1 Introduction↩︎

The rapid growth of social media and the accelerating pace of digital information exchange have intensified the demand for secure and covert communication. Steganography provides a critical security layer by hiding both the semantic content of a message and the very existence of the communication. Compared to encryption [1] which may draw suspicion due to its detectable nature, steganographic methods facilitate covert transmission by embedding secret data within ordinary media. Driven by deep neural networks, modern steganography [2]–[6] has evolved into a data-driven field capable of high-capacity embedding while preserving the natural statistics of the carrier [6].

As digital media evolve from 2D images to immersive 3D representations, 3D Gaussian Splatting (3DGS) [7] has emerged as a dominant paradigm. 3DGS is an information-rich medium favored for its real-time rendering capabilities and high fidelity. By utilizing differentiable rasterization [8], it enables accurate gradient back-propagation and stable rendering of complex scenes. These 3DGS assets carry dense geometric and appearance information, making them valuable intellectual property and ideal carriers for sensitive data. However, the open transmission of these assets across public platforms increases the risk of interception, necessitating steganographic techniques specifically designed for 3DGS to ensure secret scenes remain indistinguishable from ordinary content.

To address this challenge, existing 3DGS steganographic methods such as GS-Hider [9] and SecureGS [10] attempt to embed one 3DGS scene within another. However, they still depend on scene-specific optimization to conceal information. This dependency creates a rigid coupling between the model and a fixed set of scenes, preventing the system from adapting to unseen assets without extensive retraining. In practical applications, this restriction poses a severe security risk. If a steganographic system is limited to a predictable set of cover scenes, an adversary can more easily monitor and detect anomalies. Furthermore, the need to retrain the network for every new secret scene incurs prohibitive computational costs and introduces significant latency, rendering real-time covert communication infeasible. Therefore, developing a generalizable steganographic approach that functions across diverse 3DGS scenes is of critical importance for the field.

In this paper, we propose IBRSteG, a generalizable framework for 3DGS steganography that achieves undetectable concealment of secret scenes. Unlike existing approaches whose parameter generation is rigidly coupled with the specific scenes, we treat 3D steganography as a feed-forward embedding process that draws inspiration from Image-Based Rendering (IBR) principles to ensure cross-scene compatibility (Fig. 1). To achieve this, we introduce Gaussian Attributes Steganographer (GAS), a neural network that learns a scene-agnostic embedding function. GAS processes the Gaussian Attribute Maps (GAM) of secret scenes and integrates them into the GAM of a cover scene. This design allows steganographic scenes to be reconstructed directly without any scene-specific fine-tuning. The GAM provides a structured representation of 3D Gaussian attributes, including depth, color, rotation, and opacity. By operating on these structured 2D maps, GAS directly leverages the generalization properties of 2D convolutional architectures. This strategy encourages the model to learn universal embedding patterns rather than memorizing the geometry of specific scenes. Both the embedding and extraction processes are fully differentiable, enabling end-to-end supervised training across diverse datasets. Extensive experiments on DyNeRF [11], ENeRF [12], DTU [13] and THuman_MV [14] datasets demonstrate that IBRSteG can effectively conceal different scenes with high visual quality. In addition, IBRSteG exhibits strong resilience against steganalysis, and its substantial embedding capacity indicates the potential for concealing multiple secret scenes within a single cover. We also analyze the inherent capacity-fidelity trade-off under extreme payloads.

Our contributions can be summarized as follows:

• We propose IBRSteG, a generalizable 3DGS steganographic framework that enables the concealment of diverse secret scenes within diverse cover scenes without retraining.

• We design GAS, a scene-agnostic network that learns a generalizable embedding and extraction function by operating on structured Gaussian Attribute Maps (GAM), enabling feed-forward reconstruction of steganographic scenes without per-scene finetuning.

• We demonstrate through extensive experiments that our method achieves superior performance in terms of visual quality, capacity, and security across multiple 3D datasets.

2 Related Work↩︎

2.1 3D Gaussian Splatting↩︎

3D Gaussian Splatting (3DGS) [7] has emerged as a powerful paradigm for explicit 3D scene representation, utilizing a set of 3D anisotropic Gaussians to represent the scene geometry and appearance [15], [16]. Unlike implicit representations [17]–[19], 3DGS enables real-time rendering while maintaining high visual fidelity through a rasterization-based pipeline. To scale these generative capabilities to expansive environments, GaussianCity [20] introduces a generative 3DGS framework for unbounded 3D city generation. Recently, several works have explored generalizable 3DGS to achieve novel view synthesis across unseen scenes without per-scene optimization. PixelSplat [21] and MVSGaussian [22] predict Gaussian primitives directly from pixel-wise features or cost volumes in a feed-forward manner. GPS-Gaussian [23] introduces a depth-aware formulation to regress 3D Gaussian parameters directly from 2D image features for human novel view synthesis. Building upon this, GPS-Gaussian+ [14] further enhances performance by enabling robust rendering from sparse views in real-time human-background interactions.

