{"id":"21cb04f1-758f-45f7-94d6-2003114e738c","arxiv_id":"2509.00757","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"MarkSplatter embeds arbitrary messages into 3D Gaussian Splatting models in one forward pass via Splatter Image conversion, reaching about 94% bit-level accuracy at about 2.5 seconds per model.","lead":"A new method embeds arbitrary copyright messages into 3D Gaussian Splatting models in a single forward pass, where earlier methods required minutes to hours of per-model fine-tuning. It bridges the 3D model to an image-like Splatter Image format, then applies neural watermark embedding and segmentation-based extraction, reporting about 94% bit accuracy and about 2.5 seconds per model.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"GaussianBridge is not a bijection; the paper never demonstrates watermark extraction after the full point-cloud round trip, so the point-cloud 3DGS protection claim is unsupported.","rationale":"The paper's headline experiment supports the Splatter-Image-native claim: a generalizable embedder/extractor that operates in a single forward pass and achieves roughly 94% bit accuracy is plausible and has held-out quantitative support. The load-bearing gap is the point-cloud extension, which is one of the three listed contributions and appears in the title/abstract framing. The reader flags the lossiness of GaussianBridge as weakening protection of the original point-cloud model; I agree that lossiness matters, but the more concrete, testable failure mode is on the extraction side: the reported 'parameter extraction' numbers may be measured on the watermarked Splatter Image itself, not on a point-cloud model that has been re-bridged for extraction. If the full cycle is not validated, the unified point-cloud protection claim is unsupported. This does not require rejecting the Splatter-native contribution; it requires a conditional acceptance with a targeted experiment. Credit is due for the generalizable architecture and the robustness table, but the bridge round trip needs to be demonstrated.","tokens_in":16129,"tokens_out":8438,"duration_ms":108908,"concrete_test":"On the Objaverse/GSO evaluation sets, run the full pipeline: P = point-cloud 3DGS; S0 = GaussianBridge(P); Sw = embed(S0, m); Pw = flatten(Sw); Sw' = GaussianBridge(Pw); then extract m from Sw' and from 512x512 renders of Pw. Compare bit accuracy with Table 3's 100% and Table 2's 'None' row, and report PSNR between renders of P and Pw. If accuracy is near chance or materially below 94%, the point-cloud protection claim is not supported; if it stays high, the concern is resolved.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"Section 4.1 introduces GaussianBridge as enabling conversion between point-cloud 3DGS and Splatter Images, and Figure 2 labels it 'bi-directional.' But the reverse direction to point cloud is only a flattening operation; recovering a Splatter Image from a distributed point-cloud model requires running the same lossy LGM reconstruction again. The reported end-to-end reconstruction/watermarking quality is only about 35 dB PSNR (Table 1), so the conversion is not identity. Table 3 reports 100% extraction 'from 3DGS model parameters,' but Section 5.1 states that during training the authors also extract messages from the watermarked Splatter Images. That bypasses the point-cloud round trip: it treats the Splatter Image itself as the distributed asset. For the stated contribution 'unified watermarking protection for existing point-cloud-based 3DGS architectures' (Section 1), the owner must flatten the watermarked Splatter Image to point cloud, distribute that, and later re-bridge the point cloud to a Splatter Image before extraction. No experiment reports this full cycle. Thus the point-cloud protection claim rests on an untested assumption that the watermark survives both directions of a lossy conversion.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes MarkSplatter, a generalizable watermarking framework for 3D Gaussian Splatting (3DGS) models. It introduces GaussianBridge, which converts unstructured point-cloud 3DGS into structured Splatter Images via multi-view rendering and an LGM-based reconstruction model. A multi-view embedder perturbs the Splatter Image color attributes conditioned on geometry, modulated by a Gaussian-Uncertainty-Perceptual (GUP) heatmap; a segmentation-based extractor localizes watermarked regions and recovers bit messages from rendered views or from Splatter Image parameters. Experiments on held-out Objaverse and GSO objects report roughly 94% bit accuracy, PSNR 35.12 dB, and a runtime of about 2.5 s, against fine-tuning baselines that require 100+ s. The paper claims this is the first generalizable 3DGS watermarking framework and that it can protect both Splatter-Image-native and existing point-cloud-based 3DGS models.","tokens_in":16437,"tokens_out":8381,"duration_ms":99158,"significance":"If the claims hold, this is a meaningful step toward practical 3DGS watermarking: it replaces per-scene fine-tuning with a single forward pass, is evaluated on held-out objects and generative model families, and includes reasonable ablations of its components. The generalization protocol is a genuine strength, and the runtime advantage over fine-tuning baselines is substantial. However, the current evidence supports bit-level accuracy, not message-level reliability, and the point-cloud protection claim relies on an untested lossy round trip. Both issues are load-bearing for the paper's central claims and need to be addressed before the contribution