Pith. sign in

REVIEW 4 major objections 5 minor 72 references

GuardSplat: Efficient and Robust Watermarking for 3D Gaussian Splatting

T0 review · 4 major / 5 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read GuardSplat watermarks 3D Gaussian Splatting assets by embedding messages in spherical-harmonic color offsets, claiming 98%+ bit accuracy with 15 minutes total optimization.

desk verdict A genuinely novel CLIP-guided decoder for 3DGS watermarking, but the reported bit accuracy may be circular until the train/test message split is clarified. read the letter →

arxiv 2411.19895 v5 pith:TEAO2DTO submitted 2024-11-29 cs.CV cs.CR

Zixuan Chen , Guangcong Wang , Jiahao Zhu , Jianhuang Lai , Xiaohua Xie This is my paper · ORCID
classification cs.CVcs.CR
keywords 3DGaussianSplattingwatermarkingCLIP-guideddecodersphericalharmonicoffsetscopyrightprotectionrobustmessageextractionassetsecuritysteganographyneuralrendering
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper proposes GuardSplat, a watermarking framework for 3D Gaussian Splatting assets that claims to embed large binary messages into the spherical-harmonic color features of a pretrained 3DGS model while leaving the 3D geometry untouched. It reports that a message decoder trained in five minutes on CLIP text features can extract 48-bit messages from rendered and distorted views with over 98% accuracy, with PSNR around 39 dB, and that watermarking a model takes ten minutes on one GPU. The appeal is practical: creators could mark a 3DGS asset once and later identify stolen renderings, without retraining a decoder per scene and without visible quality loss.

What carries the argument

The pipeline has three parts. CLIP-guided message decoupling optimization converts a binary message to CLIP text tokens through bit-to-token mapping, feeds them to CLIP's frozen textual encoder, and trains a three-layer MLP decoder to recover the bits from the 512-dimensional feature. The SH-aware message embedding freezes all Gaussian attributes and adds a learnable 48-dimensional offset to each Gaussian's spherical-harmonic coefficients, so the watermarked color comes from $h_i + h_i^{\text{offset}}$ while geometry stays fixed. Anti-distortion message extraction applies a differentiable distortion layer (crop, scale, rotation, JPEG, brightness) during optimization so the offsets learn to survive those distortions at test time.

What would settle it

Take a trained GuardSplat decoder, watermark a 3DGS model with binary messages that were excluded from the decoder's training subset, render novel views, and measure bit accuracy; if accuracy falls to chance levels (near 50% for random bits) rather than near the reported 98%, the claimed cross-modal generalization does not hold. A second check is to render views with viewpoint shifts larger than the tested range and see whether extraction degrades.

Watch

Extended reading notes

Core claim

GuardSplat's central claim is that watermarking 3DGS assets can be made efficient and robust by decoupling decoder training from image reconstruction: instead of training an encoder-decoder on images, it trains a small three-layer decoder to map CLIP textual features to bits, then uses the same decoder on CLIP visual features of rendered views to optimize learnable spherical-harmonic offsets. The paper asserts that this transfer works because CLIP aligns text and image representations, and that embedding messages only in SH offsets preserves fidelity while resisting removal from model files. Experiments on Blender and LLFF report bit accuracy of 99.64% for 16-bit, 99.04% for 32-bit, and 98.29% for 48-bit messages, with PSNR above 38 dB, and robustness to noise, geometric distortions, JPEG, and VAE-based attacks.

Load-bearing premise

A decoder trained only on text-encoded versions of a subset of messages will correctly read the same messages from visual features of rendered views it never saw, including messages outside the training subset.

Editorial extensions

If this is right

  • A creator can watermark a pretrained 3DGS model in about ten minutes and later extract the message from arbitrary rendered views, making stolen renderings identifiable.
  • Because the decoder is trained once on CLIP text features and reused across scenes, watermarking cost no longer scales with per-scene decoder optimization.
  • Messages of 64 and 72 bits still extract above 96% accuracy per the supplementary results, suggesting capacity beyond the headline 48 bits.
  • Robustness to JPEG and VAE re-encoding means the watermark can survive common redistribution channels such as screenshots and compressed uploads.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If CLIP's text-image alignment is the true carrier of the watermark, then the method's robustness is bounded by CLIP's invariance: any image perturbation that changes CLIP's visual feature enough to break alignment should also break extraction, which suggests a stress test against adversarial or semantic edits not in the distortion list.
  • The bit-to-token mapping writes each bit to a CLIP token index, so the decoder may be learning a lookup over token positions rather than a general bit code; testing random bit permutations would show whether the coding scheme itself is what generalizes.
  • Because the watermark lives in SH offsets, it is tied to view-dependent color; re-rendering under a different lighting model or tone-mapping that recomputes SH coefficients could remove the signal, an attack the paper does not test.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper presents GuardSplat, a watermarking framework for 3D Gaussian Splatting (3DGS) assets. The method trains a small MLP message decoder on CLIP textual features of binary messages (5 minutes), then embeds a user-chosen message into the spherical-harmonic (SH) coefficients of a pre-trained 3DGS model by optimizing learnable SH offsets (10 minutes), while freezing all other Gaussian attributes. Extraction is performed by feeding rendered views through CLIP's visual encoder and the same decoder, with a differentiable distortion layer used during training to improve robustness. Experiments on Blender and LLFF report bit accuracies above 98% for up to 48-bit messages with high PSNR, robustness to various distortions, and a large efficiency gain over prior NeRF/3DGS watermarking methods.

