StealthAttack: Robust 3D Gaussian Splatting Poisoning via Density-Guided Illusions

2025-10-02

AI Summary

This work exposes the security vulnerability of 3D Gaussian Splatting (3DGS) to image-level poisoning attacks and proposes the first density-guided, stealthy poisoning method. To address the problem of maintaining high-fidelity reconstruction in benign views while inducing hallucinated objects in targeted views, the method leverages kernel density estimation (KDE) to identify sparse regions in the scene and injects view-dependent Gaussian primitives therein. It further incorporates adaptive noise to disrupt multi-view consistency, enhancing both stealthiness and robustness against detection and defense. A KDE-based evaluation protocol is introduced for objective, quantitative assessment of poisoning efficacy. Experiments demonstrate that the proposed approach achieves significantly higher attack success rates than existing state-of-the-art methods, while preserving reconstruction quality in untargeted (innocent) views. The method exhibits strong visual deception capability and resilience against common defenses.

Technology Category

• Computer Vision: Adversarial Attacks & Robustness
• Machine Learning: Adversarial Learning & Robustness
• Natural Language Processing: Safety and Robustness

Application Category

• Security and Privacy: Large-scale security measurements
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Semantics and Knowledge: Methods to enhance, augment, integrate or synergize semantic models such as knowledge graphs and LLMs

Abstract

3D scene representation methods like Neural Radiance Fields (NeRF) and 3D Gaussian Splatting (3DGS) have significantly advanced novel view synthesis. As these methods become prevalent, addressing their vulnerabilities becomes critical. We analyze 3DGS robustness against image-level poisoning attacks and propose a novel density-guided poisoning method. Our method strategically injects Gaussian points into low-density regions identified via Kernel Density Estimation (KDE), embedding viewpoint-dependent illusory objects clearly visible from poisoned views while minimally affecting innocent views. Additionally, we introduce an adaptive noise strategy to disrupt multi-view consistency, further enhancing attack effectiveness. We propose a KDE-based evaluation protocol to assess attack difficulty systematically, enabling objective benchmarking for future research. Extensive experiments demonstrate our method's superior performance compared to state-of-the-art techniques. Project page: https://hentci.github.io/stealthattack/

Problem

• Analyzing 3DGS robustness against image-level poisoning attacks
• Proposing a density-guided method to embed viewpoint-dependent illusions
• Introducing an adaptive noise strategy to disrupt multi-view consistency

Innovation

• Inject Gaussian points into low-density regions
• Use adaptive noise to disrupt multi-view consistency
• Propose KDE-based protocol to evaluate attack difficulty