MultiNeRF: Multiple Watermark Embedding for Neural Radiance Fields

TL;DR

MultiNeRF tackles IP protection for Neural Radiance Fields by enabling multiple distinct watermarks to be embedded and retrieved from a single NeRF representation. It extends the TensoRF framework with a dedicated watermark grid and FiLM-based conditioning to selectively activate distinct watermarks per rendering identifier, trained end-to-end and compatible with existing HiDDeN decoders. The approach achieves higher watermark capacity and robust bit accuracy across synthetic and real-world NeRF datasets while maintaining rendering quality, and it demonstrates strong robustness against common image degradations and regeneration attacks. This work advances 3D content provenance by providing a scalable, multi-watermark framework for NeRFs that can accommodate multiple stakeholders or licenses without retraining for each watermark.

Abstract

We present MultiNeRF, a 3D watermarking method that embeds multiple uniquely keyed watermarks within images rendered by a single Neural Radiance Field (NeRF) model, whilst maintaining high visual quality. Our approach extends the TensoRF NeRF model by incorporating a dedicated watermark grid alongside the existing geometry and appearance grids. This extension ensures higher watermark capacity without entangling watermark signals with scene content. We propose a FiLM-based conditional modulation mechanism that dynamically activates watermarks based on input identifiers, allowing multiple independent watermarks to be embedded and extracted without requiring model retraining. MultiNeRF is validated on the NeRF-Synthetic and LLFF datasets, with statistically significant improvements in robust capacity without compromising rendering quality. By generalizing single-watermark NeRF methods into a flexible multi-watermarking framework, MultiNeRF provides a scalable solution for 3D content. attribution.

Figures (7)

• Figure 2: MultiNeRF extends TensoRF by introducing a watermark grid $A_w$ alongside the geometry $A_\sigma$ and appearance $A_c$ grids. Unique watermark IDs ($1..n$) are first encoded via a learnable embedding network into compact vectors that are then transformed into per-channel scaling ($\gamma$) and shifting ($\beta$) parameters. These parameters modulate the watermark grid’s features, ensuring that each distinct message is selectively activated and merged with the appearance grid during inference.
• Figure 3: MultiNeRF training process. A learnable encoder transforms multiple distinct watermark IDs into compact embedding vectors. MultiNeRF is trained with an end-to-end HiDDEN decoder module that renders images passing through differentiable noise augmentations. Perceptual (\ref{['eq:init']}) and patch-based (\ref{['eq:patch']}) reconstruction losses balance quality against accuracy (\ref{['eq:bce']}).
• Figure 4: Comparing visual quality. Left: Table of metrics (LPIPS $\downarrow$, PSNR $\uparrow$, SSIM $\uparrow$) of MultiNeRF to baselines (NeRFProtector, WateRF) for single message task on SYN and LLFF datasets. Values to 2 d.p. b) Right: Examples of visual artifacts (colored ripples) present in WateRF-modified versus the proposed MultiNeRF method (zoom inset).
• Figure 5: Evaluating the visual quality of MultiNeRF vs. baseline WateRF-modified for the multi-watermarking task: LPIPS (top); PSNR (mid.); SSIM (bot.).
• Figure 6: Evaluating bit accuracy $\uparrow$ of MultiNeRF versus baseline WateRF-modified for the multi-watermarking task. Accuracies averaged for SYN (left) and LLFF (right) datasets. Performance is significantly higher for MultiNeRF beyond the single watermarking case.