Significance. If the claims hold, GuardSplat would be a practical and efficient tool for protecting 3DGS assets, with a lightweight decoder, fast per-asset watermarking, and the ability to embed messages without altering the underlying 3D structure. The paper provides a useful comparison against several recent baselines, includes ablations and security analyses, and releases code, which strengthens reproducibility. However, the central capacity claim—that arbitrary L-bit messages can be embedded and extracted with over 98% bit accuracy—currently rests on an ambiguous decoder training/test protocol that may allow evaluation on the decoder's training messages, and on a sign error in the offset loss equation. These issues must be resolved before the practical significance of the method can be assessed.

major comments (4)
  1. [Section 5, Implementation Details; Tables 1 and 2] The evaluation protocol for the message decoder is ambiguous and potentially circular. The text states: 'Given the message length NL, we randomly select min(2^NL, NK) samples from a total of 2^NL messages as training and test data, where NK=2048.' This does not specify whether the selected samples are split into disjoint training and test sets, or whether the same pool is used for both. More importantly, the paper never states how the messages used in the watermarking evaluations of Tables 1 and 2 are chosen. If those messages are drawn from the decoder's 2048-message training pool, the reported bit accuracy measures memorization of the exact text features seen during decoder training, not the ability to embed and extract arbitrary user messages. This is load-bearing because the abstract and Section 4.1 claim a general-purpose decoder that can handle arbitrary messages. Please clarify the exact train/test split and, crucially, report bit accuracy for messages that are disjoint from the decoder's training set, for each message length.
  2. [Section 4.2, Eq. (8)] The offset loss in Eq. (8) is written as L_off = - (1/N) sum_i ||h^o_i||^2_2. Since the optimization in Eq. (10) minimizes the total loss, this negative sign encourages the SH offsets to grow in magnitude, which is the opposite of the stated purpose of 'constrain[ing] its magnitude' to preserve fidelity. The ablation in Table 4 shows that adding L_off improves PSNR, which is only consistent with a positive L2 penalty. The equation should be corrected to L_off = + (1/N) sum_i ||h^o_i||^2_2 (or an equivalent formulation), and the authors should confirm that the reported experiments used the corrected sign.
  3. [Section 4.1 and Section 4.3 (generalization of the decoder)] The decoder is trained exclusively on CLIP textual features of a subset of messages, then applied to CLIP visual features of rendered watermarked views. The load-bearing premise is that this decoder will extract messages that were never in its training set. The paper provides no such held-out evaluation. Because of the ambiguity identified above, all reported bit accuracies may be on training messages. Please add an experiment where the message embedded into the 3DGS asset is sampled from the complement of the decoder training pool (e.g., from the remaining 2^NL - 2048 messages for NL=16, and from a fresh random sample for NL=32 and 48), and report the resulting bit accuracy. Without this, the 'general-purpose decoder' claim and the associated efficiency comparison are not supported.
  4. [Section 4.1, Eq. (6)] In Eq. (6), the extracted message is written as \hat{M} = D_M(E_V(T)), but the preceding sentence says the tokens T are fed into the CLIP textual encoder E_T. The subscript V appears to be a typo for T. Please correct this to E_T(T) to avoid confusion about which CLIP encoder is used for decoder training.
minor comments (5)
  1. [Section 5, Evaluation Metrics] The term 'Brightness Jittoring' appears to be a typo for 'Brightness Jittering'.
  2. [Table 1 caption] The caption says 'Comparisons of the start-of-the-art methods'; this should read 'state-of-the-art'.
  3. [Table 3 and Section 5.2] The labels 'Offestall' and 'Offestrest' contain misspellings of 'Offset'; please correct them for clarity.
  4. [Section 5, Implementation Details] The paper does not explicitly state whether a separate decoder is trained for each message length NL or whether one decoder handles all lengths; please clarify, since the architecture in Supp. Fig. S1 has an output layer that appears length-dependent.
  5. [Section 5, Implementation Details] The phrase 'as training and test data' should be clarified to specify the exact split ratio and whether the same views/messages are reused across evaluation; this is related to the major comment about protocol ambiguity.

Circularity Check

1 steps flagged · score 4.0 of 10

Capacity claim partly reduces to the decoder's training message pool: the paper's train/test message ambiguity and use of the same decoder as optimization objective leave arbitrary-message generalization unestablished.

  1. fitted input called prediction [Section 5, Implementation Details (decoder training); Eq. (10); Section 5.1, Table 1]
    "Given the message length NL, we randomly select min(2NL , NK) samples from a total of 2NL messages as training and test data, where NK=2048. ... We freeze the message decoder and utilize it to extract the message from the rendered views, and the secret message can be embedded into 3DGS models by minimizing the following loss: L = λrecon(Lrgb + Llpips) + λmsgLmsg + λoffLoff."

