DEGauss: Defending Against Malicious 3D Editing for Gaussian Splatting
Authors: Lingzhuang Meng
Mingwen Shao
Yuanjian Qiao
Xiang Lv
Venue: NeurIPS 2025 poster ()
Keywords: 3D Gaussian Splatting
Malicious editing defense
View-focal fusion
dual discrepancy optimization
Primary area: social_and_economic_aspects_of_machine_learning
TL;DR: A defending framework against malicious 3D editing for 3D Gaussian splatting

Abstract: 3D editing with Gaussian splatting is exciting in creating realistic content, but it also poses abuse risks for generating malicious 3D content. Existing 2D defense approaches mainly focus on adding perturbations to single image to resist malicious image editing. However, there remain two limitations when applied directly to 3D scenes: (1) These methods fail to reflect 3D spatial correlations, thus protecting ineffectively under multiple viewpoints. (2) Such pixel-level perturbation is easily eliminated during the iterations of 3D editing, leading to failure of protection. To address the above issues, we propose a novel Defense framework against malicious 3D Editing for Gaussian splatting (DEGauss) for robustly disrupting the trajectory of 3D editing in multi-views. Specifically, to enable the effectiveness of perturbation across various views, we devise a view-focal gradient fusion mechanism that dynamically emphasizes the contributions of the most challenging views to adaptively optimize 3D perturbations. Furthermore, we design a dual discrepancy optimization strategy that both maximize the semantic deviation and the edit direction deviation of the guidance conditions to stably disrupt the editing trajectory. Benefiting from the collaborative designs, our method achieves effective resistance to 3D editing from various views while preserving photorealistic rendering quality. Extensive experiments demonstrate that our DEGauss not only performs excellent defense in different scenes, but also exhibits strong generalization across various state-of-the-art 3D editing pipelines.

DEGauss: Defending Against Malicious 3D Editing for Gaussian Splatting
Lingzhuang Meng', Mingwen Shao?; Yuanjian Qiao', Xiang Lv! Shandong Key Laboratory of Intelligent Oil & Gas Industrial Software, Qingdao Institute of Software, College of Computer Science and Technology. China University of Petroleum (East China), China 2 Artificial Intelligence Research Institute, Shenzhen University of Advanced Technology, China 3 College of Computer Science (College of Software), Inner Mongolia University, China Schmeng1688@166 com, smw2780126 com, yjqiao580163. com, mrxxiang199701222 com
Abstract
3D editing with Gaussian splatting exciting in creating realistic content, but it also poses abuse risks for generating malicious 3D content. Existing 2D defense approaches mainly focus on adding perturbations single image to resist malicious image editing. However, there remain two limitations when applied directly to 3D scenes: (1) These methods fail reflect 3D spatial correlations, thus protecting ineffectively under multiple viewpoints. (2) Such pixel-level perturbation is easily eliminated during the iterations of 3D editing, leading to failure of protection. To address the above issues, we propose a novel Defense framework against malicious 3D Editing for Gaussian splatting (DEGauss) for robustly disrupting the trajectory of 3D editing in multi-views. Specifically, to enable the effectiveness of pertur- bation across various views, we devise a view-focal gradient fusion mechanism that dynamically emphasizes the contributions of the most challenging views adaptively optimize 3D perturbations. Furthermore, we design a dual discrepancy optimization strategy that both maximize the semantic deviation and the edit di- rection deviation of the guidance conditions to stably disrupt the editing trajectory. Benefiting from the collaborative designs, our method achieves effective resistance to 3D editing from various views while preserving photorealistic rendering quality. Extensive experiments demonstrate that our DEGauss not only performs excellent defense in different scenes, but also exhibits strong generalization across various state-of-the-arg art 3D editing pipelines.
Introduction
Recent advances in scene editing with 3D Gaussian Splatting (3DGS) have substantially enhanced the controllability and expressiveness scene manipulation driven by natural language prompts, largely powered by the integration of diffusion models with neural 3D representations [12, 39]. However, such convenience also brings significant security risks: anyone with access to a rendered 3D model change identity, appearance, or contextual details without authorization [25, 22), which can lead to serious consequences such as identity deception, misinformation, or reputational damage [31, 40]. Therefore, is imperative to develop effective protection method for 3D digital assets and personal portraits against unauthorized modifications, in order to prevent the spread of malicious content.
Unlike 2D editing that operates single image [15, 38), 3D editing fundamentally involves ma- nipulating spatially structured data [20, 35), which brings in unique properties such as multi-view
"Corresponiing authors.
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

