ML Security PapersCan Protective Watermarking Safeguard the Copyright of 3D Gaussian Splatting?
Wenkai Huang 1,2, Yijia Guo 3, Gaolei Li 1,2, Lei Ma 3,4, Hang Zhang 5, Liwen Hu 3, Jiazheng Wang 6, Jianhua Li 1,2, Tiejun Huang 3
1 Shanghai Jiao Tong University
2 Shanghai Key Laboratory of Integrated Administration Technologies for Information Security
Published on arXiv
2511.22262
Output Integrity Attack
OWASP ML Top 10 — ML09
Key Finding
GSPure reduces watermark PSNR by up to 16.34dB while limiting scene quality degradation to less than 1dB PSNR, consistently outperforming existing watermark removal methods on 3DGS representations.
GSPure
Novel technique introduced
3D Gaussian Splatting (3DGS) has emerged as a powerful representation for 3D scenes, widely adopted due to its exceptional efficiency and high-fidelity visual quality. Given the significant value of 3DGS assets, recent works have introduced specialized watermarking schemes to ensure copyright protection and ownership verification. However, can existing 3D Gaussian watermarking approaches genuinely guarantee robust protection of the 3D assets? In this paper, for the first time, we systematically explore and validate possible vulnerabilities of 3DGS watermarking frameworks. We demonstrate that conventional watermark removal techniques designed for 2D images do not effectively generalize to the 3DGS scenario due to the specialized rendering pipeline and unique attributes of each gaussian primitives. Motivated by this insight, we propose GSPure, the first watermark purification framework specifically for 3DGS watermarking representations. By analyzing view-dependent rendering contributions and exploiting geometrically accurate feature clustering, GSPure precisely isolates and effectively removes watermark-related Gaussian primitives while preserving scene integrity. Extensive experiments demonstrate that our GSPure achieves the best watermark purification performance, reducing watermark PSNR by up to 16.34dB while minimizing degradation to original scene fidelity with less than 1dB PSNR loss. Moreover, it consistently outperforms existing methods in both effectiveness and generalization.
Key Contributions
- First systematic vulnerability study of 3DGS watermarking frameworks, demonstrating that 2D watermark removal methods fail to generalize to the 3DGS rendering pipeline
- GSPure: a 3DGS-specific watermark purification framework exploiting view-dependent rendering contributions and geometrically accurate feature clustering to isolate and remove watermark-related Gaussian primitives
- Achieves up to 16.34dB reduction in watermark PSNR while maintaining scene fidelity degradation below 1dB PSNR, outperforming all existing baselines
🛡️ Threat Analysis
GSPure is a watermark removal/purification attack targeting content protection watermarks embedded in 3DGS neural rendering representations. 3DGS is an ML-optimized asset, and this attack defeats the output integrity/content provenance schemes protecting it — directly analogous to watermark removal attacks on AI-generated images.