GaussianMarker: Uncertainty-Aware Copyright Protection of 3D Gaussian Splatting

Authors: xiufeng  huang
ruiqi  li
yiu-ming  cheung
ka chun cheung
simon  see
renjie  wan
Venue: NeurIPS_cc_2024_Conference
Published: 2024-05-10 06:13:22

Abstract: 3D Gaussian Splatting (3DGS) has become a crucial method for acquiring 3D assets. To protect the copyright of these assets, digital watermarking techniques can be applied to embed ownership information discreetly within 3DGS mod- els. However, existing watermarking methods for meshes, point clouds, and implicit radiance fields cannot be directly applied to 3DGS models, as 3DGS models use explicit 3D Gaussians with distinct structures and do not rely on neural networks. Naively embedding the watermark on a pre-trained 3DGS can cause obvious distortion in rendered images. In our work, we propose an uncertainty- based method that constrains the perturbation of model parameters to achieve invisible watermarking for 3DGS. At the message decoding stage, the copyright messages can be reliably extracted from both 3D Gaussians and 2D rendered im- ages even under various forms of 3D and 2D distortions. We conduct extensive experiments on the Blender, LLFF, and MipNeRF-360 datasets to validate the effectiveness of our proposed method, demonstrating state-of-the-art performance on both message decoding accuracy and view synthesis quality.

