PatchPoison: Poisoning Multi-View Datasets to Degrade 3D Reconstruction

Prajas Wadekar; Venkata Sai Pranav Bachina; Kunal Bhosikar; Ankit Gangwal; Charu Sharma

cs.CVApr 14, 2026

PatchPoison: Poisoning Multi-View Datasets to Degrade 3D Reconstruction

Authors: Prajas Wadekar, Venkata Sai Pranav Bachina, Kunal Bhosikar, Ankit Gangwal, Charu Sharma

Organizations: International Institute of Information Technology, Hyderabad, India

Abstract

3D Gaussian Splatting (3DGS) has recently enabled highly photorealistic 3D reconstruction from casually captured multi-view images. However, this accessibility raises a privacy concern: publicly available images or videos can be exploited to reconstruct detailed 3D models of scenes or objects without the owner's consent. We present PatchPoison, a lightweight dataset-poisoning method that prevents unauthorized 3D reconstruction. Unlike global perturbations, PatchPoison injects a small high-frequency adversarial patch, a structured checkerboard, into the periphery of each image in a multi-view dataset. The patch is designed to corrupt the feature-matching stage of Structure-from-Motion (SfM) pipelines such as COLMAP by introducing spurious correspondences that systematically misalign estimated camera poses. Consequently, downstream 3DGS optimization diverges from the correct scene geometry. On the NeRF-Synthetic benchmark, inserting a 12 X 12 pixel patch increases reconstruction error by 6.8x in LPIPS, while the poisoned images remain unobtrusive to human viewers. PatchPoison requires no pipeline modifications, offering a practical, "drop-in" preprocessing step for content creators to protect their multi-view data.

Figures & tables

Figure 2: PatchPoison pipeline. A small high-frequency patch inserted into each image induces spurious feature correspondences during Structure-from-Motion, leading to incorrect camera pose estimation and degraded 3D Gaussian Splatting reconstruction.

Figure 3: Qualitative evaluation on the NeRF-Synthetic dataset. These renders are generated from the poisoned images, illustrating the structural degradation and severe visual artifacts introduced by the PatchPoison attack across multiple views. We omit views that resulted in entirely black renders, which constituted the majority of the overall outputs.

Patch Size	Poisoned vs Render			Poisoned vs Original
	SSIM $\downarrow$	PSNR $\downarrow$	LPIPS $\uparrow$	SSIM $\uparrow$	PSNR $\uparrow$	LPIPS $\downarrow$
clean	0.969 $\pm$ 0.026	32.96 $\pm$ 3.26	0.050 $\pm$ 0.035	1.000	inf	0.000
12	0.793 ± 0.106	18.06 ± 5.82	0.336 ± 0.147	0.9996	39.03	0.0016
24	0.798 ± 0.110	18.32 ± 5.82	0.322 ± 0.155	0.9988	33.47	0.0036
48	0.775 ± 0.091	16.91 ± 3.06	0.354 ± 0.121	0.9958	27.45	0.0083
76	0.809 ± 0.101	17.42 ± 4.80	0.302 ± 0.165	0.9900	23.44	0.0163

Table 1: Reconstruction Degradation and Imperceptibility for different scenes in the NeRF-Synthetic dataset with different sizes of adversarial patch.

	Poisoned vs Render			Poisoned vs Original
Scene	SSIM $\uparrow$	PSNR $\uparrow$	LPIPS $\downarrow$	SSIM $\downarrow$	PSNR $\downarrow$	LPIPS $\uparrow$
Clean Baseline
chair	0.990 $\pm$ 0.000	33.54 $\pm$ 0.00	0.023 $\pm$ 0.000	1.000	inf	0.000
drums	0.966 $\pm$ 0.000	27.91 $\pm$ 0.00	0.057 $\pm$ 0.000	1.000	inf	0.000
ficus	0.993 $\pm$ 0.000	35.90 $\pm$ 0.10	0.010 $\pm$ 0.000	1.000	inf	0.000
hotdog	0.989 $\pm$ 0.000	37.58 $\pm$ 0.01	0.025 $\pm$ 0.000	1.000	inf	0.000

Table 2: Per-scene reconstruction and imperceptibility metrics on NeRF-Synthetic, comparing clean and poisoned data (patch size 100) over 3 runs.

