Steal part of a splat and the watermark comes with it
Figure: Qin et al., Zhejiang University (CC BY 4.0) · Research
Aug 19, 2026, 6:20 AM ETResearch
Hao Qin and colleagues at Zhejiang University have published NGS-Marker at ICLR 2026, a watermarking scheme that embeds an ownership message into gaussian primitives themselves rather than into the images they render.
Why it matters: A splat is an explicit list of primitives, which is most of what makes it convenient — and it means anyone can open a scene, select a region, and paste it into their own. The paper calls this partial infringement, and the example it opens with is a polar bear lifted out of one capture and dropped onto someone else's park bench.
Watermarking that operates on rendered images assumes two things that stop being true the moment that happens: that the whole scene gets reused, and that the distribution of rendered views stays roughly where it was.
The failure they measured: Three published 3DGS watermarking methods were run against partial infringement. 3D-GSW recovered 50.35% of the message bits, GaussianMarker 50.10%, GuardSplat 51.08%.
On a binary message, 50% is what you get by guessing. The protection was not degraded, it was absent.
By the numbers:
- NGS-Marker recovers 97.94% of bits and identifies 96.60% of primitives correctly at a 16-bit message, against 50–51% for the image-space baselines.
- Imperceptibility holds: 41.77 dB PSNR and 0.004 LPIPS between renders before and after watermarking at 8 bits.
- Trained on 24 public scenes with 4 held out, on two A100s; injection into a target scene runs on one.
- Gradient-based progressive injection spreads the mark across the whole scene, so ownership decodes from any local region rather than from designated patches.
- Survives densification, Gaussian noise, rotation, dropout and translation, which are applied as augmentations during training.
Yes, but: Distortion intensity in the robustness tests is capped, on the reasoning that an attacker who mangles the asset has destroyed the thing worth stealing. That is a fair argument and also a convenient one, and it leaves the harder adversary — someone who will accept visible damage to break a mark — untested.
The messages are short, 8 to 24 bits, which is enough to say whose it is and not much more. Bit accuracy slips as the message lengthens, though primitive-level accuracy holds up.
The big picture: Scanning services, asset marketplaces and capture studios are all now selling scenes that a buyer receives as a file full of primitives. The question of what stops the second buyer reselling a quarter of it has mostly been answered with a licence agreement.
There is an older precedent for where that goes. Image watermarking became infrastructure once stock photography became a business, not before.
