{"id":"15323224-d126-4a45-b0fb-6df3a45d1322","arxiv_id":"2412.15278","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"DreaMark embeds a secret message into a text-to-3D NeRF during score distillation sampling by tuning the color field so a pretrained decoder extracts the message from camera views generated from the message.","lead":"Researchers present a way to watermark a 3D scene model while it is being generated from a text description, rather than adding the watermark after generation. The method hides a secret code in the colors of the model that can be read from specific camera angles, and it removes the window in which an unwatermarked copy exists.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The paper's central 'no non-watermarked intermediate' claim is contradicted by its own two-stage pipeline: stage 1 produces an SDS-only NeRF before watermark fine-tuning, so the promised during-generation security property does not hold as stated.","rationale":"The reader's weakest assumption targets trigger secrecy for 16-bit messages, which is a valid security concern for the final watermark. But before reaching that question, there is a more immediate, internal inconsistency in the central claim: the method's own two-stage pipeline creates a non-watermarked NeRF at the end of stage 1, contradicting the paper's stated contribution that no non-watermarked version is ever produced. This is not a matter of external consensus; it is a direct textual contradiction between the threat model in Figure 1 and the training procedure in the Proposed Method section. The reader's trigger-enumeration concern presupposes the no-intermediate claim and attacks the robustness of the watermark; my concern attacks the existence claim itself. The watermarking mechanism may still be salvageable, so I would not move to REJECT, but the authors must either redesign the pipeline to make watermark loss active from the first SDS iteration or significantly revise the central security claim. Since the reader already assigned CONDITIONAL, my concern strengthens that verdict without changing it.","tokens_in":12983,"tokens_out":6200,"duration_ms":62645,"concrete_test":"Modify the official training script to save the model at the end of stage 1 (after 40,000 SDS iterations, before the 30,000-iteration watermark fine-tuning), render the trigger viewports generated by Algorithm 1 from the same secret message, and evaluate bit accuracy with the frozen WD. If the accuracy is near chance for the same prompt (i.e., the first-stage model is non-watermarked), then the claim 'no non-watermarked version of the NeRF is ever produced' is false under the paper's own threat model, and the method's security advantage over post-generation fine-tuning must be restated or dropped.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The contribution bullets and Figure 1 claim DreaMark 'ensures that no non-watermarked version of the NeRF is ever produced,' eliminating the leakable intermediate that post-generation methods suffer. However, the method itself is two-stage: in the first stage the authors 'optimize a high-resolution NeRF (e.g., 512) by SDS (Eq.(5)) with joint optimization of both fc and fσ,' with no watermark loss; only in the second stage is fσ frozen and fc fine-tuned with Eq. (8), the combined SDS+BCE loss on trigger viewports. Therefore a fully trained, non-watermarked NeRF exists at the end of stage 1 and before stage 2. If an internal staff member (the threat model in Figure 1) can access the training process, checkpoint, or GPU memory after stage 1, they can copy a model from which the frozen decoder WD will extract no message (bit accuracy at chance). This is exactly the vulnerability the paper claims to remove. The abstract's 'during-generation' framing also understates the remaining delay: stage 2 is a 30k-iteration fine-tuning of fc with the watermark loss, conceptually similar to post-generation watermarking, just scheduled before release. This does not invalidate the watermarking mechanism, but the central claimed security advantage is not supported by the described pipeline.