FlyMark: Training-Free Invisible Watermarking of 3D Gaussian Splatting via a Fruit Fly Connectome

Ziyuan Luo; Haoliang Li; Renjie Wan

cs.CVOct 8, 2026

FlyMark: Training-Free Invisible Watermarking of 3D Gaussian Splatting via a Fruit Fly Connectome

Authors: Ziyuan Luo, Haoliang Li, Renjie Wan

Organizations: Department of Computer Science, Hong Kong Baptist University · Department of Electrical Engineering, City University of Hong Kong

Abstract

A trained 3D Gaussian Splatting (3DGS) scene ships as a portable parameter array that can be copied, pruned, requantized, or repackaged outside its training pipeline, so ownership evidence is most useful when it lives in the released parameters and remains checkable long after the embedding tooling is gone. Existing 3DGS watermarks typically tie embedding or extraction to scene optimization, a learned decoder, or rendered views, so the evidence survives only as long as a second trained artifact does. FlyMark instead writes a keyed message into the parameters a 3DGS file already stores. Its carrier directions are derived from the photoreceptors of a published connectome, a citable versioned artifact that fixes the geometry exhaustively and leaves nothing to tune per scene. A virtual observer reads cone-wise apparent luminance along a scene-normalized orbit from stored centers, colors, and opacities; a keyed dithered quantization-index-modulation code replicates each message bit across these observations; and one sparse bounded least-squares solve realizes the targets through achromatic shifts of existing degree-zero colors under a hard per-channel linear-RGB bound. All geometry and higher-order appearance parameters are preserved bit-identically, and extraction needs only cone queries, rounding, and majority voting. Under a model-domain threat model on synthetic and real scenes, FlyMark attains high clean bit accuracy and visual fidelity while cleanly separating matched from wrong keys.

Figures & tables

Figure 1: FlyMark writes a message where a fly looks. A virtual observer carries the connectome’s photoreceptor directions around the scene, and each direction reads an opacity-weighted cone of Gaussians. Embedding perturbs only the stored degree-zero colors, so the marked render $\mathcal{G}^{\prime}$ is high visual fidelity from $\mathcal{G}$ ; extraction replays the same orbit readout with the key. The fly, orbit, and bit glyphs are schematic.

Figure 2: FlyMark’s embedding and extraction paths. (a) The connectome-derived retinal lattice and observer orbit define a cone-wise mean-luminance readout $a_{tj}$ from the original Gaussian model $\mathcal{G}$ . The key $K$ and message $\mathbf{b}\in\{0,1\}^{B}$ determine keyed QIM targets $q_{tj}$ : even lattice points encode 0 and odd points encode 1. A color solve adjusts the colors of existing Gaussians to produce the marked model $\mathcal{G}^{\prime}$ . (b) Given a suspect 3DGS model and the private record, the verifier repeats the same orbit readout to obtain $a^{\prime}_{tj}$ , converts each activation into a parity vote $v_{tj}$ on the keyed lattice, and takes a majority vote within each message-bit group to recover message. The displayed votes and message bits are schematic.

Method	Cells	Bit acc. $\uparrow$	PSNR $\uparrow$	SSIM $\uparrow$	LPIPS $\downarrow$
FlyMark	30	99.27	44.21	0.993	0.0021
RandomCone-QIM	30	95.94	43.36	0.991	0.0026
SpatialHash-QIM	30	83.12	44.41	0.991	0.0022
GaussianMarker	30	98.75	30.11	0.954	0.0411
3D-GSW	30	86.67	32.59	0.970	0.0266
GuardSplat	24	62.11	41.06	0.996	0.0025

Table 1: Clean message recovery and direct visual fidelity. Bit accuracy is the fraction of correctly recovered message bits, aggregated scene first. Fidelity compares marked renders against the corresponding unmarked 3DGS renders. GuardSplat covers the eight Synthetic scenes and the remaining methods cover all ten scenes. Arrows indicate the preferred direction.

Role	Cells	Bit acc. $\uparrow$	PSNR $\uparrow$	LPIPS $\downarrow$
Development	6	100.00	43.82	0.0015
Validation	6	98.96	48.48	0.0003
Held-out	12	98.96	45.20	0.0021
External real	27	96.64	38.02	0.0045

Table 2: Role-separated FlyMark results. Held-out Synthetic and all nine real scenes are excluded from method selection.

