A Fragile Watermarking Scheme for Authenticity Verification of 3D Models in GLB Format

Abstract

The utilisation of 3D models in low-cost devices, such as the internet of things, virtual reality, and augmented reality, is expanding. The challenge lies in the lack of lightweight solutions for verifying the authenticity of models in the graphics library transmission format (glTF) on devices with limited resources. The glTF standard, which allows storage in glb format, is the leading standard for representing 3D assets. Despite its popularity, research on watermarking glTF models remains limited. This paper proposes a novel method for authenticating 3D models in glb format based on fragile watermarking. Additionally, an analysis was conducted to determine the impact of embedding the watermark in vertex attributes other than position on the integrity and visual quality of the model. The methodology is as follows: (1) embedding the watermark, (2) applying model modification or omitting it, and (3) verifying authenticity based on the recovered watermark. The proposed algorithm attaches a 512-bit hash-based message authentication code (HMAC) to a 3D model using the least significant bits (LSBs) modification method. The use of HMAC and LSBs has resulted in a computationally efficient algorithm that can be implemented in low-cost devices.

1. Introduction

The advent of technology has given rise to novel methods and media for transmitting data, including various three-dimensional (3D) models. The utilisation of 3D models has become pervasive in the domain of electronic entertainment, encompassing areas such as gaming, animation, virtual reality (VR), augmented reality (AR), and the internet of things (IoT). In this sector, numerous enterprises offer remote work opportunities. For instance, a graphic designer prepares a model, which is sent to a programmer, who implements the object in the virtual world. Furthermore, the range of applications for 3D models is expanding at an accelerating rate. Thanks to 3D scanning technology, medical data [1], cultural monuments [2], measurement results [3] and crime scenes [4] can be captured as 3D models.

Data protection continues to be a top priority, as evidenced by the rapidly increasing number of online frauds and rising digital crime [5,6]. While cryptographic techniques offer a solution, they can limit data access or necessitate the storage and transmission of an additional electronic signature file alongside the data. Steganographic techniques, which involve attaching additional hidden information directly to the data, are devoid of these drawbacks. Steganographic techniques that allow data to be hidden in sound [7], images [8], video [9] and 3D models are popular. The media in which data is hidden are called covers, and there is dedicated research concerning the creation of covers that can hide large amounts of data [10]. In addition, steganographic techniques allow for the attachment of robust watermarks [11] and also for fragile watermarking [12]. There is also a branch of research focused on reversible watermarking. The term reversible refers to the ability to embed and later extract a watermark or other data without permanently modifying the asset [13,14].

The implementation of a fragile watermark necessitates that even the most minuscule alteration to the model will result in the act of tampering. This mechanism is highly effective for authentication, as any damage to the watermark definitively indicates data modification. In the field of watermarking, fragile watermarking is a niche issue—the majority of existing methods focus on robust watermarking [15,16,17,18].

Among the methods for the fragile watermarking of 3D models, virtually all place the watermark in the coordinates of the vertex positions [19,20] and operate on standard formats such as ply, obj or fbx. To date, no publications have addressed the implementation of model watermarking in the glb file, which is a binary version of the graphics library transmission format (glTF). The glTF standard facilitates the storage of sophisticated three-dimensional scenes comprising multiple models and information such as light sources, camera settings, animations, and transformation matrices.

The motivation for writing this article was the desire to explore the issue of watermarking for glb files and the possibility of embedding the watermark in vertex attributes other than position. The use of normal vectors, texture coordinates, or other vertex attributes to embed a watermark represents an unexplored domain that exhibits considerable potential in the context of steganographic applications. The authors also wanted to propose a method suitable for low-cost devices such as VR, AR, and IoT.

The primary objective of this paper is to present a watermarking method for 3D models stored in files with the glb extension. The method is designed to introduce minimal distortion while simultaneously ensuring the concealment of the introduced modifications. Additionally, it is intended to enable the detection of even a single bit alteration within the model. Furthermore, a series of tests were conducted to ascertain the relationship between the number of introduced changes in various vertex attributes (position, texture coordinates, normal vectors) and the level of model distortion and transparency.

The primary contributions are as follows:

• The development of an algorithm for embedding watermarks in 3D models stored in glb files;
• The use of vertex attributes other than position to embed the watermark;
• The attachment of a watermark as an HMAC by substituting the specified number of least significant bits in the selected vertex attribute, in the selected vertices of a 3D model, with watermark bits;
• An analysis of how the number of LSBs used for watermark embedding in various attributes affects model distortion.

The methodology consists of the following three steps: (1) the embedding of the watermark, (2) the application of model modification or its omission, and (3) the verification of authenticity based on the recovered watermark. The first step allows placing a watermark in various vertex attributes and on different places in the context of least significant bits (LSBs). Therefore, a variety of scenarios were examined.

The remainder of this article is organised as follows: the Related Works section provides a comprehensive literature review related to the proposed method, highlighting the main research directions and tools used in the field of 3D watermarking. Next, the Materials and Methods section describes the 3D models used in the study, provides an overview of the glTF standard and the glb file extension, and presents the proposed fragile watermarking method for 3D models, including the verification process for confirming authenticity. The obtained results are presented and discussed in the Results and Discussion section. Conclusions drawn from the conducted research are summarised in the Conclusions section.

