Poison-splat: Computation Cost Attack on 3D Gaussian Splatting
Authors: Jiahao Lu
Yifan Zhang
Qiuhong Shen
Xinchao Wang
Shuicheng YAN
Venue: ICLR 2025 Spotlight (2025)
Keywords: gaussian splatting
computation cost attack
energy-latency attack
data poisoning attack
3D security
AI security
Primary area: alignment, fairness, safety, privacy, and societal considerations
TL;DR: We reveal a severe security vulnerability of 3D Gaussian Splatting:  the computation cost of training 3DGS (GPU consumption, training time) could be significantly manipulated by poisoning input data.

Abstract: 3D Gaussian splatting (3DGS), known for its groundbreaking performance and efficiency, has become a dominant 3D representation and brought progress to many 3D vision tasks. However, in this work, we reveal a significant security vulnerability that has been largely overlooked in 3DGS: the computation cost of training 3DGS could be maliciously tampered by poisoning the input data. By developing an attack named Poison-splat, we reveal a novel attack surface where the adversary can poison the input images to drastically increase the computation memory and time needed for 3DGS training, pushing the algorithm towards its worst computation complexity. In extreme cases, the attack can even consume all allocable memory, leading to a Denial-of-Service (DoS) that disrupts servers, resulting in practical damages to real-world 3DGS service vendors. Such a computation cost attack is achieved by addressing a bi-level optimization problem through three tailored strategies: attack objective approximation, proxy model rendering, and optional constrained optimization. These strategies not only ensure the effectiveness of our attack but also make it difficult to defend with simple defensive measures. We hope the revelation of this novel attack surface can spark attention to this crucial yet overlooked vulnerability of 3DGS systems. Our code is available at https://github.com/jiahaolu97/poison-splat  .

Published as a conference paper at ICLR 2025
POISON-SPLAT: COMPUTATION COST ATTACK ON 3D GAUSSIAN SPLATTING
Jiahao Lu Yifan Zhang?- Qiuhong Shen'
Xinchao Wang"
Shuicheng Yan
National University of Singapore Skywork AI
i ahac. Luêu. edu, yitan. xi nnchhc@uuus... edu. sg, shuicheng. www.kynlnnnnnnnnne com
-nnnnnc.n--nnnncoo com, qiubong shendu. www.aaa.seee............ edu,
ABSTRACT
3D Gaussian splatting (3DGS), known for its groundbreaking performance and efficiency, has become a dominant 3D representation and brought progress to many 3D vision tasks. However, in this work, we reveal a significant security vulnerability that has been largely overlooked in 3DGS: the computation cost of training 3DGS could be maliciously tampered by poisoning the input data. By developing an attack named Poison-splat, we reveal novel attack surface where the adversary can poison the input images to drastically increase the computation memory and time needed for 3DGS training, pushing the algorithm towards its worst computation complexity. In extreme cases, the attack can even consume all allocable memory, leading to a Denial-of-Servicee (DoS) that disrupts servers, resulting in practical damages to real-world 3DGS service vendors. Such a computation cost attack is achieved by addressing bi-level optimization problem through three tailored strategies: attack objective approximation, proxy model rendering, and optional constrained optimization. These strategies not only ensure the effectiveness of our attack but also make it difficult to defend with simple defensive measures. We hope the revelation of this novel attack surface can spark attention to this crucial yet overlooked vulnerability of 3DGS systems."
INTRODUCTION
3D reconstruction, aiming to build 3D representations from multi-view 2D images, holds critical position in computer vision and machine learning, extending its benefits across broad domains including entertainment, healthcare, archacology, and the manufacturing industry. A notable example is Google Map with a novel feature for NeRF-based (Mildenhall et al., 2021) 3D outdoor scene reconstruction (Google, 2023). Similarly, commercial companies like LumaAI, KIRI, Polycam and Spline offer paid service for users to generate 3D captures from user-uploaded images or videos. Among these popular 3D applications, many are powered by novel and sought-after 3D reconstruction paradigm known as 3D Gaussian Splatting (3DGS).
3DGS, introduced by Kerbl al. (2023) in 2023. has quickly revolutionized the field of 3D Vision and achieved overwhelming popularity (Chen & Wang, 2024; Fei et al., 2024; Wu et al., 2024b; Dalal et al., 2024). 3DGS not powered by neural networks, distinguishing itself from NeRF (Mildenhall et al., 2021), the former dominant force in 3D vision. Instead, it captures 3D scenes by learning cloud of 3D Gaussians as an explicit 3D model and uses rasterization to render multiple objects simultaneously. This enables 3DGS to achieve significant advantages in rendering speed, photo- realism, and interpretability, making it a game changer in the field.
One intriguing property of Gaussian Splatting is its flexibility in model complexity. Unlike NeRF or any other neural-network based algorithms which have a pre-determined and fixed computational complexity based on network cording to the input data. During the 3DGS training process, the size of learnable parameters, i. number of 3D Gaussians is dynamically adjusted to align with the complexity of the underlying 3D scene. More specifically, 3DGS algorithm uses an adaptive density control strategy to flexibly
ppprr-paramtter, 3DGS can dynamically adjust its complexity ac-
Authorr contributed equally. This work was performed when Jiahao Lu was an intern at Skywork AL.
1 Corresponding authors
Our code is available at https: http://gttttttt/// wtwpo//iaaaala9/////
splat.

---

Published as a conference paper at ICLR 2025
POISON-SPLAT
GPU memory:
12.32
GPU memory-
Training time:
25.36 min
Training time: .00 min'
Param size: 0,35 08
Param size: 1.45 GB
Render speed: FPS
Render speed: 36 FPS
Clean input image/ Gaussian point cloud
Poisoned input image/ 3D Gaussian point cloud
Figure 1: Our Poison-splat attack adds perturbations to input images, making 3D Gaussian Splatting need significantly more parameters reconstruct the 3D scene, leading to huge increases in GPU memory consumption, training time and rendering latency. Here, we visualize the input image and the underlying 3D Gaussians of clean view (left) and its corresponding poisoned view (right).
increase or decrease the number of Gaussians for optimizing reconstruction, leading to variable computational complexity in terms of GPU memory occupancy and training time cost.
The above flexibility in design aims to provide training advantages. However, this flexibility can also become a vulnerability. In this paper, we reveal severe yet unnoticed attack vector: the flexibility of 3DGS complexity can be abused to over-consume computation resources such as GPU memory and significantly drag down training speed of Gaussian Splatting system, pushing the training process to its worst computational complexity.
We develop computation cost attack method Poison-splat proof-of-concept of this novel attack vector. Poison-splat takes the form training data poisoning (Tian et al., 2022), where the attacker manipulates the input data fed into the victim 3DGS system. This is practical in real-world scenarios, as commercial 3D service providers like Kiri (KIRI), Polycam (Polycam) and Spline (Spline) receive images or videos from end users to generate 3D captures. An attacker normal users to submit poisoned data and launch the attack stealthily, or even secretly manipulate data uploaded by other users. During peak usage periods, this attack competes for computing resources with legitimate users, slowing down service response times and potentially causing severe consequences like service crashes, leading to significant financial losses for service providers.
hide themselves among
We formulate Poison-splat attack as a max-min problem. The inner optimization is the learning process of 3D Gaussian Splatting, i.e., minimizing the reconstruction loss given a set of input images and camera poses, while the outer optimization problem is to maximize the computation cost of solving the inner problem. Although accurately solving this bi-level optimization is often infeasible, we find that the attacker can use proxy model to approximate the inner minimization and focus on optimizing the outer maximization objective. Moreover, we observe an important relationship that memory consumption and rendering latency exhibit a clear positive correlation with the number of 3D Gaussians training. Therefore, the attacker can use the number of Gaussians in proxy model training metric depict computation costs for outer optimization. Motivated by these insights, our Poison-splat attack uses image total variation loss as prior to guide the oves-dennoiiiation 3D Gaussians, and can approximately solve this bi-level optimization problem in cheap way.
The contributions of this work can be concluded in three-folds:
We reveal that the flexibility model complexity of 3DGS can become a security backdoor, making it vulnerable to computation cost attack. This vulnerability has been largely over- looked by the 3D vision and machine learning communities. Our research shows that such attacks are feasible, potentially causing severe financial losses to 3D service providers.
We formulate the attack on 3D Gaussian Splatting as data poisoning attack problem. To our best knowledge, there is no previous work investigating how to poison training data to increase the computation cost of machine learning systems.
We propose a novel attack algorithm, named Poison-splat, which significantly increases GPU memory consumption and slows down training procedure of 3DGS. We hope the community can recognize this vulnerability and develop more robust 3D Gaussian Splatting algorithms or defensive methods to mitigate such attacks.

---

Published as a conference paper at ICLR 2025
PRELIMINARIES
In this section, we provide essential backgrounds on 3D Gaussian Splatring and aasource-targetiinn attacks, which are crucial for understanding our attack method proposed in Section 3. Due to page constraints, we put related works in Appendix Section A.
2.1 3D GAUSSIAN SPLATTING
3D Gaussian Splatting (3DGS) (Kerbl et al., 2023) has revolutionized the 3D vision community with its superior performance and efficiency. It models 3D scene by learning set of 3D Gaussians G = {G:} from multi-view images D = {V2, Ps J 1- where each view consists of a ground-truth image V/2 and the corresponding camera poses P&.. We denote N as the total number of image- pose pairs in the training data. As for the model, each 3D Gaussian G; = {ig St, ag qi, 4 has 5 optimizable parameters: center coordinates 14, scales 81, opacity a;, rotation quaternion qi and associated view-dependent color represented as spherical harmonics c;.
To render from 31D Gaussian space to 2D images, each Gaussian is first projected into the camera coordinate frame given a camera pose Pk to determine the depth of each Gaussian, which is the distance of that Gaussian to the camera view. The calculated depth is used for sorting Gaussians from near to far, and then the colors in 2D image are rendered in parallel by alpha blending according to the depth order of adjacent 3D Gaussians. We denote the 3DGS renderer as function R, which takes as input the Gaussians G and camera pose PA to render an image V/ RRG. Pt).
The training is done by optimizing the reconstruction loss between the rendered image and ground truth image for each camera view, where the reconstruction loss is combination of L1 loss and structural similarity index measure (SSIM) loss SSSSSIM (Brunet et al., 2011):
N min L(D) = min Σ L(V, Vv) min -(-A)) V&) + A (VIM(VV Vi., g
(1)
where À is a trade-off parameter. To ensure finer reconstruction, 3DGS deploys adaptive density control to automatically add or remove Gaussians from optimization. Adding Gaussians called densification, while removing Gaussians is called pruming. Densification is performed when the view-space positional gradient f is larger than a pre-set gradient threshold Ty (by default 0.0002). Pruning occurs when the opacity falls below the opacity threshold Ta Both densification and pruning are non-differentiable operations. A more formal and comprehensive introduction provided in Appendix Section B.
pre-settgradiet
2.2 RESOURCE- TARGETTIG ATTACK
A similar concept in computer security domain is the -fnial-of-Service (DoS) attack (Elleithy et al., 2005; Aldhyani & Alkahtani, 2023; Bhatia et al., 2018). Dos attack aims to overwhelmly consume system's 's resources or network (Mirkovic & Reiher, 2004; Long & Thomas, 2001), making it unable to serve legitimate users. Common methods include flooding the system with excessive requests or triggering crash through malicious inputs. Such attacks pose severe risks to real- weal-world service providers, potentially resulting in extensive operational disruptions and financial losses. For example, Midjourney, generative Al platform, experienced significant 24-hour system outage (Akash, 2024), potentially caused by employees from another generative AI company who were allegedly scraping data, causing a Somial-of-Servicee
In the machine learning community, similar concepts are rarely mentioned. This might stem from the fact that once parameeeraetteess..ee are set in most machine learning models, such deep neural networks, their computation complexity remains fixed. Regardless of input data content, most machine learning algorithms incur nearly constant computational costs and consume almost consistent computational resources. Despite this, only a few studies have focused on resource-targeting attacks at inference stage of machine learning systems. For example, Shumailov al. (2021) first identified samples that trigger excessive neuron activations which maximise energy consumption and latency. Following works investigated other inference-stage attacks against dynamic neural networks (Hong et al., 2020; Chen al., 2023) and language models (Chen et al., 2022b;a; Gao et al., 2023). However, to knowledge, no previous works have targeted at attacking the training-star stage computation cost of machine learning systems. Our work is pioneering in bridging this research gap through Gaussian Splatting, which features adaptively flexible computation complexity.

---

Published as a conference paper at ICLR 2025
166
Lenal
Feas
Peek (SPU merniry (M6)
Cime [mmin]
lego
1.5000
manetas
courcer
sturp
12500
der
biace
chai Riaa
13000
gurdin
hoodkg
Mitten
holdeg
1000
16-
2200
100000 200003 300020 400000 Avarago Voriation Soore
Number Goussions
Number of Gausdians
Figure 2: The figure illustrates the strong positive correlation between the number of Gaussians and (a) GPU memory occupancy, and (b) training time costs. Panel (c) shows the relationship between image sharpness, measured by the average total variation score, and the number of Gaussians.
POISON-SPLAT ATTACK
In this section, we first formulate the computation cost attack on 3D Gaussian Splatting in Section 3.1. Subsequently, we introduce novel attack method in Section 3.2.
3.1 PROBLEM FORMULATION
We formulate attack under data poisoning framework follows. The victims the service providers of 3D Gaussian Splatting (3DGS), who typically train their 3DGS models using a dataset of multi-view images and camera poses D- (Vi, Ja We assume the attackers have the capability to introduce poisoned data within the entire dataset. This assumption is realistic an attacker could masquerade regular user, submitting poisoned data covertly, or even covertly alter data submitted by legitimate users. This allows the attack to be launched stealthily and enhances its potential impact on the training process of 3DGS. We next detail the formulation of the attacker and victim.
Attacker. The attacker begins with the clean data D = (Va, Pa) as input, manipulating it to produce poisoned training data Dp {Vk, P where the attacker does not modify the camera pose configuration files. Each poisoned image V₁ perturbed from the original clean image Vi. aiming to maximize the computational costs of victim training, such GPU memory usage and training time. The ultimate goal of the attacker significantly increase the computational resources, potentially leading denial-of-service attack by overwhelming the training system.
Victim. On the other hand, the victim receives this poisoned dataset Dp (Vi, Pa) from the attacker, unaware that has been poisoned. With this data, the victim seeks train Gaussian Splatting Model G, striving to minimize the reconstruction loss (cf. Eq. (1)). The victim's objective to achieve the lowest loss as possible, thus ensuring the quality the Gaussian Splatting model.
Optimization problem. To summarize, the computation cost attack for the attacker can be formulated as the following max-min bi-level optimization problem:
Dp arg max C(g"), s.t. arg min L(Dp), D,
where the computation cost metric C(g) is flexible and can be designed by the attacker.
3.2 PROPOSED METHOD
To conduct the attack, directly addressing the above optimization is infeasible as the computation cost is not differentiable. To address this, we seek to find an approximation for the objective.
Using the number of Gaussians as an approximation. advantage of 3DGS is its flexibility to dynamically adjust model complexity (i.c., the number of Gaussians) according to the complexity of the input data. This adaptability enhances the model's efficiency and fidelity in rendering complex scenes. However, this feature may also act double- edged sword, providing a potential backdoor for attacks. To explore this, we analyze how the number of Gaussians affects computational costs, including memory consumption and training time. Our findings, depicted in Figures 2(a-b), reveal a clear positive correlation between computational costs
mentioned in Section 1, a major

