WATER-GS: Toward Copyright Protection for 3D Gaussian Splatting via Universal Watermarking

Bin Chen; Shu-Tao Xia; Shuzhao Xie; Xiang Liu; Yuqi Tan; Zhi Wang

REVIEW 4 major objections 7 minor 1 cited by

WATER-GS: Toward Copyright Protection for 3D Gaussian Splatting via Universal Watermarking

T0 review · 4 major / 7 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read WATER-GS claims that a fixed pre-trained decoder plus 3D distortion layers can embed an invisible watermark into 3D Gaussian Splatting models, recoverable from any rendered viewpoint.

desk verdict First 3DGS watermarking method with a clean core idea; the headline robustness gain is largely a training/test augmentation overlap artifact, so the paper needs a more general evaluation before its claims hold. read the letter →

arxiv 2412.05695 v1 pith:ROLTF4W3 submitted 2024-12-07 cs.CR

Yuqi Tan , Xiang Liu , Shuzhao Xie , Bin Chen , Shu-Tao Xia , Zhi Wang This is my paper · ORCID

classification cs.CR

keywords 3DGaussianSplattingwatermarkingcopyrightprotectiondigitalwatermarkpointclouddistortionrobustnessneuralrendering3DGS

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that 3D Gaussian Splatting models can be watermarked without changing the 3DGS format or adding an explicit encoder: the creator fine-tunes the model's existing Gaussian parameters so that every rendered image, from any viewpoint, carries the same binary message, extractable by a fixed pre-trained decoder. The point is copyright protection: because users consume 3D scenes through 2D renderings, embedding the message in the parameters and recovering it from any rendering gives creators a practical way to prove ownership of a 3DGS asset. The paper backs this with experiments showing bit error rates around 3 to 9 percent on clean renderings of standard scene benchmarks, and with the proposed distortion layers the BER on the LLFF set stays near 5 percent under noise, dropout, and crop distortions, although larger outdoor scenes show higher rates. It also shows the same recipe transfers to 2D Gaussian Splatting and to a compressed 3DGS format.

What carries the argument

The load-bearing object is a fixed, pre-trained convolutional watermark decoder $D$ that maps a rendered image to a binary message, together with the 3D distortion layers $\mathcal{N}$ applied to the Gaussian parameters before rendering. The decoder is trained once on ordinary natural images in an end-to-end encoder-decoder setup, then frozen; during watermark embedding, gradient descent on the 3DGS parameters (against the message loss $L_m = \mathrm{BCE}(m, D(\tilde{I}))$ and the rendering-quality loss $L_{\text{rgb}}$) treats the 3DGS rasterization pipeline as the encoder, so the model learns to render watermarked images without any explicit watermark encoder. The distortion layers $\mathcal{N} = \{\text{Identity}, \text{Gaussian Noise}, \text{Dropout}, \text{Crop}\}$ perturb the point cloud during training, which is what makes extraction robust to realistic file distortions; the paper's rendering equation shows that pixel colors are $\alpha$-composed from projected Gaussians, so these parameter perturbations propagate into every rendered view.

What would settle it

Render a WATER-GS-watermarked model from a viewpoint using a 3D distortion stronger than the training strengths, for example Gaussian noise with $\$\sigma$$ larger than 0.01 or a 30 percent point drop, then measure the Bit Error Rate of the extracted 48-bit message; if the BER approaches 50 percent, which is random guessing, the claimed robustness does not generalize beyond the trained distortion strengths, whereas staying below 5 percent would confirm the mechanism.

