Spectral Defense Against Resource-Targeting Attack in 3D Gaussian Splatting

Yang Chen; Yi Yu; Jiaming He; Yueqi Duan; Zheng Zhu; Yap-Peng Tan

cs.CVMar 13, 2026

Spectral Defense Against Resource-Targeting Attack in 3D Gaussian Splatting

Authors: Yang Chen, Yi Yu, Jiaming He, Yueqi Duan, Zheng Zhu, Yap-Peng Tan

Organizations: Nanyang Technological University · UESTC · Tsinghua University · GigaAI ·

Abstract

Recent advances in 3D Gaussian Splatting (3DGS) deliver high-quality rendering, yet the Gaussian representation exposes a new attack surface, the resource-targeting attack. This attack poisons training images, excessively inducing Gaussian growth to cause resource exhaustion. Although efficiency-oriented methods such as smoothing, thresholding, and pruning have been explored, these spatial-domain strategies operate on visible structures but overlook how stealthy perturbations distort the underlying spectral behaviors of training data. As a result, poisoned inputs introduce abnormal high-frequency amplifications that mislead 3DGS into interpreting noisy patterns as detailed structures, ultimately causing unstable Gaussian overgrowth and degraded scene fidelity. To address this, we propose Spectral Defense in Gaussian and image fields. We first design a 3D frequency filter to selectively prune Gaussians exhibiting abnormally high frequencies. Since natural scenes also contain legitimate high-frequency structures, directly suppressing high frequencies is insufficient, and we further develop a 2D spectral regularization on renderings, distinguishing naturally isotropic frequencies while penalizing anisotropic angular energy to constrain noisy patterns. Experiments show that our defense builds robust, accurate, and secure 3DGS, suppressing overgrowth by up to $5.92\times$ , reducing memory by up to $3.66\times$ , and improving speed by up to $4.34\times$ under attacks.

Figures & tables

Figure 1: Spectral defense against attack in 3DGS. (a) A resource-targeting attack poisons input images to trigger excessive Gaussian growth, leading to redundant splats and degrading renderings. Our defense operates jointly in 3D and 2D domains, where 3D frequency filter prunes Gaussians with abnormally high-frequency responses to suppress attack-induced overgrowth, and 2D spectral regularization constrains the angular distribution of energy to reduce anisotropic noise. (b) Frequency spectrum reveals spectral energy and angular distribution to distinguish frequency components of images.

Figure 2: Spectral energy over frequencies under clean, poisoned, and defended settings.

