing nor research with human subjects.
25

---

Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
26


Reviews:
[{"review_id": "8qFYIpdXwN", "reviewer": "Reviewer_X8jQ", "summary": "The paper introduces GS-Hider, a novel steganography framework for 3D Gaussian Splatting (3DGS). Protecting the security and fidelity of 3D assets while embedding information into transparent 3DGS point clouds is challenging, and the method addresses this by invisibly embedding 3D scenes and images into original GS point clouds. It employs a coupled secured feature attribute, scene decoder, and message decoder. Extensive experiments demonstrate its effectiveness in concealing multimodal messages without compromising rendering quality a lot.", "questions": "1) It is interesting to understand where and how exactly your method hides the secret information. As you show in Figure 6, at first glance, it seems that the rendered coupled feature map only contains information about the original scene. Does it mean that the hidden message is encoded as (spatial) high-frequency details in the feature channels? Or maybe it learnt to hide information in last bits just like the least significant bit method? Are there any experiments that you conducted to investigate this more?", "limitations": "Limitations are adequately addressed.", "rating": 6, "confidence": 2, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1) The first work to perform steganography for the 3D gaussian splatting, it might inspire more research into this direction.\n2) The method works well and exhibits robustness and high capacity shown by the empirical results.", "weaknesses": "1) The rendering quality and speed are compromised a bit, but not much.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your constructive comments! We hope that our response will address all of your concerns. All discussions and supplementary analyses will be included in our revised version. If there are any additional comments to be added, please continue the discussion with us.\n\n$\\textcolor{red}{\\textbf{The supplementary rebuttal PDF file can be found at the bottom of the overall response}}$.\n\n> **Weakness #1: Compromised rendering quality and speed.**\n\n- First, our rendering quality and speed are still $\\textcolor{red}{\\textbf{acceptable}}$.\n  - In the case of hiding a 3D scene, our rendering quality only drops a little bit (about 1dB) and is comparable to the original 3DGS and other 3D rendering methods (such as Instant NGP). \n  - Meanwhile, our rendering speed can reach 45 FPS, $\\textcolor{red}{\\textbf{which far exceeds the real-time rendering requirement of 30 FPS}}$.\n- Second, our method has $\\textcolor{red}{\\textbf{unique advantages}}$ compared with the original 3DGS.\n  - As shown in Table 1 of the main paper, our GS-Hider significantly reduces the storage space by $\\textcolor{red}{\\textbf{385.05MB}}$ compared to the original 3DGS.\n  - Our GS-Hider has better privacy and can hide a 3D scene or a copyright image with high quality, which is suitable for tasks such as encrypted transmission and copyright protection.\n\n- Third, the rendering speed of our GS-Hider can be $\\textcolor{red}{\\textbf{easily improved}}$.\n  - We can apply GS compression methods to reduce the number of Gaussian points and improve rendering speed. As shown in Table 2 of the main paper, sequentially pruning Gaussian points by 25% hardly affects the rendering quality and can bring a **20%** improvement in rendering speed.\n  - We can improve rendering speed by reducing the number of convolutions in the scene decoder or using a more efficient and lightweight network design. More FPS results of GS-Hider under different settings can be found on $\\textcolor{red}{\\textbf{Table 1}}$ of the rebuttal PDF.\n\n> **Question #1: Where and how GS-Hider hides the secret information?**\n\n- First, the hidden scene information is concealed in the **spatial high-frequency details of the coupled feature and some visually insensitive areas (such as artifacts, noise, and edges)**. The invisible hidden information in the coupled feature map will be amplified and decoupled by the message decoder, eventually forming an RGB hidden scene. We visualize the intermediate feature of the message decoder in the $\\textcolor{red}{\\textbf{Figure 1}}$ of the rebuttal PDF to illustrate this process.\n\n- Second, the secret information is hidden in some **redundant feature channels** of the coupled feature field $\\mathbf{F}\\_{coup}$. To prove this, we randomly set some channels in $\\mathbf{F}\\_{coup}$ to $\\mathbf{0}$, and eventually find that the hidden decoder can not reconstruct the complete secret scene. The results are presented in $\\textcolor{red}{\\textbf{Figure 2}}$ of the rebuttal PDF. This indicates that multiple feature channels are coupled and interact with each other, collectively storing the hidden information.