Block Size	Poisoned vs Render			Poisoned vs Original
	SSIM $\downarrow$	PSNR $\downarrow$	LPIPS $\uparrow$	SSIM $\uparrow$	PSNR $\uparrow$	LPIPS $\downarrow$
clean	0.969 $\pm$ 0.026	32.97 $\pm$ 3.26	0.050 $\pm$ 0.035	1.000	inf	0.000
1	0.952 $\pm$ 0.029	20.63 $\pm$ 0.34	0.073 $\pm$ 0.038	0.983	21.07	0.022
2	0.953 $\pm$ 0.027	20.62 $\pm$ 0.32	0.080 $\pm$ 0.035	0.983	21.07	0.031
4	0.788 $\pm$ 0.106	16.75 $\pm$ 4.54	0.342 $\pm$ 0.154	0.983	21.07	0.026
6	0.751 $\pm$ 0.068	14.66 $\pm$ 3.14	0.398 $\pm$ 0.096	0.983	21.07	0.025

Table 3: Reconstruction degradation and imperceptibility across different checkerboard block sizes (frequency of the pattern) for NeRF-Synthetic Dataset.

Variant	Poisoned vs Render			Poisoned vs Original
	SSIM $\uparrow$	PSNR $\uparrow$	LPIPS $\downarrow$	SSIM $\downarrow$	PSNR $\downarrow$	LPIPS $\uparrow$
All Patterns	0.822 $\pm$ 0.053	18.97 $\pm$ 1.96	0.294 $\pm$ 0.074	0.983	21.23	0.026
Checkerboard + Circles	0.809 $\pm$ 0.088	17.98 $\pm$ 3.10	0.304 $\pm$ 0.132	0.983	21.02	0.027
Checkerboard + Diagonal Lines	0.820 $\pm$ 0.078	18.49 $\pm$ 1.82	0.291 $\pm$ 0.113	0.983	21.29	0.026
Checkerboard Only	0.801 $\pm$ 0.094	16.91 $\pm$ 3.53	0.324 $\pm$ 0.146	0.983	21.07	0.026
Circles Only	0.878 $\pm$ 0.115	23.89 $\pm$ 6.66	0.190 $\pm$ 0.155	0.996	33.50	0.016

Table 4: Reconstruction quality and imperceptibility across different synthetic patterns variants on NeRF-Synthetic scenes.

Figure 4: Examples of synthetic pattern variants evaluated.

Alpha	Poisoned vs Render			Poisoned vs Original
	SSIM $\downarrow$	PSNR $\downarrow$	LPIPS $\uparrow$	SSIM $\uparrow$	PSNR $\uparrow$	LPIPS $\downarrow$
clean	0.969 $\pm$ 0.026	32.97 $\pm$ 3.26	0.050 $\pm$ 0.035	1.000	inf	0.000
0.001	0.970 $\pm$ 0.029	33.26 $\pm$ 3.67	0.050 $\pm$ 0.039	1.000	inf	0.000
0.1	0.783 $\pm$ 0.073	17.49 $\pm$ 2.48	0.349 $\pm$ 0.096	0.984	40.89	0.015
0.25	0.774 $\pm$ 0.070	16.57 $\pm$ 3.49	0.364 $\pm$ 0.097	0.984	33.07	0.019
0.5	0.770 $\pm$ 0.064	16.37 $\pm$ 3.47	0.374 $\pm$ 0.088	0.983	27.05	0.023

Table 5: Reconstruction quality and imperceptibility across different transparency value for the data on NeRF-Synthetic scenes, reported as mean

\pm

std across scenes.

White	Poisoned vs Render			Poisoned vs Original
	SSIM $\downarrow$	PSNR $\downarrow$	LPIPS $\uparrow$	SSIM $\uparrow$	PSNR $\uparrow$	LPIPS $\downarrow$
clean	0.969 $\pm$ 0.026	32.97 $\pm$ 3.26	0.050 $\pm$ 0.035	1.000	inf	0.000
5	0.964 $\pm$ 0.028	33.41 $\pm$ 3.54	0.050 $\pm$ 0.038	0.992	55.11	0.003
10	0.958 $\pm$ 0.029	33.43 $\pm$ 4.22	0.056 $\pm$ 0.040	0.987	49.15	0.008
25	0.795 $\pm$ 0.104	18.62 $\pm$ 5.28	0.331 $\pm$ 0.152	0.984	41.23	0.014
50	0.781 $\pm$ 0.073	17.18 $\pm$ 3.54	0.357 $\pm$ 0.102	0.984	35.22	0.018

Table 6: Reconstruction quality and imperceptibility across different white values which represents the color difference between the checkerboard pattern for NeRF-Synthetic scenes.

Poison (%)	Poisoned vs Render			Poisoned vs Original
	SSIM $\downarrow$	PSNR $\downarrow$	LPIPS $\uparrow$	SSIM $\uparrow$	PSNR $\uparrow$	LPIPS $\downarrow$
clean	0.969 $\pm$ 0.026	32.97 $\pm$ 3.26	0.050 $\pm$ 0.035	1.000	inf	0.000
5	0.967 $\pm$ 0.028	32.08 $\pm$ 3.15	0.054 $\pm$ 0.038	0.9992	inf	0.0013
10	0.937 $\pm$ 0.095	29.68 $\pm$ 7.85	0.106 $\pm$ 0.167	0.9983	inf	0.0026
25	0.857 $\pm$ 0.138	22.47 $\pm$ 6.11	0.222 $\pm$ 0.198	0.9958	inf	0.0065
50	0.762 $\pm$ 0.082	15.16 $\pm$ 3.68	0.386 $\pm$ 0.096	0.9915	inf	0.0129

Table 7: Reconstruction quality and imperceptibility under varying poisoning levels with limited training data on NeRF-Synthetic scenes, reported as mean

\pm

std across scenes.