"Make him Burning."
Original 3D Scene
Edit Success
Protecting by our DEGauss
Malicious Editing
Protected 3D Scene
Protect Success
Figure I: Malicious 3D editing and our defense. The 31) scenes protected by our DEGauss are able to disrupt the direction of malicious editing and preserve the original 3D appearance and structure.
consistency, structural integrity, and global iterative optimization. Existing studies [24, 3] on 3D edit- ing based on Gaussian splatting and diffusion models have emphasized better semantic controllability, multi-view consistency, and editing flexibility. These methods aim to enable precise modifications of 3D content that align with user intent by local region mapping [7], while ensuring consistency across diverse viewpoints through the integration of semantic information from different viewpoints [4, 34). Furthermore, recent works [18, 19] have increasingly focused on the editing efficiency and speed, enabling high-quality results with reduced computational cost and minimal guidance. Despite these significant advances, existing researches neglect the security risks posed by malicious use of 3D editing, which raises concerns about unauthorized modifications.
To defend against malicious editing on 2D images, various adversarial- based defense methods [22, 14, 26] have been proposed disrupt the editing capabilities of diffusion models through embedded imperceptible perturbations. For example, AdvDM [22]. Mist [21] and PhotoGuard [30] optimize the perturbations by maximizing the noise prediction loss of the diffusion model, thereby inducing significant degradation in downstream editing results. Posterior Collapse Attack [10] achieves attacks latent space by inducing a posterior collapse in the VAE encoder, thus disrupting variety of editing methods based on latent diffusion models. In addition, Semantic Attack [23] and AdvPaint [16] degrade editing quality by manipulating the self-attention and cross-attention mechanisms within the diffusion process, leading to misaligned attention maps and impaired semantic alignment. However, the aforementioned 2D defense methods are inherently unsuitable for 3D scenarios due to two main limitations: (1) Their 2D perturbations failed to reflect 3D spatial correlations, leading to poor protection across varying viewpoints. (2) Such perturbations are also easily erased during iterative optimization of 3D editing, resulting in defense failure.
To tackle the above challenges, we propose tailored Defense framework against malicious 3D Editing for Gaussian splatting (DEGauss), which stably disrupts the multi-view editing trajectory to suppress unauthorized 3D modifications, as shown in Fig. Specifically, to ensure the effectiveness of perturbations across different viewpoints, we design view-focal gradient fusion mechanism that dynamically emphasizes the gradient of the most challenging viewpoints in broadly sampled cameras, thereby adaptively optimizing the 3D perturbations under varying viewpoints. Furthermore, we devise a dual discrepancy optimization strategy that simultancously maximizes the semantic deviation and the directional bias of the guidance condition, therefore enabling the 3D perturbation to robustly disrupt editing trajectories throughout the iterative optimization. With the support of these two dedicated designs, our method achieves strong resistance to multi -iew editing, while preserving high-fidelity rendering with photorealistic visual details. Extensive experiments illustrate that our DEGauss effectively prevents malícious 3D editing across diverse scenes and exhibits promising generalization across a variety of 3D editing frameworks.
The main contributions of this paper are as follows:
We propose DEGauss, a noval defense framework against malicious 3D editing for Gaussian splatting that actively disturbs the editing trajectory from multiple viewpoints. To the best of our knowledge, this is the first framework for defense against 3D malicious editing.

