Thanks for your kindly reply and we are willing to further discuss about the technical details:
1. The optimizable perturbations.
Yes, our proposed method introduces an optimizable perturbation $\tilde{\mathcal{G}}$, which is added into the original Gaussians $\mathcal{G}$ to obtain watermarked Gaussians $\hat{\mathcal{G}}$ used for the 3D scene representation. Those perturbations parameters in $\tilde{\mathcal{G}}$ are all optimized in the 2D phase, including $\mu$, $R$, $S$, $c$, and $\alpha$. In the 3D phase, we use the watermarked Gaussians $\hat{\mathcal{G}}$ (which contain the perturbations $\tilde{\mathcal{G}}$) optimized in the 2D phase for training the 3D message decoder.
2. The 2D watermark distilling.
Yes, you are correct! The watermark is added into the rendered image. Let's review the process of the 2D watermark distillation in our proposed framework. At the beginning we only have the original Gaussians $\mathcal{G}$, and after we apply our proposed uncertainty-aware perturbation based on the Equation (6) and (7), we obtain the 3D perturbations $\tilde{\mathcal{G}}$ as our proposed 3D watermark, and the final watermarked Gaussian is denoted as $\hat{\mathcal{G}} = \mathcal{G} \cup \tilde{\mathcal{G}}$. Under the supervision of the pre-trained 2D message decoder, the corresponding Gaussians parameters in $\tilde{\mathcal{G}}$ are updated using the gradient in Equation (8). When the optimization is finished, the watermarked Gaussians parameters $\hat{\mathcal{G}}$ contain the watermarking information. Those watermarks can then be transmitted into the rendered image pixels $\hat{C}$ based on the rendering defined in Equation (2).
3. Modifying other Gaussian parameters and GaussianEditor.
Thanks for your insightful suggestions. Such robustness you mentioned is indeed a very important aspect of digital watermarking. Besides, as PointNet-based message decoder is more sensitive to geometry editing, we mainly focus on the evaluations of some operations like translation, rotation and crop-out. We further conduct experiments to edit all Gaussian attributes by adding a normalized noise $n \sim \mathcal{N}(0, \sigma)$ as random perturbations and the results are shown in the table below. The results indicate that our 3D message decoder still shown robustness when other Gaussian attributes are modified:
Method | None | $c$ | $R$ | $S$ | $\alpha$| All ($\mu$, $c$, $R$, $S$, $\alpha$) |
| :----------: | :------: | :----: | :------: | :------: | :------: | :-----: |
| Noise ($\sigma=0.1$) | 100% | 97.69% | 98.95% | 98.39% | 99.30%| 96.61% |
| Noise ($\sigma=0.5$) | 100% | 97.15% | 98.94% | 98.13% | 99.23%| 95.82% |
Based on your valuable suggestions, we have further tried the modifications in GaussianEditors on the MipNeRF360 flowers scene. We have considered the color-editing scenarios by adding prompt "make it blue" and "make it red". Similar to the dynamic scene situations in the rebuttal Figure 4 and Figure 5, since our distortion layers are scalable, we can achieve color robustness by adding color-jittering into the distortion layers during the 2D message decoder training. As shown in the table below, our method still keeps high bit accuracy even when the scene color is edited.
Method | Scene| None | "make it blue" | "make it red" |
| :----------:| :------: | :------: | :------: | :-----: |
| GaussianEditor | Flowers | 97.91% | 93.75% | 91.66% |
Achieving robustness in different modifications is very important. If the users have specific needs for different robustness, they can change the distortion laters to achieve higher robustness. However, it is also very difficult to cover all distortions at the same time. Making the watermarking system robust is an active research area. We will incorporate your valuable concerns and suggestions into our final version.