ML Security PapersRDSplat: Robust Watermarking Against Diffusion Editing for 3D Gaussian Splatting
Longjie Zhao 1, Ziming Hong 1, Zhenyang Ren 1, Runnan Chen 1, Mingming Gong 2,3, Tongliang Liu 1,3
Published on arXiv
2512.06774
Output Integrity Attack
OWASP ML Top 10 — ML09
Key Finding
RDSplat achieves state-of-the-art watermark robustness against diffusion-based editing (regeneration and global/local editing) that completely destroys prior 3DGS watermarks, while preserving watermark invisibility.
RDSplat
Novel technique introduced
3D Gaussian Splatting (3DGS) has enabled the creation of digital assets and downstream applications, underscoring the need for robust copyright protection via digital watermarking. However, existing 3DGS watermarking methods remain highly vulnerable to diffusion-based editing, which can easily erase embedded provenance. This challenge highlights the urgent need for 3DGS watermarking techniques that are intrinsically resilient to diffusion-based editing. In this paper, we introduce RDSplat, a Robust watermarking paradigm against Diffusion editing for 3D Gaussian Splatting. RDSplat embeds watermarks into 3DGS components that diffusion-based editing inherently preserve, achieved through (i) proactively targeting low-frequency Gaussians and (ii) adversarial training with a diffusion proxy. Specifically, we introduce a multi-domain framework that operates natively in 3DGS space and embeds watermarks into diffusion-editing-preserved low-frequency Gaussians via coordinated covariance regularization and 2D filtering. In addition, we exploit the low-pass filtering behavior of diffusion-based editing by using Gaussian blur as an efficient training surrogate, enabling adversarial fine-tuning that further enhances watermark robustness against diffusion-based editing. Empirically, comprehensive quantitative and qualitative evaluations on three benchmark datasets demonstrate that RDSplat not only maintains superior robustness under diffusion-based editing, but also preserves watermark invisibility, achieving state-of-the-art performance.
Key Contributions
- Multi-domain framework that embeds watermarks into diffusion-editing-preserved low-frequency Gaussians via covariance regularization and 2D filtering
- Adversarial fine-tuning strategy using Gaussian blur as an efficient diffusion proxy to improve robustness against diffusion-based editing attacks
- State-of-the-art watermark robustness against diffusion-based editing (regeneration, global/local editing) while maintaining imperceptibility across three benchmark datasets
🛡️ Threat Analysis
The paper watermarks 3DGS scene content to trace provenance via rendered outputs (novel 2D views); the primary adversarial threat is diffusion-based editing that removes embedded content watermarks. This is content provenance/output integrity watermarking, not ML model IP protection.