Pith. sign in

REVIEW 4 major objections 5 minor 56 references

GaussTrap: Stealthy Poisoning Attacks on 3D Gaussian Splatting for Targeted Scene Confusion

T0 review · 4 major / 5 minor · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read At one camera pose, a 3D scene renders a fake view and looks normal everywhere else.

desk verdict First 3DGS backdoor worth taking seriously, but the stealth claim has a blind spot right at the trigger. read the letter →

arxiv 2504.20829 v1 pith:CM2RSERB submitted 2025-04-29 cs.CV cs.AI

Jiaxin Hong , Sixu Chen , Shuoyang Sun , Hongyao Yu , Hao Fang , Yuqi Tan , Bin Chen , Shuhan Qi
show 1 more author
Jiawei Li
This is my paper · ORCID
classification cs.CVcs.AI
keywords 3DGaussianSplattingbackdoorattacksceneconfusionviewpointtriggerEnsembleStabilizationnovelviewsynthesispoisoningsecurity
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper claims that a 3D Gaussian Splatting model can be secretly backdoored so that, from one designated trigger viewpoint, it renders an attacker-chosen image, while from every other viewpoint it renders what the clean model would render. The authors call this targeted scene confusion and frame it as a security risk for any system that downloads pre-trained 3DGS models, such as autonomous driving, AR/VR, or medical simulation. The reported experiments place attack-view quality at 36.23 to 40.85 dB PSNR on synthetic scenes and 32.95 to 40.26 dB on real scenes, with normal-view quality close to normal training. If true, a user inspecting the model at ordinary viewpoints would not notice the poison, making the attack hard to detect before deployment.

What carries the argument

The load-bearing mechanism is the Viewpoint Ensemble Stabilization (VES) step, which creates a ring of neighboring camera poses by applying pitch and yaw offsets around the trigger viewpoint and rendering those poses with the clean model. These synthetic stabilization views are added to the training set so the Gaussian splat is pulled back to the true scene immediately around the trigger, preventing the black-cloud artifacts that appear when a model is trained only on the attack view and normal views. The three-stage loop, attack, stabilization, and normal, is what allows one viewpoint to be hijacked without degrading the surrounding view manifold.

What would settle it

Render the poisoned model from a dense set of camera poses that pass through the trigger pose, including small translations and roll rotations not used in the stabilization set; if the attacker image appears only at the exact trained pose and neighboring views show visible artifacts, the claimed viewpoint-consistent backdoor fails its own Eq. (3). A second, cheaper check is to re-run the pipeline without access to a clean pretrained model and observe whether the stabilization views can be produced at all.

Watch

Extended reading notes

Core claim

On its own terms, the paper establishes that the two backdoor objectives, Eq. (2), which forces the poisoned model to match the attacker's image at the trigger viewpoint, and Eq. (3), which forces it to match the clean model at all non-trigger viewpoints, can be jointly satisfied in 3DGS by interleaving three training phases. A viewpoint ensemble of slightly rotated cameras around the trigger is rendered with the clean model and added to the training set, and training alternates attack, stabilization, and normal data. The result is a splat cloud whose Gaussian parameters encode two scenes at once: the true scene for almost all viewpoints and the attacker's scene from the single trigger pose. The quantitative evidence is attack-view PSNR above 36 dB and test-view PSNR comparable to unpoisoned training across Blender and Mip-NeRF-360 scenes.

Load-bearing premise

The attack assumes the adversary can train or obtain an exact clean 3DGS model of the target scene before poisoning, because the stabilization views are rendered from that clean model; without it, the claimed stealth near the trigger viewpoint cannot be constructed as described.