Main paper: 
 introduction: 
 3DGS [1] has introduced a new category of 3D assets that can be readily created and extensively distributed online [2] . However, the ownership of these created 3D assets can be vulnerable if malicious users distribute and manipulate the 3DGS without authorization. How can we effectively protect the ownership of those created 3DGS models? 3DGS represents the scene via 3D Gaussian parameters, which can be standardized into point cloud formats. Such formats can be easily shared and show strong compatibility with the mainstream 3D assets processing pipeline [3] . However, unauthorized users can exploit this convenience to distribute 3DGS models and maliciously alter the 3D Gaussian parameters. These unauthorized 3DGS models can then be easily used to produce 2D images. Since ownership of 3DGS models can be compromised through unauthorized manipulations of 3D Gaussian parameters and 2D images, an effective ownership solution should enable owners to assert their rights over both the 3D Gaussian parameters and the corresponding 2D images.Similar to copyright protection for digital assets such as videos and images, protecting copyright for 3DGS models can be achieved via digital watermarking. Aligned with the established principles in digital watermarking [4, 5] , effective copyright protection methods for 3DGS models should satisfy Figure 1 : Our proposed scenario for copyright protection over the 3DGS assets. Once users have created 3DGS assets, they can apply our proposed 3DGS watermarking method to create watermarked 3DGS models. If unauthorized users maliciously apply 3D editing or different volume splatting settings on the watermarked 3DGS model, the 3DGS model owners can reliably retrieve the copyright message from the altered 3D Gaussian parameters or rendered 2D images to verify ownership.two key standards. First, they should maintain invisibility, ensuring that the embedded copyright messages do not cause significant distortion in both 3D Gaussian parameters and the rendered 2D images. Second, they should exhibit robustness, enabling reliable extraction of the copyright messages even under various 2D or 3D distortions.Although several methods [4, 6] have been investigated to protect the copyright of radiance fields, these methods are specifically designed for Neural Radiance Field (NeRF) [7] , a framework known for its implicit property. For example, CopyRNeRF [4] embeds copyright messages via multilayer perceptrons (MLPs) into the implicit neural parameters in NeRF [7] and extracts the copyright messages from rendered 2D images. However, embedding messages into 3D Gaussian parameters via MLPs can easily undermine the 3D Gaussian positions and lead to noticeable geometry distortions in the rendered images, thereby degrading the invisibility. Additionally, since current copyright solutions for NeRF can only extract messages from rendered images, 3DGS model owners lack approaches to directly extract ownership messages from the 3D Gaussian parameters. This hinders the direct assertion of ownership over 3DGS model, thereby undermining the robustness.Rather than directly embedding the copyright messages into the 3D Gaussian parameters, we propose an uncertainty-aware watermarking method to optimize the embedded copyright messages. We apply Laplace approximation to estimate the uncertainty [8] in the radiance fields for determining how large we can add perturbations to different 3D Gaussian parameters. From a Bayesian inference perspective [9] , 3D Gaussian parameters with high uncertainty can tolerate larger perturbations. Thus, we keep the original 3D Gaussian parameters unchanged and densify 3D Gaussian parameters with high uncertainty. These newly densified 3D Gaussians are regarded as the perturbations for embedding copyright messages. Such perturbations can be transmitted into rendered 2D images with unperceivable distortion, which ensures invisibility.To ensure robust copyright message extraction on both 3D Gaussian parameters and rendered 2D images, we utilize both 3D and 2D message decoders. The 3D message decoder extracts the copyright messages on the 3D Gaussian parameters based on a PointNet [10] architecture. The 2D message decoder based on the image watermarking method HiDDeN [11] extracts the copyright messages on rendered 2D images. We incorporate 3D and 2D distortion layers into our training process to ensure robustness of copyright message extraction against various malicious manipulations. The 3D distortion layer is designed to defend against malicious 3D editing, such as noise, translation, rotation, and cropping. Meanwhile, the 2D distortion layer is designed to withstand significant degradation in the rendered images, such as noise, JPEG compression, scaling, and blurring.Our whole framework is shown in Figure 2 , we estimate the uncertainty for the 3DGS model to add perturbations to different 3D Gaussian parameters. Then, we keep the original 3D Gaussian parameters unchanged and densify 3D Gaussian parameters with high uncertainty. These newly densified 3D Gaussians are regarded as the perturbations for embedding copyright messages and can be verified via 3D Gaussian parameters and 2D images. Our contribution can be summarized as follows:• A novel method to help claim the ownership of 3D Gaussian Splatting models.• A uncertainty-aware message embedding strategy to incorporate 3D perturbations into selected 3D Gaussian parameters to achieve invisibility.• The copyright messages can be extracted from both 3D Gaussian parameters and rendered 2D images, showing robustness to different 3D and 2D distortions.2 Related works 3D Gaussian Splatting. 3DGS has been rapidly adopted across multiple domains and has demonstrated remarkable results. Unlike NeRF [7] and its variants [12] [13] [14] reply on the implicit neural representation (INR) to reconstruction the 3D scene, 3DGS [1] has an explicit point cloud structure and has been expanded to various developments and applications. Mip-Splatting [15] utilizes a 3D smoothing filter and a 2D Mip filter to address frequency constraints for effective anti-aliasing. Dynamic 3DGS [16] represents the dynamic motion of the scene by processing the center location and rotation of each Gaussian over time, which enables dense non-rigid 6-DOF tracking of the entire scene. SuGar [17] reconstructs the mesh surface with a regularization term for the Gaussian Splatting optimization to promote alignment of the Gaussians with the scene's surface. 3DGS avatar [18] is a brand-new way to create digital humans compared with traditional methods based on 3D human meshes such as SMPL [19] . With the rapid development of point-based 3D Gaussian rendering, it is necessary to develop an efficient copyright protection method for 3DGS [1] models.2D digital watermarking. Traditional 2D watermarking methods typically embed information in the least significant bits (LSB) of image pixels [20] . Other advanced methods encode information into the frequency domains based on the Discrete Wavelet Transform (DWT) and Singular Value Decomposition (SVD) [21, 22] . Deep-learning [23] [24] [25] [26] has made significant progress in image watermarking [27] [28] [29] [30] [31] [32] [33] . HiDDeN [11] is one of the first deep image watermarking methods that outperformed traditional methods. RedMark [5] introduces scalable residual connections for embedding binary images in any transform domain. Robustness is a critical requirement for watermarking, ensuring resilience against various distortions and even adversarial attacks [34, 35] . Deep-learning-based watermarking methods have emerged as a crucial component in video copyright protection [5, 28, 36] , such as RivaGAN [36] , which utilizes an attention-based mechanism for embedding hidden messages in videos. However, the 2D digital watermarking methods for images or videos can differ significantly from 3D digital watermarking methods for explicit 3D models.3D digital watermarking. Most 3D digital watermarking approaches are designed for explicit 3D models [37] [38] [39] [40] [41] . For example, Deep 3D-to-2D [41] can embed messages in 3D meshes [38, 42] and retrieve them from 2D rendered views [43] . Recently, several 3D digital watermarking approaches [4, 6, 44, 45] have emerged for NeRF [7] to watermark the implicit neural representation (INR) and extract the hidden information from the rendered images. CopyRNeRF [4] generates watermarked color representations to ensure the invisibility of hidden copyright messages. StegaNeRF [6] designs an optimization framework for steganographic information embedding in NeRF renderings. However, both explicit 3D watermarking [37, 38, 41] and NeRF watermarking approaches [4, 6] are not applicable for 3DGS to simultaneously protect the explicit 3D Gaussians and the 2D rendered images. This motivates us to develop digital watermarking for 3DGS models. 
limitations: 
 Question: Does the paper discuss the limitations of the work performed by the authors? Answer: [Yes] Justification: We create a "Limitation" section in the Conclusion to discuss the limitations of our work. Guidelines:• The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper. • The authors are encouraged to create a separate "Limitations" section in their paper.• The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be. • The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on a few datasets or with a few runs. In general, empirical results often depend on implicit assumptions, which should be articulated. • The authors should reflect on the factors that influence the performance of the approach.For example, a facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or a speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon. • The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size. • If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness. • While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an important role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations. 
preliminary of 3d gaussian splatting: 
 Starting from a sparse set of Structure-from-Motion (SfM) [46] points, the goal of 3DGS [1] is to optimize a scene representation that enables high-quality novel view synthesis. The scene is modeled as a collection of 3D Gaussians:EQUATIONwhere x is any positions in the 3D scene, µ is the 3D Gaussian center position, and Σ is the 3D Gaussian covariance matrix. By utilizing a scaling matrix S and rotation matrix R, we can determine the corresponding Σ = RSS T R T and ensure Σ is positive semi-definite. The 3D Gaussians need to be further projected to 2D Gaussians for rendering by volume splatting [47] method. During rendering, 3DGS follows a typical neural point-based approach [48] to compute the color C of a pixel by blending N depth ordered points:EQUATIONwhere c i is the color estimated by the spherical harmonics (SH) coefficients of each Gaussian, and α i is given by evaluating a 2D Gaussian with covariance Σ ′ [49] multiplied with a per-point opacity. Consequently, the 3D Gaussians G contain parameters θ including five different properties {µ, R, S, c, α} to represent a 3D scene.Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof? Justification: We discuss the societal impact in the conclusion and supplementary. Guidelines:• The answer NA means that there is no societal impact of the work performed.• If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact. • Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations. • The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster. • The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology. • If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML). 
proposed method: 
 Our scenario is shown in Figure 1 . We propose embedding copyright messages into 3D Gaussian parameters to protect the copyright of 3DGS models. These messages can be extracted from both the 3D Gaussian parameters and the rendered 2D images. The proposed uncertainty-aware watermarking method can claim ownership over both 3D and 2D assets derived from 3DGS models. As mentioned in Section 1, an effective watermarking algorithm for 3DGS models should achieve both invisibility in rendered novel views, and robustness in decoded messages, via the optimization goal of:EQUATION)where I is the rendered novel view, Î is the ground truth image, D is the message decoder and M is the copyright message. We can use appropriate distance metrics d 1 and d 2 to estimate and minimize the error in rendered views and decoded messages. A straightforward method could be embedding the copyright messages as perturbations into the 3D Gaussian parameters. However, directly embedding perturbations into 3D Gaussian parameters without constraints can easily undermine the position and geometry of 3D Gaussians and cause obvious distortion in the rendered images. To solve this issue, we propose an uncertainty-aware perturbation strategy to embed copyright messages, as illustrated below.Estimating the uncertainty of Gaussian parameters. To ensure the invisibility of embedded messages in both the 3D and 2D domains, we allow only a subset of the 3D Gaussian parameters where ownership messages can be embedded. Specifically, as previous works [9] have already shown that the Gaussian parameters with high uncertainty are more tolerant to external perturbations, we select parameters with high uncertainty to incorporate ownership messages. If we estimate the model parameter posterior p(θ|D), where θ is the model parameters of the 3D Gaussians model G and D is the training dataset, then the predictive distribution p(I|V, D) can be computed by marginalize over the model posterior:EQUATIONwhere I is rendered image at a test view V. In this inference integration, for a converged model, parameters θ * with larger uncertainty quantified by posterior variance can tolerate greater perturbation. Therefore, we densify only the parameters above an uncertainty threshold τ unc to add perturbations for less impacting the rendered images. Laplace approximation provides an analytical expression for a posterior distribution in the form of a Gaussian distribution with the mean equal to the maximum a posterior (MAP) estimation θ = θ * [50] , and the covariance equal to the reciprocal of observed Fisher information: p(θ|D) ∼ N (θ * , Γ). Thus, the uncertainty of the 3DGS parameters can be estimated by the Hessian matrix H [I | V, θ * ] as the approximated Fisher information [51] :EQUATIONwhere f (V; θ * ) is the rendered image with the converged 3D Gaussians parameters θ * at view V and ∇ 2 f (V;θ * ) H [I | f (V; θ * )] = 1 as we assume the covariance of RGB in images is equal to one [8] . Hence, the Hessian matrix can be simplified as: The overview of our proposed uncertainty-aware 3DGS watermarking. We apply uncertainty estimation to the created 3DGS model. The 3D Gaussians with high uncertainty will be densified. These new densified Gaussians will be regarded as the 3D perturbations and embedded into the original Gaussians to create watermarked 3D Gaussians. The copyright messages can be retrieved from the watermarked 3D Gaussians via the 3d message decoder under various 3D editing. The copyright messages can also be retrieved from the watermarked images via the 2D message decoder against various 2D distortions.H [I | V, θ * ] = ∇ θ f (V; θ * ) T ∇ θ f (V; θ * ).As Fisher Information is additive, we compute the model uncertainty U by summing the Hessians of model parameters across all different views in the training dataset D:EQUATIONwhere i is the index and N is the total samples in D, and all Gaussian parameters are used to calculate the uncertainty of the 3DGS model:H [I | V, θ * ] = H I | V, θ * µ +H [I | V, θ * R ]+H [I | V, θ * S ]+ H [I | V, θ * c ] + H [I | V, θ * α ]. GaussianMarker.As shown in Figure 2 , we demonstrate the overall framework of our proposed uncertainty-aware 3DGS watermarking, aka GaussianMarker. By leveraging the quantified uncertainty U of the created 3DGS model, we can effectively distinguish between parameters that are resilient to perturbations and those that are vulnerable. Parameters exhibiting low uncertainty are identified as highly sensitive to perturbations. Conversely, parameters characterized by high uncertainty are more tolerant to perturbations, implying that perturbations can be embedded in these areas with negligible impact on the quality of the final rendered images. By targeting 3D Gaussians with high uncertainty, we can incorporate effective 3D perturbations that remain detectable by our designated message decoders, and maintain invisibility on the 3D Gaussians and rendered images. To achieve this, we retain the integrity of the original 3D Gaussians, denoted as G. We then densify those 3D Gaussians with high uncertainty. The new densified Gaussians are regarded as the perturbations G for copyright message embedding:EQUATIONwhere g(G i ) is the densified Gaussian with the densify function g(•) on the i th Gaussian G i by random sampling new position μi under the distribution μi ∼ N (µ i , Σ i ) and other Gaussian parameters are cloned, U i is the uncertainty of G i , and τ unc is the threshold for uncertainty. We compute the average uncertainty value of all original 3D