# IW-NeRF: Using Implicit Watermarks to Protect the Copyright of Neural Radiation Fields
## 5 Experiments
### Security Assessment  
Contrary to discrete representations, implicit neural representations introduce uncertainty, leading to varied weight distributions for each dataset across rendering and watermark extraction processes. To assess the algorithm's security, we conducted a comprehensive statistical analysis and visual examination of the weight distributions within the watermark network model and the carrier network post-watermark embedding. The watermark network comprised 10 layers, while the carrier network featured 22 layers. By comparing the corresponding layers' weights in both networks, we observed distinct differences. Visualization techniques were employed to juxtapose the weights of networks with equivalent layer numbers in the watermark and carrier networks, depicted in Figure 14. The disparity in weight distributions between the watermark and carrier networks was evident, signifying the successful incorporation of watermark network parameters into the carrier network.  
Within our watermarking framework, the pivotal role of the key in extracting watermark information underscores the need for a comprehensive evaluation of key sensitivity. Analogous to cryptographic protocols, the correct key serves  
Figure 14: Comparison of weight visualization between watermark network and carrier network.  
\begin{table}
\begin{tabular}{l c c c c} \hline \hline
**Dataset** & **Hot Dog** & **Lego** & **Fern** & **Flower** \\ \hline PSNR (dB) & 46.34 & 45.28 & 44.57 & 46.13 \\ SSIM & 0.9843 & 0.9789 & 0.9648 & 0.9881 \\ \hline \hline \end{tabular}
\end{table}
Table 5: The watermark extraction effect on different datasets after model fine-tuning.  
which copyright stakeholders can access the embedded watermark data. In contrast to traditional cryptography, the performance of neural networks in extracting watermarks is subject to various influencing factors, including network topology, training datasets, parameter configurations, and optimization strategies, which may introduce performance variability. From an experimental standpoint, the fundamental criterion lies in the successful extraction of the watermark using the correct key, as even minor deviations in the key could result in extraction failures. Figure 15 showcases the average peak signal-to-noise ratio (PSNR) values between the original watermark and the extracted watermark across diverse datasets, highlighting the impact of varying error bits within the 2180-sized key. Additionally, Figure 16 visually demonstrates the consequences of erroneous key bits on the output quality of the extracted watermark network, showcasing a rapid decline in PSNR values as the number of incorrect key bits escalates, leading to perceptible image blurring. This observation underscores the sensitivity of the watermark extraction process to even minor alterations in the key. For individuals lacking direct access to the key, resorting to guesswork may introduce errors, with approximately 50% of incorrect key bits resulting in failed watermark extraction attempts. Future endeavors will focus on refining key generation methodologies to bolster the security of the watermarking scheme.