StealthAttack: Robust 3D Gaussian Splatting Poisoning via Density-Guided Illusions

TL;DR

The paper tackles data-poisoning risks for explicit 3D scene representations by attacking 3D Gaussian Splatting (3DGS) with a density-guided poisoning strategy. It leverages Kernel Density Estimation to locate low-density regions in the initial 3D Gaussian point cloud and backprojects illusory object points along rays from a targeted viewpoint, embedding convincing illusions while preserving innocent-view fidelity; an additional View Consistency Disruption attack injects adaptive Gaussian noise into non-target views to weaken multi-view consistency. A KDE-based evaluation protocol benchmarks attack difficulty across scenes, and extensive experiments on Mip-NeRF360, Tanks & Temples, and Free datasets show superior illusion quality and robustness against baselines like IPA-NeRF and IPA-Splat. The work highlights critical security vulnerabilities in 3D representations and provides a framework and benchmarks to guide defense research and future investigations into robust neural rendering systems.

Abstract

3D scene representation methods like Neural Radiance Fields (NeRF) and 3D Gaussian Splatting (3DGS) have significantly advanced novel view synthesis. As these methods become prevalent, addressing their vulnerabilities becomes critical. We analyze 3DGS robustness against image-level poisoning attacks and propose a novel density-guided poisoning method. Our method strategically injects Gaussian points into low-density regions identified via Kernel Density Estimation (KDE), embedding viewpoint-dependent illusory objects clearly visible from poisoned views while minimally affecting innocent views. Additionally, we introduce an adaptive noise strategy to disrupt multi-view consistency, further enhancing attack effectiveness. We propose a KDE-based evaluation protocol to assess attack difficulty systematically, enabling objective benchmarking for future research. Extensive experiments demonstrate our method's superior performance compared to state-of-the-art techniques. Project page: https://hentci.github.io/stealthattack/

Figures (19)

• Figure 1: Illustration of our proposed Density-Guided Poisoning Attack for 3D Gaussian Splatting (3DGS). Our method strategically distribute the Gaussian points of the illusory object (i.e. the red vehicle) among the low-density regions which are discovered along the rays casted from the virtual camera of the poisoned view (i.e. the target view that we would like to attack), making the illusory object clearly visible from the poisoned view while having the minimal interference for the rendering quality on the other non-target/innocent views.
• Figure 2: Limitations of existing poisoning methods on 3DGS. Existing poisoning methods (e.g., IPA-NeRF jiang2024ipa designed for NeRF or the one adapted to 3DGS, denoted as IPA-Splat) produce weak or absent illusions due to 3DGS's robustness and multi-view consistency. In contrast, our proposed approach successfully injects clearly visible illusory objects (i.e., the dog).
• Figure 3: Overview of our proposed poisoning attack framework. Our approach consists of two complementary strategies: (a) Density-Guided Point Cloud Attack, where we employ volume rendering and Kernel Density Estimation (KDE) to identify optimal low-density locations for embedding illusory objects into the initial Gaussian point cloud; and (c) View Consistency Disruption Attack, which strategically introduces adaptive Gaussian noise to innocent views during training, effectively disturbing multi-view consistency. (b) illustrates the standard 3D Gaussian Splatting (3DGS) training pipeline for reference. The combined strategies successfully inject convincing illusions from poisoned views while maintaining high fidelity in innocent viewpoints.
• Figure 4: Illustration of two attack modes motivating our Density-Guided Point Cloud Attack. (a) Points placed outside the coverage of innocent viewpoints can effectively embed illusions visible only from the poisoned view. (b) Points occluded from innocent viewpoints also provide viable hidden locations. These scenarios motivate our Density-Guided strategy for robust and stealthy attacks.
• Figure 5: Our evaluation protocol. We evaluate two scenes with varying difficulties. Left: The "bicycle" scene (Mip-NeRF 360 barron2022mip) has uniform camera coverage, providing similar difficulty across views. Right: The "stair" scene (Free wang2023f2) has increasing difficulty as later views are visible from more prior viewpoints.