Editorial extensions

If this is right

  • A user who downloads a pre-trained 3DGS model and inspects it from conventional camera paths can be shown a completely different scene at one chosen pose without any visible warning.
  • Because the trigger is a viewpoint rather than a patch or object, the backdoor does not require a visible pattern in the scene, making manual inspection less effective.
  • The same three-stage procedure scales to multiple simultaneous backdoor viewpoints, with only mild quality loss as the number grows to five.
  • Detection work on 3DGS should look at local view-transition consistency near each pose rather than only at per-image quality, because per-image metrics on normal views stay close to clean levels.
  • The method turns a rendering-pipeline optimizer into a tool for scene-level deception, which is a different attack surface from watermarking or computational-cost attacks on 3DGS.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the trigger definition is extended from pose to pose-plus-translation or pose-plus-roll, the VES stabilization set would need to cover those degrees of freedom too; the paper's offset search only covers pitch and yaw, so robustness to camera roll at the trigger pose is not established by the reported experiments.
  • A natural testable extension is to use the same stabilization idea as a defense diagnostic: render a poisoned model from a dense angular sweep through the trigger pose and measure the sharpest PSNR drop, which should localize the backdoor even when single-view metrics look clean.
  • The clean-model requirement suggests that a cheaper attack variant that poisons only raw training data would need a different mechanism than VES, because stabilization views are defined by rendering the unpoisoned model.
  • The reported multi-backdoor degradation hints at a per-scene capacity limit on how many viewpoints a splat can hide, and estimating that limit could inform concrete defense thresholds.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes GaussTrap, a backdoor poisoning attack against 3D Gaussian Splatting (3DGS) models. The attacker's goal is that the poisoned model renders a preselected malicious image at a designated trigger viewpoint (Eq. 2) while rendering exactly as the clean model at all non-trigger viewpoints (Eq. 3). The method has three stages: attack, stabilization, and normal training. The stabilization stage introduces Viewpoint Ensemble Stabilization (VES), which renders nearby viewpoints with the clean model and uses them as additional training data to reduce artifacts around the attack viewpoint. Experiments on Blender and MipNeRF-360 report high PSNR/SSIM/LPIPS at the attack viewpoint, comparable quality at train and test viewpoints, and ablations over the number of backdoors, densification level, and attack viewpoint.

Significance. If the central claim holds, this is the first backdoor attack specifically targeting 3DGS rendering and it identifies a plausible supply-chain risk for downloaded scene models. The three-stage attack+VES formulation is a reasonable engineering contribution, and the authors provide a concrete algorithmic description plus experiments on standard datasets. However, the paper's significance as a security threat is currently limited because it never demonstrates 'scene confusion' with any downstream perception model, and the central stealth claim is not validated in the transition region near the trigger viewpoint. The strengths are the novelty of the attack scenario, the VES idea, and the breadth of the ablation study.

major comments (4)
  1. [§3.2.2, Eqs. (2)-(3), and §5.1.2]
  2. [Abstract, §1, and §5.2]
  3. [Tables 1-3 and Eq. (4)]
  4. [§4.2 and Algorithm 2]
minor comments (5)
  1. [Throughout]
  2. [§5.1.2]
  3. [Tables 1-10]
  4. [Figure 7]
  5. [§5.1.4]

Circularity Check

2 steps flagged · score 4.0 of 10

Attack-view and stabilization-view metrics are in-sample optimization objectives; only the held-out train/test views provide independent evidence for the stealth claim.

  1. fitted input called prediction [Section 4.1 (Eq. 4); Section 5.2.1 (Table 1 'Attack Viewpoints')]
    "The loss between the rendered image V′ and the target ground truth image Vtarget is then computed to guide the optimization process of the model. The loss functionL combines L1 loss and structural similarity loss (D-SSIM), defined as follows: L =(1−λ)·L1(V′,Vtarget)+ λ·LD-SSIM(V′,Vtarget), (4)"

    The attack stage optimizes exactly this loss with V_target = V_atk at the attack viewpoint (Algorithm 2 sets S_atk=(P_atk,V_atk)). Table 1 then reports 'Attack Viewpoints PSNR↑ SSIM↑ LPIPS↓' as evidence of attack success. SSIM is literally the D-SSIM term being minimized (D-SSIM=1−SSIM), and PSNR is a pixelwise fidelity score on the same target image that the optimizer was trained to reproduce. The attack-view PSNR/SSIM numbers are therefore the value of the training objective after optimization, not an independent prediction; they certify that the optimizer converged, not that the attack generalizes. LPIPS is not in Eq. (4) and provides some independent evidence, but the headline attack-view metrics are forced by construction.

