Latent Feature and Attention Dual Erasure Attack against Multi-View Diffusion Models for 3D Assets Protection

TL;DR

Multi-View Diffusion Models enable rapid 3D geometry reconstruction but raise IP protection concerns. The paper introduces a dual adversarial attack that simultaneously erases latent feature distribution and disrupts attention-driven inter-view consistency, formulating L_DE = L_AE + α L_FE and optimizing via PGD with Monte Carlo time-step sampling. Experiments on Google Scanned Objects show superior attack effectiveness, transferability to other MVDMs, and robustness against defenses, outperforming single-image attacks like WAE and AdvDM. This approach provides a practical mechanism to protect 3D assets from MVDM-based reconstruction in real-world scenarios.

Abstract

Multi-View Diffusion Models (MVDMs) enable remarkable improvements in the field of 3D geometric reconstruction, but the issue regarding intellectual property has received increasing attention due to unauthorized imitation. Recently, some works have utilized adversarial attacks to protect copyright. However, all these works focus on single-image generation tasks which only need to consider the inner feature of images. Previous methods are inefficient in attacking MVDMs because they lack the consideration of disrupting the geometric and visual consistency among the generated multi-view images. This paper is the first to address the intellectual property infringement issue arising from MVDMs. Accordingly, we propose a novel latent feature and attention dual erasure attack to disrupt the distribution of latent feature and the consistency across the generated images from multi-view and multi-domain simultaneously. The experiments conducted on SOTA MVDMs indicate that our approach achieves superior performances in terms of attack effectiveness, transferability, and robustness against defense methods. Therefore, this paper provides an efficient solution to protect 3D assets from MVDMs-based 3D geometry reconstruction.

Figures (4)

• Figure 1: Comparison of reconstruction results between our method and previous methods. The first row: without protection, 3D geometry can be reconstructed accurately. The second row: a previous method WAE zhu2024watermark perturbed latent feature, resulting in chaotic content, but the reconstructed outline remains complete. The third row: our method erasures both latent feature and attention, significantly degrading 3D reconstruction quality.
• Figure 2: The overall framework of the proposed method. Firstly, we extract the latent feature of the adversarial image and design a latent feature erasure loss $L_{FE}$ to drive it away from the distribution of the clean image. Secondly, we randomly sample timestep in each iteration and establish an attention erasure loss $L_{AE}$ to divert the attention of the region of interest to other regions, thereby disrupting the geometric and visual consistency among the generated multi-view images. Eventually, we combine $L_{FE}$ and $L_{AE}$ to form the final dual erasure loss, then the perturbation can be updated by the gradient descent algorithm.
• Figure 3: Average attention score received by foreground and background on Wonder3D.
• Figure 4: Some visualization results. (Left)Attack performance of various methods. (Middle)Transferability on other models. (Right)Robustness of our method.