Where, What, Why: Toward Explainable 3D-GS Watermarking
Mingshu Cai 1, Jiajun Li 2, Osamu Yoshie 1, Yuya Ieiri 1, Yixuan Li 3
Published on arXiv
2603.08809
Output Integrity Attack
OWASP ML Top 10 — ML09
Key Finding
Achieves +0.83 dB PSNR improvement and +1.24% bit-accuracy gain over state-of-the-art 3D-GS watermarking methods while providing per-Gaussian explainability
SBAG (Safety and Budget Aware Gate)
Novel technique introduced
As 3D Gaussian Splatting becomes the de facto representation for interactive 3D assets, robust yet imperceptible watermarking is critical. We present a representation-native framework that separates where to write from how to preserve quality. A Trio-Experts module operates directly on Gaussian primitives to derive priors for carrier selection, while a Safety and Budget Aware Gate (SBAG) allocates Gaussians to watermark carriers, optimized for bit resilience under perturbation and bitrate budgets, and to visual compensators that are insulated from watermark loss. To maintain fidelity, we introduce a channel-wise group mask that controls gradient propagation for carriers and compensators, thereby limiting Gaussian parameter updates, repairing local artifacts, and preserving high-frequency details without increasing runtime. Our design yields view-consistent watermark persistence and strong robustness against common image distortions such as compression and noise, while achieving a favorable robustness-quality trade-off compared with prior methods. In addition, decoupled finetuning provides per-Gaussian attributions that reveal where the message is carried and why those carriers are selected, enabling auditable explainability. Compared with state-of-the-art methods, our approach achieves a PSNR improvement of +0.83 dB and a bit-accuracy gain of +1.24%.
Key Contributions
- Trio-Experts module operating directly on Gaussian primitives to derive priors for carrier selection, separating watermark embedding from quality preservation
- Safety and Budget Aware Gate (SBAG) that allocates Gaussians as watermark carriers vs. visual compensators, optimized for bit resilience and bitrate budgets
- Decoupled finetuning providing per-Gaussian attributions for explainable watermarking — revealing where and why specific Gaussians carry the message
🛡️ Threat Analysis
Proposes a content watermarking scheme embedded in 3D-GS assets (the rendered content/output), enabling provenance tracking, authenticity verification, and auditable attribution — core output integrity and content watermarking concerns. The watermark is in the content representation, not in ML model weights, making this ML09 rather than ML05.