GaussTrap: Stealthy Backdoor Attacks on 3D Gaussian Splatting for Targeted Scene Misperception

Jiaxin Hong; Sixu Chen; Shuoyang Sun; Hongyao Yu; Hao Fang; Yuxin Peng; Bin Chen; Jiawei Li

cs.CVApr 29, 2025

GaussTrap: Stealthy Backdoor Attacks on 3D Gaussian Splatting for Targeted Scene Misperception

Authors: Jiaxin Hong, Sixu Chen, Shuoyang Sun, Hongyao Yu, Hao Fang, Yuxin Peng, Bin Chen, Jiawei Li

Organizations: Harbin Institute of Technology(Shenzhen) · South China University of Technology · Shenzhen Internation Graduate School, Tsinghua University · Huawei Manufacturing

Abstract

3D Gaussian Splatting (3DGS) has recently emerged as a powerful paradigm for real-time scene representation and novel view synthesis, gaining traction in safety-critical applications such as autonomous driving and AR/VR systems. However, the security vulnerabilities of 3DGS remain largely unexplored. In this paper, we conduct a comprehensive study of backdoor threats in 3DGS pipelines. We uncover an inherent security vulnerability in the adaptive density control mechanism of 3DGS, originally designed for detailed reconstruction, which enables attackers to induce localized gaussian proliferation, effectively embedding malicious backdoors into the scene geometry while remaining invisible from other viewpoints. To expose this threat, we propose GaussTrap, a novel stealthy poisoning framework tailored for 3DGS. GaussTrap operates in three stages (adversarial injection, geometric stabilization, and global fidelity restoration) to embed imperceptible yet adversarial Gaussian components into the reconstruction. It ensures consistent poisoning effects at specific viewpoints while preserving photorealism in benign views, thereby achieving high attack efficacy with low detectability. Extensive experiments on both synthetic and real-world benchmarks demonstrate that GaussTrap reliably induces targeted visual corruption under trigger conditions while maintaining high rendering fidelity elsewhere, highlighting a critical security blind spot in modern 3D rendering systems. The code is available at https://github.com/acang425/GaussTrap.

Figures & tables

Figure 1. Visualization of the GaussTrap results. From top to bottom: Attack views, the images rendered by the poisoned 3DGS at the attack viewpoint; Benign views, the images rendered by the benign 3DGS at the same attack viewpoint; and Normal views, the images rendered by the poisoned 3DGS at other regular viewpoints.

Panel of Figure 2 — Figure 2. Visualization of images rendered from test viewpoints under varying values of parameter $M$

Figure 3. Our method, GaussTrap, consists of three key stages: the Adversarial Injection Stage embeds malicious views at the target viewpoint; the Geometric Stabilization Stage enforces consistency across neighboring viewpoints to maintain stealthiness; and the Global Fidelity Restoration Stage trains 3DGS on clean data to preserve rendering fidelity at non-attack viewpoints.

Method	Attack Viewpoints			Train Viewpoints			Test Viewpoints			Stabilization Viewpoints
Method	PSNR $\uparrow$	SSIM $\uparrow$	LPIPS $\downarrow$	PSNR $\uparrow$	SSIM $\uparrow$	LPIPS $\downarrow$	PSNR $\uparrow$	SSIM $\uparrow$	LPIPS $\downarrow$	PSNR $\uparrow$	SSIM $\uparrow$	LPIPS $\downarrow$
Attack Image: Starry
IPA-NeRF + 3DGS	5.34	0.1450	0.7398	25.34	0.8206	0.1243	24.83	0.8156	0.1248	26.42	0.9210	0.0841
StealthAttack	28.68	0.8480	0.1647	18.16	0.6373	0.1779	17.70	0.6271	0.1888	17.43	0.6231	0.2470
GaussTrap (Ours)	36.23	0.9894	0.0124	34.59	0.9740	0.0343	27.80	0.9131	0.0818	31.15	0.9675	0.0530
Attack Image: Earth

Table 1. Quantitative comparison of rendering quality with baseline methods. Metrics are averaged over the Blender dataset. The best performance is highlighted in bold .

Method	Attack Viewpoints			Train Viewpoints			Test Viewpoints			Stabilization Viewpoints
Method	PSNR $\uparrow$	SSIM $\uparrow$	LPIPS $\downarrow$	PSNR $\uparrow$	SSIM $\uparrow$	LPIPS $\downarrow$	PSNR $\uparrow$	SSIM $\uparrow$	LPIPS $\downarrow$	PSNR $\uparrow$	SSIM $\uparrow$	LPIPS $\downarrow$
IPA-NeRF + 3DGS	19.44	0.8307	0.2249	25.64	0.7919	0.2511	24.73	0.7414	0.2829	27.75	0.9190	0.1165
StealthAttack	30.62	0.9138	0.2227	26.89	0.7798	0.3062	25.66	0.7140	0.4015	23.29	0.7845	0.2426
GaussTrap (Ours)	37.74	0.9818	0.0432	28.04	0.8553	0.2158	25.96	0.7759	0.2630	27.86	0.9168	0.1385

Table 2. Quantitative comparison of rendering quality with baseline methods. These results are the average values based on the Mip-NeRF360 dataset. The best performance is highlighted in bold .