2.2 Image Steganography↩︎

Steganography aims to embed secret messages into cover media while maintaining perceptual indistinguishability. Traditional methods primarily modify spatial or transform domains based on heuristic rules, including Least Significant Bit (LSB) substitution [24], Picture Quality Optimization [25], and coefficient modification in DCT [26] or DWT [27] domains. However, these heuristics often introduce statistical anomalies detectable by steganalysis [28], [29]. In contrast, Deep Neural Network (DNN) based approaches leverage end-to-end adversarial optimization to better preserve image statistics. Early works utilized GANs [2], [30] or encoder-decoder architectures [3], [6] for high-capacity hiding [31]. Recent advances employ Invertible Neural Networks (INNs) [4], [5], [32] to ensure lossless information flow or encode secrets into high-frequency residuals. Concurrently, deep learning-based video steganography has also been explored [33]–[36], leveraging temporal coherence and redundancy for concealed message embedding. Despite their success in the images or video domains, extending these capabilities to complex 3D representations remains a significant challenge.

2.3 Steganography for 3D Scenes↩︎

With the popularity of 3D assets, steganography of 3D scene representations has attracted significant attention. For implicit representations [17], existing works have explored embedding information into the network weights or color representations [37]–[39]. Recent studies further migrate watermarks from multi-view images to radiance fields via frequency modulation [40], or improve robustness with codebook-aided NeRF signatures [41]. As for 3DGS, recent methods have focused on embedding watermarks into Gaussian Splatting for copyright protection [42]–[44]. However, these watermarking methods offer limited payload capacity, which makes them insufficient for steganographic tasks that require concealing entire 3D scenes. To address this, as a pioneering work, GS-Hider [9] embeds messages into 3DGS by leveraging coupled secured feature attributes. Building on this, SecureGS [10] enhances security and fidelity by refining the embedding strategy. KeySS [45] introduces an explicit key-secured mechanism for protecting 3D secrets within 3DGS, while InstantSplamp [46] explores a generalizable generative 3D Gaussian steganography setting. Despite these advances, current approaches typically lack generalizability, as they require training a scene-specific encoder for each scene. They cannot adapt to new 3DGS assets without retraining, which severely limits their practical deployment in real-world scenarios.

3 Method↩︎

3.1 Preliminary↩︎

3D Gaussian Splatting (3DGS) represents a 3D scene as a collection of anisotropic 3D Gaussians. Each Gaussian is defined by a center position \(\mu \in \mathbb{R}^3\) and a covariance matrix \(\Sigma \in \mathbb{R}^{3 \times 3}\). The spatial influence of a Gaussian at position \(x\) is defined as: \[G(x) = \exp\left(-\frac{1}{2}(x - \mu)^\top \Sigma^{-1} (x - \mu)\right). \label{eq:gaussian95def}\tag{1}\] To ensure the covariance matrix \(\Sigma\) remains positive semi-definite during optimization, it is decomposed into a scaling matrix \(\Lambda\) and a rotation matrix \(R\) via \(\Sigma = R \Lambda \Lambda^\top R^\top\).

During the rendering process, 3D Gaussians are projected onto the 2D image plane. Given the viewing transformation matrix \(W\) and the Jacobian \(J\) of the affine approximation of the projective transformation, the 2D covariance matrix \(\Sigma'\) is computed as \(\Sigma' = J W \Sigma W^\top J^\top\). The final pixel color \(I\) is computed using differentiable \(\alpha\)-blending of the \(N\) ordered Gaussians overlapping the pixel: \[I = \sum_{i \in \mathcal{N}} c_i \alpha_i \prod_{j=1}^{i-1} (1 - \alpha_j), \label{eq:rendering}\tag{2}\] where \(c_i\) is the view-dependent color computed from Spherical Harmonics (SH) coefficients, and \(\alpha_i\) is the opacity derived from the learned opacity parameter and the spatial probability of the 2D Gaussian.

3.2 Problem Formulation↩︎

A 3DGS steganographic system is designed to conceal a secret 3DGS scene within a cover scene while ensuring its subsequent recovery. Formally, the system \(\{\mathbf{F}_E,\mathbf{F}_D\}\) is defined by two core functions: \[\begin{align} &\text{Encode:} \quad S = \mathbf{F}_E(C, m), \\ &\text{Decode:} \quad R = \mathbf{F}_D(S), \end{align}\] where the encoder \(\mathbf{F}_E\) embeds the secret 3DGS scene \(m\) into the cover 3DGS scene \(C\) to produce a stego scene \(S\), and the decoder \(\mathbf{F}_D\) extracts the hidden 3DGS scene \(R\) from \(S\).

Scene-Specific Steganography Formulation. Existing methods [9], [10] typically rely on fixed pairs of cover and secret scenes \((S_c, S_m)\) during both training and inference. This dependence leads to scene-specific optimization that limits generalization: \[\label{eq:fixed32formulation} S = \mathbf{F}_{E}^{(S_c, S_m)}(C, m), R = \mathbf{F}_{D}^{(S_c, S_m)}(S),\tag{3}\] where the superscript \((S_c, S_m)\) indicates that both the encoder \(\mathbf{F}_E^{(S_c, S_m)}\) and decoder \(\mathbf{F}_D^{(S_c, S_m)}\) are specifically optimized for the fixed cover scene \(S_c\) and secret scene \(S_m\), i.e., \[(\mathbf{F}_E^{(S_c, S_m)},\mathbf{F}_D^{(S_c, S_m)}) \;\neq (\mathbf{F}_E^{(S_c', S_m')},\mathbf{F}_D^{(S_c', S_m')}).\] This formulation highlights the lack of generalization to unseen scenes, necessitating retraining for each new secret–cover scene pair \((S_c,S_m)\). Such a constraint restricts the pool of viable cover scenes and compromises security, as the embedding process is confined to a small, fixed set of candidates. Furthermore, it imposes a significant computational burden, as the model requires re-optimization upon the introduction of any new secret scene \(S_m'\).