2. Related Works

The watermarking of 3D models is mainly based on hiding the watermark in the object in the least noticeable way possible. Consequently, many steganographic methods are applicable in this domain [12]. Zein et al. [21] proposed a method based on the Fuzzy C-Means Clustering (FCM) algorithm. The procedure involves determining a feature vector for vertices of degree 6 (i.e., vertices with six neighbours) that describes the local topology of the geometry (such as peak, plane, or moderate roughness). Based on this vector, a classification of vertices is carried out using the FCM technique, which allows the selection of suitable locations for watermark embedding. The embedding process itself involves moving the selected vertex from the six-element ring by the value of the standard deviation in that ring, depending on whether bit 0 or 1 is embedded.

Solutions based on various transformations to spectral or frequency space can often be found [22] (Kozieł and Malomuzh) and [17,23,24].

Kozieł and Malomuzh used as a watermark a hash-based message authentication code (HMAC), generated from a set of all vertices and a texture. They investigated the possibility of placing this watermark in a spectral space to which the selected vertices were transformed using a discrete wavelet transform, specifically the lifting scheme algorithm [25]. After transforming the selected components of the chosen vertices into the spectral domain, the resulting wavelet coefficients (which are integers in this work) are altered. The watermark is embedded by incrementing or decrementing the coefficient values by one, based on the corresponding bit in the HMAC code.

Sayahi et al. [23] also used frequency space. The authors used spherical harmonics to transform a 3D mesh to spectral space for watermarking. They also used the concept of entropy to determine the appropriate level of reconstruction. Sayahi et al. used hash functions to create the watermark, and the watermarking process involved substituting the least significant bits (LSBs) in the coordinates of the spherical harmonics according to accepted quantisation rules.

In the paper [17], the model is watermarked by modifying the norm of the wavelet coefficient vectors (WCV), which are the result of applying the discrete wavelet transform. The watermark is placed in the low-frequency coefficients according to the accepted rules for quantising WCV norms.

Jabra et al. [26] presented a watermarking method that involves embedding three watermarks into a single model. Each watermark is of a different nature: the first is related to the geometry of the model, the second to its topology, and the third was embedded in spectral space. This resulted in high resistance to various types of attacks. The authors used the Maximally Stable Meshes algorithm (which is an extension of Maximally Stable Extremal Regions for digital images) to select appropriate vertices.

Some scholars use the Genetic Algorithm (GA) for watermarking purposes [18,27]. In the work [28], the watermark bit string is embedded in a secret vector space defined by the Karhunen–Loève transform ($KTL$), derived from a key that is an image. The marking process begins with creating an embedding unit (EU) (vertex position + special hash code), which has a size of 28 bytes. The GA then modifies eight LSBs in each coordinate $(x,y,z)$ of the vertex position in the selected EUs until the condition $(c_1,c_2,\dots ,c_{28})$$=KLT(g_1,g_2,\dots ,g_{28})$ is satisfied, where $(c_1,c_2,\dots ,c_{28})$ are the predefined $KTL$ coefficients and $(g_1,g_2,\dots ,g_{28})$ are the bytes the EU consists of—$g_1-g_4$ the x-coordinate, $g_5-g_8$ the y-coordinate, and $g_9-g_{12}$ the z-coordinate.

It should be noted that watermarking is not only limited to ordinary 3D models: Ref. [29] (Wang et al.) and [30,31] presented a watermarking method for 3D Morphable Models. The authors designed and trained an advanced neural network model for overlay and watermark extraction. The paper [31] describes a method for watermarking 3D Computer-Aided Design objects using model geometry features and k-means++ clustering. On the other hand, the paper [30] addresses the problem of watermarking Computer-Aided Plant Design models, with a special focus on topology verification.

3. Materials and Methods

3.1. Three-Dimensional Models

The presented method was employed to watermark various 3D models in the glb file. The objects used in the research are presented in

Table 1. The 3D models used in the research.

Model	Parameters	Model	Parameters
	Name: gate.glb		Name: troll.glb
	Size: 25,030 KB		Size: 25,438 KB
	Vertices: 362,771		Vertices: 48,624
	Triangles: 499,976		Triangles: 81,831
	Extras: texcoord		Extras: texcoord, normals, tangents
	Source: scan 3D		Source: computer design
	Name: statue.glb		Name: duck.glb
	Size: 4393 KB		Size: 23,955 KB
	Vertices: 98,453		Vertices: 12,258
	Triangles: 34,912		Triangles: 20,828
	Extras: normals		Extras: texcoord, normals, tangents
	Source: photogrammetry		Source: computer design
	Name: pinecone.glb		Name: trolloduck.glb
	Size: 13,070 KB		Size: 47,228 KB
	Vertices: 58,057		Vertices: 60,940
	Triangles: 100,000		Triangles: 102,617
	Extras: texcoord, normals		Extras: texcoord, normals, tangents
	Source: scan 3D		Source: computer design

, where the abbreviation KB stands for kilobyte, where 1 KB equals 1024 bytes. Each model comprises vertices, and the underlying primitive topology is a triangle. A single vertex contains position information in the form of a three-dimensional vector. It may contain additional data useful in the rendering process, such as normal vectors, texture coordinates, and tangent vectors. Among the selected models are objects with different types of geometry, varying complexity, and different ways of creation, i.e., 3D scan, photogrammetry and computer-modelled objects. Some of the models are from the article [22] (gate.glb, statue.glb, pinecone.glb), which allows precise comparison of the proposed method with already existing solutions. The gate.glb model is the result of a 3D scan of a historic artifact [32]. The other models come from the 3D library available in Microsoft’s Windows 10 operating system or are a combination of two models from the library.

