Fading the Digital Ink: A Universal Black-Box Attack Framework for 3DGS Watermarking Systems

2025-08-10

AI Summary

Existing robustness evaluations of 3D Gaussian Splatting (3DGS) watermarking systems are insufficient. Method: This paper proposes GMEA, the first general-purpose black-box attack framework for 3DGS watermark removal. GMEA employs multi-objective evolutionary optimization with a grouped search strategy and an indirect objective function—minimizing the standard deviation of convolutional features—to jointly optimize visual fidelity and watermark elimination without accessing model internals. Contribution/Results: GMEA achieves efficient, stealthy removal of both 1D and 2D watermarks embedded in mainstream 3DGS systems. Experiments demonstrate that it preserves high-quality rendering while substantially degrading copyright protection capability, exposing critical security vulnerabilities in current 3DGS watermarking schemes. By establishing a rigorous, model-agnostic benchmark, GMEA provides a foundational reference for future robustness enhancement and standardized evaluation of 3DGS watermarking.

Technology Category

• Computer Vision: Adversarial Attacks & Robustness
• Machine Learning: Adversarial Learning & Robustness
• Search and Optimization: Sampling/Simulation-based Search

Application Category

• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Security and Privacy: Large-scale security measurements
• Web Mining and Content Analysis: Robustness and generalizability of Web mining methods

Abstract

With the rise of 3D Gaussian Splatting (3DGS), a variety of digital watermarking techniques, embedding either 1D bitstreams or 2D images, are used for copyright protection. However, the robustness of these watermarking techniques against potential attacks remains underexplored. This paper introduces the first universal black-box attack framework, the Group-based Multi-objective Evolutionary Attack (GMEA), designed to challenge these watermarking systems. We formulate the attack as a large-scale multi-objective optimization problem, balancing watermark removal with visual quality. In a black-box setting, we introduce an indirect objective function that blinds the watermark detector by minimizing the standard deviation of features extracted by a convolutional network, thus rendering the feature maps uninformative. To manage the vast search space of 3DGS models, we employ a group-based optimization strategy to partition the model into multiple, independent sub-optimization problems. Experiments demonstrate that our framework effectively removes both 1D and 2D watermarks from mainstream 3DGS watermarking methods while maintaining high visual fidelity. This work reveals critical vulnerabilities in existing 3DGS copyright protection schemes and calls for the development of more robust watermarking systems.

Problem

• Assessing robustness of 3DGS watermarking against attacks
• Developing black-box attack to remove 1D/2D watermarks
• Balancing watermark removal with visual quality preservation

Innovation

• Group-based Multi-objective Evolutionary Attack (GMEA)
• Indirect objective function blinds watermark detector
• Group-based optimization partitions 3DGS models