Pith. sign in

REVIEW 4 major objections 5 minor 1 cited by

DreaMark: Rooting Watermark in Score Distillation Sampling Generated Neural Radiance Fields

T0 review · 4 major / 5 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read DreaMark embeds a secret message into a neural radiance field during score distillation sampling, eliminating the clean intermediate model that post-generation watermarking leaves exposed.

desk verdict A genuinely new during-generation NeRF watermarking method with real experiments, but the paper's headline security property is contradicted by its own two-stage pipeline and the abstract overstates robustness. read the letter →

arxiv 2412.15278 v1 pith:TWKLE7V6 submitted 2024-12-18 cs.GR cs.AI

Xingyu Zhu , Xiapu Luo , Xuetao Wei This is my paper · ORCID
classification cs.GRcs.AI
keywords neuralradiancefieldstext-to-3Dgenerationscoredistillationsamplingwatermarkingbackdoorcopyrightprotectiontriggerviewportsimage-levelattacks
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

DreaMark claims to be the first watermarking method for text-to-3D generation that embeds the secret during generation rather than after it. By adding a message-recovery loss to the score distillation sampling (SDS) loop on a small set of secret camera angles, it produces a NeRF that is watermarked from the moment it exists, so no clean intermediate model ever appears. The paper reports that the watermark reaches 98.93% bit accuracy for 16-bit messages and stays above 90% under common image distortions and model pruning, while generation quality, measured by CLIP score, is not degraded. The selling point is closing the theft window that post-generation watermarking leaves open, without changing the NeRF architecture.

What carries the argument

The load-bearing object is the trigger viewport backdoor: a set of camera angles generated from the secret message by seeding a pseudorandom generator with the SHA-256 hash of the message. On those viewports alone, the pre-trained frozen decoder's output is pulled toward the message by a binary cross-entropy term added to the SDS loss, while the SDS loss continues to guide generation on all other viewports. The authors backdoor only the color network $f_c$, leaving the density network $f_\sigma$ frozen after the first SDS stage, because changing point density alters the color of every viewing direction and collapses generation quality. The decoder itself is trained with a transformation layer that applies cropping, resizing, and rotation, so robustness to image-level attacks is inherited by the generated NeRF without extra adversarial training during generation.

What would settle it

Enumerate all 65,536 candidate 16-bit messages, regenerate their trigger viewport sets, render those views from a watermarked NeRF, and fine-tune the color field to decode a wrong message on all candidates; if bit accuracy drops below 90% while CLIP score stays nearly unchanged, the claimed robustness against model-level attacks fails.

Watch

Extended reading notes

Core claim

DreaMark's central claim is that a neural radiance field generated from a text prompt can carry a verifiable secret message as an intrinsic part of the generation process. The method pre-trains a watermark decoder that maps a rendered image to a bit string, then optimizes a NeRF with two losses at once: the standard SDS loss over all viewports and a binary cross-entropy loss between the decoder's output and the target message on images rendered from a set of trigger viewports. The trigger viewports are derived deterministically from the secret message through a SHA-256-seeded pseudorandom generator, so the verifier can recreate them and an attacker who does not know the message cannot. The authors find that backdooring only the color network, after the density network has been learned in an initial SDS stage, preserves generation quality; backdooring the density network degrades every view and collapses quality. The reported result is that the watermarked NeRF matches or slightly exceeds the generation quality of a non-watermarked one while yielding 90%+ bit accuracy under image-level attacks and strong robustness to fine-tuning and pruning.

Load-bearing premise

The watermark stays secret only if an attacker cannot guess or re-derive the message that seeds the trigger viewports; with the default 16-bit message there are only 65,536 possible seeds, and an attacker with full access to the model could in principle try all of them.