    The decoder D_M is fit on CLIP text embeddings of at most 2048 sampled messages, and the same sentence labels these samples as both training and test data. No held-out message set is specified for the watermarking evaluations in Table 1, so for NL=48 the reported 98.29% bit accuracy can be read as measured on messages whose text embeddings were in D_M's training pool; a 3-layer MLP can memorize 2048 text-to-message mappings, making the capacity result in-sample rather than a prediction for arbitrary 2^48 messages. Eq. (10) further uses the same frozen D_M as the gradient source for the SH offsets and as the evaluator of extraction accuracy, so the reported accuracy is the optimized objective, not an independent verification of CLIP text-to-visual transfer.

full rationale

Apart from this evaluation-protocol issue, the derivation chain is self-contained: the decoder is trained on CLIP textual features (Eqs. 5-7), the SH offsets are fitted with a frozen decoder (Eq. 10), and extraction uses the same decoder on CLIP visual features (Eq. 9). This is a standard optimize-then-evaluate watermarking loop and does not import a uniqueness theorem or load-bearing self-citation; references to the authors' prior work ([7], [67]) are background only. The central risk is not that the math is definitionally circular, but that the reported capacity numbers may be computed on the decoder's own training messages, so the generalization to arbitrary secret messages - the load-bearing premise of Sections 4.1 and 4.3 - is not demonstrated. That warrants a moderate circularity score rather than a clean bill.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

No new physical entities or forces are introduced. The method relies on a pre-trained CLIP model, standard 3DGS, and learned SH offsets. The main free parameters are the loss weights and the decoder training sample cap, all chosen by hand or sensitivity analysis. The key domain assumptions concern CLIP transfer, SH offset visual impact, and distortion representativeness.

free parameters (4)
  • lambda_recon = 1
    Chosen via sensitivity analysis in Fig. 7 to balance reconstruction quality.
  • lambda_msg = 0.03
    Chosen via sensitivity analysis to balance message accuracy.
  • lambda_off = 10
    Described as a watershed in Fig. 7; controls SH offset magnitude.
  • number of training messages NK = 2048
    Cap on message samples used for decoder training.
assumptions (4)
  • domain assumption CLIP text and image feature spaces are sufficiently aligned that a decoder trained on text features can decode visual features of watermarked images.
    This is the key transfer assumption in Sec. 4.1 and 4.3; if false the method fails.
  • domain assumption Adding offsets to SH coefficients preserves 3D structure and allows invisible watermarking.
    Motivates the SH-aware embedding in Sec. 4.2; relies on SH being view-dependent and less visually critical.
  • domain assumption The differentiable distortion layer during training is representative of test distortions.
    Used for anti-distortion training; if test distortions differ, robustness may drop.
  • standard math Standard 3DGS rendering is differentiable and can propagate gradients to SH offsets.
    Foundation of the optimization; based on Kerbl et al. [19].

how reviews work

0 comments
Cite this review

Pith. "Pith review of GuardSplat: Efficient and Robust Watermarking for 3D Gaussian Splatting." pith.science (2026). https://pith.science/paper/TEAO2DTO

@misc{pith2026241119895,
  author       = {Pith},
  title        = {Pith review of: GuardSplat: Efficient and Robust Watermarking for 3D Gaussian Splatting},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/TEAO2DTO}},
  note         = {Machine review of arXiv:2411.19895}
}
read the original abstract

3D Gaussian Splatting (3DGS) has recently created impressive 3D assets for various applications. However, considering security, capacity, invisibility, and training efficiency, the copyright of 3DGS assets is not well protected as existing watermarking methods are unsuited for its rendering pipeline. In this paper, we propose GuardSplat, an innovative and efficient framework for watermarking 3DGS assets. Specifically, 1) We propose a CLIP-guided pipeline for optimizing the message decoder with minimal costs. The key objective is to achieve high-accuracy extraction by leveraging CLIP's aligning capability and rich representations, demonstrating exceptional capacity and efficiency. 2) We tailor a Spherical-Harmonic-aware (SH-aware) Message Embedding module for 3DGS, seamlessly embedding messages into the SH features of each 3D Gaussian while preserving the original 3D structure. This enables watermarking 3DGS assets with minimal fidelity trade-offs and prevents malicious users from removing the watermarks from the model files, meeting the demands for invisibility and security. 3) We present an Anti-distortion Message Extraction module to improve robustness against various distortions. Experiments demonstrate that GuardSplat outperforms state-of-the-art and achieves fast optimization speed. Project page is at https://narcissusex.github.io/GuardSplat, and Code is at https://github.com/NarcissusEx/GuardSplat.

Figures

Figures reproduced from arXiv: 2411.19895 by the authors.

Figure 1
Figure 1. Application scenarios of GuardSplat. To protect the copyright of 3D Gaussian Splatting (3DGS) [19] assets, (a) the owners (Alice) can use our GuardSplat to embed the secret message (blue key) into these models. (b) If malicious users (Bob) render views for unauthorized uses, (c) Alice can use the private message decoder to extract messages (purple key) for copyright identification. Abstract 3D Gaussian Splatting (3D… view at source ↗
Figure 2
Figure 2. Comparisons of four 3D watermarking frameworks. They differ in how to embed messages and train message decoders. (a) Directly training 3D models on the watermarked images. (b) Simultaneously training a 3D model and a message decoder. (c) Employing the message decoder from a 2D watermarker for optimization. (d) GuardSplat first trains a message decoder to extract messages from CLIP [41] textual features. This message… view at source ↗
Figure 3
Figure 3. Performance of state-of-the-art methods with NL = 32 bits on Blender [32] and LLFF [31] datasets. The radius of circles is proportional to their total training time (decoder opti￾mization + watermarking) evaluated on RTX 3090 GPU. 2. Related Works 3D Representations. Neural radiance field (NeRF) [32] is a compelling solution for 3D representations, which is based on the standard volumetric rendering [18] and alpha c… view at source ↗
Figures from the paper (4 more)
Figure 4
Figure 4. Figure 4: Overview of GuardSplat. (a) Given a binary message M ∈ {0, 1} L i=1, we first transform it into CLIP tokens T using the proposed message tokenization. We then employ CLIP’s textual encoder ET to map T to the textual feature FT . Finally, we feed FT into message decoder…
Figure 5
Figure 5. Figure 5: ROC curves produced by varying thresholds in StegEx￾pose [6] on different methods. The closer the curve is to the “Ref￾erence”, the more effective the method is regarding security. 4.3. Anti-distortion Message Extraction Given CLIP’s visual encoder EV and the message d…
Figure 6
Figure 6. Figure 6: Visual comparisons with NL = 32 bits. Heatmaps show the differences (×10) between the watermarked and original views. mization. In the test, the rendered views are distorted using the visual distortions built by OpenCV for evaluation. Evaluation Metrics. We follow the …
Figure 7
Figure 7. Figure 7: Performance across different hyper-parameter values with NL = 32 bits on the Blender [32] and LLFF [31] datasets [PITH_FULL_IMAGE:figures/full_fig_p008_7.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

