All That Glitters Is Not Gold: Key-Secured 3D Secrets within 3D Gaussian Splatting

TL;DR

KeySS introduces an end-to-end, key-secured 3D steganography framework that embeds secrets inside 3D Gaussian Splatting by transforming cover Gaussians into secret Gaussians through a key-conditioned decoder. A key insight is that Gaussian features contribute unequally to hiding, leading to an end-to-end architecture that jointly optimizes fidelity and security, including a CLIP-based key embedding and multi-secret support with wrong-key defense. To evaluate imperceptibility in 3D space, the authors propose 3D-Sinkhorn distance, a distributional metric over 3D Gaussian parameters, alongside a composite score that balances 3D fidelity and 3D-space security. Experimental results show state-of-the-art cover and secret reconstruction quality and enhanced resistance to steganalysis, including scenarios with multiple secrets and unauthorized access, while maintaining real-time rendering performance. The work also discusses limitations, notably a trade-off between cover and secret fidelity due to joint optimization, and points to future improvements in loss balancing and feature modulation for further gains.

Abstract

Recent advances in 3D Gaussian Splatting (3DGS) have revolutionized scene reconstruction, opening new possibilities for 3D steganography by hiding 3D secrets within 3D covers. The key challenge in steganography is ensuring imperceptibility while maintaining high-fidelity reconstruction. However, existing methods often suffer from detectability risks and utilize only suboptimal 3DGS features, limiting their full potential. We propose a novel end-to-end key-secured 3D steganography framework (KeySS) that jointly optimizes a 3DGS model and a key-secured decoder for secret reconstruction. Our approach reveals that Gaussian features contribute unequally to secret hiding. The framework incorporates a key-controllable mechanism enabling multi-secret hiding and unauthorized access prevention, while systematically exploring optimal feature update to balance fidelity and security. To rigorously evaluate steganographic imperceptibility beyond conventional 2D metrics, we introduce 3D-Sinkhorn distance analysis, which quantifies distributional differences between original and steganographic Gaussian parameters in the representation space. Extensive experiments demonstrate that our method achieves state-of-the-art performance in both cover and secret reconstruction while maintaining high security levels, advancing the field of 3D steganography. Code is available at https://github.com/RY-Paper/KeySS

Figures (9)

• Figure 1: Compared to existing methods like (a) GS-Hider gshider_zhang2024gshider and (b) WaterGS sis_guo2024splats, (c) the proposed method maintains the standard 3DGS format compatibility while achieving superior performance through fully exploiting inherent features for fidelity and implementing a key-controllable scheme that enables both multi-secret hiding and defense against incorrect key inputs.
• Figure 2: 3D Gaussians provide rich steganographic potential through multiple attributes: opacity, scale, rotation, position, and spherical harmonics (SH). However, naive approaches that simply zero out specific attributes to hide secrets pose fundamental security risks. The presence of hidden content can be easily detected by simply restoring the zero-value attribute, instantly revealing the hidden content. This limitation motivates our exploration of optimal feature transformation strategies for both effective hiding and security.
• Figure 3: (a) Our end-to-end 3D steganography framework jointly trains the cover 3D Gaussians and the key-secured decoder from scratch. To enhance training, we introduce combined camera poses for diverse training samples, combined SfM points for optimal initialization, and combined densifications for refinement. (b) The key-secured decoder features a decoupled architecture with feature-specific layers for different Gaussian attributes. A key-controlled scheme enables multi-secret hiding and strengthens defenses against unauthorized extraction. Additionally, the feature-specific layers allow systematic exploration of the optimal feature update for secret embedding.
• Figure 4: Visualization of decoder outputs across different feature combinations using correct and incorrect keys. The last two rows show secret recovery (correct key) and security preservation (incorrect key). Notation follows \ref{['tab_1hide1']}.
• Figure 5: Visualization comparison of our method on multiple secret hiding across different feature update scenarios using both correct and incorrect key inputs. The notation is consistent with \ref{['tab_1hide1']}. More visualization results can be found in \ref{['sec_sup_morevis']}.