Poison-splat: Computation Cost Attack on 3D Gaussian Splatting

## Abstract

Abstract 3D Gaussian splatting (3DGS), known for its groundbreaking performance and efficiency, has become a dominant 3D representation and brought progress to many 3D vision tasks. However, in this work, we reveal a significant security vulnerability that has been largely overlooked in 3DGS: the computation cost of training 3DGS could be maliciously tampered by poisoning the input data . By developing an attack named Poison-splat , we reveal a novel attack surface where the adversary can poison the input images to drastically increase the computation memory and time needed for 3DGS training, pushing the algorithm towards its worst computation complexity. In extreme cases, the attack can even consume all allocable memory, leading to a Denial-of-Service (DoS) that disrupts servers, resulting in practical damages to real-world 3DGS service vendors. Such a computation cost attack is achieved by addressing a bi-level optimization problem through three tailored strategies: attack objective approximation, proxy model rendering, and optional constrained optimization. These strategies not only ensure the effectiveness of our attack but also make it difficult to defend with simple defensive measures. We hope the revelation of this novel attack surface can spark attention to this crucial yet overlooked vulnerability of 3DGS systems 1 1 1 Our code is available at https://github.com/jiahaolu97/poison-splat . .

## 1 Introduction

3D reconstruction, aiming to build 3D representations from multi-view 2D images, holds a critical position in computer vision and machine learning, extending its benefits across broad domains including entertainment, healthcare, archaeology, and the manufacturing industry. A notable example is Google Map with a novel feature for NeRF-based (Mildenhall et al., ) 3D outdoor scene reconstruction (Google, ). Similarly, commercial companies like  ,  ,   and   offer paid service for users to generate 3D captures from user-uploaded images or videos. Among these popular 3D applications, many are powered by a novel and sought-after 3D reconstruction paradigm known as 3D Gaussian Splatting (3DGS).

3DGS, introduced by Kerbl et al. () in 2023, has quickly revolutionized the field of 3D Vision and achieved overwhelming popularity (Chen & Wang, ; Fei et al., ; Wu et al., ; Dalal et al., ). 3DGS is not powered by neural networks, distinguishing itself from NeRF (Mildenhall et al., ), the former dominant force in 3D vision. Instead, it captures 3D scenes by learning a cloud of 3D Gaussians as an explicit 3D model and uses rasterization to render multiple objects simultaneously. This enables 3DGS to achieve significant advantages in rendering speed, photo-realism, and interpretability, making it a game changer in the field.

Figure: Figure 1: Our Poison-splat attack adds perturbations to input images, making 3D Gaussian Splatting need significantly more parameters to reconstruct the 3D scene, leading to huge increases in GPU memory consumption, training time and rendering latency. Here, we visualize the input image and the underlying 3D Gaussians of a clean view (left) and its corresponding poisoned view (right).
Refer to caption: x1.png

One intriguing property of Gaussian Splatting is its flexibility in model complexity.
Unlike NeRF or any other neural-network based algorithms which have a pre-determined and fixed computational complexity based on network hyper-parameters, 3DGS can dynamically adjust its complexity according to the input data. During the 3DGS training process, the size of learnable parameters, *i.e*.the number of 3D Gaussians is dynamically adjusted to align with the complexity of the underlying 3D scene. More specifically, 3DGS algorithm uses an adaptive density control strategy to flexibly increase or decrease the number of Gaussians for optimizing reconstruction, leading to variable computational complexity in terms of GPU memory occupancy and training time cost.

The above flexibility in design aims to provide training advantages. However, this flexibility can also become a vulnerability. In this paper, we reveal a severe yet unnoticed attack vector: the flexibility of 3DGS complexity can be abused to over-consume computation resources such as GPU memory and significantly drag down training speed of Gaussian Splatting system, pushing the training process to its worst computational complexity.

We develop a computation cost attack method named Poison-splat as a proof-of-concept of this novel attack vector. Poison-splat takes the form of training data poisoning (Tian et al., ), where the attacker manipulates the input data fed into the victim 3DGS system. This is practical in real-world scenarios, as commercial 3D service providers like Kiri (), Polycam () and Spline () receive images or videos from end users to generate 3D captures. An attacker can hide themselves among normal users to submit poisoned data and launch the attack stealthily, or even secretly manipulate data uploaded by other users. During peak usage periods, this attack competes for computing resources with legitimate users, slowing down service response time and potentially causing severe consequences like service crashes, leading to financial losses for service providers.

We formulate Poison-splat attack as a max-min problem. The inner optimization is the learning process of 3D Gaussian Splatting, *i.e*., minimizing the reconstruction loss given a set of input images and camera poses, while the outer optimization problem is to maximize the computation cost of solving the inner problem. Although accurately solving this bi-level optimization is often infeasible, we find that the attacker can use a proxy model to approximate the inner minimization and focus on optimizing the outer maximization objective. Moreover, we observe an important relationship that memory consumption and rendering latency exhibit a clear positive correlation with the number of 3D Gaussians in training. Therefore, the attacker can use the number of Gaussians in proxy model training as a metric to depict computation costs for outer optimization. Motivated by these insights, our Poison-splat attack uses image total variation loss as a prior to guide the over-densification of 3D Gaussians, and can approximately solve this bi-level optimization problem in a cheap way.

The contributions of this work can be concluded in three-folds:

- •
We reveal that the flexibility in model complexity of 3DGS can become a security backdoor, making it vulnerable to computation cost attack. This vulnerability has been largely overlooked by the 3D vision and machine learning communities. Our research shows that such attacks are feasible, potentially causing severe financial losses to 3D service providers.
- •
We formulate the attack on 3D Gaussian Splatting as a data poisoning attack problem. To our best knowledge, there is no previous work investigating how to poison training data to increase the computation cost of machine learning systems.
- •
We propose a novel attack algorithm, named Poison-splat, which significantly increases GPU memory consumption and slows down training procedure of 3DGS. We hope the community can recognize this vulnerability and develop more robust 3D Gaussian Splatting algorithms or defensive methods to mitigate such attacks.

## 2 Preliminaries

In this section, we provide essential backgrounds on 3D Gaussian Splatting and resource-targeting attacks, which are crucial for understanding our attack method proposed in Section 3. Due to page constraints, we put related works in Appendix Section A.

### 2.1 3D Gaussian Splatting

3D Gaussian Splatting (3DGS) (Kerbl et al., ) has revolutionized the 3D vision community with its superior performance and efficiency. It models a 3D scene by learning a set of 3D Gaussians $\mathcal{G}=\{G_{i}\}$ from multi-view images $\mathcal{D}=\{V_{k},P_{k}\}_{k=1}^{N}$, where each view consists of a ground-truth image ${V_{k}}$ and the corresponding camera poses ${P_{k}}$.
We denote $N$ as the total number of image-pose pairs in the training data. As for the model, each 3D Gaussian $G_{i}=\{\mu_{i},s_{i},\alpha_{i},q_{i},c_{i}\}$ has 5 optimizable parameters: center coordinates $\mu_{i}$, scales $s_{i}$, opacity $\alpha_{i}$, rotation quaternion $q_{i}$, and associated view-dependent color represented as spherical harmonics $c_{i}$.

To render $\mathcal{G}$ from 3D Gaussian space to 2D images, each Gaussian is first projected into the camera coordinate frame given a camera pose $P_{k}$ to determine the depth of each Gaussian, which is the distance of that Gaussian to the camera view. The calculated depth is used for sorting Gaussians from near to far, and then the colors in 2D image are rendered in parallel by alpha blending according to the depth order of adjacent 3D Gaussians. We denote the 3DGS renderer as a function $\mathcal{R}$, which takes as input the Gaussians $\mathcal{G}$ and a camera pose $P_{k}$ to render an image $V^{\prime}_{k}=\mathcal{R}(\mathcal{G},P_{k})$.

The training is done by optimizing the reconstruction loss between the rendered image and ground truth image for each camera view, where the reconstruction loss is a combination of $\mathcal{L}_{1}$ loss and structural similarity index measure (SSIM) loss $\mathcal{L}_{\text{D-SSIM}}$ (Brunet et al., ):

$$ $\displaystyle\mathop{\min}\limits_{\mathcal{G}}\mathcal{L}(\mathcal{D})= \mathop{\min}\limits_{\mathcal{G}}\sum\limits_{k=1}^{N}\mathcal{L}(V^{\prime}_ {k},{V}_{k})=\mathop{\min}\limits_{\mathcal{G}}~{}\sum\limits_{k=1}^{N}(1- \lambda)\mathcal{L}_{1}(V^{\prime}_{k},{V}_{k})+\lambda\mathcal{L}_{\text{D- SSIM}}(V^{\prime}_{k},{V}_{k}),$ (1) $$

where $\lambda$ is a trade-off parameter. To ensure finer reconstruction, 3DGS deploys adaptive density control to automatically add or remove Gaussians from optimization. Adding Gaussians is called densification, while removing Gaussians is called pruning. Densification is performed when the view-space positional gradient $\nabla_{\mu_{i}}\mathcal{L}$ is larger than a pre-set gradient threshold $\tau_{g}$ (by default 0.0002). Pruning occurs when the opacity $\alpha_{i}$ falls below the opacity threshold $\tau_{\alpha}$. Both densification and pruning are non-differentiable operations. A more formal and comprehensive introduction is provided in Appendix Section B.

### 2.2 Resource-targeting Attack

A similar concept in computer security domain is the Denial-of-Service (DoS) attack (Elleithy et al., ; Aldhyani & Alkahtani, ; Bhatia et al., ). A Dos attack aims to overwhelmly consume a system’s resources or network (Mirkovic & Reiher, ; Long & Thomas, ), making it unable to serve legitimate users. Common methods include flooding the system with excessive requests or triggering a crash through malicious inputs. Such attacks pose severe risks to real-world service providers, potentially resulting in extensive operational disruptions and financial losses.
For example, Midjourney, a generative AI platform, experienced a significant 24-hour system outage (Akash, ), potentially caused by employees from another generative AI company who were allegedly scraping data, causing a Denial-of-Service.

In the machine learning community, similar concepts are rarely mentioned. This might stem from the fact that once hyper-parameters are set in most machine learning models, such as deep neural networks, their computation complexity remains fixed. Regardless of input data content, most machine learning algorithms incur nearly constant computational costs and consume almost consistent computational resources. Despite this, only a few studies have focused on resource-targeting attacks at inference stage of machine learning systems. For example,  Shumailov et al. () first identified samples that trigger excessive neuron activations which maximise energy consumption and latency. Following works investigated other inference-stage attacks against dynamic neural networks (Hong et al., ; Chen et al., ) and language models (Chen et al., ; ; Gao et al., ). However, to our knowledge, no previous works have targeted at attacking the training-stage computation cost of machine learning systems. Our work is pioneering in bridging this research gap through Gaussian Splatting, which features adaptively flexible computation complexity.

## 3 Poison-splat Attack

In this section, we first formulate the computation cost attack on 3D Gaussian Splatting in Section 3.1. Subsequently, we introduce a novel attack method in Section 3.2.

### 3.1 Problem Formulation

We formulate our attack under data poisoning framework as follows. The victims are the service providers of 3D Gaussian Splatting (3DGS), who typically train their 3DGS models using a dataset of multi-view images and camera poses $\mathcal{D}=\{V_{k},P_{k}\}_{k=1}^{N}$. We assume the attackers have the capability to introduce poisoned data within the entire dataset. This assumption is realistic as an attacker could masquerade as a regular user, submitting poisoned data covertly, or even covertly alter data submitted by legitimate users. This allows the attack to be launched stealthily and enhances its potential impact on the training process of 3DGS. We next detail the formulation of the attacker and victim.

Attacker. The attacker begins with the clean data $\mathcal{D}=\{V_{k},P_{k}\}_{k=1}^{N}$ as input, manipulating it to produce poisoned training data $\mathcal{D}_{p}=\{\tilde{V}_{k},P_{k}\}_{k=1}^{N}$, where the attacker does not modify the camera pose configuration files. Each poisoned image $\tilde{V_{k}}$ is perturbed from the original clean image ${V_{k}}$, aiming to maximize the computational costs of victim training, such as GPU memory usage and training time. The ultimate goal of the attacker is to significantly increase the computational resources, potentially leading to a denial-of-service attack by overwhelming the training system.

Victim. On the other hand, the victim receives this poisoned dataset $\mathcal{D}_{p}=\{\tilde{V}_{k},P_{k}\}_{k=1}^{N}$ from the attacker, unaware that it has been poisoned. With this data, the victim seeks to train a Gaussian Splatting Model $\mathcal{G}$, striving to minimize the reconstruction loss (cf. Eq. (1)). The victim’s objective is to achieve the lowest loss as possible, thus ensuring the quality of the Gaussian Splatting model.

Optimization problem. To summarize, the computation cost attack for the attacker can be formulated as the following max-min bi-level optimization problem:

$$ $\displaystyle\mathcal{D}_{p}=\mathop{\arg\max}\limits_{\mathcal{D}_{p}} \mathcal{C}(\mathcal{G}^{*}),~{}~{}\text{s.t.\quad}\mathcal{G}^{*}=\mathop{ \arg\min}\limits_{\mathcal{G}}\mathcal{L}(\mathcal{D}_{p}),$ (2) $$

where the computation cost metric $\mathcal{C}(\mathcal{G})$ is flexible and can be designed by the attacker.

