ComplicitSplat: Downstream Models are Vulnerable to Blackbox Attacks by 3D Gaussian Splat Camouflages

Aeree Cho; Duen Horng Chau; Haorang Wang; Haoyang Yang; Mansi Phute; Martin Andreoni; Matthew Hull; Matthew Lau; Pratham Mehta; Wenke Lee

REVIEW 4 major objections 3 minor 1 cited by

ComplicitSplat: Downstream Models are Vulnerable to Blackbox Attacks by 3D Gaussian Splat Camouflages

T0 review · 4 major / 3 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read ComplicitSplat embeds adversarial patterns into 3D scenes that are visible only from a single viewpoint, fooling detectors without any model access.

desk verdict Clever new attack idea, but I can't judge it: the supplied full text is a different paper, and the physical-transfer claim is unbacked. read the letter →

arxiv 2508.11854 v2 pith:3NZIYMGY submitted 2025-08-16 cs.CV cs.LG

Matthew Hull , Haoyang Yang , Pratham Mehta , Mansi Phute , Aeree Cho , Haorang Wang , Matthew Lau , Wenke Lee

show 3 more authors

Wilian Lunardi Martin Andreoni Duen Horng Chau

This is my paper

classification cs.CVcs.LG

keywords 3DGaussianSplattingadversarialattackblack-boxobjectdetectionview-dependentcamouflagenovelviewsynthesisautonomousvehiclesafety

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

ComplicitSplat tries to show that 3D Gaussian Splatting—a fast-growing technique for reconstructing a scene from photos—gives an adversary a new way to hide attacks. The trick is to exploit the shading model's view-dependent behavior to bake a pattern into an object that looks benign from most angles but turns into detector-fooling content exactly when viewed from a spot the attacker chooses. The attack is black-box: it does not need the weights or architecture of the object detector it targets. The paper reports that the resulting camouflage fools single-stage, multi-stage, and transformer-based detectors, and that it transfers both to synthetic scenes and to real-world captures of physical objects. If these results hold, safety-critical systems like autonomous cars would need to treat a scene's appearance as attacker-controlled rather than trustworthy.

What carries the argument

The central object is ComplicitSplat itself: a method that exploits standard 3D Gaussian Splatting shading to generate view-dependent camouflage. 3DGS represents a scene as a set of Gaussian primitives whose appearance is computed through a differentiable splatting pipeline; ComplicitSplat adjusts these primitives' colors and textures so that a rendered object changes appearance with viewing angle. This mechanism is what makes the adversarial signal present in one rendering direction and absent in others, achieving viewpoint specificity without knowledge of the target detector's architecture or weights.

What would settle it

Print or fabricate an object with ComplicitSplat's optimized appearance, place it in a real scene with a standard object detector, and record detections across a sweep of camera viewpoints. If the detector is not fooled at the target viewpoint, or is fooled from a wide range of viewpoints rather than only the intended one, the paper's real-world generalization claim fails; if the attack works physically as well as in synthetic renders, the claim is supported.

Watch

Extended reading notes

Core claim

The central claim is that ComplicitSplat is the first black-box attack that leverages standard 3D Gaussian Splatting (3DGS) shading to create viewpoint-specific camouflage. By optimizing colors and textures that change with viewing angle, the method embeds adversarial content in scene objects such that the object appears innocuous from most viewpoints but triggers detector failure from a specific viewpoint. The paper asserts this is the first 3DGS-based black-box attack on downstream object detectors, and that it generalizes across detector families (single-stage, multi-stage, transformer-based) on both synthetic scenes and real-world captures of physical objects, exposing a new safety risk

Load-bearing premise

The load-bearing premise is that the view-dependent appearance created in the rendered 3D scene survives the transfer to a physically fabricated object—under real lighting, camera optics, and fabrication fidelity—and still fools the detector exactly at the chosen viewpoint.

