{"id":"2fe889d3-ed73-4f5a-9fcb-7f819ba2f375","arxiv_id":"2412.05695","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"A universal watermarking method that fine-tunes 3DGS parameters against a pre-trained image decoder, extracting ownership messages from rendered views and remaining robust to point-cloud noise, dropout, and cropping.","lead":"WATER-GS embeds invisible digital watermarks into 3D Gaussian Splatting models by fine-tuning their parameters against a fixed image decoder, so every rendered 2D view carries the owner's signature. It adds synthetic point-cloud distortions during training and reports under 5% bit error on clean scenes and under 30% on distorted ones.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The headline robustness gain is measured on the same distortion types and strengths used as training augmentations, so the claimed 20% improvement may reflect training/test distribution match rather than robustness to real-world distortions.","rationale":"Reader's weakest_assumption was decoder transfer from COCO images to 3DGS renderings; the clean-image BER results (3.26% on LLFF, 9.22% on Mip-NeRF360, 6.30% on Tanks&Temples in Table 1) actually provide reasonable evidence that this transfer works, so I do not treat it as the most load-bearing issue. Instead, the advertised robustness improvement is more central and more vulnerable: it is measured under the exact distortions used as training augmentation. This is a test-distribution leak, not an internal inconsistency. It does not refute the method; it means the robustness claim needs out-of-distribution evaluation before adoption. The reader's CONDITIONAL verdict already requires more robustness/generalization evidence; my concern sharpens the specific condition (test distortions must differ from training distortions) but does not change the verdict. No code or error bars are provided, which further limits verification, but the concrete test above would settle the main question.","tokens_in":14192,"tokens_out":9195,"duration_ms":97032,"concrete_test":"Re-run Table 3 evaluation on held-out viewpoints with distortion parameters not used in training: Gaussian noise on xyz with sigma in {0.02, 0.05, 0.1}, Dropout/Crop with p in {20%, 40%}, and one unseen distortion such as 8-bit quantization of SH coefficients. If BER remains below ~10% across all settings, the robustness claim stands; if BER jumps above ~25% at sigma=0.02 or at quantization, the 20% improvement is specific to the training distortion parameters and the 'robust to real-world distortions' claim is not supported.","verdict_should_be":"UNCHANGED","load_bearing_attack":"WATER-GS's central robustness claim is the 20.76% accuracy improvement from the 3D distortion layers (Section 4.4, Table 3). But the evaluation protocol is confounded: the same three operations used for training augmentation (Gaussian noise on xyz with sigma=0.01, Dropout p=10%, Crop p=10%, Appendix A.1) are exactly the distortions used at test time (Tables 1 and 3). Low BER under these conditions therefore shows the model has learned to be invariant to the specific augmentation family, not that it is robust to the broader class of 'common real-world distortions of point cloud data' claimed in the abstract and Section 3.2. The paper reports no evaluation at unseen distortion severities (e.g., sigma=0.02/0.05, p=20%/50%) and no unseen distortion types (e.g., SH-coefficient quantization or spatially correlated point loss). Because the 20% improvement is the paper's key quantitative contribution, this train/test overlap is the most load-bearing weakness: if BER degrades sharply just outside the training augmentation range, the robustness advantage is largely an artifact of matching the test noise to the training noise.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes WATER-GS, a method for embedding imperceptible watermarks into 3D Gaussian Splatting (3DGS) scenes. A HiDDeN-style decoder is pre-trained on COCO; then, for each scene, the 3DGS parameters are fine-tuned so that rendered images from arbitrary viewpoints decode to a fixed binary message. To improve robustness, the authors insert 3D distortion layers (Gaussian noise, dropout, and cropping of Gaussian primitives) during fine-tuning. The method is evaluated on LLFF, Mip-NeRF360, and Tanks&Temples, reporting low bit error rates (e.g., 3.26% on clean LLFF renderings) and high extraction accuracy after distortions, with a 20.76 percentage-point improvement in accuracy under Gaussian noise on LLFF. Ablations