NGS-Marker: Robust Native Watermarking for 3D Gaussian Splatting

Hao Qin; Yukai Sun; Luyuan Chen; Mengxu Lu; Feng Zhang; Ming Kong; Zhenhong Du; Qiang Zhu

cs.CVAug 18, 2026

NGS-Marker: Robust Native Watermarking for 3D Gaussian Splatting

Authors: Hao Qin, Yukai Sun, Luyuan Chen, Mengxu Lu, Feng Zhang, Ming Kong, Zhenhong Du, Qiang Zhu

Organizations: Zhejiang University · Zhejiang Key Laboratory of Geographic Information Science

Abstract

With the rapid development and adoption of 3D Gaussian Splatting (3DGS), the need for effective copyright protection has become increasingly critical. Existing watermarking techniques for 3DGS mainly focus on protecting rendered images via pre-trained decoders, leaving the underlying 3D Gaussian primitives vulnerable to misuse. In particular, they are ineffective against Partial Infringement, where an adversary extracts and reuses only a subset of Gaussians. In this paper, we propose NGS-Marker, a novel native watermarking framework for 3DGS. It integrates a jointly trained watermark injector and message decoder, and employs a gradientbased progressive injection strategy to ensure full-scene coverage. This enables robust ownership decoding from any local region. We further extend NGS-Marker with hybrid protection (combining native and indirect watermarks) and support for multimodal watermarking. Extensive experiments demonstrate that NGS-Marker effectively defends against partial infringement while offering practical flexibility for real-world deployment.

Figures & tables

Figure 1: Comparison between native and indirect protection. Due to the explicit nature of 3DGS, malicious users may partially plagiarize protected assets during 3D content creation. When the rendered image distribution shifts significantly, existing indirect protection methods often fail to detect such infringement, whereas NGS-Marker provides reliable protection in these scenarios.

Methods	8 bits	16 bits	24 bits	32 bits
3D-GSW	50.35	49.17	50.52	51.60
GaussianMarker	50.10	50.00	49.85	50.34
GuardSplat	51.08	50.83	50.30	51.16

Table 1: Results of existing 3DGS watermarking methods under the partial infringement scenario.

Figure 2: HiDDeN successfully embeds and extracts watermarks from random noise with minimal distortion, demonstrating potential for extension to unstructured data such as 3D Gaussian primitives.

Figure 3: Overview of NGS-Marker. The watermark injector ( $\mathcal{P}_{g}+\mathcal{P}_{d}$ ) is jointly trained with the message extractor $\mathcal{E}$ . The trained extractor can guide a gradient-based optimization to protect the target 3D scene. Once the private watermark is embedded in $\mathcal{G}^{w}$ , users can verify copyright ownership directly from the native 3D data without rendering.

Figure 4: Simulated partial infringement scenarios on public datasets. It can be observed that NGS-Marker enables precise and fine-grained copyright protection.

Methods	8 bits				16 bits				24 bits
Methods	Bit-Acc	3D-Acc	PSNR/SSIM $\uparrow$	LPIPS $\downarrow$	Bit-Acc	3D-Acc	PSNR/SSIM $\uparrow$	LPIPS $\downarrow$	Bit-Acc	3D-Acc	PSNR/SSIM $\uparrow$	LPIPS $\downarrow$
3D-GSW	50.35 ∗	N/A	31.88 / 0.978	0.027	49.17 ∗	N/A	30.37 / 0.960	0.051	50.52 ∗	N/A	29.82 / 0.955	0.061
GaussianMarker	50.10 ∗	N/A	31.81 / 0.973	0.031	50.00 ∗	N/A	30.75 / 0.961	0.046	49.85 ∗	N/A	29.69 / 0.950	0.057
GuardSplat	51.08 ∗	N/A	40.74 / 0.996	0.010	50.83 ∗	N/A	39.22 / 0.994	0.013	50.30 ∗	N/A	37.96 / 0.991	0.022
WI-Naive	65.32 §	68.50	30.15 / 0.970	0.041	57.54 §	55.90	27.07 / 0.962	0.060	54.29 §	53.70	25.36 / 0.911	0.093
WI-Iterative	77.93 §	80.70	26.36 / 0.904	0.092	69.25 §	72.30	25.54 / 0.886	0.105	60.38 §	61.50	24.47 / 0.882	0.136

