RDSplat: Robust Watermarking Against Diffusion Editing for 3D Gaussian Splatting
📝 Abstract
3D Gaussian Splatting (3DGS) has enabled the creation of digital assets and downstream applications, underscoring the need for robust copyright protection via digital watermarking. However, existing 3DGS watermarking methods remain highly vulnerable to diffusion-based editing, which can easily erase embedded provenance. This challenge highlights the urgent need for 3DGS watermarking techniques that are intrinsically resilient to diffusion-based editing. In this paper, we introduce RDSplat, a Robust watermarking paradigm against Diffusion editing for 3D Gaussian Splatting. RDSplat embeds watermarks into 3DGS components that diffusion-based editing inherently preserve, achieved through (i) proactively targeting low-frequency Gaussians and (ii) adversarial training with a diffusion proxy. Specifically, we introduce a multi-domain framework that operates natively in 3DGS space and embeds watermarks into diffusion-editing-preserved low-frequency Gaussians via coordinated covariance regularization and 2D filtering. In addition, we exploit the low-pass filtering behavior of diffusion-based editing by using Gaussian blur as an efficient training surrogate, enabling adversarial fine-tuning that further enhances watermark robustness against diffusion-based editing. Empirically, comprehensive quantitative and qualitative evaluations on three benchmark datasets demonstrate that RDSplat not only maintains superior robustness under diffusion-based editing, but also preserves watermark invisibility, achieving state-of-the-art performance.
💡 Analysis
3D Gaussian Splatting (3DGS) has enabled the creation of digital assets and downstream applications, underscoring the need for robust copyright protection via digital watermarking. However, existing 3DGS watermarking methods remain highly vulnerable to diffusion-based editing, which can easily erase embedded provenance. This challenge highlights the urgent need for 3DGS watermarking techniques that are intrinsically resilient to diffusion-based editing. In this paper, we introduce RDSplat, a Robust watermarking paradigm against Diffusion editing for 3D Gaussian Splatting. RDSplat embeds watermarks into 3DGS components that diffusion-based editing inherently preserve, achieved through (i) proactively targeting low-frequency Gaussians and (ii) adversarial training with a diffusion proxy. Specifically, we introduce a multi-domain framework that operates natively in 3DGS space and embeds watermarks into diffusion-editing-preserved low-frequency Gaussians via coordinated covariance regularization and 2D filtering. In addition, we exploit the low-pass filtering behavior of diffusion-based editing by using Gaussian blur as an efficient training surrogate, enabling adversarial fine-tuning that further enhances watermark robustness against diffusion-based editing. Empirically, comprehensive quantitative and qualitative evaluations on three benchmark datasets demonstrate that RDSplat not only maintains superior robustness under diffusion-based editing, but also preserves watermark invisibility, achieving state-of-the-art performance.
📄 Content
Figure 1. Overview of 3D Watermarking and Attack Mechanisms. Left: Original and watermarked 3DGS models with imperceptible differences; watermarks remain decodable from novel 2D views. Right: Classical attacks (blur, brightness, compression, noise) apply signal-level distortions while preserving watermark integrity. Diffusion-based editing (regeneration, global/local editing) performs semantic-level reconstruction that completely destroys watermarks yet produces visually plausible results that appear natural to humans, enabling covert copyright infringement. A robust 3DGS watermark needs to withstand both attack categories while maintaining invisibility.
3D Gaussian Splatting (3DGS) has enabled the creation of digital assets and downstream applications, underscoring the need for robust copyright protection via digital watermarking. However, existing 3DGS watermarking methods remain highly vulnerable to diffusion-based editing, which can easily erase embedded provenance. This challenge highlights the urgent need for 3DGS watermarking techniques that are intrinsically resilient to diffusionbased editing. In this paper, we introduce RDSplat, a Robust watermarking paradigm against Diffusion editing for 3D Gaussian Splatting. RDSplat embeds watermarks into 3DGS components that diffusion-based editing inherently preserve, achieved through (i) proactively targeting low-frequency Gaussians and (ii) adversarial training with a diffusion proxy. Specifically, we introduce a multi-domain framework that operates natively in 3DGS space and embeds watermarks into diffusion-editing-preserved lowfrequency Gaussians via coordinated covariance regularization and 2D filtering. In addition, we exploit the lowpass filtering behavior of diffusion-based editing by using Gaussian blur as an efficient training surrogate, enabling adversarial fine-tuning that further enhances watermark Each method is shown as a diamond with four bars. The diamond area represents encoding capacity; its y-coordinate shows bit accuracy under classical attacks (averaged across multiple attack types); its x-coordinate shows TPR@1%FPR against diffusion editing. Bar length indicates TPR@1%FPR for each specific attack (longer is better). Due to diffusion-based attacks’ destructive nature, evaluation shifts from bit accuracy to watermark detection (TPR@1%FPR). Our method achieves balanced robustness across all attacks on the Blender dataset.
robustness against diffusion-based editing. Empirically, comprehensive quantitative and qualitative evaluations on three benchmark datasets demonstrate that RDSplat not only maintains superior robustness under diffusion-based editing, but also preserves watermark invisibility, achieving state-of-the-art performance.
The field of 3D representation is shifting from implicit neural fields (e.g., NeRF [36]) to explicit formats, with 3D Gaussian Splatting (3DGS) [26] emerging as a prominent breakthrough. By modeling scenes with anisotropic Gaussians, 3DGS balances reconstruction fidelity and realtime rendering efficiency, driving adoption across dynamic scenes, autonomous driving, and content creation [3, 6-8, 11, 19-21, 31, 43, 48, 51, 63]. As these 3DGS assets gain commercial value, protecting their copyright through digital watermarking becomes critical for ownership verification. Recent works have proposed watermarking schemes for 3DGS [9,22], primarily targeting robustness against classical distortions such as compression, noise, and geo-metric transformations. However, diffusion-based editing [5,56,61] poses unprecedented threats to watermark robustness. Unlike classical distortions (e.g., blur, compression, noise) that apply signal-level perturbations, diffusion-based editing performs semantic-level reconstruction through iterative denoising, fundamentally altering rendered views while maintaining visual plausibility. As Fig. 1 shows, when applied to 3DGSrendered views, such semantic manipulations obliterate embedded watermarks, rendering existing methods ineffective. Developing robust watermarking against both classical distortions and diffusion-based attacks becomes imperative.
Recent 2D watermarking methods (VINE [32], Edit-Guard [58]) achieve diffusion robustness through frequency guidance and adversarial training. However, they cannot be directly applied to 3DGS due to architectural mismatches: 2D methods embed watermarks only in rendered images without generalization to novel views, and subtle watermark signals are blurred during 3D reconstruction from 2D watermarked images. Existing 3DGS watermarking methods employ diverse embedding strategies, operating on explicit geometric parameters [9,22] or implicit feature domains [24,29], with some leveraging image-domain frequency cues [25,59] to guide 3D embedding. However, as Fig. 2 illustrates, these methods exhibit severe vulnerability to diffusion-based attacks: GaussianMarker [22] achieves 78% bit accuracy under classical attacks but only 45% detection rate (T
This content is AI-processed based on ArXiv data.