PaperlayerView exact revision on arXiv

Source-linked AI summary

FlyMark: Training-Free Invisible Watermarking of 3D Gaussian Splatting via a Fruit Fly Connectome

Ziyuan Luo, Haoliang Li, Renjie Wan

arXiv:2610.11364v1cs.CV

TL;DR

Ownership evidence in a 3DGS asset needs a reproducible place to look that an owner and later auditor can agree on. FLYMARK uses a connectome-derived carrier to embed keyed messages in existing parameters; across synthetic and real scenes, it reports high clean bit accuracy and visual fidelity, robustness to model transformations, and separation of matched from wrong keys.

  • Problem

    A watermark needs a reproducible carrier geometry that an owner and later auditor can agree on when checking a 3DGS asset.

    Source: §1 · p. 1, §3.3 · p. 4

  • Method

    FLYMARK uses a published connectome’s photoreceptor directions and an orbit-based luminance readout to embed keyed, redundantly coded messages in existing 3DGS parameters.

    Source: §1 · pp. 1–3, §3.2 · p. 4

  • Results

    FLYMARK attains high clean bit accuracy and visual fidelity, sustains recovery under model-domain attacks, and separates matched from wrong keys across synthetic and real scenes.

    Source: §1 · p. 3, §5 · p. 9

  • Takeaways & Limitations

    Biologically derived sampling serves as a practical model-domain watermark carrier for static 3DGS assets.

    Source: §5 · pp. 9–10

    The present formulation targets static 3DGS assets, with extensions to NeRF, VGGT-derived reconstructions, and 4D scenes left for future work.

    Source: §5 · p. 10

Abstract

from arXiv · show

A trained 3D Gaussian Splatting (3DGS) scene ships as a portable parameter array that can be copied, pruned, requantized, or repackaged outside its training pipeline, so ownership evidence is most useful when it lives in the released parameters and remains checkable long after the embedding tooling is gone. Existing 3DGS watermarks typically tie embedding or extraction to scene optimization, a learned decoder, or rendered views, so the evidence survives only as long as a second trained artifact does. FlyMark instead writes a keyed message into the parameters a 3DGS file already stores. Its carrier directions are derived from the photoreceptors of a published connectome, a citable versioned artifact that fixes the geometry exhaustively and leaves nothing to tune per scene. A virtual observer reads cone-wise apparent luminance along a scene-normalized orbit from stored centers, colors, and opacities; a keyed dithered quantization-index-modulation code replicates each message bit across these observations; and one sparse bounded least-squares solve realizes the targets through achromatic shifts of existing degree-zero colors under a hard per-channel linear-RGB bound. All geometry and higher-order appearance parameters are preserved bit-identically, and extraction needs only cone queries, rounding, and majority voting. Under a model-domain threat model on synthetic and real scenes, FlyMark attains high clean bit accuracy and visual fidelity while cleanly separating matched from wrong keys.

1 INTRODUCTION

FLYMARK uses a published fly connectome as a fixed, reproducible carrier for watermarking 3DGS parameters. A keyed, redundant code and bounded color solve address model-domain verification without learned decoders, while evaluation reports high clean bit accuracy and visual fidelity, robustness to model transformations, and wrong-key separation.