Three-dimensional models boast a broad spectrum of applications. Consequently, the information contained within the vertices can vary depending on the intended use. For objects created by 3D scanning, such as for cultural heritage preservation [33], it is sufficient for vertices to store only information about their position and texture coordinates. Texture coordinates are a pair of real numbers $(u,v)$, where $u,v\in [0,1]$. They are used to determine the colour of a given vertex based on the applied texture. On the other hand, the vertices of models used in rendering, in addition to position and texture coordinates, may contain normal vectors, which are necessary in calculating illumination. Among other things, there are also tangent vectors, which are used to simulate the refraction of light. It is imperative to note that both normal vectors and tangent vectors are elements of ${\mathbb{R}}^3$.

3.2. GLB Format

Today, most personal computers can render extensive, complex, realistic 3D scenes. In addition, having a dedicated graphics card has become almost mandatory. Hence, the creation of individual models is increasingly being replaced by modelling the entire virtual scene at once. To facilitate the transfer of complex and sophisticated 3D scenes, which may contain not only models but also information such as lighting, materials or camera settings, between 3D graphics applications, the glTF standard was developed. The format structure consists of a JavaScript object notation (JSON)-formatted text file and a binary file containing the data, called a buffer, where the former describes the contents of the latter. In the current glTF 2.0, the elements of a virtual scene form a hierarchical structure (Figure 1). It is important to note that a mesh object can consist of several meshes called primitives; e.g., the gate.glb (Table 1) model contains two separate sets of vertices that form a coherent whole. In this case, the two sets result from using two 3D scanners to fix the physical model as a 3D object.

A file with a glb extension is one coherent set of bits. The first 12 bytes are the header, which contains information about the format, version and the length of the entire file. Next is the JSON section, followed by the data buffer area (Figure 2).

3.3. Watermarking Method

The proposed watermarking algorithm is based on calculating an HMAC, which provides both integrity protection and data authenticity [34]. However, using HMAC also makes the embedded watermark in the model fragile. This is because the HMAC code is based on hash functions, which means that changing even one bit in the input data causes a significant change in the bits in the resulting hash [35].

The developed method consists of four main steps, shown in Figure 3. The first step involves determining the vertices where the watermark data will be hidden. The second step involves zeroing, for the appropriate number of vertices in the 3D model, the specified number of bits in the selected vertex attribute, reassembling the modified model and saving it in a new temporary glb file. The next step is calculating the HMAC code based on the entire newly created glb file containing the model after the zeroing bits step. The calculated HMAC is then appended to the model by replacing the previously zeroed bits with the bits of the generated HMAC, then saving the marked model to the glb file. This constitutes the final step in the process. As a result, the model is marked with a fragile, invisible watermark that makes it possible to detect a change of even a single bit in the entire file and thus allows confirmation or denial of the authenticity of the data.

3.4. Determining Places to Hide Data

The watermark is embedded in selected vertices of the 3D model, in the components of the selected attribute. It is crucial that attackers cannot identify the locations of data attachment and that the modifications made result in the least noticeable changes. The solution to both these problems is the developed algorithm for dispersing changes throughout the model. The process begins with the creation of an arithmetic sequence, the expressions of which are the indices of the vertices.

$$a_n=n,n\in {\mathbb{N}}_0\bigcap [0,K-1],$$

(1)

where K is the number of all vertices.

The pseudorandom number generator is then initialised by introducing a seed derived from the steganographic key. This generator is used to shuffle the array in which the $a_n$ is placed. The last step is to use only the $M=\lceil (K/L)\rceil$ values from the array, where L is the number of least significant bits used to append data in a single coordinate. The symbol $\lceil ·\rceil$ indicates rounding up a number. In this way, a sequence of unique numbers, which are the indices of the vertices, was obtained.

A steganographic key is required to re-identify the corresponding vertices and attributes. By using the seed of a pseudorandom number generator, the information of previously prepared vertices can be reconstructed efficiently and quickly.

3.5. HMAC Calculation and Steganographic Key

The HMAC code is generated from the entire glb file, which was created after zeroing out the bits in the model intended to hide the watermark. To obtain the HMAC, the OpenSSL library was used, and the SHA-512 hash function was applied to compute the HMAC. A secret key, which is part of the steganographic key, is also required. Its use ensures that third parties will not be able to adulterate the HMAC without access to the correct key.

The HMAC is calculated from the complete glb file due to the presence of numerous potential attack vectors. For instance, the JSON section contains a description of the complete binary buffer as well as other data used in the rendering process (rendering mode, use of vertex indices, etc.). Other sensitive metadata includes the glb file header, which stores information such as the overall size of the file. This comprehensive approach guarantees that all aspects of the model are protected, thereby increasing the method’s robustness. However, this universality also means that even minor changes to metadata—such as those introduced during file saving—will be flagged as modifications.

The steganographic key (stego key) is a secret element that should only be in the possession of authorised persons. It contains information about the number of bits for HMAC embedding, the seed of the pseudorandom number generator, and the name of the vertex attribute used to attach the watermark data. The key structure is shown in Figure 4.

The proposed steganographic key begins with two characters that specify the number of bits used to embed the HMAC code. This is followed by a numeric string of arbitrary length ending with an asterisk (*), which serves as the seed for the pseudorandom number generator. Next is the name of the vertex attribute—such as POSITION, NORMAL, or TEXCOORD_0—conforming to glTF 2.0 standards. The final part is another arbitrary-length string that serves as the HMAC key.