---

Published as a conference paper at ICLR 2025
Algorithm Poison-splat
Input:
Clean dataset: D {V,, P& J: Perturbation range; 6; Perturbation step size: yi
The iteration number of inner optimization: T; The iteration number of outer optimization: T.
Output: Poisoned dataset: , { (Ve,Pt) P
Initialize poisoned dataset: D
2: Train Gaussian Splatting proxy model 9p on clean datasct
D Eq. (1)
3: For t = 1,,,?? 7 do
4: Sample random camera view lt
5: V/ R(G,. Px)
Get the rendered image under the camera view Optimization of target image starts from rendered image
6: V2 = V/
7: For = I.... do
8:
VL Vv + sign(V (Va))
Eq. (4)
9:
V = PVh, Vi)
b Project into e-ball, i.e., Eq. (5)
10:
end While
11:
Update proxy model Up by minimizing L(V,, Va) under current view
> Eq. (1)
12: Update poisoned dataset: D == (Vk, Ps)
b Update the k-th element of Dp
13:
end While
and the number of Gaussians used in rendering. In light of this insight, is intuitive to use the number of Gaussians ||||| to approximate the computation cost function involved in the inner optimization:
C(G) == |||||-
Maximizing the number of Gaussians by sharpening 3D objects. Even with the above approx- imation, solving the optimization problem is still hard since the Gaussian densification operation in 3DGS is not differentiable. Hence, would be infeasible for the attacker to use gradient- based methods optimize the number of Gaussians. To circumvent this, we explore strategic alternative. As shown in Figure 2(c), we find that 3DGS tends to assign more Gaussians to those objects with more complex structures and non-smooth textures, as quantified by the total variation score-a metric assessing image sharpness (Rudin et al., 1992). Intuitively, the less smooth the surface of 3D objects is, the more Gaussians the model needs to recover all the details from its 2D image projections. Hence, non non-smoothness can be good descriptor of complexity of Gaussians, i.e., || | x Siv Inspired by this, we propose to maximize the computation cost by optimizing the total variation score of rendered images Srv(Vi):
C(9) = Siv E Vitia
V. + |
Balancing attack strength and stealthiness via optional constrained optimization. The above strategies enable the attack to significantly increase computational costs. However, this may induce an unlimited alteration to the image and result loss of semantic integrity in the generated view images (cf. Figure 4(b)), making it obvious to detect. Considering the strategic objectives of an adversary who may wish to preserve image semantics and launch the attack by stealth, we introduce an optional constrained optimization strategy. Inspired by adversarial attacks (Szegedy al., 2013; Madry et al., 2018), we enforce a e-ball constraint of the Los norm on the perturbations:
(5) where P.(-) means clamp the rendered poisoned image to be within the e-ball of the Lo norm around the original clean image, i.e., || -Velooo < e. This constraint limits each pixel's perturbation to maximum of By tuning the attack, allowing for strategic adjustments for the desired outcome. If is set to oc, the constraint effectively removed, returning the optimization to its original, unconstrained form.
V/. E P.,, V.)-
attacker balance the destructiveness and the stealthiness of
Ensuring multi-view image consistency via proxy model. An interesting insight from our study is that simply optimizing perturbations for each view image independently by maximizing total variation score does not effectively bolster attacks. As demonstrated in Figure 3(b), this image-level

---

Published as a conference paper at ICLR 2025
mammxximization attack is significantly less effective compared to our Poison-splat strategy. This mainly stems from the image-level optimization creating inconsistencies across the different views of poisoned images, undermining the attack's 'ss overall effectiveness.
Our solution is inspired by the view-consistent properties of the 3DGS model's rendering function, which effectively maintains consistency across multi-view images generated from 3D Gaussian space. In light of this, we propose to train proxy 3DGS model generate poisoned data. In each iteration, the attacker projects the current proxy model onto a camera pose, obtaining a rendered image Vid This image then serves as a starting point for optimization, where the attacker searches for target Vi that maximizes the total variation score within the 6-bound of the clean image Vi- Following this, the attacker updates the proxy model with single optimization step to mimic the victim's behavior. In subsequent iterations, the generation of poisoned images initiates with the rendering output from the updated proxy model. In this way, the attacker approximately solves this bi-level optimization by iteratively unrolling the outer and inner optimization, enhancing the attack's s effectiveness while maintaining consistency across views. We summarize the pipeline of Poison-splat in Algorithm
EXPERIMENTS
Datasets. All experiments in this paper are carried out on three common 3D datasets: (1) NeRF- Synthetic² (Mildenhall et al., 2021) is a synthetic 3D object dataset, which contains multi-view renderings synthetic 3D objects. (2) Mip-NeRF360' dataset (Barron et al., 2022) is a 3D scene dataset, which is composed of photographs of large real-world outdoor scenes. (3) Tanks-and- Temples dataset (Knapitsch et al., 2017) contains realistic 3D captures including both outdoor scenes and indoor environments.
Implementation details. In our experiments, we use the official implementation of 3D Gaussian Splatting" (Kerbl et al., 2023) to implement the victim behavior. Following their original implementa- tion, we use the recommended default syper-parameters, which were proved effective across a broad spectrum of scenes from various datasets. For testing black-box attack effectiveness, we the official implementation of Scaffold-SS* (Lu et al., 2024b) as a black box victim. All experiments reported in the paper were carried out on single NVIDIA A800-SXM4-80G GPU.
Evaluation metrics. We use the number of 3D Gaussians, GPU memory occupancy and the training time cost as metrics to evaluate the computational cost of 3DGS. A more successful attack is characterized by larger increases in the number of Gaussians, higher GPU memory consumption, and extended training time, compared with training on clean data. We also report the rendering speed of the resulted 3DGS models to show the increase in model complexity and degradation of inference latency as a byproduct of our attack.
4.1 MAIN RESULTS
We report the comparisons of the number of Gaussians, peak GPU memory, training time and rendering speed between clean and poisoned data across three different datasets in Tables 1 to show the effectiveness of our attack. The full results containing all scenes are listed the Appendix Table and Table 4. We provide visualizations of example poisoned datasets and corresponding victim reconstructions in Appendix Section F.
We want highlight some observations from the results. First, Poison-splat attack demonstrates the ability to craft a huge extra computational burden across multiple datasets. Even with perturbations constrained within small range in e-constrained attack, the peak GPU memory to over 2 times, making the overall maximum GPU occupancy higher than 24 GB in the real world, this may mean that attack may require more allocable resources than common GPU stations can provide, e.g., RTX 3090, RTX 4090 and A5000. Furthermore, as we visualized the computational cost in Figure 3()), the attack only significantly increases the memory usage, but also greatly slows
be increased
Datasett publicly accessible at https//githab.coo/mmmilleeerr 'Dataset publicly accessible https///oonharroonnnffi/iineeerp *Dataset publicly accessible at http::/www...nnsaaddnnll..nnoood

---

Published as a conference paper at ICLR 2025
166
50000
GPU memory cost (MBB)
poison-splat proxy
6
40000
20000
3-
20000
2
constrai ned attack
unconstraince attack
0
10
20
30
40
50
60
70
80
0 5000
10000
15000
20000
25000
30000
Training time [min]
Training iterations
(a) Overall comparisons of computation cost in training time and GPU memory occupancy MIP-NeRF360 (room).
(b) Number of Gaussians needed for reconstruction under attack, naive TV-maximization attack and on clean data MIP-NeRF360 (room).
Figure 3: Figure (a) shows that our attack leads to significant increase on the GPU memory and training time. Figure (b) shows that attacks simply maximizing total variation score the image level are less effective compared to Poison-splat which highlights the crucial role of the proxy model in our attack design.
down training speed. This property would further strengthen the attack, since the overwhelming GPU occupancy will last longer than normal training may take, making the overall loss of computation power higher. As shown in the bottom of Table 1, if do put constraints on the attacker and let modify the image pixels unlimitedly, then the attack results would be even more damaging. For instance, in the SyRt-iyt (ship) scene, the peak GPU usage could increase up to 21 times and almost reach 80 GB GPU memory. This level approaches the upper limits of the most advanced GPUs currently available, such H100 and A100, and is undeniably destructive.
Clean image
Attack iteration 1200 (a) Evolution the proxy model in an e-constrained attack
Attack iteration 2400
Attack iteration 4800
Clean image
Attack iterstion 1200
Attack iteratio 2400
Attack Iteration 4800
(b) Evolution of the proxy model in an unconstrained attack
Figure 4: Visualizations of proxy model updates during an attack process. The proxy 3DGS model
gradually obtains more complexity from learning from non-smoothness in the 2D image space.
To help the readers build more understanding into the attack procedure, we visualize the internal states during the attack optimization procedure, rendering the proxy model in Figure 4. It is evident that the proxy model can be guided from non-smoothness of 2D images to develop highly complex

---

Published as a conference paper at ICLR 2025
Table I: Attack results of Poison-splat across multiple datasets. Constrained attacks (E = 16/255) can covertly increase training costs through minor perturbations to images. In contrast, unconstrained attacks allow for unlimited modifications to the original input, leading to significantly higher resource consumption and more extensive damage. We highlight attacks which successfully consume over 24 GB GPU memory, which can cause halting) if 3DGS service is provided on a common memB-yy GPU (e.g., RTX 3090, RTX 4090 or A5000). Full results on all scenes provided in Table 3 and Table 4.
out-of-memory error and service
Constrained Poison-splat attack with 16
Metric
Number of Gaussians
Peak GPU memory [MB]
Training time [minutes]
Render speed [FPS]
Setting
Scene
clean
poisoned
clean
poisoned
clean
poisoned
clean
poisoned
NS-hotdog
0.185 M
1.147 M (6.20x²)
3336
29747
(8.92xf)
8.57
17.43 (2.03xf)
443
69 (6.42x.)
NS- NS-lego
0.341 M
0.805 M (2.36xx))
3532
9960 (2.82x1)
8.62
13.02 (1.51x))
349
145 (2.41x.)
NS- NS-materials
0.169 M
0.410 M (2.43x²)
3172
4886 (1.54xt)
7.33
9.92 (1.35xt)
447
250 (1.79x.)
NS ship
0.272 M
1.071 M (3.94x")
3692
16666 (4.51xf)
8.87
16.12 (1.82x))
326
(3.75x.)
TT-Courthouse
0.604 M
0.733 M (1.21x")
11402
12688 (1.11xf)
13.81
14.49 (1.05xf)
284
220 (1 (1.29x.)
Courtmoo
2,890 M
5.450 M (1.89x7)
9896
16308 (1.65x))
16.88
23.92 (1.42x()
139
83 (1.67.)
TT-Museum
4.439 M
7.130 M (1.61x))
12704
18790 (1-48xf)
19.79
26.38 (1.33xf))
121
78 (1.5xx)
TT Playgmund
2.309 M
4.307 M (1.87x7)
8717
13032 (1.50xT)
15.17
21.82 (1.44x))
151
87 (1.74x.)
MIP-bicycle
5,793 M
10,129 M (1.75x))
17748
27074"
(1.53x))
33.42
44.44 (1.33xf)
69
43 (1.60.))
counter
1.195 M
4.628 M (3.87x")
10750
24796'
(2.77xt)
26.46
37.63 (1.42xt)
164
51 (3.22x.)
MIP-room
L513 M
7.129 M (4.71x")
12316
46238'
(3.75xt)
25.36
47.98 (L.8kx))
154
35 (4.40x.
MIP-stump
4.671 M
10,003 M (2,14x
14135
25714 (1.82x1)
27.06
38.48 (1.42xl)
111
57 (1.9x.)
Unconstrained Poison-splat attack with
0o
Metric
Number of Gaussians
Peak GPU memory [MB]
Training time [minutes]
Render speed [FPS]
Setting
Scene
clean
poisoned
clean
poisoned
clean
poisoned
clean
poisoned
NS- NS-hotdog
0.185 M
4,272
(23.09xt)
3336
47859'
(14.35xt)
8.57
38.85 (4.53xt)
443
29 (15.28x.))
NS-Iego
0.341 M
4.159 (12.20xl)
3532
78852' (22.33xt)
8.62
42,46 (4.93xf)
349
25 (13.96x
NS-mic
0,205 M
3,940 M (19.22x]
3499
61835'
(17.67x1)
8.08
39.02 (4.83x))
300
29 (10.34x.)
NS-ship
0.272 M
4.317
(15.87x))
3692
80956'
(21.93xf)
8.87
44.11 (4.97xf)
326
24 (13.58x.)
TT-Courthuuse
0.604 M
3,388 M (5.61x")
11402
29856'
(2.62xt)
13.81
25.33 (1.83xt)
284
54 (5.26x..
TT-Courtroom
2,890 M
13.196 M (4.57xt)
9896
33871
(3.42x²)
16.88
41.69 (2.47xf)
139
41 (3.39x_)
TT-Museum
4.439 M
16.501 M (3.72xf)
12704
43317" (3.41xt)
19.79
48.89 (2.47xh)
121
36 (3.36x.)
TT-Playground
2.309 M
10.306 M (4.46xf)
8717
27304 (3.13x))
15.17
38.77 (2.56x²)
151
39 (3.87..
MIP-bicycle
5.793 M
25.268 M (4.36xf)
17748
63236
(3.56xt)
33.42
81.48 (2.44xh)
69
16 (4.3l.)
MIP-counter
1.195 M
11.167 M (9.34x))
10750
80732'
(7.51x²)
26.46
62.04 (2.34xf)
164
19 (8.63x.)
MIP-room
1.513
16.019 M (10.59x1)
12316
57540"
(4.67xt)
25.36
76.25 (3.01xt)
154
17 (9.06_.)
MIP-stump
4.671 M
13,550 M (2.90k))
14135
36181
(2.56x1)
27.06
51.51 (1.90x))
111
27 (4.1
3D shapes. Consequently, the poisoned data produced from the projection of this over-densified proxy model can produce more poisoned data, inducing more Gaussians to fit these poisoned data.
4.2 BLACK-BOR ATTACK PERFORMANCE
The attack results described previously assume a white-box scenario, where the attacker is fully aware of the victim system's 's details. In real-world, companies may utilize proprictary algorithms of their own, where the attacker may have no knowledge about their hyper-parameter settings or even their underlying 3DGS representations. This raises an important question: Can Poison-splat remain effective against black-box victim systems?
The answer is affirmative. To test the effectiveness of our attack on black-box victim, we chose Scaffold-GS (Lu et al., 2024b), a 3DGS variant algorithm designed with a focus on efficiency. Scaffold-GS differs significantly from traditional Gaussian Splatting as it utilizes anchor points to distribute local 3D Gaussians, which greatly alters the underlying feature representation. We directly tested Scaffold-GS on the poisoned dataset we crafted for the traditional 3DGS algorithm, making the victim (Scaffold-GS trainer) a black-box model. The results, as presented in Table and Table 5, demonstrate the attack's 's capability to generalize effectively, as evidenced by increased Gaussian parameters, higher GPU memory consumption, and reduced training speed.
The key reason for the success of generalization ability to black- victims is our core intuition: promoting the non-smoothness of input images while maintaining their 3D consistency. This approach