Gaussians G as the default uncertainty threshold: τ unc = U/L, where L is the total number of the 3D Gaussians in G 2 . We dub G as our proposed GaussianMarker for embedding the copyright messages. Similar to image watermarking methods apply 2D perturbation on the cover images, we directly embed GaussianMarker G into the original Gaussians G to compose the watermarked Gaussians Ĝ = G ∪ G. Under the position sampling distribution of μi ∼ N (µ i , Σ i ), GaussianMarker G have a subtle geometry difference with the GaussianMarker Difference (x10) Original 3DGSWatermarked 3DGSFigure 3 : Visualization of the results obtained by our proposed approach. For each row, we display the original rendered image, the watermarked rendered image, the difference (×10) between the watermarked and original rendered images, and our proposed GaussianMarker as 3D perturbations for copyright message embedding. The scalings of GaussianMarker are adjusted for better visualization.We provide more visualization examples in the supplementary material.original Gaussians G. Moreover, GaussianMarker Ĝ can be effectively transmitted into the rendered images based on the point-based rendering in Equation ( 2). We optimize GaussianMarker Ĝ in the Section 4.3 so that such 3D perturbations can be effectively detected by both 2D and 3D message decoders. In Figure 3 , we present visualization results, which demonstrate its capability to embed copyright messages as imperceptible 3D perturbations.2D message decoder for rendered images. We select the classical HiDDeN [11] as the 2D message decoder D χ to retrieve copyright messages from the rendered 2D images. The HiDDeN [11] encoder takes a cover image x o and a binary message M with length N b as the inputs. The HiDDeN [11] decoder outputs a residual image of the same size as 2D perturbation applied on the original image to produce a watermarked image x w = x o + δ. Specifically, we first pre-train HiDDeN [11] encoder and decoder to obtain a comprehensive understanding of image watermark embedding and extraction processes. During training, similar to the settings in HiDDeN [11] for the robustness at the image level, we apply several types of 2D distortions including Gaussian noise, random rotation, random cropping, and JPEG compression. After training, the HiDDeN [11] encoder and the adversarial network are discarded. We then use this pre-trained HiDDeN decoder to optimize our GaussianMarker G mentioned in Section 4.3.3D message decoder for 3D Gaussians. The inherent complexity of the implicit neural representation in NeRF [7] presents significant challenges for copyright message extraction directly from the neural network parameters. On the contrary, 3DGS [1] represents the 3D scene by 3D Gaussian parameters with an explicit geometry. Traditional 3D watermarking embeds and retrieves messages from 3D meshes. The deep learning-based 3D watermarking methods utilize networks such as PointNet [10] to enhance the message embedding process in 3D meshes [41] . Although 3D Gaussians have different geometrical representations from the 3D meshes, the PointNet [10] architectures can be easily adapted to 3D Gaussians by regarding the 3D Gaussian mean µ as the point position and other parameters as the associated point features. Thus, we adopt the PointNet [10] as our 3D message decoder D ψ to retrieve copyright messages from the watermarked 3D Gaussians Ĝ. In specific, we randomly sample a subset Gaussians (from 10k to 50k) from the watermarked Gaissians Ĝ and treat these selected Gaussians as watermarked points P w . A PointNet-like 3D message decoder D ψ is used to decode the copyright message M from these watermarked points as M = D ψ (P w ). Similarly, we also randomly sample a same number subset Gaussians on the original Gaussians G and treat these selected Gaussians as original points P o . A PointNet-like discriminator D ξ is used to distinguish the original points P o and the watermarked points P w . The 3D message decoder D ψ uses a PointNet [10] architecture, with a modified fully connected layer to predict the copyright messages. The 3D discriminator D ξ also uses a PointNet [10] architecture with a fully connected output layer for binary classification.Our optimization contains two phases. In the first phase, we distill the watermarking knowledge from the 2D message decoder to the embedded GaussianMarker G for predicting copyright messages on rendered 2D images. In the second phase, we optimize the 3D message decoder with the watermarked Gaussians Ĝ for predicting copyright messages on 3D Gaussian parameters.Distilling watermarking knowledge. We keep the original 3D Gaussians G unchanged, and optimize the embedded GaussianMarker G via teacher-student knowledge distillation. As discussed in [52] , the pre-trained feature from 2D space can be distilled to the 3D space. Thus, we use the pre-trained 2D message decoder D χ as the teacher network to distill watermarking knowledge from the 2D perturbation on images to the 3D perturbation in GaussianMarker G. During the optimization for the embedded GaussianMarker G, the copyright messages can be decoded from the watermarked image I w via the 2D message decoder D χ as M = D χ (I w ), where M is the copyright messages decoded by D χ , and I w is rendered by the watermarked Gaussians Ĝ. We compute binary cross entropy (BCE) between the original message M and the decoded message M as the message loss L msg to ensure watermarking capability:EQUATIONWe also use the photometric loss L rec = ∥I w -I o ∥ 2 2 between the watermarked image I w and the original images I o for multi-view consistency. We combine the L msg and L rec into the final 2D watermarking loss L 2D = λ 1 L msg + λ 2 L rec , where λ 1 , λ 2 are the weights for adapting the losses.Optimizing 3D message decoder. Once the embedded GaussianMarker G is optimized, we proceed to train the 3D message decoder D ψ with the watermarked Gaussians Ĝ. To make our 3D message decoding robust to different 3D distortions, we add a 3D distortion layer T during the 3D message decoder optimization. Several commonly used 3D distortions are used: 1) additive random Gaussian noise with parameter σ; 2) random axis-angle rotation with parameter r; 3) random translation with parameter t; and 4) random cropout with parameter cr. The copyright messages M′ can be decoded from the randomly selected watermarked points P w from the watermarked Gaussians Ĝ via the 3D message decoder D ψ as M′ = D ϕ (T (P w )). We compute the BCE between the original message M and extracted message M′ as the 3D message lossL msg ′ = -(M log( M′ ) + (1 -M) log(1 - M′ )). We also apply the adversarial loss L adv to optimize the 3D discriminator D ξ for classifying the original points P o and watermarked points P w :EQUATIONWe combine L msg ′ and L adv into the final 3D watermarking lossL 3D = λ ′ 1 L msg ′ + λ ′ 2 L adv , where λ ′ 1 , λ ′ 2are the weights for adapting the losses. 
experimental settings: 
 Dataset. We use three benchmark datasets for evaluation: Blender [7] (8 detailed synthetic objects), LLFF [53] (9 real-world scenes), and Mip-NeRF360 [54] (9 real-world scenes). For Blender [7] , we directly follow the dataset splitting to use 100 viewpoints for training and 200 views for testing. For LLFF [53] , we follow the dataset splitting in NeRF [7] . In general, 1/8 images in each scene are used for testing and others for training. For Mip-NeRF360 [54] , we use a train/test split suggested by Mip-NeRF360, taking every 8 th photo for testing and others for training. All testing viewpoints are used to compute the average values during the evaluation session.Implementation details. As our motivation is to protect the copyright of 3DGS that has already been created, we define our training into two stages. In the first stage, we create 3DGS models by training them on Blender [7] , LLFF [53] , and Mip-NeRF360 [54] datasets following standard settings [1] . We also train HiDDeN [11] to obtain the pre-trained 2D message decoder. In the second stage, we apply our proposed uncertainty-aware watermarking method to generate GaussianMarker G via Equation (7) . We then freeze the original Gaussians G and use the pre-trained 2D message decoder to supervise the training of our GaussianMarker G. We then train our 3D message decoder to retrieve the copyright message from the watermarked 3D Gaussians Ĝ. We apply several types of 2D and 3D distortion layers on the watermarked 2D images and 3D Gaussians to achieve robustness. We use the default optimization setting in 3DGS [1] to optimize our GaussianMarker G. We use the Adam optimizer [24] to optimize the 3D message decoder D ψ and classifier D ξ with default values β 1 = 0.9, β 2 = 0.999, ϵ = 10 -8 , and a learning rate 1 × 10 -4 that decays following the exponential scheduler during optimization. We set λ 1 = 10.0, λ 2 = 1.0 for 2D watermarking loss L 2D and λ Baselines. We design experiments to validate the message extraction on both rendered 2D images and 3D Gaussian parameters, demonstrating the effectiveness of our proposed method. For 2D message extraction, we compare our proposed method with four baselines for a fair comparison: 1) CopyRNeRF [4] : A state-of-the-art method for protecting the copyright of NeRF [7] by using watermarked color representation; 2) HiDDeN [11] + 3DGS [1] : Preprocessing images with the classical image watermarking method HiDDeN [11] before the training of 3DGS [1] ; 3) 3DGS with message: Creating message embedding by MLPs and concatenating the message embedding with 3D Gaussian parameters; 4) 3DGS with fine-tuning: Fine-tuning all of the 3D Gaussian parameters for embedding copyright messages. For 3D message extraction, since NeRF watermarking methods do not have explicit 3D parameters, we compare our methods with the 3DGS baselines, including HiDDeN + 3DGS, 3DGS with message, and 3DGS with fine-tuning.Evaluation methodology. We evaluate the performance of our proposed method by comparing it with other digital watermarking baselines using the standard of capacity, invisibility, and robustness for both 2D images and 3D Gaussians. For capacity, we set the bit length of copyright messages to 48 bits, aligning with the maximum length previously employed in 3D model watermarking methods [41, 4] . For invisibility, we evaluate the reconstruction quality with PSNR, SSIM, and LPIPS [55] for 2D images, and we evaluate geometry difference with the L 1 norm of position difference (L 1 Dif f ), and signal-to-noise ratio (SNR) for 3D Gaussian positions. For robustness, we evaluate whether the copyright messages in 2D images can remain consistent against various distortions, including 2D Gaussian noise, JPEG compression, scaling, and Gaussian blur. We also evaluate whether the copyright messages in 3D Gaussians can remain consistent against various 3D attacks, including 3D Gaussian noise, translation, rotation, and crop-out. Figure 4 : Comparisons between each baseline and our proposed method. We display the differences (×10) between the synthesized results and the ground truth for each method. Our proposed Gaussian-Marker demonstrates superior reconstruction quality and bit accuracy. Messages extraction with 2D images. We compare the reconstruction qualities and bit accuracies with all baselines, and the qualitative and quantitative results are shown in Figure 4 and Table 1 .CopyRNeRF [4] can limitedly extract hidden messages from the renderings and show undermined robustness to different image distortions. Although HiDDeN [11] + 3DGS [1] can achieve high reconstruction quality, it fails to extract the copyright messages from the rendered 2D images. This result is aligned with the previous method [4] and proves the message can not be transmitted from the 2D images into the 3D Gaussians. 3DGS [1] with messages directly embed copyright messages into 3D Gaussian parameters. It can retrieve the copyright message with relatively high accuracy, but the reconstruction quality is poor and shows obvious distortions in the rendered images. 3DGS [1] with fine-tuning shows better reconstruction quality, but the message extraction accuracy is limited. This is because 3D Gaussians usually contain millions of parameters, and directly fine-tuning all of the parameters without proper regularization can be less effective for message extraction. Our method can achieve both high reconstruction quality and high decoding accuracy. Even with different distortions to the rendered images, our method can still achieve high decoding accuracy to reliably safeguard the 3DGS models.Messages extraction with 3D Gaussians. We evaluate the geometry differences and the bit accuracies with all 3DGS baselines, and the results are shown in Table 2 . HiDDeN [11] + 3DGS [1] has small geometry difference, but it has limited message decoding accuracy. 3DGS with messages shows reasonable message decoding accuracy, but it displays high geometry differences. 3DGS with fine-tuning shows a relatively small geometry difference, but it struggles to decode the message.Our method has the smallest geometry difference, obtains accurate decoding accuracy, and shows robustness to different 3D attacks. Furthermore, 3DGS can be easily edited in the 3D space to influence the rendered 2D images. We conduct experiments to apply 3D attacks and then render the 2D images. As shown in Table 2 , the 3D attacks can easily fool the 2D message decoder, while our 3D message decoder is robust to such 3D attacks and can reliably extract copyright messages.Perturb low-uncertainty Gaussians. We design ablation experiments to add perturbations into 3D Gaussian parameters with low uncertainty. We show qualitative results in Figure 5 , the lowuncertainty Gaussians corresponding to the fine details in the 3D scene, such as the halyard on the ship. Adding perturbations to these areas can easily make the perturbation visible, thus undermining the image quality. We evaluate the quantitative results in Table 3 . Adding perturbations to 3D Gaussian parameters with low uncertainty can easily undermine the reconstruction quality and degrade the decoding accuracy. Our method preserves 3D Gaussians with low uncertainty, maintaining the geometric structure to ensure imperceptible perturbations and high message extraction accuracy.  
conclusion: 
 In conclusion, protecting the copyright of 3D Gaussian Splatting (3DGS) assets is crucial due to their vulnerability to unauthorized distribution and manipulation. Existing methods for copyright protection in the radiance field are not directly applicable to 3DGS. Our proposed method involves using uncertainty estimation to add invisible 3D perturbations to the 3D Gaussian parameters, ensuring both invisibility and robustness. Overall, our proposed approach introduces an effective solution with a positive societal impact on the copyright protection of the 3DGS models.Limitations. Our method is an effective technical solution for the copyright protection of 3DGS models. However, as we discussed before, our mechanism may still face threats from some malicious operations. More measures should be implemented for such malicious attacks beyond the technology. Furthermore, we will explore enhancing the robustness of GaussianMarker in dynamic 3DGS scenarios, via the motion transfer-based data augmentation approach, to maintain high bit accuracies while improving robustness [56] in future work. 
safeguards: 
 Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)? Answer: [Yes] Justification: We have described all data and models we use. Guidelines:• The answer NA means that the paper poses no such risks.• Released models that have a high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters. • Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images. • We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make a best faith effort. 12. Licenses for existing assets Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected? Answer: [Yes] Justification: We have cited all referenced code, data and models. Guidelines:• The answer NA means that the paper does not use existing assets.• The authors should cite the original paper that produced the code package or dataset.• The authors should state which version of the asset is used and, if possible, include a URL. • The name of the license (e.g., CC-BY 4.0) should be included for each asset.• For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided. • If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswithcode.com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of a dataset. • For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided. • If this information is not available online, the authors are encouraged to reach out to the asset's creators. 
new assets: 
 Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?Answer: [NA] Justification: Our work does not release new assets. Guidelines:• The answer NA means that the paper does not release new assets.• Researchers should communicate the details of the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc. • The paper should discuss whether and how consent was obtained from people whose asset is used. • We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution. • For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review. 
 
