Immunizing 3D Gaussian Generative Models Against Unauthorized Fine-Tuning via Attribute-Space Traps

Jianwei Zhang; Sihan Cao; Chaoning Zhang; Ziming Hong; Jiaxin Huang; Pengcheng Zheng; Caiyan Qin; Wei Dong

cs.CVApr 6, 2026

Immunizing 3D Gaussian Generative Models Against Unauthorized Fine-Tuning via Attribute-Space Traps

Authors: Jianwei Zhang, Sihan Cao, Chaoning Zhang, Ziming Hong, Jiaxin Huang, Pengcheng Zheng, Caiyan Qin, Wei Dong,

Organizations: School of Computer Science and Engineering, University of Electronic Science and Technology of China, Chengdu 611731, China · Sydney AI Centre, The University of Sydney, Sydney, NSW 2006, Australia · Machine Learning Department, Mohamed bin Zayed University of Artificial Intelligence, Abu Dhabi, United Arab Emirates · School of Robotics and Advanced Manufacture, Harbin Institute of Technology, Shenzhen 518055, China ·

Abstract

Recent large-scale generative models enable high-quality 3D synthesis. However, the public accessibility of pre-trained weights introduces a critical vulnerability. Adversaries can fine-tune these models to steal specialized knowledge acquired during pre-training, leading to intellectual property infringement. Unlike defenses for 2D images and language models, 3D generators require specialized protection due to their explicit Gaussian representations, which expose fundamental structural parameters directly to gradient-based optimization. We propose GaussLock, the first approach designed to defend 3D generative models against fine-tuning attacks. GaussLock is a lightweight parameter-space immunization framework that integrates authorized distillation with attribute-aware trap losses targeting position, scale, rotation, opacity, and color. Specifically, these traps systematically collapse spatial distributions, distort geometric shapes, align rotational axes, and suppress primitive visibility to fundamentally destroy structural integrity. By jointly optimizing these dual objectives, the distillation process preserves fidelity on authorized tasks while the embedded traps actively disrupt unauthorized reconstructions. Experiments on large-scale Gaussian models demonstrate that GaussLock effectively neutralizes unauthorized fine-tuning attacks. It substantially degrades the quality of unauthorized reconstructions, evidenced by significantly higher LPIPS and lower PSNR, while effectively maintaining performance on authorized fine-tuning.

Figures & tables

Fig. 1: Overview of the proposed GaussLock framework. Teacher-student distillation ensures high utility on original source tasks (checked green box). For the target domain, input views trigger a dormant parameter-space defense during unauthorized fine-tuning. Attribute-aware trap losses applied to explicit Gaussian parameters are averaged to form the Coupled Trap Loss ( $\mathcal{L}_{trap}$ ), inducing comprehensive geometric and visibility collapse (crossed red box) to deny visual utility to adversaries while preserving source task fidelity.

Category	Method	Source Utility (Avg.)		Target (100 Steps)		Target (200 Steps)		Target (300 Steps)		Target (400 Steps)
Category	Method	PSNR $\uparrow$	LPIPS $\downarrow$	PSNR $\downarrow$	LPIPS $\uparrow$	PSNR $\downarrow$	LPIPS $\uparrow$	PSNR $\downarrow$	LPIPS $\uparrow$	PSNR $\downarrow$	LPIPS $\uparrow$
shoe	baseline	22.52	0.0722	23.17	0.0573	23.76	0.0527	24.35	0.0490	24.85	0.0464
	naive-unlearning	21.80	0.0822	16.46	0.1517	19.57	0.1150	21.30	0.0854	23.11	0.0668
	ours (GaussLock)	21.25	0.0838	13.96	0.1920	13.96	0.1920	13.96	0.1920	13.96	0.1920
plant	baseline	22.52	0.0722	22.61	0.0740	23.22	0.0679	23.78	0.0630	24.22	0.0600
	naive-unlearning	21.72	0.0855	11.92	0.2251	13.58	0.1894	19.43	0.1254	21.32	0.1028

TABLE I: Quantitative results of intra-domain LoRA fine-tuning attacks (Omni

\rightarrow

Omni). Target metrics are reported across different optimization steps.

