Can Protective Watermarking Safeguard the Copyright of 3D Gaussian Splatting?

AI summary

Overview

• Research area: Computer vision and 3D scene representation security, specifically copyright protection and adversarial watermark removal for 3D Gaussian Splatting (3DGS).
• Technical level: Advanced. The paper assumes familiarity with 3DGS rendering pipelines, alpha compositing, Gaussian primitives, density-based clustering, and watermarking evaluation metrics.
• Scope: The paper introduces GSPure, the first watermark purification framework designed specifically to strip watermarks out of 3DGS models rather than rendered 2D images, and evaluates it against three existing 3DGS watermarking schemes.

What This Paper Is About

Several recent methods embed hidden watermarks directly into 3D Gaussian Splatting assets so that copyright owners can later verify ownership. This paper asks whether those protections actually hold up, and shows that watermark removal techniques built for 2D images fail on 3DGS because the watermark lives inside the model's geometry and rendering attributes. The authors then build GSPure, a framework that identifies which Gaussian primitives carry the watermark and prunes them away while leaving the original scene intact.

Key Contributions

1. The first systematic exploration of watermark purification for 3DGS watermarking, and the proposal of GSPure, described as the first framework designed specifically for purifying 3D scene-level watermarks.
2. A view-aware Gaussian weight accumulation mechanism that quantifies each Gaussian primitive's rendering contribution across multiple viewpoints, so that primitives serving the watermark rather than the visible scene can be identified.
3. A geometrically accurate feature clustering strategy that combines Gaussian positions, opacity, and accumulated contribution weights into a single feature space, plus an adaptive pruning mechanism with cluster-level and noise-level thresholds.
4. Extensive experiments across three 3DGS watermarking methods (Splats in Splats, GS-Hider, SecureGS) on the Mip-NeRF360 dataset, showing superior purification with minimal damage to the original scene.

Main Findings

• Watermark removal is substantial: GSPure reduces watermark PSNR by up to 16.34 dB while causing less than 1 dB PSNR loss to the original scene.
• Best overall score across all three watermarking schemes: GSPure achieves the highest Score (defined as ΔPSNR_message − ΔPSNR_scene) on Splats in Splats (15.21), GS-Hider (10.16), and SecureGS (5.03), outperforming the second-best approach by margins of 12.97, 9.48, and 4.39 respectively.
• Strongest margin on Splats in Splats: Under Splats in Splats, GSPure surpasses the second-best method by 5.44 PSNR in watermark removal.
• Scene fidelity under GS-Hider: GSPure reduces the original scene PSNR by only 0.68 on average, compared to PSNR drops of 9.68 for GOF and 2.21 for Gaussian Noise.
• One exception on SecureGS fidelity: Under SecureGS, GSPure reaches a scene PSNR of 25.27, slightly below Gaussian Noise at 25.53, because SecureGS's Scaffold-GS anchor-based design is inherently robust to Gaussian noise perturbations. That same robustness means Gaussian Noise fails to remove the watermark at all.
• GOF is a destructive alternative: GOF achieves relatively strong watermark removal, even surpassing GSPure on SecureGS, but causes irreversible and unacceptable damage to the original scene.
• 2D approaches transfer poorly: Random Pruning, Feature Scaling, and Gaussian Noise Injection either leave the watermark largely intact or degrade the scene; Random Gaussian Pruning "struggles to effectively purify watermarks."
• Ablation on components: On GS-Hider, the fully configured GSPure reduces watermark PSNR to 12.03 and SSIM to 0.49, and on SecureGS to 16.71 and 0.56. On Splats in Splats, the full configuration gives scene PSNR 25.62 / SSIM 0.77 and message PSNR 10.19 / SSIM 0.28. Some partial configurations (Weight only, or Opacity+Cluster) purify watermarks competitively but preserve scene fidelity poorly, producing lower overall scores.
• Threshold behavior: On Splats in Splats, increasing the noise pruning factor τ_n raises PSNR for both scene and watermark, consistent with watermark primitives in noise being entangled with normal scene primitives. Increasing the cluster pruning factor τ_c has minimal impact on watermark removal but significantly improves scene quality.
• Visual near-indistinguishability: Rendered results after GSPure pruning are described as nearly indistinguishable from the original scene, and the point cloud visualizations show watermark-related Gaussians tending to cluster together, raising their likelihood of being pruned.

Methodology in Plain English

The starting observation is that Gaussians carrying watermark information behave differently from Gaussians that render the visible scene. Specifically, Gaussians that matter for rendering the original scene tend to contribute consistently across many viewpoints, while watermark Gaussians stay inactive or behave inconsistently during normal scene rendering.