  2. self definitional [Section 4.2; Appendix Algorithm 2 (S_stab construction)]
    "Since these viewpoints are absent from the original training set, we leverage a clean 3DGS model to render them and incorporate the generated views along with their corresponding camera parameters to the dataset. ... Sstab =(Pstab,R(G,Pstab))"

    Algorithm 2 defines the stabilization ground truths as R(G,P_stab), i.e., renders produced by the very same Gaussian model G that is subsequently optimized, and the stabilization phase minimizes Eq. (4) against these self-generated targets. Tables 1–3 report 'Stabilization Viewpoints' metrics comparing the poisoned render to those same targets, so the stabilization numbers measure the model's fit to its own pre-attack output. The VES continuity claim is thus a self-consistency result by construction: the 'ground truth' for neighboring views is defined as the clean model's own render, so agreement is tautological rather than independent evidence against an external scene.

full rationale

GaussTrap is primarily an optimization procedure rather than a derivation that predicts a novel quantity from first principles. Its central stealth claim is not fully circular because the train-view and test-view preservation results are evaluated against real dataset images that are not used in the attack or stabilization objectives; these held-out measurements provide genuine evidence that normal rendering quality is retained. However, two of the four reported viewpoint categories are in-sample objectives. The attack-view PSNR/SSIM numbers are exactly the L1+D-SSIM loss minimized at P_atk, and the stabilization-view 'ground truths' are generated by the same clean model G that is then optimized, making those metrics self-referential. The reported train/test numbers, while real, show a clear degradation relative to normal 3DGS training on the same datasets (e.g., test PSNR 27.80 on Blender vs. typical 3DGS values around 30+), so the independent evidence is weaker than the paper's framing suggests. The formal tension between Eq. (2) and Eq. (3) in any neighborhood of the trigger, and the absence of measurements between the attack viewpoint and the nearest stabilization offsets (13°/15° on Blender, 5° on MipNeRF-360), is a correctness and validation gap rather than a circularity; it does not itself raise the circularity score. No load-bearing self-citation chains or imported uniqueness theorems appear; the only overlapping-author citation (WATER-GS) is a literature citation in the related-work survey. Overall, the direct-objective metrics create moderate partial circularity, but the central claim still has independent content from the held-out views, so a score of 4 is appropriate.

Assumptions & free parameters 2 free parameters · 4 assumptions · 0 invented entities

The central claims rest on three domain assumptions about attacker capabilities and 3DGS expressiveness, plus standard rendering math. The hand-tuned stabilization angle and iteration budget directly control reported quality and are not derived from any principle.

free parameters (2)
  • Stabilization angle delta = 13 degrees and 15 degrees for Blender; 5 degrees for MipNeRF-360
    Chosen by hand rather than by a selection rule; VES behavior depends on this range, and Table 10 shows different angle sets change stabilization-view PSNR from 21.95 to 30.83.
  • Iterations per epoch (T_a, T_c, T_t) = 25 attack, 5 stabilization, 5 normal
    Set manually and no ablation is provided for these proportions, even though the balance between attack and stabilization training is central to the method.
assumptions (4)
  • domain assumption 3DGS can represent an arbitrary target image at one viewpoint while keeping all neighboring viewpoints consistent.
    The entire method is an empirical optimization; no proof is offered that Gaussian parameters can encode two conflicting scene interpretations at nearby poses, Section 4.1.
  • domain assumption The attacker has access to a clean 3DGS model of the exact target scene to render stabilization viewpoints.
    Algorithm 2 line 12 builds S_stab by rendering P_stab with the unpoisoned model, and Section 4.2 states 'we leverage a clean 3DGS model to render them'.
  • domain assumption The trigger is a single exact camera pose that the victim will query at inference.
    Equation (2) defines activation only when the input viewpoint equals T; no robustness to pose jitter or continuous camera motion is modeled.
  • standard math Standard 3DGS differentiable rendering and the L1 plus D-SSIM loss are valid optimization machinery.
    Background from Kerbl et al. [17], Eq. (1), used without modification.

