GuardSplat: Efficient and Robust Watermarking for 3D Gaussian Splatting

Zixuan Chen, Guangcong Wang, Jiahao Zhu, Jianhuang Lai, Xiaohua Xie.

IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2025

TL;DR: GuardSplat is an efficient watermarking framework to protect the copyright of 3DGS assets. It presents superior performance to state-of-the-art watermarking approaches in capacity, invisibility, robustness, security, and training efficiency.

---

Application scenarios of GuardSplat. To protect the copyright of 3D Gaussian Splatting (3DGS) assets, (a) the owners (Alice) can use our GuardSplat to embed the secret message (blue key) into these models. (b) If malicious users (Bob) render views for unauthorized uses, (c) Alice can use the private message decoder to extract messages (purple key) for copyright identification.

Framework

Overview of GuardSplat. (a) Given a binary message $M$, we first transform it into CLIP tokens $T$ using the proposed message tokenization. We then employ CLIP's textual encoder $\mathcal{E _T}$ to map $T$ to the textual feature $F _\mathcal{T}$. Finally, we feed $F _\mathcal{T}$ into message decoder $\mathcal{D _M}$ to extract the message $\hat{M}$ for optimization. (b) For each 3D Gaussian, we freeze all the attributes and build a learnable spherical harmonic (SH) offset $\boldsymbol{h}^o _i$ as the watermarked SH feature, which can be added to the original SH features as $\boldsymbol{h} _i + \boldsymbol{h}^o _i$ to render the watermarked views. (c) We first feed the 2D rendered views to CLIP's visual encoder $\mathcal{E _V}$ to acquire the visual feature $F _{\mathcal{V}}$ and then employ the pre-trained message decoder to extract the message $\hat{M}$. A differentiable distortion layer is used to simulate various visual distortions during optimization. $\mathcal{D _M}$ and $\boldsymbol{h}^o _i$ are optimized by the corresponding losses, respectively.

1) Get start

• Python 3.12
• CUDA 12.1 or higher
• NVIDIA RTX 3090
• PyTorch 2.5.1 or higher

Create a python env using conda

conda create -n GuardSplat python=3.12 -y
conda activate GuardSplat

Install the required libraries

bash setup.sh

Please see setup.sh in details.

2) Train and evaluate the message decoder

python make_decoder.py --mode train --msg_len <message_length> --save --num_epochs <training_epochs>
python make_decoder.py --mode test --msg_len <message_length>

3) Train a 3DGS model

python gaussian-splatting/train.py -s <nerf_dir>/<nerf_item> -m <result_dir> -w 

4) Watermark a 3DGS model (blender or llff mode)

# no distortions
python run_watermark.py -s <nerf_dir>/<nerf_item> -m <result_dir> -w --mode train --msg_len <message_length> --sdir <watermark_dir> --dtype blender

# single distortion
python run_watermark.py -s <nerf_dir>/<nerf_item> -m <result_dir> -w --mode train --msg_len <message_length> --sdir <watermark_dir> --dtype blender atypes <distortion>

# combined distortions
python run_watermark.py -s <nerf_dir>/<nerf_item> -m <result_dir> -w --mode train --msg_len <message_length> --sdir <watermark_dir> --dtype blender atypes <distortion1> <distortion2> ... <distortionN>

More details can be shown in run.sh.

Citation

@InProceedings{Chen_2025_CVPR,
    author    = {Chen, Zixuan and Wang, Guangcong and Zhu, Jiahao and Lai, Jianhuang and Xie, Xiaohua},
    title     = {GuardSplat: Efficient and Robust Watermarking for 3D Gaussian Splatting},
    booktitle = {Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
    month     = {June},
    year      = {2025},
    pages     = {16325-16335}
}

Acknowledgement

We build our project based on gaussian-splatting and CLIP. The differentiable JPEG compression and VAE attack are implemented based on Diff-JPEG and WatermarkAttacker, respectively. We also follow the settings used in CopyRNeRF and WateRF. We sincerely thank them for their wonderful work and code release.