Watch

Extended reading notes

Core claim

The central claim is that the original 3DGS generative network can itself act as a watermark encoder. WATER-GS does this by fixing a pre-trained watermark decoder, then fine-tuning the full set of 3DGS parameters $\Theta = \{\mu, s, r, \$\alpha$, h\}$ (positions, scales, rotations, opacities, and spherical-harmonic colors) with the rendering loss plus a binary cross-entropy message loss, optionally masking which parameters are updated. A message $m$ is embedded implicitly across the whole model, so the same 48-bit string is recoverable from any rendered viewpoint. To survive real-world file tampering, the fine-tuning applies 3D distortion layers, namely identity, Gaussian noise, dropout, and crop, to the Gaussians before rendering, teaching the model to keep the message extractable even when the point cloud itself is corrupted. The paper reports that on the LLFF scenes, without these layers Gaussian noise pushes BER to 25.62 percent, while with them it drops to 4.86 percent, and that naive alternatives, embedding in training images or concatenating messages with attributes, either fail to survive rendering or destroy visual quality.

Load-bearing premise

The load-bearing premise is that a watermark decoder trained only on ordinary natural images can recognize watermarks in the renderings of any 3D scene once the scene's Gaussian points are fine-tuned, and that this holds across arbitrary viewpoints and distortions; if that transfer fails, extraction collapses.

Editorial extensions

If this is right

A creator can publish one watermarked 3DGS file and prove ownership from any 2D screenshot taken at a new viewpoint, because the message is embedded across all parameters rather than in one location.
Distortion-aware fine-tuning makes the watermark survive point-dropout, cropping, and Gaussian noise on the 3D model, with BER below 5 percent on the LLFF scenes in the paper's ablations, up from roughly 12 to 25 percent without the distortion layers.
The recipe is pipeline-agnostic: plugging the same decoder into 2D Gaussian Splatting or a compact compressed 3DGS variant yields extracted messages with BER near 8 to 10 percent, so watermarking does not have to be re-designed for each new splatting framework.
Because capacity is implicit, increasing the watermark from 8 to 48 bits does not degrade extraction accuracy much, making the method suitable for carrying meaningful identifiers rather than a single bit.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Editorial inference: if the watermark is a global perturbation pattern learned by the decoder, the same scheme may also survive downstream re-rendering transformations such as resolution changes or relighting, but WATER-GS only tests point-cloud distortions and not such render-level attacks, so this is an open question.
Editorial inference: a determined adversary could re-optimize a clean 3DGS from the watermarked renderings, a distillation attack, which would likely remove the watermark; the paper does not evaluate ownership verification under retraining, only robustness to local file distortions.
Editorial inference: scenes that look very different from natural photographs may require a decoder fine-tuned on that domain; a useful test would be measuring BER on stylised, night-time, or non-photorealistic 3D scenes.
Editorial inference: the per-view consistency of the embedded message could be exploited as a fingerprint channel, with different messages per viewpoint, but that would need joint optimization and a decoder that distinguishes viewpoints, neither of which is tested.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Short version: this is the first watermarking method for 3DGS that I know of, and the core trick—fine-tuning the Gaussian parameters against a fixed image decoder so every rendering carries the message—is clean and works in their tests. The robustness number they headline is weaker than it looks, though, because the test distortions are the same operations and strengths used as training augmentations. The paper needs another round of evaluation before I'd fully trust the generalization claims.

What's genuinely new: nobody else has treated the 3DGS model itself as the watermark encoder. The universal decoder is pre-trained on COCO and frozen, so there's no circularity. The 3D distortion layers (Gaussian noise on positions, dropout, crop) are a sensible adaptation of standard augmentation to point clouds. The two naive baselines—watermarking training images and concatenating messages with SH coefficients—both fail, which is an informative negative result and justifies the design choice.

Where it's soft: the main evidence for robustness is Table 3, where distortion layers drop BER under Gaussian noise from 25.6% to 4.9%. But the training noise is exactly Gaussian sigma=0.01, dropout 10%, crop 10%—the same values used at test time. That measures whether the model memorized the augmentation family, not whether it survives unseen distortions or severities. No tests at sigma=0.02/0.05 or p=20%/50%, and no unseen types like quantization or correlated point loss. So the '20% improvement' is real but its scope is narrower than the abstract claims. Also, the CopyRNeRF comparison is apples-to-oranges: 16-bit messages for them vs 48-bit for you. Quality-wise, the paper says 'imperceptible,' but the numbers show a 2-3 dB PSNR drop and LPIPS increases up to 0.26 in some settings; that's visible on close inspection. No error bars, no code release, single random seed presumably—so the 3.26% BER could be cherry-picked. The method is adaptable to 2DGS and compression variants, which is nice, but those results also show larger quality loss.