1 INTRODUCTION

  • A published connectome supplies fixed photoreceptor directions for a reproducible carrier, which FLYMARK reads by orbiting a virtual observer around the scene.The carrier writes a keyed message into parameters already stored in the 3DGS file.Source: §1 · p. 1
  • Portable 3DGS parameter arrays can be copied, pruned, requantized, or repackaged, motivating ownership evidence stored in the released parameters and checkable from the file and key.The stated requirements also include surviving routine asset transformations and leaving rendered appearance unchanged under an auditable bound.Source: §1 · pp. 1–2
  • Existing 3DGS watermark approaches use trained decoders, learned features, or rendered readouts, motivating a deterministic parameter-space alternative without learned weights.The cited approaches include GaussianMarker, GuardSplat, 3D-GSW, GS-Hider, MarkSplatter, and Splats in Splats.Source: §1 · p. 2
  • The design addresses unstable carrier indices, coupled edits from shared Gaussians, and targets that strict edit and gamut bounds may leave unrealized.A code requiring every symbol to land exactly is therefore unsuitable under these constraints.Source: §1 · p. 2
  • A keyed dithered QIM code replicates bits across cone observations for parity voting, while one sparse bounded least-squares solve adjusts existing degree-zero colors.The achromatic shifts obey a hard per-channel linear-RGB bound; geometry and higher-order spherical harmonics remain bit-identical.Source: §1 · pp. 2–3
  • FLYMARK attains high clean bit accuracy and visual fidelity, sustains recovery under model-domain attacks, and separates matched from wrong keys across synthetic and real scenes.The evaluation uses one configuration frozen before held-out or real-scene evaluation.Source: §1 · p. 3

2 RELATED WORK

Related work traces radiance-field development and watermarking approaches before positioning FLYMARK as a parameter-space code decoded without learned weights.

Radiance-field representations

  • 3DGS optimizes anisotropic Gaussians for differentiable splatting, producing portable assets whose parameters can be distributed and transformed.Earlier radiance-field work includes coordinate networks, anti-aliased and unbounded extensions (Barron et al., 2021; 2022), and explicit factorizations.Source: §2 · p. 3

Watermarking radiance fields and 3DGS

  • Prior 3DGS watermarks use learned extraction, spherical-harmonic features or offsets, splatter-image structure, or hidden 3D structure; FLYMARK instead codes existing degree-zero colors without learned weights.Examples include GaussianMarker, GS-Hider, MarkSplatter, 3D-GSW, GuardSplat, and Splats in Splats.Source: §2 · p. 3

Robust coding and watermark evaluation

  • FLYMARK combines spread-spectrum redundancy and dithered-QIM reconstruction sets for repeated symbols in a scene-normalized orbit, and evaluates recovery, fidelity, attack robustness, and wrong-key calibration.The cited coding foundations are Cox et al. (1997) and Chen & Wornell (2001).Source: §2 · p. 3

3 FLYMARK

FlyMark uses a connectome-derived carrier and a scene-normalized observer orbit to embed keyed message targets in existing 3DGS colors. A bounded sparse solve realizes the targets, and verification repeats the parameter-space readout and aggregates parity votes.

3.1 EMBEDDING CONTRACT

  • FlyMark embeds a keyed message by bounded achromatic shifts to selected existing degree-zero colors, making the appearance trade-off explicit and auditable at the file level.Figure 2 shows the color solve producing the marked model from keyed QIM targets.Source: §3.1 · p. 3, Figure 2 · p. 4

3.2 PARAMETER-SPACE READOUT

  • Cone-wise apparent luminance is read from stored Gaussian centers, degree-zero colors, and opacities, making the carrier signal reproducible from the parameter array alone.The passage says this avoids dependence on rasterizer implementations, tile orders, camera intrinsics, and image codecs.Source: §3.2 · p. 4

3.3 CONNECTOME CARRIER AND SCENE-NORMALIZED ORBIT

  • The carrier uses 825 distinct directions collapsed from 3,335 MaleCNS v1.0 photoreceptors, sampled along a scene-normalized orbit with observations screened for eligibility.The orbit has 24 azimuths; eligibility requires at least eight Gaussians per cone, 80% inside the scene body, and unsaturated activation.Source: §3.3 · pp. 4–5

3.4 KEYED DITHERED QIM

  • Keyed dithering assigns each observation to a message bit and requests the nearest quantization point with the desired parity; repeated assignments provide heavy replication.Even and odd lattice points encode 0 and 1, respectively.Source: Figure 2 · p. 4, §3.4 · p. 5

