AdvSplat: Adversarial Attacks on Feed-Forward Gaussian Splatting Models

Yiran Qiao; Yiren Lu; Yunlai Zhou; Rui Yang; Linlin Hou; Yu Yin; Jing Ma

cs.CVMar 24, 2026

AdvSplat: Adversarial Attacks on Feed-Forward Gaussian Splatting Models

Authors: Yiran Qiao, Yiren Lu, Yunlai Zhou, Rui Yang, Linlin Hou, Yu Yin, Jing Ma

Organizations: Case Western Reserve University, Cleveland OH 44106, USA

Abstract

3D Gaussian Splatting (3DGS) is increasingly recognized as a powerful paradigm for real-time, high-fidelity 3D reconstruction. However, its per-scene optimization pipeline limits scalability and generalization, and prevents efficient inference. Recently emerged feed-forward 3DGS models address these limitations by enabling fast reconstruction from a few input views after large-scale pretraining, without scene-specific optimization. Despite their advantages and strong potential for commercial deployment, the use of neural networks as the backbone also amplifies the risk of adversarial manipulation. In this paper, we introduce AdvSplat, the first systematic study of adversarial attacks on feed-forward 3DGS. We first employ white-box attacks to reveal fundamental vulnerabilities of this model family. We then develop two improved, practically relevant, query-efficient black-box algorithms that optimize pixel-space perturbations via a frequency-domain parameterization: one based on gradient estimation and the other gradient-free, without requiring any access to model internals. Extensive experiments across multiple datasets demonstrate that AdvSplat can significantly disrupt reconstruction results by injecting imperceptible perturbations into the input images. Our findings surface an overlooked yet urgent problem in this domain, and we hope to draw the community's attention to this emerging security and robustness challenge.

Figures & tables

Figure 1: White-box attack (here we use PGD attack [ 26 ] ) results against feed-forward 3DGS model (here we use NoPoSplat [ 51 ] )) on the RE10K dataset. "Ref." denotes two input reference views, and "Novel Views" denote the newly rendered target viewpoints. The first row shows results on clean inputs, while the second row shows results on adversarially perturbed inputs. The rightmost radar chart shows the rendered image quality with clean/attacked inputs, where PSNR is normalized with 30 as the maximum value. As shown, both quantitative and qualitative results consistently indicate that even imperceptible perturbations can severely degrade the reconstruction quality.

Figure 2: Pipeline of our proposed method, including gradient-based and gradient-free variants. The blue blocks denote the DCT coefficient maps, the yellow blocks denote the sampled noise, the green blocks denote the images after iDCT, and the purple blocks denote the rendered images. The black box in the center is the feed-forward 3DGS model with unknown parameters, illustrated by the gray block . The gray ellipses depict a contour map of the loss function, and the red star indicates the maximum. The red arrow inside the ellipse shows the gradient direction, while the red dashed ellipse indicates the noise sampling region. Finally, the noise sample marked with a red checkmark is the optimal perturbation we seek.

Victim Models	PSNR $\downarrow$	SSIM $\downarrow$	LPIPS $\uparrow$	CLIP $\downarrow$	DINO $\downarrow$
DepthSplat	21.09	0.710	0.228	0.956	0.930
DepthSplat+Ours (GB)	7.57 ( $-64.1\%$ )	0.289 ( $-59.3\%$ )	0.581 ( $+154.8\%$ )	0.740 ( $-22.3\%$ )	0.492 ( $-47.1\%$ )
DepthSplat+Ours (GF)	9.73 ( $-53.9\%$ )	0.437 ( $-38.5\%$ )	0.514 ( $+125.4\%$ )	0.803 ( $-16.0\%$ )	0.727 ( $-21.8\%$ )
NoPoSplat	22.50	0.781	0.165	0.957	0.938
NoPoSplat+Ours (GB)	17.64 ( $-21.6\%$ )	0.523 ( $-33.0\%$ )	0.417 ( $+152.7\%$ )	0.893 ( $-6.7\%$ )	0.816 ( $-13.0\%$ )
NoPoSplat+Ours (GF)	14.02 ( $-37.7\%$ )	0.397 ( $-49.2\%$ )	0.549 ( $+232.7\%$ )	0.856 ( $-10.6\%$ )	0.729 ( $-22.3\%$ )

Table 1: Quantitative comparison of victim model performance with vs. without our attack on the RE10K dataset. GB denotes the gradient-based variant, and GF denotes the gradient-free variant. Percentages measure the degree of performance degradation.