how reviews work

0 comments
Cite this review

Pith. "Pith review of GaussTrap: Stealthy Poisoning Attacks on 3D Gaussian Splatting for Targeted Scene Confusion." pith.science (2026). https://pith.science/paper/CM2RSERB

@misc{pith2026250420829,
  author       = {Pith},
  title        = {Pith review of: GaussTrap: Stealthy Poisoning Attacks on 3D Gaussian Splatting for Targeted Scene Confusion},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/CM2RSERB}},
  note         = {Machine review of arXiv:2504.20829}
}
read the original abstract

As 3D Gaussian Splatting (3DGS) emerges as a breakthrough in scene representation and novel view synthesis, its rapid adoption in safety-critical domains (e.g., autonomous systems, AR/VR) urgently demands scrutiny of potential security vulnerabilities. This paper presents the first systematic study of backdoor threats in 3DGS pipelines. We identify that adversaries may implant backdoor views to induce malicious scene confusion during inference, potentially leading to environmental misperception in autonomous navigation or spatial distortion in immersive environments. To uncover this risk, we propose GuassTrap, a novel poisoning attack method targeting 3DGS models. GuassTrap injects malicious views at specific attack viewpoints while preserving high-quality rendering in non-target views, ensuring minimal detectability and maximizing potential harm. Specifically, the proposed method consists of a three-stage pipeline (attack, stabilization, and normal training) to implant stealthy, viewpoint-consistent poisoned renderings in 3DGS, jointly optimizing attack efficacy and perceptual realism to expose security risks in 3D rendering. Extensive experiments on both synthetic and real-world datasets demonstrate that GuassTrap can effectively embed imperceptible yet harmful backdoor views while maintaining high-quality rendering in normal views, validating its robustness, adaptability, and practical applicability.

Figures

Figures reproduced from arXiv: 2504.20829 by the authors.

Figure 1
Figure 1. Visualization of the GaussTrap results. From top to bottom: [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Our method, GaussTrap, consists of three key stages: In the [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 4
Figure 4. Visualization of all possible angle offset pairs from [PITH_FULL_IMAGE:figures/full_fig_p005_4.png] view at source ↗
Figures from the paper (8 more)
Figure 3
Figure 3. Figure 3: Visualization of images rendered from stabilization [PITH_FULL_IMAGE:figures/full_fig_p005_3.png]
Figure 5
Figure 5. Figure 5: Visualization of training results on MipNeRF-360 Dataset. Rows: Bicycle (top), Flowers (bottom). [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]
Figure 6
Figure 6. Figure 6: Visualization of training results on Blender Dataset. [PITH_FULL_IMAGE:figures/full_fig_p007_6.png]
Figure 7
Figure 7. Figure 7: Line charts for ablation studies and multi-backdoor attacks. The x-axis represents different variables: (A) number of [PITH_FULL_IMAGE:figures/full_fig_p008_7.png]
Figure 8
Figure 8. Figure 8: Visualization of images rendered from test view. [PITH_FULL_IMAGE:figures/full_fig_p008_8.png]
Figure 9
Figure 9. Figure 9: Visualization of Results from the Blender Dataset. [PITH_FULL_IMAGE:figures/full_fig_p014_9.png]
Figure 10
Figure 10. Figure 10: Visualization of Results from the MipNeRF-360 Dataset. [PITH_FULL_IMAGE:figures/full_fig_p015_10.png]
Figure 11
Figure 11. Figure 11: Visualization of the selected angles for the multi-backdoor experiment and ablation experiment on attack viewpoints. [PITH_FULL_IMAGE:figures/full_fig_p016_11.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