examine embedding positions, bit lengths, and adaptation to 2DGS and Compact3D variants.","tokens_in":14435,"tokens_out":6471,"duration_ms":55417,"significance":"If validated, this is one of the first watermarking methods for 3DGS and demonstrates a workable principle: treating a pre-trained decoder as a fixed target and optimizing the explicit 3DGS parameters to satisfy it achieves extractable, content-preserving watermarks. The paper includes useful ablations and shows adaptability to 2DGS and a compression pipeline. However, the central robustness claim is weakened by the test-time distortions exactly matching the training augmentations, the CopyRNeRF comparison lacks controlled bit lengths, and all results are reported without variance or multi-seed analysis. With additional experiments at unseen distortion levels, the method's generality could be established more firmly.","major_comments":[{"comment":"The evaluation of robustness is confounded by the fact that the test distortions are identical to the training augmentations. Algorithm 1 and Appendix A.1 set Gaussian noise σ=0.01, Dropout p=10%, and Crop p=10%; Table 3 evaluates exactly these same strengths. The reported 20.76 percentage-point improvement in accuracy (74.38% to 95.14%) under Gaussian noise therefore shows that the model became invariant to that specific augmentation family, but it does not support the abstract and Section 3.2's claim of robustness against 'common real-world distortions of point cloud data.' Please evaluate at unseen severities (e.g., σ=0.02/0.05, p=20%/50%) and at unseen distortion types (e.g., quantization of SH coefficients, spatially correlated point removal) and report the results.","section":"Section 3.2 / Appendix A.1 / Table 3"},{"comment":"The Introduction states that 'the watermark extraction accuracy can reach 95% across various distortions,' but Table 1 shows that under Gaussian noise, Tanks&Temples has BER 29.11% (70.89% accuracy) and Mip-NeRF360 has BER 20.77% (79.23% accuracy). The 95% figure holds only for the LLFF GN case (accuracy 95.14%), not 'across various distortions' or across all datasets. Please qualify the claim per dataset and per distortion, or restrict the statement to the LLFF results that support it.","section":"Introduction / Table 1"},{"comment":"The comparison with CopyRNeRF is not fully controlled. The text says experiments were run 'under optimal settings for CopyRNeRF using 16-bit messages,' but Table 2 does not state the bit length used for the WATER-GS rows. From Appendix B, the 16-bit LLFF BER for WATER-GS is 2.83, matching the 'Ours' row; if that row is indeed 16-bit, then the subsequent claim that '48 bits represents the upper bound capacity' for CopyRNeRF is not substantiated by any reported experiment. Please state the bit length in Table 2, include the 48-bit CopyRNeRF result (or remove the capacity claim), and ensure the row labels make the comparison unambiguous.","section":"Section 4.3 / Table 2"},{"comment":"No error bars or statistical significance tests are provided; each table reports a single number. Given that the key quantitative claim (e.g., the 20.76% accuracy improvement) could be within run-to-run variation, please report means and standard deviations over at least multiple decoder initializations, multiple random watermark messages, and multiple scene subsets. Also state the number of scenes per dataset used for each average, since Table 1 says 'averaged on the selected dataset scenes' without specifying how many or which scenes.","section":"Section 4.1 / Tables 1-5"}],"minor_comments":[{"comment":"The caption contains a typo: 'Distorstion layers' should be 'Distortion layers.'","section":"Figure 3 caption"},{"comment":"The description of the Gaussian Noise layer is inconsistent: Section 3.2 says it 'applies a Gaussian kernel with width σ to blur Θ,' while Appendix A.1 says 'we add noise to position parameters xyz, the kernel width σ is set to 0.01.' Clarify whether the layer blurs, adds independent noise, or does something else to the parameters.","section":"Section 3.2 / Appendix A.1"},{"comment":"The transition from the FNN formulation in Eq. (5), where Ico is a cover image, to Algorithm 1, where the cover is a 3DGS-rendered image, is not explicitly explained. Please add a sentence connecting the 2D steganography analogy to the 3D fine-tuning procedure.","section":"Equation (5) / Algorithm 1"},{"comment":"Table 2's formatting is confusing: the columns list 'PSNR ↑ SSIM ↑ LPIPS ↓' and rows show values like '22.77 / 1.64 ↓' without clearly indicating which number is the absolute metric and which is the change relative to raw 3DGS. Please format the table to make the reported values and deltas explicit.","section":"Table 2"},{"comment":"The phrase '20% improvement in accuracy rate' should specify that this is a percentage-point improvement (74.38% to 95.14%), not a relative improvement; similarly, Section 4.4 uses '20.76%' as a percentage-point gain. Clarify to avoid misinterpretation.","section":"Abstract / Section 4.4"},{"comment":"The '1nd, 2nd and 3rd orders' should be corrected to '1st, 2nd and 3rd.' Also, the claim that 'increasing watermark bits has minimal impact on extraction accuracy' is not fully supported by Tables 7-9: for Mip-NeRF360 the BER increases from 8.88% at 8 bits to 12.22% at 48 bits, a non-negligible change that is not discussed.","section":"Section 4.4 / Appendix B"},{"comment":"The decoder training is described as 300 epochs on COCO with 256×256 crops, but no batch size, optimizer, learning rate, or message length during pretraining is specified. Please add these details, and state whether the code will be released for reproducibility.","section":"Appendix A.1"}],"recommendation":"major_revision","confidential_remarks":null},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short version: this is the first watermarking method for 3DGS that I know of, and the core trick—fine-tuning the Gaussian parameters against a fixed image decoder so every rendering carries the message—is clean and works in their tests. The robustness number they headline is weaker than it looks, though, because the test distortions are the same operations and strengths used as training augmentations. The paper needs another round of evaluation before I'd fully trust the generalization claims.\n\nWhat's genuinely new: nobody else has treated the 3DGS model itself as the watermark encoder. The universal decoder is pre-trained on COCO and frozen, so there's no circularity. The 3D distortion layers (Gaussian noise on positions, dropout, crop) are a sensible adaptation of standard augmentation to point clouds. The two naive baselines—watermarking training images and concatenating messages with SH coefficients—both fail, which is an informative negative result and justifies the design choice.\n\nWhere it's soft: the main evidence for robustness is Table 3, where distortion layers drop BER under Gaussian noise from 25.6% to 4.9%. But the training noise is exactly Gaussian sigma=0.01, dropout 10%, crop 10%—the same values used at test time. That measures whether the model memorized the augmentation family, not whether it survives unseen distortions or severities. No tests at sigma=0.02/0.05 or p=20%/50%, and no unseen types like quantization or correlated point loss. So the '20% improvement' is real but its scope is narrower than the abstract claims. Also, the CopyRNeRF comparison is apples-to-oranges: 16-bit messages for them vs 48-bit for you. Quality-wise, the paper says 'imperceptible,' but the numbers show a 2-3 dB PSNR drop and LPIPS increases up to 0.26 in some settings; that's visible on close inspection. No error bars, no code release, single random seed presumably—so the 3.26% BER could be cherry-picked. The method is adaptable to 2DGS and compression variants, which is nice, but those results also show larger quality loss.\n\nBottom line: the central embedding mechanism is sound and the first-mover contribution is real. The robustness story needs a more honest evaluation with unseen distortions and severity sweeps. I'd send it to review—it deserves referee time—but I'd ask for those experiments before acceptance. A careful reader in watermarking or 3D asset protection will get value from the core idea.","headline":"First 3DGS watermarking method with a clean core idea; the headline robustness gain is largely a training/test augmentation overlap artifact, so the paper needs a more general evaluation before its claims hold.","tokens_in":14976,"tokens_out":2966,"would_cite":true,"duration_ms":27605,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"WATER-GS claims that a fixed pre-trained decoder plus 3D distortion layers can embed an invisible watermark into 3D Gaussian Splatting models, recoverable from any rendered viewpoint.","keywords":["3D Gaussian Splatting","watermarking","copyright protection","digital watermark","point cloud distortion","robustness","neural rendering","3DGS"],"falsifier":"Render a WATER-GS-watermarked model from a viewpoint using a 3D distortion stronger