72 extracted references · 59 canonical work pages

  1. [1]

    Hidden in the noise: Two- stage robust watermarking for images

    Kasra Arabi, Benjamin Feuer, R Teal Witter, Chinmay Hegde, and Niv Cohen. Hidden in the noise: Two- stage robust watermarking for images. arXiv preprint arXiv:2412.04653, 2024. 3

    arXiv 2024

  2. [2]

    Neural rgb-d surface reconstruction

    Dejan Azinovi ´c, Ricardo Martin-Brualla, Dan B Goldman, Matthias Nießner, and Justus Thies. Neural rgb-d surface reconstruction. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 6290–6301, 2022. 3

    work page 2022

  3. [3]

    Improved wavelet-based watermarking through pixel-wise masking

    Mauro Barni, Franco Bartolini, and Alessandro Piva. Improved wavelet-based watermarking through pixel-wise masking. IEEE Transactions on Image Processing (IEEE TIP), 10(5):783–791, 2001. 3

    work page 2001

  4. [4]

    Mip-nerf: A multiscale representation for anti-aliasing neu- ral radiance fields

    Jonathan T Barron, Ben Mildenhall, Matthew Tancik, Peter Hedman, Ricardo Martin-Brualla, and Pratul P Srinivasan. Mip-nerf: A multiscale representation for anti-aliasing neu- ral radiance fields. In Proceedings of the International Conference on Computer Vision (ICCV), pages 5855–5864,

    work page

  5. [5]

    Mip-nerf 360: Unbounded anti-aliased neural radiance fields

    Jonathan T Barron, Ben Mildenhall, Dor Verbin, Pratul P Srinivasan, and Peter Hedman. Mip-nerf 360: Unbounded anti-aliased neural radiance fields. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 5470–5479, 2022. 3

    work page 2022

  6. [6]

    Stegexpose-a tool for detecting lsb steganography

    Benedikt Boehm. Stegexpose-a tool for detecting lsb steganography. arXiv preprint arXiv:1410.6656 , 2014. 5, 7

    arXiv 2014

  7. [7]

    Cunerf: Cube-based neural radiance field for zero-shot medical image arbitrary-scale super resolution

    Zixuan Chen, Lingxiao Yang, Jian-Huang Lai, and Xiaohua Xie. Cunerf: Cube-based neural radiance field for zero-shot medical image arbitrary-scale super resolution. In Proceed- ings of the International Conference on Computer Vision (ICCV), pages 21185–21195, 2023. 3

    work page 2023

  8. [8]

    Depth-supervised nerf: Fewer views and faster train- ing for free

    Kangle Deng, Andrew Liu, Jun-Yan Zhu, and Deva Ra- manan. Depth-supervised nerf: Fewer views and faster train- ing for free. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 12882–12891, 2022. 3

    work page 2022

Show all 72 references
  1. [9]

    Watermarking images in self-supervised latent spaces

    Pierre Fernandez, Alexandre Sablayrolles, Teddy Furon, Herv´e J´egou, and Matthijs Douze. Watermarking images in self-supervised latent spaces. In ICASSP 2022-2022 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 3054–3058. IEEE, 2022. 3, 6, 7

    2022

  2. [10]

    The stable signature: Rooting watermarks in latent diffusion models

    Pierre Fernandez, Guillaume Couairon, Herv ´e J ´egou, Matthijs Douze, and Teddy Furon. The stable signature: Rooting watermarks in latent diffusion models. In Proceed- ings of the IEEE/CVF International Conference on Com- puter Vision, pages 22466–22477, 2023. 3

    2023

  3. [11]

    Sugar: Surface- aligned gaussian splatting for efficient 3d mesh reconstruc- tion and high-quality mesh rendering

    Antoine Gu ´edon and Vincent Lepetit. Sugar: Surface- aligned gaussian splatting for efficient 3d mesh reconstruc- tion and high-quality mesh rendering. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 5354–5363, 2024. 1

    2024

  4. [12]

    Denoising dif- fusion probabilistic models

    Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising dif- fusion probabilistic models. In Proceedings of the Inter- national Conference on Neural Information Processing Sys- tems (NeurIPS), pages 6840–6851, 2020. 3

    2020

  5. [13]

    Gaussianmarker: Uncertainty-aware copyright protection of 3d gaussian splat- ting

    Xiufeng Huang, Ruiqi Li, Yiu-ming Cheung, Ka Chun Cheung, Simon See, and Renjie Wan. Gaussianmarker: Uncertainty-aware copyright protection of 3d gaussian splat- ting. In Proceedings of the International Conference on Neural Information Processing Systems (NeurIPS) , pages 330...