56 extracted references · 28 canonical work pages

  1. [1]

    Christoph Anthes, Rubén Jesús García-Hernández, Markus Wiedemann, and Dieter Kranzlmüller. 2016. State of the art of virtual reality technology. In 2016 IEEE aerospace conference. IEEE, 1–19

    work page 2016

  2. [2]

    Yanqi Bao, Tianyu Ding, Jing Huo, Yaoli Liu, Yuxin Li, Wenbin Li, Yang Gao, and Jiebo Luo. 2025. 3d gaussian splatting: Survey, technologies, challenges, and opportunities. IEEE Transactions on Circuits and Systems for Video Technology (2025)

    2025

  3. [3]

    Jonathan T Barron, Ben Mildenhall, Dor Verbin, Pratul P Srinivasan, and Peter Hedman. 2022. Mip-nerf 360: Unbounded anti-aliased neural radiance fields. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition . 5470–5479

    2022

  4. [4]

    Julie Carmigniani, Borko Furht, Marco Anisetti, Paolo Ceravolo, Ernesto Damiani, and Misa Ivkovic. 2011. Augmented reality technologies, systems and applica- tions. Multimedia tools and applications 51 (2011), 341–377

    work page 2011

  5. [5]

    Huili Chen, Cheng Fu, Jishen Zhao, and Farinaz Koushanfar. 2021. Proflip: Targeted trojan attack with progressive bit flips. In Proceedings of the IEEE/CVF International Conference on Computer Vision . 7718–7727

    work page 2021

  6. [6]

    Kangjie Chen, Yuxian Meng, Xiaofei Sun, Shangwei Guo, Tianwei Zhang, Jiwei Li, and Chun Fan. 2021. Badpre: Task-agnostic backdoor attacks to pre-trained nlp foundation models. arXiv preprint arXiv:2110.02467 (2021)

    arXiv 2021

  7. [8]

    Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. 2017. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv 2017. arXiv preprint arXiv:1712.05526 (2017)

    arXiv 2017

  8. [9]

    Guilherme N DeSouza and Avinash C Kak. 2002. Vision for mobile robot naviga- tion: A survey. IEEE transactions on pattern analysis and machine intelligence 24, 2 (2002), 237–267

    work page 2002

Show all 56 references
  1. [10]

    Linkun Fan, Fazhi He, Qing Guo, Wei Tang, Xiaolin Hong, and Bing Li. 2022. Be careful with rotation: A uniform backdoor pattern for 3D shape. arXiv preprint arXiv:2211.16192 (2022)

    2022 arXiv

  2. [11]

    Linkun Fan, Fazhi He, Tongzhen Si, Wei Tang, and Bing Li. 2024. Invisible backdoor attack against 3D point cloud classifier in graph spectral domain. In Proceedings of the AAAI Conference on Artificial Intelligence, Vol. 38. 21072–21080

    2024

  3. [12]

    Kuofeng Gao, Jiawang Bai, Baoyuan Wu, Mengxi Ya, and Shu-Tao Xia. 2023. Imperceptible and robust backdoor attack in 3d point cloud. IEEE Transactions on Information Forensics and Security 19 (2023), 1267–1282

    2023

  4. [13]

    Tianyu Gu, Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. 2019. Badnets: Evaluating backdooring attacks on deep neural networks. IEEE Access 7 (2019), 47230–47244

    2019

  5. [14]

    Shengshan Hu, Wei Liu, Minghui Li, Yechao Zhang, Xiaogeng Liu, Xianlong Wang, Leo Yu Zhang, and Junhui Hou. 2023. Pointcrt: Detecting backdoor in 3d point cloud via corruption robustness. InProceedings of the 31st ACM International Conference on Multimedia. 666–675

    2023

  6. [15]