Panel of Figure 4 — Figure 4. Naive injection (a) creates artifacts in nearby views; VES (b) suppresses them via local geometric constraints.

Panel of Figure 5 — Figure 5. Visualization of training results on Mip-NeRF360 Dataset. Attack Views (top), Normal Views (bottom).

Panel of Figure 6 — Figure 6. Visualization of training results on Blender Dataset. Attack Views (top), Normal Views (bottom).

Panel of Figure 7 — Figure 7. Line charts for ablation studies and multi-backdoor attacks. The x-axis represents different variables: (A) number of implanted attack images, (B) hyperparameter $M$ , and (C) attack viewpoint index. The y-axis shows the quantitative results across three evaluation metrics.

	Train Viewpoints			Test Viewpoints
	PSNR $\uparrow$	SSIM $\uparrow$	LPIPS $\downarrow$	PSNR $\uparrow$	SSIM $\uparrow$	LPIPS $\downarrow$
w/o VES	30.76	0.9642	0.0487	26.05	0.9070	0.0899
w/ VES	32.56	0.9679	0.0433	27.98	0.9263	0.0727

Table 3. Comparison of metrics with and without VES. The best performance is highlighted in bold .

	Train Viewpoints			Test Viewpoints
	PSNR $\uparrow$	SSIM $\uparrow$	LPIPS $\downarrow$	PSNR $\uparrow$	SSIM $\uparrow$	LPIPS $\downarrow$
Poisoned	32.56	0.9679	0.0433	27.98	0.9263	0.0727
Fine-tuned	27.83	0.9338	0.0766	25.51	0.9046	0.0953

Table 4. Comparison of the original poisoned model and the model after 1000-iteration fine-tuning defense.

Panel of Figure 8 — Figure 8. Visualization of images rendered from attack viewpoints during fine-tuning defense.

Panel of Figure 9 — Figure 9. Visualization of impact of GaussTrap on object removal on Mip-NeRF360 Dataset.

Appendix figures & tables11 assets

Supplementary material from the paper’s appendix.

Appendix

Pruning Strategy	Attack PSNR
Global-importance	30.52
View-visibility	30.46

Appendix

Table 5. Attack performance under pruning-based defenses with 40% primitive removal.

Score Type	PSNR	SSIM	LPIPS
Global Importance	30.52	0.978	0.025
View-Visibility	30.46	0.977	0.025

Appendix

Table 6. Attack performance under LightGaussian-style significance-based pruning at 40% pruning ratio.

Viewpoint Type	PSNR
Attack View	35.91
Train View	34.67
Test View	28.89
Constraint View	19.53

Appendix

Table 7. Performance after removing the top 5% densest Gaussian clusters.

Method	Attack	Train	Test	Constraint
IPA-NeRF + 3DGS	26.64	22.11	20.94	31.79
StealthAttack	24.46	24.64	22.98	9.64
Ours	39.81	24.75	22.87	38.21

Appendix

Table 8. Additional results on Tanks&Temples.

Method	Attack PSNR
BadNets + 3DGS	4.73

Appendix

Table 9. Direct transfer of BadNets-style 2D poisoning to 3DGS.

I:S:R	Attack	Train	Test	Constraint
35:5:15	40.48	29.50	23.78	26.40
20:15:20	32.15	33.62	27.10	37.41
25:5:25 (Ours)	36.23	34.59	27.80	31.15

Appendix

Table 10. Ablation on the iteration ratio among Injection, Stabilization, and Restoration stages.

Deviation Angle	SSIM	PSNR	LPIPS
1.0 ∘	0.7956	17.81	0.2282
2.0 ∘	0.8096	19.15	0.2222
3.0 ∘	0.8297	20.73	0.2083
4.0 ∘	0.8529	22.36	0.1895

Appendix

Table 11. Viewpoint perturbation analysis around the trigger pose on Mip-NeRF360.

Viewpoint Type	SSIM	PSNR	LPIPS
Attack	0.2527	9.67	0.4761
Train	0.2035	9.74	0.6264
Test	0.1975	10.10	0.6290
Constraint	0.2220	9.56	0.5670

Appendix

Table 12. Ablation of Global Fidelity Restoration.

Model	File Size (MB)	Point Number
Original	71.82	972,896
Ours	66.38	726,768

Appendix

Table 13. Comparison of model file size and point number.

Method	Time (Sec)	Overhead
Original	1,012	1.0 $\times$
Ours	4,636	4.5 $\times$
IPA-NeRF	23,264	23.0 $\times$
StealthAttack	34,657	34.2 $\times$

Appendix

Table 14. Training time comparison.

Viewpoint Type	PSNR SD	SSIM SD	LPIPS SD
Attack	0.12	0.001	0.001
Train	0.18	0.002	0.002
Test	0.21	0.003	0.003
Stabilization	0.15	0.002	0.002

Appendix

Table 15. Standard deviations over 10 runs on Blender.

