Research map / Image generation / Autoregressive and latent generation
DreaMark: Rooting Watermark in Score Distillation Sampling Generated Neural Radiance Fields
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes DreaMark, a during-generation watermarking method that backdoors the color MLP of a NeRF during score distillation sampling so a pre-trained HiDDeN decoder can extract an m-dependent secret message from trigger viewports.
Problem
Watermarking text-to-3D NeRFs generated with score distillation sampling; existing post-generation methods (CopyRNeRF, WateNeRF) create a non-watermarked intermediate that can be stolen and often need architecture changes.
Approach
Embed the watermark during SDS generation by backdooring only the color mapping (freezing the density MLP in a second stage) so that images rendered from message-dependent trigger viewports decode to the secret message via a fixed pre-trained HiDDeN decoder, without changing NeRF architecture.
Key results
- 16-bit messages: DreaMark reaches 98.93% bit accuracy versus 91.16% for SDS+CopyRNeRF and 94.24% for SDS+WateRF.
- CLIP/16 score rises from 0.3156 (no watermark) to 0.3218 with DreaMark, suggesting no generation-quality loss.
- Robust to image-level attacks with bit accuracy above 90% for most transforms (except rotation at 84.51%); pruning keeps about 88% accuracy at PSNR below 27dB.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use during-generation watermarking with backdoors during SDS instead of post-generation WateRF | DreaMark on Instant NGP · 16-bit message | bit accuracy: 94.24% -> 98.93% | Helped |
| Use during-generation watermarking with backdoors during SDS instead of post-generation CopyRNeRF | DreaMark on Instant NGP · 16-bit message | bit accuracy: 91.16% -> 98.93% | Helped |
| Use during-generation watermarking instead of no watermark | DreaMark on Instant NGP · Generated scenes | CLIP/16: 0.3156 -> 0.3218 | Helped |
| Use during-generation watermarking instead of no watermark | DreaMark on Instant NGP · Generated scenes | CLIP/32: 0.2859 -> 0.2943 | Helped |
| Remove transformation layer T during watermark decoder pretraining (ablation) | DreaMark watermark decoder · Gaussian noise, rotation, scaling, and crop | bit accuracy: With T: 0.93, 0.84, 0.92, 0.91; Without T: 0.64, 0.57, 0.56, 0.89 | Hurt |
| Optimize both color mapping f_c and geometric mapping f_sigma instead of f_c only (ablation) | DreaMark watermark embedding · Generated scenes | bit accuracy: 98.93% -> 60.43% | Hurt |
| Optimize both color mapping f_c and geometric mapping f_sigma instead of f_c only (ablation) | DreaMark watermark embedding · Generated scenes | CLIP/16: 0.3218 -> 0.2308 | Hurt |
| Optimize both color mapping f_c and geometric mapping f_sigma instead of f_c only (ablation) | DreaMark watermark embedding · Generated scenes | CLIP/32: 0.2943 -> 0.2241 | Hurt |
| Increase trigger viewport count from N=50 to N=20000 | DreaMark · Trigger viewport count | bit accuracy: 99.88% -> 96.27% | Hurt |
| Apply rotation (± π/6) to rendered trigger-view images | DreaMark · Rotation (± π/6) | bit accuracy: 98.93% -> 84.51% | Hurt |
| Apply Gaussian noise (v=0.1) to rendered trigger-view images | DreaMark · Gaussian noise (v=0.1) | bit accuracy: 98.93% -> 93.75% | Hurt |
| Apply Gaussian blur (deviation=0.1) to rendered trigger-view images | DreaMark · Gaussian blur (deviation=0.1) | bit accuracy: 98.93% -> 98.93% | No clear effect |
Surprising findings
- Bit accuracy is not significantly affected by the number of trigger viewports (99.88% at N=50 down to 96.27% at N=20000).
- Backdooring the density MLP as well as the color MLP substantially lowers both bit accuracy (60.43%) and CLIP score.
Limitations
- Robustness to rotation is weak (84.51% bit accuracy).
- Evaluation of invisibility relies on CLIP score since no original NeRF exists for PSNR comparison.
- Evaluated on only 100 prompts and a single NeRF backbone (Instant NGP).
Experimental setup
Datasets: COCO Blender LLFF
Benchmarks: Blender LLFF
Metrics: bit accuracy CLIP score PSNR
Baselines: CopyRNeRF WateNeRF
Builds on: DreamFusion Magic3D HiDDeN CopyRNeRF Instant NGP
Closest papers by meaning
- WateRF: Robust Watermarks in Radiance Fields for Protection of Copyrights (CVPR 2024 · similarity 0.91)
- WMCopier: Forging Invisible Watermarks on Arbitrary Images (NeurIPS 2025 · similarity 0.87)
- WAVES: Benchmarking the Robustness of Image Watermarks (ICML 2024 · similarity 0.85)
- Black-Box Forgery Attacks on Semantic Watermarks for Diffusion Models (CVPR 2025 · similarity 0.85)
- Secure Seed-Based Multi-bit Watermarking for Diffusion Models from First Principles (NeurIPS 2026 · similarity 0.85)
- Attack-Resilient Image Watermarking Using Stable Diffusion (NeurIPS 2024 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.