# IW-NeRF: Using Implicit Watermarks to Protect the Copyright of Neural Radiation Fields
## 5 Experiments  
### Experimental Settings  
**Dataset. ** We assessed our algorithm using the NeRF Semantic and LLFF datasets sourced from the NeRF dataset. The LLFF dataset encompasses diverse scenes such as flowers, ferns, fortresses, and rooms, while the NeRF Semantic dataset features 360-degree scenes like LEGO structures, drums, and chairs. For evaluating the efficacy of our approach within the NeRF Semantic dataset, akin to a NeRF [1], our training regimen involves feeding in 100 views per scene. To gauge the visual fidelity of our methodology, we handpicked 20 images per scene from the test dataset. Furthermore, we conducted renders of 200 views for each scene to validate the watermark extraction precision across varying camera angles. Our comprehensive experimental methodology entails presenting all outcomes as averaged results for clarity and consistency. **Implicit neural representation setting. ** Our approach was implemented utilizing PyTorch, and both the watermark information and carrier network were structured employing an MLP network design. We employed 12 hidden layers of size 128 to encode the watermark information and 22 hidden layers of size 256 for the carrier network. The hyperparameters used include a learning rate of \(5\times 10^{-4}\), a batch size of 512, utilization of the Adam optimizer with default values of \(\beta_{1}=0.9\), \(\beta_{2}=0.999\), and regularization parameter \(\lambda=1\times 10^{-8}\). The experiments were conducted on an NVIDIA A100 GPU, with training of both the watermark network and carrier network executed using a stochastic gradient descent algorithm over 20,000 epochs. **Baselines. ** To the best of our knowledge, there exists limited research on watermarking specifically tailored for NeRF applications. Thus, we conducted a comparative analysis with established watermarking techniques adapted for NeRF to ensure a comprehensive evaluation: (1) LSB [6] + NeRF: here, we employed the LSB algorithm to embed watermark data into the dataset images before NeRF model training; (2) DeepStega [37] + NeRF: preceding NeRF model training, we leveraged the two-dimensional watermarking approach of DeepStega for image processing; (3) HiDDeN [19] + NeRF: prior to NeRF model training, the image underwent processing utilizing the HiDDeN scheme; (4) StegaNeRF [13]; and (5) CopyNeRF [14]. **Distortion evaluation metric. ** In order to evaluate the distortion between the carrier data and the carrier data containing watermarks, as well as the distortion between the watermark data and the extracted watermark data, we visualized the implicitly represented data and used several evaluation metrics. For 2D images rendered from 3D models, we evaluate them using peak signal-to-noise ratio (PSNR), structural similarity (SSIM), and perceived loss (LPIPS). (1) PSNR (peak signal-to-noise ratio). PSNR is an indicator used to evaluate image quality based on the concept of root mean square error (MSE), which represents the peak signal-to-noise ratio of image signals. The higher the PSNR value, the better the quality of the evaluated image and the smaller the error. The calculation methods for MSE and PSNR are shown in Equations (8) and (9), respectively. \[\text{MSE}=\frac{1}{W\times H}\sum\limits_{i=1}^{W}\sum\limits_{j=1}^{H}{(X_{i, j}-Y_{i,j})}^{2} \tag{8}\]  
\[\text{PSNR}=20\times\lg(sc)-10\times\lg(\text{MSE}) \tag{9}\]  
In the formulas, \(X\) and \(Y\) represent two images with a size of \(\text{W}\times\text{H}\), respectively, and sc represents the scaling factor, usually taken as 2. (2) SSIM (structural similarity). SSIM is a metric that evaluates image quality by measuring the similarity between two images, with higher values indicating higher similarity. The calculation method of SSIM is shown in Equation (10).