💻 computer science

Deep Neural Watermarking for Robust Copyright Protection in 3D Point Clouds

This paper proposes a robust deep neural watermarking framework that embeds binary watermarks into the singular values of 3D point clouds and utilizes a PointNet++ architecture to reliably extract ownership information even under severe geometric and non-geometric attacks, significantly outperforming traditional SVD-based methods.

Original authors: Khandoker Ashik Uz Zaman, Mohammad Zahangir Alam, Mohammed N. M. Ali, Mahdi H. Miraz

Published 2026-04-07

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Khandoker Ashik Uz Zaman, Mohammad Zahangir Alam, Mohammed N. M. Ali, Mahdi H. Miraz

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you own a beautiful, intricate sculpture made of millions of tiny, floating marbles. This is a 3D point cloud—the digital format used for everything from video game characters to medical scans and virtual reality worlds.

Now, imagine you want to prove that this sculpture is yours, but you can't just slap a "Property of Me" sticker on it. If you did, someone could easily scrape the sticker off, or the sculpture could get shaken, rotated, or have some marbles knocked out, and your proof would vanish.

This is the problem the authors of this paper are solving. They created a digital "invisible tattoo" for these 3D sculptures that is incredibly hard to remove, even if the sculpture gets battered and bruised.

Here is how they did it, broken down into simple concepts:

1. The Problem: The "Shake-Off" Effect

Traditional ways of hiding secrets in digital files (like putting a secret message inside a photo) work well for flat images. But 3D point clouds are chaotic. They are just a bag of dots with no fixed order.

The Analogy: Imagine trying to hide a secret note inside a pile of sand. If you shake the pile, rotate the bucket, or scoop out half the sand, the note might get lost or buried so deep no one can find it.
The Issue: Old methods of hiding data in 3D shapes were like that note in the sand. If someone rotated the object or cropped off a piece, the "copyright proof" would disappear.

2. The Solution: A Two-Part Team

The researchers built a hybrid system that combines an old-school math trick with a modern AI brain. Think of it as a Lock and Key system, but the lock is made of math and the key is a super-smart robot.

Part A: The Lock (The "SVD" Method)

First, they needed a way to hide the watermark that wouldn't be obvious to the human eye. They used a mathematical technique called Singular Value Decomposition (SVD).

The Analogy: Imagine your sculpture is a complex musical chord. SVD breaks that chord down into its individual notes (frequencies). The researchers found the "loudest, most important notes" (the singular values) and slightly tweaked the volume of those specific notes to encode a secret binary code (like 1s and 0s).
Why it works: Because they only tweaked the "volume" of the main notes, the sculpture looks exactly the same to your eyes. It's like whispering a secret into a song; the song sounds the same, but the secret is there.

Part B: The Key (The "PointNet++" AI)

Here is the genius part. If someone attacks the sculpture (rotates it, adds noise, or chops off a chunk), the "math notes" get scrambled. An old-school calculator would fail to find the secret.

The Analogy: This is where the AI (PointNet++) comes in. Imagine a detective who has seen thousands of sculptures get beaten up, rotated, and chopped. This detective doesn't just look for the secret note; they look at the shape of the damage and the pattern of the remaining dots to figure out what the original secret was.
The Training: The AI was trained on a massive dataset (ModelNet40) where they intentionally broke, rotated, and chopped the 3D models thousands of times. It learned to say, "Even though 70% of this object is gone and it's upside down, I can still tell the secret message is 'Property of Zaman'."

3. The Showdown: Old Math vs. New AI

The researchers tested their system against a "villain" who tried to destroy the watermark using various attacks:

The Attacks: Rotating the object, adding static noise, shrinking it, or literally deleting 70% of the points (cropping).
The Result:
- The Old Way (SVD alone): When the object was just rotated or scaled, it did okay. But when the object was chopped or shuffled, it failed miserably (like trying to read a shredded letter). It got the secret right only about 58% of the time on the worst attacks.
- The New Way (AI + SVD): Even when the object was chopped and battered, the AI detective could still reconstruct the secret message with 83% accuracy.

4. Why This Matters

This isn't just about protecting art; it's about protecting the future of the internet.

Gaming & VR: Imagine a game developer creates a unique 3D character. They can watermark it so that if a hacker steals it and tries to sell it, the watermark proves who the real owner is, even if the hacker tries to modify the model.
Medical Imaging: Doctors use 3D scans of organs. If a hospital shares a scan, they need to know it hasn't been tampered with or stolen.
The Bottom Line: This paper proves that by combining classic math (to hide the secret) with modern AI (to find the secret even when it's broken), we can finally protect 3D digital content in a way that is both invisible to the eye and unbreakable by thieves.

In a nutshell: They taught a robot to find a hidden fingerprint on a 3D object, even after someone tried to sand it down, paint over it, and throw it in a blender.

1. Problem Statement

The rapid proliferation of 3D digital content (e.g., in gaming, VR, medical imaging, and autonomous vehicles) has intensified the need for robust intellectual property (IP) protection. While digital watermarking is well-established for 2D images and videos, applying it to 3D point clouds presents unique challenges:

Structural Differences: Unlike 2D images, point clouds are unordered, lack explicit connectivity (topology), and are irregular.
Vulnerability: Conventional watermarking signals embedded in point clouds are highly susceptible to geometric and non-geometric attacks, including rotation, scaling, noise addition, cropping, point shuffling, and random point removal.
Limitations of Existing Methods:
- Classical Methods: Techniques like Singular Value Decomposition (SVD) offer imperceptibility and stability against minor noise but fail under severe geometric distortions or when point ordering is disrupted.
- Pure Deep Learning: While powerful, purely neural approaches often struggle to generalize to unseen, severe attacks without leveraging the structural properties of the data during the embedding phase.

