💻 computer science

NGS-Marker: Robust Native Watermarking for 3D Gaussian Splatting

This paper introduces NGS-Marker, a novel native watermarking framework for 3D Gaussian Splatting that utilizes a gradient-based progressive injection strategy and hybrid protection mechanisms to ensure robust ownership verification against partial infringement and enable decoding from any local scene region.

Original authors: Hao Qin, Yukai Sun, Luyuan Chen, Mengxu Lu, Feng Zhang, Ming Kong, Zhenhong Du, Qiang Zhu

Published 2026-08-19

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Hao Qin, Yukai Sun, Luyuan Chen, Mengxu Lu, Feng Zhang, Ming Kong, Zhenhong Du, Qiang Zhu

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

In the rapidly evolving world of digital creation, a new tool called 3D Gaussian Splatting has emerged as a powerful way to build realistic, three-dimensional scenes. Imagine a digital landscape not built from solid blocks or smooth surfaces, but from millions of tiny, fuzzy clouds of color and light, each floating independently in space. These clouds, known as Gaussian primitives, can be arranged to form everything from a bustling city street to a quiet forest, and they can be viewed from any angle with stunning clarity. Because these digital assets are so easy to create and share, they are becoming the backbone of virtual reality, robotics, and online content. However, this ease of use brings a significant problem: how do you protect your work when someone can simply pluck a single tree or character out of your scene and paste it into their own without permission?

For years, the standard way to protect digital images has been to hide a secret code, or watermark, inside the picture itself. This code is invisible to the human eye but can be read by a computer to prove ownership. Researchers have tried to adapt this same idea to 3D scenes, but they have been applying it to the final picture you see on your screen, rather than to the 3D clouds that make up the scene. This approach works well when the whole scene is used, but it fails completely when a thief steals just a piece of it. If an adversary takes a few hundred of those floating clouds from a protected forest and places them in a new, unauthorized scene, the old protection methods cannot find the secret code. The code was hidden in the relationship between the whole scene and the final image, and once the scene is broken apart, that relationship is lost.

A team of researchers at Zhejiang University has identified this specific vulnerability, which they call "partial infringement," and has developed a new system to solve it. They created a tool called NGS-Marker, which changes the strategy entirely. Instead of hiding a message in the final picture, they hide it directly inside the tiny, floating clouds themselves. This means that even if someone steals just a small cluster of these clouds, the secret code travels with them. The researchers built a system that can write a unique identity into any local group of these 3D clouds and then read that identity back out, no matter where those clouds end up or how the scene is rearranged.

The core of their discovery is a two-step process that works like a lock and key, but for 3D data. First, they trained a computer program to act as a writer. This program looks at a small, random selection of the floating clouds and makes tiny, almost invisible adjustments to their position and color. These adjustments are so subtle that the human eye cannot see any difference in the final picture, but they are precise enough to encode a specific message, such as a string of numbers representing the owner's name. Second, they trained a separate program to act as a reader. This reader can look at any group of clouds, even a small handful taken from a much larger scene, and decode the hidden message. Because the message is embedded directly into the properties of the clouds, it does not matter if the rest of the scene is missing or if the clouds are moved to a completely different location.

To test if this method actually works, the researchers simulated a theft scenario. They took a protected 3D scene, extracted a subset of the clouds, and inserted them into a new, unauthorized scene. When they tried to use the old, traditional methods to find the owner, the systems failed completely, guessing the correct owner only about half the time, which is no better than random chance. In contrast, the new system successfully identified the owner with over 95 percent accuracy, even when the stolen clouds were mixed with other unrelated clouds. The researchers also found that the system remains effective even when the clouds are subjected to common distortions, such as being rotated, scaled, or having some of their neighbors removed.

One of the most significant findings is that this new method does not require the 3D scene to be rendered into a flat image to be checked. In the past, you had to take a picture of the 3D world to see if it was protected. Now, the ownership check can happen directly on the 3D data itself. This allows for a much more flexible form of protection. The researchers demonstrated that the system can not only hide simple text messages but can also be adapted to hide images, allowing an owner to embed a visual logo directly into the 3D structure. Furthermore, the new system can work alongside the older methods, providing a double layer of security that protects both the 3D clouds and the final images they produce.

The researchers acknowledge that while their system is robust, it is not without limits. The process of writing the watermark into a large scene takes time, with the duration increasing as the number of clouds grows. For a scene with nearly 600,000 clouds, the process took about 35 minutes on a powerful computer. However, the time required is a one-time cost for the creator, and the resulting protection offers a level of security that was previously impossible. The study confirms that by moving the protection from the final image back to the fundamental building blocks of the 3D world, it is possible to create a system that survives the fragmentation of digital assets. This approach offers a practical path forward for creators who need to protect their work in an era where digital content can be easily copied, modified, and reassembled.

Technical Summary: NGS-Marker: Robust Native Watermarking for 3D Gaussian Splatting

1. Problem Statement

The rapid adoption of 3D Gaussian Splatting (3DGS) has revolutionized real-time, high-fidelity rendering, yet it has introduced significant vulnerabilities regarding copyright protection. Existing watermarking techniques for 3DGS primarily rely on indirect protection, where watermarks are embedded into or extracted from rendered 2D images using pre-trained decoders. This approach suffers from two critical limitations:

Visual Degradation: Embedding signals into rendered images inevitably alters the visual fidelity of the 3D content.
Vulnerability to Partial Infringement: Due to the explicit and modular nature of 3DGS (where the scene is a collection of independent Gaussian primitives), adversaries can extract and reuse subsets of primitives (e.g., specific objects or characters) to create new scenes. When the distribution of rendered images shifts significantly due to this partial reuse, existing image-based detectors fail, often dropping to random guessing accuracy (~50%).