---

Published as a conference paper at ICLR 2025
Table 2: Black-box attack results on NcRF-Synthetic and MIP-NeRF360 dataset. The victim system, Scaffold-SS, utilizes distinctly different Gaussian Splatting feature representations compared to traditional Gaussian Splatting and remains unknown to the attacker. These results demonstrate the robust generalization ability of our attack against unknown black-box victim systems, Full results provided in Table 5,
Metric
Number of Gaussians
Peak GPU memory [MB]
Training time [minutes]
Setting
clean
poisoned
clean
poisoned
clean
poisoned
Scene
Constrained Black-box Poison-splat attack with
16/255 against Scaffold-GS
NS-lego
0.414 M
2.074 (5.01x))
3003
4808 (1.60xt)
9.77
17.91 (1.83xt)
NS-ship
1.000 M
3,291 M (3.29xf)
3492
5024 (1.44xt)
11.68
21.92 (1.88x))
MIP-bonsai
4.368 M
10,608 M (2.43xt)
10080
12218 (1.21x²)
35,33
37.71 (1.07xt)
MIP-stump
6.798 M
14.544 M (2.14xf)
7322
9432 (1.29x1)
33.53
36.32 (1.08xt)
Unconstrained Black-box Poison-splat attack with e = oo against Scaffold-GS
NS-lego
0.414 M
3.973 (9.60x))
3003
6242 (2.08xf)
9.77
26.11 (2.67xt)
NS-ship
1.000 M
4.717 M (4.72xf)
3492
6802 (1.95xt)
11.68
28.22 (2.42xt)
MIP-bonsai
4.368 M
28.042 M (6.42xt)
10080
22115 (2.19xt)
35.33
78.36 (2.22xt)
MIP-stump
6.798 M
34.027 M (5.01xf)
7322
20797 (2.84x1)
33.53
79.64 (2.38x1)
ensures that our poisoned dataset effectively increases the number of 3D-representation units for all adaptive complexity 3D reconstruction algorithms, regardless of the specific algorithm used.
4.3 ABLATION STUDY ON PROXY MODEL
We next ablate the effectiveness of our proxy model. As shown in Figure 3(b), we compare the number of Gaussians produced in victim learning procedures with two baselines: the green curve represents trajectory training on clean data, and the yellow curve represents naive Total Variation maximizing attack, which does not involve a proxy model, but only maximize Total Variation score on each view individually. As show in Figure 3(b), this naive attack is not as effective attack design. We attribute this reason to be lack of consistency of multi- view information. Since the Total Variation loss is local image operator, individually maximizing the TV loss on each image will result in a noised dataset without aligning with each other. As result, victim learning from this noised set of images struggles align shapes in 3D space, and the training on fine details becomes harder to converge. Thus, when faced with conflcctig textures from different views, the Gaussian Splatting technique fails effectively perform reconstruction on details, leading fewer Gaussians produced compared with our attack. We use this study to highlight the necessity of decoy model in our attack methodology design.
4.4 DISCUSSIONS ON NAIVE DEFENSE STRATEGIES
Our attack method maximizes the computational costs of 3DGS by optimizing the number of Gaussians. One may argue that straightforward defense method is to simply impose an upper limit on the number of Gaussians during victim training thwart the attack. However, such straightforward strategy is not as effective as expected. While limiting the number of Gaussians might mitigate the direct impact on computational costs, significantly degrades the quality of 3D reconstruction, demonstrated in Figure 5. The figure shows that 3DGS models trained under these defensive constraints perform much worse compared to those with unconstrained training, particularly in terms of detail reconstruction. This decline in quality occurs because 3DGS cannot automatically distinguish necessary fine details from poisoned textures. Naively capping the number of Gaussians will directly lead to the failure of the model to reconstruct the 3D scene accurately. which violates the primary goal of the service provider. This study demonstrates more sophisticated defensive strategies are necessary to both protect the system and maintain the quality of 3D reconstructions under our attack.

---

Published as a conference paper at ICLR 2025
PSNR: 20.33
PSNR: 19.83
PSNR: 19.03
With Defense
PSNR: 26.89
PSNR: 24.94
PSNR: 29.08
Defense
Bicycle
Flowers
Room
Figure 5: Poison-splat attack cannot be painlessly defended by simply constraining the number of Gaussians during 3DGS optimization. As demonstrated, while this defense can cap the maximum resource consumption, it markedly degrades the quality of 3D reconstruction, in terms of photo- realism and fine- ine-grained details of the rendered images, which violates the primary goal of the service provider.
CONCLUSION AND DISCUSSIONS
This paper uncovers significant yet previously overlooked security vulnerability in 3D Gaussian Splatting (3DGS). To this end, we have proposed novel Poison-splat attack method, which dramati- cally escalates the computational demands of 3DGS and can even trigger Denial-of-Service (e.g., server disruption), causing substantial financial losses for 3DGS service providers. By leveraging sophisticated bi-level optimization framework and strategies such as attack objective approximation, proxy model rendering, and optional constrained optimization, attacks and emphasize the challenges in countering them with naive defenses. To the best of our knowledge, this is the first research work explore attack 3DGS, and the first attack targeting the computation complexity of training phase machine learning systems. We encourage researchers and practitioners in the field of 3DGS acknowledge this security vulnerability and work together towards more robust algorithms and defense strategies against such threats. Lastly, we would like to discuss potential limitations, future directions, and social impacts of our work.
demonstrate the feasibility of such
Limitations and Future directions. There are still limitations of our work, and we expect future studies can work on them:
1. Better approximation of outer maximum optimization. In this work, approximate the outer maximum objective (i.e., the computational cost) with the number of Gaussians. Although the number of Gaussians strongly correlates with GPU memory occupancy and rendering latency, there could be better optimizable metrics for this purpose. For example, the "density" of Gaussians, i.e., the number of Gaussians falling into the same tile to involve in alpha-blending, might be a better metric to achieve better optimization outcomes.
2. Better defense methods. We focus developing attack methods, without delving deeply into defensive strategies. hope future studies can propose more robust 3DGS algorithms develop effective defensive techniques to counteract such attacks. This focus could significantly enhance the security and reliability of 3DGS systems in practical applications.
Ethics Statement. While our methods could potentially be misused by malicious actors to disrupt 3DGS service providers and cause financial harm, aim is not facilitate such actions. Instead, our objective is to highlight significant security vulnerabilities within 3DGS systems and prompt the coamunityy-rsearrcee
practitioners, and providers- to recognize and address these gaps. We aim to inspire the development of more robust algorithms and defensive strategies, enhancing the security and reliability of 3DGS systems in practical applications. We are committed to ethical research and do not endorse using our findings to inflict societal harm.
10

---

Published as a conference paper at ICLR 2025
ACKNOWLEDGEMENT
This project supported in part by NUS Start-up Grant A-0010106-00-000 and by the National Research Foundation, Singapore, and Cyber Security Agency of Singapore under its National Cybersecurity R&D Programme and CyberSG R&D Cyber Research Programme Office (Award: CRPO-GCI-VTU-002)
We sincerely thank Xuanyu Yi (NTU), Xinjie Zhang (HKUST), Jiaqi Ma (WHU) and Shizun Wang (NUS) for their helpful discussions.
REFERENCES
Pandey Akash. Midjourny bans stability ai from using its service: Here's why.
http:///wwwppooeee/////////en//a gilegedddata-sseraaignnnoyr 2024.
Theyazn HH Aldhyani and Hasan Alkahtani. Cyher security for detecting distributed denial service attacks in agriculture 4.0: Deep learning model. Mathematics, 11(1):233, 2023.
Marco Barreno, Blaine Nelson, Anthony D Joseph, and J Doug Tygar. The security of machine learning. Machine Learning. 81:121-148, 2010.
Jonathan T Barron, Ben Mildenhall, Dor Verbin, Pratul P Srinivasan, and Peter Hedman. Mip-nerf 360: Unbounded anti-aliased neural radiance fields. In Computer Vision and Pattern Recognition, pp. 5470-5479, 2022.
Sajal Bhatia, Sunny Behal, and Irfan Ahmed. Distributed denial of service attacks and defense mechanisms: current landscape and future directions. Versatile Cybersecurity, pp. 55-97, 2018.
Battista Biggio, Blaine Nelson, and Pavel Laskov. Poisoning attacks against support vector machines. In International Conference on Machine Learning, pp. 1467-1474, 2012.
Battista Biggio, Igino Corona, Davide Maiorca, Blaine Nelson, Nedim Šındić, Pavel Laskov, Giorgio Giacinto, and Fabio Roli. Evasion attacks against machine learning at test time. In Machine Learning and Knowledge Discovery in Databases: European Conference, ECML. PKDD 2013, Prague, Czech Republic, September 23-27, 2013, Proceedings, Part III 13, pp. 387-402. Springer, 2013.
Dominique Brunet, Edward R Vrscay, and Zhou Wang. On the mathematical properties of the structural similarity index. IEEE Transactions on Image Processing. 2144):1488-149 2011.
Samuel Rota Bulò. Lorenzo Porzi, and Peter Kontschieder. Revising densification in gaussian splatting, arXiv preprint arXiv:4404.06109 2024.
Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert- Voss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Ulfar Erlingsson, al. Extracting training data from large language models. 30th USENIX Security Symposium (USENIX Security 21), pp. 2633-2650, 2021.
Nicolas Carlini, Jamie Hayes, Milad Nasr, Matthew Jagielski, Vikash Schwag, Florian Tramer, Borja Balle, Daphne Ippolito, and Eric Wallace. Extracting training data from diffusion models. In 32nd USENIX Security Symposium (USENIX Security 23), pp. 5253-5270, 2023.
Anirban Chakraborty, Manaar Alam, Vishal Dey, Anupam Chattopadhyay, and Debdeep Mukhopad- hyay. Adversarial attacks and defences: A survey. arXiv preprint arXiv: 1810,00069, 2018.
Varun Chandrasekaran, Kamalika Chaudhuri, Irene Giacomelli, Somesh Jha, and Songbai Yan. Exploring connections between active learning and model extraction. In 29th USENIX Security Symposium (USENIX Security 20), pp. 1 1309-1326, 2020.
Guikun Chen and Wenguan Wang. arXiv:2401.03890 2024.
A survey 3d gaussian splatting.
arXiv preprint

---

Published as a conference paper at ICLR 2025
Simin Chen, Cong Liu, Mirazul Haque, Zihe Song, and Wei Yang. Nmtsloth: understanding and testing efficiency degradation of neural machine translation systems. In ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering, pp- 1148-1160, 2022a.
Simin Chen, Zihe Song, Mirazul Haque, Cong Liu, and Wei Yang. Nicgslowdown: Evaluating the efficiency robustness of neural image caption generation models. In Computer Vision and Pattern Recognition, pp. 15365-15374, 2022b.
Simin Chen, Hanlin Chen, Mirazul Haque, Cong Liu, and Wei Yang. The dark side of dynamic routing neural networks: Towards efficiency backdoor injection. In Computer Vision and Pattern Recognition, pp. 24585-24594, 2023.
Zilong Chen, Feng Wang, and Huaping Liu. Text-to-3d using gaussian splatting. In CVPR, 2024.
Kai Cheng, Xiaoxiao Long, Kaizhi Yang, Yao Yao, Wei Yin, Yuexin Ma. Wenping Wang, and Xuejin Chen. Gaussianpro: 3d gaussian splatting with progressive propagation. arXiv preprint arXiv:2402.14650, 2024.
Christopher A Choquette-Cheee Florian Tramer, Nicholas Carlini, and Nicolas Papernot. Label-only membership inference attacks. In International conference on machine learning, pp. 1964-1974. PMLR, 2021.
Anurag Dalal, Daniel Hagen, Kjell Robbersmyr. and Kristian Muri Knausgård. Gaussian splatting: 3d reconstruction and novel view synthesis, a review. arXiv preprint 2rXiv:2405.03417, 2024.
Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. Boosting adversarial attacks with momentum. In Computer Vision and Pattern Recognition, pp. 9185-9193, 2018.
Yinpeng Dong, Tianyu Pang, Hang Su, and Jun Zhu. Evading defenses to transferable adversarial examples by ionsslationiivariiln attacks. In Computer Vision and Pattern Recognition, pp. 4312- 4321, 2019.
Khaled M Elleithy, Drazen Blagovic, Wang K Cheng, and Paul Sideleau. Denial of service attack techniques: analysis, implementation and comparison. 2005.
Guangehi Fang and Bing Wang. Mini-splatting: Representing scenes with a constrained number of gaussians. arXiv preprint 2403:::20031111666 2024.
Ben Fei, Jingyi Xu, Rui Zhang, Qingyuan Zhou, Weidong Yang, and Ying He. 3d gaussian as a new vision era: A survey, arXiv preprint arX1v:2402.07181, 2024.
Liam Fowl, Ping-yeh Chiang, Micah Goldblum, Jonas Geiping, Arpit Bansal, Wojtek Czaja, and Tom Goldstein. Preventing unauthorized use of proprietary data: Poisoning for secure dataset release. arXiv preprint arXiv:2103.02663 2021a.
Liam Fowl, Micah Goldblum, Ping-yeh Chiang, Jonas Geiping, Wojciech Czaja, and Tom Goldstein. Adversarial examples make strong poisons. Advances in Neural Information Processing Systems, 14:30139-30351, 2021b.
Matt Fredrikson, Somesh Jha, and Thomas Ristenpart. Model inversion attacks that exploit confi- dence information and basic countermeasures. In ACM SIGSAC Conference Computer and Communications Security, pp. 1322-1333. 2015.
Yonggan Fu, Ye Yuan, Souvik Kundu, Shang Wu, Shunyao Zhang, and Yingyan Lin. Nerfool: Un- covering the vulnerability of generalizable neural radiance fields against adversarial perturbations. In International Conference on Machine Learning, 2023.
Kuofeng Gao, Yang Bai, Jindong Gu, Shu-Tao Xia, Philip Torr, Zhifeng Li, and Wei Liu. Induc- ing high Sacrgy-latency of large vision- vision-languag models with verbose images. In The Twelfth International Conference on Learning Representations, 2023.
12

