X-SG2S: Safe and Generalizable Gaussian Splatting with X-dimensional Watermarks

Conference: ECCV 2026
Paper: ECCV paper
Area: 3D Vision
Keywords: Gaussian Splatting / Multimodal watermarking / Spherical harmonics / Feed-forward injection / Copyright protection

TL;DR

X-SG2S splits binary, image, and 3D-object watermarks into patches, uses content-dependent point selection and modality-specific MLPs to write them into an existing 3DGS asset's higher-order spherical harmonic coefficients, and learns to locate and recover the patches without per-scene fine-tuning; the paper reports approximately 3-second injection and 100% unperturbed extraction accuracy in its 48-bit baseline comparison.

Background & Motivation

3D Gaussian Splatting (3DGS) assets can circulate as Gaussian cloud files, giving recipients not just rendered images but editable, reusable scene representations. Creators, platforms, and content providers therefore need a way to recover identity information during later asset verification without visibly changing the scene. Short bit strings carry limited metadata and cannot directly express a logo image or a 3D brand object. Meanwhile, optimizing a watermark separately for every scene adds latency and may require access to the original multi-view training images.

Image watermarking does not transfer straightforwardly to Gaussian point sets. Points have no stable intrinsic order, embedding in a subset creates a localization problem, and the limited appearance parameters available at each point require large payloads to be distributed. Partial data loss further requires messages to be reassembled from surviving fragments. Replacing the representation with custom hidden attributes can also break compatibility with standard 3DGS renderers. The paper aims to process existing assets with a pretrained injector while balancing payload size, appearance fidelity, and recoverability.

Core Idea: use modality-aware redundancy to determine what to store, a scene–message interaction gate to determine where to store it, replacement of selected higher-order spherical harmonic coefficients to preserve renderer compatibility, and a separate localization gate plus extraction heads to recover messages from initially unknown locations.

Method

Overall Architecture

The inputs are an existing 3DGS scene and a watermark consisting of one or more modalities: binary data, an image, or a 3D Gaussian object. The injector first creates redundant message patches, jointly uses the scene and message to select Gaussian points, and passes selected higher-order spherical harmonic (SH) coefficients and patches to modality-specific injection heads. The result remains a standard Gaussian representation. The extractor reads the watermarked asset, predicts which points carry messages, and uses the corresponding extraction heads to recover patches and reconstruct each payload.

%%{init: {'flowchart': {'rankSpacing': 24, 'nodeSpacing': 28, 'padding': 6, 'wrappingWidth': 400}}}%%
flowchart TD
    W["Bits, images, 3D objects"] --> A["Modality-aware patching<br/>and redundancy"]
    S["Existing 3DGS asset"] --> B["Content-dependent<br/>point selection"]
    A --> B
    B -->|Selected points and message patches| C["Higher-order SH injection"]
    C --> F["Watermarked standard 3DGS"]
    F --> R["Original renderer"]
    F --> D["Localization and<br/>patch recovery"]
    D --> O["Recovered bits, images, objects"]
    B -.->|Training only: selection-mask supervision| D

Solid arrows describe deployment-time data flow; the dashed arrow is training supervision and does not imply that extraction has access to the original injection mask. Training also uses message consistency, SH-deviation penalties, optional rendering losses, and the paper's degradation augmentation for recovery modules. “Fine-tuning free” means no per-asset optimization at deployment, not that the injector and extractor require no training.

Key Designs

1. Modality-aware patching and redundancy: turn heterogeneous payloads into distributed fragments

A single Gaussian cannot conveniently carry an entire image or 3D object, so messages are split into small patches with modality-dependent redundancy. For 1D and 3D payloads, the main text describes repeated data, allowing surviving copies to compensate for missing carrier points. For images, merely repeating local pixels does not adequately support global reconstruction. The image is instead encoded with a Deep Compression Autoencoder (DCAE), then divided into feature patches. Separate linear mappings subsequently project each modality into a higher-dimensional representation used to assess message–scene compatibility during point selection.