Category	Method	Source Utility (Avg.)		Target (100 Steps)		Target (200 Steps)		Target (300 Steps)		Target (400 Steps)
Category	Method	PSNR $\uparrow$	LPIPS $\downarrow$	PSNR $\downarrow$	LPIPS $\uparrow$	PSNR $\downarrow$	LPIPS $\uparrow$	PSNR $\downarrow$	LPIPS $\uparrow$	PSNR $\downarrow$	LPIPS $\uparrow$
shoe	baseline	22.52	0.0722	23.33	0.0563	23.96	0.0515	24.57	0.0477	25.07	0.0451
	naive-unlearning	21.40	0.0812	19.49	0.0913	21.66	0.0698	22.87	0.0596	23.65	0.0535
	ours (GaussLock)	20.67	0.0890	13.71	0.1916	13.71	0.1915	13.73	0.1910	13.76	0.1900
plant	baseline	22.52	0.0722	22.64	0.0734	23.27	0.0674	23.81	0.0627	24.30	0.0593
	naive-unlearning	21.72	0.0923	20.72	0.1151	21.55	0.0928	22.28	0.0777	23.09	0.0695

TABLE II: Quantitative results of cross-domain LoRA fine-tuning attacks (GSO

\rightarrow

Omni).

Category	Method	Source Utility (Avg.)		Target (100 Steps)		Target (200 Steps)		Target (300 Steps)		Target (400 Steps)
Category	Method	PSNR $\uparrow$	LPIPS $\downarrow$	PSNR $\downarrow$	LPIPS $\uparrow$	PSNR $\downarrow$	LPIPS $\uparrow$	PSNR $\downarrow$	LPIPS $\uparrow$	PSNR $\downarrow$	LPIPS $\uparrow$
shoe	baseline	22.52	0.0722	26.11	0.0354	26.35	0.0336	26.55	0.0320	26.54	0.0314
	naive-unlearning	21.80	0.0822	26.24	0.0356	26.43	0.0338	26.46	0.0329	26.79	0.0317
	ours (GaussLock)	21.25	0.0838	13.96	0.1920	13.96	0.1920	13.96	0.1920	13.96	0.1920
plant	baseline	22.52	0.0722	25.88	0.0459	26.14	0.0416	26.52	0.0383	26.46	0.0375
	naive-unlearning	21.72	0.0855	25.90	0.0458	26.40	0.0416	26.69	0.0389	26.82	0.0366

TABLE III: Quantitative results of intra-domain full-parameter fine-tuning attacks (Omni

\rightarrow

Omni).

Category	Initialization	Target PSNR $\uparrow$	Target LPIPS $\downarrow$
shoe	random	7.80	0.6159
shoe	pre-train	25.03	0.0452
plant	random	7.67	0.6037
plant	pre-train	24.28	0.0595
dish	random	8.04	0.6213
dish	pre-train	26.03	0.0511

TABLE IV: Ablation study on model initialization (GSO

\rightarrow

Omni). We compare the target domain reconstruction quality (after 400 attack steps) between a model initialized with pre-trained weights and one with random weights.

Setting	Method	200 Steps		400 Steps
Setting	Method	PSNR $\downarrow$	LPIPS $\uparrow$	PSNR $\downarrow$	LPIPS $\uparrow$
AdamW 3e-6	naive-unlearning	19.13	0.1392	19.70	0.1326
AdamW 3e-6	ours	12.60	0.1955	13.07	0.1896
AdamW 3e-5	naive-unlearning	21.55	0.0928	23.09	0.0695
AdamW 3e-5	ours	20.69	0.1032	22.26	0.0825
SGD 3e-5	naive-unlearning	18.65	0.1438	18.66	0.1437

TABLE V: Ablation on different optimizers and learning rates (GSO

\rightarrow

Omni). Target metrics are recorded at 200 and 400 steps. The Setting column indicates the specific optimizer paired with its corresponding learning rate.