---

A view-focus gradient fusion mechanism is designed to adaptively update 3D perturbations by emphasizing challenging views, thereby enhancing defense effectiveness in multi-views.
We devise a suua--dicreppancy optimization strategy that amplifies semantic divergence and editing directions errors in iterative optimization, stably disrupting the editing trajectory.
Experiments several datasets and saute-of-the-ar 3DGS editing schemes demonstrate the effectiveness and generalization of our DEGauss.
2
Related Works
3D Editing with Gaussian Splatting, Recent researches on 3D editing with 3DGS have focused almost on improving the fidelity [4, 18, 33), controllability [39, 12, 28], and efficiency [18, 19J. For instance, to achieve controllable editing, GaussianEditor [7] introduces dynamic semantic tracking strategy for precise localization by back booc-projecting 2D segmentation masks into 3D Gaussians. To ensure multi-view consistency, DGE [4] integrates spatio-temporal self-attention and epipolar constraints to achieve effective fusion of edits across views, while GaussCtrl [34] leverages geometric constraints on depth maps and cross- attention mechanism to align edits across different views. To improve editing efficiency, ProEdit [3] adopts subtask-bass optimization to gradually realize complex edits with better stability. On the contrary, DreamCatalyst [18] accelerates convergence via improved inversion and loss design, while EditSplat [19] further enhances speed through attention- weighted pruning and hierarchical densification. Despite the impressive progression of 3D editing, there are also raised concerns about its potential misuse to maliciously modify private 3D assets. Aiming this problem, we propose DEGauss, the first defense framework against malicious 3D editing for protecting digital assets from arbitrary manipulation by unauthorized editor.
Defenses against Malicious Image Editing, To defend against malicious images editing, series of adversarial -based defense methods [22, 6, 5, 14, 26) have been proposed to disrupt the editing process by exploiting imperceptible pixel-space perturbations. Among them, AdvDM [22] introduces a systematic theoretical framework that maximizes denoising loss of the diffusion models [29, 13], thereby generating perturbations to hinder feature extraction. On this basis, Mist [21] further combines semantic and texture losses to improve transferability of the perturbations, while DiffusionGuard [8] prevents the synthesis in sensitive regions by interfering with the early stages of the denoising process. In addition, SDS [36] accelerates optimization and reduces consumption through score distillation sampling, while Posterior Collapse Attack [10] induces potential spatial collapse by perturbing the VAE encoder in the latent diffusion model, thereby significantly disrupting the semantics of the encoding. Recently, Semantic Attack [23] and AdyPaint [16] perturb the text-image cross- atteettono or image self-attention in the diffusion model to distract the model attention to the specific region, and both of them showing better performance than conventional approaches. These defense schemes are investigated from the output space to the model structure to construct a more defense system against malicious editing of 2D images.
However, the above methods pose intrinsic challenges when applied directly to 3D scene protection, they are specifically designed for single-view and single-pass 2D editing. On the one hand, the perturbations generated by 2D defense are unable to reflect 3D spatial relationships, leading to insufficient effectiveness across multiple viewpoints. On the other hand, simple perturbations optimized for single-pass editing are typically climinated during the iterative optimization in 3D editing, resulting in failure of protection. In contrast, we propose DEGauss, specialized defense framework against malicious 3D editing, which combines view-focal gradient fusion with dual- discrepancy optimization to robustly disrupt multi-vies view editing results during iterations of 3D editing.
Methodology
3.1 Preliminary
3D Editing with Gaussian Splatting, Existing mainstream of 3D editing with 3DGS employ pre- trained 2D diffusion models (e.g., InstructPix2Pix [2), ControlNet [37]) as powerful generative priors to supervise the editing results. Within these framework, text prompts are used to guide diffusion- based image editing for multiple viewpoints. The resulting edited images serve as supervision to update the Gaussian parameters θ {u. E, a, c), where i denotes the 3D center position, Σ
3