    Youngdong Jang, Hyunje Park, Feng Yang, Heeju Ko, Euijin Choo, and Sangpil Kim. 2024. 3d-gsw: 3d gaussian splatting watermark for protecting copyrights in radiance fields. arXiv preprint arXiv:2409.13222 (2024)

    2024 arXiv

  7. [16]

    Wenxiang Jiang, Hanwei Zhang, Shuo Zhao, Zhongwen Guo, and Hao Wang

  8. [17]

    Bernhard Kerbl, Georgios Kopanas, Thomas Leimkühler, and George Drettakis

  9. [18]

    Hyunjeong Kim and In-Kwon Lee. 2024. Is 3DGS Useful?: Comparing the Ef- fectiveness of Recent Reconstruction Methods in VR. In 2024 IEEE International Symposium on Mixed and Augmented Reality (ISMAR) . IEEE, 71–80

    2024

  10. [19]

    Keita Kurita, Paul Michel, and Graham Neubig. 2020. Weight poisoning attacks on pre-trained models. arXiv preprint arXiv:2004.06660 (2020)

    2020 arXiv

  11. [20]

    Chenxin Li, Hengyu Liu, Zhiwen Fan, Wuyang Li, Yifan Liu, Panwang Pan, and Yixuan Yuan. 2024. Gaussianstego: A generalizable stenography pipeline for generative 3d gaussians splatting. arXiv preprint arXiv:2407.01301 (2024)

    2024 arXiv

  12. [21]

    Xinke Li, Zhirui Chen, Yue Zhao, Zekun Tong, Yabang Zhao, Andrew Lim, and Joey Tianyi Zhou. 2021. Pointba: Towards backdoor attacks in 3d point cloud. In Proceedings of the IEEE/CVF international conference on computer vision . 16492– 16501

    2021

  13. [22]

    Yuanchun Li, Jiayi Hua, Haoyu Wang, Chunyang Chen, and Yunxin Liu. 2021. Deeppayload: Black-box backdoor attack on deep learning models through neural payload injection. In 2021 IEEE/ACM 43rd International Conference on Software Engineering (ICSE). IEEE, 263–274

    2021

  14. [23]

    Yiming Li, Yong Jiang, Zhifeng Li, and Shu-Tao Xia. 2022. Backdoor learning: A survey. IEEE transactions on neural networks and learning systems 35, 1 (2022), 5–22

    2022

  15. [24]

    Yiming Li, Tongqing Zhai, Yong Jiang, Zhifeng Li, and Shu-Tao Xia. 2021. Back- door attack in the physical world. arXiv preprint arXiv:2104.02361 (2021)

    2021 arXiv

  16. [25]

    Yunfei Liu, Xingjun Ma, James Bailey, and Feng Lu. 2020. Reflection backdoor: A natural backdoor attack on deep neural networks. In Computer vision–ECCV 2020: 16th European conference, Glasgow, UK, August 23–28, 2020, proceedings, part X 16. Springer, 182–199

    2020

  17. [26]

    Jiahao Lu, Yifan Zhang, Qiuhong Shen, Xinchao Wang, and Shuicheng YAN

  18. [27]

    Ben Mildenhall, Pratul P Srinivasan, Matthew Tancik, Jonathan T Barron, Ravi Ramamoorthi, and Ren Ng. 2021. Nerf: Representing scenes as neural radiance fields for view synthesis. Commun. ACM 65, 1 (2021), 99–106

    2021

  19. [28]

    Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, Omar Fawzi, and Pascal Frossard. 2017. Universal adversarial perturbations. In Proceedings of the IEEE conference on computer vision and pattern recognition . 1765–1773

    2017

  20. [29]

    Simon Niedermayr, Christoph Neuhauser, Kaloian Petkov, Klaus Engel, and Rüdiger Westermann. 2024. Application of 3d gaussian splatting for cinematic anatomy on consumer class devices. arXiv preprint arXiv:2404.11285 (2024)

    2024 arXiv

  21. [30]