3.5 ONE BOUNDED COLOR-REALIZATION SOLVE

  • A single sparse bounded least-squares solve fits all eligible observation targets through achromatic shifts, while shared Gaussians and active bounds can leave targets partially realized.The solve uses a sparse observation matrix and preserves out-of-gamut degree-zero colors bit-identically.Source: §3.5 · p. 5

3.6 EXTRACTION AND OWNERSHIP SCORE

  • Verification rebuilds the scene frame and orbit, quantizes eligible observations into votes, and reports BitAcc without a decision threshold; explicit ownership decisions use a preselected operating point.Decoded bits are majority votes among eligible observations assigned to each bit.Source: §3.6 · p. 5

3.7 IMPLEMENTATION DETAILS

  • The implementation uses vectorized NumPy geometry and SciPy’s sparse bounded least-squares solver; CPU extraction needs only the model file for cone queries, arithmetic, rounding, and majority voting.The stored record includes the carrier, key-derived protocol data, and embedding-time eligibility mask.Source: §3.7 · pp. 5–6

4 EXPERIMENTS

Evaluation freezes one configuration before held-out and real-scene testing, then measures recovery, fidelity, robustness, and key separation across synthetic and real 3DGS scenes.

4.1 EXPERIMENTAL SETUP

  • The setup protects a static vanilla 3DGS with its parameter array available to the verifier, using frozen settings and scene/key cells for evaluation.The evaluation includes published systems, matched parameter-space controls, recovery and fidelity metrics, and model-domain attacks.Source: §4.1 · p. 6

4.2.1 CLEAN RECOVERY AND FIDELITY

  • 953 of 960 message bits (99.27%) are recovered across 30 scene/key cells, with 44.21 dB direct PSNR.Recomputing eligibility from the received model still recovers 98.96% of bits.Source: Table 1 · p. 7, §4.2.1 · p. 7
  • The frozen settings retain high clean bit accuracy and direct fidelity on held-out Synthetic scenes and all nine real scenes.Across 37 to 158 viewpoints per scene, direct PSNR stays above 38.7 dB and LPIPS below 0.0060 on every scene.Source: §4.2.1 · p. 7, Table 2

4.2.2 ROBUSTNESS TO MODEL TRANSFORMATIONS

  • At a 2 dB ground-truth PSNR-loss budget, FLYMARK retains 97.19% of bits across 30 cells, similar to RandomCone-QIM and ahead of SpatialHash-QIM on commonly measured cells.Targeted attacks retain 97.92% bit accuracy under local smoothing at severity 0.4; opacity- and scale-guided purification retain 63.54% and 70.83% at severity 0.1.Source: §4.2.2 · p. 8

4.2.3 WRONG-KEY CALIBRATION

  • At the preselected 30-bit ownership cutoff, all matched cells and no wrong-key trial are accepted; wrong-key scores never exceed 29 bits.The five million wrong-key trials peak near 16 correct bits, while matched scores range from 30 to 32.Source: §4.2.3 · p. 8, Figure 5 · p. 9

4.2.4 COMPONENT ATTRIBUTION

  • A 64-bit message retains 96.48% clean bit accuracy, and twelve orbit stops retain 97.66%.Source: §4.2.4 · p. 9

4.2.5 EFFICIENCY

  • Embedding takes a median 72.23 s on CPU, extraction 2.90 s, and median peak memory is 0.65 GiB.Verification uses spatial indices, cone means, and keyed votes without rendering or learned decoder weights.Source: §4.2.5 · p. 9

4.2.6 EXTENSION TO 2D IMAGES

  • On 200 BSDS500 test images across three keys, saved 8-bit PNGs yield 99.95% clean bit accuracy and 59.00 dB mean direct sRGB PSNR.Source: §4.2.6 · p. 9

5 CONCLUSION

FlyMark embeds a keyed message in existing degree-zero colors of static 3DGS assets, using a connectome-derived carrier and bounded color solve. Its conclusion reports accurate recovery and high visual fidelity, while identifying static assets as the current scope.