Kernel Size	Poisoned vs Render			Poisoned vs Original
	SSIM $\uparrow$	PSNR $\uparrow$	LPIPS $\downarrow$	SSIM $\downarrow$	PSNR $\downarrow$	LPIPS $\uparrow$
3	0.980 $\pm$ 0.017	37.45 $\pm$ 5.14	0.031 $\pm$ 0.025	0.978	33.76	0.069
7	0.987 $\pm$ 0.011	40.60 $\pm$ 5.57	0.022 $\pm$ 0.020	0.940	29.91	0.149
11	0.991 $\pm$ 0.010	43.83 $\pm$ 7.19	0.016 $\pm$ 0.020	0.913	28.29	0.190
21	0.998 $\pm$ 0.001	48.21 $\pm$ 5.94	0.006 $\pm$ 0.010	0.857	25.87	0.265

Table 8: Reconstruction quality and imperceptibility across different Gaussian blur kernel sizes for NeRF-Synthetic scenes. Values represent mean

\pm

std across scenes.

Stddev	# of scenes	Poisoned vs Render			Poisoned vs Original
		SSIM $\uparrow$	PSNR $\uparrow$	LPIPS $\downarrow$	SSIM $\downarrow$	PSNR $\downarrow$	LPIPS $\uparrow$
5	8	0.851 $\pm$ 0.027	31.48 $\pm$ 2.44	0.151 $\pm$ 0.029	0.691	36.57	0.105
10	8	0.649 $\pm$ 0.029	28.57 $\pm$ 1.34	0.351 $\pm$ 0.029	0.372	30.39	0.316
25	7	0.321 $\pm$ 0.044	22.86 $\pm$ 0.93	0.599 $\pm$ 0.094	0.133	22.36	0.647
50	4	0.260 $\pm$ 0.207	17.68 $\pm$ 1.43	0.686 $\pm$ 0.346	0.070	16.49	0.895

Table 9: Reconstruction quality and imperceptibility across different Gaussian noise standard deviations for NeRF-Synthetic scenes. Values represent mean

\pm

std across scenes.

Transform	# of scenes	Poisoned vs Render			Poisoned vs Original
		SSIM $\uparrow$	PSNR $\uparrow$	LPIPS $\downarrow$	SSIM $\downarrow$	PSNR $\downarrow$	LPIPS $\uparrow$
Rotation ( $15^{\circ}$ )	8	0.974 $\pm$ 0.023	34.88 $\pm$ 4.46	0.045 $\pm$ 0.033	0.732	15.33	0.288
Rotation ( $30^{\circ}$ )	8	0.978 $\pm$ 0.021	35.82 $\pm$ 4.03	0.038 $\pm$ 0.029	0.690	14.01	0.369
Rotation ( $45^{\circ}$ )	8	0.972 $\pm$ 0.023	34.39 $\pm$ 4.22	0.046 $\pm$ 0.033	0.666	13.42	0.411
Random Rotation ( $\pm 45^{\circ}$ )	8	0.972 $\pm$ 0.024	34.53 $\pm$ 4.39	0.047 $\pm$ 0.034	0.724	15.33	0.300
Shear X ( $0.2$ )	8	0.923 $\pm$ 0.061	28.25 $\pm$ 7.38	0.110 $\pm$ 0.076	0.699	14.45	0.339

Table 10: Reconstruction quality and imperceptibility across different geometric transformations for NeRF-Synthetic scenes. Values represent mean

\pm

std across scenes.

Quality	Poisoned vs Render			Poisoned vs Original
	SSIM $\uparrow$	PSNR $\uparrow$	LPIPS $\downarrow$	SSIM $\downarrow$	PSNR $\downarrow$	LPIPS $\uparrow$
10	0.958 $\pm$ 0.024	33.39 $\pm$ 2.97	0.070 $\pm$ 0.056	0.920	30.08	0.093
25	0.959 $\pm$ 0.023	32.70 $\pm$ 2.61	0.058 $\pm$ 0.032	0.945	32.61	0.046
50	0.961 $\pm$ 0.025	32.86 $\pm$ 3.52	0.054 $\pm$ 0.033	0.958	34.63	0.025
75	0.963 $\pm$ 0.026	32.26 $\pm$ 2.97	0.055 $\pm$ 0.037	0.969	36.96	0.012

Table 11: Reconstruction quality and imperceptibility across different JPEG compression quality levels for NeRF-Synthetic scenes. Values represent mean

\pm

std across scenes.

