Research map / 3D vision / Gaussian splatting
GaussianMarker: Uncertainty-Aware Copyright Protection of 3D Gaussian Splatting
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes GaussianMarker, an uncertainty-aware watermarking method that densifies high-uncertainty 3D Gaussians as invisible perturbations and decodes messages from both 3D Gaussians (PointNet decoder) and rendered images (HiDDeN decoder).
Problem
Copyright protection for 3D Gaussian Splatting models: existing watermarking methods for meshes, point clouds, and NeRFs do not directly apply to explicit 3D Gaussians, and naive embedding distorts rendered views and is not robust.
Approach
Estimate per-Gaussian uncertainty via a Laplace-approximation Hessian (Fisher information) summed over training views, keep original Gaussians fixed, and embed messages as densified copies of high-uncertainty Gaussians; a 2D HiDDeN decoder is distilled into these perturbations and a PointNet decoder with 3D distortion layers is trained for extraction from Gaussians.
Key results
- On Blender, the method reaches 97.91% bit accuracy without distortion and 31.53 PSNR, versus 60.83% for CopyRNeRF and 80.22% for 3DGS with messages (which drops to 22.65 PSNR).
- The 3D decoder achieves 100% bit accuracy on watermarked Gaussians with near-zero geometry difference (L1 0.00003, SNR 43.23), versus 0.10513 L1 for 3DGS with messages.
- Perturbing low-uncertainty Gaussians instead of high-uncertainty ones drops LLFF-style decoding accuracy from 97.07% to 76.56% and PSNR from 28.71 to 26.61.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use GaussianMarker instead of CopyRNeRF | 3DGS watermarking · Blender | PSNR/SSIM: 30.29/0.8878 -> 31.53/}/0.9082 | Helped |
| Use GaussianMarker instead of 3DGS with messages | 3DGS watermarking · Blender | bit accuracy (None): 80.22 -> 97.91 | Helped |
| Use GaussianMarker instead of CopyRNeRF | 3DGS watermarking · LLFF | PSNR/SSIM: 24.03/0.7747 -> 28.61/0.8930 | Helped |
| Use GaussianMarker instead of 3DGS with messages | 3DGS watermarking · LLFF | bit accuracy (None): 83.33 -> 98.33 | Helped |
| Use GaussianMarker instead of 3DGS with messages | 3DGS watermarking · MipNeRF360 | bit accuracy (None): 77.08 -> 97.32 | Helped |
| Use the 3D message decoder rather than the 2D message decoder for 3D attack extraction | GaussianMarker · Blender, LLFF, MipNeRF360 | bit accuracy (Cropout): 48.23 -> 92.70 | Helped |
| Perturb low-uncertainty instead of high-uncertainty Gaussians (ablation) | GaussianMarker · Blender ship | Acc: 97.07 -> 76.56 | Hurt |
| Perturb low-uncertainty instead of high-uncertainty Gaussians (ablation) | GaussianMarker · Blender ship | PSNR: 28.71 -> 26.61 | Hurt |
| Raise the uncertainty threshold from average × 1.0 to average × 3.7 (ablation) | GaussianMarker · Blender ship | ACC: 95.21% -> 92.08% | Hurt |
| Lower the uncertainty threshold from average × 1.0 to average × 0.24 (ablation) | GaussianMarker · Blender ship | ACC: 95.21% -> 96.88% | Helped |
Surprising findings
- The 2D-decoder-based message extraction from the Gaussians is fragile to 3D attacks: the 2D decoder falls to 57.05% under noise and 48.23% under cropout, suggesting 3D attacks easily defeat 2D-based extraction.
- HiDDeN preprocessing before 3DGS training gives around 50% bit accuracy, indicating messages cannot be transferred from 2D images into 3D Gaussians via that route.
Limitations
- Robustness to malicious operations is not fully addressed; the authors note further measures beyond technology are needed.
- Dynamic 3DGS scenarios are not covered; robustness there is left to future work.
- Densifying high-uncertainty Gaussians increases the number of Gaussians, with a trade-off between bit accuracy and image quality depending on the threshold.
Experimental setup
Datasets: Blender LLFF Mip-NeRF360
Benchmarks: Blender LLFF Mip-NeRF360
Metrics: PSNR SSIM LPIPS bit accuracy L1 position difference SNR
Baselines: CopyRNeRF HiDDeN + 3DGS 3DGS with messages 3DGS with fine-tuning
Builds on: 3D Gaussian Splatting HiDDeN CopyRNeRF PointNet Laplace approximation
Closest papers by meaning
- GuardSplat: Efficient and Robust Watermarking for 3D Gaussian Splatting (CVPR 2025 · similarity 0.93)
- 3D-GSW: 3D Gaussian Splatting for Robust Watermarking (CVPR 2025 · similarity 0.92)
- GS-Hider: Hiding Messages into 3D Gaussian Splatting (NeurIPS 2024 · similarity 0.91)
- SecureGS: Boosting the Security and Fidelity of 3D Gaussian Splatting Steganography (ICLR 2025 · similarity 0.90)
- Geometry Cloak: Preventing TGS-based 3D Reconstruction from Copyrighted Images (NeurIPS 2024 · similarity 0.90)
- Rethinking Mesh Watermark: Towards Highly Robust and Adaptable Deep 3D Mesh Watermarking (AAAI 2024 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.