Metric	Max Gaussian Number (M) $\downarrow$			Peak GPU Memory (MB) $\downarrow$			Training Time (min) $\downarrow$
Setting	clean	poison	defense	clean	poison	defense	clean	poison	defense
TT-Auditorium	0.692	2.740 ${}_{{\color[rgb]{0.6992,0.1328,0.1328}3.96\!\times\!\uparrow}}$	0.907 ${}_{{\color[rgb]{0.2539,0.4102,0.8828}3.02\!\times\!\downarrow}}$	4918	15280 ${}_{{\color[rgb]{0.6992,0.1328,0.1328}3.11\!\times\!\uparrow}}$	7633 ${}_{{\color[rgb]{0.2539,0.4102,0.8828}2.00\!\times\!\downarrow}}$	10.91	18.88 ${}_{{\color[rgb]{0.6992,0.1328,0.1328}1.73\!\times\!\uparrow}}$	15.27 ${}_{{\color[rgb]{0.2539,0.4102,0.8828}1.24\!\times\!\downarrow}}$
TT-Ballroom	3.123	4.007 ${}_{{\color[rgb]{0.6992,0.1328,0.1328}1.28\!\times\!\uparrow}}$	1.983 ${}_{{\color[rgb]{0.2539,0.4102,0.8828}2.02\!\times\!\downarrow}}$	9902	11510 ${}_{{\color[rgb]{0.6992,0.1328,0.1328}1.16\!\times\!\uparrow}}$	7075 ${}_{{\color[rgb]{0.2539,0.4102,0.8828}1.63\!\times\!\downarrow}}$	20.41	23.32 ${}_{{\color[rgb]{0.6992,0.1328,0.1328}1.14\!\times\!\uparrow}}$	19.81 ${}_{{\color[rgb]{0.2539,0.4102,0.8828}1.18\!\times\!\downarrow}}$
TT-Barn	0.998	1.853 ${}_{{\color[rgb]{0.6992,0.1328,0.1328}1.86\!\times\!\uparrow}}$	0.903 ${}_{{\color[rgb]{0.2539,0.4102,0.8828}2.05\!\times\!\downarrow}}$	6801	9594 ${}_{{\color[rgb]{0.6992,0.1328,0.1328}1.41\!\times\!\uparrow}}$	6569 ${}_{{\color[rgb]{0.2539,0.4102,0.8828}1.46\!\times\!\downarrow}}$	11.26	14.70 ${}_{{\color[rgb]{0.6992,0.1328,0.1328}1.31\!\times\!\uparrow}}$	12.33 ${}_{{\color[rgb]{0.2539,0.4102,0.8828}1.19\!\times\!\downarrow}}$
TT-Caterpillar	1.272	1.877 ${}_{{\color[rgb]{0.6992,0.1328,0.1328}1.48\!\times\!\uparrow}}$	0.738 ${}_{{\color[rgb]{0.2539,0.4102,0.8828}2.54\!\times\!\downarrow}}$	6279	7589 ${}_{{\color[rgb]{0.6992,0.1328,0.1328}1.21\!\times\!\uparrow}}$	5398 ${}_{{\color[rgb]{0.2539,0.4102,0.8828}1.41\!\times\!\downarrow}}$	11.83	14.02 ${}_{{\color[rgb]{0.6992,0.1328,0.1328}1.19\!\times\!\uparrow}}$	13.70 ${}_{{\color[rgb]{0.2539,0.4102,0.8828}1.02\!\times\!\downarrow}}$
TT-Church	2.312	3.342 ${}_{{\color[rgb]{0.6992,0.1328,0.1328}1.45\!\times\!\uparrow}}$	1.292 ${}_{{\color[rgb]{0.2539,0.4102,0.8828}2.59\!\times\!\downarrow}}$	9032	11405 ${}_{{\color[rgb]{0.6992,0.1328,0.1328}1.26\!\times\!\uparrow}}$	7534 ${}_{{\color[rgb]{0.2539,0.4102,0.8828}1.51\!\times\!\downarrow}}$	16.86	20.24 ${}_{{\color[rgb]{0.6992,0.1328,0.1328}1.20\!\times\!\uparrow}}$	16.08 ${}_{{\color[rgb]{0.2539,0.4102,0.8828}1.26\!\times\!\downarrow}}$

Table 1: Training statistics on all scenes from the Tanks and Temples (TT), NeRF-Synthetic (NS), and Mip-NeRF 360 (MIP) datasets under clean, poison, and defense settings. We report the maximum Gaussian number (M), peak GPU memory (MB), and training time (min).

Figure 3: Qualitative comparison under the poison setting across representative scenes.

Metric	SSIM $\uparrow$					PSNR $\uparrow$
Setting	poison	$\text{UT}^{\triangledown}$ [ 25 ]	$\text{LG}^{\triangledown}$ [ 7 ]	$\text{PUP}^{\triangledown}$ [ 9 ]	defense	poison	$\text{UT}^{\triangledown}$ [ 25 ]	$\text{LG}^{\triangledown}$ [ 7 ]	$\text{PUP}^{\triangledown}$ [ 9 ]	defense
TT-Barn	0.64	0.68	0.65	0.64	0.71	25.29	24.08	25.03	25.14	25.90
TT-Church	0.65	0.64	0.68	0.64	0.70	22.52	18.77	22.45	21.56	22.82
TT-Panther	0.60	0.60	0.61	0.61	0.69	25.25	17.02	25.09	24.57	25.79
NS-chair	0.22	0.22	0.22	0.23	0.23	24.60	24.57	24.93	24.82	25.00
NS-hotdog	0.26	0.26	0.27	0.26	0.28	27.00	27.08	27.02	26.82	27.66

Table 2: Rendering performance on partial scenes from the TT, NS, and MIP datasets, where the results of all scenes are provided in the supplementary materials. We use SSIM and PSNR to measure the visual fidelity of reconstruction compared with various pruning methods, which are retrained based on poisoned images and evaluated on clean images, including

\text{UT}^{\triangledown}

\text{LG}^{\triangledown}

\text{PUP}^{\triangledown}

, and defense (ours).