Setting	Method	200 Steps		400 Steps
Setting	Method	PSNR $\downarrow$	LPIPS $\uparrow$	PSNR $\downarrow$	LPIPS $\uparrow$
R8	naive-unlearning	21.04	0.1069	22.06	0.0801
R8	ours	18.81	0.1300	21.24	0.0920
R16	naive-unlearning	21.55	0.0928	23.09	0.0695
R16	ours	20.69	0.1032	22.26	0.0825
R32	naive-unlearning	22.36	0.0774	24.10	0.0620

TABLE VI: Ablation on LoRA ranks (GSO

\rightarrow

Omni). Target metrics are recorded at 200 and 400 steps. The Setting column indicates the specific rank used for the adaptation.

Extended Budget: 800 Steps
Setting	Method	200 Steps		400 Steps		600 Steps		800 Steps
Setting	Method	PSNR $\downarrow$	LPIPS $\uparrow$	PSNR $\downarrow$	LPIPS $\uparrow$	PSNR $\downarrow$	LPIPS $\uparrow$	PSNR $\downarrow$	LPIPS $\uparrow$
800 Steps	N.U.	21.55	0.0919	23.10	0.0693	24.08	0.0620	24.68	0.0578
800 Steps	ours	20.69	0.1027	22.26	0.0826	23.60	0.0698	24.15	0.0639
Highly Aggressive Budget: 1600 Steps
Setting	Method	400 Steps		800 Steps		1200 Steps		1600 Steps

TABLE VII: Ablation on extended training budgets (GSO

\rightarrow

Omni). Target metrics are recorded at different intervals for total optimization budgets of 800 and 1600 steps.

Joint Categories	Method	Source Utility Avg.		Target 200 Steps		Target 400 Steps
Joint Categories	Method	PSNR $\uparrow$	LPIPS $\downarrow$	PSNR $\downarrow$	LPIPS $\uparrow$	PSNR $\downarrow$	LPIPS $\uparrow$
bowl, shoe	baseline	22.52	0.0722	23.12	0.0663	24.05	0.0587
	naive-unlearning	21.35	0.0844	20.87	0.0940	22.61	0.0709
	ours	20.14	0.1009	12.87	0.2261	12.87	0.2261
shoe, dish, bowl	baseline	22.52	0.0722	23.57	0.0656	24.44	0.0580
	naive-unlearning	21.78	0.0813	21.28	0.0933	23.30	0.0693

TABLE VIII: Ablation study on multi-category joint attacks (GSO

\rightarrow

Omni). Target metrics represent the combined performance across all categories involved in the fine-tuning attack and are recorded at 200 and 400 steps.

Category	Trap Combination	Source Utility Avg.		Target 200 Steps		Target 400 Steps
Category	Trap Combination	PSNR $\uparrow$	LPIPS $\downarrow$	PSNR $\downarrow$	LPIPS $\uparrow$	PSNR $\downarrow$	LPIPS $\uparrow$
shoe	op	17.93	0.1255	13.71	0.1916	13.71	0.1916
	sc	19.74	0.1333	20.68	0.1233	23.43	0.0656
	op + sc	19.62	0.1053	13.71	0.1916	13.71	0.1916
	op + sc + pos	20.06	0.0999	13.71	0.1916	13.71	0.1916
	op + sc + pos + rt	20.28	0.0982	14.10	0.1825	21.81	0.0777

TABLE IX: Ablation study on the combination of multiple attribute traps (GSO

\rightarrow

Omni). The results highlight that integrating multiple traps significantly enhances the stability of the source domain performance. Abbreviations op, sc, pos, cl, and rt denote opacity, scale, position, color, and rotation traps respectively. Target metrics are recorded at 200 and 400 steps.

Category	Trap Attribute	Source Utility Avg.		Target 200 Steps		Target 400 Steps
Category	Trap Attribute	PSNR $\uparrow$	LPIPS $\downarrow$	PSNR $\downarrow$	LPIPS $\uparrow$	PSNR $\downarrow$	LPIPS $\uparrow$
shoe	baseline attack	22.52	0.0722	23.96	0.0515	25.07	0.0451
	rotation	22.28	0.0738	23.84	0.0576	24.90	0.0490
	position	19.87	0.0929	19.12	0.0982	22.09	0.0677
	opacity	17.93	0.1255	13.71	0.1916	13.71	0.1916
	color	21.85	0.0784	23.20	0.0648	24.47	0.0555

TABLE X: Ablation study on individual attribute traps (GSO

\rightarrow

Omni). We isolate the defensive effect of each attribute-aware trap and report the target domain performance at 200 and 400 steps.