than the training strengths, for example Gaussian noise with \\(\\$\\sigma$\\) larger than 0.01 or a 30 percent point drop, then measure the Bit Error Rate of the extracted 48-bit message; if the BER approaches 50 percent, which is random guessing, the claimed robustness does not generalize beyond the trained distortion strengths, whereas staying below 5 percent would confirm the mechanism.","tokens_in":14006,"feed_emoji":"🔒","tokens_out":8649,"duration_ms":74043,"temperature":0.7,"pith_summary":"This paper argues that 3D Gaussian Splatting models can be watermarked without changing the 3DGS format or adding an explicit encoder: the creator fine-tunes the model's existing Gaussian parameters so that every rendered image, from any viewpoint, carries the same binary message, extractable by a fixed pre-trained decoder. The point is copyright protection: because users consume 3D scenes through 2D renderings, embedding the message in the parameters and recovering it from any rendering gives creators a practical way to prove ownership of a 3DGS asset. The paper backs this with experiments showing bit error rates around 3 to 9 percent on clean renderings of standard scene benchmarks, and with the proposed distortion layers the BER on the LLFF set stays near 5 percent under noise, dropout, and crop distortions, although larger outdoor scenes show higher rates. It also shows the same recipe transfers to 2D Gaussian Splatting and to a compressed 3DGS format.","feed_headline":"Fine-tuned Gaussians carry a hidden copyright message in every view","feed_subtitle":"A fixed decoder plus 3D distortion layers lets creators watermark 3DGS scenes while keeping render quality high.","key_machinery":"The load-bearing object is a fixed, pre-trained convolutional watermark decoder \\(D\\) that maps a rendered image to a binary message, together with the 3D distortion layers \\(\\mathcal{N}\\) applied to the Gaussian parameters before rendering. The decoder is trained once on ordinary natural images in an end-to-end encoder-decoder setup, then frozen; during watermark embedding, gradient descent on the 3DGS parameters (against the message loss \\(L_m = \\mathrm{BCE}(m, D(\\tilde{I}))\\) and the rendering-quality loss \\(L_{\\text{rgb}}\\)) treats the 3DGS rasterization pipeline as the encoder, so the model learns to render watermarked images without any explicit watermark encoder. The distortion layers \\(\\mathcal{N} = \\{\\text{Identity}, \\text{Gaussian Noise}, \\text{Dropout}, \\text{Crop}\\}\\) perturb the point cloud during training, which is what makes extraction robust to realistic file distortions; the paper's rendering equation shows that pixel colors are $\\alpha$-composed from projected Gaussians, so these parameter perturbations propagate into every rendered view.","core_discovery":"The central claim is that the original 3DGS generative network can itself act as a watermark encoder. WATER-GS does this by fixing a pre-trained watermark decoder, then fine-tuning the full set of 3DGS parameters \\(\\Theta = \\{\\mu, s, r, \\$\\alpha$, h\\}\\) (positions, scales, rotations, opacities, and spherical-harmonic colors) with the rendering loss plus a binary cross-entropy message loss, optionally masking which parameters are updated. A message \\(m\\) is embedded implicitly across the whole model, so the same 48-bit string is recoverable from any rendered viewpoint. To survive real-world file tampering, the fine-tuning applies 3D distortion layers, namely identity, Gaussian noise, dropout, and crop, to the Gaussians before rendering, teaching the model to keep the message extractable even when the point cloud itself is corrupted. The paper reports that on the LLFF scenes, without these layers Gaussian noise pushes BER to 25.62 percent, while with them it drops to 4.86 percent, and that naive alternatives, embedding in training images or concatenating messages with attributes, either fail to survive rendering or destroy visual quality.","pith_inferences":["Editorial inference: if the watermark is a global perturbation pattern learned by the decoder, the same scheme may also survive downstream re-rendering transformations such as resolution changes or relighting, but WATER-GS only tests point-cloud distortions and not such render-level attacks, so this is an open question.","Editorial inference: a determined adversary could re-optimize a clean 3DGS from the watermarked renderings, a distillation attack, which would likely remove the watermark; the paper does not evaluate ownership verification