Where, What, Why: Toward Explainable 3D-GS Watermarking

TL;DR

This work presents a representation-native framework that separates where to write from how to preserve quality, and yields view-consistent watermark persistence and strong robustness against common image distortions such as compression and noise, while achieving a favorable robustness-quality trade-off compared with prior methods.

Abstract

As 3D Gaussian Splatting becomes the de facto representation for interactive 3D assets, robust yet imperceptible watermarking is critical. We present a representation-native framework that separates where to write from how to preserve quality. A Trio-Experts module operates directly on Gaussian primitives to derive priors for carrier selection, while a Safety and Budget Aware Gate (SBAG) allocates Gaussians to watermark carriers, optimized for bit resilience under perturbation and bitrate budgets, and to visual compensators that are insulated from watermark loss. To maintain fidelity, we introduce a channel-wise group mask that controls gradient propagation for carriers and compensators, thereby limiting Gaussian parameter updates, repairing local artifacts, and preserving high-frequency details without increasing runtime. Our design yields view-consistent watermark persistence and strong robustness against common image distortions such as compression and noise, while achieving a favorable robustness-quality trade-off compared with prior methods. In addition, decoupled finetuning provides per-Gaussian attributions that reveal where the message is carried and why those carriers are selected, enabling auditable explainability. Compared with state-of-the-art methods, our approach achieves a PSNR improvement of +0.83 dB and a bit-accuracy gain of +1.24%.

Figures (7)

• Figure 1: Usage of our model. The owner embeds a secret message into a 3D-GS model using our method; even if the model is stolen and undergoes distortion attacks, the rendered views can still be decoded to verify copyright.
• Figure 2: Pipeline of Our Method. During initialization, we prune redundant Gaussians based on their rendering contribution. The Trio-Experts module extracts geometry/appearance/redundancy priors and aggregates them into an evidence package $E_k(i)$. The SBAG uses this evidence and a one-shot render to select, expand, and densify watermark carriers. In finetuning, a channel-wise group mask controls gradients for watermark carriers ($GS_{\text{wm}}$) and visual compensators ($GS_{\text{vis}}$). EOT attacks render both clean and attacked views: $\mathcal{L}_{\text{visual}}$ preserves appearance, while low-frequency subbands form the watermark loss $\mathcal{L}_{\text{wm\_total}}$, with $\mathcal{L}_{\mathrm{wav}}^{\mathrm{low}}$ penalizing over-editing. The individual optimization of $\mathcal{L}_{\text{vis}}$ and $\mathcal{L}_{\text{wm}}$ improves both fidelity and robustness.
• Figure 3: Rendering-quality comparison. We compare our method with all baselines using 32-bit messages. The difference maps are shown at 10× scale. Our approach achieves higher bit accuracy and better visual fidelity than competing methods.
• Figure 4: Rendering-quality comparison under different message capacities. With 32-bit, 48-bit, and 64-bit embedded messages, (differences $\times 10$), our method maintains high bit-acc across different capacities while preserving perceptual quality.
• Figure 5: Comparison of rendering quality among the full method (ours), without SBAG, without group mask, without decoupled finetuning, and the baseline model. All images are embedded with 32-bit messages.