WATER-GS: Watermark-embedded 3D Gaussian Splatting via Plug-and-play Decoder

1. The novelty of the paper is limited. The proposed method closely resembles NeRFProtector [1] and WateRF [2], but is applied to 3DGS. Such a straightforward adaptation lacks innovation.
2. The baselines used for comparison are too simple. It is essential to include comparisons with NeRFProtector [1] and WateRF [2].
3. There is no evaluation of robustness against 2D distortions, such as clipping and noise.
4. The PSNR values in Table 2, Table 3, and Table 4 are low, which could affect practical usability.

[1] Song, Qi, et al. "Protecting NeRFs' Copyright via Plug-And-Play Watermarking Base Model." arXiv preprint arXiv:2407.07735 (2024). [2] Jang, Youngdong, et al. "WateRF: Robust Watermarks in Radiance Fields for Protection of Copyrights." Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2024.

1. This work lacks innovation in terms of technology and methodology. There is no significant difference between this paper and works such as CopyRNerf [1], WateRF [2], and 3D-GSW [3]. Additionally, the method proposed in this paper has a weak correlation with the nature of 3DGS.
2. The performance of this work is limited. As shown in Table 1, the bit error rate reaches around 9%; the robustness against various attacks is also insufficient, with a significant decrease in bit accuracy under common attacks.
3. This work lacks a comparison with existing 3DGS watermarking methods, such as 3D-GSW [3]. The authors should compare existing 3DGS watermarking methods in the related work or experimental section and demonstrate the advantages of water-gs over these methods.

[1] Luo, Ziyuan, et al. "Copyrnerf: Protecting the copyright of neural radiance fields." Proceedings of the IEEE/CVF International Conference on Computer Vision. 2023.

[2] Jang, Youngdong, et al. "WateRF: Robust Watermarks in Radiance Fields for Protection of Copyrights." Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2024.

[3] Jang, Youngdong, et al. "3D-GSW: 3D Gaussian Splatting Watermark for Protecting Copyrights in Radiance Fields." arXiv preprint arXiv:2409.13222 (2024).

1. The proposed method WATER-GS is very similar to the previous baselines in NeRF such as WaterRF, NeRFProtector, and CopyRNeRF. The proposed WATER-GS basically relies on retuning on the color-related components in CopyRNeRF and relies on the pre-trained decode similar to WateRF and NeRFProtector. Since fine-tuning-based watermarking has been already proven in the radiance field, the contribution of this paper is limited.
2. The evaluation lacks a discussion on security aspects such as watermark security against sophisticated attacks such as adversarial attacks aimed at removing or altering the watermark. Such as PGD perturbations and VAE encoding attacks.
3. The proposed method relies on HiDDeN decoder, which may be vulnerable to distortions such as JPEG compression. More advanced message decoders should be discussed.

• W1. Unclear reasoning of good generation. Intuitively, watermarking 3DGS would be a much more challenging task than watermarking 2D images, since 3DGS is proposed for novel-view synthesis[1]. To protect 3D assets, stakeholders may expect the watermark can be extracted from any-view rendering. Achieving this generalization ability across training/testing views is straightforward for 3DGS rendering (as 3DGS is explicitly modeling 3D physics which should be, by nature view-consistent), however embedding an implicit, imperceptible watermark seems to be not as easy. Intuitively, watermark embedding is not supported by an underlying 3D physics. As shown in the results, the proposed scheme achieved effective generalization from training views to testing views, however readers are not convinced why this generalization could work. Authors should provide more insights into this issue to increase readers' understanding.

• W2. Considered distortions are limited. It seems most of the watermark information is embedded in Spherical Harmonic coefficients (c.f. Table 4). Compared with randomly dropping or cropping Gaussians, a more feasible operation might be transformation of color space: e.g. from Spherical Harmonic representation to RGB space (one example of such color transformation can be referred to https://github.com/graphdeco-inria/gaussian-splatting/issues/485) , for the purpose of aligning with rendering pipeline (some libraries use RGB as color representation) or reducing storage/memory. Such transformation would completely change the value of color features. Would it break the embedded watermark?

• W3: Resilience to reconstruction. This is more natural to think about compared with "regeneration attacks" in 2D image watermarks, since the original design of 3DGS is to reconstruct 3D from multi-views. Since the 3DGS files are shared online (line 186), if other users try to reconstruct a new 3DGS parameter from the rendering of this watermarked 3DGS file, will the watermark be resilient to such reconstruction?

Reference

• [1] Kerbl, Bernhard, et al. "3D Gaussian Splatting for Real-Time Radiance Field Rendering." ACM Trans. Graph. 42.4 (2023): 139-1.

1. The authors omitted some important works on NeRF and GS watermarking [1,2,3] in the related work section. They need to introduce these works and provide a comparison and explanation with them.

[1] 3D-GSW: 3D Gaussian Splatting Watermark for Protecting Copyrights in Radiance Fields.

[2] Gaussianstego: A generalizable stenography pipeline for generative 3d gaussians splatting.

[3] GeometrySticker: Enabling Ownership Claim of Recolorized Neural Radiance Fields.

2. Both Hidden and MBRS struggle to withstand the substantial degradation from 3DGS rendering and training, making the comparison between WATER-GS, 3DGS+Hidden, and 3DGS+MBRS somewhat irrelevant. I recommend that the authors directly apply the WateRF [4] strategy to 3DGS and compare it with WATER-GS, as WateRF is also a plug-and-play watermarking method and is largely independent of the type of 3D representation used.

[4] WateRF: Robust Watermarks in Radiance Fields for Protection of Copyrights.

1. The experimental validation is limited to relatively simple and common scenes. The approach needs to be tested on more challenging scenarios like large-scale environments, dynamic scenes, and real-world applications to demonstrate its practical value and scalability.

2. The high computational cost during the fine-tuning phase (10K-30K iterations taking 0.5-1.5 hours) raises concerns about practical deployment. This overhead may be prohibitive for applications requiring frequent model updates or real-time watermark embedding.

3. The methodology contribution is limited as it is similar to the paper "nerfprotector" (Protecting NeRFs' Copyright via Plug-And-Play Watermarking Base Model), no only by the overall framework, the plug-and-play design but also the writing.

4. The methodology section has gaps in explaining key design choices - particularly the selection of HiDDeN architecture for the decoder and the rationale behind specific parameter settings. More ablation studies on these architectural choices would strengthen the technical contribution.

The manuscript is confusing with respect to 3D-based digital watermarking. In the conclusion it is claimed that the watermarks into variants 3DGS models, which can be accurately extracted from rendered images captured from any viewpoints. However, this important result is not supported during the manuscript either in the methodology or through experiments about how results are extracted from various views of a scene.

There are too few robustness attacks reported in Tables 1 and 3.

Attacks such as JPEG image compression, noise addition and smoothing should have been presented as plots of watermark robustness where the attack is considered at various levels.