5 CONCLUSION

  • FlyMark uses a connectome-derived carrier and orbit-based readout to encode a keyed message in existing degree-zero colors, without changing geometry or training a decoder.A bounded color solve realizes the code without adding Gaussians.Source: §5 · p. 9
  • The present formulation targets static 3DGS assets; adapting it to NeRF, VGGT-derived reconstructions, or temporally consistent 4D readouts is future work.Ownership scores should be weighed alongside provenance records and legal context.Source: §5 · p. 10

A APPENDIX OVERVIEW

  • The appendices cover datasets and evaluation, readout and constrained realization, attack and ownership results, fidelity, carrier sensitivity, image-domain extension, and qualitative views.The supplementary materials include code and a README for reproducing reported results.Source: REPRODUCIBILITY STATEMENT · p. 10, A APPENDIX OVERVIEW · p. 14

B.1 DATASETS AND SCENE ROLES

The appendix records the frozen scene and evaluation protocol, method settings, controls, and implementation details, then expands the carrier, voting, and color-writeback procedures. It also describes damage-matched standard-attack evaluation and reports targeted adaptive-attack findings.

B.1 DATASETS AND SCENE ROLES

  • The protocol uses canonical NeRF Synthetic splits and official Mip-NeRF 360 scenes, with each base model trained once and shared across compared methods.The ten-scene cross-method corpus uses the same saved model; seven additional real scenes use frozen FlyMark settings.Source: §B.1 · p. 14

B.2 FLYMARK HYPERPARAMETERS; B.3 BASELINES AND CONTROLS

  • The appendix identifies the frozen configuration and compares three published watermark systems with RandomCone-QIM and SpatialHash-QIM controls.The controls replace the carrier directions or cone aggregation while retaining specified portions of FlyMark’s pipeline.Source: §B.2 · p. 14, §B.3 · pp. 14–15, Table 7 · p. 15

B.4 FIDELITY, ATTACKS, AND STATISTICS

  • Evaluation audits preserved model fields and bounded linear-RGB changes, measures fidelity and attacks, and uses scene-level resampling and CPU efficiency measurements.Direct fidelity compares marked and original renders; damage-matched selection uses ground-truth PSNR loss.Source: §B.4 · p. 15

C.1 CARRIER MEMBERSHIP

  • Each observation is an angular cone query, with a scene-body indicator supporting an 80% body-fraction eligibility gate.The gate uses the 95th-percentile scene radius; activation means include every Gaussian center inside an eligible cone.Source: §C.1 · p. 16

C.2 QIM TARGET AND VOTE RULE

  • QIM targets use even and odd integer reconstruction cosets, and decoding rounds normalized activations to recover parity for each bit.Ties resolve toward the lower parity-constrained reconstruction point.Source: §C.2 · p. 16

C.3 SPARSE LINEAR SYSTEM AND COLOR WRITEBACK

  • One bounded sparse solve reconciles overlapping observation targets through achromatic color shifts, with writeback limited to selected degree-zero rows.Bounds combine the color budget with channel-wise gamut headroom; untouched rows retain their stored values.Source: §C.3 · p. 16

D.1 DAMAGE-MATCHED STANDARD ATTACKS

  • Damage-matched attack comparisons select the most severe measured condition within a 2 dB ground-truth PSNR-loss budget, without using recovery or extrapolating missing severities.Table 8 reports bit accuracy for the representative Lego/Hotdog/Bonsai subset.Source: §D.1 · p. 16, Table 8 · p. 17

D.2 ADAPTIVE ATTACKS

  • Local color smoothing preserves high bit accuracy across measured severities, while opacity- and scale-guided purification reduce recovery at smaller visual losses than spatial partial theft.The results distinguish attacks on color readout from attacks that remove or alter Gaussian support.Source: Table 9 · p. 17, §D.2 · p. 18

D.3 OVERWRITE AND COPY COLLUSION

Overwrite tests find that tighter attacker color budgets can preserve the owner's message, while the attacker's recovery rises with its permitted change. Copy averaging retains some recovery for keys present in the mixture, with lower recovery for three-copy mixtures.

