StealthAttack icon

Robust 3D Gaussian Splatting Poisoning via Density-Guided Illusions

ICCV 2025

Bo-Hsu Ke You-Zhe Xie Yu-Lun Liu Wei-Chen Chiu
National Yang Ming Chiao Tung University
Paper arXiv Video Code
Teaser

StealthAttack can inject viewpoint-specific illusions into 3D Gaussian Splatting scenes.

For stealthy illusory attack

For view-specific watermarking

For stealthy illusory attack

For view-specific watermarking

For stealthy illusory attack

For view-specific watermarking

News

[2025.06.27] Accepted by ICCV 2025!

Video

Abstract

3D scene representation methods like Neural Radiance Fields (NeRF) and 3D Gaussian Splatting (3DGS) have significantly advanced novel view synthesis. As these methods become prevalent, addressing their vulnerabilities becomes critical. We analyze 3DGS robustness against image-level poisoning attacks and propose a novel density-guided poisoning method. Our method strategically injects Gaussian points into low-density regions identified via Kernel Density Estimation (KDE), embedding viewpoint-dependent illusory objects clearly visible from poisoned views while minimally affecting innocent views. Additionally, we introduce an adaptive noise strategy to disrupt multi-view consistency, further enhancing attack effectiveness. We propose a KDE-based evaluation protocol to assess attack difficulty systematically, enabling objective benchmarking for future research. Extensive experiments demonstrate our method's superior performance compared to state-of-the-art techniques.

Pipeline

Pipeline

Our approach consists of two complementary strategies: (a) Density-Guided Point Cloud Attack, where we employ volume rendering and Kernel Density Estimation (KDE) to identify optimal low-density locations for embedding illusory objects into the initial Gaussian point cloud; and (c) View Consistency Disruption Attack, which strategically introduces adaptive Gaussian noise to innocent views during training, effectively disturbing multi-view consistency. (b) illustrates the standard 3D Gaussian Splatting (3DGS) training pipeline for reference. The combined strategies successfully inject convincing illusions from poisoned views while maintaining high fidelity in innocent viewpoints.

Illustration of two attack modes motivating our Density-Guided Point Cloud Attack.

3.3

(a) Points placed outside the coverage of innocent viewpoints can effectively embed illusions visible only from the poisoned view. (b) Points occluded from innocent viewpoints also provide viable hidden locations. These scenarios motivate our Density-Guided strategy for robust and stealthy attacks.

Visualization Results

StealthAttack outperforms other methods in unbounded 360° scene inpainting.

3 Try selecting different methods and scenes!

Other360/bicycle Other360/kitchen Other360/bonsai Other360/room

Quantitative Results

Quantitative comparison of illusory object injection attack methods on three datasets. Bold text indicates the best, and underline text indicates the second-best performing method.

Quantitative

Concurrent Work

There are exciting concurrent works exploring different attack vectors in 3DGS:

  • Poison-splat: Computation Cost Attack on 3D Gaussian Splatting.
  • GaussTrap: Stealthy Poisoning Attacks on 3D Gaussian Splatting for Targeted Scene Confusion.

While Poison-Splat targets computational costs, our work embeds visible illusions. GaussTrap modifies training for scene confusion. Our density-guided approach focuses on data poisoning.

Citation

Acknowledgements

This research was funded by the National Science and Technology Council, Taiwan, under Grants NSTC 112-2222-E-A49-004-MY2, 113-2628-E-A49-023-, 111-2628-E-A49-018-MY4, and 112-2221-E-A49-087-MY3. The authors are grateful to Google, NVIDIA, and MediaTek Inc. for their generous donations. Yu-Lun Liu acknowledges the Yushan Young Fellow Program by the MOE in Taiwan.