DreaMark: Rooting Watermark in Score Distillation Sampling Generated Neural Radiance Fields

TL;DR

This work tackles copyright protection for NeRFs produced via Score Distillation Sampling by introducing Dreamark, a during-generation watermarking method that backdoors NeRFs during SDS training and enables ownership verification via a pre-trained watermark decoder on arbitrary trigger viewports. Dreamark comprises two main steps: (i) pre-training a unique watermark decoder (HiDDeN) to reliably extract a secret message, and (ii) injecting backdoors into the NeRF's color mapping during SDS in a two-stage process, generating trigger viewports from the secret message so that rendering from any trigger viewport reveals the watermark. Experiments show Dreamark achieves 90+% bit accuracy under both image-level and model-level attacks while preserving generation quality (as evidenced by CLIP scores), and it outperforms post-generation baselines like CopyRNeRF and WateNeRF in both watermark robustness and quality. The approach is architecture-agnostic and removes the generation-to-watermark delay, offering practical, provable ownership protection for SDS-based text-to-3D assets with strong robustness guarantees. This could significantly impact IP protection for rapid 3D content creation in commercial pipelines and broader deployment of watermarking in generation-time workflows.

Abstract

Recent advancements in text-to-3D generation can generate neural radiance fields (NeRFs) with score distillation sampling, enabling 3D asset creation without real-world data capture. With the rapid advancement in NeRF generation quality, protecting the copyright of the generated NeRF has become increasingly important. While prior works can watermark NeRFs in a post-generation way, they suffer from two vulnerabilities. First, a delay lies between NeRF generation and watermarking because the secret message is embedded into the NeRF model post-generation through fine-tuning. Second, generating a non-watermarked NeRF as an intermediate creates a potential vulnerability for theft. To address both issues, we propose Dreamark to embed a secret message by backdooring the NeRF during NeRF generation. In detail, we first pre-train a watermark decoder. Then, the Dreamark generates backdoored NeRFs in a way that the target secret message can be verified by the pre-trained watermark decoder on an arbitrary trigger viewport. We evaluate the generation quality and watermark robustness against image- and model-level attacks. Extensive experiments show that the watermarking process will not degrade the generation quality, and the watermark achieves 90+% accuracy among both image-level attacks (e.g., Gaussian noise) and model-level attacks (e.g., pruning attack).

Figures (5)

• Figure 1: Attack scenario. If company-generated content is considered company property, internal staff could steal non-watermarked intermediates in the post-generation pipeline (top row). However, such intermediates do not exist in the during-generation pipeline (bottom row).
• Figure 2: Overview. (a) We first pre-train a watermark encoder $W_E$ to embed a watermark into images and a watermark decoder $W_D$ to decode a watermark from images. (b) We generate trigger viewports $\{\mathbf{p}_T^i\}$ from the given secret message $m$ and optimize a NeRF such that the secret message can be decoded from images rendered from arbitrary trigger viewport $\mathbf{p}_T^i$.
• Figure 3: Images rendered from trigger viewports. Top: generated non-watermarked NeRF. Bottom: Watermarked NeRF generated by Dreamark. We aim to show that generated NeRF has the same visual quality as the non-watermarked NeRF instead of showing they are perceptually the same since there is no such the "original NeRF" in the generation context.
• Figure 4: Effect under varied trigger size. Bit accuracy is not significantly affected by trigger size.
• Figure 5: Robustness against model-level attacks. $x_w,x_a$ are images rendered from watermarked and attacked NeRF.