{"id":"2aa23316-af84-4a51-a076-95b32e938075","arxiv_id":"2411.19895","paper_version":5,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"A fast and robust watermarking framework for 3D Gaussian Splatting that embeds messages into spherical harmonic offsets and decodes them via a CLIP-guided decoder.","lead":"GuardSplat embeds hidden messages into 3D Gaussian Splatting models by adjusting spherical harmonic color coefficients. It trains a CLIP-based decoder in five minutes and watermarks a 3D asset in ten, claiming high accuracy and robustness.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Decoder train/test ambiguity in Section 5: reported bit accuracy may be measured on messages sampled from the decoder's 2048-message training pool, so generalization to arbitrary secret messages is unestablished.","rationale":"The reader's weakest_assumption correctly identifies the decoder's generalization to unseen messages as the load-bearing premise. The paper's phrase 'as training and test data' is genuinely ambiguous, and no experiment in the main text or supplement establishes that the decoder extracts messages outside its training pool. Since the advertised capacity and efficiency both depend on a single decoder working for arbitrary user-chosen messages, this gap is central. If the reported bit accuracies were measured only on messages from the decoder's training subset, the quantitative claims would be inflated. A held-out test is straightforward and would settle the issue. The reader's conditional verdict remains appropriate; I do not see a reason to move away from it. A secondary internal issue is the sign of the offset loss in Eq. (8), where a negative norm would encourage large offsets rather than constrain them, contradicting the stated purpose and the ablation in Table 4; this is likely a typo, but it should be corrected for reproducibility.","tokens_in":20130,"tokens_out":6390,"duration_ms":60900,"concrete_test":"Rerun the evaluation with a strict split: train the decoder on 2048 randomly sampled L-bit messages, then watermark each 3DGS scene with 100-200 messages drawn uniformly from the complementary set that was never used in decoder training, and report bit accuracy separately for seen versus unseen messages. If unseen-message accuracy drops materially below the reported ~98% (for example, below 90% for L=48), the capacity claim is unsupported. Additionally, report the decoder's own held-out text-feature bit accuracy and state explicitly which message IDs were used for the results in Tables 1 and 2.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim is that GuardSplat embeds arbitrary L-bit messages into 3DGS assets and extracts them from novel views with over 98% bit accuracy. This requires the frozen CLIP-guided decoder D_M to map CLIP visual features of watermarked views to the correct message for any message, including messages not seen during decoder training. Section 5 states: 'Given the message length NL, we randomly select min(2^NL, NK) samples from a total of 2^NL messages as training and test data, where NK=2048.' The paper never specifies how the messages used in the Table 1 and Table 2 watermarking evaluations are chosen, and the most natural reading is that they come from the same 2048-message pool used for decoder training. If the evaluation messages are in the decoder's training set, the decoder has directly memorized how to output those exact messages from their CLIP text features, so the reported accuracy does not demonstrate capacity for arbitrary messages. The method's efficiency claim (5-minute decoder training, 10-minute watermarking) presumes that a single general decoder works for all future messages; if the decoder must be trained on or near the target message, the cost model is invalid. Furthermore, the decoder is trained only on textual features, while the transfer to visual features is the entire premise of Section 4.3, yet the paper provides no held-out test where target messages are disjoint from the decoder training set. Without such a test, the observed bit accuracy could reflect memorization rather than generalization. This is the load-bearing weak point because capacity is one of the four advertised requirements and the main efficiency and novelty claims depend on decoder reusability.