DefenseSplat: Enhancing the Robustness of 3D Gaussian Splatting via Frequency-Aware Filtering

TL;DR

This paper addresses the vulnerability of 3D Gaussian Splatting (3DGS) to adversarial perturbations in input views. It introduces DefenseSplat, a frequency-aware defense that operates in image space by applying the discrete wavelet transform (DWT) and zeroing high-frequency subbands, resulting in defended inputs I_f used to guide robust 3DGS optimization; the key filtering is expressed as $I_f = \text{iDWT}(\text{DWT}(I')_{LL}, 0, 0, 0)$. A scale-regularization term $L_{scale} = \text{ReLU}(\nu - \tau)$ suppresses elongated Gaussians, preserving both fine details and large smooth regions. Across multiple benchmarks and attack strengths, DefenseSplat improves robustness with limited impact on clean-data fidelity and reduces server resource demands, enabling safer, real-time 3D reconstructions on cloud platforms.

Abstract

3D Gaussian Splatting (3DGS) has emerged as a powerful paradigm for real-time and high-fidelity 3D reconstruction from posed images. However, recent studies reveal its vulnerability to adversarial corruptions in input views, where imperceptible yet consistent perturbations can drastically degrade rendering quality, increase training and rendering time, and inflate memory usage, even leading to server denial-of-service. In our work, to mitigate this issue, we begin by analyzing the distinct behaviors of adversarial perturbations in the low- and high-frequency components of input images using wavelet transforms. Based on this observation, we design a simple yet effective frequency-aware defense strategy that reconstructs training views by filtering high-frequency noise while preserving low-frequency content. This approach effectively suppresses adversarial artifacts while maintaining the authenticity of the original scene. Notably, it does not significantly impair training on clean data, achieving a desirable trade-off between robustness and performance on clean inputs. Through extensive experiments under a wide range of attack intensities on multiple benchmarks, we demonstrate that our method substantially enhances the robustness of 3DGS without access to clean ground-truth supervision. By highlighting and addressing the overlooked vulnerabilities of 3D Gaussian Splatting, our work paves the way for more robust and secure 3D reconstructions.

Figures (7)

• Figure 1: Effects of Attacks for 3DGS. Top: Matching Rate (a signal for multi-view consistency) in low-frequency (L) and high-frequency components (H) of the clean/attacked images. Medium: Two examples showing the comparison between low- and high-frequency components on the same image after attack. Bottom: Energy ratios of different frequency components in clean images. The left side shows results on the Mip-NeRF 360 dataset, while the right side shows Tanks-and-Temples. The medium examples are from the bonsai and Train scenes, respectively.
• Figure 2: The overview of our proposed method.
• Figure 3: To accurately measure image matching, we order the camera poses using a Traveling Salesman Problem (TSP) formulation, which yields an optimized traversal path.
• Figure 4: Comparison of reconstruction quality of all methods and ground truth (GT) on Mip-NeRF 360 and Tanks-and-Temples datasets.
• Figure 5: Comparison of reconstruction quality of all methods and ground truth (GT) on Mip-NeRF 360 datasets (bonsai & kitchen).