Proposed Generalizable Steganography Formulation. In contrast, we propose a generalizable 3DGS steganography framework capable of operating on unseen cover–secret scene pairs \((C,m)\) without retraining. Rather than optimizing scene-specific models, we train a unified encoder-decoder pair shared across all scenes: \[\label{eq:general32formulation} \begin{align} S &= \mathbf{F}_E(C, m;\,\theta_E), \\ R &= \mathbf{F}_D(S;\,\theta_D), \end{align}\tag{4}\] where \((C,m)\sim\mathcal{D}\) denotes a cover–secret 3DGS scene pair sampled from a diverse scene distribution \(\mathcal{D}\), and \(\theta_E,\theta_D\) are scene-agnostic parameters shared across all pairs. Only the party possessing these specific parameters can accurately extract the hidden 3DGS scene from the stego scene.

This generalizable formulation offers distinct advantages. First, a single encoder-decoder pair \(\{\mathbf{F}_E,\mathbf{F}_D\}\) operates on diverse scene pairs \((C,m)\), eliminating the need for repeated optimization and retraining per scene, thereby significantly reducing computational costs. Second, the flexibility to employ diverse cover scenes \(C\in\mathcal{D}\) enhances security, as the embedding process is not bound to a restricted, predictable set of scenes. Finally, it facilitates practical deployment, as the system can handle unseen content \((C,m)\notin\mathcal{D}_{\text{train}}\) without retraining, making 3D steganography more scalable and reliable in real-world settings.

3.3 Generalizable 3DGS Steganography Framework↩︎

As discussed in Sect. 3.2, generalizable steganography requires a framework capable of processing unseen secret and cover scenes. To achieve this, we propose IBRSteG, a feed-forward generalizable framework for 3DGS steganography, as illustrated in Fig. 2. The framework initiates by reconstructing the cover and secret scenes from dual-view images. These reconstructed 3DGS scenes are then mapped into Gaussian Attribute Maps (GAM) via a mapping function \(M\), which establishes a structured 2D attribute representation for each scene. These GAMs are compatible with 2D learning paradigms and leverage their structured nature to enhance generalization across unseen scenes. On top of this representation, we introduce Gaussian Attributes Steganographer (GAS), which operates directly in the GAM domain to perform both the embedding of secret scenes into cover scenes and the subsequent extraction of the hidden secret 3DGS content.

Mapping between 3D Gaussians and GAM. Formally, given a 3DGS scene \(m\), the mapping process is defined as: \[G_m = \mathcal{M}(m)= \{D(m), C(m), R(m), O(m)\},\] where \(\mathcal{M}(\cdot)\) is the mapping function that converts the input 3DGS scene \(m\) into the corresponding GAM \(G_m\). Here, \(D(m)\), \(C(m)\), \(R(m)\), and \(O(m)\) correspond to the attribute maps encoding depth, color, rotation (represented in quaternion form), and opacity, respectively.

Specifically, the framework performs structured 3DGS scene reconstruction for both cover and secret scenes, avoiding direct manipulation of unstructured native 3DGS assets. We employ a pretrained generalizable 3D reconstruction model [14] to predict GAMs from dual-view images, with all network parameters frozen during training. From the predicted GAM, the corresponding 3D Gaussian representation is explicitly derived. Formally, given a pixel coordinate \(x\) and its associated depth value \(D(x)\) in the GAM, the 3D position of a Gaussian primitive \(X\) is obtained via an inverse projection function: \[X = \Pi^{-1}(P, x, D(x)),\] where \(P\) denotes the camera intrinsic and extrinsic parameters, and \(\Pi^{-1}\) denotes the inverse projection transformation that lifts 2D coordinates into 3D space.

Unlike traditional 3DGS that produces an unordered point cloud with variable density, our framework adopts a pixel-aligned representation. Each pixel \(x\) in the GAM stores the surface depth \(D(x)\) of the first ray intersection and deterministically corresponds to exactly one Gaussian primitive. This grid-structured formulation avoids ambiguities caused by multi-hit rays or varying primitive counts. We denote this deterministic reconstruction from the 2D GAM to 3D Gaussian primitives as the inverse mapping \(\mathcal{M}^{-1}\).