Figure 3: Registered-view qualitative comparison on Lego, Hotdog, and Bonsai. Every method is shown as an equal-size output/difference pair, where the right panel is the $10\times$ absolute RGB difference from the matched reference under a shared display transform. In the one-line annotation beneath each marked pair, the value before the slash is key-17 bit accuracy (%) and the value after it is direct PSNR (dB) for the displayed frame. Each row uses identical cameras and crops across methods, and Bonsai uses the third registered view (frame 29). Tables 1 and 2 report aggregate recovery and fidelity; Appendix H shows all three registered views.

Figure 4: Bit accuracy under four representative model-attack families. Lines are scene-first means over ten scenes and three watermark keys, and shaded regions show hierarchical-bootstrap uncertainty. The clean point is repeated as severity zero.

Figure 5: Wrong-key calibration. The left panel plots empirical probability by correct message bits over five million wrong-key trials (logarithmic vertical axis); the right panel counts clean matched-key scores across 30 scene/key cells. The preselected ownership cutoff is 30 correct bits.

Method	Injection	DC noise	fp16	Quant.	Opacity noise	Opacity prune	Position noise	Random prune	Reorder	SH trunc.	Macro
FlyMark	0.793	0.992	0.983	0.992	0.974	0.733	0.767	0.767	0.993	0.993	0.899
RandomCone-QIM	0.801	0.960	0.954	0.960	0.934	0.696	0.771	0.760	0.959	0.959	0.875
SpatialHash-QIM	0.539	0.827	0.718	0.837	0.814	0.544	0.535	0.609	0.831	0.831	0.709

Table 3: Bit-accuracy AUC for all ten standard attack families. Values average over ten scenes, three watermark keys, and three stochastic seeds where applicable. AUC integrates over ordinal severity within a family, and Macro is the unweighted family mean.

Variant	Clean bit acc.	Recomputed	Attacked bit acc.	PSNR (dB)
Full method	100.00	99.22	68.91	46.02
One orbit stop	89.06	89.84	62.50	50.13
No keyed dither	91.41	89.84	66.41	46.29
No scene-body gate	99.22	99.22	68.75	45.83
Differential cone pairs	96.09	96.09	86.56	50.14
Gamut only; no 0.02 bound	100.00	100.00	78.44	30.62

Table 4: Component study on four development/validation scenes with key 17. Attacked bit accuracy averages component-attack conditions by scene; fidelity is direct marked-versus-original PSNR.

Method	Embed median (s)	Extract/test (s)	Peak RSS (GiB)	Params	Decoder MB
FlyMark	72.23	2.90	0.65	0	0.00
GaussianMarker	218.57	13.20	13.00	291,456	5.74
3D-GSW	1400.66	12.21	8.85	281,952	1.18
GuardSplat	226.46	13.59	1.94	205,344	1.22

Table 5: Implementation resource costs. FlyMark uses CPU; published baselines use one GPU where applicable.

Appendix figures & tables14 assets

Supplementary material from the paper’s appendix.

Appendix

Dataset	Role	Scenes	Count	Cells
NeRF Synthetic	Development	Lego, Chair	2	6
NeRF Synthetic	Validation	Ficus, Materials	2	6
NeRF Synthetic	Held-out test	Drums, Hotdog, Mic, Ship	4	12
Mip-NeRF 360	External real test	All nine scenes	9	27

Appendix

Table 6: Dataset roles and clean evaluation cells. Every scene uses watermark keys 17, 29, and 43.

Quantity	Value
Message length $B$	32 bits
Source carrier	3,335 MaleCNS photoreceptors
Distinct directions	825 after exact UV collapse
Orbit stops	24
Orbit radius / elevation / phase	$1.5\rho$ / $10^{\circ}$ / $0^{\circ}$
Scene center / radius $\rho$	bounding-box midpoint / 95th-percentile distance

Appendix

Table 7: Frozen FlyMark configuration. The angular cone radius is derived from the carrier lattice instead of being specified as an absolute angle.

Method	Selected cells	Missing cells	Bit acc.
FlyMark	30	0	97.19
RandomCone-QIM	30	0	98.02
SpatialHash-QIM	20	10	82.97
GaussianMarker	0	30	—
3D-GSW	10	20	100.00
GuardSplat	1	19	56.25

Appendix

Table 8: Damage-matched bit accuracy at a measured 2 dB ground-truth PSNR-loss budget on the representative Lego/Hotdog/Bonsai attack subset. Cells without a measured severity inside the budget are marked missing and are never extrapolated.