    2024

  6. [14]

    Waterf: Robust water- marks in radiance fields for protection of copyrights

    Youngdong Jang, Dong In Lee, MinHyuk Jang, Jong Wook Kim, Feng Yang, and Sangpil Kim. Waterf: Robust water- marks in radiance fields for protection of copyrights. In Pro- ceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 12087–12097, ...

    2024

  7. [15]

    3d-gsw: 3d gaussian splatting watermark for protecting copyrights in radiance fields.arXiv preprint arXiv:2409.13222, 2024

    Youngdong Jang, Hyunje Park, Feng Yang, Heeju Ko, Eui- jin Choo, and Sangpil Kim. 3d-gsw: 3d gaussian splatting watermark for protecting copyrights in radiance fields.arXiv preprint arXiv:2409.13222, 2024. 2, 3

    2024 arXiv

  8. [16]

    Tensoir: Tensorial inverse rendering

    Haian Jin, Isabella Liu, Peijia Xu, Xiaoshuai Zhang, Song- fang Han, Sai Bi, Xiaowei Zhou, Zexiang Xu, and Hao Su. Tensoir: Tensorial inverse rendering. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 165–174, 2023. 2

    2023

  9. [17]

    Investi- gating loss functions for extreme super-resolution

    Younghyun Jo, Sejong Yang, and Seon Joo Kim. Investi- gating loss functions for extreme super-resolution. In Pro- ceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshop (CVPR Workshop), pages 424–425, 2020. 6

    2020

  10. [18]

    Ray tracing volume densities

    James T Kajiya and Brian P V on Herzen. Ray tracing volume densities. In ACM SIGGRAPH, pages 165–174. ACM New York, NY , USA, 1984. 3

    1984

  11. [19]

    3d gaussian splatting for real-time radiance field rendering

    Bernhard Kerbl, Georgios Kopanas, Thomas Leimk ¨uhler, and George Drettakis. 3d gaussian splatting for real-time radiance field rendering. ACM Transactions on Graphics (ACM TOG), 42(4):1–14, 2023. 1, 3, 4, 5, 6, 7

    2023

  12. [20]

    Adam: A method for stochastic optimization

    Diederik P Kingma and Jimmy Ba. Adam: A method for stochastic optimization. arXiv preprint arXiv:1412.6980 ,

    arXiv

  13. [21]

    Segment any- thing

    Alexander Kirillov, Eric Mintun, Nikhila Ravi, Hanzi Mao, Chloe Rolland, Laura Gustafson, Tete Xiao, Spencer White- head, Alexander C Berg, Wan-Yen Lo, et al. Segment any- thing. In Proceedings of the International Conference on Computer Vision (ICCV), pages 4015–4026, 2023. 2

    2023

  14. [22]

    Point-based neural rendering with per- view optimization

    Georgios Kopanas, Julien Philip, Thomas Leimk ¨uhler, and George Drettakis. Point-based neural rendering with per- view optimization. Computer Graphics Forum (CGF) , 40 (4), 2021. 3

    2021

  15. [23]

    Dig- ital signature of color images using amplitude modulation

    Martin Kutter, Frederic D Jordan, and Frank Bossen. Dig- ital signature of color images using amplitude modulation. In Storage and Retrieval for Image and Video Databases V , pages 518–526. SPIE, 1997. 3

    1997

  16. [24]

    Luciddreamer: Towards high- fidelity text-to-3d generation via interval score matching

    Yixun Liang, Xin Yang, Jiantao Lin, Haodong Li, Xiaogang Xu, and Yingcong Chen. Luciddreamer: Towards high- fidelity text-to-3d generation via interval score matching. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) , pages 6517–6526,

  17. [25]

    Grounding dino: Marrying dino with grounded pre-training for open-set object detection

    Shilong Liu, Zhaoyang Zeng, Tianhe Ren, Feng Li, Hao Zhang, Jie Yang, Qing Jiang, Chunyuan Li, Jianwei Yang, Hang Su, et al. Grounding dino: Marrying dino with grounded pre-training for open-set object detection. In Pro- ceedings of the European Conference on Computer Vision (...

    2024

  18. [26]

    Distortion agnostic deep watermarking

    Xiyang Luo, Ruohan Zhan, Huiwen Chang, Feng Yang, and Peyman Milanfar. Distortion agnostic deep watermarking. In Proceedings of the IEEE/CVF Conference on Computer Vi- sion and Pattern Recognition (CVPR), pages 13548–13557,

  19. [27]

    Dvmark: a deep multiscale frame- work for video watermarking

    Xiyang Luo, Yinxiao Li, Huiwen Chang, Ce Liu, Peyman Milanfar, and Feng Yang. Dvmark: a deep multiscale frame- work for video watermarking. IEEE Transactions on Image Processing (IEEE TIP), 2023. 3

    2023

  20. [28]