 Appendix: Origin Watermarked Differences (x10) GaussianMarker Original Watermarked Difference (x10) Uncertainty The uncertainty estimation in the 3DGS model inherently identifies model parameters that are more robust to perturbations, making it highly suitable for the application of invisible watermarking in 3DGS. Additionally, the HiDDeN decoder [11] , primarily focuses on decoding information along the boundary regions. As illustrated in Figure 8 , these boundary regions exhibit high uncertainty values. This observation demonstrates the correlation between uncertainty and message embedding, highlighting how areas of high uncertainty can be leveraged for effective watermarking.In our experiments, we set the average uncertainty value as the default threshold. We show more results to verify the influence of the uncertainty threshold. As shown Table 6 , we select the ship scene in the Blender dataset to study the influence of the uncertainty threshold. A lower threshold can enhance the bit accuracy, though it slightly compromises image quality. Conversely, a higher threshold results in better image quality and a more lightweight model but also slightly compromising message decoding accuracy. However, in both situations, the compromises are moderate.It is noteworthy that our method is also compatible with compressing the 3DGS model based on the uncertainty value, similar to how LightGaussian compresses 3DGS using importance values [57] . This compatibility highlights that our approach can work seamlessly with existing 3DGS model compression techniques, effectively mitigating the impact of the increasing number of 3D Gaussians in our method.Front Back Left Right Our method embeds watermarks into the 3DGS model by adding perturbations to 3D Gaussians with high uncertainty. As shown in Figure 8 , these areas cover most object boundaries in the 3DGS scene. Figure 9 further illustrates geometry consistency by displaying the incorporated perturbations. These perturbations effectively cover the scene's general geometric structure. The geometry of these perturbations remains consistent across different camera angles and can be transmitted into the rendered images, which is essential for robust extraction from different viewing angles.Synthetic datasets (Blender) 30k steps / 30mins 1k steps / 3 mins Real-world scenes (LLFF) 30k steps / 40mins 1k steps / 5 mins Real-world scenes (MipNeRF360) 30k steps / 45mins 2k steps / 10 mins We present a time analysis of our method's training efficiency in Table 7 . Compared to the original 3DGS model training, our method requires only 1,000 to 2,000 steps within a span of 10 minutes. This demonstrates that our approach is not only efficient but also practical for watermarking 3DGS models.1. Claims Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope? Answer: [Yes] Justification: The abstract and introduction include the claims in the paper. Guidelines:• The answer NA means that the abstract and introduction do not include the main claims made in the paper. • The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers. • The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings. • It is fine to include aspirational goals as motivation as long as it is clear that these goals are not attained by the paper.The influence of different uncertainty thresholds is further discussed in the supplementary materials. 


