{"id":"ea2ccb5a-34d1-439d-b826-9b5ae4ab073b","arxiv_id":"2504.20829","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":2,"one_line_summary":"A three-stage poisoning pipeline with viewpoint-ensemble stabilization can implant an attacker-chosen image at a single viewport of a 3D Gaussian Splatting model while preserving rendering quality at other views.","lead":"GaussTrap shows that a 3D Gaussian Splatting scene model can be secretly poisoned so that it renders a completely different, attacker-chosen image when viewed from one specific angle, while looking normal from all other angles. The work matters because 3D Gaussian Splatting is being adopted in autonomous driving, robotics, and AR/VR, where a deliberately corrupted scene could mislead perception systems or users.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The universal preservation claim (Eq. 3) conflicts with the attack objective (Eq. 2) in any neighborhood of the trigger, and the reported 13°/15° stabilization offsets never probe that transition region.","rationale":"The reader's weakest_assumption is that the attacker needs a clean, already-trained 3DGS model to build the stabilization set. That is a real practical constraint, but it is largely granted by the paper's own threat model in Section 3.2.1: attackers can download pre-trained model repositories, and Algorithm 2 initializes from such a model. It therefore does not undermine the central rendering-objective claim in the same way. The reader also notes that attack-viewpoint selection and viewpoint coverage are underspecified, which is closer to the concern raised here.\n\nMy concern targets the central claim directly: Eq. 2 and Eq. 3 cannot both hold exactly for a continuous renderer when the attack image differs from the clean render at the trigger. The paper's metric tables evaluate discrete training/test/stabilization viewpoints, but the most difficult region is the continuous shell immediately around T. The stabilization offsets of 13° and 15° (Blender) or 5° (MipNeRF-360) are far enough from T that they cannot certify behavior at 0.5° or 2°. A dense sweep is a concrete, low-cost experiment that would settle whether the attack is actually stealthy for nearby non-trigger viewpoints or whether it leaks/poppes, and it would force the authors to state the effective trigger neighborhood. Because this is a substantial but addressable validation gap, the CONDITIONAL verdict stands, so I recommend UNCHANGED.","tokens_in":17772,"tokens_out":11469,"duration_ms":135045,"concrete_test":"Reproduce a representative Blender scene (e.g., Lego with the Earth attack image) and render both the poisoned and the clean model along a dense yaw/pitch sweep around P_atk with offsets 0°, ±0.1°, ±0.5°, ±1°, ±2°, ±3°, ±5°, ±8°, ±10°, ±13°, ±15°, and ±20°. For each offset, compute (a) PSNR and LPIPS between I_poisoned(V) and I_clean(V); (b) PSNR between I_poisoned(V) and the attack image I_attack(T) to detect leakage; and (c) a visual inspection of a video of the sweep. If any non-trigger offset with |angle| ≥ 0.5° shows a PSNR drop greater than 3 dB against the clean render, or high similarity to the attack image, then Eq. 3 is violated and the paper must either bound the trigger neighborhood or soften the preservation claim.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The most load-bearing gap is not the availability of a clean model, but the mutual incompatibility of the two objectives near the trigger. The paper's formalization requires R(G,T)=I_attack(T) (Eq. 2) and R(G,V)=I_clean(V) for all non-trigger viewpoints (Eq. 3). The 3DGS renderer is a composition of smooth Gaussian projections, per-pixel depth sorting, and alpha blending; away from depth-sort discontinuities it is continuous in camera pose. Taking V→T then forces I_clean(T)=I_attack(T), which cannot hold for an arbitrary malicious image. Thus exact \"identical\" preservation is unattainable in any open neighborhood of the trigger, and the attack must occupy a narrow but nonzero transition region where neither objective is met exactly.\n\nThe experiments never measure this region. Blender stabilization offsets are 13° and 15° (Section 5.1.2), MipNeRF-360 uses 5°, and train/test views are sampled sparsely; no rendering is reported for offsets between 0° and the nearest stabilization angle. A camera trajectory passing through the attack viewpoint could therefore reveal the attack image leaking outside T, or severe popping and artifacts, either of which breaks the stealth claim and Eq. 3. Even if Eq. 3 is read as restricted to training-set viewpoints, the paper extends its stealth claim to novel/test views and VES is explicitly about neighboring poses, so the transition region remains the load-bearing unvalidated part. The reported attack/train/test PSNR values are consistent with a model that overfits a single pose and is never evaluated at intermediate poses.