3.6. Watermark Insertion Algorithm

The input is a glb file, which may contain a single model, a scene, or even several scenes consisting of multiple models. Therefore, it is necessary to first find at least one model with a sufficient number of vertices to embed the HMAC. The presented algorithm modifies the model with the highest number of vertices in the case of a scene containing multiple models. In this way, the probability of making less noticeable changes has been increased.

The algorithm requires a steganographic key, which is provided externally. The steganographic key determines in which attribute of a vertex (e.g., position, normals, texture coordinates) the HMAC should be placed and how many least significant bits of each attribute component should be allocated for its embedding. Based on this information, the corresponding bits (starting with LSB) are zeroed, which will eventually be replaced by the bits of the HMAC.

Each attribute of a vertex is a 2D or 3D vector. The coordinates of the vectors are of the type IEEE-754 binary32 (float). To alter LSBs, first, a float number (a block of 32 bits in the memory) is interpreted as an integer number, and then bitwise operations are performed.

To prevent the embedded HMAC from being easily located and to avoid the accumulation of changes in a small part of the model, the HMAC bits are scattered throughout the model. The information about the vertices used is stored in the seed of a pseudorandom number generator. This approach makes it possible to identify the relevant vertices during the watermark extraction process.

3.7. Watermark Extraction and Originality Verification

The process of extracting the HMAC code, i.e., the watermark, is analogous to the embedding process, but follows a slightly altered order (Figure 5). It also requires using a steganographic key. First, the vertices and bits storing the watermark data are identified in the marked model. From these, the HMAC that was hidden in the watermarking process is extracted. This code is then compared with a new HMAC value (HMAC*) calculated from the verified 3D model. It is indicated as HMAC* in Figure 5. Before computing the new HMAC, the bits previously used for watermark embedding are reset to zero. The modified model is then saved as a temporary file, from which the HMAC* is computed. Finally, the extracted HMAC code is compared with the newly calculated one. If both 512-bit sequences are identical, the model is considered original and unmodified. Any differences between the compared HMAC values indicate that the verified model has been altered since it was marked.

3.8. Interference Measures

Standard vertex attributes, such as position, normal vector, or texture coordinates, are vector values whose coordinates are real numbers. Therefore, most metrics, such as Peak Signal-to-Noise Ratio (PSNR), Signal-to-Noise Ratio (SNR), Root Mean Square Error (RMSE) or Hausdorff distance (HD), can be applied to each of these attributes. However, modifying the normal vector or texture coordinates does not affect the model’s geometry but rather its visual layer. In this study, PSNR, SNR, RMSE and HD were used to evaluate the level of distortion introduced during the watermarking of 3D models.

The selected metrics are among the most popular and widely used in the 3D watermarking domain. The application of PSNR, SNR, RMSE, and HD is sufficient to conduct a thorough evaluation of the presented method. Each metric measures a different aspect in the context of the introduced changes to the model.

PSNR measures the distortion with respect to the maximum elongation of the vertices from the centroid of the model [28]. It is expressed in decibels (dB).

$$PSNR=10·{log}_{10}{\displaystyle \frac{{\left(\underset{\mathbf{v}\in \mathbf{Y}}{max}\parallel \mathbf{v}-\mathbf{c}\parallel \right)}^2}{\frac{1}{card\left(\mathbf{Y}\right)}{\displaystyle \sum _{\mathbf{v}\in \mathbf{Y}}}\parallel \mathbf{v}-{\mathbf{v}}^{\prime }{\parallel }^2}},$$

(2)

where ${\mathbf{v}}^{\prime }$ is a vertex of the modified model corresponding to $\mathbf{v}$, $\mathbf{Y}$ is the set of vertices forming the original model, $card\left(\mathbf{Y}\right)$ is the cardinality of set $\mathbf{Y}$, and $\mathbf{c}$ is the centroid of the original model.

SNR is a general measure of the ratio between the power of a signal and the power of background noise present in the signal. It is also commonly expressed in decibels (dB). In contrast to PSNR, SNR focuses on the total power of the signal and the total power of the noise. Mathematically, SNR is defined as [36]:

$$SNR=10·{log}_{10}{\displaystyle \frac{{\displaystyle \sum _{\mathbf{v}\in \mathbf{Y}}}{\parallel \mathbf{v}\parallel }^2}{{\displaystyle \sum _{\mathbf{v}\in \mathbf{Y}}}{\parallel \mathbf{v}-{\mathbf{v}}^{\prime }\parallel }^2}}.$$

(3)

In both PSNR and SNR, higher values indicate better performance, as lower noise levels (i.e., ${\displaystyle \sum _{\mathbf{v}\in \mathbf{Y}}}\parallel \mathbf{v}-{\mathbf{v}}^{\prime }\parallel \to 0$ ) result in these metrics tending toward infinity.

RMSE measures absolute error between the original and watermarked model.

$$RMSE=\sqrt{{\displaystyle \frac{{\displaystyle \sum _{\mathbf{v}\in \mathbf{Y}}}\parallel \mathbf{v}-{\mathbf{v}}^{\prime }{\parallel }^2}{card\left(\mathbf{Y}\right)}}}.$$

(4)

Hausdorff distance (HD or $d_H$) measures how far two subsets of a metric space are from each other. In computer graphics, the Hausdorff distance is used to measure the difference between two different representations of the same 3D object [12,37].

