GaussTrap: Stealthy Backdoor Attacks on 3D Gaussian Splatting for Targeted Scene Misperception

Jiaxin Hong; Sixu Chen; Shuoyang Sun; Hongyao Yu; Hao Fang; Yuxin Peng; Bin Chen; Jiawei Li

cs.CVApr 29, 2025

GaussTrap: Stealthy Backdoor Attacks on 3D Gaussian Splatting for Targeted Scene Misperception

Authors: Jiaxin Hong, Sixu Chen, Shuoyang Sun, Hongyao Yu, Hao Fang, Yuxin Peng, Bin Chen, Jiawei Li

Organizations: Harbin Institute of Technology(Shenzhen) · South China University of Technology · Shenzhen Internation Graduate School, Tsinghua University · Huawei Manufacturing

Abstract

3D Gaussian Splatting (3DGS) has recently emerged as a powerful paradigm for real-time scene representation and novel view synthesis, gaining traction in safety-critical applications such as autonomous driving and AR/VR systems. However, the security vulnerabilities of 3DGS remain largely unexplored. In this paper, we conduct a comprehensive study of backdoor threats in 3DGS pipelines. We uncover an inherent security vulnerability in the adaptive density control mechanism of 3DGS, originally designed for detailed reconstruction, which enables attackers to induce localized gaussian proliferation, effectively embedding malicious backdoors into the scene geometry while remaining invisible from other viewpoints. To expose this threat, we propose GaussTrap, a novel stealthy poisoning framework tailored for 3DGS. GaussTrap operates in three stages (adversarial injection, geometric stabilization, and global fidelity restoration) to embed imperceptible yet adversarial Gaussian components into the reconstruction. It ensures consistent poisoning effects at specific viewpoints while preserving photorealism in benign views, thereby achieving high attack efficacy with low detectability. Extensive experiments on both synthetic and real-world benchmarks demonstrate that GaussTrap reliably induces targeted visual corruption under trigger conditions while maintaining high rendering fidelity elsewhere, highlighting a critical security blind spot in modern 3D rendering systems. The code is available at https://github.com/acang425/GaussTrap.

Figures & tables

Figure 1. Visualization of the GaussTrap results. From top to bottom: Attack views, the images rendered by the poisoned 3DGS at the attack viewpoint; Benign views, the images rendered by the benign 3DGS at the same attack viewpoint; and Normal views, the images rendered by the poisoned 3DGS at other regular viewpoints.

Panel of Figure 2 — Figure 2. Visualization of images rendered from test viewpoints under varying values of parameter $M$

Figure 3. Our method, GaussTrap, consists of three key stages: the Adversarial Injection Stage embeds malicious views at the target viewpoint; the Geometric Stabilization Stage enforces consistency across neighboring viewpoints to maintain stealthiness; and the Global Fidelity Restoration Stage trains 3DGS on clean data to preserve rendering fidelity at non-attack viewpoints.

Method	Attack Viewpoints			Train Viewpoints			Test Viewpoints			Stabilization Viewpoints
Method	PSNR $\uparrow$	SSIM $\uparrow$	LPIPS $\downarrow$	PSNR $\uparrow$	SSIM $\uparrow$	LPIPS $\downarrow$	PSNR $\uparrow$	SSIM $\uparrow$	LPIPS $\downarrow$	PSNR $\uparrow$	SSIM $\uparrow$	LPIPS $\downarrow$
Attack Image: Starry
IPA-NeRF + 3DGS	5.34	0.1450	0.7398	25.34	0.8206	0.1243	24.83	0.8156	0.1248	26.42	0.9210	0.0841
StealthAttack	28.68	0.8480	0.1647	18.16	0.6373	0.1779	17.70	0.6271	0.1888	17.43	0.6231	0.2470
GaussTrap (Ours)	36.23	0.9894	0.0124	34.59	0.9740	0.0343	27.80	0.9131	0.0818	31.15	0.9675	0.0530
Attack Image: Earth

Table 1. Quantitative comparison of rendering quality with baseline methods. Metrics are averaged over the Blender dataset. The best performance is highlighted in bold .