### 3.2 Proposed Method

To conduct the attack, directly addressing the above optimization is infeasible as the computation cost is not differentiable. To address this, we seek to find an approximation for the objective.

Figure: Figure 2: The figure illustrates the strong positive correlation between the number of Gaussians and (a) GPU memory occupancy, and (b) training time costs. Panel (c) shows the relationship between image sharpness, measured by the average total variation score, and the number of Gaussians.
Refer to caption: x2.png

Using the number of Gaussians as an approximation. As is mentioned in Section 1, a major advantage of 3DGS is its flexibility to dynamically adjust model complexity (*i.e*., the number of Gaussians) according to the complexity of the input data. This adaptability enhances the model’s efficiency and fidelity in rendering complex scenes. However, this feature may also act as a double-edged sword, providing a potential backdoor for attacks. To explore this, we analyze how the number of Gaussians affects computational costs, including memory consumption and training time. Our findings, depicted in Figures 2(a-b), reveal a clear positive correlation between computational costs and the number of Gaussians used in rendering. In light of this insight, it is intuitive to use the number of Gaussians $\|\mathcal{G}\|$ to approximate the computation cost function involved in the inner optimization:

$$ $\mathcal{C}(\mathcal{G})\vcentcolon=\|\mathcal{G}\|.$ (3) $$

Maximizing the number of Gaussians by sharpening 3D objects. Even with the above approximation, solving the optimization problem is still hard since the Gaussian densification operation in 3DGS is not differentiable. Hence, it would be infeasible for the attacker to use gradient-based methods to optimize the number of Gaussians. To circumvent this, we explore a strategic alternative. As shown in Figure 2(c), we find that 3DGS tends to assign more Gaussians to those objects with more complex structures and non-smooth textures, as quantified by the total variation score—a metric assessing image sharpness (Rudin et al., ). Intuitively, the less smooth the surface of 3D objects is, the more Gaussians the model needs to recover all the details from its 2D image projections. Hence, non-smoothness can be a good descriptor of complexity of Gaussians, *i.e*., $\|\mathcal{G}\|\propto\mathcal{S}_{\text{TV}}(\mathcal{D})$. Inspired by this, we propose to maximize the computation cost by optimizing the total variation score of rendered images $\mathcal{S}_{\text{TV}}(\tilde{V}_{k})$:

$$ $\mathcal{C}(\mathcal{G})\vcentcolon=\mathcal{S}_{\text{TV}}(\tilde{V}_{k})= \sum\limits_{i,j}\sqrt{\left|\tilde{V}_{k}^{i+1,j}-\tilde{V}_{k}^{i,j}\right|^ {2}+\left|\tilde{V}_{k}^{i,j+1}-\tilde{V}_{k}^{i,j}\right|^{2}}.$ (4) $$

Balancing attack strength and stealthiness via optional constrained optimization.
The above strategies enable the attack to significantly increase computational costs . However, this may induce an unlimited alteration to the image and result in a loss of semantic integrity in the generated view images (cf. Figure 4(b)), making it obvious to detect. Considering the strategic objectives of an adversary who may wish to preserve image semantics and launch the attack by stealth, we introduce an optional constrained optimization strategy. Inspired by adversarial attacks (Szegedy et al., ; Madry et al., ), we enforce a $\epsilon$-ball constraint of the $L_{\infty}$ norm on the perturbations:

$$ $\displaystyle\tilde{V_{k}}\in\mathcal{P}_{\epsilon}(\tilde{V_{k}},V_{k}).$ (5) $$

where $\mathcal{P}_{\epsilon}(\cdot)$ means to clamp the rendered poisoned image to be within the $\epsilon$-ball of the $L_{\infty}$ norm around the original clean image, *i.e*., $\|\tilde{V_{k}}-V_{k}\|_{\infty}\leq\epsilon$. This constraint limits each pixel’s perturbation to a maximum of $\epsilon$. By tuning $\epsilon$, an attacker can balance the destructiveness and the stealthiness of the attack, allowing for strategic adjustments for the desired outcome. If $\epsilon$ is set to $\infty$, the constraint is effectively removed, returning the optimization to its original, unconstrained form.

Figure: Algorithm 1 Poison-splat

Ensuring multi-view image consistency via proxy model.
An interesting insight from our study is that simply optimizing perturbations for each view image independently by maximizing total variation score does not effectively bolster attacks. As demonstrated in Figure 3(b), this image-level TV-maximization attack is significantly less effective compared to our Poison-splat strategy. This mainly stems from the image-level optimization creating inconsistencies across the different views of poisoned images, undermining the attack’s overall effectiveness.

Our solution is inspired by the view-consistent properties of the 3DGS model’s rendering function, which effectively maintains consistency across multi-view images generated from 3D Gaussian space. In light of this, we propose to train a proxy 3DGS model to generate poisoned data. In each iteration, the attacker projects the current proxy model onto a camera pose, obtaining a rendered image $V^{\prime}_{k}$. This image then serves as a starting point for optimization, where the attacker searches for a target $\tilde{V}_{k}$ that maximizes the total variation score within the $\epsilon$-bound of the clean image $V_{k}$. Following this, the attacker updates the proxy model with a single optimization step to mimic the victim’s behavior.
In subsequent iterations, the generation of poisoned images initiates with the rendering output from the updated proxy model. In this way, the attacker approximately solves this bi-level optimization by iteratively unrolling the outer and inner optimization, enhancing the attack’s effectiveness while maintaining consistency across views. We summarize the pipeline of Poison-splat in Algorithm 1.

## 4 Experiments

Datasets.
All experiments in this paper are carried out on three common 3D datasets:
(1) NeRF-Synthetic(^2^22Dataset publicly accessible at https://github.com/bmild/nerf.) (Mildenhall et al., ) is a synthetic 3D object dataset, which contains multi-view renderings of synthetic 3D objects.
(2) Mip-NeRF360(^3^33Dataset publicly accessible at https://jonbarron.info/mipnerf360/) dataset (Barron et al., ) is a 3D scene dataset, which is composed of photographs of large real-world outdoor scenes.
(3) Tanks-and-Temples(^4^44Dataset publicly accessible at https://www.tanksandtemples.org/download/) dataset (Knapitsch et al., ) contains realistic 3D captures including both outdoor scenes and indoor environments.

Implementation details. In our experiments, we use the official implementation of 3D Gaussian Splatting(^5^55https://github.com/graphdeco-inria/gaussian-splatting) (Kerbl et al., ) to implement the victim behavior. Following their original implementation, we use the recommended default hyper-parameters, which were proved effective across a broad spectrum of scenes from various datasets. For testing black-box attack effectiveness, we use the official implementation of Scaffold-GS(^6^66https://github.com/city-super/Scaffold-GS) (Lu et al., ) as a black box victim.
All experiments reported in the paper were carried out on a single NVIDIA A800-SXM4-80G GPU.

Evaluation metrics. We use the number of 3D Gaussians, GPU memory occupancy and the training time cost as metrics to evaluate the computational cost of 3DGS. A more successful attack is characterized by larger increases in the number of Gaussians, higher GPU memory consumption, and extended training time, compared with training on clean data. We also report the rendering speed of the resulted 3DGS models to show the increase in model complexity and degradation of inference latency
as a byproduct of our attack.

Figure: (a) Overall comparisons of computation cost in training time and GPU memory occupancy on MIP-NeRF360 (room).
Refer to caption: x3.png

### 4.1 Main Results

We report the comparisons of the number of Gaussians, peak GPU memory, training time and rendering speed between clean and poisoned data across three different datasets in Tables 1 to show the effectiveness of our attack. The full results containing all scenes are listed in the Appendix Table 3 and Table 4. We provide visualizations of example poisoned datasets and corresponding victim reconstructions in Appendix Section E.

We want to highlight some observations from the results. First, our Poison-splat attack demonstrates the ability to craft a huge extra computational burden across multiple datasets. Even with perturbations constrained within a small range in an $\epsilon$-constrained attack, the peak GPU memory can be increased to over 2 times, making the overall maximum GPU occupancy higher than 24 GB - in the real world, this may mean that our attack may require more allocable resources than common GPU stations can provide, *e.g*., RTX 3090, RTX 4090 and A5000. Furthermore, as we visualized the computational cost in Figure 3(a), the attack not only significantly increases the memory usage, but also greatly slows down training speed. This property would further strengthen the attack, since the overwhelming GPU occupancy will last longer than normal training may take, making the overall loss of computation power higher. As shown in the bottom of Table 1, if we do not put constraints on the attacker and let it modify the image pixels unlimitedly, then the attack results would be even more damaging. For instance, in the NeRF-Synthetic (ship) scene, the peak GPU usage could increase up to 21 times and almost reach 80 GB GPU memory. This level approaches the upper limits of the most advanced GPUs currently available, such as H100 and A100, and is undeniably destructive.

**Table 1: Attack results of Poison-splat across multiple datasets. Constrained attacks ($\epsilon=16/255$) can covertly increase training costs through minor perturbations to images. In contrast, unconstrained attacks allow for unlimited modifications to the original input, leading to significantly higher resource consumption and more extensive damage. We highlight attacks which successfully consume over 24 GB GPU memory, which can cause a denial-of-service(*i.e*., out-of-memory error and service halting) if 3DGS service is provided on a common 24GB-memory GPU (*e.g*., RTX 3090, RTX 4090 or A5000). Full results on all scenes provided in Table 3 and Table 4.**
| Constrained Poison-splat attack with $\epsilon=16/255$ |  |  |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Metric | Number of Gaussians | Peak GPU memory [MB] | Training time [minutes] | Render speed [FPS] |  |  |  |  |
| Scene<br>Setting | clean | poisoned | clean | poisoned | clean | poisoned | clean | poisoned |
| NS-hotdog | 0.185 M | 1.147 M (6.20x$\uparrow$) | 3336 | 29747^∗ (8.92x$\uparrow$) | 8.57 | 17.43 (2.03x$\uparrow$) | 443 | 69 (6.42x$\downarrow$) |
| NS-lego | 0.341 M | 0.805 M (2.36x$\uparrow$) | 3532 | 9960 (2.82x$\uparrow$) | 8.62 | 13.02 (1.51x$\uparrow$) | 349 | 145 (2.41x$\downarrow$) |
| NS-materials | 0.169 M | 0.410 M (2.43x$\uparrow$) | 3172 | 4886 (1.54x$\uparrow$) | 7.33 | 9.92 (1.35x$\uparrow$) | 447 | 250 (1.79x$\downarrow$) |
| NS-ship | 0.272 M | 1.071 M (3.94x$\uparrow$) | 3692 | 16666 (4.51x$\uparrow$) | 8.87 | 16.12 (1.82x$\uparrow$) | 326 | 87 (3.75x$\downarrow$) |
| TT-Courthouse | 0.604 M | 0.733 M (1.21x$\uparrow$) | 11402 | 12688 (1.11x$\uparrow$) | 13.81 | 14.49 (1.05x$\uparrow$) | 284 | 220 (1.29x$\downarrow$) |
| TT-Courtroom | 2.890 M | 5.450 M (1.89x$\uparrow$) | 9896 | 16308 (1.65x$\uparrow$) | 16.88 | 23.92 (1.42x$\uparrow$) | 139 | 83 (1.67x$\downarrow$) |
| TT-Museum | 4.439 M | 7.130 M (1.61x$\uparrow$) | 12704 | 18790 (1.48x$\uparrow$) | 19.79 | 26.38 (1.33x$\uparrow$) | 121 | 78 (1.55x$\downarrow$) |
| TT-Playground | 2.309 M | 4.307 M (1.87x$\uparrow$) | 8717 | 13032 (1.50x$\uparrow$) | 15.17 | 21.82 (1.44x$\uparrow$) | 151 | 87 (1.74x$\downarrow$) |
| MIP-bicycle | 5.793 M | 10.129 M (1.75x$\uparrow$) | 17748 | 27074^∗ (1.53x$\uparrow$) | 33.42 | 44.44 (1.33x$\uparrow$) | 69 | 43 (1.60x$\downarrow$) |
| MIP-counter | 1.195 M | 4.628 M (3.87x$\uparrow$) | 10750 | 29796^∗ (2.77x$\uparrow$) | 26.46 | 37.63 (1.42x$\uparrow$) | 164 | 51 (3.22x$\downarrow$) |
| MIP-room | 1.513 M | 7.129 M (4.71x$\uparrow$) | 12316 | 46238^∗ (3.75x$\uparrow$) | 25.36 | 47.98 (1.89x$\uparrow$) | 154 | 35 (4.40x$\downarrow$) |
| MIP-stump | 4.671 M | 10.003 M (2.14x$\uparrow$) | 14135 | 25714^∗ (1.82x$\uparrow$) | 27.06 | 38.48 (1.42x$\uparrow$) | 111 | 57 (1.95x$\downarrow$) |
| Unconstrained Poison-splat attack with $\epsilon=\infty$ |  |  |  |  |  |  |  |  |
| Metric | Number of Gaussians | Peak GPU memory [MB] | Training time [minutes] | Render speed [FPS] |  |  |  |  |
| Scene<br>Setting | clean | poisoned | clean | poisoned | clean | poisoned | clean | poisoned |
| NS-hotdog | 0.185 M | 4.272 M (23.09x$\uparrow$) | 3336 | 47859^∗ (14.35x$\uparrow$) | 8.57 | 38.85 (4.53x$\uparrow$) | 443 | 29 (15.28x$\downarrow$) |
| NS-lego | 0.341 M | 4.159 M (12.20x$\uparrow$) | 3532 | 78852^∗ (22.33x$\uparrow$) | 8.62 | 42.46 (4.93x$\uparrow$) | 349 | 25 (13.96x$\downarrow$) |
| NS-mic | 0.205 M | 3.940 M (19.22x$\uparrow$) | 3499 | 61835^∗ (17.67x$\uparrow$) | 8.08 | 39.02 (4.83x$\uparrow$) | 300 | 29 (10.34x$\downarrow$) |
| NS-ship | 0.272 M | 4.317 M (15.87x$\uparrow$) | 3692 | 80956^∗ (21.93x$\uparrow$) | 8.87 | 44.11 (4.97x$\uparrow$) | 326 | 24 (13.58x$\downarrow$) |
| TT-Courthouse | 0.604 M | 3.388 M (5.61x$\uparrow$) | 11402 | 29856^∗ (2.62x$\uparrow$) | 13.81 | 25.33 (1.83x$\uparrow$) | 284 | 54 (5.26x$\downarrow$) |
| TT-Courtroom | 2.890 M | 13.196 M (4.57x$\uparrow$) | 9896 | 33871^∗ (3.42x$\uparrow$) | 16.88 | 41.69 (2.47x$\uparrow$) | 139 | 41 (3.39x$\downarrow$) |
| TT-Museum | 4.439 M | 16.501 M (3.72x$\uparrow$) | 12704 | 43317^∗ (3.41x$\uparrow$) | 19.79 | 48.89 (2.47x$\uparrow$) | 121 | 36 (3.36x$\downarrow$) |
| TT-Playground | 2.309 M | 10.306 M (4.46x$\uparrow$) | 8717 | 27304^∗ (3.13x$\uparrow$) | 15.17 | 38.77 (2.56x$\uparrow$) | 151 | 39 (3.87x$\downarrow$) |
| MIP-bicycle | 5.793 M | 25.268 M (4.36x$\uparrow$) | 17748 | 63236^∗ (3.56x$\uparrow$) | 33.42 | 81.48 (2.44x$\uparrow$) | 69 | 16 (4.31x$\downarrow$) |
| MIP-counter | 1.195 M | 11.167 M (9.34x$\uparrow$) | 10750 | 80732^∗ (7.51x$\uparrow$) | 26.46 | 62.04 (2.34x$\uparrow$) | 164 | 19 (8.63x$\downarrow$) |
| MIP-room | 1.513 M | 16.019 M (10.59x$\uparrow$) | 12316 | 57540^∗ (4.67x$\uparrow$) | 25.36 | 76.25 (3.01x$\uparrow$) | 154 | 17 (9.06x$\downarrow$) |
| MIP-stump | 4.671 M | 13.550 M (2.90x$\uparrow$) | 14135 | 36181^∗ (2.56x$\uparrow$) | 27.06 | 51.51 (1.90x$\uparrow$) | 111 | 27 (4.11x$\downarrow$) |