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper presents GuardSplat, a watermarking framework for 3D Gaussian Splatting (3DGS) assets. The method trains a small MLP message decoder on CLIP textual features of binary messages (5 minutes), then embeds a user-chosen message into the spherical-harmonic (SH) coefficients of a pre-trained 3DGS model by optimizing learnable SH offsets (10 minutes), while freezing all other Gaussian attributes. Extraction is performed by feeding rendered views through CLIP's visual encoder and the same decoder, with a differentiable distortion layer used during training to improve robustness. Experiments on Blender and LLFF report bit accuracies above 98% for up to 48-bit messages with high PSNR, robustness to various distortions, and a large efficiency gain over prior NeRF/3DGS watermarking methods.","tokens_in":20424,"tokens_out":3175,"duration_ms":30213,"significance":"If the claims hold, GuardSplat would be a practical and efficient tool for protecting 3DGS assets, with a lightweight decoder, fast per-asset watermarking, and the ability to embed messages without altering the underlying 3D structure. The paper provides a useful comparison against several recent baselines, includes ablations and security analyses, and releases code, which strengthens reproducibility. However, the central capacity claim—that arbitrary L-bit messages can be embedded and extracted with over 98% bit accuracy—currently rests on an ambiguous decoder training/test protocol that may allow evaluation on the decoder's training messages, and on a sign error in the offset loss equation. These issues must be resolved before the practical significance of the method can be assessed.","major_comments":[{"comment":"The evaluation protocol for the message decoder is ambiguous and potentially circular. The text states: 'Given the message length NL, we randomly select min(2^NL, NK) samples from a total of 2^NL messages as training and test data, where NK=2048.' This does not specify whether the selected samples are split into disjoint training and test sets, or whether the same pool is used for both. More importantly, the paper never states how the messages used in the watermarking evaluations of Tables 1 and 2 are chosen. If those messages are drawn from the decoder's 2048-message training pool, the reported bit accuracy measures memorization of the exact text features seen during decoder training, not the ability to embed and extract arbitrary user messages. This is load-bearing because the abstract and Section 4.1 claim a general-purpose decoder that can handle arbitrary messages. Please clarify the exact train/test split and, crucially, report bit accuracy for messages that are disjoint from the decoder's training set, for each message length.","section":"Section 5, Implementation Details; Tables 1 and 2"},{"comment":"The offset loss in Eq. (8) is written as L_off = - (1/N) sum_i ||h^o_i||^2_2. Since the optimization in Eq. (10) minimizes the total loss, this negative sign encourages the SH offsets to grow in magnitude, which is the opposite of the stated purpose of 'constrain[ing] its magnitude' to preserve fidelity. The ablation in Table 4 shows that adding L_off improves PSNR, which is only consistent with a positive L2 penalty. The equation should be corrected to L_off = + (1/N) sum_i ||h^o_i||^2_2 (or an equivalent formulation), and the authors should confirm that the reported experiments used the corrected sign.","section":"Section 4.2, Eq. (8)"},{"comment":"The decoder is trained exclusively on CLIP textual features of a subset of messages, then applied to CLIP visual features of rendered watermarked views. The load-bearing premise is that this decoder will extract messages that were never in its training set. The paper provides no such held-out evaluation. Because of the ambiguity identified above, all reported bit accuracies may be on training messages. Please add an experiment where the message embedded into the 3DGS asset is sampled from the complement of the decoder training pool (e.g., from the remaining 2^NL - 2048 messages for NL=16, and from a fresh random sample for NL=32 and 48), and report the resulting bit accuracy. Without this, the 'general-purpose decoder' claim and the associated efficiency comparison are not supported.","section":"Section 4.1 and Section 4.3 (generalization of the decoder)"},{"comment":"In Eq. (6), the extracted message is written as \\hat{M} = D_M(E_V(T)), but the preceding sentence says the tokens T are fed into the CLIP textual encoder E_T. The subscript V appears to be a typo for T. Please correct this to E_T(T) to avoid confusion about which CLIP encoder is used for decoder training.","section":"Section 4.1, Eq. (6)"}],"minor_comments":[{"comment":"The term 'Brightness Jittoring' appears to be a typo for 'Brightness Jittering'.","section":"Section 5, Evaluation Metrics"},{"comment":"The caption says 'Comparisons of the start-of-the-art methods'; this should read 'state-of-the-art'.","section":"Table 1 caption"},{"comment":"The labels 'Offestall' and 'Offestrest' contain misspellings of 'Offset'; please correct them for