Bottom line: the central embedding mechanism is sound and the first-mover contribution is real. The robustness story needs a more honest evaluation with unseen distortions and severity sweeps. I'd send it to review—it deserves referee time—but I'd ask for those experiments before acceptance. A careful reader in watermarking or 3D asset protection will get value from the core idea.

Referee Report

4 major / 7 minor

Summary. The paper proposes WATER-GS, a method for embedding imperceptible watermarks into 3D Gaussian Splatting (3DGS) scenes. A HiDDeN-style decoder is pre-trained on COCO; then, for each scene, the 3DGS parameters are fine-tuned so that rendered images from arbitrary viewpoints decode to a fixed binary message. To improve robustness, the authors insert 3D distortion layers (Gaussian noise, dropout, and cropping of Gaussian primitives) during fine-tuning. The method is evaluated on LLFF, Mip-NeRF360, and Tanks&Temples, reporting low bit error rates (e.g., 3.26% on clean LLFF renderings) and high extraction accuracy after distortions, with a 20.76 percentage-point improvement in accuracy under Gaussian noise on LLFF. Ablations examine embedding positions, bit lengths, and adaptation to 2DGS and Compact3D variants.

Significance. If validated, this is one of the first watermarking methods for 3DGS and demonstrates a workable principle: treating a pre-trained decoder as a fixed target and optimizing the explicit 3DGS parameters to satisfy it achieves extractable, content-preserving watermarks. The paper includes useful ablations and shows adaptability to 2DGS and a compression pipeline. However, the central robustness claim is weakened by the test-time distortions exactly matching the training augmentations, the CopyRNeRF comparison lacks controlled bit lengths, and all results are reported without variance or multi-seed analysis. With additional experiments at unseen distortion levels, the method's generality could be established more firmly.

major comments (4)

[Section 3.2 / Appendix A.1 / Table 3] The evaluation of robustness is confounded by the fact that the test distortions are identical to the training augmentations. Algorithm 1 and Appendix A.1 set Gaussian noise σ=0.01, Dropout p=10%, and Crop p=10%; Table 3 evaluates exactly these same strengths. The reported 20.76 percentage-point improvement in accuracy (74.38% to 95.14%) under Gaussian noise therefore shows that the model became invariant to that specific augmentation family, but it does not support the abstract and Section 3.2's claim of robustness against 'common real-world distortions of point cloud data.' Please evaluate at unseen severities (e.g., σ=0.02/0.05, p=20%/50%) and at unseen distortion types (e.g., quantization of SH coefficients, spatially correlated point removal) and report the results.
[Introduction / Table 1] The Introduction states that 'the watermark extraction accuracy can reach 95% across various distortions,' but Table 1 shows that under Gaussian noise, Tanks&Temples has BER 29.11% (70.89% accuracy) and Mip-NeRF360 has BER 20.77% (79.23% accuracy). The 95% figure holds only for the LLFF GN case (accuracy 95.14%), not 'across various distortions' or across all datasets. Please qualify the claim per dataset and per distortion, or restrict the statement to the LLFF results that support it.
[Section 4.3 / Table 2] The comparison with CopyRNeRF is not fully controlled. The text says experiments were run 'under optimal settings for CopyRNeRF using 16-bit messages,' but Table 2 does not state the bit length used for the WATER-GS rows. From Appendix B, the 16-bit LLFF BER for WATER-GS is 2.83, matching the 'Ours' row; if that row is indeed 16-bit, then the subsequent claim that '48 bits represents the upper bound capacity' for CopyRNeRF is not substantiated by any reported experiment. Please state the bit length in Table 2, include the 48-bit CopyRNeRF result (or remove the capacity claim), and ensure the row labels make the comparison unambiguous.
[Section 4.1 / Tables 1-5] No error bars or statistical significance tests are provided; each table reports a single number. Given that the key quantitative claim (e.g., the 20.76% accuracy improvement) could be within run-to-run variation, please report means and standard deviations over at least multiple decoder initializations, multiple random watermark messages, and multiple scene subsets. Also state the number of scenes per dataset used for each average, since Table 1 says 'averaged on the selected dataset scenes' without specifying how many or which scenes.