Figure: (a) Evolution of the proxy model in an $\epsilon$-constrained attack
Refer to caption: x5.png

To help the readers build more understanding into the attack procedure, we visualize the internal states during the attack optimization procedure, rendering the proxy model in Figure 4. It is evident that the proxy model can be guided from non-smoothness of 2D images to develop highly complex 3D shapes. Consequently, the poisoned data produced from the projection of this over-densified proxy model can produce more poisoned data, inducing more Gaussians to fit these poisoned data.

### 4.2 Black-box Attack Performance

The attack results described previously assume a white-box scenario, where the attacker is fully aware of the victim system’s details. In real-world, companies may utilize proprietary algorithms of their own, where the attacker may have no knowledge about their hyper-parameter settings or even their underlying 3DGS representations. This raises an important question: Can Poison-splat remain effective against black-box victim systems?

The answer is affirmative. To test the effectiveness of our attack on a black-box victim, we chose Scaffold-GS (Lu et al., ), a 3DGS variant algorithm designed with a focus on efficiency. Scaffold-GS differs significantly from traditional Gaussian Splatting as it utilizes anchor points to distribute local 3D Gaussians, which greatly alters the underlying feature representation. We directly tested Scaffold-GS on the poisoned dataset we crafted for the traditional 3DGS algorithm, making the victim (Scaffold-GS trainer) a black-box model. The results, as presented in Table 2 and Table 5, demonstrate the attack’s capability to generalize effectively, as evidenced by increased Gaussian parameters, higher GPU memory consumption, and reduced training speed.

The key reason for the success of generalization ability to black-box victims is our core intuition: promoting the non-smoothness of input images while maintaining their 3D consistency. This approach ensures that our poisoned dataset effectively increases the number of 3D-representation units for all adaptive complexity 3D reconstruction algorithms, regardless of the specific algorithm used.

**Table 2: Black-box attack results on NeRF-Synthetic and MIP-NeRF360 dataset. The victim system, Scaffold-GS, utilizes distinctly different Gaussian Splatting feature representations compared to traditional Gaussian Splatting and remains unknown to the attacker. These results demonstrate the robust generalization ability of our attack against unknown black-box victim systems. Full results provided in Table 5.**
| Metric | Number of Gaussians | Peak GPU memory [MB] | Training time [minutes] |  |  |  |
| --- | --- | --- | --- | --- | --- | --- |
| Scene<br>Setting | clean | poisoned | clean | poisoned | clean | poisoned |
| Constrained Black-box Poison-splat attack with $\epsilon=16/255$ against Scaffold-GS |  |  |  |  |  |  |
| NS-lego | 0.414 M | 2.074 M (5.01x$\uparrow$) | 3003 | 4808 (1.60x$\uparrow$) | 9.77 | 17.91 (1.83x$\uparrow$) |
| NS-ship | 1.000 M | 3.291 M (3.29x$\uparrow$) | 3492 | 5024 (1.44x$\uparrow$) | 11.68 | 21.92 (1.88x$\uparrow$) |
| MIP-bonsai | 4.368 M | 10.608 M (2.43x$\uparrow$) | 10080 | 12218 (1.21x$\uparrow$) | 35.33 | 37.71 (1.07x$\uparrow$) |
| MIP-stump | 6.798 M | 14.544 M (2.14x$\uparrow$) | 7322 | 9432 (1.29x$\uparrow$) | 33.53 | 36.32 (1.08x$\uparrow$) |
| Unconstrained Black-box Poison-splat attack with $\epsilon=\infty$ against Scaffold-GS |  |  |  |  |  |  |
| NS-lego | 0.414 M | 3.973 M (9.60x$\uparrow$) | 3003 | 6242 (2.08x$\uparrow$) | 9.77 | 26.11 (2.67x$\uparrow$) |
| NS-ship | 1.000 M | 4.717 M (4.72x$\uparrow$) | 3492 | 6802 (1.95x$\uparrow$) | 11.68 | 28.22 (2.42x$\uparrow$) |
| MIP-bonsai | 4.368 M | 28.042 M (6.42x$\uparrow$) | 10080 | 22115 (2.19x$\uparrow$) | 35.33 | 78.36 (2.22x$\uparrow$) |
| MIP-stump | 6.798 M | 34.027 M (5.01x$\uparrow$) | 7322 | 20797 (2.84x$\uparrow$) | 33.53 | 79.64 (2.38x$\uparrow$) |

### 4.3 Ablation Study on proxy model

We next ablate the effectiveness of our proxy model. As shown in Figure 3(b), we compare the number of Gaussians produced in victim learning procedures with two baselines: the green curve represents trajectory training on clean data, and the yellow curve represents a naive Total Variation maximizing attack, which does not involve a proxy model, but only maximize Total Variation score on each view individually. As we show in Figure 3(b), this naive attack is not as effective as our attack design. We attribute this reason to be lack of consistency of multi-view information. Since the Total Variation loss is a local image operator, individually maximizing the TV loss on each image will result in a noised dataset without aligning with each other.
As a result, victim learning from this noised set of images struggles to align shapes in 3D space, and the training on fine details becomes harder to converge. Thus, when faced with conflicting textures from different views, the Gaussian Splatting technique fails to effectively perform reconstruction on details, leading to fewer Gaussians produced compared with our attack. We use this study to highlight the necessity of decoy model in our attack methodology design.

### 4.4 Discussions on Naive Defense Strategies

Our attack method maximizes the computational costs of 3DGS by optimizing the number of Gaussians. One may argue that a straightforward defense method is to simply impose an upper limit on the number of Gaussians during victim training to thwart the attack. However, such a straightforward strategy is not as effective as expected. While limiting the number of Gaussians might mitigate the direct impact on computational costs, it significantly degrades the quality of 3D reconstruction, as demonstrated in Figure 5. The figure shows that 3DGS models trained under these defensive constraints perform much worse compared to those with unconstrained training, particularly in terms of detail reconstruction. This decline in quality occurs because 3DGS cannot automatically distinguish necessary fine details from poisoned textures. Naively capping the number of Gaussians will directly lead to the failure of the model to reconstruct the 3D scene accurately, which violates the primary goal of the service provider. This study demonstrates more sophisticated defensive strategies are necessary to both protect the system and maintain the quality of 3D reconstructions under our attack.

Figure: Figure 5: Poison-splat attack cannot be painlessly defended by simply constraining the number of Gaussians during 3DGS optimization. As demonstrated, while this defense can cap the maximum resource consumption, it markedly degrades the quality of 3D reconstruction, in terms of photo-realism and fine-grained details of the rendered images, which violates the primary goal of the service provider.
Refer to caption: x7.png

## 5 Conclusion and Discussions

This paper uncovers a significant yet previously overlooked security vulnerability in 3D Gaussian Splatting (3DGS). To this end, we have proposed a novel Poison-splat attack method, which dramatically escalates the computational demands of 3DGS and can even trigger a Denial-of-Service (*e.g*., server disruption), causing substantial financial losses for 3DGS service providers. By leveraging a sophisticated bi-level optimization framework and strategies such as attack objective approximation, proxy model rendering, and optional constrained optimization, we demonstrate the feasibility of such attacks and emphasize the challenges in countering them with naive defenses. To the best of our knowledge, this is the first research work to explore an attack on 3DGS, and the first attack targeting the computation complexity of training phase in machine learning systems. We encourage researchers and practitioners in the field of 3DGS to acknowledge this security vulnerability and work together towards more robust algorithms and defense strategies against such threats. Lastly, we would like to discuss potential limitations, future directions, and social impacts of our work.

Limitations and Future directions.
There are still limitations of our work, and we expect future studies can work on them:

- 1.
Better approximation of outer maximum optimization. In this work, we approximate the outer maximum objective (*i.e*., the computational cost) with the number of Gaussians. Although the number of Gaussians strongly correlates with GPU memory occupancy and rendering latency, there could be better optimizable metrics for this purpose. For example, the "density" of Gaussians, *i.e*., the number of Gaussians falling into the same tile to involve in alpha-blending, might be a better metric to achieve better optimization outcomes.
- 2.
Better defense methods. We focus on developing attack methods, without delving deeply into defensive strategies. We hope future studies can propose more robust 3DGS algorithms or develop more effective defensive techniques to counteract such attacks. This focus could significantly enhance the security and reliability of 3DGS systems in practical applications.

Societal Impacts. While our methods could potentially be misused by malicious actors to disrupt 3DGS service providers and cause financial harm, our aim is not to facilitate such actions. Instead, our objective is to highlight significant security vulnerabilities within 3DGS systems and prompt the community—researchers, practitioners, and providers—to recognize and address these gaps. We aim to inspire the development of more robust algorithms and defensive strategies, enhancing the security and reliability of 3DGS systems in practical applications. We are committed to ethical research and do not endorse using our findings to inflict societal harm.

## 6 Acknowledgement

We sincerely thank Xuanyu Yi (NTU), Xinjie Zhang (HKUST), Jiaqi Ma (WHU) and Shizun Wang (NUS) for their helpful discussions.

## Appendix

## Appendix A Related Works

### A.1 3D Gaussian Splatting

3D Gaussian Splatting is receiving overwhelming popularity in the 3D vision domain (Chen & Wang, ; Fei et al., ; Wu et al., ; Dalal et al., ). The explicit nature of 3D Gaussian Splatting enables real-time rendering capabilities and unparalleled levels of control and editability, demonstrating its effectiveness in 3D generation. Since its introduction in (Kerbl et al., ), 3D Gaussian Splatting has facilitated a diverse array of downstream applications, including text-to-3D generation (Chen et al., ; Tang et al., ; Yi et al., ), Simultaneous Localization and Mapping (Keetha et al., ; Matsuki et al., ; Yan et al., ), human avatars (Kocabas et al., ; Lei et al., ; Zielonka et al., ), 4D-dynamic scene modeling (Luiten et al., ; Wu et al., ; Yang et al., ), and other applications (Xie et al., ; Shen et al., ; Ye et al., ; Wang et al., ; ).