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "M1T5NlVoT0", "reviewer": "Reviewer_S9BH", "summary": "The paper presents GS-Hider, a novel steganography framework designed for 3D Gaussian Splatting (3DGS). The framework enables the invisible embedding of 3D scenes and images into 3DGS point clouds, ensuring accurate extraction of hidden messages without compromising rendering quality. Extensive experiments demonstrate GS-Hider's effectiveness in concealing multimodal messages while maintaining exceptional security, robustness, capacity, and flexibility.", "questions": "Please see the weakness.", "limitations": "The authors have addressed the limitations in the paper.", "rating": 8, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "(+) The paper introduces an interesting steganography framework for 3DGS, which is a novel and emerging field in 3D scene reconstruction and rendering. GS-Hider maintains the rendering quality of the original scene while securely embedding hidden messages, addressing the challenges of fidelity and security effectively. The framework has significant potential applications in copyright protection, encrypted communication, and 3D asset compression.\n\n(+) Comprehensive experiments are conducted to validate the performance, security, robustness, and flexibility of GS-Hider. The experiment results demonstrate robustness against various forms of degradation and support hiding multiple 3D scenes or images, showcasing its versatility.  Further Applications effectively explain the results of the proposed method when dealing with other scenarios.", "weaknesses": "(-) The implementation of GS-Hider involves some techniques and may require substantial computational resources, limiting its accessibility and usability for some ordinary users without deep learning backgrounds.\n(-) The comparison with existing methods is somewhat limited, as it primarily focuses on a specific type of 3DGS. It overlooks a broader range of state-of-the-art techniques in 3DGS. It may be beneficial for the author to consider implementing their methods in other 3DGS variants like [1] to highlight the advantages of the proposed method.\n\n[1] Mip-Splatting: Alias-free 3D Gaussian Splatting.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your constructive comments! We hope that our responses can address your concerns. If there are still aspects that need further clarification, please feel free to continue the discussion with us!\n\n> **Weakness #1: Limited accessibility and usability.**\n\n- Our method is actually very simple, efficient, and user-friendly. It does not require substantial computational resources than the original 3DGS. In fact, our storage space is even smaller than the original 3DGS because we use a more compact feature representation. \n- Additionally, our method can be optimized end-to-end in a $\\textcolor{red}{\\textbf{single GTX 3090 Ti Server}}$, with training and decoding easily encapsulated into an interface. **In the training phase**, users only need to input the original scene and the hidden scene or a copyright image to render a secure and private 3DGS for publishing or sharing. **In the verification phase**, users only need to use a private message decoder to extract encrypted information from the Gaussian point cloud. This makes it accessible for users without a background in deep learning to use it effortlessly.\n\n\n> **Weakness #2: Extension to other variants of 3DGS.**\n\n- According to your valuable suggestions, we realize a variant of GS-Hider based on Mip-splatting. Specifically, we retain the 3D smooth filter and 2D mip filter from Mip-splatting, only replacing the color attributes to high-dimensional features $\\boldsymbol{f}_i$ to fit the GS-Hider framework. Then, we conducted experiments on 3D scene hiding on the mipnerf-360 dataset. The results are reported as follows. We also present some visualization results in $\\textcolor{red}{\\textbf{Figure 3}}$ of the rebuttal PDF file. This demonstrates that our GS-Hider is a universal steganography framework, not limited to specific 3DGS methods.\n\n  | Method             | $\\text{PSNR}_S$ | $\\text{SSIM}_S$ | $\\text{LPIPS}_S$ | $\\text{PSNR}_M$ | $\\text{SSIM}_M$ | $\\text{LPIPS}_M$ |\n  | ------------------ | ------ | ------ | ------- | ------ | ------ | ------- |\n  | Mip-Splatting      | 27.79  | 0.83   | 0.20    | -      | -      | -       |\n  | Mip-GSHider (Ours) | 26.25  | 0.79   | 0.24    | 25.26  | 0.76   | 0.34    |", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "yGeycbX34I", "reviewer": "Reviewer_koxG", "summary": "The paper \"GS-Hider: Hiding Messages into 3D Gaussian Splatting\" proposes a steganography framework for 3D Gaussian Splatting (3DGS). GS-Hider embeds messages into 3D scenes by replacing spherical harmonics coefficients with a secured feature attribute and uses decoders to extract hidden and original scenes without compromising quality. Unlike traditional NeRF methods, 3DGS offers explicit 3D representation and real-time rendering. Experiments show GS-Hider maintains high fidelity, security, and robustness, making it suitable for copyright protection, encrypted communication, and 3D asset compression.", "questions": "I