---

Published as a conference paper at ICLR 2025
Jonas Geiping, Hartmut Bauermeister, Hannah Dröge, and Michael Moeller. Inverting gradients- easy is it to break privacy in federated learning? Advances in Neural Information Processing Systems, 33:16937-16947, 2020.
Google. Google announces new google maps experience featuring neural radiance fields
(nerfs). http://aaddaanccceell.cco//////o wawm//google-nnonnee----ee www--gooll--ms-eeeeeeeeeeeeeeeee neural-radiance-feldds 2023.
Sanghyun Hong, Yigitean Kaya, lonut-Vlad Vlad Modoranu, and Tudor Dumitraş. A panda? no, it's
sloth: Slowdown attacks adaptive multi-exit neural network inference. arXiv preprint arXiv:2010.02432, 2020.
András Horváth and Csaba M Józsa. Targeted adversarial attacks on generalizable neural radiance fields. In International Conference on Computer Vision, pp. 3711-37777, 2023.
W Ronny Huang, Jonas Geiping, Liam Fowl, Gavin Taylor, and Tom Goldstein. Metapoison: Practical general-purpose clean-label data poisoning. Advances in Neural Information Processing Systems, 33:1 33:12080-12091 2020.
Matthew Jagielski, Alina Oprea, Battista Biggio, Chang Liu, Cristina Nita-Rotaru, and Bo Li. Manipulating machine learning: Poisoning attacks and countermeasures for regression learning. In 2018 IEEE symposium on security and privacy (SP), pp. 19-35. IEEE, 2018.
Nikhil Keetha, Jay Karhade, Krishna Murthy Jatavallabhula, Gengshan Yang. Sebastian Scherer, Deva Ramanan, and Jonathon Luiten. Splatam: Splat, track and map 3d gaussians for dense rgb-d slam. In Computer Vision and Pattern Recognition, 2024.
Bernhard Kerbl, Georgios Kopanas, Thomas Leimkühler, and George Drettakis. 3d gaussian splatting for real-time radiance field rendering. ACM SIGGRAPH, 42(4), 2023.
KIRI. Kiri engine app. seaepphhones-fo--t---------e-eee http://wwwww.iiiiiioooooggggg/ga
Arno Knapitsch, Jaesik Park, Qian-Yi Yi Zhou, and Vladlen Koltun. Tanks and temples: Benchmarking large-scale scene reconstruction. ACM Transactions on Graphics, 36(4), 2017.
Muhammed Kocabas, Jen-Hao Rick Chang, James Gabriel, Oncel Tuzel, and Anurag Ranjan. HUGS: Human gaussian splatting. In 2024 IEEE/CVF Conference Computer Vision and Pattern Recognition (CVPR), 2024. URL https: http//aaxvivv// org/orgg//...o. /bt.//1..///1111
Pang Wei Koh and Percy Liang. Understanding black-box predictions via influence functions. In International conference on machine learning, pp. 1885-1894, PMLR, 2017.
Pang Wei Koh, Jacob Steinhardt, and Percy Liang. Stronger data poisoning attacks break data sanitization defenses. Machine Learning, pp. 1-47, 2022.
Jiahui Lei, Yufu Wang, Georgios Pavlakos, Lingjie Liu, and Kostas Daniilidis. Gart: Gaussian articulated template models. In 2024 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2024. URL U http:::///xxvvvvo.. org. abs /2t...16111........1111111111111
Bo Li, Yining Wang, Aarti Singh, and Yevgeniy Vorobeychik. Data poisoning attacks on factorization- based collaborative filtering. Advances in neural information processing systems, 29, 2016
Yanyan Li, Chenyu Lyu, Yan Di, Guangyao Zhai, Gim Hee Lee, and Federico Tombari. Geogaussian: Geometry-aware gaussian splatting for scene rendering. arXiv preprint arXiv:2403. 1324, 2024.
Neil Long and Rob Thomas. Trends in denial of service attack technology. CERT Coordination Center, 648(651):569) 2001.
Jiahao Lu, Xi Sheryl Zhang, Tianli Zhao, Xiangyu He, and Jian Cheng. April: Finding the achilles' heel on privacy for vision transformers. In Computer Vision and Pattern Recognition, pp. 10051- 10060, 2022.
Jiahao Lu, Xingyi Yang, and Xinchao Wang. Unsegment anything by simulating deformation. In Computer Vision and Pattern Recognition, pp. 24294-24304, 2024a.
13

---

Published as a conference paper at ICLR 2025
Tao Lu, Mulin Yu, Linning Xu, Yuanbo Xiangli, Limin Wang, Dahua Lin, and Bo Dai. Scaffold-gs: Structured 3d gaussians for ziew-adaptive rendering. In Computer Vision and Pattern Recognition, pp. 200654-20664, 2024b.
Jonathon Luiten, Georgios Kopanas, Bastian Leibe, and Deva Ramanan, Dynamic 3d gaussians: Tracking by persistent dynamic view synthesis. In 3DV, 2024.
LumaAL. Luma ai. https://umalabs.aai..
Aleksander Madry. Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant adversarial attacks. In ICLR, 2018.
Hidenobu Matsuki, Riku Murai, Paul J. Kelly, and Andrew Davison. Gaussian Splatting SLAM. In Computer Vision and Pattern Recognition, 2024.
Shike Mei and Xiaojin Zhu. The security of latent dirichlet allocation. In Artificial Intelligncce and Statistics, pp. 681-689. PMLR, 2015a.
Shike Mei and Xiaojin Zhu. Using machine teaching to identify optimal training-set attacks on machine learners. In AAAI, volume 29, 2015b.
Ben Mildenhall, Pratul P Srinivasan, Matthew Tancik, Jonathan T Barron, Ravi Ramamoorthi, and Ren Ng. Nerf: Representing scenes neural radiance fields for view synthesis. Communications of the ACM, 65(1):99-106, 2021.
Jelena Mirkovic and Peter Reiher. A taxonomy of ddos attack and ddos defense mechanisms. ACM SIGCOMM Computer Communication Review, 34(2):39-53, 2004.
Luis Muñoz-Goovález, Battista Biggio, Ambra Demontis, Andrea Paudice, Vasin Wongrassamee, Emil C Lupu, and Fabio Roli. Towards poisoning of deep learning algorithms with back-gradient optimization. In ACM workshop on artificial intelligence and security, pp. 27-38, 2017.
Daryna Oliynyk, Rudolf Mayer, and Andreas Rauber. know what you trained last summer: A survey on stealing machine learning models and defences. ACM Computing Surveys, 2023.
Nikolaos Pitropakis, Emmanouil Panaousis, Thanassis Giannetsos, Eleftherios Anastasiadis, and George Loukas. A taxonomy and survey of attacks against machine learning. Computer Science Review, 34:100199, 2019.
Polycam. Polycam. https://poll.cam/priicee
Maria Rigaki and Sebastian Garcia. A survey of privacy attacks in machine learning. ACM Computing Surveys, 56(4):1-34, 2023.
Leonid Rudin, Stanley Osher, and Emad Fatemi. Nonlinear total variation based noise removal algorithms. Physica D: nonlinear phenomena, 60(1-4):259 2205999--68111 1992.
Ahmed Salem, Yang Zhang. Mathias Humbert, Mario Fritz, and Michael Backes. MI-leaks: Model and data independent membership inference attacks and defenses machine learning models, In Network and Distributed Systems Security Symposium 20/9. Internet Society, 2019.
Qiuhong Shen, Xuanyu Yi, Zike Wu, Pan Zhou, Hanwang Zhang, Shuicheng Yan, and Xinchao Wang. Gamba: Marry gaussian splatting with mamba for single view 3d reconstruction. arXiv preprint arXiv:2403. 18795, 2024.
Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership inference attacks against machine learning models. In 2017 IEEE symposium on security and privacy (SP), pp. 3-18. IEEE, 2017.
Ilia Shumailov, Yiren Zhao, Daniel Bates, Nicolas Papernot, Robert Mullins, and Ross Anderson. Sponge examples: Energy-latency attacks on neural networks. In 202/ IEFE European symposium on security and privacy (EuroS&P), pp. 212-231. IEEE, 2021.
Spline. Spline. https//Appiine.eesiiprpiiiigg
14

---

Published as a conference paper at ICLR 2025
Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, lan Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6699, 2013.
Jiaxiang Tang, Jiawei Ren, Hang Zhou, Ziwei Liu, and Gang Zeng. Dreamgaussian: Generative gaussian splatting for efficient 3d content creation. In ICLR, 2024.
Zhiyi Tian, Lei Cui, Jie Liang, and Shui Yu. A comprehensive survey on poisoning attacks and countermeasures in machine learning. ACM Computing Surveys, 55 2022.
Carlo Tomasi and Roberto Manduchi. Bilateral filtering for gray and color images. In Sixth international conference on computer vision (IEEE Cat. No. 98CH36271), pp. 239-846. IEEE, 1998.
Florian Tramèr, Fan Zhang, Ari Juels, Michael K Reiter, and Thomas Ristenpart. Stealing machine learning models via prediction (APIs). In 25th USENIX security symposium (USENIX Security 16), pp. 601-618, 2016.
Shizun Wang. Xingyi Yang, Qiuhong Shen, Zhenxiang Jiang, and Xinchao Wang. Gflow: Recovering 4d world from monocular video. arXiv preprint arXiv:2405.18422 2024a.
Yuxuan Wang, Xuanyu Yi, Zike Wu, Na Zhao, Long Chen, and Hanwang Zhang, View-consistent 3d editing with gaussian splatting. arXiv preprint arXiv:2403. / 1868, 2024b.
Guanjun Wu, Taoran Yi, Jiemin Fang, Lingxi Xie, Xiaopeng Zhang, Wei Wei, Wenyu Liu, Qi Tian, and Wang Xinggang. 4d gaussian splatting for real-time dynamic scene rendering. In CVPR, 2024a.
Tong Wu, Yu-Jie Yuan, Ling-Xiao Zhang, Jie Yang, Yan-Pei Cao, Ling-Qi Yan, and Lin Gao. Recent advances in 3d gaussian splatting. arXiv preprint arXiv:2403.11134 2024b.
Shaoyuan Xie, Zichao Li, Zeyu Wang, and Cihang Xie. On the adversarial robustness of camera-based 3d object detection. Transactions on Machine Learning Research, 2024a.
Tianyi Xie, Zeshun Zong, Yuxing Qiu, Xuan Li, Yutao Feng, Yin Yang, and Chenfanfu Jiang. Physgaussian: Physics-integrated 3d gaussians for generative dynamics. In CVPR, 2024b.
Chi Yan, Delin Qu, Dan Xu, Bin Zhao, Zhigang Wang. Dong Wang, and Xuelong Li. Gs-slam: Dense visual slam with 3d gaussian splatting. In CVPR, 2024a.
Zhiwen Yan, Weng Fei Low, Yu Chen, and Gim Hee Lee. Multi-scale 3d gaussian splatting for anti-aliased rendering. In Computer Vision and Pattern Recognition, pp. 20923-20931, 2024b.
Zeyu Yang, Hongye Yang, Zijie Pan, and Li Zhang. Real-time photorealistic dynamic scene rep- resentation and rendering with 4d gaussian splatting. In International Conference on Learning Representations (ICLR), 2024.
Mingqiao Ye, Martin Danelljan, Fisher Yu, and Lei Ke Gaussian grouping: Segment and edit anything in 3d scenes. arXiv preprint arXiv:2312.00732, 2023.
Zongxin Ye, Wenyu Li, Sidun Liu, Peng Qiao, and Yong Dou. Absgs: Recovering fine details for 3d gaussian splatting. arXiv preprint arXiv:2404. 1044444444444 2024.
Taoran Yi, Jiemin Fang, Junjie Wang, Guanjun Wu, Lingxi Xie, Xiaopeng Zhang, Wenyu Liu, Qi Tian, and Xinggang Wang. Gaussiandreamer: Fast generation from text to 3d gaussians by bridging 2d and 3d diffusion models. In CVPR, 2024.
Weichen Yu, Tianyu Pang, Qian Liu, Chao Du, Bingyi Kang, Yan Huang, Min Lin, and Shuicheng Yan. Bag of tricks for training data extraction from language models. In International Conference on Machine Learning. ICML 23. JMLR.org, 2023.
Zehao Yu, Anpei Chen, Binbin Huang, Torsten Sattler, and Andreas Geiger. Mip-splatting: Alias-free 3d gaussian splatting. In Computer Vision and Patlern Recognition, pp. 19447-19456, 2024.
15

---

Published as a conference paper at ICLR 2025
Yifan Zhang, Bryan Hooi, Dapeng Hu, Jian Liang, and Jiashi Feng. Unleashing the power of contrastive self- supe-vupe visual models via contrast-regulare fine-tuning. In Advances in Neural Information Processing Systems, volume 34, pp. 29848 298600, 2021.
Yifan Zhang, Bingyi Kang, Bryan Hooi, Shuicheng Yan, and Jiashi Feng. Deep long-tailed learning: survey, IEEE Transactions Pattern Analysis and Machine Intelligence, 45(9):10995-18816 2023.
Ziqi Zhou, Yufei Song, Minghui Li, Shengshan Hu, Xianlong Wang, Leo Yu Zhang, Dezhong Yao, and Hai Jin. Darksam: Fooling segment anything model to segment nothing. In Annual Conference on Neural Information Processing Systems.
Wojciech Zielonka, Timur Bagautdinov, Shunsuke Saito, Michael Zollhöfer, Justus Thies, and Javier Romero. Drivable 3d gaussian avatars. arXiv preprint arXiv:231 1,08581, 2023.
16