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes DreaMark, a method for embedding a secret message into a text-to-3D NeRF during score distillation sampling (SDS). The method first pretrains a HiDDeN-based watermark decoder, then generates a message-dependent set of trigger viewports from a SHA256 seed, and finally optimizes the NeRF with a combined SDS and BCE loss so that images rendered from trigger viewports decode to the secret message. The authors report experiments on 100 prompts, comparing bit accuracy and CLIP scores against two post-generation baselines, and evaluating robustness to image-level transformations and model-level fine-tuning and pruning. The central claims are that DreaMark is the first during-generation text-to-3D watermarking method, that no non-watermarked NeRF intermediate is ever produced, and that the watermark achieves 90+% bit accuracy without degrading generation quality.","tokens_in":13302,"tokens_out":3386,"duration_ms":33340,"significance":"If the claims were fully supported, DreaMark would be a useful contribution to NeRF copyright protection: it is architecture-agnostic, uses a single frozen decoder, and integrates watermarking into the SDS optimization loop rather than as a separate post-hoc stage. The experimental scale (100 generated scenes) is larger than prior NeRF watermarking evaluations, and the ablation on the transformation layer and on freezing the density MLP gives useful insight into why the proposed embedding works. However, the paper's headline claims are not supported by the reported pipeline and numbers: the two-stage scheme still creates a non-watermarked NeRF at the end of stage one, the abstract's '90+% accuracy' is contradicted by the 84.51% rotation result in Table 5 and the 82.59% 32-bit result in Table 1, and the trigger-viewport secrecy relies on a 16-bit message space that a white-box attacker can enumerate. The core optimization of Eq. (8) appears sound and the robustness results are suggestive, but the security and quality claims need substantial revision.","major_comments":[{"comment":"The claim that DreaMark 'ensures that no non-watermarked version of the NeRF is ever produced' is contradicted by the paper's own pipeline. In the first stage, the authors 'optimize a high-resolution NeRF (e.g., 512) by SDS (Eq.(5)) with joint optimization of both fc and fσ', which is exactly a fully trained, non-watermarked NeRF. Only in the second stage is fσ frozen and fc fine-tuned with the BCE watermark loss of Eq. (8). Thus, at the end of stage one, and during the transition to stage two, a non-watermarked NeRF exists in the training process. An internal staff member with access to the stage-one checkpoint or GPU memory can copy a model from which the decoder extracts no message. This directly undermines the main advertised advantage over post-generation methods. The authors should either redesign the method so that the watermark loss is present from the first optimization step, or substantially weaken the claim to state that the watermark is applied before release, not that no non-watermarked intermediate ever exists.","section":"Proposed Method, Two-stage Trigger Embedding; Figure 1; Contribution bullets"},{"comment":"The abstract's statement that 'the watermark achieves 90+% accuracy among both image-level attacks and model-level attacks' is not accurate for the reported experiments. Table 5 reports 84.51% bit accuracy under rotation, which is below 90%, and Table 1 reports 82.59% at 32-bit message length and 71.91% at 48-bit. The paper should state the per-condition results precisely in the abstract and introduction, or restrict the claim to the conditions where it actually holds.","section":"Abstract; Table 5; Table 1"},{"comment":"The secrecy of the trigger viewport set is a load-bearing security assumption, and the default message length makes it weak. With a 16-bit secret message, there are only 65,536 possible seeds for SHA256(m), so an attacker who knows Algorithm 1 can enumerate all candidate messages, generate each candidate trigger viewport set, render those views from the watermarked NeRF, and verify which message is embedded. The fine-tuning attack in Eq. (9) assumes 'the attacker has no prior knowledge of the secret message m,' but this assumption is not credible at 16 bits. The authors should evaluate with longer messages (e.g., 128 or 256 bits), add a keyed component to the trigger generation that is not derived solely from the message, or explicitly state and justify the threat model under which the seed space is large enough.","section":"Algorithm 1; Attacks on Dreamark's Watermarks, Model Fine-tuning"},{"comment":"The claim that DreaMark 'does not degrade generation quality' is supported only by mean CLIP scores without error bars or significance tests. In Table 2, the watermarked DreaMark CLIP/16 score (0.3218) is actually higher than the no-watermark baseline (0.3156), which is unexpected if the watermark is a fidelity cost; with only 100 prompts, this difference may not be significant. The authors should report per-prompt distributions, confidence intervals, or paired significance tests before asserting that generation quality is unaffected.","section":"Table 2; Generation