    Copyrnerf: Protecting the copyright of neural radiance fields

    Ziyuan Luo, Qing Guo, Ka Chun Cheung, Simon See, and Renjie Wan. Copyrnerf: Protecting the copyright of neural radiance fields. In Proceedings of the International Confer- ence on Computer Vision (ICCV), pages 22401–22411, 2023. 2, 3, 4, 6, 7

    2023

  21. [29]

    Towards blind watermarking: Com- bining invertible and non-invertible mechanisms

    Rui Ma, Mengxi Guo, Yi Hou, Fan Yang, Yuan Li, Huizhu Jia, and Xiaodong Xie. Towards blind watermarking: Com- bining invertible and non-invertible mechanisms. In Pro- ceedings of the ACM International Conference on Multime- dia (ACMMM), pages 1532–1542, 2022. 3, 6, 7

    2022

  22. [30]

    Gaussian splatting slam

    Hidenobu Matsuki, Riku Murai, Paul HJ Kelly, and An- drew J Davison. Gaussian splatting slam. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pat- tern Recognition (CVPR), pages 18039–18048, 2024. 3

    2024

  23. [31]

    Local light field fusion: Practical view syn- thesis with prescriptive sampling guidelines

    Ben Mildenhall, Pratul P Srinivasan, Rodrigo Ortiz-Cayon, Nima Khademi Kalantari, Ravi Ramamoorthi, Ren Ng, and Abhishek Kar. Local light field fusion: Practical view syn- thesis with prescriptive sampling guidelines. ACM Transac- tions on Graphics (ACM TOG), 38(4):1–14, 2019....

    2019

  24. [32]

    Nerf: Representing scenes as neural radiance fields for view syn- thesis

    Ben Mildenhall, Pratul P Srinivasan, Matthew Tancik, Jonathan T Barron, Ravi Ramamoorthi, and Ren Ng. Nerf: Representing scenes as neural radiance fields for view syn- thesis. Communications of the ACM, 65(1):99–106, 2021. 2, 3, 5, 6, 7, 8, 1

    2021

  25. [33]

    Instant neural graphics primitives with a mul- tiresolution hash encoding

    Thomas M ¨uller, Alex Evans, Christoph Schied, and Alexan- der Keller. Instant neural graphics primitives with a mul- tiresolution hash encoding. ACM Transactions on Graphics (ACM TOG), 41(4):1–15, 2022. 3

    2022

  26. [34]

    Dwt-dct-svd based watermark- ing

    KA Navas, Mathews Cheriyan Ajay, M Lekshmi, Tampy S Archana, and M Sasikumar. Dwt-dct-svd based watermark- ing. In 2008 3rd international conference on communication systems software and middleware and workshops (COM- SWARE’08), pages 271–274. IEEE, 2008. 3, 6

    2008

  27. [35]

    Giraffe: Repre- senting scenes as compositional generative neural feature fields

    Michael Niemeyer and Andreas Geiger. Giraffe: Repre- senting scenes as compositional generative neural feature fields. In Proceedings of the IEEE/CVF Conference on Com- puter Vision and Pattern Recognition (CVPR), pages 11453– 11464, 2021. 3

    2021

  28. [36]

    A frequency-domain approach to watermarking 3d shapes

    Ryutarou Ohbuchi, Akio Mukaiyama, and Shigeo Takahashi. A frequency-domain approach to watermarking 3d shapes. Computer Graphics Forum (CGF), 21(3):373–382, 2002. 3

    2002

  29. [37]

    Automatic differentiation in pytorch

    Adam Paszke, Sam Gross, Soumith Chintala, Gregory Chanan, Edward Yang, Zachary DeVito, Zeming Lin, Al- ban Desmaison, Luca Antiga, and Adam Lerer. Automatic differentiation in pytorch. In Proceedings of the Interna- tional Conference on Neural Information Processing Sys- tems ...

    2017

  30. [38]

    Dreamfusion: Text-to-3d using 2d diffusion

    Ben Poole, Ajay Jain, Jonathan T Barron, and Ben Milden- hall. Dreamfusion: Text-to-3d using 2d diffusion. In Pro- ceedings of the International Conference on Learning Rep- resentations (ICLR), pages 1–10, 2022. 3

    2022

  31. [39]

    Compositing digital im- ages

    Thomas Porter and Tom Duff. Compositing digital im- ages. In Proceedings of the Annual Conference on Computer Graphics and Interactive Techniques, pages 253–259, 1984. 3

    1984

  32. [40]

    Robust mesh watermarking

    Emil Praun, Hugues Hoppe, and Adam Finkelstein. Robust mesh watermarking. In Proceedings of the 26th annual con- ference on Computer graphics and interactive techniques , pages 49–56, 1999. 3

    1999

  33. [41]

    Learn- ing transferable visual models from natural language super- vision

    Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learn- ing transferable visual models from natural language super- vision. In Proceedings of the International Conference ...

    2021

  34. [42]

    Discrete wavelet transform based multiple watermarking scheme

    MS Raval and PP Rege. Discrete wavelet transform based multiple watermarking scheme. In TENCON 2003. Con- ference on Convergent Technologies for Asia-Pacific Region, pages 935–938. IEEE, 2003. 3

    2003

  35. [43]

    Differentiable jpeg: The devil is in the details

    Christoph Reich, Biplob Debnath, Deep Patel, and Srimat Chakradhar. Differentiable jpeg: The devil is in the details. In Proceedings of the IEEE/CVF Winter Conference on Ap- plications of Computer Vision (WACV) , pages 4126–4135,

  36. [44]

    High-resolution image synthesis with latent diffusion models

    Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bj ¨orn Ommer. High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 10684–10695, 2022. 3

    2022

  37. [45]

    Photorealistic text-to-image diffusion models with deep language understanding

    Chitwan Saharia, William Chan, Saurabh Saxena, Lala Li, Jay Whang, Emily L Denton, Kamyar Ghasemipour, Raphael Gontijo Lopes, Burcu Karagol Ayan, Tim Salimans, et al. Photorealistic text-to-image diffusion models with deep language understanding. In Proceedings of the Inter- n...