Attack	Severity	Scenes/cells	Bit acc.	Mean GT drop (dB)
Purification by opacity	0.1	3	63.54	1.35
Purification by opacity	0.3	3	50.00	2.78
Purification by opacity	0.5	3	46.88	6.47
Purification by scale	0.1	3	70.83	1.30
Purification by scale	0.3	3	59.38	1.73
Purification by scale	0.5	3	57.29	3.63

Appendix

Table 9: Adaptive attacks on Lego, Hotdog, and Bonsai. Bit accuracy averages the available evaluation units, and ground-truth PSNR loss quantifies the accompanying asset change. Spatial partial theft includes three spatial selections per scene.

Attacker bound	Cells	Owner bit acc.	Attacker bit acc.	Final/base PSNR
0.005	9	100.00	59.72	40.47
0.010	9	100.00	78.12	40.11
0.020	9	95.49	100.00	38.10

Appendix

Table 10: Targeted overwrite. Bit accuracy is evaluated for both the original owner and the attacker after the attacker’s own bounded solve. Results average three scenes and three attacker keys.

Copies	Decoded key	Cells	Bit acc.	Colluded/base PSNR
2	non-member	9	46.88	42.03
2	member	18	93.92	42.03
3	member	9	79.17	42.76

Appendix

Table 11: Copy collusion by per-Gaussian linear-RGB averaging over Lego, Hotdog, and Bonsai. Member rows decode a key present in the mixture, and the non-member row tests an unrelated key.

Scene	Views	PSNR	SSIM	LPIPS
Bonsai	37	38.74	0.988	0.0060
Garden	37	42.73	0.995	0.0015
Chair	134	44.35	0.998	0.0015
Drums	134	39.94	0.991	0.0028
Ficus	158	50.84	0.999	0.0002
Hotdog	126	42.32	0.994	0.0039

Appendix

Table 12: Direct fidelity under multi-shell viewpoint sampling ( Matsubara et al., 2026 ) . The view count follows the scene-specific two-shell sampling protocol.

Figure 6: Connectome-derived carrier construction. Left: 3,335 mapped MaleCNS photoreceptors in the common display projection, with coincident samples overplotted. Right: 825 distinct projected coordinates after exact duplicate collapse. All right-panel markers have the same size; color shows the number of source photoreceptors mapped to each direction.

Lattice	Mean NN angle	Cone radius	Covered cap	P95 nearest angle
FlyMark	1.037 ∘	0.532 ∘	24.80%	8.105 ∘
Fibonacci	1.770 ∘	0.881 ∘	70.41%	1.101 ∘
Regular hex	1.631 ∘	0.812 ∘	58.97%	1.434 ∘
Random cone	1.664 ∘	0.819 ∘	58.72%	1.201 ∘

Appendix

Table 13: Angular geometry of the 825-direction lattices. Coverage is the fraction of 20,000 uniformly sampled cap directions within the method’s cone radius. Random-cone values average the three registered seeds.

Setting	Bit acc.	Recomputed	PSNR (dB)	LPIPS
Reference: $B=32$ , $\epsilon=\Delta=0.02$ , $T=24$	100.00	99.22	46.02	0.0009
Message length = 16	100.00	100.00	46.05	0.0009
Message length = 64	96.48	96.48	46.32	0.0009
$\epsilon=0.005$	70.31	70.31	58.39	0.0000
$\epsilon=0.01$	87.50	88.28	52.47	0.0002
$\epsilon=0.04$	100.00	100.00	40.28	0.0032

Appendix

Table 14: One-factor-at-a-time sensitivity on four development/validation scenes. Bit accuracy and recomputed-mask accuracy are percentages.

Condition	Bit accuracy (%)	95% CI (%)
Marked PNG	99.95	99.88 to 100.00
Unmarked, matched key	49.15	48.43 to 49.85
Marked, wrong candidate key	50.50	50.37 to 50.63

Appendix

Table 15: 2D image bit accuracy on the complete BSDS500 test split (200 images, three marking keys per image). Higher is better. Confidence intervals use image-first bootstrap resampling; wrong-key scores average three candidate keys per marked image.