Decision: To make this decision, AC carefully read the paper, reviewers' comments and author's rebuttal.

Before rebuttal this paper got 1 borderline accept, 1 weak accept, 2 borderline rejects. After rebuttal, 2 of the reviewers raised their score, so the final rating for this paper is 1 accept, 2 borderline accepts and 1 borderline rejects. 

Before rebuttal, Reviewer fyQG raised concerns on novelty of this paper and asked for more experiment. Authors added more experiments in the rebuttal and clarified their contribution. After rebuttal Reviewer fyQG commented that authors have addressed their concerns. 

Before rebuttal, Reviewer QvjQ asked for more experiments. Authors added experiments in the rebuttal and Reviewer QvjQ was happy with that and raised the rating from weak accept to accept. 

Before rebuttal, Reviewer VdSM asked for some clarification and design details. After rebuttal, Reviewer VdSM said that authors have address their concerns and raised rating from borderline reject to borderline accept.

Before rebuttal, Reviewer BKx3 raised concerns on novelty, the decoder is trained per scene, rather than being a generalizable decoder, need more experiments on complicated scenes, etc. AC also echoed that the decoder is trained per scene might be a problem. But as authors explained that 2D decoder is not per scene, only the 3D decoder is per scene, which is acceptable. Reviewer BKx3 also raised concerns that only do bit message embedding probably not enough. But given bit message embedding is enough for the copyright projection which is an important usage for wateramarking, AC think it is acceptable. At the end Reviewer BKx3 kept borderline reject rating. 

Considering all these, AC made the accept decision.

Reviews: review: paper_summary: paper_summary: This paper proposes an uncertainty-based method to achieve watermarking for 3D Gaussian Splatting. Specifically, the Hessian matrix is used to estimate the parameter uncertainty. Then, the 3D Gaussians with high uncertainty are densified. The densified 3D Gaussians are trained to embed watermarking using a pre-trained 2D message decoder. After that, a 3D message decoder is trained using PointNet. Experimental results show that the proposed method achieves the best performance.
strength_weakness: strength_weakness: 1. One concern about this paper is its novelty. The major contribution of this paper is the introduction of uncertainty into 3D Gaussians watermarking. As the definition of uncertainty using Fisher Information comes from [42], simply using uncertainty for 3D Gaussians watermarking is quite simple and straightforward. Regarding the message decoders, they are all standard operations. HiDDeN [11] is used for the 2D message decoder, and PointNet [43] is used for the 3D message decoder. Therefore, the major contribution of the proposed method should be further justified.

2. The proposed method utilizes the 3D Gaussians with high uncertainty to embed watermarking. What if an attacker also uses this feature? The attacker could first identify the 3D Gaussians (after training/fine-tuning) with high uncertainty and then only attack these 3D Gaussians using techniques such as Noise, Translation, Rotation, or Cropout. Additionally, the attacker might delete some of the identified 3D Gaussians to compromise the 3DGS assets.

3. The influence of the parameter uncertainty threshold should be included in the experiments to assess the sensitivity of the uncertainty threshold on the proposed method. 

4. The results with different bit lengths are missing.
questions: questions: See Weakness.
limitations: limitations: The authors have adequately addressed the limitations.
paper_summary: paper_summary: The paper presents a new method for embedding digital watermarks in 3D Gaussian Splatting (3DGS) models to protect the copyright of 3D assets. Traditional watermarking techniques for mesh, point cloud, and implicit radiance fields are not suitable for 3DGS, as they can cause distortions in rendered images. The authors propose an uncertainty-based approach that constrains perturbations to the model parameters, ensuring that watermarks remain invisible while preserving visual quality. The method allows for reliable extraction of copyright messages from both 3D Gaussians and 2D rendered images, even under various distortions.
strength_weakness: strength_weakness: The malicious scenarios considered are limited to traditional distortions. \
More sophisticated scenarios should also be explored. \
For instance, a malicious actor could fine-tune the downloaded 3DGS or use an auto-encoder to remove embedded information ([1],[2],[3]). \
In such cases, how would the proposed method perform?