While the majority of the audience in the 3D vision community places their focus on utility, we found only a handful of research works put efforts into investigating the security issues of 3D algorithms. Xie et al. () analyzed the resilience of 3D object detection systems under white-box and black-box attacks. (Fu et al., ; Horváth & Józsa, ) proposed attacks against Neural Radiance Fields (NeRFs). To our knowledge, this is the first attack ever proposed for 3D Gaussian Splatting systems.

### A.2 Attacks on Machine Learning Systems

Machine learning has been shown to be vulnerable to various types of attacks (Pitropakis et al., ; Rigaki & Garcia, ; Chakraborty et al., ; Oliynyk et al., ; Tian et al., ).
The majority of attacks target the either confidentiality (including membership inference (Shokri et al., ; Salem et al., ; Choquette-Choo et al., ), data reconstruction attacks (Fredrikson et al., ; Carlini et al., ; ; Yu et al., ; Geiping et al., ; Lu et al., ) and model stealing attacks (Tramèr et al., ; Chandrasekaran et al., )) or integrity (like adversarial attacks (Biggio et al., ; Szegedy et al., ; Dong et al., ; ) and data poisoning attacks (Barreno et al., ; Jagielski et al., ; Biggio et al., ; Mei & Zhu, )). Different from the above mentioned attacks, we aim to illustrate that by carefully crafting input images, the attacker can indeed attack availability, *i.e*., timely and cost-affordable access to machine learning service. The most similar research is the work by Shumailov et al. (), which is the first Denial-of-Service (DoS) attack towards machine learning systems. It proposed sponge examples which can cause much more latency and energy consumption for language models and image classifiers, driving deep learning models to their worst performance. Different from the work (Shumailov et al., ), our attack targets 3D reconstruction algorithms and is not driven by neural networks.

#### A.2.1 Data Poisoning Attack

We consider our proposed attacks to fall into the category of data poisoning attack, which manipulates training data to launch the attack at the training stage. The attacker makes the first move to craft poisoned training samples, and the victim has a goal of training the system based on samples provided by the attacker. Solving this problem typically involves solving a max-min bi-level optimization problem, where the attacker wants to maximize some adversarial loss (*i.e*., test error or computational cost) and victim wants to minimize the training objective (*i.e*., training loss). Different literature solves the problem using different techniques (Biggio et al., ; Mei & Zhu, ; ; Li et al., ).
For many machine learning systems, given the inherent complexity and their reliance on large datasets, it is intractable to exactly do the bi-level optimization. Muñoz-González et al. () exploited back-gradient optimization technique to approximate real gradients through reverse-mode differentiation.  Huang et al. () formulated as a meta-learning problem, and approximated the inner optimal solution by training only $K$ SGD steps for each outer objective evaluation.  proposed three methods to approximate the expensive bi-level optimization: influence functions (Koh & Liang, ), minimax duality and Karush-Kuhn-Tucker (KKT) conditions. Fowl et al. () used gradient matching which assumes inner optimality has been achieved by a fixed model. Fowl et al. () avoided the bi-level optimization with a well-trained proxy model from clean data. Different from these previous studies, we propose a gradient-free optimization process to solve the outer optimization pipeline, and show a good optimization result on the attacker’s goal.

#### A.2.2 Energy-Latency Attacks in Machine Learning

A limited number of studies have investigated attacks to manipulate the computation cost needed for machine learning systems, mainly in inference-stage. Shumailov et al. () initially brought people’s attention to sponge samples, which are malicious samples able to maximize the energy consumption and responsive latency of a neural network. Following this work, there are other works studying samples which can cause the worst case computation resource consumption in a (dynamic) machine learning systems, for example Hong et al. () and Chen et al. () found samples that can necessitate late exit in a dynamic-depth neural network. More up-to-date works utilize the flexible nature of language to attack NLP models, inducing extended natural language sequence responses to over-consume energy and latency (Chen et al., ; ; Gao et al., ). However, to the best of our knowledge, there has been no previous work targeting Denial-of-Service attacks at the training stage of machine learning systems. Our work is pioneering in proposing a DoS attack specifically designed for the training phase of machine learning systems. Additionally, this is also the first effort to develop an attack against 3D Gaussian Splatting.

## Appendix B More Backgrounds of 3D Gaussian Splatting

3D Gaussian Splatting (3DGS) (Kerbl et al., ) has revolutionized the 3D vision community with its superior performance and efficiency. It models a 3D scene by learning a set of 3D Gaussians $\mathcal{G}=\{G_{i}\}$ from multi-view images $\mathcal{D}=\{V_{k},P_{k}\}_{k=1}^{N}$, where each view consists of a ground-truth image ${V_{k}}$ and the corresponding camera poses ${P_{k}}$.
We denote $N$ as the total number of image-pose pairs in the training data, which can be arbitrary and unfixed in 3DGS. As for the model, each 3D Gaussian $G_{i}=\{\mu_{i},s_{i},\alpha_{i},q_{i},c_{i}\}$ has 5 optimizable parameters: center coordinates $\mu_{i}\in\mathbb{R}^{3}$, scales $s_{i}\in\mathbb{R}^{3}$, opacity $\alpha_{i}\in\mathbb{R}$, rotation quaternion $q_{i}\in\mathbb{R}^{4}$, and associated view-dependent color represented as spherical harmonics $c_{i}\in\mathbb{R}^{3(d+1)^{2}}$, where $d$ is the degree of spherical harmonics.

To render $\mathcal{G}$ from 3D Gaussian space to 2D images, each Gaussian is first projected into the camera coordinate frame given a camera pose $P_{k}$ to determine the depth of each Gaussian, which is the distance of that Gaussian to the camera view. The calculated depth is used for sorting Gaussians from near to far, and then the colors in 2D image are rendered in parallel by alpha blending according to the depth order of adjacent 3D Gaussians. The core reason for 3DGS to achieve real-time optimization and rendering lies in this tile-based differentiable rasterization pipeline. We denote the 3DGS renderer as a function $\mathcal{R}$, which takes as input the Gaussians $\mathcal{G}$ and a camera pose $P_{k}$ to render an image $V^{\prime}_{k}=\mathcal{R}(\mathcal{G},P_{k})$.

The training is done by optimizing the reconstruction loss between the rendered image and ground truth image for each camera view, where the reconstruction loss is a combination of $\mathcal{L}_{1}$ loss and structural similarity index measure (SSIM) loss $\mathcal{L}_{\text{D-SSIM}}$:

$$ $\displaystyle\mathop{\min}\limits_{\mathcal{G}}\mathcal{L}(\mathcal{D})= \mathop{\min}\limits_{\mathcal{G}}\sum\limits_{k=1}^{N}\mathcal{L}(V^{\prime}_ {k},{V}_{k})=\mathop{\min}\limits_{\mathcal{G}}~{}\sum\limits_{k=1}^{N}(1- \lambda)\mathcal{L}_{1}(V^{\prime}_{k},{V}_{k})+\lambda\mathcal{L}_{\text{D- SSIM}}(V^{\prime}_{k},{V}_{k}),$ (6) $$

where $\lambda$ is a trade-off parameter. To ensure finer reconstruction, Gaussian Splatting deploys adaptive density control to automatically add or remove Gaussians from optimization. The process of adding Gaussians, known as densification, involves two primary operations: splitting and cloning. Conversely, removing Gaussians, called pruning, indicates eliminating a Gaussian from the set of optimization variables. Both densification and pruning are non-differentiable operations. The adaptive density control is performed during regular optimization intervals and follows specific, predefined rules. In the initial design (Kerbl et al., ), for a Gaussian $G_{i}$ with view-space projection point $\mu^{k}_{i}=(\mu^{k}_{i,x},\mu^{k}_{i,y})$ under viewpoint $V_{k}$, the average view-space positional gradient $\nabla_{\mu_{i}}\mathcal{L}$ is calculated every 100 training iterations:

$$ $\displaystyle\nabla_{\mu_{i}}\mathcal{L}=\frac{\sum_{k=1}^{M}\|\frac{\partial \mathcal{L}(V^{\prime}_{k},{V}_{k})}{\partial\mu_{i}^{k}}\|}{M},$ (7) $$

where $M$ is the total number of views that the Gaussian $G_{i}$ participates in calculation during the 100 iterations (Ye et al., ) and $M$ is usually less than $N$. Densification is performed when the view-space positional gradient $\nabla_{\mu_{i}}\mathcal{L}$ is larger than a pre-set gradient threshold $\tau_{g}$ (by default 0.0002). Moreover, the decision to split or clone a Gaussian $G_{i}$ is based on its scale vector $s_{i}$, which is compared with a scale threshold $\tau_{s}$: it is split if larger, and cloned if smaller. Pruning occurs when the opacity $\alpha_{i}$ falls below the opacity threshold $\tau_{\alpha}$. We also notice some recent 3DGS studies (Cheng et al., ; Fang & Wang, ; Li et al., ; Bulò et al., ) that adopt different yet still pre-defined densification rules.

## Appendix C Extended Experiments

### C.1 Full attack results

We report the constrained attack results with $\epsilon=16/255$ on all scenes of NeRF-Synthetic, Mip-NeRF360 and Tanks-and-Temples dataset in Table 3, and the unconstrained attack results in Table 4.