Editorial extensions

If this is right

  • A NeRF generated with DreaMark is watermarked the instant generation ends, so the intermediate clean model that post-generation pipelines produce never exists inside the pipeline.
  • The method adds no constraints on NeRF architecture, so SDS-based generators with specialized geometry or appearance networks can adopt it without structural changes.
  • The reported robustness transfers from the decoder's training-time transformations to the generated model, giving 90%+ bit accuracy under Gaussian noise, scaling, blur, crop, and brightness, and roughly 88% accuracy under pruning.
  • Watermark capacity and accuracy trade off, as with prior methods: accuracy is 100% at 8 bits and falls to about 72% at 48 bits in the reported experiments.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the trigger seed were keyed by a long random secret instead of the message itself, the same scheme would support traitor tracing: each buyer could get a different viewport set while the decoder stays fixed.
  • The color-only backdooring result suggests a general design rule for generative-3D watermarking: hide information in appearance fields rather than geometry, because density changes perturb every view and break the SDS optimization.
  • The reported fine-tuning resistance likely depends on the attacker lacking the trigger viewports; an attacker with the decoder and a guessed short message could erase the watermark by fine-tuning on enumerated trigger views, so deployment should use longer messages or a separate key.
  • Because the decoder is shared across all watermarked NeRFs, the same fixed decoder could serve as a universal ownership verifier across many generated scenes, which post-generation methods that train a decoder per scene cannot do without extra storage.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes DreaMark, a method for embedding a secret message into a text-to-3D NeRF during score distillation sampling (SDS). The method first pretrains a HiDDeN-based watermark decoder, then generates a message-dependent set of trigger viewports from a SHA256 seed, and finally optimizes the NeRF with a combined SDS and BCE loss so that images rendered from trigger viewports decode to the secret message. The authors report experiments on 100 prompts, comparing bit accuracy and CLIP scores against two post-generation baselines, and evaluating robustness to image-level transformations and model-level fine-tuning and pruning. The central claims are that DreaMark is the first during-generation text-to-3D watermarking method, that no non-watermarked NeRF intermediate is ever produced, and that the watermark achieves 90+% bit accuracy without degrading generation quality.

Significance. If the claims were fully supported, DreaMark would be a useful contribution to NeRF copyright protection: it is architecture-agnostic, uses a single frozen decoder, and integrates watermarking into the SDS optimization loop rather than as a separate post-hoc stage. The experimental scale (100 generated scenes) is larger than prior NeRF watermarking evaluations, and the ablation on the transformation layer and on freezing the density MLP gives useful insight into why the proposed embedding works. However, the paper's headline claims are not supported by the reported pipeline and numbers: the two-stage scheme still creates a non-watermarked NeRF at the end of stage one, the abstract's '90+% accuracy' is contradicted by the 84.51% rotation result in Table 5 and the 82.59% 32-bit result in Table 1, and the trigger-viewport secrecy relies on a 16-bit message space that a white-box attacker can enumerate. The core optimization of Eq. (8) appears sound and the robustness results are suggestive, but the security and quality claims need substantial revision.