minor comments (7)

[Figure 3 caption] The caption contains a typo: 'Distorstion layers' should be 'Distortion layers.'
[Section 3.2 / Appendix A.1] The description of the Gaussian Noise layer is inconsistent: Section 3.2 says it 'applies a Gaussian kernel with width σ to blur Θ,' while Appendix A.1 says 'we add noise to position parameters xyz, the kernel width σ is set to 0.01.' Clarify whether the layer blurs, adds independent noise, or does something else to the parameters.
[Equation (5) / Algorithm 1] The transition from the FNN formulation in Eq. (5), where Ico is a cover image, to Algorithm 1, where the cover is a 3DGS-rendered image, is not explicitly explained. Please add a sentence connecting the 2D steganography analogy to the 3D fine-tuning procedure.
[Table 2] Table 2's formatting is confusing: the columns list 'PSNR ↑ SSIM ↑ LPIPS ↓' and rows show values like '22.77 / 1.64 ↓' without clearly indicating which number is the absolute metric and which is the change relative to raw 3DGS. Please format the table to make the reported values and deltas explicit.
[Abstract / Section 4.4] The phrase '20% improvement in accuracy rate' should specify that this is a percentage-point improvement (74.38% to 95.14%), not a relative improvement; similarly, Section 4.4 uses '20.76%' as a percentage-point gain. Clarify to avoid misinterpretation.
[Section 4.4 / Appendix B] The '1nd, 2nd and 3rd orders' should be corrected to '1st, 2nd and 3rd.' Also, the claim that 'increasing watermark bits has minimal impact on extraction accuracy' is not fully supported by Tables 7-9: for Mip-NeRF360 the BER increases from 8.88% at 8 bits to 12.22% at 48 bits, a non-negligible change that is not discussed.
[Appendix A.1] The decoder training is described as 300 epochs on COCO with 256×256 crops, but no batch size, optimizer, learning rate, or message length during pretraining is specified. Please add these details, and state whether the code will be released for reproducibility.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: the decoder is pre-trained independently on COCO and then fixed; fine-tuning 3DGS parameters against it is a standard optimization, not a self-referential derivation.

full rationale

WATER-GS's derivation chain is not circular. The watermark decoder is pre-trained end-to-end with a HiDDeN-style encoder on the COCO dataset (Eqs. 3-4), then frozen; the 3DGS fine-tuning stage (Algorithm 1, Eqs. 6-9) optimizes Gaussian parameters so that the fixed decoder recovers the intended message from rendered images while Lrgb preserves rendering quality. This is a standard optimization against an external, independently trained decoder, not a quantity fitted to the evaluation target. The reported BER values are measured outcomes of that optimization, and no fitted parameter or augmentation strength is relabeled as a prediction. The ablation of 3D distortion layers compares models trained with and without those layers; the fact that the test distortions match the training augmentation choices (Appendix A.1) is a generalization or evaluation-protocol concern, not circularity: the robustness gain is an empirical effect of training with those distortions, and the paper does not claim to derive that gain from the definition of the layers. All referenced methods (HiDDeN, FNN, CopyRNeRF, 3DGS, etc.) are external prior work, and no load-bearing claim rests solely on a self-citation. The central assumption that gradient descent on 3DGS parameters can steer rendered images into the decoder's decoding distribution is empirical; if it failed, the method would collapse, but the assumption is not equivalent to the conclusion by construction. Therefore no circular step can be exhibited from the paper's own equations, and the appropriate score is 0.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