**Table 3: Full constrained attack results ($\epsilon=16/255$) on all scenes from the NeRF-Synthetic, MIP-NeRF360 and Tanks-and-Temples datasets. All results are reported by averaging over three individual runs.**
| Constrained Poison-splat attack with $\epsilon=16/255$ |  |  |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Metric | Number of Gaussians | Peak GPU memory [MB] | Training time [minutes] | Render speed [FPS] |  |  |  |  |
| Scene<br>Setting | clean | poisoned | clean | poisoned | clean | poisoned | clean | poisoned |
| NS-chair | 0.494 M | 0.957 M (1.94x$\uparrow$) | 3752 | 8003 (2.13x$\uparrow$) | 9.45 | 13.41 (1.42x$\uparrow$) | 260 | 117 (2.22x$\downarrow$) |
| NS-drums | 0.385 M | 0.695 M (1.81x$\uparrow$) | 3456 | 7190 (2.08x$\uparrow$) | 8.75 | 11.94 (1.36x$\uparrow$) | 347 | 144 (2.41x$\downarrow$) |
| NS-ficus | 0.265 M | 0.273 M (1.03x$\uparrow$) | 3194 | 3783 (1.18x$\uparrow$) | 6.99 | 8.94 (1.28x$\uparrow$) | 346 | 337 (1.03x$\downarrow$) |
| NS-hotdog | 0.185 M | 1.147 M (6.20x$\uparrow$) | 3336 | 29747^∗ (8.92x$\uparrow$) | 8.57 | 17.43 (2.03x$\uparrow$) | 443 | 69 (6.42x$\downarrow$) |
| NS-lego | 0.341 M | 0.805 M (2.36x$\uparrow$) | 3532 | 9960 (2.82x$\uparrow$) | 8.62 | 13.02 (1.51x$\uparrow$) | 349 | 145 (2.41x$\downarrow$) |
| NS-materials | 0.169 M | 0.410 M (2.43x$\uparrow$) | 3172 | 4886 (1.54x$\uparrow$) | 7.33 | 9.92 (1.35x$\uparrow$) | 447 | 250 (1.79x$\downarrow$) |
| NS-mic | 0.205 M | 0.359 M (1.75x$\uparrow$) | 3499 | 6437 (1.84x$\uparrow$) | 8.08 | 10.96 (1.36x$\uparrow$) | 300 | 172 (1.74x$\downarrow$) |
| NS-ship | 0.272 M | 1.071 M (3.94x$\uparrow$) | 3692 | 16666 (4.51x$\uparrow$) | 8.87 | 16.12 (1.82x$\uparrow$) | 326 | 87 (3.75x$\downarrow$) |
| MIP-bicycle | 5.793 M | 10.129 M (1.75x$\uparrow$) | 17748 | 27074^∗ (1.53x$\uparrow$) | 33.42 | 44.44 (1.33x$\uparrow$) | 69 | 43 (1.60x$\downarrow$) |
| MIP-bonsai | 1.294 M | 6.150 M (4.75x$\uparrow$) | 10216 | 20564 (2.01x$\uparrow$) | 21.68 | 32.51 (1.50x$\uparrow$) | 214 | 66 (3.24x$\downarrow$) |
| MIP-counter | 1.195 M | 4.628 M (3.87x$\uparrow$) | 10750 | 29796^∗ (2.77x$\uparrow$) | 26.46 | 37.63 (1.42x$\uparrow$) | 164 | 51 (3.22x$\downarrow$) |
| MIP-flowers | 3.508 M | 5.177 M (1.48x$\uparrow$) | 12520 | 16338 (1.30x$\uparrow$) | 25.47 | 30.05 (1.18x$\uparrow$) | 124 | 89 (1.39x$\downarrow$) |
| MIP-garden | 5.684 M | 7.697 M (1.35x$\uparrow$) | 17561 | 23115 (1.32x$\uparrow$) | 33.19 | 40.82 (1.23x$\uparrow$) | 81 | 54 (1.50x$\downarrow$) |
| MIP-kitchen | 1.799 M | 6.346 M (3.53x$\uparrow$) | 12442 | 20902 (1.68x$\uparrow$) | 26.61 | 43.24 (1.62x$\uparrow$) | 133 | 46 (2.89x$\downarrow$) |
| MIP-room | 1.513 M | 7.129 M (4.71x$\uparrow$) | 12316 | 46238^∗ (3.75x$\uparrow$) | 25.36 | 47.98 (1.89x$\uparrow$) | 154 | 35 (4.40x$\downarrow$) |
| MIP-stump | 4.671 M | 10.003 M (2.14x$\uparrow$) | 14135 | 25714^∗ (1.82x$\uparrow$) | 27.06 | 38.48 (1.42x$\uparrow$) | 111 | 57 (1.95x$\downarrow$) |
| MIP-treehill | 3.398 M | 5.684 M (1.67x$\uparrow$) | 11444 | 17287 (1.51x$\uparrow$) | 22.76 | 29.26 (1.29x$\uparrow$) | 123 | 70 (1.76x$\downarrow$) |
| TT-Auditorium | 0.699 M | 2.719 M (3.89x$\uparrow$) | 5982 | 14532 (2.43x$\uparrow$) | 12.69 | 19.05 (1.50x$\uparrow$) | 266 | 100 (2.66x$\downarrow$) |
| TT-Ballroom | 3.103 M | 3.957 M (1.28x$\uparrow$) | 10416 | 12226 (1.17x$\uparrow$) | 20.37 | 22.43 (1.10x$\uparrow$) | 96 | 85 (1.13x$\downarrow$) |
| TT-Barn | 1.005 M | 1.865 M (1.86x$\uparrow$) | 7813 | 10470 (1.34x$\uparrow$) | 13.10 | 16.27 (1.24x$\uparrow$) | 229 | 127 (1.80x$\downarrow$) |
| TT-Caterpillar | 1.290 M | 1.857 M (1.44x$\uparrow$) | 6624 | 8014 (1.21x$\uparrow$) | 11.96 | 14.77 (1.23x$\uparrow$) | 228 | 164 (1.39x$\downarrow$) |
| TT-Church | 2.351 M | 3.396 M (1.44x$\uparrow$) | 10076 | 11797 (1.17x$\uparrow$) | 17.43 | 20.54 (1.18x$\uparrow$) | 132 | 97 (1.36x$\downarrow$) |
| TT-Courthouse | 0.604 M | 0.733 M (1.21x$\uparrow$) | 11402 | 12688 (1.11x$\uparrow$) | 13.81 | 14.49 (1.05x$\uparrow$) | 284 | 220 (1.29x$\downarrow$) |
| TT-Courtroom | 2.890 M | 5.450 M (1.89x$\uparrow$) | 9896 | 16308 (1.65x$\uparrow$) | 16.88 | 23.92 (1.42x$\uparrow$) | 139 | 83 (1.67x$\downarrow$) |
| TT-Family | 2.145 M | 3.734 M (1.74x$\uparrow$) | 7261 | 10707 (1.47x$\uparrow$) | 13.58 | 18.46 (1.36x$\uparrow$) | 182 | 111 (1.64x$\downarrow$) |
| TT-Francis | 0.759 M | 1.612 M (2.12x$\uparrow$) | 5208 | 6938 (1.33x$\uparrow$) | 10.19 | 13.92 (1.37x$\uparrow$) | 279 | 168 (1.66x$\downarrow$) |
| TT-Horse | 1.308 M | 2.510 M (1.92x$\uparrow$) | 5125 | 7762 (1.51x$\uparrow$) | 12.05 | 16.47 (1.37x$\uparrow$) | 220 | 121 (1.82x$\downarrow$) |
| TT-Ignatius | 3.144 M | 3.937 M (1.25x$\uparrow$) | 9943 | 11800 (1.19x$\uparrow$) | 16.32 | 18.52 (1.13x$\uparrow$) | 149 | 118 (1.26x$\downarrow$) |
| TT-Lighthouse | 0.888 M | 1.178 M (1.33x$\uparrow$) | 7466 | 8696 (1.16x$\uparrow$) | 14.21 | 15.92 (1.12x$\uparrow$) | 213 | 163 (1.31x$\downarrow$) |
| TT-M60 | 1.667 M | 2.980 M (1.79x$\uparrow$) | 7948 | 10874 (1.37x$\uparrow$) | 14.08 | 18.22 (1.29x$\uparrow$) | 200 | 107 (1.87x$\downarrow$) |
| TT-Meetingroom | 1.267 M | 2.927 M (2.31x$\uparrow$) | 6645 | 10234 (1.54x$\uparrow$) | 13.53 | 18.97 (1.40x$\uparrow$) | 197 | 102 (1.93x$\downarrow$) |
| TT-Museum | 4.439 M | 7.130 M (1.61x$\uparrow$) | 12704 | 18790 (1.48x$\uparrow$) | 19.79 | 26.38 (1.33x$\uparrow$) | 121 | 78 (1.55x$\downarrow$) |
| TT-Panther | 1.812 M | 3.457 M (1.91x$\uparrow$) | 8511 | 12048 (1.42x$\uparrow$) | 13.49 | 19.46 (1.44x$\uparrow$) | 199 | 103 (1.93x$\downarrow$) |
| TT-Playground | 2.309 M | 4.307 M (1.87x$\uparrow$) | 8717 | 13032 (1.50x$\uparrow$) | 15.17 | 21.82 (1.44x$\uparrow$) | 151 | 87 (1.74x$\downarrow$) |
| TT-Temple | 0.893 M | 1.345 M (1.51x$\uparrow$) | 6929 | 7525 (1.09x$\uparrow$) | 13.03 | 15.26 (1.17x$\uparrow$) | 216 | 149 (1.45x$\downarrow$) |
| TT-Train | 1.113 M | 1.332 M (1.20x$\uparrow$) | 6551 | 7128 (1.09x$\uparrow$) | 12.64 | 13.62 (1.08x$\uparrow$) | 193 | 163 (1.18x$\downarrow$) |
| TT-Truck | 2.533 M | 3.630 M (1.43x$\uparrow$) | 8662 | 11014 (1.27x$\uparrow$) | 14.64 | 20.12 (1.37x$\uparrow$) | 156 | 88 (1.77x$\downarrow$) |

**Table 4: Full unconstrained attack results ($\epsilon=\infty$) on all scenes from the NeRF-Synthetic, MIP-NeRF360 and Tanks-and-Temples datasets. All results are reported by averaging over three individual runs.**
| Unconstrained Poison-splat attack with $\epsilon=\infty$ |  |  |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Metric | Number of Gaussians | Peak GPU memory [MB] | Training time [minutes] | Render speed [FPS] |  |  |  |  |
| Scene<br>Setting | clean | poisoned | clean | poisoned | clean | poisoned | clean | poisoned |
| NS-chair | 0.494 M | 4.152 M (8.40x$\uparrow$) | 3752 | 51424^∗ (13.71x$\uparrow$) | 9.45 | 40.71 (4.31x$\uparrow$) | 260 | 27 (9.63x$\downarrow$) |
| NS-drums | 0.385 M | 4.109 M (10.67x$\uparrow$) | 3456 | 62328^∗ (18.03x$\uparrow$) | 8.75 | 43.25 (4.94x$\uparrow$) | 347 | 24 (14.46x$\downarrow$) |
| NS-ficus | 0.265 M | 3.718 M (14.03x$\uparrow$) | 3194 | 50450^∗ (15.80x$\uparrow$) | 6.99 | 36.92 (5.28x$\uparrow$) | 346 | 31 (11.16x$\downarrow$) |
| NS-hotdog | 0.185 M | 4.272 M (23.09x$\uparrow$) | 3336 | 47859^∗ (14.35x$\uparrow$) | 8.57 | 38.85 (4.53x$\uparrow$) | 443 | 29 (15.28x$\downarrow$) |
| NS-lego | 0.341 M | 4.159 M (12.20x$\uparrow$) | 3532 | 78852^∗ (22.33x$\uparrow$) | 8.62 | 42.46 (4.93x$\uparrow$) | 349 | 25 (13.96x$\downarrow$) |
| NS-materials | 0.169 M | 3.380 M (20.00x$\uparrow$) | 3172 | 43998^∗ (13.87x$\uparrow$) | 7.33 | 32.40 (4.42x$\uparrow$) | 447 | 37 (12.08x$\downarrow$) |
| NS-mic | 0.205 M | 3.940 M (19.22x$\uparrow$) | 3499 | 61835^∗ (17.67x$\uparrow$) | 8.08 | 39.02 (4.83x$\uparrow$) | 300 | 29 (10.34x$\downarrow$) |
| NS-ship | 0.272 M | 4.317 M (15.87x$\uparrow$) | 3692 | 80956^∗ (21.93x$\uparrow$) | 8.87 | 44.11 (4.97x$\uparrow$) | 326 | 24 (13.58x$\downarrow$) |
| MIP-bicycle | 5.793 M | 25.268 M (4.36x$\uparrow$) | 17748 | 63236^∗ (3.56x$\uparrow$) | 33.42 | 81.48 (2.44x$\uparrow$) | 69 | 16 (4.31x$\downarrow$) |
| MIP-bonsai | 1.294 M | 20.127 M (15.55x$\uparrow$) | 10216 | 54506^∗ (5.34x$\uparrow$) | 21.68 | 75.18 (3.47x$\uparrow$) | 214 | 18 (11.89x$\downarrow$) |
| MIP-counter | 1.195 M | 11.167 M (9.34x$\uparrow$) | 10750 | 80732^∗ (7.51x$\uparrow$) | 26.46 | 62.04 (2.34x$\uparrow$) | 164 | 19 (8.63x$\downarrow$) |
| MIP-flowers | 3.508 M | 18.075 M (5.15x$\uparrow$) | 12520 | 45515^∗ (3.64x$\uparrow$) | 25.47 | 62.62 (2.46x$\uparrow$) | 124 | 24 (5.17x$\downarrow$) |
| MIP-garden | 5.684 M | 21.527 M (3.79x$\uparrow$) | 17561 | 52140^∗ (2.97x$\uparrow$) | 33.19 | 83.81 (2.53x$\uparrow$) | 81 | 17 (4.76x$\downarrow$) |
| MIP-kitchen | 1.799 M | 12.830 M (7.13x$\uparrow$) | 12442 | 77141^∗ (6.20x$\uparrow$) | 26.61 | 73.04 (2.74x$\uparrow$) | 133 | 16 (8.31x$\downarrow$) |
| MIP-room | 1.513 M | 16.019 M (10.59x$\uparrow$) | 12316 | 57540^∗ (4.67x$\uparrow$) | 25.36 | 76.25 (3.01x$\uparrow$) | 154 | 17 (9.06x$\downarrow$) |
| MIP-stump | 4.671 M | 13.550 M (2.90x$\uparrow$) | 14135 | 36181^∗ (2.56x$\uparrow$) | 27.06 | 51.51 (1.90x$\uparrow$) | 111 | 27 (4.11x$\downarrow$) |
| MIP-treehill | 3.398 M | 13.634 M (4.01x$\uparrow$) | 11444 | 36299^∗ (3.17x$\uparrow$) | 22.76 | 52.83 (2.32x$\uparrow$) | 123 | 24 (5.12x$\downarrow$) |
| TT-Auditorium | 0.699 M | 4.153 M (5.94x$\uparrow$) | 5982 | 12666 (2.12x$\uparrow$) | 12.69 | 22.50 (1.77x$\uparrow$) | 266 | 76 (3.50x$\downarrow$) |
| TT-Ballroom | 3.103 M | 7.534 M (2.43x$\uparrow$) | 10416 | 19832 (1.90x$\uparrow$) | 20.37 | 33.63 (1.65x$\uparrow$) | 96 | 46 (2.09x$\downarrow$) |
| TT-Barn | 1.005 M | 5.456 M (5.43x$\uparrow$) | 7813 | 15682 (2.01x$\uparrow$) | 13.10 | 26.10 (1.99x$\uparrow$) | 229 | 61 (3.75x$\downarrow$) |
| TT-Caterpillar | 1.290 M | 6.980 M (5.41x$\uparrow$) | 6624 | 18909 (2.85x$\uparrow$) | 11.96 | 29.51 (2.47x$\uparrow$) | 228 | 53 (4.30x$\downarrow$) |
| TT-Church | 2.351 M | 7.564 M (3.22x$\uparrow$) | 10076 | 21296 (2.11x$\uparrow$) | 17.43 | 33.39 (1.92x$\uparrow$) | 132 | 43 (3.07x$\downarrow$) |
| TT-Courthouse | 0.604 M | 3.388 M (5.61x$\uparrow$) | 11402 | 29856^∗ (2.62x$\uparrow$) | 13.81 | 25.33 (1.83x$\uparrow$) | 284 | 54 (5.26x$\downarrow$) |
| TT-Courtroom | 2.890 M | 13.196 M (4.57x$\uparrow$) | 9896 | 33871^∗ (3.42x$\uparrow$) | 16.88 | 41.69 (2.47x$\uparrow$) | 139 | 41 (3.39x$\downarrow$) |
| TT-Family | 2.145 M | 11.700 M (5.45x$\uparrow$) | 7261 | 27533^∗ (3.79x$\uparrow$) | 13.58 | 38.79 (2.86x$\uparrow$) | 182 | 43 (4.23x$\downarrow$) |
| TT-Francis | 0.759 M | 7.435 M (9.80x$\uparrow$) | 5208 | 19777 (3.80x$\uparrow$) | 10.19 | 31.01 (3.04x$\uparrow$) | 279 | 51 (5.47x$\downarrow$) |
| TT-Horse | 1.308 M | 9.358 M (7.15x$\uparrow$) | 5125 | 22756 (4.44x$\uparrow$) | 12.05 | 34.90 (2.90x$\uparrow$) | 220 | 46 (4.78x$\downarrow$) |
| TT-Ignatius | 3.144 M | 11.278 M (3.59x$\uparrow$) | 9943 | 28895^∗ (2.91x$\uparrow$) | 16.32 | 39.61 (2.43x$\uparrow$) | 149 | 42 (3.55x$\downarrow$) |
| TT-Lighthouse | 0.888 M | 5.081 M (5.72x$\uparrow$) | 7466 | 23842 (3.19x$\uparrow$) | 14.21 | 30.67 (2.16x$\uparrow$) | 213 | 47 (4.53x$\downarrow$) |
| TT-M60 | 1.667 M | 7.076 M (4.24x$\uparrow$) | 7948 | 21062 (2.65x$\uparrow$) | 14.08 | 31.82 (2.26x$\uparrow$) | 200 | 46 (4.35x$\downarrow$) |
| TT-Meetingroom | 1.267 M | 7.066 M (5.58x$\uparrow$) | 6645 | 19182 (2.89x$\uparrow$) | 13.53 | 31.44 (2.32x$\uparrow$) | 197 | 50 (3.94x$\downarrow$) |
| TT-Museum | 4.439 M | 16.501 M (3.72x$\uparrow$) | 12704 | 43317^∗ (3.41x$\uparrow$) | 19.79 | 48.89 (2.47x$\uparrow$) | 121 | 36 (3.36x$\downarrow$) |
| TT-Palace | 0.711 M | 2.764 M (3.89x$\uparrow$) | 8980 | 14065 (1.57x$\uparrow$) | 14.27 | 20.07 (1.41x$\uparrow$) | 185 | 84 (2.20x$\downarrow$) |
| TT-Panther | 1.812 M | 8.112 M (4.48x$\uparrow$) | 8511 | 22638 (2.66x$\uparrow$) | 13.49 | 33.19 (2.46x$\uparrow$) | 199 | 49 (4.06x$\downarrow$) |
| TT-Playground | 2.309 M | 10.306 M (4.46x$\uparrow$) | 8717 | 27304^∗ (3.13x$\uparrow$) | 15.17 | 38.77 (2.56x$\uparrow$) | 151 | 39 (3.87x$\downarrow$) |
| TT-Temple | 0.893 M | 5.231 M (5.86x$\uparrow$) | 6929 | 15238 (2.20x$\uparrow$) | 13.03 | 27.96 (2.15x$\uparrow$) | 216 | 52 (4.15x$\downarrow$) |
| TT-Train | 1.113 M | 4.916 M (4.42x$\uparrow$) | 6551 | 14840 (2.27x$\uparrow$) | 12.64 | 25.34 (2.00x$\uparrow$) | 193 | 59 (3.27x$\downarrow$) |
| TT-Truck | 2.533 M | 8.004 M (3.16x$\uparrow$) | 8662 | 21166 (2.44x$\uparrow$) | 14.64 | 33.26 (2.27x$\uparrow$) | 156 | 47 (3.32x$\downarrow$) |