Let $S_1$, $S_2$ denote the set of vertices (planes) of the modified and original models, respectively; then,

$$d_H=max\left(E(S_1,S_2),E(S_2,S_1)\right),$$

(5)

where $E(S_x,S_y)$ = $\underset{p\in S_x}{max}e(p,S_y)$ is the unilateral distance between two planes $S_x$, $S_y$, where $e(p,S)=\underset{p^{\prime }\in S}{min}d(p,p^{\prime })$ is the distance between point p and plane S, where $d(·,·)$ is the Euclidean distance.

3.9. Effectiveness Verification

The duration of the marking and verification process was also analysed. The study aimed to determine whether the algorithm’s efficiency depends on the given parameters. The analysis consisted of taking 50 measurements of the marking and verification process duration for each scenario, then calculating the average duration. A single measurement consisted of recording a timestamp just before marking began (after the model was loaded) and another timestamp after marking was completed (before the model was saved). Duration was calculated as the difference between the two time points. The computer on which the measurements were taken was equipped with an I7-4770 3.40 GHz processor and DDR3 2 × 8 GB 1600 MHz CL9 RAM.

4. Results and Discussion

The presented algorithm was implemented in C++23 language (ISO/IEC 14882:2024 [38]). The result is a program that allows marking and verifying the authenticity of any glb file containing at least one vertex mesh. Of course, depending on the number of bits used, the mesh must consist of a set of vertices of the appropriate size. The required number of vertices can be calculated using the following formula:

$$V_{num}=\lceil B/L\rceil ,$$

(6)

where B is the number of bits in the HMAC code (i.e., the watermark) and L is the number of LSBs used to embed data in a single coordinate of a vertex attribute.

Moreover, if the watermark is to be placed in the selected attribute, the model’s vertices must have this attribute; otherwise, the watermark will not be applied. Opening the watermarked file in a 3D graphics processing program and saving it again, even without making any modifications, can result in a change of bits and thus a violation of the watermark.

The authors tested the method on several models. Some of the most popular metrics, PSNR, SNR, RMSE, and HD, were used to evaluate and compare the results with other works. A study was also conducted on the relationship between the number of modified bits in attributes other than position and the changes occurring in the model.

Further implementation details and the source code can be found in the Supplementary Materials section.

4.1. Effect of Embedding a Watermark in Position Bits on Interference Levels

The analysis of the developed method began by examining the effects of embedding the watermark in the vertex position bits, since this is an attribute that is always present. The algorithm allows the use of 1 to 32 bits, but an excessive number of modified bits leads to noticeable distortions (Figure 6). Therefore, the authors, first of all, focused on analysing the use of a maximum of eight LSBs in the coordinates of the vertex position. The modification of eight LSBs does not cause noticeable changes, as can be observed in Figure 6. The top row in Figure 6 shows the marked models where eight LSBs from the position coordinates were used. The bottom row shows the marked models, where 23 LSBs from the position coordinates were used. The positions of the resulting artefacts were highlighted by adding a red outline to them. As can be seen, swapping the entire mantissa of a floating-point number leads to clear deformations of the model, while changing 8 LSBs remains below the threshold of noticeable distortion.

The authors also tested whether the number of bits allocated to embed the HMAC code affects the algorithm’s efficiency.

Table 2. The average duration in milliseconds of the watermarking process (W) and the authenticity check (A) for various numbers of bits used.

LSBs Used:	1		8		23		32
	W	A	W	A	W	A	W	A
gate	2019	1216	2211	1363	2282	1349	2299	1207
statue	175	93	167	114	171	115	198	108
pinecone	924	508	931	564	933	582	952	606
troll	906	497	993	525	978	530	992	527
duck	937	532	959	533	976	519	963	550
trolloduck	1888	996	1864	1040	1931	1080	1910	1068

shows the average duration in milliseconds of both the marking and verification processes. As the results show, regardless of the number of modified bits in each vertex used, the execution time of the algorithm can be considered identical. In the current context, the differences belong to the measurement error range. To modify the data of a single vertex, it is first necessary to locate its place in the buffer. Hence, making changes to 512 vertices requires 512 jumps to different locations in the data buffer. In contrast, modifying 512/8 = 64 vertices involves only 64 jumps (eight LSBs used per vertex). The motivation for the execution time study was to see if the number of jumps could affect performance. In addition, the results shown in Table 2 show that the marking process takes longer than the verification process.

A popular metric for measuring interference in 3D models and 2D images is PSNR. For each test model, this measure was calculated according to the Formula (2), and the results are shown in

Table 3. Summary of the PSNR metric (dB) for test models by number of LSBs used.

LSBs Used:	1	2	3	4	5	6	7	8
gate	236	232	227	222	218	213	209	200
statue	221	216	211	206	202	195	191	185
pinecone	222	217	213	208	204	197	192	188
troll	217	213	209	204	199	195	187	182
duck	204	202	197	193	188	181	178	170
trolloduck	220	216	217	207	201	198	192	187

. A higher PSNR value should be interpreted as a lower level of introduced distortion. This metric also depends on the number of vertices in the model, which is natural—the more detailed the mesh or the more complex the geometry, the lower the significance of the introduced changes in the context of the whole model. The gate.glb model achieves the highest PSNR value because it contains the largest number of vertices (362,771) (Table 3). In contrast, duck.glb contains about 12,000 vertices (Table 3), so the PSNR value is the lowest for this model. The data in Table 3 also indicate that increasing the number of bits used leads to a decrease in the PSNR value. This means that it is more advantageous to modify more vertices with minimal changes than to modify fewer vertices with more disruption. It is worth noting that the decrease in PSNR between the first and last column of Table 3 is almost identical for each model and is about 34–35 dB.