Victim Models	PSNR $\downarrow$	SSIM $\downarrow$	LPIPS $\uparrow$	CLIP $\downarrow$	DINO $\downarrow$
DepthSplat	22.21	0.785	0.165	0.963	0.909
DepthSplat+Ours (GB)	14.38 ( $-35.3\%$ )	0.546 ( $-30.4\%$ )	0.448 ( $+171.5\%$ )	0.837 ( $-13.1\%$ )	0.738 ( $-18.8\%$ )
DepthSplat+Ours (GF)	16.59 ( $-25.3\%$ )	0.588 ( $-25.1\%$ )	0.396 ( $+140.0\%$ )	0.851 ( $-11.6\%$ )	0.798 ( $-12.2\%$ )
NoPoSplat	21.91	0.745	0.173	0.960	0.903
NoPoSplat+Ours (GB)	19.80 ( $-9.6\%$ )	0.582 ( $-21.9\%$ )	0.338 ( $+95.4\%$ )	0.886 ( $-7.7\%$ )	0.819 ( $-9.3\%$ )
NoPoSplat+Ours (GF)	17.17 ( $-21.6\%$ )	0.425 ( $-43.0\%$ )	0.439 ( $+153.8\%$ )	0.858 ( $-10.6\%$ )	0.722 ( $-20.0\%$ )

Table 2: Quantitative comparison of victim model performance with vs. without our attack on the DL3DV dataset. GB denotes the gradient-based variant, and GF denotes the gradient-free variant. Percentages measure the degree of performance degradation.

Figure 3: Qualitative results on RE10K and DL3DV ( $\epsilon=8/255$ ). The left half shows scenes from RE10K, while the right half shows scenes from DL3DV. DP denotes DepthSplat, NP denotes NoPoSplat, and AP denotes AnySplat. GB denotes the gradient-based variant, and GF denotes the gradient-free variant. For each method and each scene, we select two reference views and render three novel views. All baselines use clean inputs, whereas our method uses the optimized adversarial examples as inputs.

Figure 4: Visualization of 3D Gaussian point clouds.

Figure 5: Loss comparison with and without DCT. GB denotes the gradient-based variant, and GF denotes the gradient-free variant.

$\epsilon$	Method	RE10K					DL3DV
$\epsilon$	Method	PSNR $\downarrow$	SSIM $\downarrow$	LPIPS $\uparrow$	CLIP $\downarrow$	DINO $\downarrow$	PSNR $\downarrow$	SSIM $\downarrow$	LPIPS $\uparrow$	CLIP $\downarrow$	DINO $\downarrow$
2/255	GB	23.65	0.777	0.350	0.937	0.933	15.61	0.617	0.246	0.956	0.957
2/255	GF	23.59	0.772	0.321	0.942	0.946	20.23	0.698	0.231	0.967	0.978
4/255	GB	5.96	0.195	0.504	0.711	0.571	9.71	0.455	0.378	0.907	0.898
4/255	GF	9.914	0.464	0.363	0.874	0.802	14.08	0.561	0.292	0.937	0.954
8/255	GB	4.38	0.050	0.663	0.554	0.060	8.09	0.384	0.493	0.858	0.726

Table 3: Victim model performance on the RE10K and DL3DV datasets (We select one scene per dataset and use DepthSplat) under different attack strengths (

\epsilon

values). GB denotes the gradient-based variant, and GF denotes the gradient-free variant.

Figure 6: Qualitative results under different attack strengths. The gray background is used to better visualize the all-white rendered images.

Appendix figures & tables5 assets

Supplementary material from the paper’s appendix.

Appendix

Victim Models	PSNR $\downarrow$	SSIM $\downarrow$	LPIPS $\uparrow$	CLIP $\downarrow$	DINO $\downarrow$
DepthSplat	21.09	0.710	0.228	0.956	0.930
DepthSplat+Ours	6.82 ( $-67.7\%$ )	0.223 ( $-68.6\%$ )	0.594 ( $+160.5\%$ )	0.677 ( $-29.2\%$ )	0.370 ( $-60.2\%$ )
NoPoSplat	22.50	0.781	0.165	0.957	0.938
NoPoSplat+Ours	8.82 ( $-60.8\%$ )	0.268 ( $-65.7\%$ )	0.692 ( $+319.4\%$ )	0.780 ( $-18.5\%$ )	0.598 ( $-36.2\%$ )
AnySplat	18.94	0.672	0.271	0.928	0.938
AnySplat+Ours	10.20 ( $-46.1\%$ )	0.422 ( $-37.2\%$ )	0.658 ( $+142.8\%$ )	0.763 ( $-17.8\%$ )	0.450 ( $-52.0\%$ )

Appendix

Table 4: Quantitative comparison of victim model performance with vs. without our white-box attack on the RE10K dataset. Percentages measure the degree of performance degradation.

Victim Models	PSNR $\downarrow$	SSIM $\downarrow$	LPIPS $\uparrow$	CLIP $\downarrow$	DINO $\downarrow$
DepthSplat	22.21	0.785	0.165	0.963	0.909
DepthSplat+Ours	6.54 ( $-70.6\%$ )	0.202 ( $-74.3\%$ )	0.625 ( $+278.8\%$ )	0.665 ( $-30.9\%$ )	0.205 ( $-77.4\%$ )
NoPoSplat	21.91	0.745	0.173	0.960	0.903
NoPoSplat+Ours	11.44 ( $-47.8\%$ )	0.249 ( $-66.6\%$ )	0.634 ( $+266.5\%$ )	0.787 ( $-18.0\%$ )	0.527 ( $-41.6\%$ )
AnySplat	19.34	0.639	0.285	0.950	0.923
AnySplat+Ours	14.43 ( $-25.4\%$ )	0.427 ( $-33.2\%$ )	0.523 ( $+83.5\%$ )	0.860 ( $-9.5\%$ )	0.849 ( $-8.0\%$ )

Appendix

Table 5: Quantitative comparison of victim model performance with vs. without our white-box attack on the DL3DV dataset. Percentages measure the degree of performance degradation.