### C.2 Full black-box attack results

We report the full results of attacking a black-box victim (Scaffold-GS) (Lu et al., ) on NeRF-Synthetic and MIP-NeRF360 datasets in Table 5.

### C.3 Ablation study on constraint strength and attack performance

Typically, attacker can choose to balance the attack performance and stealthiness by adjusting attack constraints $\epsilon$. To better understand the tradeoff between $\epsilon$ and attack performance, we poisoned each scene with three levels of $\epsilon$ setting, which are $8/255$, $16/255$ and $24/255$. The comparisons of computation cost under different constraint levels of attacks are provided in Table 6 (NeRF-Synthetic) and Table 7. All results have been reported via the average and standard deviation of three individual runs of victim training.

**Table 5: Full black-box attack results on NeRF-Synthetic and MIP-NeRF360 datasets. The victim system, Scaffold-GS, utilizes distinctly different Gaussian Splatting feature representations compared to traditional Gaussian Splatting and remains unknown to the attacker. These results demonstrate the robust generalization ability of our attack against unknown black-box victim systems.**
| Constrained Black-box Poison-splat attack with $\epsilon=16/255$ against Scaffold-GS |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- |
| Metric | Number of Gaussians | Peak GPU memory [MB] | Training time [minutes] |  |  |  |
| Scene<br>Setting | clean | poisoned | clean | poisoned | clean | poisoned |
| NS-chair | 1.000 M | 1.615 M (1.61x$\uparrow$) | 3418 | 4003 (1.17x$\uparrow$) | 9.91 | 17.18 (1.73x$\uparrow$) |
| NS-drums | 1.000 M | 1.771 M (1.77x$\uparrow$) | 4022 | 4382 (1.09x$\uparrow$) | 10.62 | 16.29 (1.53x$\uparrow$) |
| NS-ficus | 1.000 M | 2.301 M (2.30x$\uparrow$) | 3416 | 4234 (1.24x$\uparrow$) | 9.64 | 18.54 (1.92x$\uparrow$) |
| NS-hotdog | 1.000 M | 1.463 M (1.46x$\uparrow$) | 3539 | 4516 (1.28x$\uparrow$) | 10.74 | 18.62 (1.73x$\uparrow$) |
| NS-lego | 0.414 M | 2.074 M (5.01x$\uparrow$) | 3003 | 4808 (1.60x$\uparrow$) | 9.77 | 17.91 (1.83x$\uparrow$) |
| NS-materials | 1.000 M | 2.520 M (2.52x$\uparrow$) | 4110 | 5190 (1.26x$\uparrow$) | 10.87 | 17.75 (1.63x$\uparrow$) |
| NS-mic | 1.000 M | 2.053 M (2.05x$\uparrow$) | 3682 | 5054 (1.37x$\uparrow$) | 10.36 | 18.53 (1.79x$\uparrow$) |
| NS-ship | 1.000 M | 3.291 M (3.29x$\uparrow$) | 3492 | 5024 (1.44x$\uparrow$) | 11.68 | 21.92 (1.88x$\uparrow$) |
| MIP-bicycle | 8.883 M | 16.947 M (1.91x$\uparrow$) | 12817 | 13650 (1.06x$\uparrow$) | 38.93 | 44.98 (1.16x$\uparrow$) |
| MIP-bonsai | 4.368 M | 10.608 M (2.43x$\uparrow$) | 10080 | 12218 (1.21x$\uparrow$) | 35.33 | 37.71 (1.07x$\uparrow$) |
| MIP-counter | 2.910 M | 6.387 M (2.19x$\uparrow$) | 12580 | 17702 (1.41x$\uparrow$) | 38.53 | 44.83 (1.16x$\uparrow$) |
| MIP-flowers | 7.104 M | 11.614 M (1.63x$\uparrow$) | 8241 | 9766 (1.19x$\uparrow$) | 36.56 | 38.31 (1.05x$\uparrow$) |
| MIP-garden | 7.630 M | 11.555 M (1.51x$\uparrow$) | 9194 | 10966 (1.19x$\uparrow$) | 38.57 | 42.79 (1.11x$\uparrow$) |
| MIP-kitchen | 3.390 M | 6.698 M (1.98x$\uparrow$) | 14037 | 16895 (1.20x$\uparrow$) | 43.83 | 48.10 (1.10x$\uparrow$) |
| MIP-room | 2.846 M | 10.527 M (3.70x$\uparrow$) | 13323 | 13981 (1.05x$\uparrow$) | 36.24 | 48.01 (1.32x$\uparrow$) |
| MIP-stump | 6.798 M | 14.544 M (2.14x$\uparrow$) | 7322 | 9432 (1.29x$\uparrow$) | 33.53 | 36.32 (1.08x$\uparrow$) |
| Unconstrained Black-box Poison-splat attack with $\epsilon=\infty$ against Scaffold-GS |  |  |  |  |  |  |
| Metric | Number of Gaussians | Peak GPU memory [MB] | Training time [minutes] |  |  |  |
| Scene<br>Setting | clean | poisoned | clean | poisoned | clean | poisoned |
| NS-chair | 1.000 M | 3.082 M (3.08x$\uparrow$) | 3418 | 5197 (1.52x$\uparrow$) | 9.91 | 25.34 (2.56x$\uparrow$) |
| NS-drums | 1.000 M | 5.026 M (5.03x$\uparrow$) | 4022 | 7364 (1.83x$\uparrow$) | 10.62 | 28.24 (2.66x$\uparrow$) |
| NS-ficus | 1.000 M | 2.106 M (2.11x$\uparrow$) | 3416 | 4446 (1.30x$\uparrow$) | 9.64 | 21.65 (2.25x$\uparrow$) |
| NS-hotdog | 1.000 M | 3.541 M (3.54x$\uparrow$) | 3539 | 5492 (1.55x$\uparrow$) | 10.74 | 24.93 (2.32x$\uparrow$) |
| NS-lego | 0.414 M | 3.973 M (9.60x$\uparrow$) | 3003 | 6242 (2.08x$\uparrow$) | 9.77 | 26.11 (2.67x$\uparrow$) |
| NS-materials | 1.000 M | 3.997 M (4.00x$\uparrow$) | 4110 | 5997 (1.46x$\uparrow$) | 10.87 | 25.48 (2.34x$\uparrow$) |
| NS-mic | 1.000 M | 3.021 M (3.02x$\uparrow$) | 3682 | 5490 (1.49x$\uparrow$) | 10.36 | 23.71 (2.29x$\uparrow$) |
| NS-ship | 1.000 M | 4.717 M (4.72x$\uparrow$) | 3492 | 6802 (1.95x$\uparrow$) | 11.68 | 28.22 (2.42x$\uparrow$) |
| MIP-bicycle | 8.883 M | 33.284 M (3.75x$\uparrow$) | 12817 | 22042 (1.72x$\uparrow$) | 38.93 | 84.71 (2.18x$\uparrow$) |
| MIP-bonsai | 4.368 M | 28.042 M (6.42x$\uparrow$) | 10080 | 22115 (2.19x$\uparrow$) | 35.33 | 78.36 (2.22x$\uparrow$) |
| MIP-counter | 2.910 M | 12.928 M (4.44x$\uparrow$) | 12580 | 16168 (1.29x$\uparrow$) | 38.53 | 55.59 (1.44x$\uparrow$) |
| MIP-flowers | 7.104 M | 27.610 M (3.89x$\uparrow$) | 8241 | 18352 (2.23x$\uparrow$) | 36.56 | 73.43 (2.01x$\uparrow$) |
| MIP-garden | 7.630 M | 23.828 M (3.12x$\uparrow$) | 9194 | 20400 (2.22x$\uparrow$) | 38.57 | 85.45 (2.22x$\uparrow$) |
| MIP-kitchen | 3.390 M | 14.404 M (4.25x$\uparrow$) | 14037 | 17838 (1.27x$\uparrow$) | 43.83 | 63.32 (1.44x$\uparrow$) |
| MIP-room | 2.846 M | 21.060 M (7.40x$\uparrow$) | 13323 | 21672 (1.63x$\uparrow$) | 36.24 | 76.94 (2.12x$\uparrow$) |
| MIP-stump | 6.798 M | 34.027 M (5.01x$\uparrow$) | 7322 | 20797 (2.84x$\uparrow$) | 33.53 | 79.64 (2.38x$\uparrow$) |