Table 6

Metric	Max Gaussian Number (M) $\downarrow$			Peak GPU Memory (MB) $\downarrow$			Training Time (min) $\downarrow$
Setting	clean	poison	defense	clean	poison	defense	clean	poison	defense
MIP-bicycle	9.205	17.401 ${}_{{\color[rgb]{0.6992,0.1328,0.1328}1.89\!\times\!\uparrow}}$	4.223 ${}_{{\color[rgb]{0.2539,0.4102,0.8828}4.12\!\times\!\downarrow}}$	15058	18261 ${}_{{\color[rgb]{0.6992,0.1328,0.1328}1.21\!\times\!\uparrow}}$	12101 ${}_{{\color[rgb]{0.2539,0.4102,0.8828}1.51\!\times\!\downarrow}}$	35.02	40.05 ${}_{{\color[rgb]{0.6992,0.1328,0.1328}1.14\!\times\!\uparrow}}$	34.42 ${}_{{\color[rgb]{0.2539,0.4102,0.8828}1.16\!\times\!\downarrow}}$
MIP-bonsai	4.231	11.108 ${}_{{\color[rgb]{0.6992,0.1328,0.1328}2.63\!\times\!\uparrow}}$	2.011 ${}_{{\color[rgb]{0.2539,0.4102,0.8828}5.52\!\times\!\downarrow}}$	9979	13959 ${}_{{\color[rgb]{0.6992,0.1328,0.1328}1.40\!\times\!\uparrow}}$	8294 ${}_{{\color[rgb]{0.2539,0.4102,0.8828}1.68\!\times\!\downarrow}}$	29.65	34.60 ${}_{{\color[rgb]{0.6992,0.1328,0.1328}1.17\!\times\!\uparrow}}$	29.41 ${}_{{\color[rgb]{0.2539,0.4102,0.8828}1.18\!\times\!\downarrow}}$
MIP-counter	2.855	6.506 ${}_{{\color[rgb]{0.6992,0.1328,0.1328}2.28\!\times\!\uparrow}}$	1.738 ${}_{{\color[rgb]{0.2539,0.4102,0.8828}3.74\!\times\!\downarrow}}$	11549	20755 ${}_{{\color[rgb]{0.6992,0.1328,0.1328}1.80\!\times\!\uparrow}}$	9575 ${}_{{\color[rgb]{0.2539,0.4102,0.8828}2.17\!\times\!\downarrow}}$	34.56	38.63 ${}_{{\color[rgb]{0.6992,0.1328,0.1328}1.12\!\times\!\uparrow}}$	32.76 ${}_{{\color[rgb]{0.2539,0.4102,0.8828}1.18\!\times\!\downarrow}}$
MIP-flowers	7.075	11.361 ${}_{{\color[rgb]{0.6992,0.1328,0.1328}1.61\!\times\!\uparrow}}$	5.197 ${}_{{\color[rgb]{0.2539,0.4102,0.8828}2.19\!\times\!\downarrow}}$	9611	12603 ${}_{{\color[rgb]{0.6992,0.1328,0.1328}1.31\!\times\!\uparrow}}$	6230 ${}_{{\color[rgb]{0.2539,0.4102,0.8828}2.02\!\times\!\downarrow}}$	31.96	34.66 ${}_{{\color[rgb]{0.6992,0.1328,0.1328}1.08\!\times\!\uparrow}}$	32.03 ${}_{{\color[rgb]{0.2539,0.4102,0.8828}1.08\!\times\!\downarrow}}$
MIP-garden	7.587	11.795 ${}_{{\color[rgb]{0.6992,0.1328,0.1328}1.55\!\times\!\uparrow}}$	4.201 ${}_{{\color[rgb]{0.2539,0.4102,0.8828}2.81\!\times\!\downarrow}}$	10449	15775 ${}_{{\color[rgb]{0.6992,0.1328,0.1328}1.51\!\times\!\uparrow}}$	8437 ${}_{{\color[rgb]{0.2539,0.4102,0.8828}1.87\!\times\!\downarrow}}$	33.46	40.15 ${}_{{\color[rgb]{0.6992,0.1328,0.1328}1.20\!\times\!\uparrow}}$	33.89 ${}_{{\color[rgb]{0.2539,0.4102,0.8828}1.18\!\times\!\downarrow}}$