is fully established.","major_comments":[{"comment":"The paper reports per-bit accuracy, but the claimed 'reliable extraction' (Abstract; §4.2.2) is a message-level property. At the reported 94.41% bit accuracy for 32-bit messages, exact message recovery has probability 0.9441^32 ≈ 0.16 under independent bit errors; for 48-bit messages the figure is 0.9336^48 ≈ 0.04. Under the distortions in Table 2 (bit accuracies of 87–93%), exact recovery is essentially negligible. No error-correcting code is described in §4.2 or §5.2. Please report full-message accuracy and false-positive rates, or add and evaluate an explicit ECC scheme.","section":"§5.2, Tables 1–2"},{"comment":"The protection claim for existing point-cloud-based 3DGS architectures is not validated end-to-end. GaussianBridge converts a point-cloud 3DGS to a Splatter Image through rendering and LGM reconstruction, which is lossy (PSNR ≈ 35 dB, Table 1; improved with 6 views in Table 5). The experiments extract from watermarked Splatter Images directly (§5.1: 'We also extract messages from the watermarked Splatter Images') or after one flattening (Table 3). They never test the full cycle: original point-cloud 3DGS → GaussianBridge → embed → flatten → distribute → GaussianBridge again → extract. Without this test, survival of the watermark through the two lossy conversions is unverified. Add this experiment or restrict the claim to Splatter-Image-native models.","section":"§4.1, §5.1, Table 3"},{"comment":"The message embedder uses 'a learnable binary lookup table' to map binary messages into latent perturbations. If this is a literal lookup table indexed by the complete message, it cannot scale to 32-bit or 48-bit messages; if it is a learned linear projection or per-bit embedding, the description is misleading. Please specify the mechanism precisely and verify generalization to messages not seen during training, since 'arbitrary message embedding' is a core contribution.","section":"§4.2.1"}],"minor_comments":[{"comment":"In the baseline list, 'Fine-tuning 3DGS+WAM[64]' and the bullet 'WAM[64]' should cite WAM [32], not HiDDeN [64]; the bullet also says 'HiDDeN [32]' where WAM is meant.","section":"§5.2"},{"comment":"The dataset description states '45K objects and 144k rendering views,' but 45,000 objects × 32 views ≈ 1.44M views. Please correct this inconsistency.","section":"§5.1"},{"comment":"The caption describes GaussianBridge as enabling 'bi-directional transformation.' The reverse direction is only a flattening operation, not a learned reconstruction; this should be stated in the caption or text to avoid overstating the symmetry of the module.","section":"Figure 2"},{"comment":"The 'None' row for Ours reports 94.41% in Table 1 and 94.35% in Table 2 for the same setting. Please clarify whether this is due to different test subsets or randomization, or unify the numbers.","section":"Tables 1–2"},{"comment":"The uncertainty estimate H = ∇G I G ∇G I^T_G is described as a simplification of the Hessian; please state the exact dimensions per Gaussian and cite the specific approximation from FisherRF [16] so the implementation is reproducible.","section":"§4.2.1, Eq. (3)"}],"recommendation":"major_revision","confidential_remarks":"The paper fits the scope of ACM MM and the core Splatter-Image-native idea is interesting. The main risks are that the reported bit-accuracy numbers are being equated with reliable watermark extraction, and that the GaussianBridge extension is presented as protecting point-cloud models without testing the full conversion round trip. Both are fixable with additional experiments and more precise claims. I would ask for these before acceptance."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"MarkSplatter is the first generalizable 3DGS watermarking pipeline I've seen that works in a single forward pass: given a Splatter Image, it embeds an arbitrary binary message and extracts it from rendered views or from the Splatter Image itself. The held-out evaluation on Objaverse and GSO is a genuine generalization test, not a fit, and the numbers are decent: about 94% bit accuracy, PSNR around 35 dB, and 2.5 seconds versus 100+ for fine-tuning baselines. That is a real advance in the subfield, even though the components (HiDDeN-style embedder, WAM-style extraction, LGM reconstruction) are individually known. The segmentation-based extractor that localizes small watermarked regions is a sensible adaptation to 3D rendering.\n\nThe soft spots are real but not fatal. First, the paper claims 'reliable extraction,' but only reports per-bit accuracy. With 94% per-bit accuracy on 32-bit messages, independent bit errors give roughly 14% chance of exact message recovery. Unless there is an error-correcting code or a matching tolerance, 'reliable' overstates what the data show. The authors should report message-level accuracy or specify a code. Second, the GaussianBridge extension to point-cloud 3DGS is not actually demonstrated end-to-end. Table 3 reports extraction from '3DGS model parameters,' but that is on the watermarked Splatter Image, not on a point-cloud model that was flattened, distributed, and then re-bridged through LGM. Since LGM reconstruction is lossy (the reported PSNR is around 35 dB), the watermark may not survive the round trip. The claim that existing point-cloud models are protected is therefore unsupported by the experiments. That said, the core contribution—watermarking Splatter-Image-based 3DGS—does not depend on this extension. Third, the manuscript omits key hyperparameters (alpha, lambda1, lambda2) and does not release code or data, which makes replication harder.