Figure 7: Lego at registered frames 40, 100, and 159. For FlyMark , GaussianMarker, 3D-GSW, and GuardSplat, the equal-size panel to the right of each output shows its $10\times$ absolute RGB difference from the matched reference. The one-line values are key-17 bit accuracy (%) / direct PSNR (dB), with PSNR evaluated at the displayed frame.

Figure 8: Hotdog at registered frames 40, 100, and 159. For FlyMark , GaussianMarker, 3D-GSW, and GuardSplat, the equal-size panel to the right of each output shows its $10\times$ absolute RGB difference from the matched reference. The one-line values are key-17 bit accuracy (%) / direct PSNR (dB), with PSNR evaluated at the displayed frame.

Figure 9: Bonsai at registered frames 7, 18, and 29, including the targeted GuardSplat key-17 qualitative cell. For every method, the equal-size panel to the right of each output shows its $10\times$ absolute RGB difference from the matched reference. The one-line values are key-17 bit accuracy (%) / direct PSNR (dB), with PSNR evaluated at the displayed frame.

Explore similar work

X-SG $^2$ S: Safe and Generalizable Gaussian Splatting with X-dimensional Watermarks
Feb 13, 2025Zihang Cheng, Wentao Bao, Huiping Zhuang +63D Gaussian Splatting Multimodal Embedding
South China University of Technology · Shenzhen MSU-BIT University · Peking University +1
GuardMarkGS: Unified Ownership Tracing and Edit Deterrence for 3D Gaussian Splatting
May 13, 2026Utae Jeong, Jaewan Choi, Junseok Lee +43D Gaussian Splatting Robust Watermarking
Korea University · KAIST · Hanshin University
BitC-3DGS: High-Capacity 3D Gaussian Splatting Watermarking via Bit Compression
May 28, 2026Yuquan Bi, Baosheng Yu, Yingke Lei +53D Gaussian Splatting Robust Watermarking
School of Cyber Science and Engineering, Southeast University, Nanjing, China · Lee Kong Chian School of Medicine, Nanyang Technological University, Singapore · College of Electronic Engineer, National University of Defense and Technology, Hefei, 230000, China +5

Feb 13, 2025, cs.CRJ/K move · Enter open · S save

X-SG $^2$ S: Safe and Generalizable Gaussian Splatting with X-dimensional Watermarks

Zihang Cheng, Wentao Bao, Huiping Zhuang, Chun Li+5

South China University of Technology · Shenzhen MSU-BIT University · Peking University+1

3D Gaussian Splatting Multimodal Embedding Robust Watermarking

Open paper AskPDF arXiv

3D Gaussian Splatting (3DGS) has been widely used in 3D reconstruction and 3D generation. However, the rapid adoption of 3D Gaussian Splatting raises growing concerns about information leakage and unauthorized use, urging the exploration of effective watermarking techniques. However, existing methods are limited by low capacity, fragility under geometric perturbations, and the infeasible requirement for costly fine-tuning or pipeline modifications, motivating the need for a generalizable, feed-forward framework capable of robust multi-modal embedding with minimal intrusion. In this paper, we propose a new framework X-SG

^2

S which can simultaneously inject 1D to 3D watermarks for copyright protection, while keeping the high fidelity of original 3DGS scenes. Specifically, we first split the watermarks into message patches. A self-adaptive gate is developed to select the injection positions of the watermark messages. Then, we use an XD (multi-dimensional) injection head to inject multi-modal messages into sorted 3DGS points. To restore watermarking messages, a learnable gate is developed to recognize the watermarked locations, from which our XD-extraction heads are used to restore hidden messages. X-SG

^2

S is the first framework to unify 1D-to-3D watermarking and enable simultaneous multi-modal watermark embedding in 3DGS, achieving this with minimal rendering interference and zero modifications to parameters or pipelines. Extensive experiments demonstrate that X-SG

^2

S effectively preserves consistency between the watermark and the original 3DGS, exhibits robustness against model degradation, and maintains accurate judgment capabilities.

Abstract

Explore similar work

X-SG2^22S: Safe and Generalizable Gaussian Splatting with X-dimensional Watermarks

GuardMarkGS: Unified Ownership Tracing and Edit Deterrence for 3D Gaussian Splatting

BitC-3DGS: High-Capacity 3D Gaussian Splatting Watermarking via Bit Compression

X-SG $^2$ S: Safe and Generalizable Gaussian Splatting with X-dimensional Watermarks