major comments (4)
  1. [Proposed Method, Two-stage Trigger Embedding; Figure 1; Contribution bullets] The claim that DreaMark 'ensures that no non-watermarked version of the NeRF is ever produced' is contradicted by the paper's own pipeline. In the first stage, the authors 'optimize a high-resolution NeRF (e.g., 512) by SDS (Eq.(5)) with joint optimization of both fc and fσ', which is exactly a fully trained, non-watermarked NeRF. Only in the second stage is fσ frozen and fc fine-tuned with the BCE watermark loss of Eq. (8). Thus, at the end of stage one, and during the transition to stage two, a non-watermarked NeRF exists in the training process. An internal staff member with access to the stage-one checkpoint or GPU memory can copy a model from which the decoder extracts no message. This directly undermines the main advertised advantage over post-generation methods. The authors should either redesign the method so that the watermark loss is present from the first optimization step, or substantially weaken the claim to state that the watermark is applied before release, not that no non-watermarked intermediate ever exists.
  2. [Abstract; Table 5; Table 1] The abstract's statement that 'the watermark achieves 90+% accuracy among both image-level attacks and model-level attacks' is not accurate for the reported experiments. Table 5 reports 84.51% bit accuracy under rotation, which is below 90%, and Table 1 reports 82.59% at 32-bit message length and 71.91% at 48-bit. The paper should state the per-condition results precisely in the abstract and introduction, or restrict the claim to the conditions where it actually holds.
  3. [Algorithm 1; Attacks on Dreamark's Watermarks, Model Fine-tuning] The secrecy of the trigger viewport set is a load-bearing security assumption, and the default message length makes it weak. With a 16-bit secret message, there are only 65,536 possible seeds for SHA256(m), so an attacker who knows Algorithm 1 can enumerate all candidate messages, generate each candidate trigger viewport set, render those views from the watermarked NeRF, and verify which message is embedded. The fine-tuning attack in Eq. (9) assumes 'the attacker has no prior knowledge of the secret message m,' but this assumption is not credible at 16 bits. The authors should evaluate with longer messages (e.g., 128 or 256 bits), add a keyed component to the trigger generation that is not derived solely from the message, or explicitly state and justify the threat model under which the seed space is large enough.
  4. [Table 2; Generation quality] The claim that DreaMark 'does not degrade generation quality' is supported only by mean CLIP scores without error bars or significance tests. In Table 2, the watermarked DreaMark CLIP/16 score (0.3218) is actually higher than the no-watermark baseline (0.3156), which is unexpected if the watermark is a fidelity cost; with only 100 prompts, this difference may not be significant. The authors should report per-prompt distributions, confidence intervals, or paired significance tests before asserting that generation quality is unaffected.
minor comments (5)
  1. [Preliminaries, NeRF] Equation (2) and the surrounding text state that the viewing direction d is in R2, but NeRF viewing directions are unit vectors in R3. Please correct the dimensionality.
  2. [Proposed Method, Choosing Trigger Embedding Media] The phrase 'arbitrary trigger viewport pT' is used throughout, but Algorithm 1 generates a fixed set of viewports from the message; extraction is only meaningful for viewports in that set. Please clarify the wording to avoid implying that any viewport works.
  3. [Figure 1 and Figure 3] Figure 1's bottom row shows no non-watermarked intermediate, which is inconsistent with the two-stage description. Figure 3 shows 'generated non-watermarked NeRF' as a comparison, which again conflicts with the claim that no non-watermarked NeRF is ever produced. Please reconcile these figures with the actual pipeline.
  4. [Implementation Details, Pretrained Watermark Extractor] The watermark decoder is pretrained with 48-bit messages but evaluated at 8, 16, 32, and 48 bits. Please clarify whether the decoder is retrained or adapted for each bit length, or whether a single 48-bit decoder is used with message lengths padded/truncated; otherwise the capacity comparison may not be apples-to-apples.
  5. [Proposed Method, Pretrain the watermark decoder] The description of PCA whitening applied to a linear decoder layer is brief; please provide the exact layer and how the whitening transform is computed and applied, since this step is claimed to remove bit bias.

Circularity Check

1 steps flagged · score 4.0 of 10

Trigger-view bit accuracy is the BCE training objective itself, so the headline 98.93% bit accuracy is an in-sample fit; robustness under held-out attacks remains independent.

  1. fitted input called prediction [Proposed Method, 'DreaMark' (Eq. 8); Experiment, 'Performance of Dreamark']
    "In the second stage, we freeze fσ to fine-tune fc by the following combined loss to conceal watermarks in trigger viewports pT : Lcomb(θ) =Lsds + Epi T [BCE(WD(g(θ, pi T )), m)] . (8) ... For each scene, its CLIP-Score is averaged among all viewports p, and bit accuracy is averaged among all N trigger viewport {pi T }N i=1."

    The reported headline accuracy (98.93% bit accuracy for 16-bit messages) is measured on the exact trigger viewports p_i_T and the exact secret message m that appear in Eq. (8)'s BCE term. Because the optimization directly minimizes BCE(WD(g(θ, p_i_T)), m) over those viewports, the NeRF is explicitly fitted so that the frozen decoder outputs m there. Reporting this as successful watermark embedding is equivalent to reporting the training objective in different units; it is not an independent prediction of watermark extraction. The non-circular evidence is the transfer to held-out conditions: bit accuracy after image distortions not included in DreaMark optimization, robustness to pruning/fine-tuning, and CLIP-Score quality, none of which is directly optimized by the watermark loss.

full rationale

The only load-bearing step that reduces to its own input is the bit-accuracy metric evaluated on the trigger viewports used in Eq. (8). High accuracy there is forced by construction, since the BCE term is the watermark training objective. This is a real but localized circularity. The paper's other headline results are not circular: robustness to Gaussian noise, blur, brightness, pruning, and fine-tuning is evaluated under conditions not present in the DreaMark optimization, and the CLIP-Score quality comparison is independent of the BCE watermark loss. The pre-trained HiDDeN decoder is an external, fixed component, not fitted on the rendered NeRF images, so it provides genuine independent structure. The trigger-set derivation from SHA256(m) and a PRNG is deterministic but not a circular step, though its entropy is weak for 16-bit messages. Separately, the claimed 'no non-watermarked version of the NeRF is ever produced' is contradicted by the described two-stage pipeline: stage one optimizes SDS with no watermark loss, so a non-watermarked NeRF exists before stage two; that is a correctness/security inconsistency rather than a derivation that reduces to its inputs. Overall circularity is moderate and localized, so the score is 4 rather than higher.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