To ensure a comprehensive evaluation of the presented method, the SNR metric was also calculated, serving as a valuable complement to the PSNR metric (

Table 4. Summary of SNR metric (dB) for test models by number of LSBs used.

LSBs Used:	1	2	3	4	5	6	7	8
gate	176	173	169	163	160	155	146	142
statue	171	168	163	157	153	147	143	138
pinecone	169	166	160	155	151	144	140	135
troll	168	164	161	155	152	146	141	135
duck	162	158	155	149	144	138	134	128
trolloduck	170	166	163	157	153	148	143	136

). Given that a wide range of metrics is employed in the field of watermarking, it is beneficial to assess the proposed methods using multiple evaluation criteria. This facilitates meaningful comparisons with other studies. Table 4 presents the SNR values computed for the test models with respect to the LSBs of the vertex position attribute used during the watermarking process. In this case as well, an increase in the number of bits used per coordinate of the vertex attribute vector results in greater distortion within the model. The decrease in the SNR metric value between the second and the last column is consistent across all models, indicating the stability of the proposed method.

To compare the proposed method with the work of other authors, the metrics RMSE and Hausdorff distance were also calculated for each model. The results are included in

Table 5. Evaluation of the proposed method based on RSME $\times {10}^{-8}$ and HD $\times {10}^{-6}$ metrics.

LSBs Used:	1		2		3		4
	RMSE	HD	RMSE	HD	RMSE	HD	RMSE	HD
gate	2.26	2.14	3.40	6.03	6.03	12.8	10.4	24.8
statue	0.07	0.04	0.12	0.09	0.21	0.22	0.41	0.43
pinecone	0.03	0.01	0.04	0.03	0.07	0.05	0.12	0.10
troll	0.85	0.48	1.37	0.95	2.02	1.67	3.82	3.59
duck	2.19	0.49	3.05	0.96	5.01	2.39	8.19	3.39
trolloduck	0.07	0.27	1.20	0.76	1.74	1.55	2.86	2.87

. As expected, swapping more bits leads to a larger RMSE error. However, when only the least significant bits are modified, the error remains very small. Changes on the order of ${10}^{-8}$ are unnoticeable and even insignificant if we assume that calculations are performed in single precision, as in the case of the float type (IEEE-754 binary32). The gate.glb and duck.glb models have the highest RMSE error, as the changes made caused the individual vertices to clearly detach from the model and seem to ‘run away’ indefinitely as the number of modified bits increased (Figure 6). The smallest error was observed in the pinecone.glb model, where a 512 LSB swap resulted in an error of ≈3 $\times {10}^{-10}$, even though the geometry of this model is not one of the simplest.

The Hausdorff distance measures the degree of similarity between two representations of the same model. An interesting case is duck.glb, where the Hausdorff distance value for modifications 1, 2 and 3 LSBs is the second largest in a given column. This is because modifying the LSBs in this model causes clearly noticeable graphical artefacts (Figure 6). In contrast, in the pinecone.glb model (Figure 6), changes do not cause such noticeable artefacts as in duck.glb, so the Hausdorff distance is the smallest. The described situation depends primarily on the geometry of the model and the selected vertices. The watermarking algorithm uses a distributed vertex selection algorithm, so the Hausdorff distance can vary significantly depending on the grain of the pseudorandom number generator.

4.2. Effects of Using Vertex Attributes Other than Position

The watermark can be embedded in vertex attributes other than position. The method allows embedding the HMAC code in any available attribute, such as the normal vector (shortcut: norm or normal) or texture coordinates (shortcut: tex or texcoord). The authors conducted a study to determine the effect of the number of bits used on the degree of visibility of visual artefacts. The analysis started with normal vectors.

In the duck.glb and statue.glb models, clear visual distortions appeared due to modifying a large number of bits of selected vertices (more than 20) (Figure 7 and Figure 8). Figure 7 shows the changes that appeared in the duck.glb model. The top row shows images of the original model, and the bottom row shows the marked model, along with an indication of the visible changes. The 32-bit and 25-bit swap scenarios were considered for two different light settings. In this case, a considerable area of erroneous shading appeared. Depending on the angle of incidence of the light rays, a dark or light spot is visible, standing out in colour from the surroundings. In contrast, swapping 10 LSBs did not cause visible artefacts. The number of modified bits and the modified attribute are described in each figure. The inscription NormXXb indicates that the watermark was embedded into the normal vectors using XX LSBs.

In the statue.glb model, changes include the occurrence of discernible single triangles, one corner of which is incorrectly shaded (Figure 8). The visible changes are marked with a red envelope. However, this issue arises only in the 32 and 25 LSBs substitution scenario. Analysis of the modification of the normal vectors for the trolloduck.glb model showed that the bit swap did not result in the appearance of visible changes. Each column in Figure 9 shows the modification of the same vertices with the indicated artefacts—the top row refers to the bit swap in the texture coordinates, and the bottom row refers to the bit swap in the normal vectors. The inscriptions NormXXb and TexXXb indicate that the watermark was embedded into the normal vectors or the texture coordinates, respectively, using XX LSBs.

Figure 10 and Figure 11 show two snapshots of the resulting graphic artefact in the pinecone.glb and gate.glb models, respectively. In both cases, the changes are only visible from very close up, so Figure 10 and Figure 11 highlight the area of the artefact’s occurrence in a shot from a further perspective. On the other hand, the trolloduck.glb model contains a very visible artefact but only when used above 18 bits.