Fig. 2: Visualization of authorized domain utility preservation. Top row: High-quality generation from the original unprotected weights. Bottom row: Clear and high-fidelity generation from our immunized weights, showing almost no perceptible degradation on authorized task capabilities.

Fig. 3: Visualization of LoRA fine-tuning attack results on the unauthorized domain. Top row: Unprotected baseline showing successful unauthorized generation. Bottom row: Our GaussLock model showing successful defense via structural collapse.

Fig. 4: Visual comparison of target domain generation under continuous LoRA fine-tuning attacks from 100 to 400 steps (GSO $\rightarrow$ Omni). Top row: Unprotected baseline attack progression. Bottom row: Generation under our GaussLock defense. Low step counts result in complete transparency, while high step counts produce only blurry and degraded objects, confirming persistent suppression throughout the attack.

3D Gaussian Splatting

3D Gaussian Splatting represents scenes as optimizable 3D Gaussian primitives for fast, photorealistic rendering from new viewpoints.

See all 1,019 papers

GaussTrap: Stealthy Backdoor Attacks on 3D Gaussian Splatting for Targeted Scene Misperception
Apr 29, 2025Jiaxin Hong, Sixu Chen, Shuoyang Sun +53D Gaussian Splatting 3DGS Training
Harbin Institute of Technology(Shenzhen) · South China University of Technology · Shenzhen Internation Graduate School, Tsinghua University +1
TriFold: Folding irregular 3D Gaussians into structured latents for 3D Scene Generation
Oct 16, 2026Yun Wang, Chiyu Wang, Fan Jiang +53D Scene Generation 3D Representation Learning
City University of Hong Kong · AMAP, Alibaba Group · Hong Kong Polytechnic University
Generative 3D Gaussians with Learned Density Control
May 8, 2026Runjie Yan, Yan-Pei Cao, Peng Wang +23D Gaussian Splatting 3D Asset Generation
Institute for Interdisciplinary Information Sciences, Tsinghua University, China · VAST

Apr 29, 2025J/K move · Enter open · S save

GaussTrap: Stealthy Backdoor Attacks on 3D Gaussian Splatting for Targeted Scene Misperception

Jiaxin Hong, Sixu Chen, Shuoyang Sun, Hongyao Yu+4

Harbin Institute of Technology(Shenzhen) · South China University of Technology · Shenzhen Internation Graduate School, Tsinghua University+1

3D Gaussian Splatting 3DGS Training 3D Scene Representation

Open paper AskPDF arXiv

3D Gaussian Splatting (3DGS) has recently emerged as a powerful paradigm for real-time scene representation and novel view synthesis, gaining traction in safety-critical applications such as autonomous driving and AR/VR systems. However, the security vulnerabilities of 3DGS remain largely unexplored. In this paper, we conduct a comprehensive study of backdoor threats in 3DGS pipelines. We uncover an inherent security vulnerability in the adaptive density control mechanism of 3DGS, originally designed for detailed reconstruction, which enables attackers to induce localized gaussian proliferation, effectively embedding malicious backdoors into the scene geometry while remaining invisible from other viewpoints. To expose this threat, we propose GaussTrap, a novel stealthy poisoning framework tailored for 3DGS. GaussTrap operates in three stages (adversarial injection, geometric stabilization, and global fidelity restoration) to embed imperceptible yet adversarial Gaussian components into the reconstruction. It ensures consistent poisoning effects at specific viewpoints while preserving photorealism in benign views, thereby achieving high attack efficacy with low detectability. Extensive experiments on both synthetic and real-world benchmarks demonstrate that GaussTrap reliably induces targeted visual corruption under trigger conditions while maintaining high rendering fidelity elsewhere, highlighting a critical security blind spot in modern 3D rendering systems. The code is available at https://github.com/acang425/GaussTrap.

Abstract

3D Gaussian Splatting

Explore similar work

GaussTrap: Stealthy Backdoor Attacks on 3D Gaussian Splatting for Targeted Scene Misperception

TriFold: Folding irregular 3D Gaussians into structured latents for 3D Scene Generation

Generative 3D Gaussians with Learned Density Control