am curious about the scenario where an eavesdropper, let's say Eve, downloads Alice's publicly available model, renders it, and then trains her own GS. The purpose of Alice's steganography in Fig. 1 is to verify that the \"Table\" GS corresponds to her. However, if Eve can train her own \"Table\" GS, it seems Alice may not be able to protect her \"Table\" GS effectively. Could you please clarify how this concern is addressed?", "limitations": "Please refer to the questions.", "rating": 6, "confidence": 2, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. Innovative Steganography Framework for 3DGS:\nGS-Hider is the first framework designed specifically for 3D Gaussian Splatting, allowing for the embedding and extraction of hidden messages within 3D scenes without compromising their fidelity and rendering quality.\n\n2. Robust Security and High Fidelity:\nThe framework introduces a coupled secured feature attribute and parallel decoders, ensuring the secure and accurate extraction of hidden messages while minimally altering the original 3DGS structure, maintaining high fidelity of the rendered scenes.", "weaknesses": "The authors discussed the limitations of their approach, which appear to be relatively minor.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your valuable comments! If there are any additional comments to be added, please continue the discussion with us.\n\n> **Weakness #1:  Minor Limitations.** \n\nDue to limited space, we only discussed the limitations of our method in terms of rendering quality and speed in the supplementary material. We will delve deeper into these two aspects, provide additional insights, and introduce our potential improvements. Our limitations are reorganized as follows.\n\n- **Compromised rendering quality:** Since the feature attribute $\\boldsymbol{f}_i$ does not consider view-dependency compared to spherical harmonics, and we need to hide the secret scene while representing the original scene, our rendering quality is somewhat inferior to the original 3DGS. In fact, we inevitably need to make a trade-off between rendering quality and steganography capacity.  However, **our GS-Hider is a universal framework that can be integrated with the latest 3DGS variants**, such as Mip-splatting [1], to enhance rendering performance. Details can be found in the response to **Weakness #2** of reviewer S9BH. Meanwhile, the current designs of the scene and message decoder are relatively simple. Integrating more efficient neural rendering and decoding designs (such as Scaffold-GS [2]) can also help improve the overall rendering quality of the framework.\n- **Decreased rendering speed:**  Due to the rasterization of high-dimensional features and the use of network decoding, although we can still achieve real-time rendering, the rendering speed has decreased compared to the original 3DGS. However, we can easily improve rendering speed by **pruning Gaussian points, reducing the dimension of feature attributes $\\boldsymbol{f}_i$, and decreasing the number of convolution layers or feature kernels**. As shown in $\\textcolor{red}{\\textbf{Table 1}}$ of the rebuttal PDF, these approaches do not significantly impact rendering quality.\n\n\n\n> **Question #1:  How to resist Eve's re-rendering?**\n\nThank you for presenting such an interesting scenario. If Eve re-renders a GS using Alice's trained model, our copyright protection still holds for the following reasons:\n\n- First, if Eve re-renders a GS, he cannot decode any pre-embedded copyright image or secret scene from it, making Eve's GS unauthorized. Therefore, Eve cannot prove that he owns the copyright of this GS, and the ownership of this GS model still belongs to Alice.\n- Second, our GS-Hider works in conjunction with an online copyright database. When Alice uploads her model, the copyright image is registered in the database. If a similar GS scene is encountered later, the decoded copyright image must be matched with the one in the database. Otherwise, it will be judged as infringement.\n- Third, the cost of re-training a GS is high. Eve would need to spend almost the same computational resources as Alice to steal such a 3D scene, which is difficult for the average thief to achieve.\n\n> **Reference**\n\n[1] Mip-Splatting: Alias-free 3D gaussian splatting, in CVPR 2024.\n\n[2] Scaffold-gs: Structured 3d gaussians for view-adaptive rendering, in CVPR 2024.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "pVxlxrI17Y", "reviewer": "Reviewer_crVb", "summary": "This paper presents GS-Hider, a novel framework for steganography in 3D Gaussian Splatting (3DGS) models. The key innovation is a coupled secured feature attribute that replaces the original spherical harmonics coefficients, allowing the embedding of hidden 3D scenes or images into the original scene without compromising rendering quality. The framework uses a scene decoder and a message decoder to disentangle the original and hidden information. The authors demonstrate the effectiveness of GS-Hider across various experiments, showing its ability to hide multiple 3D scenes or single images while maintaining high fidelity, security, and robustness.", "questions": "Main issues that could be considered in rebuttal：\n* what's the added inference time overhead due to using the scene decoder?