---

Published as a conference paper at ICLR 2025
APPENDIX
The Appendix is organized as follows: Section A discusses related works; Section B provides formal and comprehensive description of 3D Gaussian Splatting training. Section C explicitly describes the threat model in this paper, aiming to provide readers with a clearer understanding. Section D offers the full results of experiments mentioned in the main paper, presented here due to page constraints. Section E lists all the notations used throughout the paper. Section F presents examples of tttacker-crafter poisoned images and the corresponding reconstructions from victim models trained with those images. Section G reports the attack performance under various levels of = 24/255. Section H studies how effective the
perturbation intensity, ranging from 8/255 Poison-Splat attack will be if the poison ratio is not 100%. Section I shows the defensive threshold of limiting Gaussian numbers and discuss the difficulty of setting a uniform defense threshold. Section J discusses another potential defense: image smoothing as a pre-processing, and shows that it is not an ideal defense in terms of keeping reconstruction quality. Section K reports and analyzes the time complexity of Doison-Splat attack.
A RELATED WORKS
A.1 3D GAUSSIAN SPLATTING
3D Gaussian Splatting is receiving overwhelming popularity in the 3D vision domain (Chen & Wang, 2024; Fei et al., 2024; Wu et al., 2024b; Dalal et al., 2024). The explicit nature of 3D Gaussian Splatting enables real-time rendering capabilities and unparalleled levels of control and editability, demonstrating its effectiveness in 3D generation. Since its introduction in (Kerbl et al., 2023), 3D Gaussian Splatting has facilitated diverse array of downstream applications, including text-to-3D generation (Chen et al., 2024; Tang et al., 2024; Yi et al., 2024), Simultaneous Localization and Mapping (Keetha al., 2024; Matsuki al., 2024; Yan et al., 2024a), human avatars (Kocabas et al., 2024; Lei et al., 2024; Zielonka et al., 2023), 4D-dynamic scene modeling (Luiten et al., 2024; Wu al., 2024a; Yang et al., 2024), and other applications (Xie al., 2024b; Shen et al., 2024; Ye et al., 2023; Wang et al., 2024b;a).
While the majority of the audience in the 3D vision community places their focus on utility, we found only handful of research works put efforts into investigating the security issues of 3D algorithms. Xie et al. (2024a) analyzed the resilience of 3D object detection systems under white-box and black-box attacks. (Fu et al., 2023; Horváth & Józsa, 2023) proposed attacks against Neural Radiance Fields (NeRFs). To our knowledge, this the first attack ever proposed for 3D Gaussian Splatting systems.
A.2 ATTACKS ON MACHINE LEARNING SYSTEMS
Machine learning has been shown to be vulnerable to various types of attacks (Pitropakis et al., 2019; Rigaki & Garcia, 2023; Chakraborty al., 2018; 8; Oliynyk al., 2023; Tian et al., 2022; Zhang et al., 2021; 2023). The majority of attacks target the either confidentiality (including membership inference (Shokri et al., 2017; Salem et al., 2019; Choquette- Cayue et al., 2021), data reconstruction attacks (Fredrikson et al., 2015; Carlini et al., 2021; 2023; Yu et al., 2023; Geiping et al., 2020; Lu et al., 2022) and model stealing attacks (Tramèr al., 2016; Chandrasekaran et al., 2020)) or integrity (like adversarial attacks (Biggio et al., 2013; Szegedy et al., 2013; Dong et al., 2018; 2019; Lu et al., 2024a; Zhou et al.) and data poisoning attacks (Barreno al., 2010; Jagielski et al., 2018; Biggio et al., 2012; Mei & Zhu, 2015b)). Different from the above mentioned attacks, we aim to illustrate that by carefully crafting input images, the attacker can indeed attack availability, i.e., timely and cost-affordable access to machine learning service. The most similar research is the work by Shumailov et al. (2021), which is the first Denial-of-SSe Service (DoS) attack towards machine learning systems. It proposed sponge examples which can cause much more latency and energy consumption for language models and image classifiers, driving deep learning models to their worst performance. Different from the work (Shumailov et al., 2021), our attack targets 3D reconstruction algorithms and is not driven by neural networks.
17

---

Published as a conference paper at ICLR 2025
A.2.1 DATA POISONING ATTACKS
We consider our proposed attacks to fall into the category of data poisoning attack, which manipulates training data to launch the attack at the training stage. The attacker makes the first move to craft poisoned training samples, and the victim has a goal of training the system based on samples provided by the attacker. Solving this problem typically involves solving max-min bi-level optimization problem, where the attacker wants to maximize some adversarial loss (i.e., test error or computational cost) and victim wants to minimize the training objective (i.e., training loss). Different literature solves the problem using different techniques (Biggio et al., 2012; Mei & Zhu, 2015;;a; Li et al., 2016). For many machine learning systems, given the inherent complexity and their reliance on large datasets, it is intractable to exactly do the bi-level optimization. The work Mluuooz-Gonzále et al., 2017) exploited back-gradient optimization technique to approximate real gradients through reverse-mode differentiation. The work (Huang et al., 2020) formulated and approximated the inner optimal solution by training only K SGD steps for each outer objective evaluation. The work (Koh et al., 2022) proposed three methods to approximate the expensive bi-level optimization: influence functions (Koh & Liang, 2017), minimax duality and Karush- Kuhnh Tuuker (KKT) conditions. The work (Fowl et al., 2021a) used gradient matching which assumes inner optimality has been achieved by a fixed model. The work (Fowl et al., 2021b) avoided the bi-level optimization with well-trained proxy model from clean data. Different from these previous studies, we propose gradient- ffree optimization process to solve the outer optimization pipeline, and show a good optimization result on the attacker's goal.
meta-learning problem,
A.2.2 ENERGY-LATENCY ATTACKS MACHINE LEARNING
A limited number of studies have investigated attacks to manipulate the computation cost needed for machine learning systems, mainly in inference-stage. Shumailov et al. (2021) initially brought people's attention to sponge samples, which are malicious samples able maximize the energy consumption and responsive latency of neural network. Following this work, there are other works studying samples which can cause the worst case computation resource consumption in a (dynamic) machine learning systems, for example Hong et al. (2020) and Chen et al. (2023) found samples that can necessitate late exit in dynamic-depth neural network. More up-to-date works utilize the flexible nature of language to attack NLP models, inducing extended natural language sequence responses to over-consume energy and latency (Chen et al., 2022b;a; Gao et al., 2023). However, to the best of our knowledge, there has been previous work targeting Denial-of-See -f--viiec attacks at the training stage of machine learning systems. Our work is pioneering in proposing a DoS attack specifically designed for the training phase of machine learning systems. Additionally, this is also the first effort to develop an attack against 3D Gaussian Splatting.
B MORE BACKGROUNDS OF 3D GAUSSIAN SPLATTING
3D Gaussian Splatting (3DGS) (Kerbl et al., 2023) has revolutionized the 3D vision community with its superior performance and efficiency. models 3D scene by learning a set of 3D Gaussians G {G.} from multi-vier images D (Ve, Ps R= where each view consists of ground-truth image VA2 and the corresponding camera poses Px- We denote N as the total number of image-pore pose pairs in the training data, which can be arbitrary and unfixed in 3DGS. As for the model, each 3D Gaussian G (14, 8i, 02 qi, G, } has 5 optimizable parameters: center coordinates μ4; E R.3 scales s; E 33, opacity a; IR. rotation quaternion 9i E R and associated view-dependent color represented as spherical harmonics e; E 33d+1)) where is the degree of spherical harmonics.
To render G from 3D Gaussian space to 2D images, each Gaussian is first projected into the camera coordinate frame given a camera pose Pa to determine the depth of each Gaussian, which is the distance of that Gaussian to the camera view. The calculated depth is used for sorting Gaussians from near to far, and then the colors in 2D image are rendered in parallel by alpha blending according to the depth order of adjacent 3D Gaussians. The core reason for 3DGS to achieve real-time optimization and rendering lies in this bale- differentiable rasterization pipeline. We denote the 3DGS renderer as function R, which takes as input the Gaussians G and camera pose Ps to render an image VV = RGG Pa).
18

---

Published as a conference paper at ICLR 2025
The training is done by optimizing the reconstruction loss between the rendered image and ground truth image for each camera view, where the reconstruction loss is combination of L1 loss and structural similarity index measure (SSIM) loss D.SSIM:
min L(D) = min C(Vi V4) min E ()CIV VR) + ACD-SSI((V,, Vs),
(6)
k=1
where À is a trade-off parameter. To ensure finer reconstruction, Gaussian Splatting deploys adaptive density control automatically add remove Gaussians from optimization. The process of adding Gaussians, known as densification, involves two primary operations: splitting and cloning, Conversely, removing Gaussians, called pruning, indicates eliminating a Gaussian from the set of optimization variables. Both densification and pruning are non-differentiable operations. The adaptive density control is performed during regular optimization intervals and follows specific, predefined rules. the initial design (Kerbl et al., 2023), for Gaussian G, with view-space projection point μ (uf p under viewpoint Vx, the average view-space positional gradient V C is calculated every 100 training iterations (Ye et al., 2024):
M. k=
Op
M
where . is the total number of views that the Gaussian G2 participates in calculation during the 100 iterations (Ye et al., 2024) and M is usually less than N. Densification is performed when the view-space positional gradient V, y. C is larger than a pre-set gradient threshold Ty (by default 0.0002). Moreover, the decision to split or clone Gaussian G; is based on its scale vector 8i, which is compared with scale threshold r, it is split if larger, and cloned if smaller. Pruning occurs when the opacity a; falls below the opacity threshold Ta We also notice some recent 3DGS studies (Cheng al., 2024; Fang & Wang, 2024; Li al., 2024; Buld et al., 2024) that adopt different yet still pre-defined densification rules.
C THREAT MODEL
We provide structured description of the attack's goal, input, output, information and constraints in this section, to provide more clarity of the threat model:
Attacker Goal: To increase the computation cost and over-consume computation resource of 3DGS service provider.
Attacker Input: Clean data.
Attacker Output: Poisoned data by running attack on the clean data.
Attacker Information: Attacker doesn't 't need to know the underlying hardware device of the victim.
White-box: Attacker knows the specific 3DGS configuration of the victim.
Black-box: Attacker only knows victim is using 3DGS, but does not know which variant of 3DGS representation and what configuration the victim is using.
Attacker Constraint: Attacker can optionally choose constrain the perturbation range of his additive perturbation to add on clean data.
Attacker Algorithm: Algorithm 1.
19

---

Published as a conference paper at ICLR 2025
Table 3: Full constrained attack results (e = 16/255) on all scenes from the NeRF-Synthetic, MIP- NeRF360 and Tanks-and- and-Temples datasets. All results are reported by averaging over three individual runs.
Construined Poison-splat uttack with
16/255
Metric
Number of Gaussians
Peak GPU memory [MB]
Training time [minutes]
Render speed [HPS]
Setting
clean
poisoned
clean
poisoned
clean
poisoned
clean
poisoned
Scene
NS-chuir
0.494 M
0.957 M (1.9x1))
3752
8003 (2. 13x1)
9.45
13.41 (1.42x")
260
117 (2.22x
NS-drums
0.385
116955
(1.81x1)
3456
7190 (2.08x())
8.75
(1.36x")
347
(2.41x.))
NS-ficus
0.265 M
0.273 M (1.03xt)
3194
3783 (1.18x7)
6.99
8.94 (1.28xf)
346
337 (1.03x.))
NS-hotdog
0.185 M
1.147
M (6.20xt)
3336
29747' (8.92xt)
8.57
17.43 (2.03x*)
443
69 (6.42x.)
NS-Iego
0.341
0.805
(2.36x1)
3532
9960 (2.82x1)
8.62
13.02 (1.51x")
349
(2.41x.)
NS- IS-materials
0.169 M
0.410 M (2.43xt)
3172
4886 (1.54x1))
7.33
9.92 (1.35xf)
447
250 (1.79x.)
NS-mic
0.205 M
0.359 M (1.75xt)
3499
6437 (1.84x7)
8.08
10.96 (1.36x")
300
172 (1.74x))
NS-ship
0.272
1.071 (3.94x1)
3692
16666 (4.51x1)
8.87
16.12 (1.82x")
326
(3.75xL)
MIP-bicyele
5.793
10.129 M (1.75xt)
17748
27074
(1.53xf))
33.42
44.44 (1.33x")
69
(1.60x.)
MIP-bonsai
1.294 M
6,150 M (4.75x1)
10216
20564 (2.01x1)
21. 68
32,51 (1.50x")
214
66 (3.24x
MIP-counter
1.195
4.628 M (3.87x1)
10750
29796' (2.77xt)
26.46
37.63 (1.42x")
164
(3.22xL)
MIP-flowers
3.508
5.177 (L48xt))
12520
16338 (1.30xt)
25.47
30.05 (1.18x")
124
(1.39kL)
MIP-garden
5.684 M
7.697 M (1.35x))
17561
23115 (1.32x))
33.19
40.82 (1.23x")
81
54 (1.50x
MIP-kitchen
1.799
6,346 M (3.53x1)
12442
20902 (1 (1.68xt)
26.61
43.24 (1.62x")
133
46 (2.89x))
MIP-room
LS133
7.129 (4.71xf)
12316
46238 (3.75xt)
25.36
(1.89x")
154
(4.40xL)
MIP-stump
4.671 M
10,003 M (2.14x))
14135
25714 (1.82x()
27,06
38.48 (1.42x")
111
57 (1.95x.)
MIP-trechill
3,398 M
5.684 M (1.6x1)
11444
17287 (1.51x))
22.76
29.26 (1.29x*)
123
70 (1.76x
TT-Auditorium
0.699 M
2,719 M (3.89x1)
5982
14532 (2.43xt)
12.69
19.05 (1.50x")
266
100 (2.66x.)
TT-Ballroom
3.103
3,957 (L.28x))
10416
12226 (1.17x))
20.37
(1.10x")
96
(1.13xL)
TT-Barn
1.005 M
1.865 M (1 16x
7813
10470 (1.3xx))
13.10
16.27 (1.24x")
229
127 (1x8
TT-Caterpillar
1,290 M
1.857 M (1 (1x44x)
6624
8014 (1.21x1)
11.96
14.77 (1.23x")
228
164 (1.39x
TT-Church
2.351
3.396 (1.4xxt)
10076
11797 (1.17xt)
17.43
(1.18x")
132
(1.36xL)
IT-Courthouse
0.604 M
0.733 M (1.21x))
14402
12688 (L.1Ix))
13.81
14.49 (1.05x")
284
220 (1x29x
TT-Courtroom
2,890 M
5,450 M (1 1981
9896
16308 (1.65x))
16.88
23.92 (1.42x")
139
83 (1.67x))
TT. Family
2.145
3,734 (1.74xt)
7261
10707 (1.47x()
13.58
(1.36x")
182
(1 (1.44.])
TT-Francis
0.759 M
1.612 M (2.12xt)
5208
6938 (1.33xT)
10.19
13.92 (1.37x*)
279
168 (1 66
TT-Horse
L,308 M
2,510 M (1 (1.2x())
5125
7762 (1.51x1)
12.05
16.47 (1.37x")
220
121
82x
TT-Ignatius
3.144
3,937 (1 (1.25xt)
9943
11800 (1.19xt)
16.32
18.52 (1.13x")
149
(1 (1.26x.)
TT-Lighthouse
0.888 M
1.178 M (1.33xt)
7466
8696 (1.16X))
14,21
15.92 (1.12x")
213
163 (1.3lxL)
TT-M60
1.667 M
2,980 M (1 (1.9x()
7948
10874 (1.37x1)
14.08
18.22 (1.29x*)
200
107 (1.87x
TT-Meetingroom
1.267
2,927 (2.31xf)
6645
10234 (1.54x()
13.53
18.97 (1.40x")
197
(1 (1.93x.)
TT- Museuni
4.439 M
7.130 M (1.61x))
12704
18790 (1.48xf)
19.79
26.38 (1.33x")
121
78 (1.55xL)
TT-Palace
0.711 M
0.696 M (0.98x))
8980
8372 (0.93x1)
14.27
14.54 (1.02x")
185
186 (0.99x
TT-Panther
1.812
3.457 (1.91xf)
8511
12048 (1 (2x42)))
13.49
19,46 (1.44x")
199
(1.93x.)
TT- Playground
2.309
4.307 M (1.87t))
8717
13032 (1.50xt)
15.17
21.82 (1.44x")
151
87 (1.74x))
TT- Temple
0.893 M
1.345 M (L.1xx))
6929
7525 (1.09xT)
13.03
15.26 (1.17x")
216
149 (1445x))
TT-Train
1.113
1,332 (1.20xf)
6551
7128 (1. (1.09x1)
12.64
13.62 (1.08x")
193
163 (1.18x))
TT
2.533
3,630 M (1.43x1)
8662
11014 (1.27x1)
14.64
20.12
1,56
88 (1.778L)
D EXTENDED EXPERIMENTS
D.1 FULL ATTACK RESULTS
We report the constrained attack results with 16/255 on all scenes of NeRF-Synthetic, Mip- NeRF360 and Tan -en-eesee dataset in Table 3, and the unconstrained attack results in Table 4.
20