Additionally, a more complex scenario to consider is when a malicious actor renders Bob's 3DGS and uses it as training data to create their own 3DGS. \
How would the proposed method address these advanced threats?

[1] Fernandez et al., The Stable Signature: Rooting Watermarks in Latent Diffusion Models \
[2] Kim et al., WOUAF: Weight Modulation for User Attribution and Fingerprinting in Text-to-Image Diffusion Models \
[3] Zhao et al., Invisible Image Watermarks Are Provably Removable Using Generative AI
questions: questions: Please refer weakness.
limitations: limitations: N/A
paper_summary: paper_summary: 3D Gaussian Splatting(3DGS) has gradually become the mainstream method for acquiring 3D assets, which has led to a demand for copyright protection of 3DGS. In this paper, a watermarking method based on uncertainty called GaussianMarker is proposed. Firstly, 3DGS is partitioned based on uncertainty, and the watermark is only added to the model parameters with high uncertainty. Subsequently, the corresponding parameters are perturbed using both 2D and 3D watermark encoders, enabling the extraction of watermark information from rendered 2D images as well as directly from 3D model parameters. Experimental results demonstrate the robustness of the proposed GaussianMarker method against 2D and 3D distortions.
strength_weakness: strength_weakness: 1. The paper mentions that the calculation of uncertainty is related to the model parameters, and in 3D Gaussian, each point has multiple parameters such as $\mu, R, S, c, and \alpha$. It would be helpful if the authors could clarify which specific parameters are used in the proposed method. Additionally, the paper provides a formula for calculating model uncertainty, but it is unclear how the uncertainty of each Gaussian is computed and used for partitioning. The authors should provide further explanation or clarification on this matter.
2. The description of the densify function $g(\cdot)$ in the paper states that it randomly samples a new position from a distribution. According to my understanding, the original Gaussian $G_i$ should have been replaced. However, Figure 2 shows that the original Gaussian  $G_i$ still exists, which is confusing to me.
3. During the watermark embedding process, it is unclear whether the 2D and 3D watermarks are embedded into the same model parameters. It would be helpful if the authors could clarify which specific model parameters of the 3D Gaussian are used for embedding the watermarks.
4. In the section on "Distilling watermarking knowledge," the authors mention that "the pre-trained feature from 2D space can be distilled to the 3D space." It is important for the authors to provide an explanation of how this is achieved.
questions: questions: 1. In the experimental section, the authors present four baseline methods. How do 3DGS with message and 3DGS with fine-tuning extract messages. 
2. Four types of 3D editing methods are listed in the experiment, which parameters of 3DGS are affected by these distortions?
limitations: limitations: The authors have addressed the limitations.
paper_summary: paper_summary: This paper proposes GaussianMarker, a novel method for embedding invisible watermarks into 3D Gaussian Splatting (3DGS) models to protect their copyright. The key idea is to use uncertainty estimation to add imperceptible perturbations to 3D Gaussian parameters with high uncertainty. The method enables extraction of copyright messages from both the 3D Gaussian parameters and rendered 2D images, and demonstrates robustness to various 3D and 2D distortions. Experiments on multiple datasets show the effectiveness of the approach in terms of message decoding accuracy and visual quality preservation.
strength_weakness: strength_weakness: * The decoder is trained per scene, rather than being a generalizable decoder. This makes the watermarking process essentially impractical for real-world use. It's not feasible for people to store a separate watermark encoder and decoder for each scene for the vast number of Gaussians distributed across the internet. Reflecting on the logic of image watermarking, a single watermark encoder and decoder can encode and decode information for any cover image, so the sender and receiver only need to jointly possess one watermark decoder. This is a more reasonable setup.
* Experiments focus mostly on relatively simple scenes - more complex, dynamic scenes could be challenging
* The robustness to more sophisticated attacks (e.g. adversarial perturbations) is not explored
* Discussion of potential negative impacts of the technology could be expanded
questions: questions: My primary concern with this paper stems from a fundamental physical challenge: How can a digital watermark be embedded into the 3D Gaussian Splatting (3DGS) representation of a scene in such a way that it can be reliably decoded from any viewing direction?

The volume rendering process that converts 3DGS representations into 2D images is designed to produce geometrically consistent views based on the camera pose. However, the requirement to embed and extract a watermark from arbitrary viewpoints seems to conflict with this underlying principle.

One potential resolution to this contradiction could be as follows: Rather than directly encoding the watermark itself into the 3D representation, the method might embed a geometrically consistent signal that can be detected by a trained network D. This signal could then trigger the generation or retrieval of the actual watermark (be it an image, audio, or text), which has been memorized by the detector D during the training process.

This hypothesis aligns with the paper's description of F as a detector/classifier rather than a decoder. It also explains the need for a separate classification module to guide whether the detector should produce the stored watermark data.

However, this interpretation raises several questions:

* How does the method ensure that the embedded signal remains detectable across different viewing angles and rendering conditions?
What is the information capacity of this approach, and how does it compare to traditional digital watermarking techniques?
* How robust is the embedded signal to various forms of 3D transformations or edits to the 3DGS model?
* Is there a trade-off between the strength of the embedded signal and the visual quality of the rendered images?
limitations: limitations: The authors have included a brief limitations section that acknowledges potential vulnerabilities to malicious attacks beyond their technical solution. However, this discussion could be expanded to consider more specific limitations of the approach, such as potential challenges with very complex scenes or highly dynamic content. The societal impact is briefly mentioned, focusing on the positive aspects of copyright protection. A more thorough examination of potential negative impacts or misuse scenarios would strengthen the paper.

Comments: title: Response
Some questions
comment: Dear Reviewer BKx3,

Thank you for your feedback. We would like to state that our work is **different** from CopyRNeRF and we combine our work closely with the 3DGS. We would like to highlight our novelty to clarify our contributions. 

**1. The difference with CopyRNeRF.**

> 1. Uncertainty-based message embedding.

Firstly, our work originated from the uncertainty perspective for the Gaussian Splatting model to minimize perturbations on the 3DGS models for achieving invisible watermarking. While CopyRNeRF uses an additional color mlp layer to embed copyright messages into the NeRF model. Without considering the uncertainty, naively applying the existing watermarking strategies such as CopyRNeRF can cause noticeable distortions. We have conducted the experiment in the baseline of "3DGS with message"  which is similar to CopyRNeRF that encodes the message into the 3DGS model, which can result in noticeable artifacts and reduced bit accuracy, as demonstrated in the **main paper Table 1** and **rebuttal paper Figure 1**. 

Besides, the HiDDeN decoder mainly focuses on the decoding of information along the boundary areas. From **the left part of rebuttal Figure 2**, such boundary areas are all with high uncertainty values. This can also show the correlation between the uncertainty and the message embedding. While CopyRNeRF utilizes an additional MLP layer to embed messages into the NeRF color component, which is totally *different* from our method.

> 2. Message extraction on both 2D images and 3D Gaussians.