The image branch's feature-sparse DCAE retains more than isolated patch content: upsampling convolutions add neighboring context, and fixed positional encodings identify locations. Training removes some patches. During recovery, a network predicts positional encodings, matches them to the complete encoding table through nearest-neighbor search, and places surviving patches at their estimated locations. Downsampling convolutions and a refinement MLP reconstruct the feature sequence before DCAE decoding. This separates locating fragments from reconstructing missing content, but it does not establish exact recovery from an arbitrarily small surviving subset; recoverability still depends on redundancy and the extent of missing data.

2. Content-dependent point selection: combine scene context with payload compatibility

Random carrier selection can modify appearance-sensitive points, whereas processing each point independently misses its relationship to the scene and current payload. The adaptive gate therefore combines a self-score and a cross-score. The self-score models interaction between a point and the scene set, which the authors interpret as related to the point's contribution to overall appearance. The cross-score measures compatibility through interaction between Gaussian representations and message patches. Both are learned scores, not importance values measured by explicitly removing and rendering individual points.

The self-score uses Induced Set Attention: learnable inducing tokens summarize the point set and return contextual information to the points. The reported configuration uses one inducing token and one attention head, reducing attention's dependence on point count from quadratic to linear. Efficient Attention computes the cross-score without explicitly constructing a large all-pairs point–patch attention matrix. The two scores are multiplied element-wise, and Top-K selection produces the injection mask. The following summarizes the selection rule stated in the prose rather than reconstructing the damaged attention equations.

\[ \mathrm{mask}=\mathrm{TopK}\!\left(s_{\mathrm{self}}\odot s_{\mathrm{cross}}\right). \]

This provides content-dependent selection within a set, not automatic invariance to every geometric transformation. The main text also does not fully explain gradient handling through Top-K, resolution of selection conflicts between modalities, or the complete patch-to-point assignment procedure. Reproduction still requires additional implementation material.

3. Higher-order SH injection: preserve the representation structure, not every parameter value

Each modality uses a separate injection MLP with PointNet-like pointwise processing, typically containing 3–5 layers according to the paper. It reads selected points' higher-order SH coefficients across three color channels, concatenates them with the corresponding message patches, and predicts replacement coefficients carrying the watermark. Position, scale, rotation, and opacity are not the fields modified by this injection operation. The resulting asset can still be consumed by a standard Gaussian renderer.

Using higher-order SH rather than all color coefficients aims to concentrate changes in view-dependent appearance and reduce direct disruption of the original scene. The paper qualitatively compares these choices. Representation format must be distinguished from numeric values: a literal reading of the abstract's and conclusion's “no parameter modification” language conflicts with the method. Selected SH values are modified, while no custom Gaussian attributes or renderer redesign are introduced. This is minimally intrusive embedding, not strictly distortion-free processing or zero computational and storage overhead.

4. Localization and patch recovery: recognize carrier points independently before decoding their payloads

The injector knows which points it selected, but verification after asset distribution cannot assume the original indices remain valid. A four-layer MLP localization gate predicts carrier locations from watermarked Gaussian parameters, using the injection mask as its training target. Gradients are detached before this gate so that its localization loss does not push the injection side to accommodate the locator. Each modality also has its own extraction MLP, which reads the identified points' SH parameters and predicts message patches, followed by the relevant reassembly or image-feature decoding procedure.

Point selection differs importantly between training and inference. Figure 2 states that the extraction head is trained using known watermarked points, while the localization gate separately learns to identify them after degradation. At inference, only points selected by the learned gate reach the extraction head. End-to-end recovery therefore depends on localization misses and false selections as well as individual patch-decoding quality. The authors evaluate recovery from unwatermarked assets, but the main text does not provide complete false-positive curves or a copyright-decision threshold. Reconstructing a message is also not equivalent to establishing legal ownership.

Loss & Training

Training combines binary cross-entropy for 1D messages, MSE for 2D and 3D patches, binary cross-entropy for location masks, and MSE penalizing changes to SH coefficients. Optional rendered-view MSE and LPIPS losses constrain pixel consistency and perceptual quality. Several connecting operators are missing from Equation (7) in the cached text, so this note does not invent an exact reconstruction of the authors' equation.