---

Published as a conference paper at ICLR 2025
Table 4: Full unconstrained attack results (c = oc) on all scenes from the NeRF-Synthetic, MIP- NeRF360 and Tanks-and and-Templee datasets. All results are reported by averaging over three individual runs.
Unconstrained Polson-splat attack with
Metric
Number of Gaussians
Peak GPU memory [MB]
Training time [minutes]
Render speed (FPS)
Setting
clean
poisoned
clean
poisoned
clean
poisoned
clean
poisoned
Scene
NS. WS-chair
0.494 M
4.152 M (8.40x1)
3752
51424"
(13.71x1)
9.45
40.71
(4.31xf)
260
(9.63x_)
NS- -S-drums
0,385 M
4,109 M (10.67x))
3456
62328'
(18.03x1)
8.75
43.25 (4.94x))
347
24 (14,46x.)
NS. ficus
0.265 M
3.718 M (14.03xt)
3194
50450"
(15.80xt)
6.99
36.92 (5.28xf)
346
31 (11.16x.)
NS-hotdog
0.185 M
4.272 M (23.09xt)
3336
47859' (14.35x1)
8.57
38.85 (4.53xt)
443
29 (15.28x
NS- lego
0,341 M
4.159 M (12.20xl)
3532
78852"
(22.33xt)
8.62
42.46 (4.93xf)
349
25 (13.96x.])
NS-materials
0.169 M
3,380
(20.00xt)
3172
43998'
(13.87xt)
7.33
32.40 (4.42xf)
447
37 (12.08x
NS-
0,205 M
3,940 M (19.22xt)
3499
61835'
(17.67xt)
8.08
39.02 (4.83xf)
300
29 (10.34x_))
NS-ship
0.272 M
4.317 M (15.87x1)
3692
80956'
(21.93xt)
8.87
44.11 (4.97xf)
326
24 (13.58x
MIP- bicycle
5.793 M
25.268 M (4.36xt)
17748
632236
(3.56xt)
33.42
81.48 (2.44xf)
69
16 (4.31x.)
MIP-bonssi
1.294 M
20.127 M (15.55x7)
10216
54506' (5.34x))
21.68
18.18 (3.47xx))
214
18 (1
MlP-counter
1,195 M
11.167 M (9.34x1)
10750
80732
(7.51x7)
26.46
62.04 (2.34xT)
164
19 (8.63x.)
MIP-flowers
3,508 M
18.075 M (5.15xt)
12520
45515'
(3.64x²)
25.47
62.62 (2.46xt)
124
24 (5.17x.)
Mir-ga
5.684 M
21.527 M (3.79xt)
17561
52140 (2.97x²)
33.19
83.81 (2.53x))
81
17 (4.76x.)
MIP-kitchen
1.799 M
12,830 M (7. (3.13xt)
12442
77141
(6.20x1)
26.61
73.04 (2.74x))
133
16 (8.)
MIP-room
1,513 M
16.019 (10.59x7)
12316
57540
(4.67xt)
25.36
76.25 (3.01xT)
154
17 (9.06x.)
MIP-stump
4.671 M
13,550 M (2.90xf)
14135
36181
(2.56x1)
27.06
51.51 (1.90x))
111
27 (4.L
MIP-treehill
3.398 M
13.634 M (4.01xt)
11444
36299
(3.17x1)
22.76
52.83 (2.32xt)
123
24 (5.12
TT-Auditorium
0.699 M
4.153 M. (5. (5.94xt)
5982
12666
(2. 12xf)
12,69
22.50 (1.77xt)
266
76 (3.50x)
TT-Ballrom
3,103 M
7.534 M (2.43xt)
10416
19832 (1.90x))
20.37
33.63 (1.65x()
96
46 (2.09x)
TT-Bam
1.005 M
5,456 M (5 (3x()
7813
5662 (2.01xf)
13. 10
26.10 (1 (1.99xt)
229
61 (3.75x.
CT-Caterpillar
1,290 M
6,980 (5.41xt)
6624
(2. 85KT)
11,96
29.51 (2.47xt)
(4.30x.
TT-Church
2,351 M
7,564 M (3. (.22xx)
10076
21296
(2x1
17.43
33,39 (1 (1.92x))
132
43 (3.07_)
TT. Courthouse
0.604 M
3,388 M (5.61xf)
11402
29856
(2.62x1)
13.81
25.33 (1 (1.83x))
284
54 (5. (6x
IT-Courtromm
2.890 M
13. 19669966 M (4.57x))
9896
33871
(3,42x1)
16.88
41.69 (2.47xt)
139
(3.39x.)
TT Family
2,145 M
11.700 M (5.45xf)
7261
27533'
(3.79x7)
13.58
38.79 (2.86xT)
182
43 (4.23xL)
Francis
0.759 M
7,435 M. (9 (Dxx
5208
19777 (3 80x
10.19
31.01 (3. (3.04kt)
279
(7.)
TT- Horse
1.308 M
9.358 M (7.15xt)
5125
22756 (4.44xT)
12.05
34,90 (2. (2.90xt)
220
46 (4.78x))
TT-Ignatius
3,144 M
11.278 M (3 ()
9943
28895' (2.91x1)
16.32
39.61 (2.43xT)
149
42 (3.55x.)
Lightsossss
0.888 M
5.081 (5.72xt)
7466
23842 (3.19x7)
14.21
30.67 (2.16x²)
213
(4
TT-M60
1.667 M
7.076 M (4. (4.24xt)
7948
21062 (2.65xt)
14,08
31.82 (2.26x()
200
46 (4.35x)
Meeteniingroo
1.267 M
7,066 M (8.58x()
6645
19182 (289x()
13.53
31.44 (2.32xT)
197
50 (3.
TT-Museum
4.439 M
16.501 M 72x()
12704
43317' (3.41xt)
19.79
48.89 (2.47x()
121
36 (x.36)
TT-Palace
0,711 M
2.764 M (3.89x()
8980
14065 (1.57xt)
14.27
20.07 (LAIIT))
185
84 (2.20
TT-Panther
1.812 M
8.112 M (4.48x1)
8511
22638 (2. (.666x)
13.49
33.19 (2.46xt)
199
49 (4.06x)
TT. Playgmund
2.309 M
10.306 M (4.46x))
8717
27304" (3.13x1)
15.17
38.77 (2.56x()
151
39 (387X)
TT- Temple
0.893 M
5,231 M (5 (5.86x))
6929
15238 (2.20x1)
13.03
27.96 (2.15xf)
216
52 (4.55))
Train
1.113
4,916 (4.42xt)
6551
14840 (2.27kt)
12.64
25.34 (2.00xt)
193
(1.27K.)
Truck
2.533 M
8.004 M (3.16x1)
8662
21166 (2.44x1)
14.64
33.26 (2.27x1)
156
47 (3.328L)
D.2 FULL BLACK-BOX ATTACK RESULTS
We report the full results of attacking a black-box victim (Scaffold-GS) (Lu al., 2024b) on NeRF- Synthetic and N3R datasets in Table 5.
To further test the effectiveness of Foison-Splat we conduct black- box attack experiments on Mip- Splatting (Yu et al., 2024). which received the best student paper award at CVPR 2024 and has been highly popular (with 178 citations as of November 20th, 2024). Mip-Splatting is an advanced variant of the original 3D Gaussian Splatting, incorporating a 3D smoothing filter and a 2D Mip filter. These enhancements help climinate various artifacts and achieve alias-free renderings. Results are shown in Table 6.
We found that Mip-Splatting (Yu et al., 2024) consumes more GPU memory compared to the original 3D Gaussian Splatting, making it more prone to the worst attack consequence of rumning Out-of- Memory, As illustrated in Table 6, even when the attack perturbation is constrained to = 16/255, the GPU memory consumption nearly reached the 80 GB capacity of Nvidia A800. When we apply an unconstrained attack, all scenes in the MIP-NeRF360 dataset will result in denial-of-service.
21

---

Published as a conference paper at ICLR 2025
Table 5: Full black-box attack results on NeRt-Synthetic and MIP-NcRF360 datasets. The victim system, Scaffold-GS, utilizes distinctly different Gaussian Splatting feature representations compared to traditional Gaussian Splatting and remains unknown to the attacker. These results demonstrate the robust generalization ability of our attack against unknown black-box victim systems.
Constrained Black-box Poison-splat attack with 16/255 against Scaffold-GS
Metric
Number of Gaussians
Peak GPU memory [MB]
Training time [minutes]
Setting
clean
poisoned
clean
poisoned
clean
poisoned
Scene
NS-chair
1.000 M
1,615 M (1.61x))
3418
4003 (1.17x1)
9.91
17.18
(1.73xf)
NS-drums
1.000 M
1.771 M (1.77x))
4022
4382 (1.09x1)
10.62
16.29 (1.53x
NS-ficus
1.000 M
2.301
(2.30x
3416
4234 (1.24x1)
9.64
18.54 (1.92xf)
NS-hotdog
1.000 M
1,463
(1.46x
3539
4516 (1.28x1)
10.74
18.62 (1.73xt)
NS-Icgo
0.414 M
2.074 M (5.01x))
3003
4808 (1.60x1)
9.77
17.91 (1.83x))
NS materials
1.000 M
2.520 M (2.52x
4110
5190 (1.26x1)
10.87
17.75 (1.63x1)
NS-mic
1.000 M
2.053
(2.05xt)
3682
5054 (1.37xf)
10.36
18.53 (1.79xt)
NS-ship
1.000 M
3,291 (3.29x²)
3492
5024 (1.44xt)
11.68
21.92 (1.88xt)
MIP-bicycle
8.883 M
16.947
(1.91xf)
12817
13650 (1.06xt)
38.93
44.98 (1.16xt)
MIP-bonsai
4.368 M
10.608 M (2.43xt)
10080
12218 (1.21x²)
35.33
37.71 (1.07xt)
MIP-counter
2.910 M
6.387 M (2.19xt)
12580
17702 (1.41x²)
38.53
44.83 (1.16xt)
MIP-ftowers
7.104 M
11.614 M (1.63xt)
8241
9766 (1.19xt)
36.56
38.31 (1.05xt)
MIP-garden
7.630 M
11.555 (1.51xt)
9194
10966 (1.19xt)
38.57
42.79 (1.11xt)
MIP-kitchen
3.390 M
6,698 M (1.98x))
14037
16895 (1.20xt)
43.83
48.10 (1.10xt)
MIP-room
2.846 M
10.527 M (3.70xt)
13323
13981 (1.05xt)
36.24
48,01 (1.32xt)
MIP-stump
6.798 M
14.544 M (2.14xf)
7322
9432 (1.29xt)
33.53
36.32 (1.08xt)
Unconstrained Black-box Poison-splat attack with e o0 against Scaffold-GS
Metric
Number Gaussians
Peak GPU memory [MB]
Training time [minutes]
Setting
clean
poisoned
clean
poisoned
clean
poisoned
Scene
NS-chair
1.000 M
3.082
(3.08x))
3418
5197 (1.52x1)
9.91
25.34 (2.56xf)
NS-drums
1.000 M
5.026
(5.03x))
4022
7364 (1.83x1)
10.62
28.24 (2.66x
NS-ficus
1.000 M
2.106 M (2.11x²)
3416
4446 (1.30x1)
9.64
21.65 (2.25x1)
NS NS-hotdog
1.000 M
3,541 M (3.54x²)
3539
5492 (1.55xt)
10.74
24.93 (2.32x
NS-Icgo
0.414 M
3,973
(9.60x))
3003
6242 (2.08xf)
9.77
26.11 (2.67xf)
NS materials
1.000 M
3,997
(4.00x))
4110
5997 (1.46xt)
10.87
25.48 (2.34xt)
NS-mic
1.000 M
3,021 M (3.02x²)
3682
5490 (1.49xt)
10.36
23.71 (2.29xt)
NS-ship
1.000 M
4.717 M (4.72x))
3492
6802 (1.95xt)
11.68
28.22 (2.42xt)
MIP-bicycle
8.883 M
33,284 M (3.75xt)
12817
22042 (1.72xt)
38.93
84.71 (2.18xf)
MIP-bonsai
4.368 M
28.042 M (6.42xt)
10080
22115 (2.19xt)
35.33
78.36 (2.22x1)
MIP-counter
2.910 M
12.928 (4.44xt)
12580
16168 (1.29xt)
38.53
55.59 (1.44xt)
MIP-flowers
7.104 M
27.610 M (3.89xt)
8241
18352 (2.23x*)
36.56
73.43 (2.01xt)
MIP-garden
7.630 M
23.828 M (3.12xt)
9194
20400 (2.22xt)
38.57
85.45 (2.22xt)
MIP-kitchen
3.390 M
14.404 M (4.25xt)
14037
17838 (1.27x1)
43.83
63.32 (1.44x1)
MIP-room
2.846 M
21.060 (7.40xt)
13323
21672 (1.63xt)
36.24
76.94 (2.12xt)
MIP-stump
6.798 M
34.027 M (5.01xt)
7322
20797 (2.84x1)
33.53
79.64 (2.38x1)
We examined the code implementation of Mip-Splatting?, and identified that it uses quantile com- putation in its Gaussian model densification function 8 which requires massive GPU memory and easily triggers out-of-memory. Our attack highlights the vulnerability in various 3DGS algorithm implementations.
hhtpp://gthubb.co/atttoooo http:///hw....mtttoooooooooooons
In Line 524 of mi mip-spllpll.. pttsppaattigg///etetto scene gaussian
22