\n\nThis paper is for researchers in 3D deep watermarking and 3D generative models. It deserves a serious referee: the novelty is clear, the evaluation is honest in the main setting, and the open problems are fixable with additional experiments and reporting. I'd engage with it, but I'd push the authors to close the message-level and round-trip gaps before trusting the stronger claims.","headline":"A genuinely new single-forward-pass 3DGS watermarking framework with solid held-out results, but the point-cloud extension via GaussianBridge is untested and the 'reliable extraction' claim needs message-level evidence.","tokens_in":16966,"tokens_out":2640,"would_cite":true,"duration_ms":31119,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"MarkSplatter embeds arbitrary copyright messages into 3D Gaussian Splatting models in a single forward pass.","keywords":["3D Gaussian Splatting","digital watermarking","Splatter Image","generalizable watermarking","single-forward-pass embedding","segmentation-based extraction","uncertainty-aware embedding","copyright protection"],"falsifier":"Render the original point-cloud 3DGS model and its GaussianBridge-reconstructed Splatter Image from identical camera paths and measure perceptual distance between the renderings; if the reconstruction is clearly distinguishable from the original beyond the reported ~35 dB PSNR level, then a watermark embedded in the reconstructed Splatter Image does not protect the original model, because an attacker can redistribute the untouched original. A complementary test: extract the message from renderings of the original, unwatermarked model after the watermarked Splatter Image is deleted; if the mess","tokens_in":16031,"feed_emoji":"🔒","tokens_out":7561,"duration_ms":79918,"temperature":0.7,"pith_summary":"MarkSplatter aims to make 3D Gaussian Splatting (3DGS) watermarking as flexible as image watermarking: instead of fine-tuning each 3D model for each fixed message, a trained embedder-extractor pair processes the model once and embeds any binary message on demand. The key move is to represent 3DGS models as Splatter Images—a grid where each pixel encodes one 3D Gaussian—so standard neural networks can operate directly on the 3D representation. For existing point-cloud-based 3DGS models, a GaussianBridge module converts them into Splatter Images, extending protection beyond models natively generated in that format. The paper reports about 94% bit accuracy with minimal visual distortion, in roughly 2.5 seconds per model, compared with over 100 seconds for fine-tuning baselines, and robustness across common image and 3D attacks.","feed_headline":"MarkSplatter watermarks 3D Gaussians in one forward pass","feed_subtitle":"Uses a grid-based Gaussian format to embed or swap messages per model in seconds, not minutes.","key_machinery":"The central object is the Splatter Image, a grid-based 3DGS format in which each pixel encodes one 3D Gaussian's 14 attributes (position, color, opacity, rotation, scaling). It carries the argument by turning an unstructured, permutation-invariant point cloud into an image-like tensor that standard neural networks can process. On top of it, GaussianBridge converts point-cloud 3DGS into Splatter Images through multi-view orbital rendering and a feed-forward Gaussian reconstruction model. The embedder uses an encoder-decoder with AdaIN and multi-view attention to add message-dependent perturbations to color attributes, modulated by a Gaussian-Uncertainty-Perceptual (GUP) heatmap that suppresse","core_discovery":"The paper claims to be the first generalizable 3DGS watermarking framework, and its central claim is that 3DGS watermarking can be made generalizable by operating on the Splatter Image structure rather than on model parameters. The paper constructs an embedder that adds a message-dependent perturbation to the color attributes of the Splatter Image, modulated by a Gaussian-Uncertainty-Perceptual (GUP) heatmap that reduces changes in perceptually important regions, and an extractor reframed as a dense segmentation task that locates watermarked pixels and reads their bits from rendered views even when the object occupies a small image region. To cover existing point-cloud 3DGS models, GaussianB","pith_inferences":["If single-pass embedding holds, watermarking could move to distribution time rather than creation time, letting different customers or licenses receive the same model with distinct embedded messages at negligible cost.","The Splatter Image bridge is representation-level: the same conversion could make other neural image operations—denoising, compression, style transfer—applicable to 3DGS models, since the 3D asset is temporarily rendered into an image-like tensor.","The current evaluation renders mostly from equatorial orbit elevations; a natural extension is to test steep top-down or bottom-up viewpoints, where occlusion and scale vary, to see whether the dense segmentation extractor remains accurate.","A stricter ownership proof would require the watermark to survive a GaussianBridge round trip in both directions; as presented, the watermark lives in the reconstructed Splatter Image, so an attacker who keeps the original point-cloud model may be able to redistribute it unmarked."],"forward_implications":["Any Splatter Image-based 3DGS model can be watermarked with a new message on demand in a single forward pass, removing the need to re-run per-scene optimization when the copyright message changes.","GaussianBridge extends