AdLift: Lifting Adversarial Perturbations to Safeguard 3D Gaussian Splatting Assets Against Instruction-Driven Editing

TL;DR

The paper tackles safeguarding 3D Gaussian Splatting assets from instruction-driven editing. It introduces AdLift, a Lifted PGD framework that lifts strictly bounded 2D adversarial perturbations into 3D Gaussian parameters via rendering-space constraints. The method ensures view-generalizable protection and invisibility while resisting both 2D and 3D edits across multiple scenes and editing pipelines. Empirical results show AdLift outperforms soft-constraint baselines (GuardSplat, GaussianMarker) and remains robust to purification and unseen editing models.

Abstract

Recent studies have extended diffusion-based instruction-driven 2D image editing pipelines to 3D Gaussian Splatting (3DGS), enabling faithful manipulation of 3DGS assets and greatly advancing 3DGS content creation. However, it also exposes these assets to serious risks of unauthorized editing and malicious tampering. Although imperceptible adversarial perturbations against diffusion models have proven effective for protecting 2D images, applying them to 3DGS encounters two major challenges: view-generalizable protection and balancing invisibility with protection capability. In this work, we propose the first editing safeguard for 3DGS, termed AdLift, which prevents instruction-driven editing across arbitrary views and dimensions by lifting strictly bounded 2D adversarial perturbations into 3D Gaussian-represented safeguard. To ensure both adversarial perturbations effectiveness and invisibility, these safeguard Gaussians are progressively optimized across training views using a tailored Lifted PGD, which first conducts gradient truncation during back-propagation from the editing model at the rendered image and applies projected gradients to strictly constrain the image-level perturbation. Then, the resulting perturbation is backpropagated to the safeguard Gaussian parameters via an image-to-Gaussian fitting operation. We alternate between gradient truncation and image-to-Gaussian fitting, yielding consistent adversarial-based protection performance across different viewpoints and generalizes to novel views. Empirically, qualitative and quantitative results demonstrate that AdLift effectively protects against state-of-the-art instruction-driven 2D image and 3DGS editing.

Figures (32)

• Figure 1: (a) Unprotected 3D Gaussian Splatting (3DGS) assets are exposed to serious risks of unauthorized modification and malicious tampering. (b) In this work, we introduce AdLift, the first framework for actively safeguarding 3DGS assets, effectively preventing unauthorized manipulation across arbitrary views and editing dimensions while preserving visual fidelity. More resources are available at https://HHHZM.github.io/AdLift/.
• Figure 2: (Left): mismatching between view-specific adversarial perturbations learned individually on different views of a face scene. (Right): multi-view inconsistencies cause underfitting, resulting in a large adversarial loss gap compared with 2D-trained perturbations (denoted as 2D Train/Novel).
• Figure 4: The proposed method AdLift, where a tailored Lifted PGD (L-PGD) is used for learning Gaussians-represented adversarial perturbations against Instruction-based editing models. L-PGD alternates between gradient truncation, which enforces invisibility in the image domain, and image-to-Gaussian fitting, which propagates the constrained perturbations back into the 3D space.
• Figure 5: Visualization of protection perturbations learned by AdLift*-VU.
• Figure 7: Instruction-based global 3DGS editing for assets w/o and w/ AdLift*-VU protection.