The central method rests on standard differentiable rendering, a domain-transfer assumption for the pre-trained decoder, and a coverage assumption for the distortion set; no new entities are invented.

free parameters (4)

gamma = 0.1 (LLFF), 0.3 (Mip-NeRF360, Tanks&Temples)
Balancing weight between rendering loss and watermark loss in Eq. (9), chosen per dataset by hand to control the trade-off.
Gaussian noise kernel width sigma = 0.01
Strength of Gaussian noise applied to xyz positions in distortion layers, set in Appendix A.1.
Dropout and Crop fraction p = 0.1 (10%)
Fraction of points removed in Dropout and Crop distortion layers, set in Appendix A.1.
Fine-tuning iterations = 10,000 to 30,000 with early stopping at BER 0
Training length varies by scene and dataset, chosen to balance quality and extraction accuracy.

assumptions (5)

standard math The rendering process of 3DGS is differentiable with respect to all Gaussian parameters, enabling gradient-based fine-tuning.
Used throughout fine-tuning (Algorithm 1); 3DGS is designed to be differentiable, but this is an unproved background assumption relative to watermark optimization.
domain assumption A decoder D pre-trained on COCO natural images can recognize watermarks in 2D renderings of fine-tuned 3DGS models.
Core of the universal decoder approach; Section 3.1 states the decoder learns an embedding pattern that 3DGS incorporates, but no analysis shows why natural-image decoding transfers to renderings.
domain assumption The proposed 3D distortion layers (Gaussian noise, Dropout, Crop) represent common real-world point cloud distortions.
Section 3.2 motivates distortion layers; the paper explicitly excludes compression, so coverage of real-world distortions is incomplete.
domain assumption Fine-tuning all Gaussian parameters does not alter the file format or break the physical semantics of the 3DGS representation.
The method claims universal compatibility by not changing file structure; this holds only if parameter fine-tuning preserves the format.
domain assumption PSNR, SSIM, and LPIPS are valid proxies for imperceptibility of the watermark.
Used as evaluation metrics in Section 4.1; standard but not a formal guarantee of imperceptibility.

how reviews work

0 comments

Cite this review

Pith. "Pith review of WATER-GS: Toward Copyright Protection for 3D Gaussian Splatting via Universal Watermarking." pith.science (2026). https://pith.science/paper/ROLTF4W3

@misc{pith2026241205695,
  author       = {Pith},
  title        = {Pith review of: WATER-GS: Toward Copyright Protection for 3D Gaussian Splatting via Universal Watermarking},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/ROLTF4W3}},
  note         = {Machine review of arXiv:2412.05695}
}

read the original abstract

3D Gaussian Splatting (3DGS) has emerged as a pivotal technique for 3D scene representation, providing rapid rendering speeds and high fidelity. As 3DGS gains prominence, safeguarding its intellectual property becomes increasingly crucial since 3DGS could be used to imitate unauthorized scene creations and raise copyright issues. Existing watermarking methods for implicit NeRFs cannot be directly applied to 3DGS due to its explicit representation and real-time rendering process, leaving watermarking for 3DGS largely unexplored. In response, we propose WATER-GS, a novel method designed to protect 3DGS copyrights through a universal watermarking strategy. First, we introduce a pre-trained watermark decoder, treating raw 3DGS generative modules as potential watermark encoders to ensure imperceptibility. Additionally, we implement novel 3D distortion layers to enhance the robustness of the embedded watermark against common real-world distortions of point cloud data. Comprehensive experiments and ablation studies demonstrate that WATER-GS effectively embeds imperceptible and robust watermarks into 3DGS without compromising rendering efficiency and quality. Our experiments indicate that the 3D distortion layers can yield up to a 20% improvement in accuracy rate. Notably, our method is adaptable to different 3DGS variants, including 3DGS compression frameworks and 2D Gaussian splatting.