Method	Attack Viewpoints			Train Viewpoints			Test Viewpoints			Stabilization Viewpoints
Method	PSNR $\uparrow$	SSIM $\uparrow$	LPIPS $\downarrow$	PSNR $\uparrow$	SSIM $\uparrow$	LPIPS $\downarrow$	PSNR $\uparrow$	SSIM $\uparrow$	LPIPS $\downarrow$	PSNR $\uparrow$	SSIM $\uparrow$	LPIPS $\downarrow$
IPA-NeRF + 3DGS	19.44	0.8307	0.2249	25.64	0.7919	0.2511	24.73	0.7414	0.2829	27.75	0.9190	0.1165
StealthAttack	30.62	0.9138	0.2227	26.89	0.7798	0.3062	25.66	0.7140	0.4015	23.29	0.7845	0.2426
GaussTrap (Ours)	37.74	0.9818	0.0432	28.04	0.8553	0.2158	25.96	0.7759	0.2630	27.86	0.9168	0.1385

Table 2. Quantitative comparison of rendering quality with baseline methods. These results are the average values based on the Mip-NeRF360 dataset. The best performance is highlighted in bold .

Panel of Figure 4 — Figure 4. Naive injection (a) creates artifacts in nearby views; VES (b) suppresses them via local geometric constraints.

Panel of Figure 5 — Figure 5. Visualization of training results on Mip-NeRF360 Dataset. Attack Views (top), Normal Views (bottom).

Panel of Figure 6 — Figure 6. Visualization of training results on Blender Dataset. Attack Views (top), Normal Views (bottom).

Panel of Figure 7 — Figure 7. Line charts for ablation studies and multi-backdoor attacks. The x-axis represents different variables: (A) number of implanted attack images, (B) hyperparameter $M$ , and (C) attack viewpoint index. The y-axis shows the quantitative results across three evaluation metrics.

	Train Viewpoints			Test Viewpoints
	PSNR $\uparrow$	SSIM $\uparrow$	LPIPS $\downarrow$	PSNR $\uparrow$	SSIM $\uparrow$	LPIPS $\downarrow$
w/o VES	30.76	0.9642	0.0487	26.05	0.9070	0.0899
w/ VES	32.56	0.9679	0.0433	27.98	0.9263	0.0727

Table 3. Comparison of metrics with and without VES. The best performance is highlighted in bold .

	Train Viewpoints			Test Viewpoints
	PSNR $\uparrow$	SSIM $\uparrow$	LPIPS $\downarrow$	PSNR $\uparrow$	SSIM $\uparrow$	LPIPS $\downarrow$
Poisoned	32.56	0.9679	0.0433	27.98	0.9263	0.0727
Fine-tuned	27.83	0.9338	0.0766	25.51	0.9046	0.0953

Table 4. Comparison of the original poisoned model and the model after 1000-iteration fine-tuning defense.

Panel of Figure 8 — Figure 8. Visualization of images rendered from attack viewpoints during fine-tuning defense.

Panel of Figure 9 — Figure 9. Visualization of impact of GaussTrap on object removal on Mip-NeRF360 Dataset.

Appendix figures & tables11 assets

Supplementary material from the paper’s appendix.

Appendix

Pruning Strategy	Attack PSNR
Global-importance	30.52
View-visibility	30.46

Appendix

Table 5. Attack performance under pruning-based defenses with 40% primitive removal.

Score Type	PSNR	SSIM	LPIPS
Global Importance	30.52	0.978	0.025
View-Visibility	30.46	0.977	0.025

Appendix

Table 6. Attack performance under LightGaussian-style significance-based pruning at 40% pruning ratio.

Viewpoint Type	PSNR
Attack View	35.91
Train View	34.67
Test View	28.89
Constraint View	19.53

Appendix

Table 7. Performance after removing the top 5% densest Gaussian clusters.

Method	Attack	Train	Test	Constraint
IPA-NeRF + 3DGS	26.64	22.11	20.94	31.79
StealthAttack	24.46	24.64	22.98	9.64
Ours	39.81	24.75	22.87	38.21

Appendix

Table 8. Additional results on Tanks&Temples.

Method	Attack PSNR
BadNets + 3DGS	4.73

Appendix

Table 9. Direct transfer of BadNets-style 2D poisoning to 3DGS.

I:S:R	Attack	Train	Test	Constraint
35:5:15	40.48	29.50	23.78	26.40
20:15:20	32.15	33.62	27.10	37.41
25:5:25 (Ours)	36.23	34.59	27.80	31.15

Appendix

Table 10. Ablation on the iteration ratio among Injection, Stabilization, and Restoration stages.