Accordingly, we define the representation mapping \(\mathcal{M}\) as the process of indexing 3D Gaussian primitives back to their originating GAM, i.e., \(\mathcal{M} : m \rightarrow G_m\), where each Gaussian center \(\mathbf{X}\) is uniquely associated with a pixel coordinate \(x\) under the camera projection \(P\). This one-to-one correspondence enables seamless attribute embedding and accurate recovery of the secret 3DGS from the steganographic GAM. From a security perspective, the camera parameters \(P\) also serve as a compact geometric key. Even if the decoder output GAM were exposed, reconstructing a coherent 3D secret still requires the exact pre-shared intrinsics and extrinsics for the inverse mapping \(\mathcal{M}^{-1}\). ¹

Gaussian Attributes Steganographer (GAS) Network. Leveraging the structured GAM representation of the 3DGS scene, we introduce the Gaussian Attributes Steganographer (GAS). By operating in this structured attribute domain, GAS learns a scene-agnostic embedding and extraction function that generalizes across unseen cover and secret scenes. This module comprises an encoder and a decoder. The encoder fuses the cover and secret GAMs to generate a steganographic GAM, which is subsequently mapped back to a 3DGS representation through the inverse mapping \(\mathcal{M}^{-1}\). The decoder extracts the secret GAM from the steganographic GAM, which is then transformed back into the original secret 3DGS scene.

The encoder of GAS accepts the cover and secret GAMs as inputs. A U-Net backbone [47] extracts multi-level features from the inputs and feeds them into four parallel multi-layer convolutional subnetworks: the Depth head, Color head, Rotation head, and Opacity head. Specifically, a residual connection [48] is employed, adding the depth feature map of the cover GAM to the output of the Depth head. This design incentivizes the Depth head to learn a residual refinement of the cover depth, rather than predicting depth values from scratch. The outputs of the four heads are then combined to form the steganographic GAM. This embedding process is formalized as: \[\begin{align} \text{Embedding}:G_s = \mathbf{F}_{E}(G_c, G_m), \quad S = \mathcal{M}^{-1}(G_s), \end{align}\] where \(G_c\) and \(G_m\) are the Gaussian Attribute Maps (GAM) of the cover and secret scenes, respectively. \(G_s\) denotes the output stego GAM, and \(S\) denotes the stego 3DGS. \(\mathcal{M}^{-1}\) represents the inverse mapping that reconstructs the stego 3DGS \(S\) from \(G_s\).

The decoder of GAS takes the stego GAM as input and utilizes a straightforward multi-layer convolutional neural network to output the recovered GAM. The inverse mapping \(\mathcal{M}^{-1}\) is then applied to reconstruct the secret 3DGS scene, completing the extraction process. This secret extraction process is formalized as: \[\begin{align} &G_s=\mathcal{M}(S),\\ \text{Extraction}:\quad &G_r = \mathbf{F}_{D}(G_s),\\ &R = \mathcal{M}^{-1}(G_r), \end{align}\] where \(G_r\) is the output recovered GAM, and \(R\) is the recovered 3DGS. Both the decoder and head modules employ the ReLU activation function and instance normalization [49].

IBRSteG is trained in an end-to-end framework that receives multi-view posed images from diverse scenes. This training strategy exposes the network to a wide range of geometric and appearance variations, rather than fixed pairs of cover and secret scenes. As a result, the model learns a generalizable embedding and extraction function applicable to diverse 3DGS scenes, independent of scene-specific optimization.

3.4 Loss Function↩︎

3D Loss. Adhering to the multi-view training protocol, we supervise both the stego and secret scenes using images rendered from multiple viewpoints. For each view, we jointly optimize appearance fidelity and geometric consistency through image-level and geometry-level supervision. Specifically, we employ a combination of pixel-wise reconstruction loss and structural similarity loss on the rendered RGB images.

For the embedding stage, the loss is defined as: \[\begin{align} \mathcal{L}_{\text{emb}} = &\;\lambda_{\text{mae}} \cdot \ell_{1}\!\left(I^{S}_{\text{pred}}, I^{C}_{\text{gt}}\right) + \lambda_{\text{ssim}} \cdot \ell_{\text{SSIM}}\!\left(I^{S}_{\text{pred}}, I^{C}_{\text{gt}}\right) \\ &\;+ \lambda_{\text{chamfer}} \cdot \mathcal{L}_{\text{CD}}(S), \end{align}\] where \(I^{S}_{\text{pred}}\) denotes the rendered RGB images of the steganographic 3DGS, and \(I^{C}_{\text{gt}}\) denotes the corresponding ground-truth images of the cover scene. The geometric alignment loss \(\mathcal{L}_{\text{CD}}\) is formulated as the Chamfer distance between the sets of 3D Gaussian points reconstructed from the left- and right-view GAMs, enforcing spatial consistency across dual perspectives.

Similarly, for the extraction stage, the loss is defined as: \[\begin{align} \mathcal{L}_{\text{ex}} = &\;\lambda_{\text{mae}} \cdot \ell_{1}\!\left(I^{R}_{\text{pred}}, I^{m}_{\text{gt}}\right) + \lambda_{\text{ssim}} \cdot \ell_{\text{SSIM}}\!\left(I^{R}_{\text{pred}}, I^{m}_{\text{gt}}\right) \\ &\;+ \lambda_{\text{chamfer}} \cdot \mathcal{L}_{\text{CD}}(R), \end{align}\] where \(I^{R}_{\text{pred}}\) denotes the rendered RGB images of the recovered secret 3DGS, and \(I^{m}_{\text{gt}}\) denotes the ground-truth images of the secret scene.