2. Methodology

The authors propose a hybrid framework that combines the mathematical stability of spectral decomposition with the adaptive extraction capabilities of deep learning.

A. Watermark Embedding (Block-SVD)

Mechanism: The 3D point cloud is partitioned into $n$ equal-sized blocks (where $n$ corresponds to the number of watermark bits; $n=2$ in this study).
Process:
1. Points are lexicographically sorted and partitioned.
2. Singular Value Decomposition (SVD) is performed on each block to extract singular values.
3. The largest singular value in each block is shifted by a scalar $\alpha$ (embedding strength, set to 2.0) based on the binary watermark bit (0 or 1).
4. The modified singular values are used to reconstruct the point cloud.
Rationale: Embedding in the singular values ensures the watermark is robust to minor noise and imperceptible to human vision, as singular values represent the global geometric structure.

B. Watermark Extraction (Deep Learning Decoder)

Architecture: The authors utilize PointNet++, a hierarchical deep neural network designed specifically for unordered point sets.
Function: Instead of relying on analytical reconstruction (which fails under severe attacks), the PointNet++ network is trained to directly predict the embedded watermark bits from the potentially attacked point cloud.
Training Strategy:
- Dataset: Princeton ModelNet40 (4,899 samples: 3,991 training, 908 testing).
- Augmentation: During training, point clouds undergo stochastic augmentations including Gaussian noise ( $\sigma=0.01$ ), random scaling, rotation, point dropout (10%), and re-normalization.
- Loss Function: Binary Cross-Entropy loss with Adam optimizer.
- Goal: To learn invariances to geometric transformations and data loss, enabling the network to "hallucinate" or recover the watermark even when the SVD-based analytical extraction would fail.

C. Evaluation Metrics

The system was evaluated using:

Bitwise Accuracy: Percentage of correctly recovered bits.
Intersection over Union (IoU): Overlap between ground truth and predicted watermarks.
Geometric Fidelity: Peak Signal-to-Noise Ratio (PSNR), Chamfer Distance (CD), and Bit Error Rate (BER).
Verification: Receiver Operating Characteristic (ROC) analysis for ownership authentication.

3. Key Contributions

Hybrid Framework: The paper introduces a novel pipeline that integrates Block-SVD for imperceptible embedding with PointNet++ for robust, learning-based extraction. This bridges the gap between classical signal processing and modern deep learning.
Robustness to Severe Attacks: The method specifically addresses the failure modes of classical SVD. While SVD struggles with point reordering and cropping, the deep learning decoder maintains high recovery rates under these conditions.
Comprehensive Benchmarking: The study evaluates the system against a wide spectrum of attacks (noise, scaling, rotation, cropping, shuffling, and compound attacks) on a standard dataset (ModelNet40), providing a rigorous baseline for future research.
Performance Validation: The authors demonstrate that while classical SVD is superior for mild attacks, the hybrid deep learning approach significantly outperforms it in scenarios involving data loss and structural disruption.

4. Experimental Results

The experiments compared the proposed PointNet++ decoder against a baseline Block-SVD decoder.

Mild Attacks (Noise, Scaling, Translation):
- The SVD baseline performed exceptionally well, achieving ~95% accuracy.
- The Deep Learning (DL) model performed slightly lower (approx. 77-78%) but remained robust.
Severe Attacks (Cropping, Shuffling, Point Dropout):
- SVD Failure: Under severe geometric distortion (e.g., 70% cropping or 10% point dropout), SVD accuracy dropped significantly (e.g., 0.58 for 70% crop).
- DL Success: The PointNet++ model maintained high accuracy under the same conditions (e.g., 0.83 for 70% crop).
- Specific Gains:
  - 70% Crop Attack: DL achieved 0.83 accuracy vs. SVD's 0.58.
  - Point Dropout (10%): DL achieved 82% accuracy vs. SVD's 57%.
  - Shuffle Attack: DL achieved 78% accuracy vs. SVD's 59%.
Geometric Fidelity:
- Under mild attacks, both methods preserved high PSNR (>21 dB) and low Chamfer Distance (~0.10).
- Under severe attacks, the DL method maintained better Bit Error Rates (BER) and PSNR compared to the SVD baseline.
Ownership Verification:
- The ROC analysis yielded an Area Under the Curve (AUC) of 0.67, indicating reasonable discriminative capability, though the authors note room for improvement via ensemble methods.

5. Significance and Future Directions

Significance: This research establishes a new standard for 3D copyright protection by proving that deep learning extraction is essential for recovering watermarks from point clouds that have undergone structural degradation. It solves the "ordering" and "topology" problem that plagues traditional mesh-based or spectral-only methods.
Applications: The framework is directly applicable to protecting assets in the Metaverse, VR/AR, autonomous vehicle mapping, and medical imaging, where 3D data is frequently edited, compressed, or partially occluded.
Future Work:
- Enhancing resilience against the most destructive attacks (e.g., chunk removal).
- Improving the ownership verification pipeline (increasing AUC) using ensemble methods or uncertainty quantification.
- Scaling to larger, more diverse datasets and optimizing computational efficiency for real-time deployment.

In conclusion, the paper successfully demonstrates that a hybrid approach—using SVD for embedding and PointNet++ for extraction—provides superior robustness for 3D point cloud copyright protection compared to either method used in isolation.