clarity.","section":"Table 3 and Section 5.2"},{"comment":"The paper does not explicitly state whether a separate decoder is trained for each message length NL or whether one decoder handles all lengths; please clarify, since the architecture in Supp. Fig. S1 has an output layer that appears length-dependent.","section":"Section 5, Implementation Details"},{"comment":"The phrase 'as training and test data' should be clarified to specify the exact split ratio and whether the same views/messages are reused across evaluation; this is related to the major comment about protocol ambiguity.","section":"Section 5, Implementation Details"}],"recommendation":"major_revision","confidential_remarks":"The paper is within the scope of the journal and the code release is commendable. The main risk is that the reported capacity results may be an artifact of evaluating on the decoder's training messages; I would like the editor to ensure the authors provide a clear disjoint-message evaluation before publication. The sign error in Eq. (8) is easy to fix but needs confirmation that the experiments used the corrected loss."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Dear colleague,\n\nYou should know two things about GuardSplat before reading it: the core mechanism is genuinely new, and the headline numbers are probably not trustworthy as reported. The CLIP-guided decoupling idea—training a message decoder on text embeddings and then reusing it on visual embeddings—is a real departure from prior 3DGS watermarking work. If it works for arbitrary messages, it changes the cost model for 3DGS watermarking. But the paper does not currently demonstrate that it works for arbitrary messages.\n\nWhat is good: the SH-offset embedding is clean and the ablation in Table 3 supports the design choice; the anti-distortion training layer is standard but sensibly applied; Table 1 and 2 show large gains over baselines, and the efficiency claim (5 min decoder, 10 min watermarking) is striking. Code is available, which is credit-worthy.\n\nThe soft spots are in the evaluation protocol. Section 5 says: 'Given the message length NL, we randomly select min(2^NL, NK) samples from a total of 2^NL messages as training and test data, where NK=2048.' It never says how the 2048 samples are split, and the most natural reading is that the same message pool is used to train the decoder and to evaluate watermarking. For 48-bit messages, 2^48 is enormous, and a decoder trained on 2048 specific messages can easily memorize them. The reported 98%+ bit accuracy may therefore reflect memorization of the training messages, not capacity for arbitrary secrets. The paper needs a held-out experiment where the messages used to watermark the 3DGS assets are disjoint from the decoder's training pool. Without that, the central claim of generalization—and the efficiency model that says you train one general decoder—is unsupported.\n\nSeparately, Eq. (8) defines Loff as the negative squared norm of the offsets. Since you minimize the total loss, a negative offset loss would push offsets to grow, not shrink, contradicting the stated purpose. This looks like a sign typo, but as written it is wrong. There are also no error bars, and the security evaluation is limited to pruning. These are smaller issues. The sign error matters because the whole invisibility argument depends on the offset constraint.\n\nIs this paper worth a serious referee? Yes. The mechanism is novel enough, the results are strong enough, and the code being public makes the claims checkable. But it needs revision before acceptance: clarify the train/test message split, add a held-out message experiment, fix the offset loss, and report variance. If the held-out accuracy collapses, the paper is reduced to a clever but narrow method that works only for a tiny message set.\n\nI wouldn't cite it in my own work until those numbers are clarified. For a reading group, it is actually a good case study in how easy it is to make a capacity claim circular.","headline":"A genuinely novel CLIP-guided decoder for 3DGS watermarking, but the reported bit accuracy may be circular until the train/test message split is clarified.","tokens_in":21006,"tokens_out":2909,"would_cite":false,"duration_ms":25435,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"GuardSplat watermarks 3D Gaussian Splatting assets by embedding messages in spherical-harmonic color offsets, claiming 98%+ bit accuracy with 15 minutes total optimization.","keywords":["3D Gaussian Splatting watermarking","CLIP-guided decoder","spherical harmonic offsets","copyright protection","robust message extraction","3D asset security","steganography","neural rendering watermarking"],"falsifier":"Take a trained