The Chamfer distance enforces cross-view geometric consistency by minimizing the bidirectional distance between the corresponding Gaussian point sets. The weighting coefficients \(\lambda_{\text{mae}}\), \(\lambda_{\text{ssim}}\), and \(\lambda_{\text{chamfer}}\) modulate the relative contributions of appearance reconstruction and geometry alignment.

Finally, the 3D training objective is given by: \[\mathcal{L}_{\text{3D}} = \mathcal{L}_{\text{emb}} + \mathcal{L}_{\text{ex}}.\]

2D GAM Loss. Supplementing the rendering-based supervision, we impose a 2D loss directly within the Gaussian Attribute Map (GAM) domain to further regularize the embedding and extraction processes. This loss promotes consistency at the attribute level. Specifically, for the embedding stage, we define a GAM reconstruction loss between the steganographic GAM \(G_s\) and the cover GAM \(G_c\). For the extraction stage, a similar loss is imposed between the recovered GAM \(G_r\) and the secret GAM \(G_m\). The GAM loss is a weighted sum of attribute-wise reconstruction errors over depth, color, rotation, and opacity, denoted compactly as \(\mathcal{L}_{\text{GAM}}(\cdot,\cdot)\).

The resulting 2D GAM loss is defined as: \[\mathcal{L}_{\text{2D}} = \lambda_{\text{emb}} \cdot \mathcal{L}_{\text{GAM}}(G_s, G_c) + \lambda_{\text{ex}} \cdot \mathcal{L}_{\text{GAM}}(G_r, G_m),\] where \(\lambda_{\text{emb}}\) and \(\lambda_{\text{ex}}\) balance the contributions of the embedding and extraction stages, respectively.

Total Objective. The final training objective combines the rendering-based 3D loss and the 2D GAM loss. Specifically, the overall loss is defined as: \[\mathcal{L}_{\text{total}} = \mathcal{L}_{\text{3D}} + \lambda_{\text{2D}} \cdot \mathcal{L}_{\text{2D}}.\]

4 Experiments↩︎

In this section, we first describe the experimental setup, including datasets, evaluation metrics, implementation details, and baseline methods used for comparison. We then evaluate the fidelity of our methods in Sec. 4.2, followed by an analysis of its high-capacity hiding performance in Sec. 4.3. We further examine the security of our method against potential detection and steganographic analysis in Sec. 4.4, and analyze its robustness under geometric degradation in Sec. 4.5. Finally, we provide ablation studies in Sec. [sec:ablation] to validate the design choices of our approach.

4.1 Experimental Setups↩︎

Datasets. To evaluate generalization across diverse scene configurations, we adopt four widely-used datasets: DyNeRF [11], ENeRF [12], THuman_MV [14] and DTU [13], aligning with the generalizable method GPS-Gaussian+ [14]. DyNeRF [11] provides four motion sequences of 300 frames each, where the first 220 frames are used for training and the remaining frames are used for testing. ENeRF [12] provides four motion sequences for training and two sequences of unseen human-background scenes for testing. THuman_MV [14] provides 15 sequences in total, with 10 training sequences and 5 unseen testing sequences. DTU [13] provides a variety of non-human-centric indoor environments, from which 4 scenes are selected for testing. All images are standardized to 1K resolution.

Evaluation Metrics. Following existing works [11], [12], [14], [42], we evaluated the experimental results using Peak Signal-to-Noise Ratio (PSNR), Structural Similarity Index (SSIM) [51], and Learned Perceptual Image Patch Similarity (LPIPS) [52]. PSNR measures pixel-level differences between a reference and a processed image, while SSIM [51] evaluates perceived degradation by comparing structural information, luminance, and contrast. LPIPS [52] is a learned metric that quantifies perceptual similarity between image patches using calibrated deep features.

Implementation Details. We set \(\lambda_\text{2D}\), \(\lambda_\text{emb}\) and \(\lambda_\text{ex}\) as 0.4, 1 and 0.75 respectively. In \(Loss_\text{3D}\), we set hyperparameters \(\lambda_\text{mae}\), \(\lambda_\text{ssim}\), and \(\lambda_\text{chamfer}\) as 0.8, 0.5 and 0.2. For the Mapping module, we follow the implementation of [14]. The model was trained for 100,000 iterations using the Adam optimizer [53] with an initial learning rate of 1e-4 and batch size of 2. The learning rate was decayed by a factor of 0.1 every 20,000 iterations, and a weight decay of 1e-5 was applied. All experiments were conducted on an RTX 3090 GPU.

Compared Methods. We conduct quantitative experiments with two groups of baselines to comprehensively evaluate the transferability of existing 3D model steganography and the migration potential of 2D steganography methods. (1) Decoder Methods. Most existing 3DGS and NeRF watermarking and steganographic approaches [37], [38], [42], [43], [46], [54] employ an additional image-space decoder to recover hidden information from rendered views. As a representative example, StegaNeRF [37] extracts secrets via a decoder operating on rendered images, and we denote it as “Gaussian + StegaNeRF”. Recent 3DGS watermarking methods such as GaussianMarker [54] also follow this decoder-based paradigm, but are restricted to low-capacity, bit-level payloads and are therefore not suitable for concealing full 3D scenes. (2) 2D Steganography Methods. To examine whether the performance gains arise from the proposed GAS, rather than from merely operating on GAM representations, we construct a diagnostic baseline by directly migrating a representative 2D steganographic model proposed by Weng et al. [50] to the GAM domain, replacing the GAS module in our pipeline. This baseline reflects a naive extension of 2D steganography to 3D attributes, and we denote this category as “Gaussian + Weng et al”.

