MutiNeRF: Multiple Watermark Embedding for Neural Radiance Fields

Yash Kulthe[1], Andrew Gilbert[1], John Collomosse[1,2]
University of Surrey[1], Adobe Research[2]
The Thirteenth International Conference on Learning Representations ICLR'25
1st Workshop on GenAI Watermarking
Paper Poster

MultiNeRF embeds multiple watermarks within the representation learned by a NeRF model (TensoRF) at training time. Watermarks are keyed by a unique ID specified at rendering time to trigger the embedding of the watermark into the image independent of the viewing position.

Abstract

We present MultiNeRF, a novel 3D watermarking method that enables the embedding of multiple uniquely keyed watermarks within images rendered by a single Neural Radiance Field (NeRF) model while maintaining high visual quality. Our approach extends the TensoRF NeRF model by incorporating a dedicated watermark grid alongside the existing geometry and appearance grids. This ensures higher watermark capacity without entangling watermark signals with scene content. We propose a FiLM-based conditional modulation mechanism that dynamically activates watermarks based on input identifiers, allowing multiple independent watermarks to be embedded and extracted without requiring model retraining. We validate MultiNeRF on the NeRF-Synthetic and LLFF datasets, demonstrating statistically significant improvements in robust capacity without compromising rendering quality. By generalizing single-watermark NeRF methods into a flexible multi-watermarking framework, MultiNeRF provides a scalable solution for securing ownership and attribution in 3D content.

MultiNeRF training process A learnable encoder transforms multiple distinct watermark IDs into compact embedding vectors. TensoRF is trained with a HiDDEN decoder module end-to-end with rendered images passing through differentiable noise augmentations. Perceptual and patch-based reconstruction losses balance visual quality against a message loss.

This table shows that MultiNeRF achieves a mean bit accuracy of 93.18\% on SYN outperforming both WateRF (91.51%) and NeRFProtector (90.81%); and like WaterRF saturates performance on LLLF at ~ 99\%. Whilst the noised variant (MultiNeRF-Noised) exhibits slightly lower bit accuracies in some scenes, this is traded for improved robustness. MultiNeRF generally achieves comparable quality and slightly higher accuracy at the single watermarking task.

This Figure presents the average bit accuracy across the SYN and LLFF datasets for varying numbers of unique watermarks per model. For SYN, WateRF-modified returns a random response (50% bit accuracy) for 32 watermarks and onwards versus MultiNeRF at 70% bit accuracy on 32 watermarks, which degrades to a random response at 64 watermarks. Similarly, for LLFF, we observe that both methods start with similar bit accuracies at 2 watermarks, with WateRF-modified dropping to random response at 32 watermarks, whilst MultiNeRF achieves 82% bit accuracy at 32 watermarks and 68% at 64 watermarks. The error bars confirm a significant bit accuracy improvement using MultiNeRF for the multiple watermarking task.

Poster

BibTeX

@inproceedings{Kulthe:Dear:ICLRWS:2025,
        AUTHOR = Kulthe, Yash and Gilbert, Andrew and Collomosse, John",
        TITLE = "MutiNeRF: Multiple Watermark Embedding for Neural Radiance Fields",
        BOOKTITLE = "International Conference on Learning Representations (ICLR'25) - The 1st Workshop on GenAI Watermarking, 2025",
        YEAR = "2025",
        }