the same protection to existing point-cloud-based 3DGS models, so legacy assets can be protected without retraining the watermarking network.","The segmentation-based extractor keeps message recovery reliable when watermarked objects appear small in the frame, a standard failure mode for global image watermark extractors.","Reported robustness under render-space and 3D-space attacks implies the watermark can survive common redistributions, including cropping, scaling, and geometric edits to the Gaussian representation itself."],"supporting_citations":[{"why":"Introduces the Splatter Image grid representation that turns unstructured 3D Gaussians into an image-like tensor, the core structure the watermarking pipeline operates on.","marker":"[37]"},{"why":"Provides the feed-forward Gaussian reconstruction model that GaussianBridge adapts to reconstruct Splatter Images from multi-view renders.","marker":"[39]"},{"why":"Defines 3D Gaussian Splatting, the model representation that the watermarking framework is designed to protect.","marker":"[17]"},{"why":"Supplies the deep image watermarking embedder-extractor paradigm and the extractor baseline that the paper compares against and extends.","marker":"[64]"},{"why":"Reformulates watermark extraction as a segmentation task with localized messages, which the proposed extractor follows.","marker":"[32]"},{"why":"Introduces uncertainty-based perturbation estimation for 3DGS watermarking and serves as the fine-tuning baseline that the method's GUP heatmap builds on.","marker":"[51]"},{"why":"Represents a fine-tuning-based radiance-field watermarking baseline to which the single-forward-pass approach is compared.","marker":"[14]"},{"why":"Supplies the Fisher-information uncertainty estimation used to compute the perceptual heatmap for imperceptible embedding.","marker":"[16]"},{"why":"Provides the large-scale 3D object dataset used to train the GaussianBridge and watermarking models.","marker":"[4]"},{"why":"Provides the held-out 3D object dataset used to evaluate reconstruction quality and watermark robustness.","marker":"[7]"}],"fun_headline_variants":["One forward pass watermarks any 3D Gaussian model","Generalizable 3DGS watermarking without per-model fine-tuning","Watermark 3D Gaussians instantly, no training needed","MarkSplatter: universal watermarking for Gaussian splats in a pass","Turn any 3D Gaussian scene into a watermarked model fast"],"cache_read_input_tokens":2688,"weakest_assumption_plain":"The claim that pre-existing point-cloud 3DGS models are protected rests on the assumption that converting them to Splatter Images via orbital rendering and feed-forward reconstruction loses no perception-critical content, so watermarking the reconstruction is equivalent to watermarking the original.","fun_headline_variants_meta":{"raw":{"variants":["One forward pass watermarks any 3D Gaussian model","Generalizable 3DGS watermarking without per-model fine-tuning","Watermark 3D Gaussians instantly, no training needed","MarkSplatter: universal watermarking for Gaussian splats in a pass","Turn any 3D Gaussian scene into a watermarked model fast"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000778,"raw_usage":{"total_tokens":3247,"prompt_tokens":683,"completion_tokens":2564,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":427,"completion_tokens_details":{"reasoning_tokens":2474}},"tokens_in":427,"tokens_out":2564,"duration_ms":21724,"temperature":1.0,"reasoning_tokens":2474,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-05T13:15:29.653640+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Render the original point-cloud 3DGS model and its GaussianBridge-reconstructed Splatter Image from identical camera paths and measure perceptual distance between the renderings; if the reconstruction is clearly distinguishable from the original beyond the reported ~35 dB PSNR level, then a watermark embedded in the reconstructed Splatter Image does not protect the original model, because an attacker can redistribute the untouched original. A complementary test: extract the message from renderings of the original, unwatermarked model after the watermarked Splatter Image is deleted; if the mess","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Introduces the Splatter Image grid representation that turns unstructured 3D Gaussians into an image-like tensor, the core structure the watermarking pipeline operates on."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides the feed-forward Gaussian reconstruction model that GaussianBridge adapts to reconstruct Splatter Images from multi-view renders."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the deep image watermarking embedder-extractor paradigm and the extractor baseline that the paper compares against and extends."},{"cited_title":"In IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)","cited_arxiv_id":null,"evidence_quote":"Introduces uncertainty-based perturbation estimation for 3DGS watermarking and serves as the fine-tuning baseline that the method's GUP heatmap builds on."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Represents a fine-tuning-based radiance-field watermarking baseline to which the single-forward-pass approach is compared."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the Fisher-information uncertainty estimation used to compute the perceptual heatmap for imperceptible embedding."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides the held-out 3D object dataset used to evaluate reconstruction quality and watermark robustness."}],"review_version":1}