Deviation Angle	SSIM	PSNR	LPIPS
1.0 ∘	0.7956	17.81	0.2282
2.0 ∘	0.8096	19.15	0.2222
3.0 ∘	0.8297	20.73	0.2083
4.0 ∘	0.8529	22.36	0.1895

Appendix

Table 11. Viewpoint perturbation analysis around the trigger pose on Mip-NeRF360.

Viewpoint Type	SSIM	PSNR	LPIPS
Attack	0.2527	9.67	0.4761
Train	0.2035	9.74	0.6264
Test	0.1975	10.10	0.6290
Constraint	0.2220	9.56	0.5670

Appendix

Table 12. Ablation of Global Fidelity Restoration.

Model	File Size (MB)	Point Number
Original	71.82	972,896
Ours	66.38	726,768

Appendix

Table 13. Comparison of model file size and point number.

Method	Time (Sec)	Overhead
Original	1,012	1.0 $\times$
Ours	4,636	4.5 $\times$
IPA-NeRF	23,264	23.0 $\times$
StealthAttack	34,657	34.2 $\times$

Appendix

Table 14. Training time comparison.

Viewpoint Type	PSNR SD	SSIM SD	LPIPS SD
Attack	0.12	0.001	0.001
Train	0.18	0.002	0.002
Test	0.21	0.003	0.003
Stabilization	0.15	0.002	0.002

Appendix

Table 15. Standard deviations over 10 runs on Blender.

3D Gaussian Splatting

3D Gaussian Splatting represents scenes as optimizable 3D Gaussian primitives for fast, photorealistic rendering from new viewpoints.

See all 986 papers

DefenseSplat: Enhancing the Robustness of 3D Gaussian Splatting via Frequency-Aware Filtering
Feb 22, 2026Yiran Qiao, Yiren Lu, Yunlai Zhou +43D Gaussian Splatting 3D Reconstruction
Case Western Reserve University, Cleveland OH 44106, USA
Fake3DGS: A Benchmark for 3D Manipulation Detection in Neural Rendering
Apr 30, 2026Davide Di Nucci, Riccardo Catalini, Guido Borghi +13D Gaussian Splatting Neural Rendering
University of Modena and Reggio Emilia, Via Pietro Vivarelli, 41121 Modena, Italy
Spectral Defense Against Resource-Targeting Attack in 3D Gaussian Splatting
Mar 13, 2026Yang Chen, Yi Yu, Jiaming He +33D Gaussian Splatting Adversarial Robustness
Nanyang Technological University · UESTC · Tsinghua University +2

Feb 22, 2026J/K move · Enter open · S save

DefenseSplat: Enhancing the Robustness of 3D Gaussian Splatting via Frequency-Aware Filtering

Yiran Qiao, Yiren Lu, Yunlai Zhou, Rui Yang+3

Case Western Reserve University, Cleveland OH 44106, USA

3D Gaussian Splatting 3D Reconstruction Adversarial Robustness Adversarial Perturbations

Open paper AskPDF arXiv

3D Gaussian Splatting (3DGS) has emerged as a powerful paradigm for real-time and high-fidelity 3D reconstruction from posed images. However, recent studies reveal its vulnerability to adversarial corruptions in input views, where imperceptible yet consistent perturbations can drastically degrade rendering quality, increase training and rendering time, and inflate memory usage, even leading to server denial-of-service. In our work, to mitigate this issue, we begin by analyzing the distinct behaviors of adversarial perturbations in the low- and high-frequency components of input images using wavelet transforms. Based on this observation, we design a simple yet effective frequency-aware defense strategy that reconstructs training views by filtering high-frequency noise while preserving low-frequency content. This approach effectively suppresses adversarial artifacts while maintaining the authenticity of the original scene. Notably, it does not significantly impair training on clean data, achieving a desirable trade-off between robustness and performance on clean inputs. Through extensive experiments under a wide range of attack intensities on multiple benchmarks, we demonstrate that our method substantially enhances the robustness of 3DGS without access to clean ground-truth supervision. By highlighting and addressing the overlooked vulnerabilities of 3D Gaussian Splatting, our work paves the way for more robust and secure 3D reconstructions.

Abstract

3D Gaussian Splatting

Explore similar work

DefenseSplat: Enhancing the Robustness of 3D Gaussian Splatting via Frequency-Aware Filtering

Fake3DGS: A Benchmark for 3D Manipulation Detection in Neural Rendering

Spectral Defense Against Resource-Targeting Attack in 3D Gaussian Splatting