\n* the fps metrics for all experiments, so that we can see the impact on the practical usage. If the rendering speed is affected, the improvement about privacy is not useful.\n* try to prove that the hidden scene is not simply memorized by the decoder. maybe trying to memory more than one hidden scenes or curating a general decoder that can be applied to not only one scene can be convincing\n\nOther issues:\nplease see the weakness", "limitations": "The authors provide a brief discussion of limitations in Section B of the appendix, acknowledging issues such as the lack of view-dependency and slightly reduced rendering quality. They also mention future work directions, including enhancing model expressiveness and extending to tasks like tampering detection. However, this discussion could be expanded to more thoroughly address potential failure modes or edge cases of the proposed method.\n\nThe broader impacts section (A.2) touches on both positive applications (e.g., copyright protection) and potential risks (sensitive data concerns). However, a more in-depth exploration of potential misuse scenarios and mitigation strategies would strengthen the paper's ethical considerations.", "rating": 6, "confidence": 5, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "Novelty: GS-Hider presents the attempt at steganography for 3D Gaussian Splatting, addressing an important challenge in protecting 3D assets.\nTechnical innovation: The coupled secured feature attribute and parallel decoder architecture effectively balance security, fidelity, and computational efficiency.\nVersatility: The method can hide both 3D scenes and 2D images, demonstrating flexibility for various applications.\nComprehensive evaluation: The authors provide extensive experiments on fidelity, security, robustness, and capacity, comparing against baselines and ablation studies.\nReal-time capability: Despite the additional complexity, the method maintains near real-time rendering speeds (45 fps), which is crucial for practical applications.", "weaknesses": "Main weakness:\n* The main weakness is the additional computational overhead introduced by using the scene decoder. Gaussian splatting significantly simplifies the neural rendering paradigm of NeRF into a point vector + rasterization approach, achieving very fast rendering - this is one of the most valued aspects of GS. However, the introduction of the scene decoder greatly undermines this advantage. This makes such an improvement meaningless. I am confident in this inference because the authors do not seem to report any FPS-related metrics, nor do they compare the FPS increase with the original 3DGS.\n* The decoder is trained per scene, rather than being a generalizable decoder, which suggests it may be \"memorizing\" scene watermarks. This can be inferred from the issues involved in training a decoder for each scene and hiding only a single scene per scene. At the same time, the geometrically inconsistent signals present in the cover scene and hidden scene are well accommodated together, further indicating that the signals are to some extent being \"memorized\" in the decoder. Therefore, I speculate that the capacity of the decoder is not small. This further corroborates the aforementioned weakness.\n\nSome other weakness:\n* While the empirical results are strong, there's a lack of theoretical justification for why the coupled feature representation works so well.\n* Comparison to recent work: The paper could benefit from comparing against more recent steganography methods, particularly those designed for other 3D representations that might be adaptable to 3DGS.\n* Generalization: The experiments are limited to a single dataset (Mip-NeRF360). It would be valuable to see how the method performs on a wider range of 3D scenes and different types of hidden information.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your constructive comments! If there are any additional comments to be added, please continue the discussion with us.\n\n$\\textcolor{red}{\\textbf{The supplementary rebuttal PDF file can be found at the bottom of the overall response}}$.\n\n> **Weakness #1, Question #1 and Question #2:  Additional computational overhead.