---

Published as a conference paper at ICLR 2025
Table 6: Black-box attack results on Mip-Splatting (Yu et al., 2024) as the victim system, which can further demonstrate the robust generalization ability of our attack against unknown black-box victim systems.
Constrained Black-box Poison-splat attack with = 16/255 against Mip-Splatting
Metric
Number of Gaussians
Peak GPU memory [MB]
Training time [minutes]
Sctting
clcan
poisoned
clean
poisoned
clcan
poisoned
Scene
NS-chair
0.372 M
1.088 M (2.92x
6318
33042"
(5.23x1)
7.85
13.75 (1.75x1)
NS-drums
0.429 M
0.773 M (1.80x
7474
22036 (2.95xt)
8.15
12.60 (1.55x1)
NS-ficus
0.234
0,420 M (1.79x²)
6144
12374 (2.01xf)
6.35
8.97 (1.41xf)
NS-hotdog
0,200
1,437 M (7.18xt)
5350
58878
(11.01xt)
7.08
20.08 (2.84xt)
NS-lego
0.307 M
1.127 M (3.67x²)
6696
48682' (7.27xt)
7.28
16.43 (2.26xt)
NS-materials
0.216 M
0.505 M (2.34x1)
5278
9674 (1.83x1)
6.72
8.88 (1.32x1)
NS-mic
0.268 M
0.557
M (2.08xf)
5338
19758 (3.70x1)
9.12
12.23 (1.34x1)
NS-ship
0.330
1.793 M (5.43x))
6500
61026
(9.39x1)
8.75
21.05 (2.41x1)
MIP-bicycle
8.683 M
DoS
80614
DoS
47.57
DoS
MIP-bonsai
1.670
13.016 (7.79x))
30876
80826'
(2.62xf)
23.72
(2.61x1)
MIP-counter
1.493
8,329 M (5,58xt)
19478
79904"
(4.10xt)
26.25
56.75 (2.16xt)
MIP-ffowers
3,834 M
7,281 M (1.9xt))
50922
80286'
(1,58xt)
32.85
41.80 (1.27xf)
MIP-garden
5.828 M
8.677 M (1.49xt)
70446
80440"
(1.14x1)
43.20
54.43 (1.26x1)
MIP-kitchen
2.182 M
10.734 M (4.92x))
37024
81006
(2.19x1)
30.63
66.92 (2.18x1)
MIP-room
2.080
12,949 (6.23x))
31616
811300
(2.57x1)
27.13
77.83 (2.87x1)
MIP-stump
5.920 M
13.925 M (2.35x))
65882
80480 (1.22x1)
34.33
56.43 (1.64x))
Unconstrained Black-box Poison-splat attack with against Mip-Splatting
Metric
Number of Gaussians
Peak GPU memory [MB]
Training time [minutes]
Setting
clean
poisoned
clean
poisoned
clean
poisoned
Scene
NS-chair
0.372
6.106 M (16.41x²)
6318
80732
(12.78x
7.85
57.73 (7.35x
NS-drums
0.429 M
6,818 M (15.89x1)
7474
81210'
(10.87x1)
8.15
67.6 (8.30xf)
NS-ficus
0.234 M
4.847 M (20.71x7)
6144
80834 (13.16x1)
6.35
45.85 (7.22xf)
NS-hotdog
0.200 M
6.876 M (34.38x1)
5350
80630' (15.07x1)
7.08
59.80 (8.45x1)
NS-lego
0.307
6.472
(21.08x7)
6696
80668
(12.05x1)
7.28
64.93 (8.92x1)
NS-matcrials
0,216
5.513 M (25.52x1)
5278
81112" (15.37x1)
6.72
45.08 (6.71xf)
NS-mic
0.268 M
5,433 M (20.27x1)
5338
81020'
(15.18xt)
9.12
52.83 (5.79xt)
NS-ship
0.330 M
6.848 M (20.75x1)
6500
81236
(12.50x1)
8.75
66.15 (7.56x1)
MIP-bicycle
8.683 M
DoS
80614
DoS
47.57
DoS
MIP-honsai
1.670 M
DoS
30876
DoS
23.72
DoS
MIP-counter
1.493 M
DoS
19478
DoS
26,25
DoS
MIP-flowers
3.834
DoS
50922
DoS
32.85
DoS
MIP-garden
5.828 M
DoS
70446
DoS
43.20
DoS
MIP-kitchen
2.182 M
DoS
37024
DoS
30.63
DoS
MIP-room
2.080 M
DoS
31616
DoS
27.13
DoS
MIP-stump
5.920 M
DoS
65882
DoS
34.33
DoS
E NOTATIONS
We provide Table list all the notations appeared in the paper.
F VISUALIZATIONS
In this section, we present both the attacker-crafted poisoned images and the resultant reconstructions by the victim model. The visualizations aim to provide readers with more straightforward understand- ing our attack. The constrained attack visualizations are provided in Table 8, and the unconstrained attack visualizations provided in Table 9.
We have following interesting observations:
23

---

Published as a conference paper at ICLR 2025
Table 7: Notation List
Variable
Description
G
3D Gaussians
The number of 3D Gaussians
G D Dp V Pk VR
The i-th Gaussian in the scene
Clean image datasets Poisoned image datasets
The k-th camera view's clean image The k-th camera view's camera pose
The k-th camera view's poisoned image The k-th camera view's poisoned pose The k-th camera view's s rendered image The total number of views
PR V
N
μ e R
Center 3D coordinates (positions) of Gaussian
s R
3D scales of Gaussian
Opacity of Gaussian
q E R
Rotation quaternion of Gaussian
3x((+1))
Color of Gaussian represented spherical harmonics, where d is the degree Gradient threshold
T9
Ta
Scale threshold
Opacity threshold
R
Renderer function
Perturbation range Perturbation step size The iteration number of inner optimization
y
T
T
The iteration number of outer optimization Projection into e-ball Reconstruction loss L1 loss
P.()
L
LDSSSI
Structural similarity index measure (SSIM) loss
C(G*)
Training costs of 3D Gaussians Total variation score
STV(VV)
A
Loss trade-off parameters
Unconstrained Poisoned Attacks: On both NeRF-Synthetic and MIP-NeRF360, the reconstruction results consistently show low PSNR (around 20 dB). While the poisoned images and victim reconstructions may both resemble chaotic arrangements lines with needle-like Gaussians, subtle differences in detail exist. These differences, though difficult for the human eye to distinguish, are reflected in the PSNR.
Constrained Attacks on NeRF-Synthetic: the reconstruction results are significantly better than unconstrained attacks, with an average PSNR of around 30 dB.
Constrained Attacks on MIP-NeRF360: There are substantial appearance differences between the victim reconstructions and the poisoned input images, which are easily no- ticeable through human observation. Specifically, in the bicycle scene, the reconstructed trees appear to have denser leaves. In the bonsai and counter scenes, we observe notable changes in reflective areas. with several reflection highlights disappearing in the victim' 's reconstructed images. Additionally, the counter scene, there is evidence of underfitting, where the complex textures of the poisoned data degrade into large, blurry floaters in the victim's reconstruction.
24

---

Published as a conference paper at ICLR 2025
Table Attacker poisoned and victim reconstructed images with PSNR values under constrained attack (e 16/255) settings.
Dataset Setting
Attacker Poisoned Image
Victim Reconstructed Image
PSNR
NS-Chair
37.07 dB
NS-Drums
30.32 dB
NS-Ficus
35.77 dB
MIP-bicycle
18.20 dB
MIP-bonsai
22.67 dB
MIP-counter
24.45 dB
25

---

Published as a conference paper at ICLR 2025
Table Attacker poisoned and victim reconstructed images with PSNR values under unconstrained attack settings.
Dataset Scene
Attacker Poisoned Image
Victim Reconstructed Image
PSNR
NS-Chair
19.54 dB
NS-Drums
18.65 dB
NS-Ficus
21.00 dB
MIP-bicycle
20.57 dB
MIP-bonsai
23.66 dB
MIP-counter
21.33 dB
26

---

Published as a conference paper at ICLR 2025
Table 10: Attack performance (number of Gaussians, GPU memory consumption and training time) and image quality (SSIM and PSNR compared with clean images) under different levels of perturbation range on NeRF Synthetic dataset.
Scene
Attack setting
Number of Gaussians
GPU memory
Training time
SSIM
PSNR
clean
0.494
3752 MB
9.45 min
8/255
0.670 M
4520 MB
11.24 min
0.42
34.20
chair
16/255
0.957 M
8003 MB
13.41 min
0.21
27.94
24/255
1.253 M
16394 MB
15.89 min
0.16
24.35
unconstrained
4.152
51424 MB
40.71 min
0.07
4.63
clean
0.385 M
3456 MB
8.75 min
8/255
0.469 M
4353 MB
10.19 min
0.45
34.05
drums
16/255
0.695 M
7190 MB
11.94 min
0.24
27.87
24/255
0.966 M
14668 MB
14.86 min
0.17
24.36
unconstrained
4.109 M
62328 MB
43.25 min
0.03
4.49
clean
0.265 M
3194 MB
6.99 min
8/255
0,246 M
3238
8.28 min
0.39
34.45
ficus
16/255
0.273 M
3783 MB
8,94 min
0.18
28.21
24/255
0,450 M
8993 MB
11.32 min
0.13
24.53
unconstrained
3.718 M
50450 MB
36.92 min
0.08
4.41
clean
0.185 M
3336 MB
8.57 min
8/255
0.610 M
10362 MB
12.96 min
0.46
33.93
hotdog
16/255
1.147 M
29747 MB
17.43 min
0.25
27.56
24/255
1.553 M
39087 MB
21.26 min
0.17
24.11
unconstrained
4.272 M
47859 MB
38.85 min
0.07
5.75
clean
0.341 M
3532 MB
8.62 min
8/255
0.469 M
4648 MB
10.38 min
0.48
34.08
lego
16/255
0.805 M
9960
13.02 min
0.28
27.88
24/255
1.116 M
18643 MB
15.33 min
0.21
24.30
unconstrained
4.159 M
78852 MB
42,46 min
0.06
4.78
clean
0.169 M
3172 MB
7.33 min
8/255
0.229 M
3581 MB
8.84 min
0.44
34.25
materials
16/255
0.410
4886 MB
9.92
0.21
27.97
24/255
0,589 M
7724 MB
11.51 min
0.14
24.35
unconstrained
3.380 M
43998 MB
32.40 min
0.08
5,40
clean
0,205 M
3499 MB
8.08 min
8/255
0,251 M
4038 MB
9.29 min
0.36
34.46
mic
16/255
0.359 M
6437 MB
10.96 min
0.15
28.17
24/255
0,514
13014 MB
12.89 min
0.10
24.48
unconstrained
3.940 M
61835 MB
39.02 min
0.08
4.50
clean
0,272 M
3692
8.87 min
8/255
0.516 M
5574 MB
11.01 min
0.55
33.42
ship
16/255
1.071 M
16666 MB
16.12 min
0.33
27.50
24/255
1.365 M
29828 MB
18.46 min
0.24
24.03
unconstrained
4.317 M
80956 MB
44.11 min
0.04
5,31
G ABLATION STUDY ON PERTURBATION RANGE
We compare the attack effects (in terms number of Gaussians, GPU memory and training time) and image degradation (in terms of SSIM and PSNR compared with clean input) under different perturbation ranges = 8/2555, 6 = 16/26 16/255, < 24/255) on NeRF-Synthetic and MIP-NeRF360 datasets, shown in Table 10 and Table 11.
27

---

Published as a conference paper at ICLR 2025
Table 11: Attack performance (number of Gaussians, GPU memory consumption and training time) and image quality (SSIM and PSNR compared with clean images) under different levels of constraints on NIP-NeeF330 dataset.
Scene
Attack setting
Number of Gaussians
GPU memory (MB)
Training time (min)
SSIM
PSNR
clean
5.793 M
17748
35.42
8/255
6.116 M
18608
34.73
30.80
bicycle
16/255
10.129
27074
44.44
0.67
26.24
24/255
13.265 M
34870
51.37
0.52
23.12
unconstrained
25.268 M
63236
81.48
0.02
6.60
clean
1.294 M
10216
21.68
8/255
1.778 M
11495
21.39
0.79
32.45
bonsai
16/255
6.150 M
20564
26.83
24/255
9.321 M
39.84
23.52
unconstrained
20.127
54506
75.18
6.27
clean
1.195 M
10750
26.46
8/255
1.739 M
15133
28.06
0.80
32.24
counter
16/255
4.628 M
29796
37.63
0.52
26.78
24/255
6.649 M
47607
43.68
0.35
23.45
unconstrained
11.167
80732
62.04
6.64
clean
3,508 M
12520
25.47
8/255
3,457 M
12391
25.53
0.87
29. 18
flowers
16/255
5.177 M
16338
30.05
0.71
25.60
24/255
7,280 M
20264
34.25
0.58
22.79
unconstrained
18.075 M
45515
62.62
0.02
6.79
clean
5.684 M
17561
33.19
8/255
5.122 M
16498
32.17
0.84
29.85
garden
16/255
7.697 M
23115
40.82
0.68
25.87
24/255
10.356 M
28130
48.88
0.54
22.82
unconstrained
21.527 M
52140
83.81
0.04
7.43
clean
1.799 M
12442
8/255
2.675 M
13760
31.39
0.83
31.58
kitchen
16/255
6.346 M
20902
43.24
0.60
26.52
24/255
9.445 M
27646
53.16
0.45
23.18
unconstrained
12.830 M
77141
73.04
0.03
7.76
clean
1,513 M
12316
25.36
8/255
3.034 M
19542
32.99
0.75
32.41
room
16/255
7.129 M
46238
47.98
0.45
26.64
24/255
9.724 M
80142
$6.87
23.32
unconstrained
16.019
57540
76.25
6.42
clean
4.671 M
14135
27.06
8/255
5.152 M
15342
28.21
0.84
31.20
stump
16/255
10.003
25714
38.48
0.65
25.67
24/255
14.292 M
34246
46.89
0.49
22.98
unconstrained
13.550
36181
51.51
0.02
7.14
28

---

Published as a conference paper at ICLR 2025
H ABLATION STUDY ON POISON RATIO
In the main paper, we conducted all other experiments with 100% poison rate, based on the assumption that attacker can fully control data collection process. This assumption is reasonable for most 3D tasks, since the datasets typically are the same scene or object captured from different angles.
To gain deeper insights into the Poison- Poison-splat attack, we explore how varying levels of data poisoning ratio can affect the attack's effectiveness. We conduct experiments using poison ratios of 20%, 40%, 60%, and 80%, and report the number of Gaussians, GPU memory consumption, and training time in Table 12. these experiments, the poisoned views are randomly selected. To mitigate the effects of randomness, we report the mean value and standard deviation for each setting across three individual runs.
Table 12: Attack effectiveness under different poison ratio.
Scene
Poison Ratio
Number of Gaussians
GPU memory (MB)
Training time (min)
clean
0.185 M + 0.000 M
3336 MB + 11 MB
8.57 min + 0.30 min
20%
0,203 M 0.004
3286 MB MB
8.84 min + 0.27 min
40%
0.279 M 0.024
3896
MB
9.79 min + 0.53 min
16-hotdog-eps16
60%
0,501 M + 0.054 M
7367 MB + 1200 MB
11.33 min + 0.82 min
80%
0.806 M + 0.018 M
13621 MB + 861 MB
14.02 min + 0.60 min
100%
1.147 M = 0.003 M
29747 + 57 MB
17.43 min + 0.61 min
clean
0.272 M + 0.001 M
3692 MB + 52 MB
8.87 min + 0.44 min
20%
0.321 M = 0.004
3764 MB +
9.55 min + 0.17 min
40%
0.472 M = 0.021 M
4796
293 MB
10.49 min 0.58 min
N6-ship-eps16
60%
0.718 M + 00,003 M
7034 MB 407 MB
12.52 min 0.45 min
80%
0.924 M + 0.004 M
11850 MB + 510 MB
14.37 min + 0.60 min
100%
1,071 M = 0.003 M
16666 MB + 548 MB
16.12 min + 0.42 min
clean
1.195 M + 0,005 M
10750 MB + 104 MB
26.46 min + 0.57 min
20%
1.221 M = 0.005 M
11043 MB + 141 MB
27.41 min + 0.85 min
40%
1.358 M + 0.030 M
11535 MB + 147 MB
27.97 min + 0.47 min
MIP-ccouner-eps166
60%
2,005 M = 0.056 M
13167 MB + 227 MB
28.87 min + 0.52 min
80%
3.273 M 0.119
19578 MB 1417 MB
32.99 min 0.57 min
100%
4.628 M 0.014
29796 MB + 187 MB
37.63 min 0.48 min
clean
1.513 M + 0,004 M
12316 MB + 13 MB
25.36 min + 0.09 min
20%
1.520 M + 0.015 M
12624 MB + 502 MB
26.45 min + 0.75 min
40%
1.938 M + 0.036 M
14495 MB + 320 MB
27.99 min - 0.72 min
MIP-room-eps16
60%
3,589 M = 0.096 M
18760 MB +-2 765 MB
34,09 min 1 0.79 min
80%
5.503
M 0.017 M
28166 MB 457 MB
41.47 min 1.36 min
100%
7.129 M 0.020
46238 MB + 802 MB
47.98 min 0.72 min
From Table 12, we have following observations:
Attack performance, in terms of both GPU memory usage and training time extension, becomes stronger as poisoning rate increases.
At higher poisoning rates (between 60%-80%), the attack exhibits greater variance due to the randomness involved in selecting which views to poison. This suggests that the choice of views to poison can also impact the effectiveness of the attack.
I ABLATION STUDY ON DEFENSE THRESHOLD OF LIMITING GAUSSIAN NUMBERS
In the main paper, we set the defense threshold to ensure tight wrapping of necessary Gaussians for reconstruction on the clean scene. More specifically, for three scenes we show in Section 4.4 and Figure 5, we set defense threshold in the following Table 13:
For a 3DGS trainer, setting a uniform defense threshold is a notably challenging task due to the significant variance in different scenes. Implementing low threshold can safeguard the victim's computational resources from excessive consumption, but it may also substantially compromise
29