Figures

Figures reproduced from arXiv: 2412.05695 by the authors.

**Figure 1.** Before publication, creators can utilize pre-trained decoder and 3D distortion layers to embed digital signatures as watermarks into 3DGS files, thereby asserting ownership. Even when the 3DGS files undergo various distortions, the watermark can be reliably extracted, serving as effective proof of ownership. In recent years, significant advancements in 3D scene representations have positioned 3D Gaussian Splatting… view at source ↗

**Figure 2.** Two intuitive solutions for 3DGS watermarking. [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗

**Figure 3.** Illustration of our WATER-GS framework. (1) Training a universal decoder. In this stage, a message encoder E and a decoder D are trained end-to-end. (2) Fine-tuning the 3D Gaussians. In this stage, creators fine-tune the original 3D Gaussians using the pre-trained decoder to embed fixed messages. They have the flexibility to control which parameters are frozen by employing a self-defined mask. (3) Distorstion laye… view at source ↗

Figures from the paper (5 more)

**Figure 4.** Figure 4: Visual quality comparisons of each baseline. We display both the rendered images and [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]

**Figure 5.** Figure 5: A visual comparison of the watermark patterns pre- and post-rendering. The residual images indicate that the watermark pattern is disrupted. Watermarking Training Datasets. For methods that aim to transfer watermarks from training images to rendered images, althoug…

**Figure 6.** Figure 6: The rendered images and localized detailed residual images ( [PITH_FULL_IMAGE:figures/full_fig_p010_6.png]

**Figure 7.** Figure 7: Qualitative comparison of concatenating watermark with different attributes. [PITH_FULL_IMAGE:figures/full_fig_p016_7.png]

**Figure 8.** Figure 8: Qualitative comparison of fine-tuning different parameters for watermark embedding. [PITH_FULL_IMAGE:figures/full_fig_p017_8.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

GaussTrap: Stealthy Poisoning Attacks on 3D Gaussian Splatting for Targeted Scene Confusion
cs.CV 2025-04 conditional novelty 6.0 of 10

A three-stage poisoning pipeline with viewpoint-ensemble stabilization can implant an attacker-chosen image at a single viewport of a 3D Gaussian Splatting model while preserving rendering quality at other views.

Reference graph

Works this paper leans on

16 extracted references · 7 canonical work pages · cited by 1 Pith paper

[1]

Barron, Ben Mildenhall, Matthew Tancik, Peter Hedman, Ricardo Martin-Brualla, and Pratul P

Jonathan T. Barron, Ben Mildenhall, Matthew Tancik, Peter Hedman, Ricardo Martin-Brualla, and Pratul P. Srinivasan. Mip-nerf: A multiscale representation for anti-aliasing neural radiance fields. In 2021 IEEE/CVF International Conference on Computer Vision (ICCV) , Oct

work page 2021
[6]

URL http://dx.doi

doi: 10.3390/s19153268. URL http://dx.doi. org/10.3390/s19153268. Jing Liu, Yajie Yang, Douli Ma, Wenjuan He, and Yinghui Wang. A novel watermarking algorithm for three-dimensional point-cloud models based on vertex curvature.International Journal of Dis- tributed Sensor Networks, pp. 155014771982604, Jan

work page doi:10.3390/s19153268
[7]

URL http://dx.doi.org/10.1177/1550147719826042

doi: 10.1177/1550147719826042. URL http://dx.doi.org/10.1177/1550147719826042. Tao Lu, Mulin Yu, Linning Xu, Yuanbo Xiangli, Limin Wang, Dahua Lin, and Bo Dai. Scaffold-gs: Structured 3d gaussians for view-adaptive rendering. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 20654–20664,

work page doi:10.1177/1550147719826042
[10]