The central method rests mostly on domain assumptions about SDS and decoder transferability, plus an ad-hoc design choice to freeze geometry. No new physical entities are introduced. The most fragile ledger item is the assumed secrecy of the trigger viewport seed for short messages.

free parameters (4)
  • Trigger viewport count N = 1000 (default)
    Chosen by hand; Fig. 4 shows bit accuracy is insensitive to N, so not load-bearing.
  • Decoder pretraining transformation parameters = crop 0.3/0.7, resize 0.3/0.7, rotation +/- pi/6
    Chosen by hand; these distortions determine the robustness that later transfers to the NeRF (Table 3).
  • Message length = 16 bits (default; 8, 32, 48 also tested)
    The capacity-robustness tradeoff is central; shorter messages are more robust and also have a smaller trigger-seed space.
  • Training stage lengths = 40,000 then 30,000 iterations
    Chosen by hand; no ablation on iteration count, so the optimality is not established.
assumptions (4)
  • domain assumption SDS gradient in Eq. 6 reliably optimizes a NeRF to match the text prompt
    The method relies on the standard Score Distillation Sampling procedure from Poole et al. (2022) as a working text-to-3D optimizer; problems like over-saturation are acknowledged in the related work.
  • domain assumption A HiDDeN decoder pretrained on COCO natural images yields gradients that are sufficient to embed a message into NeRF-rendered images
    Stated in 'Pre-train the watermark decoder' and used throughout; if the decoder's features are incompatible with rendered images, the BCE loss in Eq. 8 cannot drive embedding.
  • ad hoc to paper Freezing the geometry MLP f_sigma and fine-tuning only the color MLP f_c preserves multi-view consistency and generation quality
    Ablation in Table 4 supports this empirically, but it is a design choice specific to this paper and not guaranteed by prior theory.
  • ad hoc to paper The trigger viewports generated from SHA256(m) and a PRNG are effectively secret and unguessable
    Algorithm 1 ties the set to the message, but the paper uses 16-bit messages, making the seed space enumerable.

how reviews work

0 comments
Cite this review

Pith. "Pith review of DreaMark: Rooting Watermark in Score Distillation Sampling Generated Neural Radiance Fields." pith.science (2026). https://pith.science/paper/TWKLE7V6

@misc{pith2026241215278,
  author       = {Pith},
  title        = {Pith review of: DreaMark: Rooting Watermark in Score Distillation Sampling Generated Neural Radiance Fields},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/TWKLE7V6}},
  note         = {Machine review of arXiv:2412.15278}
}
read the original abstract

Recent advancements in text-to-3D generation can generate neural radiance fields (NeRFs) with score distillation sampling, enabling 3D asset creation without real-world data capture. With the rapid advancement in NeRF generation quality, protecting the copyright of the generated NeRF has become increasingly important. While prior works can watermark NeRFs in a post-generation way, they suffer from two vulnerabilities. First, a delay lies between NeRF generation and watermarking because the secret message is embedded into the NeRF model post-generation through fine-tuning. Second, generating a non-watermarked NeRF as an intermediate creates a potential vulnerability for theft. To address both issues, we propose Dreamark to embed a secret message by backdooring the NeRF during NeRF generation. In detail, we first pre-train a watermark decoder. Then, the Dreamark generates backdoored NeRFs in a way that the target secret message can be verified by the pre-trained watermark decoder on an arbitrary trigger viewport. We evaluate the generation quality and watermark robustness against image- and model-level attacks. Extensive experiments show that the watermarking process will not degrade the generation quality, and the watermark achieves 90+% accuracy among both image-level attacks (e.g., Gaussian noise) and model-level attacks (e.g., pruning attack).

Figures

Figures reproduced from arXiv: 2412.15278 by the authors.

