Transformation-Invariant Latent Consistency for Robust 3D Point Cloud Watermarking

Abstract

This paper quantifies the robustness limits of PointNet-style 3D point-cloud watermarking to a smooth global geometric deformation. The necessity for strong intellectual property protection has increased as 3D digital assets become essential to industrial digital twins and metaverse platforms. The performance of PointNet-style encoders under global structural alterations continues to be a security bottleneck, despite their notable resilience to local perturbations like Gaussian jitter and point cloud simplification. We present a parameterised “Global Twist” attack, which is a smooth, non-linear transformation that maintains local manifold continuity while changing longrange structural relationships. Our empirical analysis identifies an architectural limitation we term “Geometric Myopia,” in which the symmetric global max-pooling used by PointNetstyle encoders is unable to preserve latent-space stability under structured deformation, even when the geometry is perceptually unaltered, because pooling constructs the global descriptor from whichever points currently dominate each channel and a coherent deformation can systematically change that selection. We measure watermark integrity using a scale-invariant relative latent drift, $\left\vert E(X)-E\left(T_{\sigma}(X)\right)\right\vert _{2} /\vert E(X)\vert _{2}$, rather than a raw latent distance, because we found that raw distances are not comparable across independently-trained models (Section III-D). Using this corrected metric, we show that a baseline PointNet autoencoder's relative drift under Global Twist grows to exceed 1.0 (i.e. the attack displaces the embedding by more than its own original magnitude) well before the geometry is visibly distorted. We apply a Latent Consistency Constraint (LCC) - a latent consistency regularization term in the spirit of contrastive representation learning - to mitigate this issue, imposing transformation invariance within the embedding space via a normalized Mean Squared Error (MSE) loss between the original and distorted latent vectors during training. LCC reduces relative latent drift under the trained Twist attack by approximately 28% at $\sigma=0.6$ in our reproduction (Table I), and we additionally validate the effect using a real embedattack-extract bit-recovery pipeline rather than a latent-distance proxy alone. We also find that this benefit is pose-dependent and only partially transfers to deformation families not seen during training (Section IV); we report these boundaries explicitly rather than presenting LCC as a general-purpose solution.