Editorial extensions

If this is right

A detector's output can be made unreliable by a physical object that appears unremarkable to human observers, because the adversarial pattern is gated by viewing angle.
Safety evaluation of perception systems should include attacks that manipulate scene appearance through the rendering or physical layer, not just image-level noise.
Autonomous navigation and robotics pipelines that rely on novel-view synthesis or 3D reconstruction inherit a new attack surface at the object level.
Because the attack is black-box, it transfers even when the target model's architecture and weights are hidden, widening the set of plausible attackers.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The most critical unresolved link is physical transfer: the abstract reports a real-world capture, but without a described fabrication method or per-condition numbers, a reader cannot tell whether the printed object preserved the view-dependent effect. A natural extension would be a systematic sweep over materials, printers, lighting, and camera lenses.
The attack's viewpoint specificity presupposes the attacker can predict or steer the victim camera's pose. A practical deployment would likely need to create multiple viewpoint-specific patches or a temporal sequence, since a moving vehicle's camera angle changes continuously.
The same shading-based hiding trick could plausibly be applied to other view-dependent rendering methods, not just 3DGS; the mechanism is the view-dependent shading itself, so the attack concept may be more general than the specific implementation.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Quick take: the abstract describes something I haven't seen before – using 3DGS view-dependent shading to hide adversarial content that only appears from a specific viewpoint, with no white-box access to the target detector. That's a real departure from static patches and whole-scene poisoning, and the breadth of claimed targets (single-stage, multi-stage, transformer detectors on both synthetic and physical scenes) is impressive if true.

Problem: the full text I was given is a chemistry paper (LARC, retrosynthesis). So I have no way to check methods, numbers, baselines, or the novelty claim. That's the first thing to fix.

The biggest soft spot, even from the abstract, is the physical-transfer step. 3DGS appearance is a rendering abstraction (spherical-harmonic coefficients, alpha-blended splats). Getting that onto a physical object that still fools a detector at one viewpoint under natural lighting is not a given. The abstract says 'real-world capture of physical objects' but gives no fabrication method, no per-condition numbers, no sensitivity analysis. If that step fails, the result is a synthetic-only attack, which is still interesting but much weaker. The other assumption is that the attacker controls the victim's viewing angle. That's a specific threat model that needs to be stated and justified.

Also, 'black-box' is doing a lot of work. The abstract says no architecture or weight access, but it doesn't say how many queries, what surrogate ensemble was used, or whether the detectors tested share inductive biases with the surrogates. The transfer-abstraction overlap could inflate success rates.

What's genuinely good: the viewpoint-specific aspect is a new axis for adversarial camouflage, and the framing around safety-critical 3DGS deployment is fair. The claim that it works across detector families suggests they ran a real eval, but I can't see it.

Who's this for? Adversarial ML and 3D vision people, especially anyone thinking about physical attacks on autonomous driving. If the experiments check out, it's a solid contribution. But right now I can't tell you if they do.

Recommendation: don't desk reject based on the abstract. Ask the authors to supply the correct full text. If it matches, send it out for review with extra scrutiny on the physical-transfer experiments and the threat model. If the mismatch is a submission defect, that's a separate integrity issue.

Referee Report

4 major / 3 minor

Summary. The submission presents an abstract claiming 'ComplicitSplat', described as the first black-box attack that exploits standard 3D Gaussian Splatting shading to create viewpoint-specific camouflage, with experiments on real-world physical objects and synthetic scenes against single-stage, multi-stage, and transformer-based detectors. However, the supplied 'Full Text' is a different manuscript (arXiv:2508.11860, 'LARC: Towards Human-level Constrained Retrosynthesis Planning through an Agentic Framework'), which concerns LLM agents for chemistry and contains no material on 3DGS, adversarial attacks, or object detection. As submitted, the manuscript therefore consists only of an abstract plus an unrelated full text. No method, experiments, datasets, ablations, or quantitative results are available for ComplicitSplat.

Significance. If the claimed attack were fully demonstrated, it would be significant for safety-critical vision systems relying on 3DGS-based rendering, particularly autonomous navigation. The viewpoint-specific, black-box property would be a novel contribution. However, the significance cannot be assessed from this submission because there is no verifiable technical content: no optimization procedure, no threat model, no detector evaluation, no physical fabrication protocol, and no comparison with prior adversarial 3DGS work. The abstract alone is a plausible but unsubstantiated research proposal, not a refereed paper. The claimed real-world transfer and black-box generalization are exactly the load-bearing assertions that need experimental support, and none is present.

major comments (4)

[Full Text (arXiv:2508.11860)] The supplied full text is a completely different manuscript on constrained retrosynthesis planning (LARC). It contains no description of ComplicitSplat's method, objective function, rendering/optimization pipeline, datasets, detector architectures, metrics, or baselines. Consequently, every technical claim in the abstract is unsupported by any evidence in the submission. This is a load-bearing omission that prevents review.
[Abstract, 'real-world capture of physical objects'] The abstract claims the attack generalizes to physical objects, but no fabrication or physical-transfer methodology is described. It is not established that view-dependent appearance parametrized by 3DGS shading (e.g., spherical harmonics) survives manufacturing, lighting conditions, and camera optics to fool a detector at the target viewpoint. Without a protocol and per-condition results, this claim is unverifiable and cannot be accepted as a demonstrated result.
[Abstract, 'without requiring access to model architecture or weights'] The black-box claim is not supported by any experimental protocol. There is no statement of which surrogate models were used to optimize the camouflage, whether the tested detectors overlap with or share inductive biases with those surrogates, or how transfer was measured. As stated, the risk of circularity—where 'black-box' success is measured on models effectively included in the surrogate ensemble—cannot be ruled out. Concrete model lists and per-detector results are required.
[Abstract, 'visible only from specific viewpoints'] The attack's practical threat relies on the assumption that the victim camera observes the object from a known or controllable viewpoint. No threat model, viewpoint-sensitivity analysis, or robustness to pose variation is provided. If this assumption fails, the claimed attack reduces to a synthetic-render-only curiosity. This is a central unsupported premise.

