ML Security PapersMarkSplatter: Generalizable Watermarking for 3D Gaussian Splatting Model via Splatter Image Structure
Xiufeng Huang , Ziyuan Luo , Qi Song , Ruofei Wang , Renjie Wan
Published on arXiv
2509.00757
Output Integrity Attack
OWASP ML Top 10 — ML09
Key Finding
First generalizable 3DGS watermarking framework achieving efficient multi-bit message embedding via single forward pass, robust to small object occupancy in rendered views.
MarkSplatter
Novel technique introduced
The growing popularity of 3D Gaussian Splatting (3DGS) has intensified the need for effective copyright protection. Current 3DGS watermarking methods rely on computationally expensive fine-tuning procedures for each predefined message. We propose the first generalizable watermarking framework that enables efficient protection of Splatter Image-based 3DGS models through a single forward pass. We introduce GaussianBridge that transforms unstructured 3D Gaussians into Splatter Image format, enabling direct neural processing for arbitrary message embedding. To ensure imperceptibility, we design a Gaussian-Uncertainty-Perceptual heatmap prediction strategy for preserving visual quality. For robust message recovery, we develop a dense segmentation-based extraction mechanism that maintains reliable extraction even when watermarked objects occupy minimal regions in rendered views. Project page: https://kevinhuangxf.github.io/marksplatter.
Key Contributions
- GaussianBridge module that converts unstructured 3D Gaussians into Splatter Image format, enabling neural message embedding in a single forward pass without per-message fine-tuning
- Gaussian-Uncertainty-Perceptual heatmap prediction strategy for imperceptibility-preserving watermark placement
- Dense segmentation-based message extraction mechanism robust to small object occupancy in rendered views
🛡️ Threat Analysis
Proposes content watermarking of 3DGS representations (3D scene assets) to protect copyright and trace provenance. The 3DGS model is a trained AI content asset, and embedding hidden messages into its Gaussian parameters to be extracted from rendered views is analogous to watermarking AI-generated images or audio — protecting content IP rather than an ML classifier's model weights. The goal is digital rights management and content provenance authentication.