---

represents the covariance matrix controlling shape, is the opacity, and defines the RGB color. The updated 3D representation is iteratively rendered to generate a new image for further editing.
Formally, given a constructed scene G, the goal of the editor to update the Gaussian parameters é so that its rendered images from all viewpoints match the edited images according to the text prompt Shext. This update is performed iteratively:
+ arg min E () Ceasa
Do Lus Vret)),
(1)
where 1tth = R2, (G*) denotes the k-th round of iterations and the e-th view of the rendered image, I, represents the initial rendered image being used as image guidance to preserve the original information. Da denotes the diffusion model, and Ledit is the loss of rendering, which is commonly used to align the appearance of rendering (e.g., I. I.PIPS) or geometric depth.
Defense against Malicious Image Editing. To defend against malicious image editing, existing researches has proposed adversarial-based methods disrupt the editing process of diffusion models. The core principle of these approaches is to introduce a small smallmman perturbation 8 to the input image z to make the diffusion model deviate from the original denoising process, thus affecting the normal editing operation. It can be formalized as:
== arg min p(æ + 6), s.t.||8|| < 5.
(2)
where p(z) denotes the probability distribution of the image x generated by the diffusion model and S denotes the bound limit of the perturbation. To solve Eq. (2), AdvDM [22] represents the solution of the defense perturbation d uniformly according to Monte Carlo as follows:
i- = arg max BA=.t,,..)ee [|oo(T,, + 8, thext, 1) =112 [
where (1,, T' denotes the number of denoising steps in the diffusion model, e (O, I) denotes normally distributed noise, and eo is the denoising network. By encouraging the noise predictions to deviate from the correct values all time steps I, the denoising results of the diffusion model can be actively perturbed and ultimately achieve a robust defense against malicious image editing.
3.2 Problem Definition
In this paper. we present defense against malicious 3D editing, aiming to prevent unauthorized modifications to 3D scenes performed by diffusion model-based editors. For scene G constructed by 3DGS, let Ps (Grar G, Veeu is the conditional probability distribution of the target 3D scene Gur produced by the diffusion editor (parameterized by Φ) given a text prompt T. We define the defense against malicious 3D editing as probabilistic optimization problem.
Definition 3.1 (Defense against malicious 3D editing). Given a 3D editor, there exists 3D perturba- tion A added the original scene G that minimize the conditional probability of generating valid edit result at text prompt Vext- The perturbation A is given by the following equation:
A = arg min (Gtar G + A, 3hext), s.t.
||||| <
(4)
Our goal is not limited to dissimilarity to specific target distribution Gur. but to reduce the probability of similarity to any edit distribution. Thus, the above equation can be written as:
== arg max BG..r-a((1G...mm))) log pa (Grr G + A, Vrext]] |
(5)
Combined with the optimization objective for 3D editing given in Eq. (1), we can reinterpret the defense problem as maximization of the editing loss, as follows:
A = arg max ER. (Tt, (It RG + Meea)) |A|K<
However, this rendering loss essentially an iterative fitting process to the explicit model, aiming to align the rendered image with the target edited image produced by the diffusion model. It is not possible to optimize the perturbation by maximizing this render loss Ledit- Therefore, we turn to replace the original editing loss with differentiable diffusion loss, which drives the 3D edit to fit to

---

Sampling
Text Procapt Library man waaring sall hamisunger
Ori
VSOWS
Render
Ini
Inll
cxerese bikid
3DGS
Een
View-Focal Weightnn
Ont
Ap
Wi
F- Lotall
A
X
Lutal
An
Iatoo
Ac
Ltetal
Protected 3DGS
View-Focal Gradient Fusion
Dual Discrepancy Optimization
Camera views
Operating flow
Gradient flow
+|1i InstruciPix2PPis
Loss
@ Gradient
Weights
Addition
Figure 2: Overview of the proposed DEGauss. Firstly, a wide-viewpoint sampling is performed to obtain rendered image of the 3D scene, and then feature discrepancy loss and guidance discrepancy loss are computed between the rendered and original view images. These losses from multiple viewpoints are subsequently fused using a view-focal weighting to guide perturbation optimization. The perturbation A = (A A., Da. Acj is initialized to zero and optimized in iterations.
the wrong edit direction by making the diffusion process in multiple views deviate from the original edit direction. This objective formally defined as follows:
min BUEV Cai (R. A), Yiex)
Ex,,,e, ||Eo (G A), Bhexss t) =|l2 |
(8)
Although Eq. (8) constructs theoretically reasonable attack targets based on the noise prediction of the diffusion model, it results in limited direct optimization due to the fact that the denoiser of
the diffusion model is extremely robust to perturbations and the gradient is weak and unstable [36]. Therefore, propose two loss terms, Feature Discrepancy (FD) and Guidance Discrepancy (GD), which directly measure the semantic differences and bias in the guidance direction in latent space. These contribute to more stable convergence and better gradient propagation.
A arg max EA,,, e,e [I=(R, + A)) =(,) |A|KE
Feature Discrepancy
(T R. + A), Brext, L) eo (o I Ins yhexts 1>11
Guidance Discrepancy
where represents the image encoder. The purpose of FD is drive the protected view away from the original feature latent space and increase the uncertainty the editor. While the purpose the GD is alter the guidance direction of the diffusion model deviate from the original trajectory, weakening its semantic understanding of Ytext and editing behavior.
Following the above analysis, we propose DEGauss, a dedicated framework that introduces targeted perturbations to disrupt editing across multiple views, as illustrated in Fig. 2. Our DEGauss consists of two key components: view-focal gradient fusion mechanism and dual-discrepancy optimization strategy. These components work collaboratively to optimize 3D spatial perturbations that reliably disrupt multi-view editing throughout the iterative process.
3.3 Dual Discrepancy Optimization
Based on Eq. (9), we devise a dual discrepancy optimization strategy that provides supervision from both the semantic feature and guidance direction in the latent space. Specifically, this module contains two dedicated loss functions: feature discrepancy loss and guidance discrepancy loss, which jointly guide the optimization of the perturbations, thus deviating editing results from target semantics.
5