Figure 1
Figure 1. Attack scenario. If company-generated content is [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Overview. (a) We first pre-train a watermark encoder [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Images rendered from trigger viewports. Top: generated non-watermarked NeRF. Bottom: Watermarked NeRF gen [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: Effect under varied trigger size. Bit accuracy is not [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]
Figure 5
Figure 5. Figure 5: Robustness against model-level attacks. xw, xa are images rendered from watermarked and attacked NeRF. produce trigger viewports since trigger viewports are only related to m. For the first scenario, when the attacker has full access to WD, the attacker can use an adve…

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Hallo4D: Multi-Modal Hallucination Mitigation for Consistent Spatio-Temporal Generation

    cs.CV 2026-07 conditional novelty 6.0 of 10

    Hallo4D uses vision-language models to detect and correct spatial and temporal mistakes in AI-generated 3D and 4D content, improving consistency without retraining the base generators.

Reference graph

Works this paper leans on

44 extracted references · 19 canonical work pages · cited by 1 Pith paper

  1. [1]

    Adi, Y.; Baum, C.; Cisse, M.; Pinkas, B.; and Keshet, J. 2018. Turning your weakness into a strength: Watermarking deep neural networks by backdooring. In 27th USENIX security symposium (USENIX Security 18), 1615--1631

    work page 2018

  2. [2]

    D.; and Koushanfar, F

    Chen, H.; Rouhani, B. D.; and Koushanfar, F. 2019. Blackmarks: Blackbox multibit watermarking for deep neural networks. arXiv preprint arXiv:1904.00344

    arXiv 2019

  3. [3]

    Chen, R.; Chen, Y.; Jiao, N.; and Jia, K. 2023. Fantasia3d: Disentangling geometry and appearance for high-quality text-to-3d content creation. In Proceedings of the IEEE/CVF international conference on computer vision, 22246--22256

    2023

  4. [4]

    Fernandez, P.; Couairon, G.; J \'e gou, H.; Douze, M.; and Furon, T. 2023. The stable signature: Rooting watermarks in latent diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vision, 22466--22477

    2023

  5. [5]

    Ho, J.; Jain, A.; and Abbeel, P. 2020. Denoising diffusion probabilistic models. Advances in neural information processing systems, 33: 6840--6851

    2020

  6. [6]

    T.; Abbeel, P.; and Poole, B

    Jain, A.; Mildenhall, B.; Barron, J. T.; Abbeel, P.; and Poole, B. 2022. Zero-shot text-guided object generation with dream fields. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 867--876

    work page 2022

  7. [7]

    I.; Jang, M.; Kim, J

    Jang, Y.; Lee, D. I.; Jang, M.; Kim, J. W.; Yang, F.; and Kim, S. 2024. WateRF: Robust Watermarks in Radiance Fields for Protection of Copyrights. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 12087--12097

    work page 2024

  8. [8]

    A.; Chandrasekaran, V.; and Papernot, N

    Jia, H.; Choquette-Choo, C. A.; Chandrasekaran, V.; and Papernot, N. 2021. Entangled watermarks as a defense against model extraction. In 30th USENIX security symposium (USENIX Security 21), 1937--1954

    work page 2021

Show all 44 references
  1. [9]

    Jiang, R.; Zhou, H.; Zhang, W.; and Yu, N. 2017. Reversible data hiding in encrypted three-dimensional mesh models. IEEE Transactions on Multimedia, 20(1): 55--67

    2017

  2. [10]

    Le Merrer, E.; Perez, P.; and Tr \'e dan, G. 2020. Adversarial frontier stitching for remote neural network watermarking. Neural Computing and Applications, 32(13): 9233--9244

    2020

  3. [11]

    Y.; Fan, Z.; Pan, P.; and Wang, Z

    Li, C.; Feng, B. Y.; Fan, Z.; Pan, P.; and Wang, Z. 2023. Steganerf: Embedding invisible information within neural radiance fields. In Proceedings of the IEEE/CVF International Conference on Computer Vision, 441--453

    2023

  4. [12]

    Liang, Y.; Yang, X.; Lin, J.; Li, H.; Xu, X.; and Chen, Y. 2024. Luciddreamer: Towards high-fidelity text-to-3d generation via interval score matching. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 6517--6526

    2024

  5. [13]

    Lin, C.-H.; Gao, J.; Tang, L.; Takikawa, T.; Zeng, X.; Huang, X.; Kreis, K.; Fidler, S.; Liu, M.-Y.; and Lin, T.-Y. 2023. Magic3d: High-resolution text-to-3d content creation. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 300--309

    2023

  6. [14]

    Lin, T.-Y.; Maire, M.; Belongie, S.; Hays, J.; Perona, P.; Ramanan, D.; Doll \'a r, P.; and Zitnick, C. L. 2014. Microsoft coco: Common objects in context. In Computer Vision--ECCV 2014: 13th European Conference, Zurich, Switzerland, September 6-12, 2014, Proceedings, Part V 1...