URL http://dx.doi.org/10.1109/iccv48922.2021

1109/iccv48922.2021.00580. URL http://dx.doi.org/10.1109/iccv48922.2021. 00580. Yihang Chen, Qianyi Wu, Jianfei Cai, Mehrtash Harandi, and Weiyao Lin. Hac: Hash-grid assisted context for 3d gaussian splatting compression. arXiv preprint arXiv:2403.14530, 2024a. Zilong Chen, Feng Wang, Yikai Wang, and Huaping Liu. Text-to-3d using gaussian splatting. InPro...

arXiv 2021
[11]

Very deep convolutional networks for large-scale image recognition

Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. arXiv preprint arXiv:1409.1556,

arXiv
[14]

A recipe for watermarking diffusion models

Yunqing Zhao, Tianyu Pang, Chao Du, Xiao Yang, Ngai-Man Cheung, and Min Lin. A recipe for watermarking diffusion models. arXiv preprint arXiv:2303.10137,

arXiv
[16]

Concatenating Watermarks with Attributes

dataset and γ = 0.3 for others. Fine-tuning iterations. Excessive training epochs can degrade image quality; therefore, we set the training duration to range between 10,000 and 30,000 iterations. When the bit error rate (BER) decreases to 0.0%, we implement early stopping of the fine-tuning process. A.2 T IMING Tab. 6 presents the average time required to...

work page 2019
[1999]

URL http://dx.doi.org/10.1145/311535

doi: 10.1145/311535.311540. URL http://dx.doi.org/10.1145/311535. 311540. Johannes L Schonberger and Jan-Michael Frahm. Structure-from-motion revisited. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 4104–4113,

arXiv

Show all 16 references

[2001]

We use the network architecture proposed by HiDDeN (Zhu et al., 2018)

13 A I MPLEMENTATION DETAILS A.1 H YPER -PARAMETERS Decoder network architecture. We use the network architecture proposed by HiDDeN (Zhu et al., 2018). The encoder E consists of four stacked layers of convolution followed by ReLU activation functions and the decoder D consist...

2018
[2002]

URL http://dx.doi.org/10.1111/1467-8659

doi: 10.1111/1467-8659.t01-1-00597. URL http://dx.doi.org/10.1111/1467-8659. t01-1-00597. Emil Praun, Hugues Hoppe, and Adam Finkelstein. Robust mesh watermarking. In Proceedings of the 26th annual conference on Computer graphics and interactive techniques - SIGGRAPH ’99 , Jan

doi
[2014]

Protecting nerfs’ copyright via plug-and-play watermarking base model

Qi Song, Ziyuan Luo, Ka Chun Cheung, Simon See, and Renjie Wan. Protecting nerfs’ copyright via plug-and-play watermarking base model. arXiv preprint arXiv:2407.07735,

arXiv
[2016]

URL http: //dx.doi.org/10.1098/rsta.2015.0202

doi: 10.1098/rsta.2015.0202. URL http: //dx.doi.org/10.1098/rsta.2015.0202. Nikhil Keetha, Jay Karhade, Krishna Murthy Jatavallabhula, Gengshan Yang, Sebastian Scherer, Deva Ramanan, and Jonathon Luiten. Splatam: Splat track & map 3d gaussians for dense rgb-d slam. In Proceedi...

2015
[2018]

URL http://dx

doi: 10.1109/cvpr.2018.00068. URL http://dx. doi.org/10.1109/cvpr.2018.00068. Xinjie Zhang, Xingtong Ge, Tongda Xu, Dailan He, Yan Wang, Hongwei Qin, Guo Lu, Jing Geng, and Jun Zhang. Gaussianimage: 1000 fps image representation and compression by 2d gaussian splatting. arXiv ...