GSPure works in three stages:

1. Measure contribution per Gaussian. For each of N rendered viewpoints, the method computes how much each Gaussian primitive contributes to the final image, accounting for its opacity, its intersection energy along the camera ray, and occlusion by Gaussians in front of it. These per-view contributions are averaged into a single accumulated weight per Gaussian. Low average weights suggest watermark-correlated primitives.
2. Cluster by unified features. Each Gaussian's position, opacity, and accumulated weight are standardized individually and concatenated into one feature vector. HDBSCAN is then applied to this joint feature space to group geometrically and photometrically similar primitives into clusters, with some points labeled as noise.
3. Prune adaptively. Each cluster is scored by its average weight. If a cluster's average falls below a threshold derived from the global average weight divided by a cluster pruning factor τ_c, the entire cluster is removed. Noise points are judged individually against a separate threshold using the noise pruning factor τ_n. This keeps removal selective so original scene structure survives.

The evaluation sets τ_n and τ_c to (4, 4) for Splats in Splats, (4, 4) for GS-Hider, and (2, 3) for SecureGS, with all weight analysis carried out at the anchor level for SecureGS. Experiments run on an NVIDIA A800 GPU, using a modified CUDA implementation of 3DGS to support computing rendering contribution weights. Evaluation uses PSNR and SSIM for scene fidelity and the newly defined Score for overall purification effectiveness.

Why This Matters

Impact on research. The paper shows that current 3DGS watermarking schemes do not provide absolute protection: watermarks can be removed effectively while the host scene stays usable. It shifts watermark attack research from the rendered image domain into the model parameters themselves, and it establishes a benchmark-style evaluation setup (Mip-NeRF360, three watermarking frameworks, four baselines, a combined Score metric) that future defensive work can be measured against.

Real-world applications:

• 3D asset marketplaces and model licensing platforms that rely on embedded watermarks to identify purchased or pirated Gaussian splat scenes.
• Visual effects, virtual reality, and novel-view synthesis pipelines where reconstruction models are expensive to produce and are traded as high-value assets.
• Digital forensics and copyright dispute resolution, where the ability to strip or verify watermarks affects the evidentiary value of a 3D asset.
• Generative 3D modeling and 3D editing workflows that ingest publicly shared point clouds of uncertain provenance.

Industry relevance. Because 3DGS training is costly, the models themselves are valuable digital assets worth protecting. Any company planning to distribute or license 3DGS content needs to know that watermark removal is achievable with less than 1 dB scene degradation, which weakens the commercial guarantee that ownership verification currently implies. The authors explicitly advocate for developing more robust 3D Gaussian watermarking methods alongside principled watermark removal.

Future Directions

• Designing 3DGS watermarking schemes that resist contribution-based analysis, for instance by distributing a watermark across primitives that are individually essential to scene rendering.
• Understanding and defending, more broadly, the vulnerability class this paper exposes, since the authors frame the work as a call for deeper study of 3DGS watermark vulnerabilities and defenses.
• Extending purification analysis beyond the three evaluated frameworks (Splats in Splats, GS-Hider, SecureGS) and the Mip-NeRF360 benchmark to larger or anchor-based representation variants.
• Reconciling the tension between removal strength and scene fidelity, particularly the observed trade-off where strong purification (as with GOF on SecureGS) causes unacceptable geometric damage, and where the SecureGS anchor design resists noise perturbations but not GSPure's clustering approach.

Target Audience

Researchers and practitioners working on 3D Gaussian Splatting, digital watermarking, copyright protection, and adversarial robustness for 3D scene representations. It is also relevant to security engineers and product teams at companies that license, distribute, or verify ownership of 3D assets, and to anyone evaluating whether existing 3D watermarking claims survive an adversarial attacker. Readers without a background in 3DGS rendering, differentiable splatting, or clustering will need to review the preliminaries before the methodology is fully accessible.

Authors’ abstract

3D Gaussian Splatting (3DGS) has emerged as a powerful representation for 3D scenes, widely adopted due to its exceptional efficiency and high-fidelity visual quality. Given the significant value of 3DGS assets, recent works have introduced specialized watermarking schemes to ensure copyright protection and ownership verification. However, can existing 3D Gaussian watermarking approaches genuinely guarantee robust protection of the 3D assets? In this paper, for the first time, we systematically explore and validate possible vulnerabilities of 3DGS watermarking frameworks. We demonstrate that conventional watermark removal techniques designed for 2D images do not effectively generalize to the 3DGS scenario due to the specialized rendering pipeline and unique attributes of each gaussian primitives. Motivated by this insight, we propose GSPure, the first watermark purification framework specifically for 3DGS watermarking representations. By analyzing view-dependent rendering contributions and exploiting geometrically accurate feature clustering, GSPure precisely isolates and effectively removes watermark-related Gaussian primitives while preserving scene integrity. Extensive experiments demonstrate that our GSPure achieves the best watermark purification performance, reducing watermark PSNR by up to 16.34dB while minimizing degradation to original scene fidelity with less than 1dB PSNR loss. Moreover, it consistently outperforms existing methods in both effectiveness and generalization. Our code is available at https://github.com/insightlab-CG-3DV/GSPure.