To ensure a fair and rigorous comparison, all baseline models are implemented with the same capacity constraints, unified decoder architectures, and identical hyperparameters and optimization schedules as our IBRSteG framework.

4.2 Main Results↩︎

We assess the visual quality of rendered images for both the stego scene and the recovered secret scene. Experiments are conducted on three diverse datasets, including THuman_MV [14], ENeRF [12], and DyNeRF [11], to comprehensively evaluate the steganographic performance and generalizability of IBRSteG. We compare our method against Gaussian + StegaNeRF [37] and Gaussian + Weng et al [50]. We additionally report the reconstruction quality of GPS-Gaussian+ [14], the current state-of-the-art (SOTA) for generalizable 3D Gaussian Splatting, without steganographic embedding. This serves as a “Vanilla Upper Bound" and acts as a reference baseline to rigorously evaluate the effect of steganographic embedding on visual quality. The quantitative results are summarized in Table. 1, and the qualitative visual comparisons are presented in Fig. 3.

As shown in Table. 1, IBRSteG consistently achieves superior hiding and recovery performance across all datasets without scene-specific tuning, demonstrating strong generalizability. On THuman_MV [14], our method attains a stego PSNR of 32.98 dB and a recovered PSNR of 32.40 dB, which are very close to the reconstruction quality obtained by directly applying GPS-Gaussian+ [14] without steganographic embedding (33.05 dB). This small gap indicates that embedding an entire 3D scene has only a limited impact on visual quality. In contrast, Gaussian + StegaNeRF [37] shows a clear imbalance between hiding and recovery. While the stego scene maintains reasonable visual quality, the recovered secret suffers a substantial degradation, with PSNR dropping to 17.77 dB. Similarly, Gaussian + Weng et al [50] is constrained by the inability of 2D-based methods, leading to poor visual fidelity for both the stego and recovered scenes (e.g., Cover PSNR of 14.65 dB on THuman_MV [14]) The same trends persist on the more challenging ENeRF [12] and DyNeRF  [11] datasets. On ENeRF [12], IBRSteG achieves a Cover PSNR of 20.94 dB, which is comparable to the quality of direct GPS-Gaussian+ [14] reconstruction without embedding (20.93 dB), while Gaussian + StegaNeRF [37] and Gaussian + Weng et al [50] degrades significantly. On DyNeRF [11], although a gap to direct reconstruction remains, IBRSteG still preserves substantially higher visual quality for both cover and secret scenes. Overall, these results indicate that IBRSteG learns a scene-agnostic embedding function that remains robust across diverse 3DGS scenes, whereas existing methods are more sensitive to domain shifts.

To further evaluate the broader applicability of our approach beyond human-centric domains, we extend our experiments to the widely used DTU [13] dataset, which features a variety of complex, non-human-centric indoor scenes. As shown in Table 2, IBRSteG consistently maintains high fidelity for stego scenes (e.g., 25.40 dB Cover PSNR on ‘Bricks’, close to upper bound) while ensuring reliable secret recovery. In contrast, existing baselines fail to balance these objectives effectively; Gaussian + StegaNeRF [37] suffers severe degradation in secret recovery, and Gaussian + Weng et al [50] experiences comprehensive quality drops across both cover and recovered images. These results further corroborate that IBRSteG can effectively generalize to diverse indoor environments without compromising the delicate balance between steganographic imperceptibility and recovery accuracy.

Fig. 4 provides qualitative comparisons on the challenging DTU [13] dataset. IBRSteG consistently preserves complex geometries with noticeably fewer artifacts, achieving stego scenes nearly indistinguishable from the clean Vanilla Upper Boundreconstructions. Conversely, Gaussian + StegaNeRF [37] introduces noticeable blurring in recovered scenes, while Gaussian + Weng et al [50] exhibits severe geometric distortions. These results confirm the strong generalizability of our approach in non-human-centric environments.

4.3 Performance Under High capacity↩︎

Setting. To evaluate the payload capacity, we conduct experiments on the THuman_MV [14] dataset by embedding multiple secret scenes (ranging from 2 to 5) into a single cover scene. We utilize a Multi-Channel output configuration to simultaneously recover all secret scenes. Under this setting, each hidden scene is assigned to a pre-defined segment of output channels, establishing an implicit channel indexing mechanism. This allows the decoder to deterministically disambiguate and reconstruct multiple payloads in a single feed-forward pass. We report the metrics for the stego cover scene and the average metrics of the recovered secret scenes.

