Where, What, Why: Toward Explainable 3D-GS Watermarking

Mingshu Cai; Jiajun Li; Osamu Yoshie; Yuya Ieiri; Yixuan Li

cs.CVMar 9, 2026

Where, What, Why: Toward Explainable 3D-GS Watermarking

Authors: Mingshu Cai, Jiajun Li, Osamu Yoshie, Yuya Ieiri, Yixuan Li

Organizations: Waseda University · Southeast University · Nanyang Technological University

Abstract

As 3D Gaussian Splatting becomes the de facto representation for interactive 3D assets, robust yet imperceptible watermarking is critical. We present a representation-native framework that separates where to write from how to preserve quality. A Trio-Experts module operates directly on Gaussian primitives to derive priors for carrier selection, while a Safety and Budget Aware Gate (SBAG) allocates Gaussians to watermark carriers, optimized for bit resilience under perturbation and bitrate budgets, and to visual compensators that are insulated from watermark loss. To maintain fidelity, we introduce a channel-wise group mask that controls gradient propagation for carriers and compensators, thereby limiting Gaussian parameter updates, repairing local artifacts, and preserving high-frequency details without increasing runtime. Our design yields view-consistent watermark persistence and strong robustness against common image distortions such as compression and noise, while achieving a favorable robustness-quality trade-off compared with prior methods. In addition, decoupled finetuning provides per-Gaussian attributions that reveal where the message is carried and why those carriers are selected, enabling auditable explainability. Compared with state-of-the-art methods, our approach achieves a PSNR improvement of +0.83 dB and a bit-accuracy gain of +1.24%.

Figures & tables

Figure 1: Usage of our model. The owner embeds a secret message into a 3D-GS model using our method; even if the model is stolen and undergoes distortion attacks, the rendered views can still be decoded to verify copyright.

Figure 2: Pipeline of Our Method. During initialization, we prune redundant Gaussians based on their rendering contribution. The Trio-Experts module extracts geometry/appearance/redundancy priors and aggregates them into an evidence package $E_{k}(i)$ . The SBAG decouples ranking and budgeting and uses this evidence and a one-shot render to select, expand, and densify watermark carriers. In finetuning, a channel-wise group mask enforces disjoint gradient routing for watermark carriers ( $GS_{\text{wm}}$ ) and visual compensators ( $GS_{\text{vis}}$ ). EOT attacks render both clean and attacked views: $\mathcal{L}_{\text{vis}}$ preserves appearance, while low-frequency subbands form the watermark loss $\mathcal{L}_{\text{wm}}$ , with $\mathcal{L}_{\mathrm{wav}}^{\mathrm{low}}$ penalizing over-editing. The separate optimization of $\mathcal{L}_{\text{vis}}$ and $\mathcal{L}_{\text{wm}}$ improves both fidelity and robustness.

Figure 3: Rendering-quality comparison. We compare our method with all baselines using 32-bit messages. The difference maps are shown at 10× scale. Our approach achieves higher bit accuracy and better visual fidelity than competing methods.

	32 bits				48 bits				64 bits
Methods	Bit Acc↑	PSNR ↑	SSIM ↑	LPIPS ↓	Bit Acc↑	PSNR ↑	SSIM ↑	LPIPS ↓	Bit Acc↑	PSNR ↑	SSIM ↑	LPIPS ↓
WateRF [ 7 ] +3D-GS [ 10 ]	93.28	30.57	0.954	0.052	84.39	30.06	0.949	0.056	74.92	25.73	0.887	0.105
GuardSplat [ 3 ]	95.58	35.32	0.978	0.043	93.29	33.36	0.969	0.045	90.14	32.25	0.963	0.048
3D-GSW [ 8 ]	97.22	35.15	0.977	0.044	93.59	33.26	0.972	0.047	91.31	32.52	0.966	0.050
Ours	98.46	35.98	0.982	0.041	94.29	33.45	0.973	0.044	91.65	32.71	0.969	0.047

Table 1: Bit accuracy and rendering quality compared with baselines. We report results for 32, 48, and 64-bit messages, averaged over the Blender, LLFF, and Mip-NeRF 360 datasets. The best scores are shown in bold .

Figure 4: Rendering-quality comparison under different message capacities. With 32-bit, 48-bit, and 64-bit embedded messages, (differences $\times 10$ ), our method maintains high bit-acc across different capacities while preserving perceptual quality.