---

Feature Diserepancy Loss. The feature discrepancy loss is used to measure the consistency between the original views and the perturbed 3D views in the latent space, and we utilize the encoder of pre-trained InstructPix2Pix [2] model to extract the feature representations of the rendered image and the original image, which can be represented as:
LFD = EE ||e (R. - -
(10)
Guidance Discrepancy Loss. The guidance discrepancy loss is designed ensure that the editing direction of the protected 3D scene deviates from that of the original scene under the same viewpoint. To achieve this, we utilize features from the noise space of the pre-trained InstructPix2Pix [2] model to represent guidance features. The loss is defined as follows:
COD -.p,p............ || (G + A), Vextt 1) - Eo (Ku, Los Mheas 1)
(1I)
where Yis represent a library of text prompt. as in DreamFusion [27], which contains 415 different prompts. It is used to introduce semantic diversity and prevent overfitting to specific prompt.
Overall Loss. During training, the above two losses are loss, and the total loss can be expressed as:
are jointly optimized with the main rendering
Coaal
Lrender AED CFD + AGD LGD.
(12)
where Lrender denotes the rendering loss, defined as the L2 distance between rendered views and original views. AnD and AGD are the hyperparameters for the feature and guidance terms, respectively, The total loss is then used for view-focal gradient fusion to update the perturbation parameters.
3.4 View-Focal Gradient Fusion
During 3D object optimization, updates from different viewpoint may interfere with one another, leading to inconsistencies across multiple viewpoints. This effect is particularly noticeable in the optimization fine-grained perturbations, resulting in extremely poor protection in some viewpoints. To mitigate this issue, we devise a View-Foccl Gradient Fusion (VFGF) strategy that consists of two parts, a wide-view sampling and a view-focal weighting, which aims to improve the consistency and effectiveness of the perturbations across multiple views.
Wide-View Sampling. To ensure uniform spatial distribution and broad coverage of the selected viewpoints, we design the wide-view sampling strategy to avoid concentration in locally similar or redundant views. For the reference viewpoint n and Bj. each is associated with a camera translation vector _ and the rotation matrix R SO(3). We define the distance between two viewpoints as the sum of normalized translation and angular differences:
d(v,, 13) = I T2lll2 (R,, R,))
(13)
D Dmax
Translation distance
Rotation angle
tracce (P,
Z(R;, R2)) arceos
(14)
where Dmax is the maximum translation distance in view space and trace(-) denotes the trace of the matrix. Both components are mapped to [0, 1] and equally weighted. Start from a initial set of viewpoints {reet). we select the next viewpoint furthest from all previously selected viewpoints based on all the statistics until N viewpoints have been selected:
VN- v
VN = =w=vv
v" = arg max min d(r;, uz)
(15)
EyEV v.EVV-
At each iteration, from the unselected viewpoints, find that viewpoint that has the largest distance from the nearest point in the current sampling set and add it to the sampling set. This sampling strategy avoids focusing the samples on locally similar viewpoints, thus providing stronger global structural constraints for the subsequent gradient fusion.
View-Focal Weighting. For the widely sampled set of viewpoints, we further propose a view-focal weighting strategy, which weights the gradient according to the difficulty of each viewpoint for