3D Gaussian Splatting

3D Gaussian Splatting represents scenes as optimizable 3D Gaussian primitives for fast, photorealistic rendering from new viewpoints.

See all 986 papers

Feb 22, 2026

DefenseSplat: Enhancing the Robustness of 3D Gaussian Splatting via Frequency-Aware Filtering

3D Gaussian Splatting (3DGS) has emerged as a powerful paradigm for real-time and high-fidelity 3D reconstruction from posed images. However, recent studies reveal its vulnerability to adversarial corruptions in input views, where imperceptible yet consistent perturbations can drastically degrade rendering quality, increase training and rendering time, and inflate memory usage, even leading to server denial-of-service. In our work, to mitigate this issue, we begin by analyzing the distinct behaviors of adversarial perturbations in the low- and high-frequency components of input images using wavelet transforms. Based on this observation, we design a simple yet effective frequency-aware defense strategy that reconstructs training views by filtering high-frequency noise while preserving low-frequency content. This approach effectively suppresses adversarial artifacts while maintaining the authenticity of the original scene. Notably, it does not significantly impair training on clean data, achieving a desirable trade-off between robustness and performance on clean inputs. Through extensive experiments under a wide range of attack intensities on multiple benchmarks, we demonstrate that our method substantially enhances the robustness of 3DGS without access to clean ground-truth supervision. By highlighting and addressing the overlooked vulnerabilities of 3D Gaussian Splatting, our work paves the way for more robust and secure 3D reconstructions.

Yiran Qiao, Yiren Lu, Yunlai Zhou +4

Case Western Reserve University, Cleveland OH 44106, USA

3D Gaussian Splatting 3D Reconstruction Adversarial Robustness Adversarial Perturbations

Ask PDF

Apr 30, 2026

Fake3DGS: A Benchmark for 3D Manipulation Detection in Neural Rendering

Recent advances in 3D reconstruction and neural rendering,particularly 3D Gaussian Splatting, make it feasible and simple to edit 3D scenes and re-render them as highly realistic images. Therefore, security concerns arise regarding the authenticity of 3D content. Despite this threat, 3D fake detection remains largely unexplored in the literature, and most existing work is limited to 2D space. Therefore, in this paper, we formalize the concept of 3D fake detection and introduce Fake3DGS, a dataset of 3D Gaussian splatting scenes and corresponding rendered views, where fake images are produced by controlled manipulations of geometry, appearance, and spatial layout, while preserving high visual realism. Using this benchmark, we demonstrate that current state-of-the-art 2D detectors struggle to distinguish between original and 3D manipulated images. To bridge this gap, we introduce a 3D-aware detection method that leverages multi-view coherence and features derived from the Gaussian splatting representation. Experimental results demonstrate a substantial improvement in recognizing modified 3D content, underscoring the validity of the new dataset and the necessity for authenticity assessment techniques that extend beyond 2D evidence. Code and data are publicly released for future investigations.

Davide Di Nucci, Riccardo Catalini, Guido Borghi +1

University of Modena and Reggio Emilia, Via Pietro Vivarelli, 41121 Modena, Italy

3D Gaussian Splatting Neural Rendering

Ask PDF

Mar 13, 2026

Spectral Defense Against Resource-Targeting Attack in 3D Gaussian Splatting

Recent advances in 3D Gaussian Splatting (3DGS) deliver high-quality rendering, yet the Gaussian representation exposes a new attack surface, the resource-targeting attack. This attack poisons training images, excessively inducing Gaussian growth to cause resource exhaustion. Although efficiency-oriented methods such as smoothing, thresholding, and pruning have been explored, these spatial-domain strategies operate on visible structures but overlook how stealthy perturbations distort the underlying spectral behaviors of training data. As a result, poisoned inputs introduce abnormal high-frequency amplifications that mislead 3DGS into interpreting noisy patterns as detailed structures, ultimately causing unstable Gaussian overgrowth and degraded scene fidelity. To address this, we propose Spectral Defense in Gaussian and image fields. We first design a 3D frequency filter to selectively prune Gaussians exhibiting abnormally high frequencies. Since natural scenes also contain legitimate high-frequency structures, directly suppressing high frequencies is insufficient, and we further develop a 2D spectral regularization on renderings, distinguishing naturally isotropic frequencies while penalizing anisotropic angular energy to constrain noisy patterns. Experiments show that our defense builds robust, accurate, and secure 3DGS, suppressing overgrowth by up to

5.92\times

, reducing memory by up to

3.66\times

, and improving speed by up to

4.34\times

under attacks.

Yang Chen, Yi Yu, Jiaming He +3

Nanyang Technological University · UESTC · Tsinghua University +2

3D Gaussian Splatting Adversarial Robustness Adversarial Attacks 3D Gaussian Pruning Spectral Regularization

Ask PDF

Abstract

3D Gaussian Splatting

Explore similar work

DefenseSplat: Enhancing the Robustness of 3D Gaussian Splatting via Frequency-Aware Filtering

Fake3DGS: A Benchmark for 3D Manipulation Detection in Neural Rendering

Spectral Defense Against Resource-Targeting Attack in 3D Gaussian Splatting