Figure 5: Comparison of rendering quality among the full method (ours), without SBAG, without group mask, without decoupled finetuning, and the baseline model. All images are embedded with 32-bit messages.

Methods			Ours
SBAG	Group Mask	Decoupling	Bit Acc(%)↑	PSNR↑	SSIM↑	LPIPS↓
–	–	–	94.70	30.00	0.952	0.073
✓	✓	–	96.80	34.10	0.974	0.048
✓	–	✓	97.10	33.70	0.972	0.051
–	✓	✓	95.10	33.10	0.968	0.056
✓	✓	✓	97.80	35.20	0.979	0.042

Table 4: Quantitative ablation results. The best performance is obtained when all components are activated, with evaluation conducted on 32-bit message embedding.

Budget	Bit Acc ↑	PSNR ↑	SSIM ↑	LPIPS ↓	Storage ↓
$1\%$	97.19	34.98	0.980	0.046	164MB
Adaptive	98.46	35.98	0.982	0.041	178MB
$10\%$	98.12	34.24	0.975	0.048	195MB

Table 5: Ablation study on Budget for Watermark Carrier Gaussians. Results represent the average score across Blender, LLFF, and Mip-NeRF 360 datasets using 32-bit messages.

Figure 6: Training dynamics of coupled vs. decoupled finetuning. Decoupled optimization converges faster and consistently achieves higher PSNR and BitAcc across finetuning steps.

Figure 7: Qualitative comparison of our group mask. For background-free objects, it confines 3D Gaussian updates to object boundaries, preserving rendering quality.(difference $\times 8$ )

Robust Watermarking

Robust watermarking embeds or verifies ownership and provenance signals that survive editing, compression, model changes, and deliberate removal.

See all 207 papers

NGS-Marker: Robust Native Watermarking for 3D Gaussian Splatting
Aug 18, 2026Hao Qin, Yukai Sun, Luyuan Chen +5Robust Watermarking 3D Gaussian Splatting
Zhejiang University · Zhejiang Key Laboratory of Geographic Information Science
X-SG $^2$ S: Safe and Generalizable Gaussian Splatting with X-dimensional Watermarks
Feb 13, 2025Zihang Cheng, Wentao Bao, Huiping Zhuang +63D Gaussian Splatting Multimodal Embedding
South China University of Technology · Shenzhen MSU-BIT University · Peking University +1
GuardMarkGS: Unified Ownership Tracing and Edit Deterrence for 3D Gaussian Splatting
May 13, 2026Utae Jeong, Jaewan Choi, Junseok Lee +43D Gaussian Splatting Robust Watermarking
Korea University · KAIST · Hanshin University

Aug 18, 2026J/K move · Enter open · S save

NGS-Marker: Robust Native Watermarking for 3D Gaussian Splatting

Hao Qin, Yukai Sun, Luyuan Chen, Mengxu Lu+4

Zhejiang University · Zhejiang Key Laboratory of Geographic Information Science

Robust Watermarking 3D Gaussian Splatting

Open paper AskPDF arXiv

With the rapid development and adoption of 3D Gaussian Splatting (3DGS), the need for effective copyright protection has become increasingly critical. Existing watermarking techniques for 3DGS mainly focus on protecting rendered images via pre-trained decoders, leaving the underlying 3D Gaussian primitives vulnerable to misuse. In particular, they are ineffective against Partial Infringement, where an adversary extracts and reuses only a subset of Gaussians. In this paper, we propose NGS-Marker, a novel native watermarking framework for 3DGS. It integrates a jointly trained watermark injector and message decoder, and employs a gradientbased progressive injection strategy to ensure full-scene coverage. This enables robust ownership decoding from any local region. We further extend NGS-Marker with hybrid protection (combining native and indirect watermarks) and support for multimodal watermarking. Extensive experiments demonstrate that NGS-Marker effectively defends against partial infringement while offering practical flexibility for real-world deployment.

Abstract

Robust Watermarking

Explore similar work

NGS-Marker: Robust Native Watermarking for 3D Gaussian Splatting

X-SG2^22S: Safe and Generalizable Gaussian Splatting with X-dimensional Watermarks

GuardMarkGS: Unified Ownership Tracing and Edit Deterrence for 3D Gaussian Splatting

X-SG $^2$ S: Safe and Generalizable Gaussian Splatting with X-dimensional Watermarks