    Xiangyu Qi, Jifeng Zhu, Chulin Xie, and Yong Yang. 2021. Subnet replacement: Deployment-stage backdoor attack against deep neural networks in gray-box setting. arXiv preprint arXiv:2107.07240 (2021)

    2021 arXiv

  22. [31]

    Shi Qiu, Binzhu Xie, Qixuan Liu, and Pheng-Ann Heng. 2025. Advancing ex- tended reality with 3d gaussian splatting: Innovations and prospects. In 2025 IEEE International Conference on Artificial Intelligence and eXtended and Virtual Reality (AIxVR). IEEE, 203–208

    2025

  23. [32]

    Adnan Siraj Rakin, Zhezhi He, and Deliang Fan. 2020. Tbt: Targeted neural network attack with bit trojan. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition . 13198–13207

    2020

  24. [33]

    Kathleen R Rosen. 2008. The history of medical simulation. Journal of critical care 23, 2 (2008), 157–166

    2008

  25. [34]

    Qi Song, Ziyuan Luo, Ka Chun Cheung, Simon See, and Renjie Wan. 2024. Ge- ometry cloak: Preventing tgs-based 3d reconstruction from copyrighted images. Advances in Neural Information Processing Systems 37 (2024), 119361–119385

    2024

  26. [35]

    Yuqi Tan, Xiang Liu, Shuzhao Xie, Bin Chen, Shu-Tao Xia, and Zhi Wang. 2024. WATER-GS: Toward Copyright Protection for 3D Gaussian Splatting via Univer- sal Watermarking. arXiv preprint arXiv:2412.05695 (2024)

    2024 arXiv

  27. [36]

    Ruixiang Tang, Mengnan Du, Ninghao Liu, Fan Yang, and Xia Hu. 2020. An embarrassingly simple approach for trojan attack in deep neural networks. In Proceedings of the 26th ACM SIGKDD international conference on knowledge discovery & data mining . 218–228

    2020

  28. [37]

    Alexander Turner, Dimitris Tsipras, and Aleksander Madry. 2019. Label- consistent backdoor attacks. arXiv preprint arXiv:1912.02771 (2019)

    2019 arXiv

  29. [38]

    Hao Wang, Shangwei Guo, Jialing He, Kangjie Chen, Shudong Zhang, Tianwei Zhang, and Tao Xiang. 2024. Eviledit: Backdooring text-to-image diffusion Hong et al. models in one second. In Proceedings of the 32nd ACM International Conference on Multimedia. 3657–3665

    2024

  30. [39]

    Shuo Wang, Surya Nepal, Carsten Rudolph, Marthie Grobler, Shangyu Chen, and Tianle Chen. 2020. Backdoor attacks against transfer learning with pre-trained deep learning models. IEEE Transactions on Services Computing 15, 3 (2020), 1526–1539

    2020

  31. [40]

    Weijia Wang. 2024. Real-Time Fast 3D Reconstruction of Heritage Buildings Based on 3D Gaussian Splashing. In 2024 IEEE 2nd International Conference on Sensors, Electronics and Computer Engineering (ICSECE) . IEEE, 1014–1018

    2024

  32. [41]

    Zhou Wang, Alan C Bovik, Hamid R Sheikh, and Eero P Simoncelli. 2004. Image quality assessment: from error visibility to structural similarity.IEEE transactions on image processing 13, 4 (2004), 600–612

    2004

  33. [42]

    Cheng Wei, Yang Wang, Kuofeng Gao, Shuo Shao, Yiming Li, Zhibo Wang, and Zhan Qin. 2024. Pointncbw: Towards dataset ownership verification for point clouds via negative clean-label backdoor watermark. IEEE Transactions on Information Forensics and Security (2024)

    2024

  34. [43]

    Zhen Xiang, David J Miller, Siheng Chen, Xi Li, and George Kesidis. 2021. A backdoor attack against 3d point cloud classifiers. In Proceedings of the IEEE/CVF international conference on computer vision . 7597–7607