Figure 5: Trade-off between reconstruction degradation and imperceptibility. An effective method should lie in the bottom-right region. PatchPoison achieves this optimal balance, while baselines either fail to degrade reconstruction or introduce visible artifacts.

Patch	Poisoned vs Render			GT vs Poisoned
	SSIM $\uparrow$	PSNR $\uparrow$	LPIPS $\downarrow$	SSIM $\downarrow$	PSNR $\downarrow$	LPIPS $\uparrow$
2%	0.923 $\pm$ 0.035	30.57 $\pm$ 1.66	0.119 $\pm$ 0.039	0.982	36.37	0.008
6%	0.878 $\pm$ 0.104	25.75 $\pm$ 2.05	0.164 $\pm$ 0.103	0.979	27.44	0.014
12.5%	0.876 $\pm$ 0.076	21.50 $\pm$ 0.99	0.161 $\pm$ 0.069	0.961	21.10	0.034
25%	0.752 $\pm$ 0.204	15.58 $\pm$ 1.88	0.309 $\pm$ 0.286	0.893	15.07	0.110

Table 12: Reconstruction quality and imperceptibility aggregated across scenes for different patch sizes in terms of % of the width of the image. Values represent mean

\pm

std across scenes in the MIP-360 dataset.

Figure 6: Results on Mip-NeRF 360 scenes. In structured scenes such as bicycle , PatchPoison introduces visible distortions. In complex natural scenes such as garden , the patch blends into the background, reducing visual artifacts while still increasing reconstruction error.

Data Poisoning Attacks

Data poisoning attacks manipulate training or retrieval data to corrupt model behavior, implant backdoors, or undermine reliability.

See all 123 papers

PoInit-of-View: Poisoning Initialization of Views Transfers Across Multiple 3D Reconstruction Systems
Apr 17, 2026Weijie Wang, Songlong Xing, Zhengyu Zhao +23D Reconstruction Transfer-Based Adversarial Attacks
University of Trento, Italy · Xi’an Jiaotong University, China · Fondazione Bruno Kessler, Italy
ArtifactWorld: Scaling 3D Gaussian Splatting Artifact Restoration via Video Generation Models
Apr 14, 2026Xinliang Wang, Yifeng Shi, Zhenyu Wu3D Gaussian Splatting Novel View Synthesis
Ke Holdings Inc. Beijing, China
CleanGS: Pareto-Guided Post-Hoc Cleanup of 3D Gaussian Splatting Scenes
Jan 1, 2026Jyotirmaya Shivottam, Om Kumar, Subhankar Mishra3D Gaussian Splatting 3D Gaussian Pruning
School of Computer Sciences National Institute of Science Education and Research Bhubaneswar, India

Apr 17, 2026J/K move · Enter open · S save

PoInit-of-View: Poisoning Initialization of Views Transfers Across Multiple 3D Reconstruction Systems

Weijie Wang, Songlong Xing, Zhengyu Zhao, Nicu Sebe+1

University of Trento, Italy · Xi’an Jiaotong University, China · Fondazione Bruno Kessler, Italy

3D Reconstruction Transfer-Based Adversarial Attacks Structure from Motion

Open paper AskPDF arXiv

Poisoning input views of 3D reconstruction systems has been recently studied. However, we identify that existing studies simply backpropagate adversarial gradients through the 3D reconstruction pipeline as a whole, without uncovering the new vulnerability rooted in specific modules of the 3D reconstruction pipeline. In this paper, we argue that the structure-from-motion (SfM) initialization, as the geometric core of many widely used reconstruction systems, can be targeted to achieve transferable poisoning effects across diverse 3D reconstruction systems. To this end, we propose PoInit-of-View, which optimizes adversarial perturbations to intentionally introduce cross-view gradient inconsistencies at projections of corresponding 3D points. These inconsistencies disrupt keypoint detection and feature matching, thereby corrupting pose estimation and triangulation within SfM, eventually resulting in low-quality rendered views. We also provide a theoretical analysis that connects cross-view inconsistency to correspondence collapse. Experimental results demonstrate the effectiveness of our PoInit-of-View on diverse 3D reconstruction systems and datasets, surpassing the single-view baseline by 25.1% in PSNR and 16.5% in SSIM in black-box transfer settings, such as 3DGS to NeRF.

Abstract

Data Poisoning Attacks

Explore similar work

PoInit-of-View: Poisoning Initialization of Views Transfers Across Multiple 3D Reconstruction Systems

ArtifactWorld: Scaling 3D Gaussian Splatting Artifact Restoration via Video Generation Models

CleanGS: Pareto-Guided Post-Hoc Cleanup of 3D Gaussian Splatting Scenes