    2014

  7. [15]

    C.; See, S.; and Wan, R

    Luo, Z.; Guo, Q.; Cheung, K. C.; See, S.; and Wan, R. 2023. Copyrnerf: Protecting the copyright of neural radiance fields. In Proceedings of the IEEE/CVF International Conference on Computer Vision, 22401--22411

    2023

  8. [16]

    Metzer, G.; Richardson, E.; Patashnik, O.; Giryes, R.; and Cohen-Or, D. 2023. Latent-nerf for shape-guided generation of 3d shapes and textures. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 12663--12673

    2023

  9. [17]

    P.; Ortiz-Cayon, R.; Kalantari, N

    Mildenhall, B.; Srinivasan, P. P.; Ortiz-Cayon, R.; Kalantari, N. K.; Ramamoorthi, R.; Ng, R.; and Kar, A. 2019. Local light field fusion: Practical view synthesis with prescriptive sampling guidelines. ACM Transactions on Graphics (ToG), 38(4): 1--14

    2019

  10. [18]

    P.; Tancik, M.; Barron, J

    Mildenhall, B.; Srinivasan, P. P.; Tancik, M.; Barron, J. T.; Ramamoorthi, R.; and Ng, R. 2021. Nerf: Representing scenes as neural radiance fields for view synthesis. Communications of the ACM, 65(1): 99--106

    2021

  11. [19]

    M \"u ller, T.; Evans, A.; Schied, C.; and Keller, A. 2022. Instant neural graphics primitives with a multiresolution hash encoding. ACM transactions on graphics (TOG), 41(4): 1--15

    2022

  12. [20]

    Peng, F.; Liao, T.; and Long, M. 2022. A semi-fragile reversible watermarking for authenticating 3D models in dual domains based on variable direction double modulation. IEEE Transactions on Circuits and Systems for Video Technology, 32(12): 8394--8408

    2022

  13. [21]

    Peng, F.; Long, B.; and Long, M. 2021. A general region nesting-based semi-fragile reversible watermarking for authenticating 3D mesh models. IEEE transactions on circuits and systems for video technology, 31(11): 4538--4553

    2021

  14. [22]

    T.; and Mildenhall, B

    Poole, B.; Jain, A.; Barron, J. T.; and Mildenhall, B. 2022. Dreamfusion: Text-to-3d using 2d diffusion. arXiv preprint arXiv:2209.14988

    2022 arXiv

  15. [23]

    W.; Hallacy, C.; Ramesh, A.; Goh, G.; Agarwal, S.; Sastry, G.; Askell, A.; Mishkin, P.; Clark, J.; et al

    Radford, A.; Kim, J. W.; Hallacy, C.; Ramesh, A.; Goh, G.; Agarwal, S.; Sastry, G.; Askell, A.; Mishkin, P.; Clark, J.; et al. 2021. Learning transferable visual models from natural language supervision. In International conference on machine learning, 8748--8763. PMLR

    2021

  16. [24]

    Ramesh, A.; Dhariwal, P.; Nichol, A.; Chu, C.; and Chen, M. 2022. Hierarchical text-conditional image generation with clip latents. arXiv preprint arXiv:2204.06125, 1(2): 3

    2022 arXiv

  17. [25]

    Rombach, R.; Blattmann, A.; Lorenz, D.; Esser, P.; and Ommer, B. 2022. High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 10684--10695

    2022

  18. [26]

    Shi, Y.; Wang, P.; Ye, J.; Long, M.; Li, K.; and Yang, X. 2023. Mvdream: Multi-view diffusion for 3d generation. arXiv preprint arXiv:2308.16512

    2023 arXiv

  19. [27]

    Song, J.; Meng, C.; and Ermon, S. 2020. Denoising diffusion implicit models. arXiv preprint arXiv:2010.02502

    2020 arXiv

  20. [28]

    P.; Kumar, A.; Ermon, S.; and Poole, B

    Song, Y.; Sohl-Dickstein, J.; Kingma, D. P.; Kumar, A.; Ermon, S.; and Poole, B. 2020. Score-based generative modeling through stochastic differential equations. arXiv preprint arXiv:2011.13456

