Position: 3D Gaussian Splatting Watermarking Should Be Scenario-Driven and Threat-Model Explicit

TL;DR

The paper addresses the lack of explicit security specifications in 3D Gaussian Splatting watermarking and argues for a scenario-driven threat-model framework that ties deployment contexts to adversarial assumptions. It introduces a reference system and formalizes an access-vector based security model, defining black/grey/white-box regimes and multiple attack levels. A reproducible spread-spectrum baseline with explicit keys $K_{\mathrm{sel}},K_{\mathrm{code}},K_{\mathrm{seq}}$ demonstrates concrete trade-offs between capacity, robustness, and fidelity within the transform-domain embedding on 3DGS SH parameters. These contributions aim to enable principled evaluation, cross-study comparability, and robust IP protection for editable 3D assets in AI-enabled pipelines.

Abstract

3D content acquisition and creation are expanding rapidly in the new era of machine learning and AI. 3D Gaussian Splatting (3DGS) has become a promising high-fidelity and real-time representation for 3D content. Similar to the initial wave of digital audio-visual content at the turn of the millennium, the demand for intellectual property protection is also increasing, since explicit and editable 3D parameterization makes unauthorized use and dissemination easier. In this position paper, we argue that effective progress in watermarking 3D assets requires articulated security objectives and realistic threat models, incorporating the lessons learned from digital audio-visual asset protection over the past decades. To address this gap in security specification and evaluation, we advocate a scenario-driven formulation, in which adversarial capabilities are formalized through a security model. Based on this formulation, we construct a reference framework that organizes existing methods and clarifies how specific design choices map to corresponding adversarial assumptions. Within this framework, we also examine a legacy spread-spectrum embedding scheme, characterizing its advantages and limitations and highlighting the important trade-offs it entails. Overall, this work aims to foster effective intellectual property protection for 3D assets.

Figures (4)

• Figure 1: An authenticated watermarking system. It consists of three parts, setup, embedding, and verification. It is essential to ensure that the key is transmitted directly from the setup side to the verification portal via a secure channel.
• Figure 2: Qualitative fidelity under different spread-spectrum embedding amplitudes. We visualize rendered images of the original and watermarked 3DGS scenes, together with the corresponding difference images ($\times 10$), under payload $B=32$ and three embedding strengths $\alpha \in \{0.1,\,0.01,\,0.001\}$. Results are shown for three scenes, LLFF fern, Mip-NeRF 360 bicycle, and Blender hotdog.
• Figure 3: The trade-off between bit accuracy and payload length. Bit accuracy is represented as a function of payload length $B \in \{32,\,48,\,64\}$ under a fixed-total embedding energy constraint.
• Figure 4: Qualitative fidelity with different payload lengths. Rendered original, watermarked, and difference ($\times 10$) images are represented with a fixed embedding strength $\alpha=0.01$ and payload lengths $B \in \{32,\,48,\,64\}$. The three rows correspond to LLFF fern, Mip-NeRF 360 bicycle, and Blender hotdog, respectively.