    2022

  38. [46]

    Graf: Generative radiance fields for 3d-aware image synthesis

    Katja Schwarz, Yiyi Liao, Michael Niemeyer, and Andreas Geiger. Graf: Generative radiance fields for 3d-aware image synthesis. In Proceedings of the International Conference on Neural Information Processing Systems (NeurIPS), pages 20154–20166. Curran Associates, Inc., 2020. 3

    2020

  39. [47]

    Splattingavatar: Realistic real-time human avatars with mesh-embedded gaussian splatting

    Zhijing Shao, Zhaolong Wang, Zhuang Li, Duotun Wang, Xiangru Lin, Yu Zhang, Mingming Fan, and Zeyu Wang. Splattingavatar: Realistic real-time human avatars with mesh-embedded gaussian splatting. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recogniti...

    2024

  40. [48]

    Denois- ing diffusion implicit models

    Jiaming Song, Chenlin Meng, and Stefano Ermon. Denois- ing diffusion implicit models. In Proceedings of the Inter- national Conference on Learning Representations (ICLR) , pages 1–9, 2020. 3

    2020

  41. [49]

    Protecting nerfs’ copyright via plug-and-play watermarking base model

    Qi Song, Ziyuan Luo, Ka Chun Cheung, Simon See, and Renjie Wan. Protecting nerfs’ copyright via plug-and-play watermarking base model. In Proceedings of the Euro- pean Conference on Computer Vision (ECCV), pages 57–73. Springer, 2024. 2, 3

    2024

  42. [50]

    Geometry cloak: Preventing tgs-based 3d re- construction from copyrighted images

    Qi Song, Ziyuan Luo, Ka Chun Cheung, Simon See, and Renjie Wan. Geometry cloak: Preventing tgs-based 3d re- construction from copyrighted images. In Proceedings of the International Conference on Neural Information Processing Systems (NeurIPS), pages 119361–119385, 2024. 3

    2024

  43. [51]

    Splatter image: Ultra-fast single-view 3d recon- struction

    Stanislaw Szymanowicz, Chrisitian Rupprecht, and Andrea Vedaldi. Splatter image: Ultra-fast single-view 3d recon- struction. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) , pages 10208–10217, 2024. 1, 3

    2024

  44. [52]

    Stegastamp: Invisible hyperlinks in physical photographs

    Matthew Tancik, Ben Mildenhall, and Ren Ng. Stegastamp: Invisible hyperlinks in physical photographs. InProceedings of the IEEE/CVF Conference on Computer Vision and Pat- tern Recognition (CVPR), pages 2117–2126, 2020. 3, 6, 7

    2020

  45. [53]

    A robust multiple watermarking scheme in the discrete wavelet transform do- main

    Peining Tao and Ahmet M Eskicioglu. A robust multiple watermarking scheme in the discrete wavelet transform do- main. In Internet Multimedia Management Systems V, pages 133–144. SPIE, 2004. 3

    2004

  46. [54]

    Ref-nerf: Struc- tured view-dependent appearance for neural radiance fields

    Dor Verbin, Peter Hedman, Ben Mildenhall, Todd Zickler, Jonathan T Barron, and Pratul P Srinivasan. Ref-nerf: Struc- tured view-dependent appearance for neural radiance fields. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) , pages ...

    2022

  47. [55]

    Sparsenerf: Distilling depth ranking for few-shot novel view synthesis

    Guangcong Wang, Zhaoxi Chen, Chen Change Loy, and Zi- wei Liu. Sparsenerf: Distilling depth ranking for few-shot novel view synthesis. In Proceedings of the International Conference on Computer Vision (ICCV), pages 9065–9076,

  48. [56]

    Image quality assessment: from error visibility to structural similarity

    Zhou Wang, Alan C Bovik, Hamid R Sheikh, and Eero P Si- moncelli. Image quality assessment: from error visibility to structural similarity. IEEE Transactions on Image Process- ing (IEEE TIP), 13(4):600–612, 2004. 7

    2004

  49. [57]

    Prolificdreamer: High-fidelity and diverse text-to-3d generation with variational score distilla- tion

    Zhengyi Wang, Cheng Lu, Yikai Wang, Fan Bao, Chongxuan Li, Hang Su, and Jun Zhu. Prolificdreamer: High-fidelity and diverse text-to-3d generation with variational score distilla- tion. In Proceedings of the International Conference on Neu- ral Information Processing Systems (N...