    2020 arXiv

  21. [29]

    G.; Marchal, S.; and Asokan, N

    Szyller, S.; Atli, B. G.; Marchal, S.; and Asokan, N. 2021. Dawn: Dynamic adversarial watermarking of neural networks. In Proceedings of the 29th ACM International Conference on Multimedia, 4417--4425

    2021

  22. [30]

    Tang, J.; Ren, J.; Zhou, H.; Liu, Z.; and Zeng, G. 2023. Dreamgaussian: Generative gaussian splatting for efficient 3d content creation. arXiv preprint arXiv:2309.16653

    2023 arXiv

  23. [31]

    Tsai, Y.-Y. 2020. Separable reversible data hiding for encrypted three-dimensional models based on spatial subdivision and space encoding. IEEE transactions on multimedia, 23: 2286--2296

    2020

  24. [32]

    Tsai, Y.-Y.; and Liu, H.-L. 2022. Integrating coordinate transformation and random sampling into high-capacity reversible data hiding in encrypted polygonal models. IEEE Transactions on Dependable and Secure Computing, 20(4): 3508--3519

    2022

  25. [33]

    G.; Tirkel, A

    Van Schyndel, R. G.; Tirkel, A. Z.; and Osborne, C. F. 1994. A digital watermark. In Proceedings of 1st international conference on image processing, volume 2, 86--90. IEEE

    1994

  26. [34]

    Wang, Z.; Lu, C.; Wang, Y.; Bao, F.; Li, C.; Su, H.; and Zhu, J. 2024. Prolificdreamer: High-fidelity and diverse text-to-3d generation with variational score distillation. Advances in Neural Information Processing Systems, 36

    2024

  27. [35]

    Wen, Y.; Kirchenbauer, J.; Geiping, J.; and Goldstein, T. 2024. Tree-rings watermarks: Invisible fingerprints for diffusion images. Advances in Neural Information Processing Systems, 36

    2024

  28. [36]

    Yang, Z.; Zeng, K.; Chen, K.; Fang, H.; Zhang, W.; and Yu, N. 2024. Gaussian Shading: Provable Performance-Lossless Image Watermarking for Diffusion Models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 12162--12171

    2024

  29. [37]

    Yi, T.; Fang, J.; Wu, G.; Xie, L.; Zhang, X.; Liu, W.; Tian, Q.; and Wang, X. 2023. Gaussiandreamer: Fast generation from text to 3d gaussian splatting with point cloud priors. arXiv preprint arXiv:2310.08529

    2023 arXiv

  30. [38]

    You, Y.; Li, J.; Reddi, S.; Hseu, J.; Kumar, S.; Bhojanapalli, S.; Song, X.; Demmel, J.; Keutzer, K.; and Hsieh, C.-J. 2019. Large batch optimization for deep learning: Training bert in 76 minutes. arXiv preprint arXiv:1904.00962

    2019 arXiv

  31. [39]

    Zhang, H.; Chen, B.; Yang, H.; Qu, L.; Wang, X.; Chen, L.; Long, C.; Zhu, F.; Du, D.; and Zheng, M. 2024. Avatarverse: High-quality & stable 3d avatar creation from text and pose. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 38, 7124--7132

    2024

  32. [40]

    P.; Huang, H.; and Molloy, I

    Zhang, J.; Gu, Z.; Jang, J.; Wu, H.; Stoecklin, M. P.; Huang, H.; and Molloy, I. 2018. Protecting intellectual property of deep neural networks with watermarking. In Proceedings of the 2018 on Asia conference on computer and communications security, 159--172

    2018

  33. [41]

    Zhu, J.; Kaplan, R.; Johnson, J.; and Fei-Fei, L. 2018. Hidden: Hiding data with deep networks. In Proceedings of the European conference on computer vision (ECCV), 657--672

    2018

  34. [42]

    Zhu, X.; Ye, G.; Luo, X.; and Wei, X. 2024. Rethinking Mesh Watermark: Towards Highly Robust and Adaptable Deep 3D Mesh Watermarking. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 38, 7784--7792

    2024

  35. [43]

    , " * write output.state after.block = add.period write newline

    ENTRY address archivePrefix author booktitle chapter edition editor eid eprint howpublished institution isbn journal key month note number organization pages publisher school series title type volume year label extra.label sort.label short.list INTEGERS output.state before.all...

  36. [44]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 gl...

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.