Hiding two/three secret scenes. We first compare our method against the baselines when embedding two and three secret scenes, with quantitative results summarized in Table. 3 and visual examples shown in Fig. 5. As the payload increases, IBRSteG consistently preserves high visual quality for both the stego scene and the recovered secret scenes. When embedding two secret scenes, IBRSteG maintains a stego PSNR of 32.70 dB and an average recovered PSNR of 31.07 dB, indicating that increasing the payload does not significantly compromise reconstruction quality. In contrast, baselines suffer a pronounced degradation. Similar trends are observed when embedding three secret scenes. Despite the higher payload, IBRSteG continues to produce stable reconstructions for both cover and secret scenes. These results suggest that the proposed IBRSteG effectively disentangles multiple scene representations during high-capacity embedding, while conventional methods are more susceptible to interference among dense 3D features.

Hiding \(\geq 4\) secret scenes. To push the limits of our framework, we further increase the payload to \(\geq 4\) secret scenes. As shown in Table. 4 and visualized in Fig. 6, IBRSteG remains acceptable even under this extreme load. With four secret scenes, we achieve a stego PSNR of 31.76 dB and a recovered PSNR of 28.94 dB. When embedding five distinct secret scenes into a single cover, the stego PSNR and recovered PSNR are 28.63 dB and 24.77 dB. This performance reflects a capacity-fidelity trade-off under extreme payloads. Despite the numerical degradation, the structural integrity of the recovered scenes remains identifiable. These results demonstrate the high-capacity potential of our method while outlining its practical boundaries.

3pt

4.4 Steganographic Security↩︎

To evaluate the security of our method against steganalysis, we conduct anti-steganography detection experiments using StegExpose [55], following the same protocol as prior work [5], [9], [56]. Specifically, the detection set is constructed by mixing rendered images from the stego scenes and the corresponding non-embedded reference scenes with equal proportions. StegExpose [55] is then applied to this mixed set to distinguish stego images from non-stego ones.

We vary the detection threshold of StegExpose over a wide range and report the corresponding Receiver Operating Characteristic (ROC) curve in Fig. 7. In the ideal case, a secure steganographic method should yield a detection performance close to random guessing, where the true positive rate equals the false positive rate and the Area Under the Curve (AUC) approaches 0.5. As shown in Fig. 7, the ROC curve of our method closely follows the diagonal line, with an AUC of 0.486, indicating that StegExpose fails to reliably distinguish stego images from non-stego ones. These results suggest that the rendered images produced by our method exhibit strong resistance to classical image-based steganalysis.

Following prior work [5], [50], we further evaluate the undetectability of our method under learning-based steganalysis, which measures how many stego samples are required for a deep detector to reliably distinguish stego scenes from cover scenes. Specifically, we adopt a state-of-the-art model Zhu-Net [57] as the steganalysis model and progressively increase the number of training image pairs available to the attacker.

We conduct two groups of experiments under different testing conditions. In the first setting (same-domain), the steganalysis model is trained on rendered cover-stego image pairs generated from the THuman_MV [14] dataset and evaluated on unseen scenes from the same dataset. As shown in the left of Fig. 8, our method consistently exhibits lower detection accuracy compared to baseline methods. Notably, Zhu-Net requires more than 150 image pairs to achieve reliable detection performance (above 90%), whereas competing baselines can be detected with substantially fewer samples. This indicates that stego images produced by our method are significantly harder to learn and classify, even when the attacker operates within the same data domain.

In the second setting (cross-domain), the steganalysis model is still trained on THuman_MV [14]-generated image pairs but tested on stego images rendered from the ENeRF dataset [12], which differs notably in scene structure and appearance. As shown in the right of Fig. 8, the detection accuracy remains close to random guessing (around 50%) across all training sample sizes. This suggests that steganalysis models trained on one dataset fail to generalize to stego images from a substantially different 3D scene distribution, which shows that our method maintains strong security guarantees under realistic deployment conditions. These results show that our method exhibits strong resistance to learning-based steganalysis.

Beyond image-based evaluation, exploring detection approaches directly in the 3D attribute domain is an important consideration, although dedicated 3DGS steganalysis methods are currently scarce. To assess security in this domain, we conduct a statistical analysis of the native 3D Gaussian attributes. Excluding the unaltered scale and numerically normalized rotation attributes, we focus on measurable deviations in RGB, depth, and opacity.

As summarized in Table ¿tbl:tab:enerf95dtu95transfer?, we derive optimal detection thresholds based on the mean and 95th percentile (q95) of these attributes using cover and stego scenes from the ENeRF dataset [12]. We then evaluate the accuracy of this statistical detector on the unseen DTU dataset. While attributes such as RGB and opacity exhibit numerical deviations on the source dataset, these statistical thresholds fail to generalize. When applied to the DTU [13] dataset, the detection accuracy for most metrics collapses to random guessing. The highest cross-dataset transferability achieved is merely 60% for the opacity q95 statistic. This severe performance drop demonstrates that such statistical differences are highly dataset-dependent rather than indicative of generalized steganographic artifacts.

Overall, our empirical results demonstrate that our proposed method exhibits strong resistance to both 2D image-based steganalysis and 3D statistical detection.