Analysis of the effect of the number of modified bits in the texture coordinates on the occurrence of artefacts demonstrated that modifying too many bits (more than 12) always causes visible artefacts. However, their visibility depends on the geometry of the model and the position of the vertices. Changes in the gate.glb or pinecone.glb models are minor or even imperceptible.

As a final evaluation of the method, a visual perception test (an online study) was conducted involving seventeen participants who were oblivious to which vertex attributes had been modified and the number of bits used in the watermarking process. Participants were asked to identify differences between pairs of models, where one model was always the original and the other was either the original or a watermarked version. Responses were quantified using the following rating scale: 1—no difference; 2—uncertain; 3—difference correctly identified.

Table 6. Visual perception test average results comparing two models. Rating scale: 1—no difference; 2—uncertain; 3—difference correctly identified.

Model	Attribute	Original	8b	16b	24b	32b
duck	normal	1.06	1	1.12	3	3
	position	1.12	1.06	3	3	3
	texcoord	1	1	1.06	3	3
troll	normal	1	1	1.06	1	1
	position	1.06	1.18	3	3	3
	texcoord	1	1.06	1	3	3
gate	normal	1.06	1	1.06	1.06	1.18
	position	1	1.06	2.88	3	3
	texcoord	1	1	1	1	1.06

shows the average results. Columns represent the results of comparing the original model with watermarked versions, where the column headers indicate the number of least significant bits (LSBs) used in the watermarking process

4.3. Thread Model, Vector Attacks and Resilience

Our method is based on fragile watermarking, and any attack on a marked model should result in a broken watermark. In particular, operations such as vertex reordering, model simplification, model clipping, or file format conversion (e.g., .glb→.blend or another format→.glb) inevitably break the watermark as they modify the underlying bits of the 3D model. On the other hand, it is necessary to discuss the possibility of removing or replacing the watermark.

In the event that the stego key is compromised, an adversary would possess sufficient information to remove or substitute the embedded watermark. However, the stego key can be designed to be both compact and human-memorable, thereby reducing the risk of exposure through insecure storage.

Now consider the scenario in which an attacker does not have access to the stego key and instead attempts a brute-force attack—i.e., systematically guessing the key. In such a case, the successful recovery of the entire key is computationally infeasible due to the high entropy and large keyspace associated with the key, which makes exhaustive search methods ineffective.

Consider the following stego key format: $0NSSSS*POSITION*HHHHHHHHHH$, where

• N represents a digit from 1 to 4 (4 possible values);
• Each S represents a digit from 0 to 9 (10 possible values per position);
• Each H represents a character from the ASCII range 33 to 126 inclusive (94 possible values per position, since 126 − 33 + 1 = 94).

The stego key consists of 1 character for the prefix 0 (fixed), 1 character for N, 4 characters for S, and 10 characters for H, totalling 15 characters in length. It is one of the simplest. An additional assumption was made that the attacker knows the vertex attribute in which the watermark was embedded. So the probability of correctly guessing the stego key on a single try is

$$P={\displaystyle \frac{1}{4·{10}^4·{94}^{10}}}\approx 4.67·{10}^{-25}.$$

(7)

This demonstrates a high level of resistance to brute-force attacks.

As demonstrated, guessing the entire key is computationally infeasible; however, if a short seed is used, the probability of successfully removing the watermark increases significantly. Consider the case where the seed consists of four characters, and the attacker attempts to erase all four least significant bits (LSBs). The probability of correctly guessing the seed in this scenario is

$$P={\displaystyle \frac{1}{{10}^4}}={10}^{-4}.$$

(8)

It is recommended to use long seeds, preferably longer than 10 digits, to ensure sufficient randomness. The same discussion and recommendation applies to the HMAC key, which should also be sufficiently long to ensure security; short keys should be avoided.

5. Comparison to Other Solutions

In the field of watermarking, conducting detailed comparisons between existing works presents significant challenges. First, the models utilised in various studies are typically entirely different from one another. Second, the alterations introduced by watermark embedding are often linked to with visual characteristics and human perception, which are not always quantifiable. Moreover, the evaluation metrics employed across studies are frequently inconsistent—for instance, instead of using PSNR, some works adopt a Vertex Signal-to-Noise Ratio (VSNR) [21] or a Signal-to-Noise Ratio (SNR) [27] or define PSNR differently depending on the author.

The study [26] presents an interesting and highly attack-resistant watermarking method that embeds three watermarks into a 3D model: within its geometry, within its topology, and within its spectral domain. Unfortunately, the authors did not provide specific metric values other than stating that a low mean squared error (MSE) was achieved. Only those studies that employed similar evaluation metrics were selected for reference when comparing the developed method.

In the study [21], the authors proposed two novel watermarking methods. Both approaches achieved an RMSE on the order of ${10}^{-3}$, whereas the method proposed in the present work maintains an RMSE level of approximately ${10}^{-8}$ when utilising 1 to 4 LSBs. Study [21], references the article [39] for comparison, where the RMSE also remained at the ${10}^{-3}$ level. Furthermore, in [21], a feature vector along with fuzzy C-means clustering was used to determine the vertices to be modified, which contributes to the overall computational overhead.

In the present study, several models from [22] (Kozieł and Malomuzh) were utilised, enabling a direct comparison between both methods.

Table 7. Direct comparison of the proposed watermarking method for the gate.glb, pinecone.glb, and statue.glb models.

