3D-GSW: 3D Gaussian Splatting for Robust Watermarking

CVPR 2025

Youngdong Jang 1,  Hyunje Park 1,   Feng Yang 2,   Heeju Ko 1,   Euijin Choo 3,   Sangpil Kim 1

1Korea University 2Google DeepMind 3University of Alberta
arXiv Code

Abstract

As 3D Gaussian Splatting (3D-GS) gains significant attention and its commercial usage increases, the need for watermarking technologies to prevent unauthorized use of the 3D-GS models and rendered images has become increasingly important. In this paper, we introduce a robust watermarking method for 3D-GS that secures copyright of both the model and its rendered images. Our proposed method remains robust against distortions in rendered images and model attacks while maintaining high rendering quality. To achieve these objectives, we present Frequency-Guided Densification (FGD), which removes 3D Gaussians based on their contribution to rendering quality, enhancing real-time rendering and the robustness of the message. FGD utilizes Discrete Fourier Transform to split 3D Gaussians in high-frequency areas, improving rendering quality. Furthermore, we employ a gradient mask for 3D Gaussians and design a wavelet-subband loss to enhance rendering quality. Our experiments show that our method embeds the message in the rendered images invisibly and robustly against various attacks, including model distortion. Our method achieves superior performance in both rendering quality and watermark robustness while improving real-time rendering efficiency.

Overview of 3D-GSW

Teaser

Before fine-tuning 3D-GS, Frequency-Guided Densification (FGD) removes 3D Gaussians based on their contribution to the rendering quality and splits 3D Gaussians in high-frequency areas into smaller ones. We also construct a gradient mask based on the parameters of an FGD-processed 3D-GS. During the fine-tuning, we apply the Discrete Wavelet Transform (DWT) to the rendered image for robustness, using the low frequency as input to a pre-trained message decoder. For rendering quality, we design a wavelet-subbands loss that utilizes only high-frequency subbands. Finally, 3D-GS is optimized through the $\mathcal{L}_{total}$.

Qualitative Comparison


📷 Click on video to play or pause. Move mouse to change the hover 📷

Mip-NeRF 360

Scene Watermarking Results Comparison Slider


LLFF

Scene Watermarking Results Comparison Slider


NeRF-Blender

Scene Watermarking Results Comparison Slider




Experiment Results

Teaser

Rendering quality comparison of each baseline with our method. We doubled the scale of the difference map. Our method outperforms others in bit accuracy and rendering quality, using 32-bit messages for the qualitative results.



Teaser

Bit accuracy and quantitative comparison of rendering quality with baselines. We show the results in 32, 48, and 64 bits. The results are the average of Blender, LLFF, and Mip-NeRF 360 datasets. The best performances are highlighted in bold.


Teaser

Quantitative evaluation of robustness under various attacks compared to baseline methods. The results are the average of Blender, LLFF, and Mip-NeRF 360 datasets. We conduct experiments using 32-bit messages. The best performances are highlighted in bold.

Teaser

Robustness under model distortion. We show the results on 32-bits. The best performances are highlighted in bold.


Teaser

Results on the large-scale Mip-NeRF 360 dataset for 64-bits. All scores are averaged across Mip-NeRF 360 scenes, with ’fine-tunes’ referring to embedded messages. For a fair comparison, we utilize the pre-trained models provided by 3D-GS. The first row is the performance of the pre-trained models.





BibTeX

@inproceedings{jang20253d,
  title={3d-gsw: 3d gaussian splatting for robust watermarking},
  author={Jang, Youngdong and Park, Hyunje and Yang, Feng and Ko, Heeju and Choo, Euijin and Kim, Sangpil},
  booktitle={Proceedings of the Computer Vision and Pattern Recognition Conference},
  pages={5938--5948},
  year={2025}
}