4pt max width=

4.5 Robustness Under Geometric Degradation↩︎

To assess the robustness of IBRSteG, we experiment under geometric degradation via random pruning. Specifically, we randomly remove 5% to 20% of the Gaussians from the stego scene and evaluate the subsequent recovery quality. As summarized in Table 5, IBRSteG exhibits resilience to this degradation; even with 20% of the Gaussian points discarded, the secret scenes can still be recovered with acceptable visual fidelity. These results suggest that the embedded steganographic information is distributed across the Gaussian primitives rather than being concentrated in a few points, providing a degree of tolerance against random pruning. Furthermore, we conduct additional evaluations against four other types of perturbations: resplatting, compression, quantization, and spatial cropping. IBRSteG achieves promising robustness under these conditions as well, with comprehensive results detailed in Appendix B.

4.6 Comparison with Non-Generalizable Approaches↩︎

GS-Hider [9], SecureGS [10], and KeySS [45] are representative 3DGS [7] steganography methods operating under a scene-specific training paradigm. These methods necessitate time-consuming retraining or optimization for each fixed cover-secret scene pair, which fundamentally differs from the generalizable steganography setting considered in our work. To further highlight this architectural distinction, we quantitatively compare the computational cost and reconstruction quality, as reported in Table ¿tbl:tab:reply95dtu95thu95compare952?. On an NVIDIA RTX 3090 GPU, training a GS-Hider [9] model for a single scene pair takes approximately 2.5 hours, while the KeySS [45] baseline requires 7.6 hours per scene. In contrast, our proposed generalizable model executes the entire end-to-end process in approximately two seconds per scene without requiring any scene-specific optimization. It is important to clarify that this two-second execution time accounts for the complete pipeline, which fully encompasses the reconstruction of Gaussian Attribute Maps (GAM) from dual-view images. Furthermore, quantitative results on the THuman_MV [14] dataset indicate that IBRSteG achieves a secret recovery PSNR of 32.40 dB and an SSIM of 0.958, outperforming the optimization-based baselines in recovery fidelity while maintaining a competitive stego SSIM of 0.960. This substantial gap in runtime, combined with the quantitative rendering quality across both image pairs, demonstrates the efficiency and effectiveness of our method for practical applications.

3pt max width=

4.7 Ablation Studies on Loss Design↩︎

We evaluate the necessity of the proposed 3D loss \(\mathcal{L}_{3D}\) and 2D GAM loss \(\mathcal{L}_{2D}\) in Sec. 3.4 by removing each component from the full objective. Without \(\mathcal{L}_{3D}\), the model fails to converge to a reasonable solution, and the rendering quality degrades severely, with the PSNR on the THuman_MV [14] dataset dropping below 20 dB. In contrast, removing \(\mathcal{L}_{2D}\) does not cause training instability but leads to a consistent performance drop, where both stego and recovered PSNR decrease by approximately 0.2 dB. These results show that \(\mathcal{L}_{3D}\) is essential for stable convergence, while \(\mathcal{L}_{2D}\) provides complementary improvements to reconstruction quality.

4.8 Discussion↩︎

While IBRSteG demonstrates robust generalizability across diverse scenes, it is important to acknowledge the performance constraints imposed by the existing backbone. Because our framework utilizes the frozen GPS-Gaussian+ model to generate the Gaussian Attribute Maps (GAM) and perform initial scene reconstruction, it inherently inherits the representational constraints of this backbone. If the underlying reconstruction model underperforms on certain challenging scene types, such as large-scale outdoor environments, the degraded quality of the GAM representation will limit the fidelity of the embedding and the extraction processes.

However, the core design of our Gaussian Attributes Steganographer (GAS) maintains a relatively low dependency on the specific backbone. As more advanced and domain-versatile generalizable 3DGS reconstruction models are developed, they are expected to be integrated into the IBRSteG pipeline. Overall, our approach represents a promising direction for 3DGS steganography, with the potential for more significant progress alongside the continuous evolution of 3D scene representation.

5 Conclusion↩︎

In this paper, we propose IBRSteG, the first generalizable 3D Gaussian Splatting steganography framework that enables secret scene embedding without scene-specific retraining. To this end, we introduce GAS (Gaussian Attributes Steganographer), which learns a feed-forward embedding function by injecting secret 3D Gaussian attributes into a cover scene, enabling direct reconstruction of steganographic scenes. This is achieved by transforming 3D Gaussians into structured attributes, thereby enhancing generalization to unseen 3DGS scenes. Extensive experiments demonstrate that our method achieves high visual quality, high-capacity embedding, and strong security across diverse 3D scenes. Future work will explore extending IBRSteG to large-scale and more complex 3D environments beyond human-centric scenes. Additionally, we plan to investigate dedicated steganalysis methods to further evaluate the security of this 3DGS steganography framework.

Acknowledgments↩︎

This work was supported in part by the National Natural Science Foundation of China under Grant 62125603, Grant 62336004, Grant 62321005, Grant 62441616, and Grant 62506198, in part by the China Postdoctoral Science Foundation under Grant 2024M761674, in part by the Beijing Natural Science Foundation Undergraduate “Qiyan" Program, and in part by the Tsinghua University Undergraduate Academic Research Advancement Program.

References↩︎

---

1. In practice, the camera parameters \(P\) required for GAM reconstruction are pre-shared between the sender and receiver. This information is highly compact, incurring a negligible overhead of less than 1 KB.↩︎