**Table 6: Attack performance under different levels of constraints on NeRF Synthetic dataset. Standard deviation are reported over three individual runs.**
| NeRF-Synthetic Dataset |  |  |  |  |
| --- | --- | --- | --- | --- |
| Scene | Attack setting | Number of Gaussians | Peak GPU memory [MB] | Training time [minutes] |
| chair | clean | 0.494 M $\pm$ 0.001 M | 3752 MB $\pm$ 57 MB | 9.45 min $\pm$ 0.55 min |
| $\epsilon=8/255$ | 0.670 M $\pm$ 0.002 M | 4520 MB $\pm$ 4 MB | 11.24 min $\pm$ 0.09 min |  |
| $\epsilon=16/255$ | 0.957 M $\pm$ 0.003 M | 8003 MB $\pm$ 138 MB | 13.41 min $\pm$ 0.44 min |  |
| $\epsilon=24/255$ | 1.253 M $\pm$ 0.005 M | 16394 MB $\pm$ 284 MB | 15.89 min $\pm$ 0.68 min |  |
| unconstrained | 4.152 M $\pm$ 0.006 M | 51424 MB $\pm$ 98 MB | 40.71 min $\pm$ 0.67 min |  |
| drums | clean | 0.385 M $\pm$ 0.001 M | 3456 MB $\pm$ 47 MB | 8.75 min $\pm$ 0.39 min |
| $\epsilon=8/255$ | 0.469 M $\pm$ 0.000 M | 4353 MB $\pm$ 53 MB | 10.19 min $\pm$ 0.42 min |  |
| $\epsilon=16/255$ | 0.695 M $\pm$ 0.002 M | 7190 MB $\pm$ 261 MB | 11.94 min $\pm$ 0.45 min |  |
| $\epsilon=24/255$ | 0.966 M $\pm$ 0.007 M | 14668 MB $\pm$ 451 MB | 14.86 min $\pm$ 0.33 min |  |
| unconstrained | 4.109 M $\pm$ 0.039 M | 62328 MB $\pm$ 878 MB | 43.25 min $\pm$ 0.75 min |  |
| ficus | clean | 0.265 M $\pm$ 0.000 M | 3194 MB $\pm$ 42 MB | 6.99 min $\pm$ 0.11 min |
| $\epsilon=8/255$ | 0.246 M $\pm$ 0.001 M | 3238 MB $\pm$ 1 MB | 8.28 min $\pm$ 0.56 min |  |
| $\epsilon=16/255$ | 0.273 M $\pm$ 0.001 M | 3783 MB $\pm$ 51 MB | 8.94 min $\pm$ 0.40 min |  |
| $\epsilon=24/255$ | 0.450 M $\pm$ 0.001 M | 8993 MB $\pm$ 112 MB | 11.32 min $\pm$ 0.31 min |  |
| unconstrained | 3.718 M $\pm$ 0.001 M | 50450 MB $\pm$ 452 MB | 36.92 min $\pm$ 0.86 min |  |
| hotdog | clean | 0.185 M $\pm$ 0.000 M | 3336 MB $\pm$ 11 MB | 8.57 min $\pm$ 0.30 min |
| $\epsilon=8/255$ | 0.610 M $\pm$ 0.000 M | 10362 MB $\pm$ 280 MB | 12.96 min $\pm$ 0.23 min |  |
| $\epsilon=16/255$ | 1.147 M $\pm$ 0.003 M | 29747 MB $\pm$ 57 MB | 17.43 min $\pm$ 0.61 min |  |
| $\epsilon=24/255$ | 1.553 M $\pm$ 0.005 M | 39087 MB $\pm$ 198 MB | 21.26 min $\pm$ 0.99 min |  |
| unconstrained | 4.272 M $\pm$ 0.003 M | 47859 MB $\pm$ 688 MB | 38.85 min $\pm$ 0.90 min |  |
| lego | clean | 0.341 M $\pm$ 0.001 M | 3532 MB $\pm$ 91 MB | 8.62 min $\pm$ 0.41 min |
| $\epsilon=8/255$ | 0.469 M $\pm$ 0.002 M | 4648 MB $\pm$ 120 MB | 10.38 min $\pm$ 0.47 min |  |
| $\epsilon=16/255$ | 0.805 M $\pm$ 0.001 M | 9960 MB $\pm$ 132 MB | 13.02 min $\pm$ 0.50 min |  |
| $\epsilon=24/255$ | 1.116 M $\pm$ 0.011 M | 18643 MB $\pm$ 504 MB | 15.33 min $\pm$ 0.63 min |  |
| unconstrained | 4.159 M $\pm$ 0.002 M | 78852 MB $\pm$ 2392 MB | 42.46 min $\pm$ 0.88 min |  |
| materials | clean | 0.169 M $\pm$ 0.001 M | 3172 MB $\pm$ 32 MB | 7.33 min $\pm$ 0.21 min |
| $\epsilon=8/255$ | 0.229 M $\pm$ 0.000 M | 3581 MB $\pm$ 52 MB | 8.84 min $\pm$ 0.29 min |  |
| $\epsilon=16/255$ | 0.410 M $\pm$ 0.001 M | 4886 MB $\pm$ 66 MB | 9.92 min $\pm$ 0.10 min |  |
| $\epsilon=24/255$ | 0.589 M $\pm$ 0.000 M | 7724 MB $\pm$ 106 MB | 11.51 min $\pm$ 0.43 min |  |
| unconstrained | 3.380 M $\pm$ 0.000 M | 43998 MB $\pm$ 675 MB | 32.40 min $\pm$ 1.02 min |  |
| mic | clean | 0.205 M $\pm$ 0.000 M | 3499 MB $\pm$ 130 MB | 8.08 min $\pm$ 0.20 min |
| $\epsilon=8/255$ | 0.251 M $\pm$ 0.001 M | 4038 MB $\pm$ 132 MB | 9.29 min $\pm$ 0.03 min |  |
| $\epsilon=16/255$ | 0.359 M $\pm$ 0.001 M | 6437 MB $\pm$ 70 MB | 10.96 min $\pm$ 0.10 min |  |
| $\epsilon=24/255$ | 0.514 M $\pm$ 0.005 M | 13014 MB $\pm$ 141 MB | 12.89 min $\pm$ 0.52 min |  |
| unconstrained | 3.940 M $\pm$ 0.004 M | 61835 MB $\pm$ 586 MB | 39.02 min $\pm$ 0.65 min |  |
| ship | clean | 0.272 M $\pm$ 0.001 M | 3692 MB $\pm$ 52 MB | 8.87 min $\pm$ 0.44 min |
| $\epsilon=8/255$ | 0.516 M $\pm$ 0.003 M | 5574 MB $\pm$ 55 MB | 11.01 min $\pm$ 0.16 min |  |
| $\epsilon=16/255$ | 1.071 M $\pm$ 0.003 M | 16666 MB $\pm$ 548 MB | 16.12 min $\pm$ 0.42 min |  |
| $\epsilon=24/255$ | 1.365 M $\pm$ 0.002 M | 29828 MB $\pm$ 192 MB | 18.46 min $\pm$ 0.47 min |  |
| unconstrained | 4.317 M $\pm$ 0.005 M | 80956 MB $\pm$ 13 MB | 44.11 min $\pm$ 0.94 min |  |

**Table 7: Attack performance under different levels of constraints on MIP-NeRF360 dataset. Standard deviation are reported over three individual runs.**
| MIP-NeRF360 Dataset |  |  |  |  |
| --- | --- | --- | --- | --- |
| Scene | Attack setting | Number of Gaussians | Peak GPU memory [MB] | Training time [minutes] |
| bicycle | clean | 5.793 M $\pm$ 0.007 M | 17748 MB $\pm$ 554 MB | 33.42 min $\pm$ 0.22 min |
| $\epsilon=8/255$ | 6.116 M $\pm$ 0.019 M | 18608 MB $\pm$ 401 MB | 34.73 min $\pm$ 0.67 min |  |
| $\epsilon=16/255$ | 10.129 M $\pm$ 0.053 M | 27074 MB $\pm$ 1180 MB | 44.44 min $\pm$ 0.43 min |  |
| $\epsilon=24/255$ | 13.265 M $\pm$ 0.080 M | 34870 MB $\pm$ 1882 MB | 51.37 min $\pm$ 0.26 min |  |
| unconstrained | 25.268 M $\pm$ 0.627 M | 63236 MB $\pm$ 537 MB | 81.48 min $\pm$ 1.44 min |  |
| bonsai | clean | 1.294 M $\pm$ 0.002 M | 10216 MB $\pm$ 21 MB | 21.68 min $\pm$ 1.18 min |
| $\epsilon=8/255$ | 1.778 M $\pm$ 0.011 M | 11495 MB $\pm$ 264 MB | 21.39 min $\pm$ 0.48 min |  |
| $\epsilon=16/255$ | 6.150 M $\pm$ 0.063 M | 20564 MB $\pm$ 58 MB | 32.51 min $\pm$ 0.27 min |  |
| $\epsilon=24/255$ | 9.321 M $\pm$ 0.058 M | 27191 MB $\pm$ 194 MB | 39.84 min $\pm$ 0.15 min |  |
| unconstrained | 20.127 M $\pm$ 0.122 M | 54506 MB $\pm$ 3437 MB | 75.18 min $\pm$ 0.39 min |  |
| counter | clean | 1.195 M $\pm$ 0.005 M | 10750 MB $\pm$ 104 MB | 26.46 min $\pm$ 0.57 min |
| $\epsilon=8/255$ | 1.739 M $\pm$ 0.010 M | 15133 MB $\pm$ 408 MB | 28.06 min $\pm$ 0.61 min |  |
| $\epsilon=16/255$ | 4.628 M $\pm$ 0.014 M | 29796 MB $\pm$ 187 MB | 37.63 min $\pm$ 0.48 min |  |
| $\epsilon=24/255$ | 6.649 M $\pm$ 0.002 M | 47607 MB $\pm$ 796 MB | 43.68 min $\pm$ 0.14 min |  |
| unconstrained | 11.167 M $\pm$ 0.092 M | 80732 MB $\pm$ 255 MB | 62.04 min $\pm$ 0.13 min |  |
| flowers | clean | 3.508 M $\pm$ 0.008 M | 12520 MB $\pm$ 263 MB | 25.47 min $\pm$ 0.29 min |
| $\epsilon=8/255$ | 3.457 M $\pm$ 0.026 M | 12391 MB $\pm$ 262 MB | 25.53 min $\pm$ 0.39 min |  |
| $\epsilon=16/255$ | 5.177 M $\pm$ 0.008 M | 16338 MB $\pm$ 566 MB | 30.05 min $\pm$ 0.42 min |  |
| $\epsilon=24/255$ | 7.280 M $\pm$ 0.129 M | 20264 MB $\pm$ 44 MB | 34.25 min $\pm$ 0.59 min |  |
| unconstrained | 18.075 M $\pm$ 0.136 M | 45515 MB $\pm$ 2810 MB | 62.62 min $\pm$ 0.62 min |  |
| garden | clean | 5.684 M $\pm$ 0.014 M | 17561 MB $\pm$ 194 MB | 33.19 min $\pm$ 0.54 min |
| $\epsilon=8/255$ | 5.122 M $\pm$ 0.006 M | 16498 MB $\pm$ 108 MB | 32.17 min $\pm$ 0.71 min |  |
| $\epsilon=16/255$ | 7.697 M $\pm$ 0.016 M | 23115 MB $\pm$ 505 MB | 40.82 min $\pm$ 0.23 min |  |
| $\epsilon=24/255$ | 10.356 M $\pm$ 0.010 M | 28130 MB $\pm$ 174 MB | 48.88 min $\pm$ 0.15 min |  |
| unconstrained | 21.527 M $\pm$ 0.027 M | 52140 MB $\pm$ 1208 MB | 83.81 min $\pm$ 0.07 min |  |
| kitchen | clean | 1.799 M $\pm$ 0.002 M | 12442 MB $\pm$ 252 MB | 26.61 min $\pm$ 0.28 min |
| $\epsilon=8/255$ | 2.675 M $\pm$ 0.001 M | 13760 MB $\pm$ 117 MB | 31.39 min $\pm$ 0.66 min |  |
| $\epsilon=16/255$ | 6.346 M $\pm$ 0.046 M | 20902 MB $\pm$ 353 MB | 43.24 min $\pm$ 0.59 min |  |
| $\epsilon=24/255$ | 9.445 M $\pm$ 0.040 M | 27646 MB $\pm$ 614 MB | 53.16 min $\pm$ 0.32 min |  |
| unconstrained | 12.830 M $\pm$ 0.059 M | 77141 MB $\pm$ 1444 MB | 73.04 min $\pm$ 0.28 min |  |
| room | clean | 1.513 M $\pm$ 0.004 M | 12316 MB $\pm$ 13 MB | 25.36 min $\pm$ 0.09 min |
| $\epsilon=8/255$ | 3.034 M $\pm$ 0.003 M | 19542 MB $\pm$ 363 MB | 32.99 min $\pm$ 0.34 min |  |
| $\epsilon=16/255$ | 7.129 M $\pm$ 0.020 M | 46238 MB $\pm$ 802 MB | 47.98 min $\pm$ 0.72 min |  |
| $\epsilon=24/255$ | 9.724 M $\pm$ 0.053 M | 80142 MB $\pm$ 249 MB | 56.87 min $\pm$ 0.51 min |  |
| unconstrained | 16.019 M $\pm$ 0.025 M | 57540 MB $\pm$ 3983 MB | 76.25 min $\pm$ 0.14 min |  |
| stump | clean | 4.671 M $\pm$ 0.070 M | 14135 MB $\pm$ 218 MB | 27.06 min $\pm$ 0.31 min |
| $\epsilon=8/255$ | 5.152 M $\pm$ 0.072 M | 15342 MB $\pm$ 121 MB | 28.21 min $\pm$ 0.31 min |  |
| $\epsilon=16/255$ | 10.003 M $\pm$ 0.292 M | 25714 MB $\pm$ 1806 MB | 38.48 min $\pm$ 0.59 min |  |
| $\epsilon=24/255$ | 14.292 M $\pm$ 0.050 M | 34246 MB $\pm$ 1108 MB | 46.89 min $\pm$ 0.49 min |  |
| unconstrained | 13.550 M $\pm$ 1.257 M | 36181 MB $\pm$ 3769 MB | 51.51 min $\pm$ 1.90 min |  |

## Appendix D Notations

We provide Table 8 to list all the notations appeared in the paper.