minor comments (3)

[Abstract] Typographical and grammatical errors: 'a variety of popular detector - both single-stage, multi-stage, and transformer-based models' should be 'detectors — both single-stage, multi-stage, and transformer-based —'.
[Abstract] The phrase 'To our knowledge, this is the first...' is not accompanied by a related-work comparison or citations; novelty claims require at least a brief positioning against prior adversarial rendering and 3DGS attacks.
[Full Text] The submission file itself appears to be a different paper. If ComplicitSplat is the intended manuscript, the correct full text must be uploaded. This is not a minor formatting issue but a submission-integrity problem.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity found; the ComplicitSplat abstract contains no derivation chain, and the supplied full text is a different manuscript (LARC).

full rationale

The ComplicitSplat abstract makes empirical claims about a first black-box viewpoint-specific attack using 3DGS shading, but it provides no equations, no fitted parameters, no self-citation chain, and no derivation that would reduce a prediction to its inputs. The full text supplied is LARC (arXiv:2508.11860), a constrained retrosynthesis paper, not the ComplicitSplat manuscript; it cannot be used to exhibit a specific reduction in ComplicitSplat's method. Concerns that physical transfer and viewpoint control are unsubstantiated, or that test detectors may share inductive biases with surrogate models, are validity and generalization critiques, not circularity under the stated rules. Therefore no circular step can be quoted and scored.

Assumptions & free parameters 2 free parameters · 3 assumptions · 0 invented entities

The central claim rests on domain assumptions unverifiable from the abstract: physical transfer of view-dependent appearance, black-box transfer from surrogate to unseen detectors, and attacker control of the victim's viewpoint. No free parameters are disclosed in the abstract; an attack of this type necessarily involves optimization hyperparameters and surrogate model selection whose values are not stated. No new entities are postulated.

free parameters (2)

Viewpoint-conditioned adversarial budget (color/texture deviation per viewing angle)
The magnitude of appearance deviation at each viewpoint is an optimization parameter; its value is not given in the abstract and directly controls whether the camouflage is detectable by human or statistical inspection.
Surrogate model ensemble used for black-box optimization
Black-box transfer requires optimizing against accessible surrogate detectors; which surrogates were used and whether the evaluated detectors overlap the surrogate set is not stated in the abstract.

assumptions (3)

domain assumption Physical-world transfer: view-dependent appearance generated by 3DGS shading survives real-world fabrication and camera capture at the target viewpoint.
The abstract claims success on 'real-world capture of physical objects'; this requires printed or fabricated materials to reproduce angle-dependent colors accurately enough to still fool detectors, a strong and unverified assumption in abstract-only materials.
domain assumption Black-box transferability: perturbations optimized against accessible surrogate models transfer to unseen proprietary detectors.
The abstract claims a black-box attack against single-stage, multi-stage, and transformer detectors without architecture or weight access; transfer across families and training sets is an empirical regularity, not a guarantee.
domain assumption Viewpoint control: the victim's camera views the object from the specific viewpoint at which the adversarial content is visible.
The attack's premise, 'visible only from specific viewpoints', is only harmful if the target pipeline observes the object from those viewpoints, e.g., a known camera trajectory in a navigation setting.

how reviews work

0 comments

Cite this review

Pith. "Pith review of ComplicitSplat: Downstream Models are Vulnerable to Blackbox Attacks by 3D Gaussian Splat Camouflages." pith.science (2026). https://pith.science/paper/3NZIYMGY