**\n\n- We kindly remind the reviewer that we have already provided the rendering time of each scene in our $\\textcolor{red}{\\textbf{Table 2}}$ of the main paper and presented the FPS of our GS-Hider in $\\textcolor{red}{\\textbf{Line 236}}$. It achieves 45 FPS rendering speed, which surpasses the real-time rendering requirement of 30 FPS. Meanwhile, the added inference time of scene decoder (5 Conv layers) is only $\\textcolor{red}{\\textbf{0.006s}}$, only accounts for $\\textcolor{red}{\\textbf{0.006/0.0222=27}}$% of the total rendering time. \n\n- The rendering speed of GS-Hider can be **further improved by adjusting some hyperparameters**, such as reducing the number of convolutions in the scene decoder ($N$) and the dimension of feature attributes ($M$), sequentially pruning Gaussian points in ascending order of Gaussian’s opacity. We report the FPS of GS-Hider under different settings and compare it with the original 3DGS on the $\\textcolor{red}{\\textbf{Table 1}}$ of the rebuttal PDF. The FPS of our lightest GS-Hider ($M=8, N=5$) reaches $\\textcolor{red}{\\textbf{71.429}}$ and is comparable to the original 3DGS with an acceptable rendering quality. \n\n  \n\n> **Weakness #2 and Question #3:  Prove the hidden scene is not memorized by the decoder.** \n\n- We have conducted experiments of hiding two hidden scenes, as detailed in $\\textcolor{red}{\\textbf{Section 4.6}}$ of the main paper. This proves that our decoder is not storing or memorizing the secret information. \n\n- Our message decoder is very lightweight with only $\\textcolor{red}{\\textbf{5}}$ convolution layers. It only contains $\\textcolor{red}{\\textbf{0.465 M}}$ parameters, which is far from enough to memorize complex 3D scenes. In fact, the geometrical and structural information is mainly embedded in the coupled feature, and the role of the decoder is merely to $\\textcolor{red}{\\textbf{extract and decouple the secret information}}$, not to memorize the scene watermark.\n\n- To show the role of our decoder, we further input the rendered coupled feature from another scene like 'playroom' to the message decoder that is trained to hide the scene 'bicycle'. The results are presented in $\\textcolor{red}{\\textbf{Figure 4}}$ of the rebuttal PDF.  We find that the rendered scene retains most of the geometric structure of the 'playroom' scene, with only some colors resembling those of the 'bicycle' scene. This indicates that our decoder itself does not have the capability to memorize secret information.\n\n  \n> **Weakness #3:  A lack of theoretical justification for why the coupled feature works.** \n\n- The reason of the coupled feature representation works so well is that the feature attribute $\\boldsymbol{f}_i$ has sufficient capacity and high flexibility. Combined with our decoder and designed loss function, it can effectively fuse two scenes, and hide secret information in some visually insensitive areas and the redundant feature channels. More analysis can be found in our response to the **Question #1** of reviewer X8jQ.\n- Considering the black-box nature of deep learning, thoroughly analyzing the process of embedding information into high-dimensional features, and providing theoretical proof is an open, challenging, and interesting issue. We appreciate your valuable suggestions and will leave this for future work.\n\n\n\n> **Weakness #4:  Comparison to recent work.** \n\nAccording to your valuable suggestion, we have tried our best to migrate the pipeline and decoding network of StegaNerf [1] to the 3DGS steganography task. Specifically, we feed the output of 3DGS to the decoding network of StegaNerf and let it approximate the hidden 3D scene. The results are reported on $\\textcolor{red}{\\textbf{Table 2}}$ of the rebuttal PDF. We find that GS-Hider is much better than 3DGS+StegaNeRF in the reconstruction quality of hidden scenes. If you find other comparison methods suitable for 3DGS steganography, please let us know and we will compare them accordingly.\n\n\n\n> **Weakness #5: Generalization to other datasets and hidden information.**\n\n- **Different dataset:** We have supplemented the experiments on two datasets, namely Tank&Template and Deep Blending, on $\\textcolor{red}{\\textbf{Table 3}}$ and $\\textcolor{red}{\\textbf{Figure 5}}$ of the rebuttal PDF. For Tank&Template, we hide the scene 'bicycle' into the two original scenes. For Deep Blending, we insert and hide the 'lego' and 'hotdog' in the Nerf synthetic dataset to the original scenes. It can be found that our GS-Hider can still achieve good results on these two datasets.  \n\n- **Different type:** Our GS-Hider can support hiding scenes or a copyright image in our main paper. It can also be applied to hide bits or audio since they can also be treated as a special image. We will realize it in our future work.\n\n  \n\n> **Limitations and broader impacts** \n\n- We have reorganized the limitations of our approach and potential improvements in depth in our response to **Weakness #1** of reviewer koxG.\n\n- Our GS-Hider needs to be used in conjunction with an online copyright protection platform to record the exclusive copyrights of different users and scenarios to prevent copyright conflicts. Meanwhile, GS-Hider can be combined with key technology for further protection to prevent users from abusing our models and sensitive data.\n\n> **Reference**\n\n[1] Steganerf: Embedding invisible information within neural radiance fields, in ICCV 2023.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:
We sincerely appreciate all the constructive comments from the reviewers! Below is our brief overall response.