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes GaussTrap, a backdoor poisoning attack against 3D Gaussian Splatting (3DGS) models. The attacker's goal is that the poisoned model renders a preselected malicious image at a designated trigger viewpoint (Eq. 2) while rendering exactly as the clean model at all non-trigger viewpoints (Eq. 3). The method has three stages: attack, stabilization, and normal training. The stabilization stage introduces Viewpoint Ensemble Stabilization (VES), which renders nearby viewpoints with the clean model and uses them as additional training data to reduce artifacts around the attack viewpoint. Experiments on Blender and MipNeRF-360 report high PSNR/SSIM/LPIPS at the attack viewpoint, comparable quality at train and test viewpoints, and ablations over the number of backdoors, densification level, and attack viewpoint.","tokens_in":18090,"tokens_out":3029,"duration_ms":32672,"significance":"If the central claim holds, this is the first backdoor attack specifically targeting 3DGS rendering and it identifies a plausible supply-chain risk for downloaded scene models. The three-stage attack+VES formulation is a reasonable engineering contribution, and the authors provide a concrete algorithmic description plus experiments on standard datasets. However, the paper's significance as a security threat is currently limited because it never demonstrates 'scene confusion' with any downstream perception model, and the central stealth claim is not validated in the transition region near the trigger viewpoint. The strengths are the novelty of the attack scenario, the VES idea, and the breadth of the ablation study.","major_comments":[{"comment":"","section":"§3.2.2, Eqs. (2)-(3), and §5.1.2"},{"comment":"","section":"Abstract, §1, and §5.2"},{"comment":"","section":"Tables 1-3 and Eq. (4)"},{"comment":"","section":"§4.2 and Algorithm 2"}],"minor_comments":[{"comment":"","section":"Throughout"},{"comment":"","section":"§5.1.2"},{"comment":"","section":"Tables 1-10"},{"comment":"","section":"Figure 7"},{"comment":"","section":"§5.1.4"}],"recommendation":"major_revision","confidential_remarks":"The paper tackles a timely and underexplored problem, and the VES idea is interesting. The main revision needs to address the unvalidated transition region around the trigger viewpoint, add a concrete downstream perception evaluation, and clarify the clean-model assumption in the threat model. The lack of code and variance reporting also needs attention. I believe these are addressable within the scope of a major revision rather than requiring rejection."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Here's the quick take: this is the first backdoor attack aimed specifically at 3DGS, and the Viewpoint Ensemble Stabilization trick is genuinely useful. But the paper sells 'stealth' harder than the evidence supports. The biggest blind spot is right around the trigger viewpoint, and the paper never looks there.\n\nWhat's actually new: the core idea is to train a clean 3DGS model, then run three stages (attack, stabilize, normal) to force a malicious image at one chosen pose while recovering clean rendering elsewhere. VES renders a set of slightly offset viewpoints from the clean model and uses them as a curriculum to avoid the black-cloud artifacts you get from naive injection. The numbers show a real effect: attack-view PSNR goes from 5-19 with the IPA-NeRF baseline to 36-41 with GaussTrap, while test-view PSNR stays within a couple dB of normal training. That's a solid engineering result, and the pseudocode in the appendix makes the baseline comparably reproducible.\n\nSoft spots, in rough order of importance. First, the formalization in Eq. (2) and Eq. (3) is literally impossible to satisfy in a neighborhood of the trigger: the renderer is continuous in pose, so you can't have I_attack at T and I_clean at arbitrarily close poses. The paper never reports what happens between 0° and the nearest stabilization offset (13° on Blender, 5° on MipNeRF-360). That transition region is exactly where a user or a downstream perception system would notice popping or leaking. Second, the advertised 'scene confusion' is never demonstrated: no downstream detector, no segmentation, no depth estimation, no classification. All metrics are rendering-based. Third, the threat model requires the attacker to have a clean, fully-trained model of the exact target scene; that's a heavy assumption for the download-and-poison scenario they sketch, and it deserves more discussion.