Table 2: Quantitative comparison with baselines in partial infringement scenarios. Results are reported for 8-, 16-, and 24-bit messages and averaged over all test scenes. ‘ N/A ’ indicates that the corresponding method does not support this functionality. Superscripts ‘*’ and ‘§’ denote watermark extraction from rendered images and Gaussian primitives, respectively.

Figure 5: Visual comparisons in the bear scene with 16-bit watermark embedding. For better visualization, the difference images are amplified by a factor of 5. It can be seen that our method introduces negligible visual distortion.

Metrics	None	Gaussian Noise	Rotation	Scaling	Densification	Dropout	Translation	Combined
Metrics	None	( $\sigma$ =0.015)	( $\pm\pi$ )	( $\pm\infty$ )	(0%-50%)	(0%-50%)	( $\pm\infty$ )	Combined
Bit-Acc $\uparrow$	98.35	97.06	98.31	98.35	97.93	97.41	98.35	96.28
3D-Acc $\uparrow$	97.90	96.80	97.80	97.90	97.40	97.50	97.90	96.30

Table 3: Quantitative robustness evaluation under various attacks. ‘Combined’ denotes concurrent exposure to all attack types. Results are averaged over five runs to account for attack randomness.

Figure 6: Impact of different

\delta

values on convergence time and Bit-Acc in bear scene. NGS-Marker remains effective even at a high watermarking granularity.

Scene	person	chair	bear	garden
Time (min)	4.0	9.3	28.7	35.2
Number	42512	116713	418979	588946

Table 4: Watermarking time for different scenes and the number of primitives contained therein.

Type	3D-GSW				GaussianMarker				GuardSplat
Type	PSNR/SSIM $\uparrow$	LPIPS $\downarrow$	3D-Acc	Bit-Acc	PSNR/SSIM $\uparrow$	LPIPS $\downarrow$	3D-Acc	Bit-Acc	PSNR/SSIM $\uparrow$	LPIPS $\downarrow$	3D-Acc	Bit-Acc
Indirect	30.37 / 0.960	0.051	N/A	99.07 ∗	30.75 / 0.961	0.046	N/A	98.85 ∗	39.22 / 0.994	0.013	N/A	99.51 ∗
Native	40.17 / 0.995	0.007	97.90	98.35 §	40.17 / 0.995	0.007	97.90	98.35 §	40.17 / 0.995	0.007	97.90	98.35 §
Hybrid	33.16 / 0.980	0.039	97.10	98.68 ∗	35.09 / 0.983	0.022	97.40	98.21 ∗	39.46 / 0.994	0.011	97.00	99.14 ∗
Hybrid	33.16 / 0.980	0.039	97.10	97.59 §	35.09 / 0.983	0.022	97.40	97.84 §	39.46 / 0.994	0.011	97.00	97.38 §

Table 5: Results of combining NGS-Marker with indirect protection methods. ‘Indirect’ refers to indirect watermarking; ‘Native’ indicates native protection using Equation 4 ; ‘Hybrid’ combines both via optimization in Equation 5 .

Figure 7: Our method successfully embeds and recovers image watermarks in 3D scenes.

Appendix figures & tables20 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 8: Schematic diagram of the detailed structure of each module in NGS-Marker.

Type	PSNR/SSIM $\uparrow$	LPIPS $\downarrow$	3D-Acc $\uparrow$	Bit-Acc $\uparrow$
Indirect	34.63 / 0.981	0.034	N/A	99.02 ∗
Native	40.17 / 0.995	0.007	97.90	98.35 §
Hybrid	38.16 / 0.986	0.020	97.20	98.27 ∗
Hybrid	38.16 / 0.986	0.020	97.20	97.33 §

Appendix

Table 6: Experimental results for the clean collaboration baseline.