The implementation uses PyTorch, a CUDA 3DGS renderer, and Adam on a single RTX A6000ada. Optional rendered-view MSE and LPIPS weights are 1 and 0.05; the other reported weights are γ=1, ϕ=0.005, θ=2, and δ=1.5. These settings train the general injector/extractor rather than specifying an optimization run required whenever a new scene is watermarked.

Default payloads are described as a 48bit×1024 binary message, a 10,000-point 3D Gaussian object, and 16×2048 image-message patches. The text lists 48 higher-order SH parameters per Gaussian. The counting convention for 48 and the extracted DCAE feature dimensions require implementation verification rather than silent correction. Default payload shape, redundant copies, and net independent information must not be conflated; the baseline comparison below separately uses a common 48-bit payload.

Key Experimental Results

Main Results

Pretrained MVSplat generates scenes from ACID, with 11,075 / 1,972 training/test scenes. Image watermarks come from the reorganized Logo-2K dataset, with 110,313 / 28,415 training/test images. The 3D payloads use an Objaverse subset converted to Gaussian objects by Gamba, with 353 / 94 training/test files. Scene evaluation renders at 256×256, while object evaluation uses 512×512.

The following extracts Table 2, comparing a common 48-bit payload on Blender and LLFF. Accuracy is reported in %. Perturbation columns summarize defensive evaluation results, not procedures for removing third-party watermarks. The noise column follows that table's setting and should not be merged with results from different tables.

Method	Injection time	Unperturbed	SH noise	Translation	Rotation	Partial point loss
3DGS + fine-tuning	3–5 minutes	69.79	69.70	68.78	65.88	64.84
GaussianMarker 2D decoder	3–5 minutes	97.85	57.05	59.07	53.88	48.23
GaussianMarker 3D decoder	3–5 minutes	100	99.90	98.95	95.83	92.70
GuardSplat	3–5 minutes	90.98	67.10	67.77	66.13	71.32
3D-GSW	3–5 minutes	93.72	84.54	81.67	82.33	91.87
X-SG2S	3 seconds	100	94.12	99.07	96.56	95.01

X-SG2S offers feed-forward injection, multimodal support, and strong recovery under the tested geometric degradations. It does not lead every column: GaussianMarker's 3D decoder reaches 99.90% under SH noise versus 94.12% for X-SG2S. Reported injection time is not an end-to-end latency covering one-time network training, every scene size, and all payload configurations.

Ablation Study

The following comes from Table 6. Org denotes the reference scene without watermark injection. Recovery metrics describe the payload, whereas “scene” metrics describe the carrier asset. Bit Acc retains the original 0–1 scale, and PSNR is measured in dB.

Metric	Interactive selection	Ordinary MLP selection	Random selection	Org
Scene PSNR ↑	27.804	24.276	21.534	27.826
Scene SSIM ↑	0.871	0.824	0.529	0.871
Scene LPIPS ↓	0.126	0.235	0.443	0.123
Bit Acc ↑	1.000	0.958	0.667	1.000
Image-watermark PSNR ↑	22.791	22.595	21.797	29.755
3D-object-watermark PSNR ↑	23.017	21.322	20.699	28.807

Interactive selection improves both message recovery and carrier-scene PSNR over an ordinary MLP. Its scene PSNR differs from Org by 0.022 dB. This supports the importance of carrier selection but does not isolate the self-score and cross-score contributions. Payload-related entries in Org are reference values listed by the paper, not evidence of successful message extraction from an unwatermarked scene.

The third table selects results from Tables 4 and 5 to show simultaneous embedding and optional rendering supervision. “Not applicable” means the configuration does not embed that modality.

Config	Scene PSNR ↑	Bit Acc ↑	Image-watermark PSNR ↑	3D-object-watermark PSNR ↑
Image watermark only	27.811	Not applicable	22.804	Not applicable
3D watermark only	27.810	Not applicable	Not applicable	23.044
Multimodal, without optional losses	27.757	0.979	21.923	22.647
Multimodal, with optional losses	27.804	1.000	22.791	23.017

Multimodal embedding reduces image and object recovery PSNR by 0.013 and 0.027 dB relative to the corresponding single-modality configurations. This supports small interference in the tested setup, not mathematically zero interference. Optional losses improve scene and payload quality, showing that “no access to a new asset's original training images” does not mean the general network is trained without rendering supervision.