\n\nMinor issues: no error bars or variance, no code release, a single baseline, and the attack viewpoint is chosen without any stated criterion.\n\nOverall, I think this deserves a serious referee. The core method is a step forward and the VES idea is worth keeping. But the authors need to address the transition region, either by arguing the trigger is only ever viewed at a discrete pose or by measuring the artifact. They also need a downstream evaluation or a clear retraction of the 'scene confusion' claim. I'd send it to review, but with those two gaps front and center.","headline":"First 3DGS backdoor worth taking seriously, but the stealth claim has a blind spot right at the trigger.","tokens_in":18662,"tokens_out":3565,"would_cite":false,"duration_ms":33043,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"At one camera pose, a 3D scene renders a fake view and looks normal everywhere else.","keywords":["3D Gaussian Splatting","backdoor attack","scene confusion","viewpoint trigger","Viewpoint Ensemble Stabilization","novel view synthesis","poisoning attack","view synthesis security"],"falsifier":"Render the poisoned model from a dense set of camera poses that pass through the trigger pose, including small translations and roll rotations not used in the stabilization set; if the attacker image appears only at the exact trained pose and neighboring views show visible artifacts, the claimed viewpoint-consistent backdoor fails its own Eq. (3). A second, cheaper check is to re-run the pipeline without access to a clean pretrained model and observe whether the stabilization views can be produced at all.","tokens_in":17593,"feed_emoji":"🎯","tokens_out":4425,"duration_ms":40726,"temperature":0.7,"pith_summary":"The paper claims that a 3D Gaussian Splatting model can be secretly backdoored so that, from one designated trigger viewpoint, it renders an attacker-chosen image, while from every other viewpoint it renders what the clean model would render. The authors call this targeted scene confusion and frame it as a security risk for any system that downloads pre-trained 3DGS models, such as autonomous driving, AR/VR, or medical simulation. The reported experiments place attack-view quality at 36.23 to 40.85 dB PSNR on synthetic scenes and 32.95 to 40.26 dB on real scenes, with normal-view quality close to normal training. If true, a user inspecting the model at ordinary viewpoints would not notice the poison, making the attack hard to detect before deployment.","feed_headline":"At one camera pose, a 3D scene renders a fake view","feed_subtitle":"A poisoned Gaussian splat shows an attacker-chosen image at the trigger pose and stays normal everywhere else.","key_machinery":"The load-bearing mechanism is the Viewpoint Ensemble Stabilization (VES) step, which creates a ring of neighboring camera poses by applying pitch and yaw offsets around the trigger viewpoint and rendering those poses with the clean model. These synthetic stabilization views are added to the training set so the Gaussian splat is pulled back to the true scene immediately around the trigger, preventing the black-cloud artifacts that appear when a model is trained only on the attack view and normal views. The three-stage loop, attack, stabilization, and normal, is what allows one viewpoint to be hijacked without degrading the surrounding view manifold.","core_discovery":"On its own terms, the paper establishes that the two backdoor objectives, Eq. (2), which forces the poisoned model to match the attacker's image at the trigger viewpoint, and Eq. (3), which forces it to match the clean model at all non-trigger viewpoints, can be jointly satisfied in 3DGS by interleaving three training phases. A viewpoint ensemble of slightly rotated cameras around the trigger is rendered with the clean model and added to the training set, and training alternates attack, stabilization, and normal data. The result is a splat cloud whose Gaussian parameters encode two scenes at once: the true scene for almost all viewpoints and the attacker's scene from the single trigger pose. The quantitative evidence is attack-view PSNR above 36 dB and test-view PSNR comparable to unpoisoned training across Blender and Mip-NeRF-360 