quality"}],"minor_comments":[{"comment":"Equation (2) and the surrounding text state that the viewing direction d is in R2, but NeRF viewing directions are unit vectors in R3. Please correct the dimensionality.","section":"Preliminaries, NeRF"},{"comment":"The phrase 'arbitrary trigger viewport pT' is used throughout, but Algorithm 1 generates a fixed set of viewports from the message; extraction is only meaningful for viewports in that set. Please clarify the wording to avoid implying that any viewport works.","section":"Proposed Method, Choosing Trigger Embedding Media"},{"comment":"Figure 1's bottom row shows no non-watermarked intermediate, which is inconsistent with the two-stage description. Figure 3 shows 'generated non-watermarked NeRF' as a comparison, which again conflicts with the claim that no non-watermarked NeRF is ever produced. Please reconcile these figures with the actual pipeline.","section":"Figure 1 and Figure 3"},{"comment":"The watermark decoder is pretrained with 48-bit messages but evaluated at 8, 16, 32, and 48 bits. Please clarify whether the decoder is retrained or adapted for each bit length, or whether a single 48-bit decoder is used with message lengths padded/truncated; otherwise the capacity comparison may not be apples-to-apples.","section":"Implementation Details, Pretrained Watermark Extractor"},{"comment":"The description of PCA whitening applied to a linear decoder layer is brief; please provide the exact layer and how the whitening transform is computed and applied, since this step is claimed to remove bit bias.","section":"Proposed Method, Pretrain the watermark decoder"}],"recommendation":"major_revision","confidential_remarks":"The paper has a solid core idea and a reasonable experimental setup, but the main contribution claim (during-generation watermarking with no non-watermarked intermediate) is internally inconsistent with the two-stage pipeline, and the robustness/security claims are overstated. These are fixable by rewriting the claims and adding experiments with longer message keys, but as currently written the paper would mislead readers about both the security guarantee and the 90+% robustness figure. I recommend major revision."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: this is worth reading, but not as advertised. The new thing is real. DreaMark is the first attempt I know of to embed a watermark into an SDS-optimized NeRF during generation rather than post-hoc. The design is sensible: a fixed HiDDeN decoder, trigger viewports derived from the secret message, and an extra BCE term on those views during SDS. Choosing the color field over geometry is well motivated by the ablation, and the evaluation is a step up from prior NeRF watermarking work: 100 prompts instead of eight scenes, trigger-size scaling, and an ablation of the decoder transformation layer. Eq. 8 is internally sound and the core mechanism likely works.\n\nThe central security claim, however, does not hold as stated. The method is two-stage: stage 1 runs plain SDS on both fc and fsigma, and only stage 2 freezes fsigma and fine-tunes fc with the BCE watermark loss. A fully trained, non-watermarked NeRF therefore exists at the end of stage 1. The 'no non-watermarked version is ever produced' bullet, and the Figure 1 contrast, are contradicted by the paper's own pipeline. An internal attacker with access to the stage-1 checkpoint can leak exactly the leakable intermediate the paper claims to eliminate. That is not a minor wording issue; it is the headline property. A one-stage integrated loss, or a different threat model, might fix it, but the paper does not make that argument.\n\nRobustness is also overstated. The abstract's '90+% accuracy' is not true across Table 5: rotation gives 84.51%, Gaussian noise 93.75%, and the pruning attack sits around 88%. At 32 bits, Table 1 shows 82.59%. The quality claim rests on CLIP point estimates with no variance or significance test; DreaMark exceeding the no-watermark CLIP baseline by 0.006 looks like noise. The trigger-secrecy assumption is shaky too: with 16-bit messages there are only 65,536 possible seeds, and an attacker who knows Algorithm 1 can enumerate them, render the trigger views, and fine-tune against a random message. No code or data are released. Citation coverage is fine; the relevant NeRF and DNN watermarking lines are cited, and self-citation is not an issue here.