under retraining, only robustness to local file distortions.","Editorial inference: scenes that look very different from natural photographs may require a decoder fine-tuned on that domain; a useful test would be measuring BER on stylised, night-time, or non-photorealistic 3D scenes.","Editorial inference: the per-view consistency of the embedded message could be exploited as a fingerprint channel, with different messages per viewpoint, but that would need joint optimization and a decoder that distinguishes viewpoints, neither of which is tested."],"forward_implications":["A creator can publish one watermarked 3DGS file and prove ownership from any 2D screenshot taken at a new viewpoint, because the message is embedded across all parameters rather than in one location.","Distortion-aware fine-tuning makes the watermark survive point-dropout, cropping, and Gaussian noise on the 3D model, with BER below 5 percent on the LLFF scenes in the paper's ablations, up from roughly 12 to 25 percent without the distortion layers.","The recipe is pipeline-agnostic: plugging the same decoder into 2D Gaussian Splatting or a compact compressed 3DGS variant yields extracted messages with BER near 8 to 10 percent, so watermarking does not have to be re-designed for each new splatting framework.","Because capacity is implicit, increasing the watermark from 8 to 48 bits does not degrade extraction accuracy much, making the method suitable for carrying meaningful identifiers rather than a single bit."],"supporting_citations":[{"why":"Supplies the original 3DGS representation and rendering equations that WATER-GS fine-tunes.","marker":"Kerbl et al., 2023"},{"why":"Provides the decoder network architecture and end-to-end training framework that WATER-GS adapts as the universal decoder.","marker":"Zhu et al., 2018"},{"why":"Introduces the fixed-neural-network steganography idea of treating the generative model as an encoder via fine-tuning against a fixed decoder.","marker":"Kishore et al., 2021"},{"why":"Is the NeRF watermarking baseline, CopyRNeRF, that WATER-GS compares against and extends to explicit 3DGS representations.","marker":"Luo et al., 2023b"},{"why":"Provides the natural-image dataset used to train the universal watermark decoder.","marker":"Lin et al., 2014"},{"why":"Supplies the Compact3D compression framework used to test adaption of WATER-GS to compressed 3DGS.","marker":"Lee et al., 2024"},{"why":"Provides the 2D Gaussian Splatting variant used to demonstrate that WATER-GS transfers beyond the original 3DGS pipeline.","marker":"Huang et al., 2024a"}],"fun_headline_variants":["Watermark 3DGS by fine-tuning Gaussians as encoders","Hidden 48-bit message in every 3DGS render","Robust invisible watermarks for 3DGS without quality loss","Turn Gaussian splatting itself into a watermark encoder","Universal watermarking for 3DGS: robust to distortions"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that a watermark decoder trained only on ordinary natural images can recognize watermarks in the renderings of any 3D scene once the scene's Gaussian points are fine-tuned, and that this holds across arbitrary viewpoints and distortions; if that transfer fails, extraction collapses.","fun_headline_variants_meta":{"raw":{"variants":["Watermark 3DGS by fine-tuning Gaussians as encoders","Hidden 48-bit message in every 3DGS render","Robust invisible watermarks for 3DGS without quality loss","Turn Gaussian splatting itself into a watermark encoder","Universal watermarking for 3DGS: robust to distortions"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.001196,"raw_usage":{"total_tokens":4980,"prompt_tokens":1040,"completion_tokens":3940,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":656,"completion_tokens_details":{"reasoning_tokens":3853}},"tokens_in":656,"tokens_out":3940,"duration_ms":22440,"temperature":1.0,"reasoning_tokens":3853,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T20:25:56.158902+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Render a WATER-GS-watermarked model from a viewpoint using a 3D distortion stronger than the training strengths, for example Gaussian noise with \\(\\$\\sigma$\\) larger than 0.01 or a 30 percent point drop, then measure the Bit Error Rate of the extracted 48-bit message; if the BER approaches 50 percent, which is random guessing, the claimed robustness does not generalize beyond the trained distortion strengths, whereas staying below 5 percent would confirm the mechanism.","supporting_citations":[],"review_version":1}