Figure 9: Ablation study of

\tau

Time (min)	person	chair	bear	garden	Avg.
3D-GSW	12.8	9.5	21.4	27.7	17.9
GaussianMarker	4.2	4.3	12.7	16.5	9.4
GuardSplat	5.5	4.9	15.2	19.5	11.3
NGS-Marker	4.0	9.3	28.7	35.2	19.3
NGS-Marker-Parallel	2.7	4.6	12.5	13.9	8.4

Appendix

Table 7: Comparison of the time required to embed watermarks by different methods.

Time (ms)	person	chair	bear	garden	Avg.
3D-GSW	16.2	17.2	18.7	19.1	17.8
GaussianMarker	15.0	16.1	17.5	18.0	16.7
GuardSplat	17.2	18.3	19.7	20.2	18.9
NGS-Marker	20.7	20.7	20.9	21.0	20.8

Appendix

Table 8: Comparison of the time required to extract watermarks by different methods.

Method	Params(M)	FLOPs (G)
3D-GSW	0.29	14.48
GaussianMarker	0.29	14.48
GuardSplat	151.48	4.37
NGS-Marker	51.28	6.61

Appendix

Table 9: Comparison of the computational complexity.

$\delta$	None	Gaussian Noise	Rotation	Scaling	Densification	Dropout	Translation
$\delta$	None	( $\sigma$ =0.015)	( $\pm\pi$ )	( $\pm\infty$ )	(0%-50%)	(0%-50%)	( $\pm\infty$ )
2048	95.62	93.89	95.62	95.62	94.14	93.78	95.62
4096	96.77	95.19	96.77	96.77	95.83	94.94	96.77
6144	96.83	95.30	96.83	96.83	96.22	95.36	96.83
8192	98.35	97.06	98.35	98.35	97.93	97.41	98.35
12288	98.17	97.02	98.17	98.17	97.82	97.26	98.17

Appendix

Table 10: Ablation study on the effect of

\delta

on robustness.

Attributes	Bit-Acc	PSNR $\uparrow$	SSIM $\uparrow$	LPIPS $\downarrow$
position+SH(0)	81.45	31.39	0.968	0.035
position+SH(3)	92.66	38.50	0.991	0.017
position+SH(3)+opacity	96.23	39.74	0.994	0.010
All	98.35	40.17	0.995	0.007

Appendix

Table 11: The influence of using different attributes on performance.

Attacker	8 bits $\delta$ :8192	16 bits $\delta$ :4096	16 bits $\delta$ :8192	24 bits $\delta$ :8192	Avg.
3D-GSW	57.29	58.55	58.55	67.19	60.40
GaussianMarker	57.74	57.39	57.39	63.30	59.00
GuardSplat	62.03	65.42	65.42	72.51	66.35
NGS-Marker	93.50	79.22	65.83	92.16	82.68

Appendix

Table 12: Robustness against adversarial attacks.

Bit-Acc	“Turn the bear into a grizzly bear”	“Turn him into a clown”
3D-GSW	72.40	74.39
GaussianMarker	70.26	69.42
GuardSplat	78.55	77.18
NGS-Marker	91.06	90.53

Appendix

Table 13: Robustness against 3D editing.

Scene	8 bits		16 bits		24 bits
Scene	Bit-Acc	PSNR $\uparrow$	Bit-Acc	PSNR $\uparrow$	Bit-Acc	PSNR $\uparrow$
Train	98.75	41.07	97.83	40.12	94.50	39.05
Truck	99.03	41.00	97.84	39.61	94.73	39.20
Drjohnson	98.06	39.48	96.46	39.13	93.22	38.43
Playroom	98.32	40.19	97.59	39.38	93.65	38.71
Original Test Results	99.26	41.77	98.35	40.17	94.79	39.61

Appendix

Table 14: Experimental results on complex scenes.