\n\nNone of this kills the idea. The mechanism is coherent and the experimental effort is real. But as written, this is a solid demonstration with an overclaimed security story. A serious referee should see it, because the method is new and the evaluation is larger and more careful than prior work in this niche. The revision needs to fix the stage-1 leak, report realistic robustness numbers, and address the small key space. If the claim/pipeline mismatch is repaired, this becomes a publishable contribution; as it stands, I would treat it as conditional.","headline":"A genuinely new during-generation NeRF watermarking method with real experiments, but the paper's headline security property is contradicted by its own two-stage pipeline and the abstract overstates robustness.","tokens_in":842,"tokens_out":3361,"would_cite":true,"duration_ms":57138,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"DreaMark embeds a secret message into a neural radiance field during score distillation sampling, eliminating the clean intermediate model that post-generation watermarking leaves exposed.","keywords":["neural radiance fields","text-to-3D generation","score distillation sampling","watermarking","backdoor","copyright protection","trigger viewports","image-level attacks"],"falsifier":"Enumerate all 65,536 candidate 16-bit messages, regenerate their trigger viewport sets, render those views from a watermarked NeRF, and fine-tune the color field to decode a wrong message on all candidates; if bit accuracy drops below 90% while CLIP score stays nearly unchanged, the claimed robustness against model-level attacks fails.","tokens_in":12766,"feed_emoji":"🔏","tokens_out":9467,"duration_ms":78413,"temperature":0.7,"pith_summary":"DreaMark claims to be the first watermarking method for text-to-3D generation that embeds the secret during generation rather than after it. By adding a message-recovery loss to the score distillation sampling (SDS) loop on a small set of secret camera angles, it produces a NeRF that is watermarked from the moment it exists, so no clean intermediate model ever appears. The paper reports that the watermark reaches 98.93% bit accuracy for 16-bit messages and stays above 90% under common image distortions and model pruning, while generation quality, measured by CLIP score, is not degraded. The selling point is closing the theft window that post-generation watermarking leaves open, without changing the NeRF architecture.","feed_headline":"Bake a hidden message into a 3D scene as it is generated","feed_subtitle":"A during-generation watermark leaves no clean NeRF for thieves to steal, and survives image and model attacks.","key_machinery":"The load-bearing object is the trigger viewport backdoor: a set of camera angles generated from the secret message by seeding a pseudorandom generator with the SHA-256 hash of the message. On those viewports alone, the pre-trained frozen decoder's output is pulled toward the message by a binary cross-entropy term added to the SDS loss, while the SDS loss continues to guide generation on all other viewports. The authors backdoor only the color network $f_c$, leaving the density network $f_\\sigma$ frozen after the first SDS stage, because changing point density alters the color of every viewing direction and collapses generation quality. The decoder itself is trained with a transformation layer that applies cropping, resizing, and rotation, so robustness to image-level attacks is inherited by the generated NeRF without extra adversarial training during generation.","core_discovery":"DreaMark's central claim is that a neural radiance field generated from a text prompt can carry a verifiable secret message as an intrinsic part of the generation process. The method pre-trains a watermark decoder that maps a rendered image to a bit string, then optimizes a NeRF with two losses at once: the standard SDS loss over all viewports and a binary cross-entropy loss between the decoder's output and the target message on images rendered from a set of trigger viewports. The trigger viewports are derived deterministically from the secret message through a SHA-256-seeded pseudorandom generator, so the verifier can recreate them and an attacker who does not know the message cannot. The authors find that backdooring only the color network, after the density network has been learned in an initial SDS stage, preserves generation quality; backdooring the density network degrades every view and collapses quality. The reported result is that the watermarked NeRF matches or slightly exceeds the generation quality of a non-watermarked one while yielding 90%+ bit accuracy under image-level attacks and strong robustness to fine-tuning and pruning.","pith_inferences":["If the trigger seed were keyed by a long random secret instead of the message itself, the same scheme would support traitor tracing: each buyer could get a different viewport set while the decoder