2018
[2019]

URL http: //dx.doi.org/10.3390/info10020067

doi: 10.3390/info10020067. URL http: //dx.doi.org/10.3390/info10020067. Binbin Huang, Zehao Yu, Anpei Chen, Andreas Geiger, and Shenghua Gao. 2d gaussian splatting for geometrically accurate radiance fields. In ACM SIGGRAPH 2024 Conference Papers , pp. 1–11, 2024a. Qinglong Hu...

arXiv
[2023]

Microsoft coco: Common objects in context

Tsung-Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Doll´ar, and C Lawrence Zitnick. Microsoft coco: Common objects in context. In Computer Vision–ECCV 2014: 13th European Conference, Zurich, Switzerland, September 6-12, 2014, Proceeding...

2014
[2024]

Dreamgaussian: Generative gaussian splatting for efficient 3d content creation

12 Jiaxiang Tang, Jiawei Ren, Hang Zhou, Ziwei Liu, and Gang Zeng. Dreamgaussian: Generative gaussian splatting for efficient 3d content creation. arXiv preprint arXiv:2309.16653,

arXiv

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.

[1] [1]

Barron, Ben Mildenhall, Matthew Tancik, Peter Hedman, Ricardo Martin-Brualla, and Pratul P

Jonathan T. Barron, Ben Mildenhall, Matthew Tancik, Peter Hedman, Ricardo Martin-Brualla, and Pratul P. Srinivasan. Mip-nerf: A multiscale representation for anti-aliasing neural radiance fields. In 2021 IEEE/CVF International Conference on Computer Vision (ICCV) , Oct

work page 2021

[2] [6]

URL http://dx.doi

doi: 10.3390/s19153268. URL http://dx.doi. org/10.3390/s19153268. Jing Liu, Yajie Yang, Douli Ma, Wenjuan He, and Yinghui Wang. A novel watermarking algorithm for three-dimensional point-cloud models based on vertex curvature.International Journal of Dis- tributed Sensor Networks, pp. 155014771982604, Jan

work page doi:10.3390/s19153268

[3] [7]

URL http://dx.doi.org/10.1177/1550147719826042

doi: 10.1177/1550147719826042. URL http://dx.doi.org/10.1177/1550147719826042. Tao Lu, Mulin Yu, Linning Xu, Yuanbo Xiangli, Limin Wang, Dahua Lin, and Bo Dai. Scaffold-gs: Structured 3d gaussians for view-adaptive rendering. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 20654–20664,

work page doi:10.1177/1550147719826042

[4] [10]

URL http://dx.doi.org/10.1109/iccv48922.2021

1109/iccv48922.2021.00580. URL http://dx.doi.org/10.1109/iccv48922.2021. 00580. Yihang Chen, Qianyi Wu, Jianfei Cai, Mehrtash Harandi, and Weiyao Lin. Hac: Hash-grid assisted context for 3d gaussian splatting compression. arXiv preprint arXiv:2403.14530, 2024a. Zilong Chen, Feng Wang, Yikai Wang, and Huaping Liu. Text-to-3d using gaussian splatting. InPro...

arXiv 2021

[5] [11]

Very deep convolutional networks for large-scale image recognition

Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. arXiv preprint arXiv:1409.1556,

arXiv

[6] [14]

A recipe for watermarking diffusion models

Yunqing Zhao, Tianyu Pang, Chao Du, Xiao Yang, Ngai-Man Cheung, and Min Lin. A recipe for watermarking diffusion models. arXiv preprint arXiv:2303.10137,

arXiv

[7] [16]

Concatenating Watermarks with Attributes

dataset and γ = 0.3 for others. Fine-tuning iterations. Excessive training epochs can degrade image quality; therefore, we set the training duration to range between 10,000 and 30,000 iterations. When the bit error rate (BER) decreases to 0.0%, we implement early stopping of the fine-tuning process. A.2 T IMING Tab. 6 presents the average time required to...

work page 2019

[8] [1999]

URL http://dx.doi.org/10.1145/311535

doi: 10.1145/311535.311540. URL http://dx.doi.org/10.1145/311535. 311540. Johannes L Schonberger and Jan-Michael Frahm. Structure-from-motion revisited. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 4104–4113,

arXiv