Key Findings

• Table 1 reports unperturbed multimodal recovery of 100% bit accuracy, 22.791 dB image PSNR, and 23.017 dB object PSNR. These results must not be treated as the same experiment as Table 2's cross-dataset baseline comparison.
• At 25% point loss in Table 7, bit accuracy is 97.7%, with image/object PSNR of 21.563 / 22.133 dB. This is defensive evidence within a tested degradation range, not guaranteed recovery after arbitrary modification.
• Section 4.4 states a noise standard deviation of 0.1, while Tables 1 and 2 state 0.05. This discrepancy is retained rather than silently resolving it in favor of either value.
• The unwatermarked control in Table 3 has Acc 0.395, image PSNR 7.719 dB, and object PSNR 11.934 dB. These demonstrate different reconstruction quality, but without a threshold, sample count, and ROC/FPR evaluation, they do not establish zero false positives.

Highlights & Insights

• Localization is explicitly learned. The framework does not assume original Gaussian indices will remain usable; a separate network is trained with injection masks. Patch decoding and carrier recognition can be diagnosed separately to identify recovery failures.
• Compatibility follows from a controlled modification interface. Watermarks remain in standard SH fields instead of requiring a custom renderer for hidden attributes. This simplifies deployment but still accepts small numerical changes to appearance.
• Multimodal redundancy is not just uniform replication. Image recovery uses compressed features, positional encoding, and contextual reconstruction, unlike repeated storage for discrete payloads. This respects payload structure more directly than simply increasing the total patch count.

Limitations & Future Work

• Copyright verification lacks a complete decision protocol. Reconstructing a recognizable logo is not the same as reliably establishing ownership. Threshold calibration, false-positive control, key or identity binding, and conflicting ownership claims need further treatment beyond the current experiments.
• Generalization and costs remain bounded by the evidence. Training mainly uses MVSplat scenes and Gamba objects, with only 353 training files for 3D watermarks. Different generators, SH configurations, scene sizes, peak memory, and extraction latency require systematic reporting.
• Capacity and redundancy are not fully disentangled. More patches may include more repeated information, so total stored elements cannot be equated with net payload. Capacity curves should jointly report independent information and recovery quality.
• The source has wording and extraction gaps. Some equations are damaged, DCAE dimensions are poorly extracted, and “no parameter modification” conflicts with SH replacement. The referenced appendix is absent from the cache. This note preserves those limits instead of guessing implementation details.

Related Work & Insights

• GaussianMarker, GuardSplat, and 3D-GSW: X-SG2S emphasizes moving from per-scene fine-tuning to feed-forward asset processing after training and expanding to multimodal payloads. The common bit comparison supports some advantages, but the noise column clearly rules out complete dominance over all baselines.
• GS-Hider and GaussianStego: The former uses hidden feature attributes and specialized decoding, while the latter integrates image watermarks with generation/rendering workflows. X-SG2S emphasizes standard Gaussian parameter structure and asset-side SH modification. This does not imply that all prior methods share identical deployment constraints.
• Set Transformer and DCAE: Set attention models interactions without depending on input ordering, while the compression autoencoder turns images into patch-recoverable representations. They address different bottlenecks rather than assigning every modality to a single generic encoder.
• Research direction: On authorized asset benchmarks, separately calibrate localization accuracy, patch reconstruction quality, and final copyright-decision false positives. Compare redundancy strategies using net payload rather than repeated patch counts. This is a defensive verification direction, not a proposal for third-party watermark-evasion tools.

Rating

• Novelty: 4/5 — Unifying multimodal payloads, content-dependent selection, and feed-forward Gaussian-asset watermarking makes a clear systems contribution.
• Experimental Thoroughness: 3/5 — Baselines and modality/selection ablations are useful, but false-positive protocols, cost reporting, and consistent experimental settings remain incomplete.
• Writing Quality: 3/5 — The architecture is clear, but claims about unchanged parameters are too strong, and damaged equations and dimensions hinder reproduction.
• Value: 4/5 — The method offers a practical route to renderer-compatible 3DGS copyright marking, but watermark recovery should not be equated with reliable ownership authentication.