stays fixed.","The color-only backdooring result suggests a general design rule for generative-3D watermarking: hide information in appearance fields rather than geometry, because density changes perturb every view and break the SDS optimization.","The reported fine-tuning resistance likely depends on the attacker lacking the trigger viewports; an attacker with the decoder and a guessed short message could erase the watermark by fine-tuning on enumerated trigger views, so deployment should use longer messages or a separate key.","Because the decoder is shared across all watermarked NeRFs, the same fixed decoder could serve as a universal ownership verifier across many generated scenes, which post-generation methods that train a decoder per scene cannot do without extra storage."],"forward_implications":["A NeRF generated with DreaMark is watermarked the instant generation ends, so the intermediate clean model that post-generation pipelines produce never exists inside the pipeline.","The method adds no constraints on NeRF architecture, so SDS-based generators with specialized geometry or appearance networks can adopt it without structural changes.","The reported robustness transfers from the decoder's training-time transformations to the generated model, giving 90%+ bit accuracy under Gaussian noise, scaling, blur, crop, and brightness, and roughly 88% accuracy under pruning.","Watermark capacity and accuracy trade off, as with prior methods: accuracy is 100% at 8 bits and falls to about 72% at 48 bits in the reported experiments."],"supporting_citations":[{"why":"Supplies the pre-trained watermark decoder and the binary cross-entropy message-loss training that extracts the secret from rendered images.","marker":"Zhu et al. 2018"},{"why":"Defines score distillation sampling, the optimization loop that DreaMark modifies by adding the watermark loss.","marker":"Poole et al. 2022"},{"why":"The post-generation NeRF watermarking baseline whose delay and architecture-modification problems DreaMark aims to remove.","marker":"Luo et al. 2023"},{"why":"The other post-generation baseline used for capacity, generation-quality, and robustness comparisons.","marker":"Jang et al. 2024"},{"why":"Provides the pretrained text-to-image diffusion model distilled by SDS in the experiments.","marker":"Rombach et al. 2022"},{"why":"Provides Instant NGP, the NeRF representation used to demonstrate architecture-agnostic during-generation watermarking.","marker":"Müller et al. 2022"}],"fun_headline_variants":["Watermark NeRFs while they are generated, not after","Embed secret bits into 3D scenes during generation to prevent theft","During-generation watermarking leaves no clean NeRF for thieves to steal","Backdoor the generation process to hide a verifiable message in every NeRF"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The watermark stays secret only if an attacker cannot guess or re-derive the message that seeds the trigger viewports; with the default 16-bit message there are only 65,536 possible seeds, and an attacker with full access to the model could in principle try all of them.","fun_headline_variants_meta":{"raw":{"variants":["Watermark NeRFs while they are generated, not after","Embed secret bits into 3D scenes during generation to prevent theft","During-generation watermarking leaves no clean NeRF for thieves to steal","Backdoor the generation process to hide a verifiable message in every NeRF"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000661,"raw_usage":{"total_tokens":3054,"prompt_tokens":1011,"completion_tokens":2043,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":627,"completion_tokens_details":{"reasoning_tokens":1967}},"tokens_in":627,"tokens_out":2043,"duration_ms":15154,"temperature":1.0,"reasoning_tokens":1967,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T13:06:10.418021+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Enumerate all 65,536 candidate 16-bit messages, regenerate their trigger viewport sets, render those views from a watermarked NeRF, and fine-tune the color field to decode a wrong message on all candidates; if bit accuracy drops below 90% while CLIP score stays nearly unchanged, the claimed robustness against model-level attacks fails.","supporting_citations":[{"cited_title":"C.; See, S.; and Wan, R","cited_arxiv_id":null,"evidence_quote":"The post-generation NeRF watermarking baseline whose delay and architecture-modification problems DreaMark aims to remove."},{"cited_title":"I.; Jang, M.; Kim, J","cited_arxiv_id":null,"evidence_quote":"The other post-generation baseline used for capacity, generation-quality, and robustness comparisons."}],"review_version":1}