    2021

  35. [44]

    Ekim Yurtsever, Jacob Lambert, Alexander Carballo, and Kazuya Takeda. 2020. A survey of autonomous driving: Common practices and emerging technologies. IEEE access 8 (2020), 58443–58469

    2020

  36. [45]

    Abdurrahman Zeybey, Mehmet Ergezer, and Tommy Nguyen. 2024. Gaussian Splatting Under Attack: Investigating Adversarial Noise in 3D Objects. arXiv preprint arXiv:2412.02803 (2024)

    2024 arXiv

  37. [46]

    Richard Zhang, Phillip Isola, Alexei A Efros, Eli Shechtman, and Oliver Wang

  38. [47]

    Xuanyu Zhang, Jiarui Meng, Runyi Li, Zhipei Xu, Jian Zhang, et al. 2024. Gs-hider: Hiding messages into 3d gaussian splatting. Advances in Neural Information Processing Systems 37 (2024), 49780–49805

    2024

  39. [48]

    Xuanyu Zhang, Jiarui Meng, Zhipei Xu, Shuzhou Yang, Yanmin Wu, Ronggang Wang, and Jian Zhang. [n. d.]. SecureGS: Boosting the Security and Fidelity of 3D Gaussian Splatting Steganography. In The Thirteenth International Conference on Learning Representations

  40. [49]

    Yan Zhang, Yi Zhu, Zihao Liu, Chenglin Miao, Foad Hajiaghajani, Lu Su, and Chunming Qiao. 2022. Towards backdoor attacks against lidar object detection in autonomous driving. In Proceedings of the 20th ACM Conference on Embedded Networked Sensor Systems. 533–547

    2022

  41. [50]

    Haoti Zhong, Cong Liao, Anna Cinzia Squicciarini, Sencun Zhu, and David Miller

  42. [51]

    Xiaoyu Zhou, Zhiwei Lin, Xiaojun Shan, Yongtao Wang, Deqing Sun, and Ming- Hsuan Yang. 2024. Drivinggaussian: Composite gaussian splatting for surround- ing dynamic autonomous driving scenes. In Proceedings of the IEEE/CVF confer- ence on computer vision and pattern recognitio...

    2024

  43. [52]

    Siting Zhu, Guangming Wang, Xin Kong, Dezhi Kong, and Hesheng Wang. 2024. 3d gaussian splatting in robotics: A survey. arXiv preprint arXiv:2410.12262 (2024). GaussTrap: Stealthy Poisoning Attacks on 3D Gaussian Splatting for Targeted Scene Confusion A Pseudocode for GaussTrap...

    2024 arXiv

  44. [2018]

    In Proceedings of the IEEE conference on computer vision and pattern recognition

    The unreasonable effectiveness of deep features as a perceptual metric. In Proceedings of the IEEE conference on computer vision and pattern recognition . 586–595

  45. [2020]

    In Proceedings of the Tenth ACM Conference on Data and Application Security and Privacy

    Backdoor embedding in convolutional neural network models via invisible perturbation. In Proceedings of the Tenth ACM Conference on Data and Application Security and Privacy. 97–108

  46. [2023]

    ACM Transactions on Graphics 42, 4 (July 2023)

    3D Gaussian Splatting for Real-Time Radiance Field Rendering. ACM Transactions on Graphics 42, 4 (July 2023). https://repo-sam.inria.fr/fungraph/3d- gaussian-splatting/

    2023

  47. [2024]

    In ECAI 2024

    IPA-NeRF: Illusory Poisoning Attack Against Neural Radiance Fields. In ECAI 2024. IOS Press, 513–520

    2024

  48. [2025]

    In The Thirteenth International Conference on Learning Representations

    Poison-splat: Computation Cost Attack on 3D Gaussian Splatting. In The Thirteenth International Conference on Learning Representations . https: //openreview.net/forum?id=ExrEw8cVlU

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.