D.3 OVERWRITE AND COPY COLLUSION

  • With smaller attacker color budgets, the original owner’s message remains fully decodable while attacker recovery rises with the permitted change.At the owner's 0.02 bound, both messages remain recoverable; results average three scenes and three attacker keys.Source: §D.3 · p. 18, Table 10 · p. 18
  • 93.92% member-key recovery follows two-copy averaging, while unrelated-key recovery is 46.88%; three-copy member-key recovery is 79.17%.The mixtures average per-Gaussian colors of differently keyed copies.Source: §D.3 · p. 18, Table 11 · p. 18
  • The copy-collusion comparison tests keys present in the mixture against an unrelated key, complementing wrong-key calibration.The evaluated mixtures use Lego, Hotdog, and Bonsai.Source: §D.3 · p. 18, Table 11 · p. 18

E.1 MULTI-SHELL VIEWS

Multi-shell viewpoint sampling reports high direct fidelity across sampled scenes, including views away from official test paths. The reported fidelity supports the spatial reach of the result.

E.1 MULTI-SHELL VIEWS

  • Every sampled scene stays above 38.7 dB direct PSNR and below 0.0060 LPIPS across multi-shell views.Table 12 reports direct fidelity under scene-specific two-shell sampling.Source: §E.1 · p. 18, Table 12 · p. 18
  • The multi-shell evaluation samples 37 to 158 viewpoints per scene in the ten-scene cross-method corpus.The sampled cameras include views away from official test paths.Source: §E.1 · p. 18
  • The authors interpret the multi-shell fidelity as supporting the spatial reach of the fidelity result.Source: §E.1 · p. 18

F.1 CARRIER ANGULAR GEOMETRY

The connectome-derived carrier is a deterministic, clustered set of 825 directions, with lower cap coverage than equal-count controls. Sensitivity tests on four development/validation scenes show recovery–fidelity trade-offs as embedding settings change.

F.1 CARRIER ANGULAR GEOMETRY

  • The carrier is reconstructed from all 3,335 expected MaleCNS photoreceptors, then exact duplicate collapse yields 825 distinct projected coordinates.The retained directions are clustered and nonuniform, and their construction is deterministic rather than scene-specific.Source: §F.1 · p. 19, Figure 6 · p. 19
  • 24.8% of uniformly sampled cap directions are covered by connectome-derived directions at their local half-spacing cone radius, versus 58.7% to 70.4% for equal-count controls.Table 13 compares geometric summaries over the same forward cap.Source: §F.1 · p. 19, Table 13 · p. 19

F.2 ONE-FACTOR SENSITIVITY

  • On four development/validation scenes, 16 bits are recovered perfectly and 64 bits retain 96.48%; a 0.04 color bound reaches 100% at 40.28 dB.These sensitivity settings use key 17 and change one factor from a frozen reference, unlike the ten-scene main estimate.Source: §F.2 · p. 19
  • Tighter color bounds raise PSNR and lower recovery; at least 12 orbit stops retain 97.66% clean bit accuracy, while smaller cones improve recovery and fidelity in this subset.Larger cones increase overlap among constraints in the joint solve.Source: §F.2 · p. 19

G TWO-DIMENSIONAL IMAGE EXTENSION

The image extension applies the retinal carrier and keyed QIM code to raster images, using bounded achromatic pixel edits. It evaluates marked and ownership-control images after PNG storage on BSDS500.

H ADDITIONAL FIXED-VIEW QUALITATIVE RESULTS

The additional qualitative comparisons show registered views for Lego, Hotdog, and Bonsai across four watermarking methods. They use matched cameras and crops, with per-frame accuracy and fidelity annotations.

Loading 2610.11364v1…