The paper identifies Partial Infringement as a prevalent but underexplored misuse scenario where current indirect methods are ineffective.

2. Methodology: NGS-Marker

The authors propose NGS-Marker, the first framework designed for native watermarking of 3DGS. Unlike indirect methods, NGS-Marker operates directly on the Gaussian primitives without relying on rendered images as intermediaries. The framework consists of three core components:

A. Joint Training of Injector and Extractor

The system employs a perturbation-based strategy where a Watermark Injector and a Message Extractor are jointly trained.

Input: A local patch of Gaussian primitives is sampled from the scene.
Injector: Composed of a perturbation feature generator ( $P_g$ ) and a decoder ( $P_d$ ). It takes the local primitives and a message (encoded via CLIP text encoder) to predict subtle perturbations. These perturbations are added to the original primitives to create a watermarked patch.
Extractor: Mirrors the injector's architecture, using the watermarked primitives as input to decode the embedded message.
Loss Function: The training optimizes for imperceptibility (minimizing the Mean Squared Error between rendered images of original and watermarked patches) and accuracy (minimizing Binary Cross Entropy between the original and decoded message).

B. Progressive Watermark Embedding

A straightforward application of the trained injector (e.g., block-wise or iterative random injection) causes boundary inconsistencies and cumulative distortion. To address this, NGS-Marker utilizes a gradient-based progressive optimization strategy:

The trained Extractor is frozen and used as a guide.
The target 3D scene is optimized via gradient descent to ensure that any randomly sampled local region contains the correct watermark information.
This approach ensures uniform watermark distribution across the entire scene while maintaining high rendering quality, avoiding the conflicts caused by repeated direct modifications.

C. Ownership Verification

Verification is performed directly on the native 3D data. A user selects a suspicious region, inputs it into the extractor, and compares the decoded message against their private ID. The paper also proposes a visualization method where primitives are colored based on the inferred owner, allowing for intuitive localization of infringing assets.

D. Extended Capabilities

Hybrid Protection: NGS-Marker can be combined with indirect protection methods by optimizing a joint loss function, providing protection at both the native primitive level and the rendered image level.
Multimodal Watermarking: The framework is not limited to binary messages; it supports image-based watermarking by replacing the text encoder and final MLP with image-specific encoders/decoders.

3. Key Contributions

Identification of Partial Infringement: The paper highlights the failure of existing image-based watermarking methods when 3D assets are partially plagiarized, a scenario where detection accuracy drops to random chance.
Native Protection Framework: NGS-Marker is the first framework to enable fine-grained, native protection for local 3DGS primitives, allowing ownership verification directly from the 3D data without rendering.
Progressive Optimization Strategy: The authors introduce a gradient-based embedding strategy that ensures uniform watermark coverage and high rendering quality, overcoming the limitations of one-shot or iterative injection schemes.
Flexibility and Robustness: The framework supports hybrid protection (native + indirect) and multimodal inputs (text and images), demonstrating robustness against common distortions like noise, rotation, scaling, and sparsification.

4. Experimental Results

Extensive experiments were conducted on public 3D datasets (24 training scenes, 4 test scenes) simulating partial infringement scenarios.

Accuracy: In partial infringement scenarios, existing baselines (3D-GSW, GaussianMarker, GuardSplat) achieved ~50% bit accuracy (random guessing). In contrast, NGS-Marker achieved 97.94% Bit-Accuracy and 96.60% 3D-Accuracy (primitive-level classification) for 16-bit messages.
Rendering Quality: NGS-Marker significantly outperformed indirect methods in preserving visual fidelity. It achieved a PSNR of 40.17 and SSIM of 0.995, whereas indirect methods often dropped below 30 PSNR when attempting to protect against such shifts.
Robustness: The method demonstrated strong resilience against Gaussian noise, rotation, scaling, densification, dropout, and translation, maintaining >96% accuracy even under combined attacks.
Ablation: The study showed that the method remains effective even with small local regions (as few as 2,048 primitives), though convergence time increases as the sampling granularity ( $\delta$ ) decreases.

5. Significance and Claims

The paper claims that NGS-Marker addresses a critical gap in 3D content protection by shifting the paradigm from indirect (image-based) to native (primitive-based) protection. Its significance lies in:

Solving the Partial Infringement Problem: It provides a reliable mechanism to detect ownership even when only a subset of a 3D asset is reused, a scenario where current state-of-the-art methods fail completely.
Preserving Fidelity: By operating directly on primitives and using progressive optimization, it avoids the visual degradation associated with modifying rendered outputs.
Practical Deployment: The ability to integrate with existing indirect methods and support multimodal watermarks (including images) makes it adaptable for real-world, privacy-sensitive, and identity-aware copyright claims.

The authors acknowledge limitations, noting that 3D encoding/decoding techniques are less mature than their 2D counterparts and that efficient partitioning strategies for arbitrarily large scenes remain an area for future improvement. However, they assert that NGS-Marker offers a robust, flexible, and necessary solution for the evolving landscape of 3DGS copyright protection.