# IW-NeRF: Using Implicit Watermarks to Protect the Copyright of Neural Radiation Fields
## 5 Experiments
### The Robustness of the Model  
In practical scenarios, the vulnerability of our model to malicious attacks necessitates an assessment of the robustness of our watermarking scheme against various model alterations. To evaluate the resilience of our algorithm, we employed two common modifications. Model pruning is a vital technique, especially for MLP networks known for their robust fitting capabilities but often burdened with numerous parameters due to deep network layers and high neuron counts. The abundance of parameters not only escalates computational demands in deep learning but also presents an opportunity for optimization through pruning. The primary objective of network pruning is to reduce redundant parameters while preserving the original network's performance. Our experiments encompassed L\({}_{1}\) unstructured pruning, L\({}_{n}\) structured pruning, random structured pruning, and random unstructured pruning methods. During the pruning process, the parameter with the minimum absolute pruning rate p% (ranging from 10% to 90%) was set to 0 for the NeRF model embedded with watermarks. Subsequently, we compared the extracted watermark information postpruning with the prepruning data to assess its impact on our watermark framework. Ideally, a model thief aims to render the extracted watermark information inaccurate postpruning while retaining the model's performance. Figures 12 and 13 illustrate the influence of pruning rates on watermark extraction performance under various pruning methodologies. Notably, even with L\({}_{1}\) unstructured pruning removing 90% of parameters, our embedding method demonstrated high accuracy in watermark extraction (with an SSIM value of 0.8829 between the extracted and original watermark information). Conversely, L\({}_{n}\) structured pruning, random structured pruning, and random unstructured pruning methods exhibited a significant reduction in extracted watermark quality beyond a 10% pruning rate. However, while these pruning methods may compromise watermark quality, they also detrimentally impact the model's performance, rendering the stolen model ineffective. Thus, our watermark algorithm exhibits robustness against pruning modifications, ensuring that any attempts to maintain the model's quality post-theft come at the cost of significantly reduced model performance. \begin{table}
\begin{tabular}{l l l l l l} \hline Expansion Rate & 2.60 & 3.00 & 3.40 & 3.80 & 4.20 \\ \hline PSNR & 20.94 & 21.58 & 23.21 & 24.34 & 25.66 \\ \hline \end{tabular}
\end{table} 
Table 4: After modifying the number of layers in the carrier network, we download the PSNR value between the rendered image and the real image of the body network with different expansion rates. Figure 12: The effect of different pruning methods on watermark extraction. Model fine-tuning is a crucial aspect in the context of large-scale NeRF models. Training such models from scratch demands a substantial training dataset, and the lack of adequate data can impact model performance. Hence, in practical scenarios, fine-tuning existing models becomes a more feasible approach when data scarcity is a concern. Typically, fine-tuning is preferred when there is minimal variance in experimental performance between the original dataset and the dataset trained using a pretrained model. Consequently, for potential plagiarists, employing fine-tuning methods to train a new model based on the stolen model with limited training data becomes a viable strategy. This new model not only mirrors the performance of the original model but also diverges in experimental outcomes from the original model. In our experimental setup, each dataset underwent a partitioning of the test data into two segments: the first half facilitated the fine-tuning of the trained NeRF model, while the second half served to evaluate the performance of the newly derived model. Subsequently, we utilized the fine-tuned model to assess the resilience of our watermark scheme against modifications induced by the fine-tuning process.