GuardSplat decoder, watermark a 3DGS model with binary messages that were excluded from the decoder's training subset, render novel views, and measure bit accuracy; if accuracy falls to chance levels (near 50% for random bits) rather than near the reported 98%, the claimed cross-modal generalization does not hold. A second check is to render views with viewpoint shifts larger than the tested range and see whether extraction degrades.","tokens_in":19942,"feed_emoji":"🔏","tokens_out":3804,"duration_ms":32948,"temperature":0.7,"pith_summary":"The paper proposes GuardSplat, a watermarking framework for 3D Gaussian Splatting assets that claims to embed large binary messages into the spherical-harmonic color features of a pretrained 3DGS model while leaving the 3D geometry untouched. It reports that a message decoder trained in five minutes on CLIP text features can extract 48-bit messages from rendered and distorted views with over 98% accuracy, with PSNR around 39 dB, and that watermarking a model takes ten minutes on one GPU. The appeal is practical: creators could mark a 3DGS asset once and later identify stolen renderings, without retraining a decoder per scene and without visible quality loss.","feed_headline":"15-minute watermark protects 3D Gaussian assets","feed_subtitle":"CLIP-trained decoder reads 48-bit messages from rendered views at 98% accuracy, surviving JPEG and VAE attacks.","key_machinery":"The pipeline has three parts. CLIP-guided message decoupling optimization converts a binary message to CLIP text tokens through bit-to-token mapping, feeds them to CLIP's frozen textual encoder, and trains a three-layer MLP decoder to recover the bits from the 512-dimensional feature. The SH-aware message embedding freezes all Gaussian attributes and adds a learnable 48-dimensional offset to each Gaussian's spherical-harmonic coefficients, so the watermarked color comes from $h_i + h_i^{\\text{offset}}$ while geometry stays fixed. Anti-distortion message extraction applies a differentiable distortion layer (crop, scale, rotation, JPEG, brightness) during optimization so the offsets learn to survive those distortions at test time.","core_discovery":"GuardSplat's central claim is that watermarking 3DGS assets can be made efficient and robust by decoupling decoder training from image reconstruction: instead of training an encoder-decoder on images, it trains a small three-layer decoder to map CLIP textual features to bits, then uses the same decoder on CLIP visual features of rendered views to optimize learnable spherical-harmonic offsets. The paper asserts that this transfer works because CLIP aligns text and image representations, and that embedding messages only in SH offsets preserves fidelity while resisting removal from model files. Experiments on Blender and LLFF report bit accuracy of 99.64% for 16-bit, 99.04% for 32-bit, and 98.29% for 48-bit messages, with PSNR above 38 dB, and robustness to noise, geometric distortions, JPEG, and VAE-based attacks.","pith_inferences":["If CLIP's text-image alignment is the true carrier of the watermark, then the method's robustness is bounded by CLIP's invariance: any image perturbation that changes CLIP's visual feature enough to break alignment should also break extraction, which suggests a stress test against adversarial or semantic edits not in the distortion list.","The bit-to-token mapping writes each bit to a CLIP token index, so the decoder may be learning a lookup over token positions rather than a general bit code; testing random bit permutations would show whether the coding scheme itself is what generalizes.","Because the watermark lives in SH offsets, it is tied to view-dependent color; re-rendering under a different lighting model or tone-mapping that recomputes SH coefficients could remove the signal, an attack the paper does not test."],"forward_implications":["A creator can watermark a pretrained 3DGS model in about ten minutes and later extract the message from arbitrary rendered views, making stolen renderings identifiable.","Because the decoder is trained once on CLIP text features and reused across scenes, watermarking cost no longer scales with per-scene decoder optimization.","Messages of 64 and 72 bits still extract above 96% accuracy per the supplementary results, suggesting capacity beyond the headline 48 bits.","Robustness to JPEG and VAE re-encoding means the watermark can survive common redistribution channels such as screenshots and compressed uploads."],"supporting_citations":[{"why":"Supplies the frozen CLIP textual and visual encoders whose alignment is the basis for transferring decoder training from text features to image features.","marker":"[41]"},{"why":"Defines the 3D Gaussian