    2023

  50. [58]

    Tree-rings watermarks: Invisible fingerprints for diffusion images

    Yuxin Wen, John Kirchenbauer, Jonas Geiping, and Tom Goldstein. Tree-rings watermarks: Invisible fingerprints for diffusion images. In Proceedings of the Interna- tional Conference on Neural Information Processing Sys- tems (NeurIPS), pages 58047–58063, 2023. 3

    2023

  51. [59]

    Gs-slam: Dense visual slam with 3d gaussian splatting

    Chi Yan, Delin Qu, Dan Xu, Bin Zhao, Zhigang Wang, Dong Wang, and Xuelong Li. Gs-slam: Dense visual slam with 3d gaussian splatting. In Proceedings of the IEEE/CVF Confer- ence on Computer Vision and Pattern Recognition (CVPR) , pages 19595–19604, 2024. 1, 3

    2024

  52. [60]

    Deep 3d-to-2d water- marking: Embedding messages in 3d meshes and extracting them from 2d renderings

    Innfarn Yoo, Huiwen Chang, Xiyang Luo, Ondrej Stava, Ce Liu, Peyman Milanfar, and Feng Yang. Deep 3d-to-2d water- marking: Embedding messages in 3d meshes and extracting them from 2d renderings. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recogniti...

    2022

  53. [61]

    pixelnerf: Neural radiance fields from one or few images

    Alex Yu, Vickie Ye, Matthew Tancik, and Angjoo Kanazawa. pixelnerf: Neural radiance fields from one or few images. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) , pages 4578–4587,

  54. [62]

    Mip-splatting: Alias-free 3d gaussian splat- ting

    Zehao Yu, Anpei Chen, Binbin Huang, Torsten Sattler, and Andreas Geiger. Mip-splatting: Alias-free 3d gaussian splat- ting. In Proceedings of the IEEE/CVF Conference on Com- puter Vision and Pattern Recognition (CVPR), pages 19447– 19456, 2024. 1, 3

    2024

  55. [63]

    Gavatar: Animatable 3d gaussian avatars with implicit mesh learning

    Ye Yuan, Xueting Li, Yangyi Huang, Shalini De Mello, Koki Nagano, Jan Kautz, and Umar Iqbal. Gavatar: Animatable 3d gaussian avatars with implicit mesh learning. InProceed- ings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 896–905, 2024. 1, 3

    2024

  56. [64]

    Udh: Universal deep hiding for steganogra- phy, watermarking, and light field messaging

    Chaoning Zhang, Philipp Benz, Adil Karjauv, Geng Sun, and In So Kweon. Udh: Universal deep hiding for steganogra- phy, watermarking, and light field messaging. In Proceed- ings of the International Conference on Neural Information Processing Systems (NeurIPS), pages 10223–1023...

    2020

  57. [65]

    The unreasonable effectiveness of deep features as a perceptual metric

    Richard Zhang, Phillip Isola, Alexei A Efros, Eli Shecht- man, and Oliver Wang. The unreasonable effectiveness of deep features as a perceptual metric. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 586–595, 2018. 7

    2018

  58. [66]

    Gs-hider: Hiding messages into 3d gaussian splatting

    Xuanyu Zhang, Jiarui Meng, Runyi Li, Zhipei Xu, Jian Zhang, et al. Gs-hider: Hiding messages into 3d gaussian splatting. In Proceedings of the International Conference on Neural Information Processing Systems (NeurIPS), pages 49780–49805, 2024. 2, 3

    2024

  59. [67]

    Adaptive 3d mesh steganography based on feature-preserving distortion

    Yushu Zhang, Jiahao Zhu, Mingfu Xue, Xinpeng Zhang, and Xiaochun Cao. Adaptive 3d mesh steganography based on feature-preserving distortion. IEEE Transactions on Vision Computer Graphics (IEEE TVCG), 30(8):5299–5312, 2024. 3

    2024

  60. [68]

    Invisible image watermarks are provably removable using generative ai

    Xuandong Zhao, Kexun Zhang, Zihao Su, Saastha Vasan, Ilya Grishchenko, Christopher Kruegel, Giovanni Vigna, Yu- Xiang Wang, and Lei Li. Invisible image watermarks are provably removable using generative ai. In Proceedings of the International Conference on Neural Information P...

    2024

  61. [69]

    Hidden: Hiding data with deep networks

    Jiren Zhu, Russell Kaplan, Justin Johnson, and Li Fei-Fei. Hidden: Hiding data with deep networks. In Proceedings of the European Conference on Computer Vision (ECCV) , pages 682–697, 2018. 2, 3, 6, 7

    2018

  62. [70]

    Gaussian model for 3d mesh steganography

    Jiahao Zhu, Yushu Zhang, Xinpeng Zhang, and Xiaochun Cao. Gaussian model for 3d mesh steganography. IEEE Signal Processing Letters (IEEE SPL), 28:1729–1733, 2021. 3

    2021

  63. [71]

    Bottom K

    Zi-Xin Zou, Zhipeng Yu, Yuan-Chen Guo, Yangguang Li, Ding Liang, Yan-Pei Cao, and Song-Hai Zhang. Triplane meets gaussian splatting: Fast and generalizable single-view 3d reconstruction with transformers. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern...

    2024

  64. [72]

    and LLFF [31] datasets with NL ∈ {64, 72} bits. NL Bit Acc PSNR SSIM LPIPS 64 97.41 37.76 0.9899 0.0040 72 96.64 36.47 0.9866 0.0053 Groundtruth Only 𝓛msg 𝓛msg+𝓛recon Ours Bit Acc: 100.00% PSNR: 30.10 SSIM: 0.9597 Bit Acc: 99.68% PSNR: 37.86 SSIM: 0.9859 Bit Acc: 99.63% PSNR: ...

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.