**Table 8: Notation List**
| Variable | Description |
| --- | --- |
| $\mathcal{G}$ | 3D Gaussians |
| $\|\mathcal{G}\|$ | The number of 3D Gaussians |
| $G_{i}$ | The $i$-th Gaussian in the scene |
| $\mathcal{D}$ | Clean image datasets |
| $\mathcal{D}_{p}$ | Poisoned image datasets |
| $V_{k}$ | The $k$-th camera view’s clean image |
| $P_{k}$ | The $k$-th camera view’s camera pose |
| $\tilde{V_{k}}$ | The $k$-th camera view’s poisoned image |
| $\tilde{P_{k}}$ | The $k$-th camera view’s poisoned pose |
| ${V^{\prime}_{k}}$ | The $k$-th camera view’s rendered image |
| $N$ | The total number of views |
| $\mu\in\mathbb{R}^{3}$ | Center 3D coordinates (positions) of a Gaussian |
| $s\in\mathbb{R}^{3}$ | 3D scales of a Gaussian |
| $\alpha\in\mathbb{R}$ | Opacity of a Gaussian |
| $q\in\mathbb{R}^{4}$ | Rotation quaternion of a Gaussian |
| $c\in\mathbb{R}^{3\times(d+1)^{2}}$ | Color of a Gaussian represented as spherical harmonics, where $d$ is the degree |
| $\tau_{g}$ | Gradient threshold |
| $\tau_{s}$ | Scale threshold |
| $\tau_{\alpha}$ | Opacity threshold |
| $\mathcal{R}$ | Renderer function |
| $\epsilon$ | Perturbation range |
| $\eta$ | Perturbation step size |
| $T$ | The iteration number of inner optimization |
| $\tilde{T}$ | The iteration number of outer optimization |
| $\mathcal{P}_{\epsilon}(\cdot)$ | Projection into $\epsilon$-ball |
| $\mathcal{L}$ | Reconstruction loss |
| $\mathcal{L}_{1}$ | $\mathcal{L}_{1}$ loss |
| $\mathcal{L}_{\text{D-SSIM}}$ | Structural similarity index measure (SSIM) loss |
| $\mathcal{C}(\mathcal{G}^{*})$ | Training costs of 3D Gaussians |
| $\mathcal{S}_{\text{TV}}(V_{k})$ | Total variation score |
| $\lambda$ | Loss trade-off parameters |

## Appendix E Visualizations

In this section, we present both the attacker-crafted poisoned images and the resultant reconstructions by the victim model. The visualizations aim to provide readers with more straightforward understanding of our attack. The constrained attack visualizations are provided in Table 9, and the unconstrained attack visualizations are provided in Table 10.

We have following interesting observations:

- •
Unconstrained Poisoned Attacks: On both NeRF-Synthetic and MIP-NeRF360, the reconstruction results consistently show a low PSNR (around 20 dB). While the poisoned images and victim reconstructions may both resemble chaotic arrangements of lines with needle-like Gaussians, subtle differences in detail exist. These differences, though difficult for the human eye to distinguish, are reflected in the PSNR.
- •
Constrained Attacks on NeRF-Synthetic: the reconstruction results are significantly better than unconstrained attacks, with an average PSNR of around 30 dB.
- •
Constrained Attacks on MIP-NeRF360: There are substantial appearance differences between the victim reconstructions and the poisoned input images, which are easily noticeable through human observation. Specifically, in the bicycle scene, the reconstructed trees appear to have denser leaves. In the bonsai and counter scenes, we observe notable changes in reflective areas, with several reflection highlights disappearing in the victim’s reconstructed images. Additionally, in the counter scene, there is evidence of underfitting, where the complex textures of the poisoned data degrade into large, blurry floaters in the victim’s reconstruction.

**Table 9: Attacker poisoned and victim reconstructed images with PSNR values under constrained attack ($\epsilon=16/255$) settings.**
| Dataset Setting | Attacker Poisoned Image | Victim Reconstructed Image | PSNR |
| --- | --- | --- | --- |
| NS-Chair |  |  | 37.07 dB |
| NS-Drums |  |  | 30.32 dB |
| NS-Ficus |  |  | 35.77 dB |
| MIP-bicycle |  |  | 18.20 dB |
| MIP-bonsai |  |  | 22.67 dB |
| MIP-counter |  |  | 24.45 dB |

**Table 10: Attacker poisoned and victim reconstructed images with PSNR values under unconstrained attack settings.**
| Dataset Scene | Attacker Poisoned Image | Victim Reconstructed Image | PSNR |
| --- | --- | --- | --- |
| NS-Chair |  |  | 19.54 dB |
| NS-Drums |  |  | 18.65 dB |
| NS-Ficus |  |  | 21.00 dB |
| MIP-bicycle |  |  | 20.57 dB |
| MIP-bonsai |  |  | 23.66 dB |
| MIP-counter |  |  | 21.33 dB |

## Peer Reviews

confidence: 3
contribution: 3
initial_rating: 5
presentation: 4
questions: 1. What poisoning ratio is needed for Poison-Splat to be effective, and how does it affect stealth and impact?
2. How is the smoothness threshold defined, and how does it impact the stealth of the attack?
3. Does the quadratic time complexity of Algorithm 1 raise practical concerns during training?
4. Is Poison-Splat still effective in multi-GPU settings, and how does it perform across GPUs with different specs?
5. What is the Gaussian limit threshold in the basic defense, and how do varying limits affect the attack?
soundness: 3
strengths: + A unique computation cost attack targeting 3D Gaussian Splatting.
+ Highlights practical vulnerabilities in commercial 3D reconstruction services.
+ Thorough experimentation across various datasets.
summary: The paper introduces Poison-splat, a data poisoning attack targeting the training phase of 3D Gaussian Splatting (3DGS). It exposes a vulnerability in the adaptive model complexity of 3DGS, showing how manipulated input data can significantly escalate computation costs during training, potentially resulting in a Denial-of-Service by consuming all available memory.
weaknesses: - The paper frames the problem as a data poisoning attack. However, it does not clearly elaborate on the poisoning ratio required for Poison-Splat to be effective. Additionally, the implications of varying poisoning ratios, particularly their impact on the stealthiness and overall effectiveness of the attack, are not thoroughly discussed.

- The paper mentions that Poison-Splat maximizes the number of Gaussians by enhancing the sharpness of 3D objects through controlling the smoothness factor. However, it is not clearly explained how the smoothness threshold is defined to ensure an effective attack. Additionally, the impact of this threshold on the stealthiness of the attack remains unclear.

- Algorithm 1 indicates that generating backdoor samples with Poison-Splat requires a quadratic time complexity relative to the number of iterations, which raises concerns about the practicality of this approach during training.

- Would the Poison-Splat technique maintain its effectiveness when the 3DGS algorithm is trained in a multi-GPU environment? Additionally, the attack should be assessed on various GPUs with different clock frequencies and memory bandwidths to evaluate the generalizability of the approach.

- The paper states a basic defense against Poison-Spat by limiting the number of Gaussians, but it does not specify the threshold for the number considered in this defense. It would be beneficial to include an evaluation that explores the effect of varying these Gaussian limits.

- The definition of the threat model for the Poison-Splat attack could be more precise, particularly in specifying attacker capabilities and constraints. Explicitly define white-box and black-box scenarios for the proxy model.

- Why does the attack perform well on specific datasets in the white-box scenario but less effectively on others, such as the Tanks-and-Temples data (as shown in Table 1 and Table 3)? Can authors provide additional reasoning?

---

confidence: 4
contribution: 3
initial_rating: 6
presentation: 3
questions: 1. Since there are many online services using 3DGS, as you mentioned in the paper, have you evaluated the real-world attack performance of your technique on those application? Will the responding time be extended or causing deny of service?
soundness: 3
strengths: 1. This work identifies a new kind of vulnerability in 3DGS systems, which is the computational cost attack.
2. Authors have proposed an efficient algorithm to optimize a perturbation to increase the number of gaussians required in 3DGS.
3. The presentation of the paper is clear and easy to follow.
4. Evaluation results demonstrate the good attack performance in both black-box and white-box settings.
summary: This paper proposes an adversarial attack against 3D Gaussian splatting, aiming at increasing the computational cost of this process. Their attack is based on the flexibility of this algorithm, in which the computational cost will change dynamically according to the input image features. Their attack named poison-splat leverages a proxy 3DGS model and the improvement of the total variation score to increase the number of gaussians required in computation, hence bring a huge computational cost regarding GPU memory usage and training time. Their evaluation has included both white-box and black-box attack results and discussed simple defense strategies.
weaknesses: 1. The constraint of the perturbation (epsilon = 16/255) seems large, and the quality of the resulted image could be affected. More ablation studies may be conducted to evaluate other constraint thresholds. 
2. A simple defense might be smoothing the input images before conducting 3DGS, which seems an adaptive defense regarding your perturbations to the input. You may discuss or evaluate the effectiveness and negative impact of such defense.

---

confidence: 4
contribution: 3
initial_rating: 6
presentation: 3
questions: My concerns mainly lie in the practically feasible of the proposed attack.
1. Is the attack practically feasible in real-world scenarios, or is it only feasible in theory?
2. In the work, the authors approximate the outer maximum objective with the number of Gaussians, which appears to be a theoretical assumption that may not apply in real-world scenarios.
soundness: 3
strengths: 1. The paper is well written and organized.
2. The paper reveals that the flexibility in model complexity of 3DGS can become a security backdoor, making it vulnerable to computation cost attack.
3. Attacks are formulated and extensive experiments are conducted.
summary: The paper discovers a security vulnerability in 3DGS. It shows that the computation cost of
training 3DGS could be maliciously tampered by poisoning the input data. An attack named Poison-splat is presented.

I have read the response of the authors and the comments of other reviewers. I would recommend weak accept.
weaknesses: 1. Is the attack practically feasible in real-world scenarios, or is it only feasible in theory?
2. In the work, the authors approximate the outer maximum objective with the number of Gaussians, which appears to be a theoretical assumption that may not apply in real-world scenarios.

---

confidence: 3
contribution: 4
initial_rating: 5
presentation: 4
questions: (1) As a model training service provider, certain benchmarks, such as model size and typical training duration, are commonly understood. Given these expectations, would an attack that poisons samples to increase memory usage and training time be easy to detect? Additionally, could existing methods for detecting adversarial samples be effective in identifying these poisoned samples?
(2)Are existing attack methods targeting the inference phase applicable to the training phase? If so, could these methods be included in the experimental analysis for comparison? If not, could the authors explain why?
(3) Since this attack targets the training phase, it would be helpful if the authors could analyze the required percentage of contamination in a clean dataset for the attack to succeed.
(4) In the Experimental Analysis section, the authors conducted extensive experiments to analyze the impact of the attack on memory usage and training duration, which is commendable. However, while the abstract suggests that Poison-splat can lead to a DoS damage to the server, the Experimental Analysis section lacks any evaluation of the attack's effects on the inference phase.
(5) Could the authors add more common models to compare the effectiveness of black-box and white-box attacks?
(6) The primary objective of the attack is to consume excessive computational resources, but what are the most serious consequences of this? Is it a denial-of-service (DoS) scenario? Additionally, how difficult would it be to achieve significant damage? For instance, if an attacker aims to prevent a model from completing its training, would this require prior knowledge of the service provider's computational resources? Lastly, it is unclear how the success or failure of this type of attack should be assessed. For example, if the service provider’s computational resources are sufficient to handle the increased demand, should the attack then be considered unsuccessful?
soundness: 4
strengths: 1. It reveals a major security vulnerability that has been overlooked in 3DGS.
2. The attack's effectiveness is validated across various datasets.
summary: This work reveals a major security vulnerability that has been overlooked in 3D Gaussian Splatting (3DGS): the computational cost of training 3DGS can be maliciously manipulated by poisoning the input data. This paper introduces a novel attack, termed "Poison," in which an adversary can poison the input images, thereby significantly increasing the memory and computational time required for 3DGS training, ultimately pushing the algorithm to its highest computational complexity. In extreme cases, the attack can even exhaust all available memory, leading to a denial-of-service (DoS) event on the server and causing real harm to 3DGS service providers.
The attack is modeled as a two-layer optimization problem, addressed through three strategies: attack target approximation, proxy model rendering, and optional constrained optimization. This proposed approach not only ensures the effectiveness of the attack but also makes it challenging for simple, existing defenses to succeed. This novel attack aims to raise awareness of the potential vulnerabilities in 3DGS systems.
weaknesses: 1. It lacks evaluation of the attack's effects on the inference phase.
2. There are no intuitive metrics for evaluating the success or failure of this attack.

Meta-review: This paper proposed a new security vulnerability in 3D Gaussian Splatting. All reviewers provides positive feedback of this paper. AC read all reviewers and rebuttal and recommend this paper as a spotlight paper. This paper also show the practical usage of this attack which is also very important and good. AC hopes the authors can revised the paper based on reviewers' comments.

Decision: Accept (Spotlight)