Research map / 3D vision / NeRF and radiance fields
WateRF: Robust Watermarks in Radiance Fields for Protection of Copyrights
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Fine-tunes pretrained NeRF models (Vanilla NeRF and TensoRF) so rendered images carry a binary watermark, using a DWT LL-subband input to a pretrained HiDDeN decoder and deferred back-propagation with a patch loss.
Problem
Watermarking NeRF-based 3D representations to protect copyright, where prior methods only work for either implicit or explicit NeRF and are not robust to distortions such as cropping.
Approach
Embed watermark bits into NeRF weights by fine-tuning with a frequency-domain loss: the rendered image's 2-level DWT LL subband is fed to a frozen pretrained HiDDeN decoder, and deferred back-propagation with a patch-wise loss (MAE, TV, SSIM) preserves quality while enabling full-resolution rendering; no encoder is needed at fine-tuning time.
Key results
- At 48 bits, the method reaches 85.82% bit accuracy with TensoRF and 70.43% with Vanilla NeRF, versus 60.06% for CopyRNeRF.
- At 16 bits with TensoRF, PSNR 32.79 and bit accuracy 95.67% vs CopyRNeRF's 91.16% bit accuracy and 26.29 PSNR.
- Training is reported as about six times faster than CopyRNeRF.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| fine-tune NeRF with WateRF instead of CopyRNeRF | NeRF watermarking · LLFF + Blender, 16 bits | bit accuracy (%): 91.16 -> 94.24 | Helped |
| fine-tune TensoRF with WateRF | TensoRF · LLFF + Blender, 16 bits | bit accuracy (%): 91.16 -> 95.67 | Helped |
| use WateRF rather than CopyRNeRF | NeRF · LLFF + Blender, 16 bits | PSNR: 26.29 -> 28.81 | Helped |
| use WateRF rather than CopyRNeRF | TensoRF · LLFF + Blender, 16 bits | PSNR: 26.29 -> 32.79 | Helped |
| add DWT frequency-domain embedding instead of DFT (ablation) | WateRF with TensoRF · LLFF + Blender, 16 bits | bit accuracy (%): 71.06 -> 95.67 | Helped |
| add DWT frequency-domain embedding instead of DCT (ablation) | WateRF with TensoRF · LLFF + Blender, 16 bits | bit accuracy (%): 43.75 -> 95.67 | Helped |
| add DWT frequency-domain embedding rather than no frequency transform (ablation) | WateRF with TensoRF · LLFF + Blender, 16 bits | bit accuracy (%): 72.68 -> 95.67 | Helped |
| use DWT level 2 rather than level 1 (ablation) | WateRF with TensoRF · LLFF + Blender, 16 bits | bit accuracy (%): 91.16 -> 95.67 | Helped |
| use DWT level 2 rather than level 3 (ablation) | WateRF with TensoRF · LLFF + Blender, 16 bits | bit accuracy (%): 90.96 -> 95.67 | Helped |
| use DWT level 2 rather than level 4 (ablation) | WateRF with TensoRF · LLFF + Blender, 16 bits | bit accuracy (%): 85.02 -> 95.67 | Helped |
| add patch-wise loss (ablation) | WateRF with NeRF · LLFF + Blender, 16 bits | bit accuracy: 82.47 -> 94.78 | Helped |
| add DWT (ablation) | WateRF with NeRF · LLFF + Blender, 16 bits | bit accuracy: 43.54 -> 94.78 | Helped |
Surprising findings
- Embedding in the LL subband (rather than the high-frequency subbands conventionally used) gave higher bit accuracy for the HiDDeN decoder.
Limitations
- Decoder training is time-consuming (about 12 hours on one RTX 3090).
- Each model encodes only one unique message, requiring fine-tuning for each new message; bit accuracy drops with many messages.
- Robustness against model-level attacks (e.g., fine-tuning or pruning of the NeRF) is not considered.
Experimental setup
Datasets: Blender (NeRF synthetic) LLFF
Benchmarks: Blender LLFF
Metrics: bit accuracy PSNR SSIM LPIPS training time
Baselines: CopyRNeRF HiDDeN+NeRF
Builds on: HiDDeN NeRF TensoRF deferred back-propagation (ARF) CopyRNeRF
Closest papers by meaning
- DreaMark: Rooting Watermark in Score Distillation Sampling Generated Neural Radiance Fields (AAAI 2025 · similarity 0.91)
- 3D-GSW: 3D Gaussian Splatting for Robust Watermarking (CVPR 2025 · similarity 0.86)
- WAVES: Benchmarking the Robustness of Image Watermarks (ICML 2024 · similarity 0.85)
- GaussianMarker: Uncertainty-Aware Copyright Protection of 3D Gaussian Splatting (NeurIPS 2024 · similarity 0.85)
- CodecNeRF: Toward Fast Encoding and Decoding, Compact, and High-quality Novel-view Synthesis (AAAI 2025 · similarity 0.85)
- WMCopier: Forging Invisible Watermarks on Arbitrary Images (NeurIPS 2025 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.