Resolving Surrogate Target Ambiguity in Black-Box 3D Gaussian Splatting Watermark Attacks

Watermarking 3D Gaussian Splatting (3DGS) assets requires modifying selected Gaussian primitives. When watermark carriers are concentrated in a few spatial regions, those regions must carry more of the embedding burden, potentially requiring stronger local perturbations that degrade rendering fidelity. However, existing methods often lack explicit mechanisms for spatially balanced carrier allocation. In this paper, we introduce MPP-GS, a high-fidelity 3DGS watermarking framework with two stages. In carrier construction, Multi-Projection Packing (MPP) organizes Gaussians on a UV grid and assigns each Gaussian multiple candidate destinations, reducing congestion and overflow while producing a more balanced carrier. In watermark embedding, Complementary Pair Modulation (CPM) exploits this carrier to distribute parent–auxiliary pairs and coordinate their updates, reducing rendering interference while preserving decodability. Across three benchmarks (Blender, LLFF, and Mip-NeRF 360), MPP reduces average carrier overflow from 17.75% to 0.08%, retaining substantially more Gaussian primitives. Together, balanced carrier construction and low-interference watermark embedding enable MPP-GS to achieve higher rendering fidelity with comparable or better decoding accuracy across multiple payloads. At 64 bits, MPP-GS achieves 35.15 dB PSNR and 95.95% bit accuracy, compared with 32.79 dB and 91.17% for W2M. Code will be made publicly available on GitHub.