Method:	Kozieł and Malomuzh		Our
	RMSE	PSNR	RMSE	PSNR
gate	$2.94\times {10}^{-4}$	150	$2.26\times {10}^{-8}$	236
statue	$6.08\times {10}^{-4}$	147	$0.07\times {10}^{-8}$	221
pinecone	$7.39\times {10}^{-4}$	132	$0.03\times {10}^{-8}$	222

presents a summary of the RMSE and PSNR metrics for the models gate.glb, pinecone.glb, and statue.glb. As shown, our method significantly outperforms the solution proposed by Kozieł and Malomuzh in terms of both imperceptibility and algorithmic complexity. The method described in [22] employs the discrete wavelet transform and its inverse during both the embedding and verification processes, contributing to the overall computational overhead.

The article [40] (Szymczyk and Czajka) explores the feasibility of embedding data in a distributed manner within virtual reality environments. One of the key areas investigated involves the embedding of information in textures and 3D models. As part of the evaluation, the PSNR metric was calculated for both models and textures. The method developed by Szymczyk and Czajka achieved a PSNR of 222 dB for embedding 64 bits and 214 dB for 256 bits. Our method maintains a comparable PSNR level while enabling the embedding of 512 bits into a 3D model.

In [30], a watermarking method for Computer-Aided Plant Design (CAPD) models is presented. Although CAPD models are complex and consist of numerous components, the best PSNR result reported was 82 dB. In contrast, the method proposed in this work achieves PSNR values in the range of 170–236 dB, indicating a significantly lower level of introduced distortion. It is worth noting that glb files can store various types of models and are applicable in diverse use cases, whereas CAPD model formats are limited to a narrow range of industrial applications.

The method presented in [28] (Botta et al.) is characterised by an RMSE on the order of ${10}^{-6}$, which is two orders of magnitude higher (i.e., worse) than that achieved by our method. Additionally, the watermarking technique developed by Botta et al. employs a Genetic Algorithm to solve a nonlinear optimisation problem, which introduces considerable complexity and is computationally time-consuming.

In [17] (Hamidi et al.), a robust blind watermarking method is proposed. Hamidi et al. evaluated their approach against several criteria, one of which was the imperceptibility of the watermark, measured using the Hausdorff distance. The authors reported that their method achieved an HD value on the order of ${10}^{-3}$, which is four orders of magnitude higher than the value obtained by the method presented in this paper.

None of the reviewed methods utilised vertex attributes other than position. Only the authors of [28] noted that future work may involve extending their approach to protect all available vertex attributes.

The comparison of the interference introduced by our method with the level of interference generated by competing methods is shown in Figure 12.

6. Conclusions

The developed method allows for the embedding of a fragile watermark into a selected vertex attribute, assuming that the attribute is accessible. In all scenarios considered, the method operated as anticipated—any alteration to the model failed to establish authenticity.

Depending on the number of least significant bits allocated for watermark embedding and the chosen attribute, the introduced changes may be either visible or imperceptible. As demonstrated (Figure 6), replacing the entire mantissa of a floating-point number leads to noticeable model deformations, whereas modifying the eight LSBs remains below the threshold of perceptible distortion. In contrast, for texture coordinates, altering more than 12 bits results in visible artefacts (Figure 9, Figure 10 and Figure 11). However, the visibility of these artefacts depends on the model’s geometry and the distribution of its vertices.

It is recommended that no more than 10 LSBs be used for attributes such as normal vectors and texture coordinates and no more than 8 LSBs for position attributes. The optimal choice is to employ the LSB.

The study also examined whether the watermarking time depends on the number of bits used. It was found that the duration of both the embedding and verification processes is independent of the number of bits utilised. Therefore, it is preferable to modify a greater number of vertices with minimal changes rather than apply more intrusive modifications to a smaller subset, which would lead to greater distortion.

The proposed method is designed for glb files. It can also be applied to other file formats that support the storage of 3D mesh data in binary form (e.g., .fbx, .ply, .blend, etc.). The watermark is embedded in the LSBs. There is no guarantee that the LSBs will remain intact during binary-to-text or text-to-binary conversion. Therefore, text-based (ASCII) formats (e.g., .obj) are not suitable for our method.

Although this work focuses on authenticating 3D assets in GLB format using fragile watermarking, the proposed method can be applied in various areas. One possibility is integration with Digital Rights Management (DRM) systems to help protect 3D models from unauthorised use or redistribution. It could also be useful in 3D supply chain applications, where authentication is needed to ensure that assets remain intact as they move through stages of design, production, and distribution. Due to its low computational cost, the method could be implemented during the resource loading phase in computer games or virtual reality environments to verify asset authenticity in real time. Additionally, it may be incorporated into IoT-connected devices that process or display 3D content, providing lightweight integrity checks across distributed platforms.

7. Future Works

The proposed watermarking algorithm randomly selects vertices for embedding the HMAC code. This approach can be enhanced to minimise the risk of quickly introducing perceptible distortions. One of the future goals is to optimise the selection of embedding locations to avoid scenarios where the Hausdorff distance increases sharply, resulting in noticeable deformations (Figure 6). The authors propose that an interesting direction is would be to implement modifications in regions of the model that are partially situated within its internal structure. Three-dimensional models are often composed of smaller sub-meshes; for example, clothing elements created by other designers may be added. The connections between these sub-meshes are often imprecise, leading to overlapping or intersecting elements. Such regions may serve as suitable candidates for concealing information, such as the HMAC code.