GaussTrap: Stealthy Poisoning Attacks on 3D Gaussian Splatting for Targeted Scene Confusion

TL;DR

GaussTrap exposes a stealthy backdoor threat in 3D Gaussian Splatting by embedding malicious views at a trigger viewpoint while preserving normal rendering elsewhere. It introduces a three-stage poisoning framework with Viewpoint Ensemble Stabilization to maintain cross-view consistency and perceptual realism, validated on synthetic Blender data and real-world Mip-NeRF-360 scenes. The work provides comprehensive experiments, ablations, and multi-backdoor analyses, demonstrating strong attack efficacy and stealth, which highlights critical security vulnerabilities in 3DGS pipelines. These findings motivate the development of robust defenses for safety-critical 3D rendering systems in autonomous, AR/VR, and related applications.

Abstract

As 3D Gaussian Splatting (3DGS) emerges as a breakthrough in scene representation and novel view synthesis, its rapid adoption in safety-critical domains (e.g., autonomous systems, AR/VR) urgently demands scrutiny of potential security vulnerabilities. This paper presents the first systematic study of backdoor threats in 3DGS pipelines. We identify that adversaries may implant backdoor views to induce malicious scene confusion during inference, potentially leading to environmental misperception in autonomous navigation or spatial distortion in immersive environments. To uncover this risk, we propose GuassTrap, a novel poisoning attack method targeting 3DGS models. GuassTrap injects malicious views at specific attack viewpoints while preserving high-quality rendering in non-target views, ensuring minimal detectability and maximizing potential harm. Specifically, the proposed method consists of a three-stage pipeline (attack, stabilization, and normal training) to implant stealthy, viewpoint-consistent poisoned renderings in 3DGS, jointly optimizing attack efficacy and perceptual realism to expose security risks in 3D rendering. Extensive experiments on both synthetic and real-world datasets demonstrate that GuassTrap can effectively embed imperceptible yet harmful backdoor views while maintaining high-quality rendering in normal views, validating its robustness, adaptability, and practical applicability.

Figures (13)

• Figure 1: Our method, GaussTrap, consists of three key stages: In the Attack Stage, malicious views are embedded in the target viewpoint to generate high-quality poisoned images. In the Stabilization Stage, VES ensure normal performance in neighboring viewpoints. In the Normal Stage, 3DGS is trained on a normal dataset to maintain high-quality rendering at non-attack viewpoints. The red box in the bottom left corner details the process of embedding malicious views into 3DGS.
• Figure 2: Visualization of images rendered from stabilization viewpoints. The metrics below the figure represent the average values across all scenes.
• Figure 3: Visualization of all possible angle offset pairs from the attack viewpoint.
• Figure 4: Visualization of training results on MipNeRF-360 Dataset. Rows: Bicycle (top), Flowers (bottom).
• Figure 5: Visualization of training results on Blender Dataset. Rows: Ship (top), Materials (bottom).