Table 5: Black-box attack results on Scaffold-GS [ 26 ] as the victim system to demonstrate our defense generalization ability against unknown black-box victim systems.

Table 8

Table 9

Table 10

3D Gaussian Splatting

3D Gaussian Splatting represents scenes as optimizable 3D Gaussian primitives for fast, photorealistic rendering from new viewpoints.

See all 986 papers

DefenseSplat: Enhancing the Robustness of 3D Gaussian Splatting via Frequency-Aware Filtering
Feb 22, 2026Yiran Qiao, Yiren Lu, Yunlai Zhou +43D Gaussian Splatting 3D Reconstruction
Case Western Reserve University, Cleveland OH 44106, USA
GaussTrap: Stealthy Backdoor Attacks on 3D Gaussian Splatting for Targeted Scene Misperception
Apr 29, 2025Jiaxin Hong, Sixu Chen, Shuoyang Sun +53D Gaussian Splatting 3DGS Training
Harbin Institute of Technology(Shenzhen) · South China University of Technology · Shenzhen Internation Graduate School, Tsinghua University +1
GS^2: Graph-based Spatial Distribution Optimization for Compact 3D Gaussian Splatting
Apr 2, 2026Xianben Yang, Tao Wang, Yuxuan Li +23D Gaussian Splatting 3DGS Compression
Key Laboratory of Big Data and Artificial Intelligence in Transportation, Ministry of Education; School of Computer and Information Technology, Beijing Jiaotong University, Beijing 100044, China · Department of Artificial Intelligence, Westlake University, Hangzhou 310030, China

Feb 22, 2026J/K move · Enter open · S save

DefenseSplat: Enhancing the Robustness of 3D Gaussian Splatting via Frequency-Aware Filtering

Yiran Qiao, Yiren Lu, Yunlai Zhou, Rui Yang+3

Case Western Reserve University, Cleveland OH 44106, USA

3D Gaussian Splatting 3D Reconstruction Adversarial Robustness Adversarial Perturbations

Open paper AskPDF arXiv

3D Gaussian Splatting (3DGS) has emerged as a powerful paradigm for real-time and high-fidelity 3D reconstruction from posed images. However, recent studies reveal its vulnerability to adversarial corruptions in input views, where imperceptible yet consistent perturbations can drastically degrade rendering quality, increase training and rendering time, and inflate memory usage, even leading to server denial-of-service. In our work, to mitigate this issue, we begin by analyzing the distinct behaviors of adversarial perturbations in the low- and high-frequency components of input images using wavelet transforms. Based on this observation, we design a simple yet effective frequency-aware defense strategy that reconstructs training views by filtering high-frequency noise while preserving low-frequency content. This approach effectively suppresses adversarial artifacts while maintaining the authenticity of the original scene. Notably, it does not significantly impair training on clean data, achieving a desirable trade-off between robustness and performance on clean inputs. Through extensive experiments under a wide range of attack intensities on multiple benchmarks, we demonstrate that our method substantially enhances the robustness of 3DGS without access to clean ground-truth supervision. By highlighting and addressing the overlooked vulnerabilities of 3D Gaussian Splatting, our work paves the way for more robust and secure 3D reconstructions.

Abstract

3D Gaussian Splatting

Explore similar work

DefenseSplat: Enhancing the Robustness of 3D Gaussian Splatting via Frequency-Aware Filtering

GaussTrap: Stealthy Backdoor Attacks on 3D Gaussian Splatting for Targeted Scene Misperception

GS^2: Graph-based Spatial Distribution Optimization for Compact 3D Gaussian Splatting