@misc{pith2026250811854,
  author       = {Pith},
  title        = {Pith review of: ComplicitSplat: Downstream Models are Vulnerable to Blackbox Attacks by 3D Gaussian Splat Camouflages},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/3NZIYMGY}},
  note         = {Machine review of arXiv:2508.11854}
}

read the original abstract

As 3D Gaussian Splatting (3DGS) gains rapid adoption in safety-critical tasks for efficient novel-view synthesis from static images, how might an adversary tamper images to cause harm? We introduce ComplicitSplat, the first attack that exploits standard 3DGS shading methods to create viewpoint-specific camouflage - colors and textures that change with viewing angle - to embed adversarial content in scene objects that are visible only from specific viewpoints and without requiring access to model architecture or weights. Our extensive experiments show that ComplicitSplat generalizes to successfully attack a variety of popular detector - both single-stage, multi-stage, and transformer-based models on both real-world capture of physical objects and synthetic scenes. To our knowledge, this is the first black-box attack on downstream object detectors using 3DGS, exposing a novel safety risk for applications like autonomous navigation and other mission-critical robotic systems.

Discussion (0). Sign in to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

ALLUDE: A Unified Evaluation System for Configurable Attacks in Differentiable Environments
cs.CV 2026-07 conditional novelty 6.0 of 10

A configurable, cross-platform simulator-based evaluation platform shows that object class and camera trajectory, not weather or detector choice, dominate whether 3D adversarial patch attacks succeed, and that all tes...

Reference graph

Works this paper leans on

3 extracted references · 2 linked inside Pith · cited by 1 Pith paper

[3669]

URL https://www.nature.com/articles/ s42004-024-01133-2

doi: 10.1038/s42004-024-01133-2. URL https://www.nature.com/articles/ s42004-024-01133-2 . Publisher: Nature Publishing Group. Mingchen Zhuge, Changsheng Zhao, Dylan Ashley, Wenyi Wang, Dmitrii Khizbullin, Yunyang Xiong, et al. Agent-as-a-Judge: Evaluate Agents with Agents, October 2024. URL http://arxiv.org/abs/2410.10934. arXiv:2410.10934 [cs]. 12 Prepr...

arXiv 2024
[4687]

URL https://www.nature.com/articles/nature25978

doi: 10.1038/nature25978. URL https://www.nature.com/articles/nature25978. Publisher: Nature Publishing Group. Kyle Swanson, Parker Walther, Jeremy Leitz, Souhrid Mukherjee, Joseph C Wu, Rabindra V Shivnaraine, et al. ADMET-AI: a machine learning ADMET platform for evaluation of large-scale chemical libraries. Bioinformatics, 40(7):btae416, July 2024. ISS...

arXiv 2024
[5495]

URL https://proceedings.mlr.press/v139/kim21b.html

PMLR, July 2021. URL https://proceedings.mlr.press/v139/kim21b.html. ISSN: 2640-3498. T. L Lai and Herbert Robbins. Asymptotically efficient adaptive allocation rules. Ad- vances in Applied Mathematics , 6(1):4–22, March 1985. ISSN 0196-8858. doi: 10. 1016/0196-8858(85)90002-8. URL https://www.sciencedirect.com/science/article/ pii/0196885885900028. 10 Pr...

arXiv 2021

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.

[1] [3669]

URL https://www.nature.com/articles/ s42004-024-01133-2

doi: 10.1038/s42004-024-01133-2. URL https://www.nature.com/articles/ s42004-024-01133-2 . Publisher: Nature Publishing Group. Mingchen Zhuge, Changsheng Zhao, Dylan Ashley, Wenyi Wang, Dmitrii Khizbullin, Yunyang Xiong, et al. Agent-as-a-Judge: Evaluate Agents with Agents, October 2024. URL http://arxiv.org/abs/2410.10934. arXiv:2410.10934 [cs]. 12 Prepr...

arXiv 2024

[2] [4687]

URL https://www.nature.com/articles/nature25978

doi: 10.1038/nature25978. URL https://www.nature.com/articles/nature25978. Publisher: Nature Publishing Group. Kyle Swanson, Parker Walther, Jeremy Leitz, Souhrid Mukherjee, Joseph C Wu, Rabindra V Shivnaraine, et al. ADMET-AI: a machine learning ADMET platform for evaluation of large-scale chemical libraries. Bioinformatics, 40(7):btae416, July 2024. ISS...

arXiv 2024

[3] [5495]

URL https://proceedings.mlr.press/v139/kim21b.html

PMLR, July 2021. URL https://proceedings.mlr.press/v139/kim21b.html. ISSN: 2640-3498. T. L Lai and Herbert Robbins. Asymptotically efficient adaptive allocation rules. Ad- vances in Applied Mathematics , 6(1):4–22, March 1985. ISSN 0196-8858. doi: 10. 1016/0196-8858(85)90002-8. URL https://www.sciencedirect.com/science/article/ pii/0196885885900028. 10 Pr...

arXiv 2021