Splatting representation, rendering pipeline, and Gaussian attributes that the watermark is embedded into.","marker":"[19]"},{"why":"GaussianMarker is the main 3DGS watermarking baseline that GuardSplat must beat on bit accuracy and optimization time.","marker":"[13]"},{"why":"WateRF is a NeRF watermarking method used as a baseline and also adapted to 3DGS, providing the comparison for the SH-aware embedding approach.","marker":"[14]"},{"why":"CopyRNeRF is a per-scene NeRF watermarking baseline that motivates the efficiency advantage of the CLIP-guided decoder.","marker":"[28]"},{"why":"HiDDeN is the 2D encoder-decoder watermarking baseline whose decoder is reused in GuardSplat variants, showing the effect of replacing it with the CLIP-trained decoder.","marker":"[69]"},{"why":"Provides the VAE-based attack used to evaluate robustness against generative re-encoding of watermarked views.","marker":"[68]"},{"why":"StegExpose is the LSB steganography detector used to evaluate the security of watermarked rendered views.","marker":"[6]"}],"fun_headline_variants":["GuardSplat: Fast, stealthy watermarking for 3D Gaussian assets","Watermark 3D Gaussians in minutes, not hours","CLIP-powered watermark survives JPEG and VAE attacks","GuardSplat: Invisible 3D watermarks that resist removal","Read 48-bit watermark from rendered 3D views at 98%"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"A decoder trained only on text-encoded versions of a subset of messages will correctly read the same messages from visual features of rendered views it never saw, including messages outside the training subset.","fun_headline_variants_meta":{"raw":{"variants":["GuardSplat: Fast, stealthy watermarking for 3D Gaussian assets","Watermark 3D Gaussians in minutes, not hours","CLIP-powered watermark survives JPEG and VAE attacks","GuardSplat: Invisible 3D watermarks that resist removal","Read 48-bit watermark from rendered 3D views at 98%"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000503,"raw_usage":{"total_tokens":2480,"prompt_tokens":988,"completion_tokens":1492,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":604,"completion_tokens_details":{"reasoning_tokens":1399}},"tokens_in":604,"tokens_out":1492,"duration_ms":10283,"temperature":1.0,"reasoning_tokens":1399,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T05:41:39.299890+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take a trained GuardSplat decoder, watermark a 3DGS model with binary messages that were excluded from the decoder's training subset, render novel views, and measure bit accuracy; if accuracy falls to chance levels (near 50% for random bits) rather than near the reported 98%, the claimed cross-modal generalization does not hold. A second check is to render views with viewpoint shifts larger than the tested range and see whether extraction degrades.","supporting_citations":[{"cited_title":"Learn- ing transferable visual models from natural language super- vision","cited_arxiv_id":null,"evidence_quote":"Supplies the frozen CLIP textual and visual encoders whose alignment is the basis for transferring decoder training from text features to image features."},{"cited_title":"3d gaussian splatting for real-time radiance field rendering","cited_arxiv_id":null,"evidence_quote":"Defines the 3D Gaussian Splatting representation, rendering pipeline, and Gaussian attributes that the watermark is embedded into."},{"cited_title":"Gaussianmarker: Uncertainty-aware copyright protection of 3d gaussian splat- ting","cited_arxiv_id":null,"evidence_quote":"GaussianMarker is the main 3DGS watermarking baseline that GuardSplat must beat on bit accuracy and optimization time."},{"cited_title":"Waterf: Robust water- marks in radiance fields for protection of copyrights","cited_arxiv_id":null,"evidence_quote":"WateRF is a NeRF watermarking method used as a baseline and also adapted to 3DGS, providing the comparison for the SH-aware embedding approach."},{"cited_title":"Copyrnerf: Protecting the copyright of neural radiance fields","cited_arxiv_id":null,"evidence_quote":"CopyRNeRF is a per-scene NeRF watermarking baseline that motivates the efficiency advantage of the CLIP-guided decoder."},{"cited_title":"Hidden: Hiding data with deep networks","cited_arxiv_id":null,"evidence_quote":"HiDDeN is the 2D encoder-decoder watermarking baseline whose decoder is reused in GuardSplat variants, showing the effect of replacing it with the CLIP-trained decoder."},{"cited_title":"Invisible image watermarks are provably removable using generative ai","cited_arxiv_id":null,"evidence_quote":"Provides the VAE-based attack used to evaluate robustness against generative re-encoding of watermarked views."}],"review_version":1}