---

Published as a conference paper at ICLR 2025
Table 13: Number of Gaussians on clean data and as defense threshold used in Section 4.4.
Scene
#Gaussians on clean data
#Gaussians as defense threshold
Bicycle
5.793 Million
Million
Flowers
3.508 Million
4 Million
Room
1.513 Million
Million
the quality of reconstruction for complex scenes, Choosing the defense threshold should consider this resource-quality tradeoff. Taking room berf-Synthetic as an example, we tested the defense threshold acrosss 2 million to 7 million, as shown in the following Table 14 and Figure 6:
Table 14: Defense threshold impact on GPU consumption and reconstruction PSNR.
Defense threshold
Max GPU memory (MB)
Reconstruction PSNR
Clean input
12316 MB
29.21
Million
14192 MB
19.03
3 Million
16472 MB
22.27
4 Million
18784 MB
24.11
5 Million
23642 MB
24.49
Million
36214 MB
28.02
Poison + No Defense
46238 MB
29.08
Defanse: Million PSNR:11900
Defense: 3 Million
Defense: 4 Million
PSNR:22.27
PSNR:24.11
(A)
(B)
(C)
Defense: Million PSNR:24444
Defense: Million
Defense: Million
PSNR: 28.02
PSNR: 20.33
(D)
(E)
(F)
Figure 6: Rendering of reconstructed models under different defense threshold.
As the defense threshold becomes tighter, the maximum GPU memory usage confined within safer range. However, this results in significant drop in the reconstruction's 's PSNR, falling low as 19.03, which nearly makes it unusable. (c.f. Figure (A)). What's more, while setting a threshold million Gaussians appears adequate (achieving PSNR 28.00 02.02 dB), this same threshold yields poor rendering results for bicycle scene, with only 20.33 dB PSNR (c.f. Figure 6 (F)).
Overall, determining universal defense threshold that preserves reconstruction quality across various scenes is challenging. Designing more effective defense against computation cost attack remains an open question, and hope that future research will continue explore this area.
J IMAGE SMOOTHING IS NOT AN IDEAL DEFENSE
We will show that image smoothing pre- pre-processing Gaussian Splatting training procedure is not an ideal defense. Without a reliable detection method, defenders may only resort to universally
30

---

Published as a conference paper at ICLR 2025
applying image smoothing to all incoming data. This pre- pre-processing will significantly compromise reconstruction quality.
We found that although image smoothing may reduce GPU consumption to some extent, severly undermines efforts preserve fine image details (Yu et al., 2024; Ye et al., 2024; Yan et al., 2024b). As illustrated Figure 7, applying common smoothing techniques such as Gaussian filtering or Bilateral filtering (Tomasi & Manduchi, 1998) leads to substantial degradation in reconstruction quality. For instance, on the chair scene of NeRF-Synthetic dataset, reconstruction achieves 36.91 dB PSNR without pre-processing; however, with Gaussian Bilateral filtering, the PSNR drops sharply to around 25 dB. This level of degradation is clearly undesirable. Given these challenges, we urge the community to develop more sophiscated detection and defense mechanisms against computation cost attacks, balancing resource consumption with the preservation of image quality.
Input
PSNR: 36.91d8
PSNR: 25.85 dB
PSNR: 26.66 66 dB
3DGS Recon
Recon
Detail
Gaussian filter smoothing
Bilateral filter smoothing
No defense
Figure Using image smoothing as a pre-processing step can result in unsatisfactory model reconstruction quality, particularly regarding fine details in images. This naive defense strategy significantly degrades the PSNR by approximately 10 dB, contradicting the primary goal of the service provider maintain high-quality outputs.
K TIME EFFICIENCY OF POISON-SPLAY ATTACK
According Algorithm 1, need solve bi-level optimization problem, and the time complexity is related to T (inner iterations) and T (outer iterations). However in practice, our inner iterations T far fewer than outer iterations Т. and the actual time cost of attacker is even less than victim's training time, which is an advantage of our attack.
31

---

Published as a conference paper at ICLR 2025
Specifically, the total running time of algorithm is decided by two parts:
Train proxy model on clean data (Line of Algorithm
2. Solve the bi-level optimization (Line 3 to Line 13 of Algorithm 1)
For example, for unconstrained attacks on MIP-NeRF360, we T 6000 and T 25, and the time of attack is totally acceptable, and is even shorter than the victim training, as shown in the Table 15 below:
Table 15: Comparison of training times for the attacker and the victim.
Scene
Attacker: Proxy training + Bi-level optimization
Victim: Training time
Bicycle
33.42 16.57 min
81.48 min
Bonsai
21.68 + 14.00 min
75.18 min
Counter
26.46 + 15.23 min
62.04 min
Flowers
25.47 + 15.05 min
62.62 min
Garden
33.19 15.07 min
83.81 min
Kitchen
26.61 + 14.77 min
73.04 min
Room
25.36 16.50 min
76.25 min
Stump
27.06 15.63 min
51.51 min
Lastly, the primary motivation of our work is to expose the severity of this security backdoor, and attack efficiency is beyond the scope of this paper. We hope to leave the improvement of attack efficiency in future studies.
32


Reviews:
[{"review_id": "bvkIbB0Vb4", "reviewer": "Reviewer_SqKM", "summary": "The paper introduces Poison-splat, a data poisoning attack targeting the training phase of 3D Gaussian Splatting (3DGS). It exposes a vulnerability in the adaptive model complexity of 3DGS, showing how manipulated input data can significantly escalate computation costs during training, potentially resulting in a Denial-of-Service by consuming all available memory.", "questions": "1. What poisoning ratio is needed for Poison-Splat to be effective, and how does it affect stealth and impact?\n2. How is the smoothness threshold defined, and how does it impact the stealth of the attack?\n3. Does the quadratic time complexity of Algorithm 1 raise practical concerns during training?\n4. Is Poison-Splat still effective in multi-GPU settings, and how does it perform across GPUs with different specs?\n5. What is the Gaussian limit threshold in the basic defense, and how do varying limits affect the attack?", "limitations": "", "rating": 8, "confidence": 3, "soundness": 3, "presentation": 4, "contribution": 3, "strengths": "+ A unique computation cost attack targeting 3D Gaussian Splatting.\n+ Highlights practical vulnerabilities in commercial 3D reconstruction services.\n+ Thorough experimentation across various datasets.", "weaknesses": "- The paper frames the problem as a data poisoning attack. However, it does not clearly elaborate on the poisoning ratio required for Poison-Splat to be effective. Additionally, the implications of varying poisoning ratios, particularly their impact on the stealthiness and overall effectiveness of the attack, are not thoroughly discussed.\n\n- The paper mentions that Poison-Splat maximizes the number of Gaussians by enhancing the sharpness of 3D objects through controlling the smoothness factor. However, it is not clearly explained how the smoothness threshold is defined to ensure an effective attack. Additionally, the impact of this threshold on the stealthiness of the attack remains unclear.\n\n- Algorithm 1 indicates that generating backdoor samples with Poison-Splat requires a quadratic time complexity relative to the number of iterations, which raises concerns about the practicality of this approach during training.\n\n- Would the Poison-Splat technique maintain its effectiveness when the 3DGS algorithm is trained in a multi-GPU environment? Additionally, the attack should be assessed on various GPUs with different clock frequencies and memory bandwidths to evaluate the generalizability of the approach.\n\n- The paper states a basic defense against Poison-Spat by limiting the number of Gaussians, but it does not specify the threshold for the number considered in this defense. It would be beneficial to include an evaluation that explores the effect of varying these Gaussian limits.\n\n- The definition of the threat model for the Poison-Splat attack could be more precise, particularly in specifying attacker capabilities and constraints. Explicitly define white-box and black-box scenarios for the proxy model.\n\n- Why does the attack perform well on specific datasets in the white-box scenario but less effectively on others, such as the Tanks-and-Temples data (as shown in Table 1 and Table 3)? Can authors provide additional reasoning?", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "aTtroaY3bo", "reviewer": "Reviewer_ybEK", "summary": "This paper proposes an adversarial attack against 3D Gaussian splatting, aiming at increasing the computational cost of this process. Their attack is based on the flexibility of this algorithm, in which the computational cost will change dynamically according to the input image features. Their attack named poison-splat leverages a proxy 3DGS model and the improvement of the total variation score to increase the number of gaussians required in computation, hence bring a huge computational cost regarding GPU memory usage and training time. Their evaluation has included both white-box and black-box attack results and discussed simple defense strategies.", "questions": "1. Since there are many online services using 3DGS, as you mentioned in the paper, have you evaluated the real-world attack performance of your technique on those application? Will the responding time be extended or causing deny of service?", "limitations": "", "rating": 8, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. This work identifies a new kind of vulnerability in 3DGS systems, which is the computational cost attack.\n2. Authors have proposed an efficient algorithm to optimize a perturbation to increase the number of gaussians required in 3DGS.\n3. The presentation of the paper is clear and easy to follow.\n4. Evaluation results demonstrate the good attack performance in both black-box and white-box settings.", "weaknesses": "1. The constraint of the perturbation (epsilon = 16/255) seems large, and the quality of the resulted image could be affected. More ablation studies may be conducted to evaluate other constraint thresholds. \n2. A simple defense might be smoothing the input images before conducting 3DGS, which seems an adaptive defense regarding your perturbations to the input. You may discuss or evaluate the effectiveness and negative impact of such defense.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "F8l5qOAgBj", "reviewer": "Reviewer_gaGQ", "summary": "The paper discovers a security vulnerability in 3DGS. It shows that the computation cost of\ntraining 3DGS could be maliciously tampered by poisoning the input data. An attack named Poison-splat is presented.\n\nI have read the response of the authors and the comments of other reviewers. I would recommend weak accept.", "questions": "My concerns mainly lie in the practically feasible of the proposed attack.\n1. Is the attack practically feasible in real-world scenarios, or is it only feasible in theory?\n2. In the work, the authors approximate the outer maximum objective with the number of Gaussians, which appears to be a theoretical assumption that may not apply in real-world scenarios.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The paper is well written and organized.\n2. The paper reveals that the flexibility in model complexity of 3DGS can become a security backdoor, making it vulnerable to computation cost attack.\n3. Attacks are formulated and extensive experiments are conducted.", "weaknesses": "1. Is the attack practically feasible in real-world scenarios, or is it only feasible in theory?\n2. In the work, the authors approximate the outer maximum objective with the number of Gaussians, which appears to be a theoretical assumption that may not apply in real-world scenarios.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "Hdy3YarMG2", "reviewer": "Reviewer_THFm", "summary": "This work reveals a major security vulnerability that has been overlooked in 3D Gaussian Splatting (3DGS): the computational cost of training 3DGS can be maliciously manipulated by poisoning the input data. This paper introduces a novel attack, termed \"Poison,\" in which an adversary can poison the input images, thereby significantly increasing the memory and computational time required for 3DGS training, ultimately pushing the algorithm to its highest computational complexity. In extreme cases, the attack can even exhaust all available memory, leading to a denial-of-service (DoS) event on the server and causing real harm to 3DGS service providers.\nThe attack is modeled as a two-layer optimization problem, addressed through three strategies: attack target approximation, proxy model rendering, and optional constrained optimization. This proposed approach not only ensures the effectiveness of the attack but also makes it challenging for simple, existing defenses to succeed. This novel attack aims to raise awareness of the potential vulnerabilities in 3DGS systems.", "questions": "(1) As a model training service provider, certain benchmarks, such as model size and typical training duration, are commonly understood. Given these expectations, would an attack that poisons samples to increase memory usage and training time be easy to detect? Additionally, could existing methods for detecting adversarial samples be effective in identifying these poisoned samples?\n(2)Are existing attack methods targeting the inference phase applicable to the training phase? If so, could these methods be included in the experimental analysis for comparison? If not, could the authors explain why?\n(3) Since this attack targets the training phase, it would be helpful if the authors could analyze the required percentage of contamination in a clean dataset for the attack to succeed.\n(4) In the Experimental Analysis section, the authors conducted extensive experiments to analyze the impact of the attack on memory usage and training duration, which is commendable. However, while the abstract suggests that Poison-splat can lead to a DoS damage to the server, the Experimental Analysis section lacks any evaluation of the attack's effects on the inference phase.\n(5) Could the authors add more common models to compare the effectiveness of black-box and white-box attacks?\n(6) The primary objective of the attack is to consume excessive computational resources, but what are the most serious consequences of this? Is it a denial-of-service (DoS) scenario? Additionally, how difficult would it be to achieve significant damage? For instance, if an attacker aims to prevent a model from completing its training, would this require prior knowledge of the service provider's computational resources? Lastly, it is unclear how the success or failure of this type of attack should be assessed. For example, if the service provider’s computational resources are sufficient to handle the increased demand, should the attack then be considered unsuccessful?", "limitations": "", "rating": 8, "confidence": 3, "soundness": 4, "presentation": 4, "contribution": 4, "strengths": "1. It reveals a major security vulnerability that has been overlooked in 3DGS.\n2. The attack's effectiveness is validated across various datasets.", "weaknesses": "1. It lacks evaluation of the attack's effects on the inference phase.\n2. There are no intuitive metrics for evaluating the success or failure of this attack.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Spotlight)