Our method enables copyright message extraction from both 2D images and 3D Gaussians. CopyRNeRF is limited to extracting messages from 2D-rendered images, as directly extracting messages from the neural networks in NeRF proves challenging. Consequently, owners of the 3D assets can only assert their ownership through these rendered 2D images, rather than from the underlying 3D neural representation itself. Our approach allows direct message extraction from 3D Gaussians. This provides model owners with a novel means of claiming ownership directly from their 3D assets, rather than relying solely on rendered images. This advancement offers a more robust and versatile approach to protecting the copyright of 3DGS model owners.

> 3. Training efficiency.

CopyRNeRF usually takes 70 hours for training to embed copyright messages, while our method can finished within minutes, which can ensure that our method can be generalized to novel 3D scenes and its practicality for users to easily distribute the watermarked 3DGS models online.

**2. Hiding information such as images.**

We also state during the rebuttal that our proposed 3D watermark can ensure the multi-view consistency in the **rebuttal paper Figure 5**, which can answer reviewer BKx3's concern about the physical challenge that our method can ensure the watermark information can be decoded from any camera angles.

We also discuss the potential challenge that reviewer BKx3 raised about hiding information such as images from the 3DGS scenes. Though we have to say our method is for digital watermarking, which is a different topic against information hiding, we are very willing to discuss that extending our method into the information hiding scenarios. Based on our 3D watermark being physically multi-view consistent, our watermark method can be extended into the information hiding cases. As suggested by reviewer BKx3, in such case the decoder may need to be changed into seperated ones for decoding media such as images. The information capacity relies on both the information encoding and decoding process. For message encoding, we can adjust our uncertainty threshold to strengthen the 3D perturbations for adding enough signal for the information decoding. For message decoding, we can select a decoder that contains large model parameters for feature extraction to detect the embedded signal and decode it into images.

We hope our explanation can address the concerns. We highly appreciate your suggestions, and we will incorporate your suggestions into our final paper.

Best Regards,

Authors
Thank you for your response. Overall, I still consider this method to be relatively incremental, similar to a version of CopyRNeRF [1] that replaces NeRF with Gaussian Splatting (GS). The novelty is not that clear. From my empirical understanding, GS has a weaker capacity for hiding information compared to NeRF, which makes embedding content like images more challenging than with NeRF. This is why I asked about the ablation study on information hiding capacity in my rebuttal. However, hiding string data is much less challenging. While efficiency can partially address the issue of generalizability, on the whole, I still find the work to be a bit incremental.

[1] CopyRNeRF: Protecting the CopyRight of Neural Radiance Fields
Dear Reviewer BKx3,

Our 3DGS training follows the original 3DGS paper [1], which takes 30k steps by default. In our experiments, the typical training times required for training 3DGS ranged from 30 to 45 minutes. The training time can also be found in the original 3DGS paper [1] Table. 1, and for the 30k steps model it also ranges from about 30 to 45 minutes. 

Users can also select 7k steps for faster training time, and the optimization can also finish faster since the 7k steps 3DGS model contains fewer parameters and can be trained faster. No matter whether the user uses a 7k or 30k steps 3DGS model, our method can all be applicable to these existing 3DGS models and be optimized within minutes for watermarking purposes.

[1] 3D Gaussian Splatting for Real-Time Radiance Field Rendering.

Best regards,

Authors
Thank you for your response. A quick follow-up question: why the training time you provide for 3DGS training: 30k steps / 30mins | 30k steps / 45mins is so big?
Dear Reviewer VdSM,

We sincerely thank you for your thorough review process and for raising your score. Your insightful feedback has been invaluable in improving our work, and we deeply appreciate your time and expertise. We're grateful for your positive evaluation and will incorporate your suggestions in our final paper.

Best regards,

The Authors
The authors have addressed some of my concerns. I will raise my score.
Dear Reviewer BKx3, 

Thank you very much for your thoughtful comments and for taking the time to engage in this discussion. We greatly appreciate your insights and the opportunity to clarify our work. 

We will incorporate all your valuable suggestions about the generalization ability into our final version. That would be a very interesting part for the future work in this area. As the discussion has come to its end, may we know whether our response has fully addressed your concerns? If possible, we would be very grateful if you can raise your score. 

Thanks again for your valuable feedback during the rebuttal and discussion. 

Best Regards, 

Authors
Dear Reviewer VdSM, 

Thanks very much for your constructive feedback throughout this review process. We greatly appreciate the time and effort you have put into evaluating our work and providing insightful comments and questions. 

We are grateful for your reviews on highlighting important technical details for clarification of our proposed methodology. We have provided further detailed descriptions and experiments on the uncertainty calculation and thresholding to provide more in-depth explanations of our methodology and results. We hope that our responses have adequately addressed your concerns. 

As the deadline for the discussion has come to its end, we would be very grateful if you can kindly raise your score. Thanks again for your valuable contributions to improving our paper. Your feedback has been extremely helpful, and we are grateful for your expertise and insights. 

Best regards, 

Authors
Dear Reviewer QvjQ, 

Thank you once again for your thorough review and valuable feedback throughout this process. We are deeply grateful for your recognition of our additional work and how it has enhanced the clarity and comprehensiveness of our paper. We appreciate the time and expertise you've dedicated to reviewing our submission. 

Sincerely,

Authors
Dear Reviewer fyQG,

We greatly appreciate the time and effort you have invested in evaluating our work and providing insightful comments and questions.

We want to express our thanks again for your expertise and insights. Your feedback has played a crucial role in improving our paper, and we are sincerely grateful for your dedication to the review process.

Best regards,

Authors
@Reviewer VdSM, authors provided new comments for your questions. could you please check whether they have addressed your concerns or not. thanks!
@Reviewer BKx3, authors provided new comments for your questions. could you please check whether they have addressed your concerns or not. thanks!
Thanks for your kindly reply and we are willing to further discuss about the technical details:

1. The optimizable perturbations. 

Yes, our proposed method introduces an optimizable perturbation $\tilde{\mathcal{G}}$, which is added into the original Gaussians $\mathcal{G}$ to obtain watermarked Gaussians $\hat{\mathcal{G}}$ used for the 3D scene representation. Those perturbations parameters in $\tilde{\mathcal{G}}$ are all optimized in the 2D phase, including $\mu$, $R$, $S$, $c$, and $\alpha$. In the 3D phase, we use the watermarked Gaussians $\hat{\mathcal{G}}$ (which contain the perturbations $\tilde{\mathcal{G}}$) optimized in the 2D phase for training the 3D message decoder.

2. The 2D watermark distilling.

Yes, you are correct! The watermark is added into the rendered image. Let's review the process of the 2D watermark distillation in our proposed framework. At the beginning we only have the original Gaussians $\mathcal{G}$, and after we apply our proposed uncertainty-aware perturbation based on the Equation (6) and (7), we obtain the 3D perturbations $\tilde{\mathcal{G}}$ as our proposed 3D watermark, and the final watermarked Gaussian is denoted as $\hat{\mathcal{G}} = \mathcal{G} \cup \tilde{\mathcal{G}}$. Under the supervision of the pre-trained 2D message decoder, the corresponding Gaussians parameters in $\tilde{\mathcal{G}}$ are updated using the gradient in Equation (8). When the optimization is finished, the watermarked Gaussians parameters $\hat{\mathcal{G}}$ contain the watermarking information. Those watermarks can then be transmitted into the rendered image pixels $\hat{C}$ based on the rendering defined in Equation (2). 

