Paper 2510.02314
StealthAttack: Robust 3D Gaussian Splatting Poisoning via Density-Guided Illusions
- Published
- Oct 2025
- Research lab
- Independent
- Citations
- 6
- GitHub
- 64 stars
01 In brief
Summary
The paper introduces StealthAttack, the first data poisoning attack targeting 3D Gaussian Splatting (3DGS) to inject view-dependent illusory objects.
The method uses Kernel Density Estimation (KDE) to identify low-density regions in the Gaussian point cloud, placing poison points along rays from the target (poisoned) view to make illusions visible only from that view while minimally affecting innocent views.
An adaptive noise scheduling strategy disrupts multi-view consistency during training, enhancing attack success.
The authors also propose a KDE-based evaluation protocol to systematically assess attack difficulty.
Experiments on Mip-NeRF 360, Tanks & Temples, and Free datasets show the method outperforms baselines (IPA-NeRF variants and IPA-Splat) in embedding clear illusions (higher PSNR/SSIM, lower LPIPS on V-ILLUSORY) while maintaining high fidelity on innocent views (V-TEST).
Ablations confirm the necessity of combining density-guided point placement with noise scheduling.
The attack reduces GPU memory by 41% and Gaussian count by 88% with modest training time increase.
Limitations include challenges in scenes with high view overlap.
02 From the paper
Abstract
3D scene representation methods like Neural Radiance Fields (NeRF) and 3D Gaussian Splatting (3DGS) have significantly advanced novel view synthesis. As these methods become prevalent, addressing their vulnerabilities becomes critical. We analyze 3DGS robustness against image-level poisoning attacks and propose a novel density-guided poisoning method. Our method strategically injects Gaussian points into low-density regions identified via Kernel Density Estimation (KDE), embedding viewpoint-dependent illusory objects clearly visible from poisoned views while minimally affecting innocent views. Additionally, we introduce an adaptive noise strategy to disrupt multi-view consistency, further enhancing attack effectiveness. We propose a KDE-based evaluation protocol to assess attack difficulty systematically, enabling objective benchmarking for future research. Extensive experiments demonstrate our method's superior performance compared to state-of-the-art techniques. Project page: https://hentci.github.io/stealthattack/