Figure 7: Qualitative results for white-box attack on RE10K and DL3DV ( $\epsilon=8/255$ ). The left half shows scenes from RE10K, while the right half shows scenes from DL3DV. The clean reconstruction results are shown in Fig. 3 .

Victim Model	Surrogate Model	PSNR $\downarrow$	SSIM $\downarrow$	LPIPS $\uparrow$	CLIP $\downarrow$	DINO $\downarrow$
DepthSplat	None	21.09	0.710	0.228	0.956	0.930
	NoPoSplat	20.32	0.653	0.406	0.927	0.889
	AnySplat	20.10	0.658	0.294	0.947	0.905
NoPoSplat	None	22.50	0.781	0.165	0.957	0.938
	DepthSplat	22.36	0.733	0.310	0.934	0.894
	AnySplat	22.02	0.743	0.265	0.946	0.911

Appendix

Table 6: Quantitative comparison of transfer attack performance on RE10K. Adversarial examples are generated on a surrogate model and transferred to the victim model. "None" means using the clean data.

Figure 8: Qualitative results for transfer attack on RE10K ( $\epsilon=8/255$ ). Each row corresponds to a victim model, and the surrogate model is indicated in each column. The clean reconstruction results are shown in Fig. 3 .

Explore similar work

ForeSplat: Optimization-Aware Foresight for Feed-Forward 3D Gaussian Splatting
May 21, 2026Yuke Li, Weihang Liu, Cheng Zhang +83D Gaussian Splatting Meta-Learning
ShanghaiTech University · GGU Technology Co., Ltd · Stereye
AdaptSplat: Adapting Vision Foundation Models for Feed-Forward 3D Gaussian Splatting
May 11, 2026Mingwei Xing, Xinliang Wang, Yifeng Shi3D Gaussian Splatting Vision Foundation Model Adaptation
Ke Holdings Inc.
DefenseSplat: Enhancing the Robustness of 3D Gaussian Splatting via Frequency-Aware Filtering
Feb 22, 2026Yiran Qiao, Yiren Lu, Yunlai Zhou +43D Gaussian Splatting 3D Reconstruction
Case Western Reserve University, Cleveland OH 44106, USA

May 21, 2026J/K move · Enter open · S save

ForeSplat: Optimization-Aware Foresight for Feed-Forward 3D Gaussian Splatting

Yuke Li, Weihang Liu, Cheng Zhang, Yuefeng Zhang+7

ShanghaiTech University · GGU Technology Co., Ltd · Stereye

3D Gaussian Splatting Meta-Learning 3D Reconstruction Feed-Forward 3D Reconstruction

Open paper AskPDF arXiv

Feed-forward 3D Gaussian Splatting models offer fast single-pass reconstruction,but scaling them to match per-scene optimization quality is fundamentally hindered by the scarcity of large-scale 3D annotations. A practical compromise is predict-then-refine,where post-prediction optimization compensates for the limited capacity of the feed-forward network. However,standard feed-forward 3DGS is trained solely for zero-step rendering error,ignoring whether its output constitutes a good initialization for the downstream optimizer. We present ForeSplat,an optimization-aware training framework that equips feed-forward 3DGS models to produce initializations explicitly designed for rapid,effective refinement. By offloading part of the scene-modeling burden to the optimizer,ForeSplat substantially reduces the capacity pressure on the feed-forward model,making high-quality reconstruction feasible even with compact networks. At its core is MetaGrad,a lightweight multi-anchor meta-gradient training rule that bypasses costly higher-order differentiation through the 3DGS optimizer. MetaGrad unrolls a short inner-loop refinement trajectory,samples anchor states,and back-propagates aggregated first-order gradients to the prediction head as a surrogate optimization-aware signal. This fine-tuning adds no inference cost and enables high-quality reconstruction within seconds after a few refinement steps. We instantiate ForeSplat on diverse backbones,including AnySplat,Pi3X,and a distilled variant tailored for edge deployment. Across all tested architectures,a ForeSplat-trained initialization converges in fewer refinement steps and reaches a higher peak reconstruction quality than its vanilla counterpart,even fully converged. The framework consistently bridges the gap between amortized prediction and per-scene optimization,establishing a practical path toward lightweight,high-fidelity 3D reconstruction.

Abstract

Explore similar work

ForeSplat: Optimization-Aware Foresight for Feed-Forward 3D Gaussian Splatting

AdaptSplat: Adapting Vision Foundation Models for Feed-Forward 3D Gaussian Splatting

DefenseSplat: Enhancing the Robustness of 3D Gaussian Splatting via Frequency-Aware Filtering