Mesh Watermark Removal Attack and Mitigation: A Novel Perspective of Function Space

TL;DR

This work reveals a fundamental vulnerability of existing mesh watermarking approaches to topology-changing, function-space attacks by introducing FuncEvade, which reconstructs a new discrete mesh from the watermarked mesh's SDF to evade detection. To counter this, the authors propose FuncMark, a function-space watermarking method that embeds a message directly in the signed distance function (SDF) using spherical partitioning and local deformation, enabling watermark verification on the SDF or any mesh derived from it. Experiments show FuncEvade attains $100\%$ evasion against prior methods with minimal impact on mesh quality, while FuncMark reduces evasion to $\approx 0.3\%$ and maintains performance parity with state-of-the-art metrics on other fronts. Overall, the paper advocates a shift toward function-space watermarking to achieve topology-robust ownership verification for 3D meshes.

Abstract

Mesh watermark embeds secret messages in 3D meshes and decodes the message from watermarked meshes for ownership verification. Current watermarking methods directly hide secret messages in vertex and face sets of meshes. However, mesh is a discrete representation that uses vertex and face sets to describe a continuous signal, which can be discretized in other discrete representations with different vertex and face sets. This raises the question of whether the watermark can still be verified on the different discrete representations of the watermarked mesh. We conduct this research in an attack-then-defense manner by proposing a novel function space mesh watermark removal attack FuncEvade and then mitigating it through function space mesh watermarking FuncMark. In detail, FuncEvade generates a different discrete representation of a watermarked mesh by extracting it from the signed distance function of the watermarked mesh. We observe that the generated mesh can evade ALL previous watermarking methods. FuncMark mitigates FuncEvade by watermarking signed distance function through message-guided deformation. Such deformation can survive isosurfacing and thus be inherited by the extracted meshes for further watermark decoding. Extensive experiments demonstrate that FuncEvade achieves 100% evasion rate among all previous watermarking methods while achieving only 0.3% evasion rate on FuncMark. Besides, our FuncMark performs similarly on other metrics compared to state-of-the-art mesh watermarking methods.

Figures (4)

• Figure 1: Top: FuncEvade fits the signed distance function (SDF) of the watermarked mesh. It gets an extracted mesh from SDF through isosurfacing, where the extracted mesh successfully evades ALL previous watermarking methods. Bottom: To mitigate FuncEvade, FuncMark watermark SDF instead of mesh, where the watermark can be verified on SDF and the mesh extracted from it.
• Figure 2: FuncMark overview. We convert vertex coordinates into (a) spherical coordinate system, which is further divided into $N_s*N_s$ partitions (denoted as $\Omega_{i,j}$). We further embed one bit in each (b) partition $\Omega_{i,j}$. The surface within $\Omega_{i,j}$ is deformed (c) outward if the embedded bit $b=1$, or else deformed (d) inward. The deformation strength is $10\times$ of the default setting.
• Figure 3: (a-c) Geometric differences between meshes extracted from $F_\Theta$ and $G_\Theta$. (d) Vertex tags $b$ on meshes from $G_\Theta$.
• Figure 4: Our watermark can be verified on SDF $G_\Theta$ and extracted meshes. For watermark detection on extracted meshes, we evaluate (a) bit accuracy with varied mesh resolution and (b) evasion rate with varied mesh resolution. For watermark verification on SDF, we evaluate bit accuracy with a varied number of sampled points on $G_\Theta$.