	Bit-Acc	PSNR $\uparrow$	SSIM $\uparrow$	LPIPS $\downarrow$
8 bits	98.71 (99.26)	41.50 (41.77)	0.996 (0.996)	0.004 (0.004)
16 bits	98.24 (98.35)	40.29 (40.17)	0.995 (0.995)	0.008 (0.007)
24 bits	95.22 (94.79)	39.48 (39.61)	0.993 (0.993)	0.013 (0.013)

Appendix

Table 15: Experimental results on dynamic scenes. The numbers in parentheses denote the results on static scenes under the corresponding settings.

Figure 10: Additional visualization examples.

Figure 11: Additional visualization examples.

Figure 12: Additional visualization examples.

Figure 13: Additional visualization examples.

Figure 14: Additional visualization examples.

Figure 17: Visualization results of overlapping Gaussian primitives with and without watermarking.

Explore similar work

GuardMarkGS: Unified Ownership Tracing and Edit Deterrence for 3D Gaussian Splatting
May 13, 2026Utae Jeong, Jaewan Choi, Junseok Lee +43D Gaussian Splatting Robust Watermarking
Korea University · KAIST · Hanshin University
X-SG $^2$ S: Safe and Generalizable Gaussian Splatting with X-dimensional Watermarks
Feb 13, 2025Zihang Cheng, Wentao Bao, Huiping Zhuang +63D Gaussian Splatting Multimodal Embedding
South China University of Technology · Shenzhen MSU-BIT University · Peking University +1
BitC-3DGS: High-Capacity 3D Gaussian Splatting Watermarking via Bit Compression
May 28, 2026Yuquan Bi, Baosheng Yu, Yingke Lei +53D Gaussian Splatting Robust Watermarking
School of Cyber Science and Engineering, Southeast University, Nanjing, China · Lee Kong Chian School of Medicine, Nanyang Technological University, Singapore · College of Electronic Engineer, National University of Defense and Technology, Hefei, 230000, China +5

May 13, 2026J/K move · Enter open · S save

GuardMarkGS: Unified Ownership Tracing and Edit Deterrence for 3D Gaussian Splatting

Utae Jeong, Jaewan Choi, Junseok Lee, Jongheon Jeong+3

Korea University · KAIST · Hanshin University

3D Gaussian Splatting Robust Watermarking

Open paper AskPDF arXiv

3D Gaussian Splatting (3DGS) is becoming a practical representation for novel view synthesis, but its growing adoption, together with rapid advances in instruction-driven 3DGS editing, also exposes a dual copyright risk: once a 3DGS-based asset is released, it can be used without permission and manipulated through 3D editing. Existing protection methods address only one side of this problem. Watermarking can trace ownership after unauthorized use, but it cannot prevent malicious editing. Adversarial edit-deterrence methods can disrupt editing, but they do not provide evidence of ownership. To the best of our knowledge, we present the first unified protection framework for 3DGS that jointly optimizes ownership tracing and unauthorized editing deterrence. Our framework combines a scene-wide watermarking objective over all Gaussians with an adversarial objective for edit deterrence. The adversarial branch combines latent-anchor separation, denoising-trajectory diversion, and cross-attention diversion to divert the editing trajectory, while an update-saliency-motivated Gaussian selection strategy assigns stronger adversarial updates to mask-selected Gaussians, improving the balance among watermark recovery, edit deterrence, and rendering fidelity. Experiments on scenes from Mip-NeRF 360 and Instruct-NeRF2NeRF demonstrate that the proposed framework achieves a favorable balance among bit accuracy, edit deterrence, and rendering quality. These results suggest that practical copyright protection of 3DGS-based assets can be more effectively addressed by integrating ownership tracing and unauthorized editing deterrence into a single optimization framework.

Abstract

Explore similar work

GuardMarkGS: Unified Ownership Tracing and Edit Deterrence for 3D Gaussian Splatting

X-SG2^22S: Safe and Generalizable Gaussian Splatting with X-dimensional Watermarks

BitC-3DGS: High-Capacity 3D Gaussian Splatting Watermarking via Bit Compression

X-SG $^2$ S: Safe and Generalizable Gaussian Splatting with X-dimensional Watermarks