scenes.","pith_inferences":["If the trigger definition is extended from pose to pose-plus-translation or pose-plus-roll, the VES stabilization set would need to cover those degrees of freedom too; the paper's offset search only covers pitch and yaw, so robustness to camera roll at the trigger pose is not established by the reported experiments.","A natural testable extension is to use the same stabilization idea as a defense diagnostic: render a poisoned model from a dense angular sweep through the trigger pose and measure the sharpest PSNR drop, which should localize the backdoor even when single-view metrics look clean.","The clean-model requirement suggests that a cheaper attack variant that poisons only raw training data would need a different mechanism than VES, because stabilization views are defined by rendering the unpoisoned model.","The reported multi-backdoor degradation hints at a per-scene capacity limit on how many viewpoints a splat can hide, and estimating that limit could inform concrete defense thresholds."],"forward_implications":["A user who downloads a pre-trained 3DGS model and inspects it from conventional camera paths can be shown a completely different scene at one chosen pose without any visible warning.","Because the trigger is a viewpoint rather than a patch or object, the backdoor does not require a visible pattern in the scene, making manual inspection less effective.","The same three-stage procedure scales to multiple simultaneous backdoor viewpoints, with only mild quality loss as the number grows to five.","Detection work on 3DGS should look at local view-transition consistency near each pose rather than only at per-image quality, because per-image metrics on normal views stay close to clean levels.","The method turns a rendering-pipeline optimizer into a tool for scene-level deception, which is a different attack surface from watermarking or computational-cost attacks on 3DGS."],"supporting_citations":[{"why":"Provides the 3D Gaussian Splatting representation and differentiable renderer that the attack modifies.","marker":"[17]"},{"why":"Supplies the NeRF backdoor-view baseline that is adapted to 3DGS for comparison.","marker":"[16]"},{"why":"Supplies the Blender synthetic dataset and NeRF benchmark conventions used for evaluation.","marker":"[27]"},{"why":"Supplies the Mip-NeRF-360 real-world dataset used to test generalizability.","marker":"[3]"},{"why":"Defines the SSIM metric used in both the training loss and the evaluation.","marker":"[41]"},{"why":"Defines the LPIPS perceptual metric used in the evaluation.","marker":"[46]"}],"fun_headline_variants":["One pose, two scenes: stealthy 3DGS backdoor attack","GaussTrap: Single viewpoint hijacks 3D scene rendering","Hidden backdoor view in 3D Gaussian splatting","At one camera angle, 3D scene shows attacker's image"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The attack assumes the adversary can train or obtain an exact clean 3DGS model of the target scene before poisoning, because the stabilization views are rendered from that clean model; without it, the claimed stealth near the trigger viewpoint cannot be constructed as described.","fun_headline_variants_meta":{"raw":{"variants":["One pose, two scenes: stealthy 3DGS backdoor attack","GaussTrap: Single viewpoint hijacks 3D scene rendering","Hidden backdoor view in 3D Gaussian splatting","At one camera angle, 3D scene shows attacker's image"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000246,"raw_usage":{"total_tokens":1550,"prompt_tokens":963,"completion_tokens":587,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":579,"completion_tokens_details":{"reasoning_tokens":510}},"tokens_in":579,"tokens_out":587,"duration_ms":5572,"temperature":1.0,"reasoning_tokens":510,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-16T05:18:39.779379+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Render the poisoned model from a dense set of camera poses that pass through the trigger pose, including small translations and roll rotations not used in the stabilization set; if the attacker image appears only at the exact trained pose and neighboring views show visible artifacts, the claimed viewpoint-consistent backdoor fails its own Eq. (3). A second, cheaper check is to re-run the pipeline without access to a clean pretrained model and observe whether the stabilization views can be produced at all.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the NeRF backdoor-view baseline that is adapted to 3DGS for comparison."}],"review_version":1}