> **First, we are very honored to receive recognition from all the reviewers for various aspects of our work.**

- All reviewers have acknowledged the **soundness, presentation, contribution, and effectiveness** of our GS-Hider.
- All reviewers have recognized the **innovation** of GS-Hider in 3DGS steganography and consider it an interesting and important work.

> **Second, we would like to emphasize the value and contribution of our work.**

- GS-Hider is **the first attempt** at 3DGS steganography, which can be applied to the encrypted transmission and copyright protection of 3D assets,  serving as inspiration for the future development of 3DGS steganography.
- GS-Hider presents **unique advantages** in security, privacy, robustness, and versatility, while having acceptable rendering quality and real-time rendering speed.

> **Third, we have tried our best to address all of the concerns raised by reviewers and added detailed analysis.**

- Regarding concerns on rendering speed raised by reviewer X8jQ and crVb, we list the added inference time by the scene decoder, present the comparison between GS-hider under different settings and original 3DGS, and give **potential improvement** methods. 
- We realize **a variant of GS-Hider based on Mip-splatting**, **supplement the experiments on other datasets**, and **compare with more methods** to make our paper more comprehensive and rigorous.
- We further analyze why the coupled feature representation is effective, explore the limitations of our approach, and clarify some application scenarios.

We sincerely thank all the reviewers for their suggestions to improve our paper and kindly request the reviewers to thoroughly consider the value and contribution of our work. The additional experiments and analyses will be added to the final version of the paper. The detailed rebuttals for each reviewer can be found below.

Additionally, we have attached a $\textcolor{red}{\textbf{PDF}}$ file containing some figures and tables for the reviewers' reference.

Meta-review: Before rebuttal most of the reviewers have concerns on the computational cost, etc. After rebuttal, all reviewers agreed that authors resolved their concern and the final rating of this paper is 1 strong accept and 3 weak accept. So AC decision to accept this paper.
Decision: Accept (poster)