Research map / 3D vision / Face and shape
Mesh Watermark Removal Attack and Mitigation: A Novel Perspective of Function Space
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes FuncEvade, a function-space mesh watermark removal attack that re-extracts a mesh from the SDF of a watermarked mesh, and FuncEnce, a watermark embedded in the SDF via spherical partitioning and message-guided deformation that survives isosurfacing.
Problem
Existing mesh watermarks embed messages in vertex coordinates and are only tested against discrete-space removal attacks that keep topology, so their robustness to topology-changing function-space re-extraction (via SDF isosurfacing) is unknown.
Approach
Attack: fit an SDF to the watermarked mesh and re-extract a differently discretized mesh by marching cubes, which evades all prior mesh watermarks. Defense: embed one bit per spherical partition by outward/inward deformation of the SDF itself, so the watermark is inherited by meshes extracted from the SDF.
Key results
- FuncEvade (attack) achieves 100% evasion rate against all five prior mesh watermarking methods, with Hausdorff distance 0.003-0.004.
- FuncEnce reduces the evasion rate of the SDF-based attack to 0.3%, while remeshing evasion drops to 0.1%.
- FuncEnce achieves the lowest Hausdorff distance (0.004) among compared watermarks, with accuracy 95.69% versus 98.17% for the best baseline (Zhu et al.).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Extract a new mesh from the watermarked mesh's SDF (FuncEvade) | Previous mesh watermarking methods · FuncEvade removal | Evasion Rate: 100\% | Helped |
| Extract a new mesh from the watermarked mesh's SDF instead of remeshing | Watermark removal · FuncEvade removal | HD: 0.005 -> 0.004; 0.006 -> 0.003; 0.005 -> 0.004; 0.006 -> 0.003; 0.005 -> 0.004 | Helped |
| Watermark the SDF through message-guided deformation | Mesh watermarking · Remesh removal | Evasion Rate: 100\% -> 0.1\% | Helped |
| Watermark the SDF through message-guided deformation | Mesh watermarking · FuncEvade removal | Evasion Rate: 100\% -> 0.3\% | Helped |
| Use function-space watermarking instead of vertex-coordinate watermarking | Mesh watermarking · Mesh watermarking | HD: 0.061 -> 0.004 | Helped |
| Use function-space watermarking instead of Zhu | Mesh watermarking · Mesh watermarking | Accuracy: 98.17\% -> 95.69\% | Hurt |
Surprising findings
- Gaussian noise, smoothing and quantization fail to evade the learning-based methods of Wang et al. and Zhu et al., while the topology-changing attack evades all of them.
Limitations
- Newton's method for inverting the deformation may fail when initialized far from the surface, requiring multiple random initializations.
- Watermark strength and partition settings were tuned on a fixed setup; evaluation covers a limited set of watermark and removal methods.
- Watermark embedding may slightly lower bit accuracy (95.69%) relative to the best baseline.
Experimental setup
Datasets: ShapeNet Stanford Repo
Benchmarks: ShapeNet Stanford Repo
Metrics: evasion rate Hausdorff distance bit accuracy
Baselines: Spectral watermarking Peng et al. watermarking P-Peng watermarking Wang et al. watermarking Zhu et al. watermarking Remeshing Gaussian noise rotation quantization Laplacian smoothing
Builds on: SIREN marching cubes Deep3DMark remeshing
Closest papers by meaning
- Rethinking Mesh Watermark: Towards Highly Robust and Adaptable Deep 3D Mesh Watermarking (AAAI 2024 · similarity 0.89)
- GaussianMarker: Uncertainty-Aware Copyright Protection of 3D Gaussian Splatting (NeurIPS 2024 · similarity 0.84)
- GuardSplat: Efficient and Robust Watermarking for 3D Gaussian Splatting (CVPR 2025 · similarity 0.84)
- Black-Box Forgery Attacks on Semantic Watermarks for Diffusion Models (CVPR 2025 · similarity 0.84)
- Mask Image Watermarking (NeurIPS 2025 · similarity 0.83)
- 3D-GSW: 3D Gaussian Splatting for Robust Watermarking (CVPR 2025 · similarity 0.83)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.