3. Modifying other Gaussian parameters and GaussianEditor.

Thanks for your insightful suggestions. Such robustness you mentioned is indeed a very important aspect of digital watermarking. Besides, as PointNet-based message decoder is more sensitive to geometry editing, we mainly focus on the evaluations of some operations like translation, rotation and crop-out. We further conduct experiments to edit all Gaussian attributes by adding a normalized noise $n \sim \mathcal{N}(0, \sigma)$ as random perturbations and the results are shown in the table below. The results indicate that our 3D message decoder still shown robustness when other Gaussian attributes are modified:

 Method  | None |   $c$  |    $R$  |    $S$  | $\alpha$| All ($\mu$, $c$, $R$, $S$, $\alpha$) |
| :----------: | :------: | :----: | :------: | :------: | :------: |  :-----: |
| Noise ($\sigma=0.1$) | 100% | 97.69% | 98.95%  |  98.39%  | 99.30%|   96.61% |
| Noise ($\sigma=0.5$) | 100% | 97.15% | 98.94%  |  98.13%  | 99.23%|   95.82% |

Based on your valuable suggestions, we have further tried the modifications in GaussianEditors on the MipNeRF360 flowers scene. We have considered the color-editing scenarios by adding prompt "make it blue" and "make it red". Similar to the dynamic scene situations in the rebuttal Figure 4 and Figure 5, since our distortion layers are scalable, we can achieve color robustness by adding color-jittering into the distortion layers during the 2D message decoder training. As shown in the table below, our method still keeps high bit accuracy even when the scene color is edited.

 Method  | Scene| None |  "make it blue" | "make it red" |
| :----------:| :------: |  :------: | :------: | :-----: |
| GaussianEditor | Flowers | 97.91% | 93.75% | 91.66% |

Achieving robustness in different modifications is very important. If the users have specific needs for different robustness, they can change the distortion laters to achieve higher robustness. However, it is also very difficult to cover all distortions at the same time. Making the watermarking system robust is an active research area. We will incorporate your valuable concerns and suggestions into our final version.
We are pleased to hear that our revisions have addressed your concerns. Your constructive comments help us improve the quality and robustness of our work. 

We will incorporate all your valuable suggestions into our final versions.  If you have further questions, please feel free to raise them.  We would be grateful if you could consider raising your scores. Thanks very much. 

Best Regards,

Authors
Thanks for your response, my concerns have been addressed.
Thank you for taking the time to review our revised submission. We greatly appreciate your recognition of the additional work we've incorporated and how it has enhanced the clarity and comprehensiveness of our paper.

We're pleased to hear that our revisions have addressed your concerns. Your constructive comments help us improve the quality and robustness of our work.
Thanks for pointing out this. We agree that a general encoder-decoder framework in image watermarking is indeed highly desirable. However, the unique nature of 3D neural representations presents distinctions that require a different approach when compared to image watermarking. 

In 3D neural representations, trainable parameters or networks are utilized to represent 3D scenes. This fundamental difference makes it challenging to directly apply the encoding techniques used in image watermarking to encode those parameters or networks. Consequently, some changes are necessary for watermarking neural representations.

These changes inevitably lead to certain optimizations during the message embedding for neural representations like previous CopyRNeRF for NeRF or our approach for 3DGS. We agree that this may potentially impact the generalization ability. To address this, our current strategy focuses on minimizing the time costs of the message embedding. By reducing the time required for embedding, we can partly mitigate the issues arising from these additional optimizations.

We have conducted extensive experiments here. Our results demonstrate that our method achieves significantly shorter message embedding times. However, such message embedding sometimes may need about 70 hours in established pipelines for neural representations. This improvement not only enhances efficiency but also helps to preserve the generalization capability of the watermarking technique.

| Datasets  | 3DGS training |   Our message embedding	|
| :----------| :-------------------------------: | -----: |
| Synthetic datasets (Blender) |  30k steps / 30mins  | 1k steps / 3 mins |
| Real-world scenes (LLFF) |  30k steps / 45mins |   1k steps / 5 mins  | 

Besides, we have to point out that the images used for training the 2D message decoder are all from the COCO dataset. This dataset does not have any correlations to the images used for the optimization of 3DGS models. Thus, it means that our 2D message decoder has never seen the images used for the optimization of 3DGS models, and can be used as a generalized message decoder on any novel 3D scenes.

What you mention is very insightful. We will incorporate those suggestions into the future work of our final version.
Thank you for your careful response. Combining it with the feedback from other reviewers, I still have some questions.

1. Does the watermark in question amount to introducing an optimizable perturbation in a 3D scene (a set of densify high-uncertainty Gaussians)? Regardless of the 2D or 3D phase, are all parameters of these Gaussians optimized ($\mu, R, S, c, and \alpha$)?、
2. I am unclear on how the 2D information is distilled. From my understanding, is it rendered directly from a viewpoint, then a watermark is added to the rendered image, and the corresponding Gaussian parameters are updated using gradients. Is this correct?
3. Regarding the four 3D editing methods mentioned, the authors stated that only  $\mu$ was modified. However, as per my understanding, some existing 3D Gaussian editing methods, such as Gaussianeditor[1], modify all parameters of the Gaussian. In this case, does the PointNet-based 3D message decoder proposed in this paper become ineffective?

[1] Chen, Yiwen, et al. "Gaussianeditor: Swift and controllable 3d editing with gaussian splatting." *Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition*. 2024.
Thank you for your response. Including this additional work in the revised version will significantly enhance the clarity and completeness of your paper, making it more robust and comprehensive. My concerns are now resolved, and I have decided to increase my score. Thank you for your efforts.
Dear Reviewers,

Authors have provided their rebuttal. Could you please take a look to see whether your concerns are addressed or not? Thanks!
>W1: Generalizability of decoders.
>>We agree that the generalization ability is very important for practical use. In our designs, we employ a two-layer protection approach to achieve generalizable and specific protection. We have two decoders in 2D and 3D, respectively. The 2D decoder is never trained per scene for generalization ability. In our setting, it is pre-trained and can be used across images rendered from different 3DGS models. This can provide protections for vast number of Gaussians distributed across the internet. Our second decoder is in 3D and is trained per scene. This is the second protection wall for 3D assets with more specific protection. The 3D asset owners can train their 3D decoder per scene based on the scene property. We believe such two-layer protection with both general and specific protection can make 3D assets safer.

Thank you for your insightful response. It appears that we may have a slight misunderstanding regarding the concept of generalizability. While using a common decoder to fit all previously encountered scenes is certainly feasible, this approach doesn't necessarily imply true generalization. Genuine generalization refers to the applicability of a model to unseen scenarios.

To illustrate this point, let's consider two analogous examples:
1. In 2D steganography on images, the encoder and decoder should be capable of embedding and extracting watermarks on carrier images that were not seen during training.
1. In machine learning, generalization typically refers to performance on unseen domains and data, rather than maintaining good performance across numerous seen domains.

This distinction raises an important question: How well does the proposed method perform on entirely new scenes or objects that were not part of the training set that have been seen?
True ”generalization“ in this context would involve the ability to apply the watermarking technique to novel 3D scenes or objects without requiring retraining or significant adaptation. This capability would demonstrate the robustness and versatility of the approach, making it more applicable in real-world scenarios where encountering new and diverse 3D environments is common.