Research map / 3D vision / Gaussian splatting
GuardSplat: Efficient and Robust Watermarking for 3D Gaussian Splatting
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes GuardSplat, a fast 3DGS watermarking framework that trains a CLIP-text-feature message decoder and embeds bits into per-Gaussian spherical harmonic offsets with distortion-robust training.
Problem
Copyright protection for 3D Gaussian Splatting assets: existing watermarking methods are slow, low-capacity, alter 3D structure, or are not robust to rendering distortions.
Approach
Train a message decoder on CLIP textual features (message decoupling, so only the decoder is optimized without encoder), then freeze it and embed messages by learning per-Gaussian SH offsets with an offset loss, while a differentiable distortion layer improves robustness.
Key results
- With 16-bit messages on Blender/LLFF, GuardSplat reaches 99.64% bit accuracy with 41.55 dB PSNR, versus 95.67% and 32.79 dB for WateRF.
- With 32-bit messages, GuardSplat achieves 99.04% bit accuracy and 39.40 dB PSNR, outperforming GaussianMarker (98.85%, 33.98 dB).
- Watermarking takes about 10 minutes on a single RTX 3090 after 5 minutes of decoder training, versus roughly 13-84 hours for NeRF/3DGS baselines.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| use GuardSplat instead of GaussianMarker | 3DGS watermarking · Blender and LLFF, 32-bit messages | Bit Acc: 98.85 -> 99.04 | Helped |
| use GuardSplat instead of GaussianMarker | 3DGS watermarking · Blender and LLFF, 32-bit messages | PSNR: 33.98 -> 39.40 | Helped |
| use GuardSplat instead of GaussianMarker | 3DGS watermarking · 16-bit messages, rotation (±π/6) | Bit accuracy: 70.84 -> 94.56 | Helped |
| use GuardSplat instead of GaussianMarker | 3DGS watermarking · 16-bit messages, JPEG (10% quality) | Bit accuracy: 86.22 -> 94.70 | Helped |
| update all 3D Gaussian attributes instead of embedding with SH-aware offsets (ablation) | 3DGS watermarking · Blender and LLFF, 32-bit messages | PSNR: 39.40 -> 36.56 | Hurt |
| embed messages in DC components of SH features instead of SH-aware offsets (ablation) | 3DGS watermarking · Blender and LLFF, 32-bit messages | Bit Acc: 99.04 -> 74.59 | Hurt |
| embed messages in residual SH features instead of SH-aware offsets (ablation) | 3DGS watermarking · Blender and LLFF, 32-bit messages | Bit Acc: 99.04 -> 98.25 | Hurt |
| remove reconstruction loss and offset loss (ablation) | GuardSplat · Blender and LLFF, 32-bit messages | PSNR: 39.40 -> 31.79 | Hurt |
| remove offset loss (ablation) | GuardSplat · Blender and LLFF, 32-bit messages | PSNR: 39.40 -> 36.88 | Hurt |
| increase reconstruction-loss weight from 0 to 1 (ablation) | GuardSplat · Blender and LLFF, 32-bit messages | PSNR | Helped |
| vary message-loss weight from 0 to 0.1 (ablation) | GuardSplat · Blender and LLFF, 32-bit messages | Bit accuracy | Mixed |
| vary offset-loss weight (ablation) | GuardSplat · Blender and LLFF, 32-bit messages | PSNR | Mixed |
Surprising findings
- Altering all Gaussian attributes (Offsetall) gives lower fidelity than SH-only embedding, and training only DC SH offsets drops bit accuracy to 74.59%.
Limitations
- Robustness to Gaussian noise and blur is attributed to CLIP and not explicitly trained; distortions like rotation and JPEG are handled by the distortion layer.
- Evaluated only on Blender and LLFF with 8 scenes each.
- Some distortions (e.g., VAE attack, combined) still show reduced bit accuracy (82.35% and 93.38%).
Experimental setup
Datasets: Blender LLFF
Benchmarks: Blender LLFF
Metrics: bit accuracy PSNR SSIM LPIPS StegExpose detection ROC
Baselines: CopyRNeRF WateRF GaussianMarker 3DGS w/ WateRF 3DGS + CIN 3DGS + SSL 3DGS + HiDDeN 3DGS + StegaStamp
Builds on: 3D Gaussian Splatting CLIP HiDDeN WateRF
Closest papers by meaning
- GaussianMarker: Uncertainty-Aware Copyright Protection of 3D Gaussian Splatting (NeurIPS 2024 · similarity 0.93)
- 3D-GSW: 3D Gaussian Splatting for Robust Watermarking (CVPR 2025 · similarity 0.92)
- GS-Hider: Hiding Messages into 3D Gaussian Splatting (NeurIPS 2024 · similarity 0.90)
- SecureGS: Boosting the Security and Fidelity of 3D Gaussian Splatting Steganography (ICLR 2025 · similarity 0.89)
- Geometry Cloak: Preventing TGS-based 3D Reconstruction from Copyrighted Images (NeurIPS 2024 · similarity 0.88)
- Rethinking Mesh Watermark: Towards Highly Robust and Adaptable Deep 3D Mesh Watermarking (AAAI 2024 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.