---

subsequent perturbation updates. Specifically, we treat the loss associated with each viewpoint as an indicator of resistance editing, and assign weights to the viewpoints based on the magnitude of the loss value, formally defined as follows:
(4 + T)
Ve
Σ w. VeLioul NEV
where
We Evevv (4 + 7)7
(16)
where a denotes the total loss at viewpoint v, y is focusing parameter controlling the degree of nonlinearity in the weighting, and is a stabilization term prevent values. This strategy biases the optimizer toward viewpoints with higher loss values (i.e., with weak defenses against editing), thereby generating perturbations that effective across views to improve resistance to editing.
Benefiting from the above designs, our DEGauss effectively optimize 3D perturbations space while maintaining perturbation validity across different views. This enables stable and niew-generalizable protection against malicious 3D editing throughout the iterative optimization process.
4 Experiments
4.1 Experimental Setup
Datasets and Editing Models. We verified the effectiveness on common 3D editing dataset [11, 32, IJ. including 'face', 'girl', 'person', 'bear', 'bicycle', and 'garden' scenes, with varying viewpoints and data scales. In addition, we validate our generalization leveraging the latest released 3D editing models, including GaussianEditor [7]. DGE [4], DreamCatalyst [18), and EditSplat [19].
Baselines. Since the defense schemes for malicious 31) editing still pending, we compare DEGauss with state-of-thh-ar 2D editing defense schemes and migrated them to 3DGS to ensure fairness, including AdvDM [22], Mist [21], SDS [36], and AdvPaint [16].
Evaluation Metrics. We utilize Peak Signal-to-Noise Ratio (PSNR) to measure the difference between protected and original samples, reflecting the imperceptibility of perturbations. In addition, Contrastive manguage-Image Pretraining (CLIP) similarity evaluates the semantic gap between protected and normal editing results. CLIP-T measures the semantic distance between the protected result and the editing prompt. CLIP Direction similarity (CLIP-D) [9] quantifies the consistency between text differences (from source to editing) and image differences (from source to edited).
Implementation Details. All experiments are conducted on single NVIDIA RTX 4090 GPU. We set the number of sampled views N = 6, the weighting factor 1e-6, and = 1.0. To balance loss terms, we set hyperparameters ÄTD = AGD 1e-5. The total number of training steps set to 2,000, More settings and algorithm are provided in the Supplementary.
4.2 Comparisons
We compare existing 2D-based editing defense methods with our DEGauss, focusing on the ability to resist malicious editing in 3D scenarios. shown Fig. 3, existing 2D defense methods suffer from obvious editing artifacts and multi-view inconsistencies when directly applied to 3D scenes. For example, AdyDM [22] and Mist [21] introduce some noise or artifacts that degrade the quality of the edits, but still maintain normal editing effects without preserving the original scene detail. SDS [36] exhibit weaker suppression of malicious edits, offering limited resistance. Although AdvPaint [16] performs slightly better in suppressing editing effects, it still introduces noticeable editing traces, noise, and inconsistencies across different viewpoints. In contrast, our DEGauss better preserves the global structure and appearance of the original scene, producing natural and artifact-free renderings with high visual fidelity across multiple views.
Moreover, Table 1 quantitatively evaluates our DEGauss against existing methods. It can be seen that our DEGauss achieves the highest PSNR, indicating that the introduced perturbations are more imperceptible. Regarding CLIP-based scores, our DEGauss attains the lowest similarity between the edited and original samples, demonstrating its effectiveness trajectories. In contrast, existing 2D defense methods such AdvDM and Mist exhibit significantly lower performance in all metrics. Even AdvPaint, which performs relatively better among the basclines, still lags behind DEGauss several metries. Both visual and quantitative comparisons
disrupting malicious editing
7

---

Original
No Protection
AdvDM-3DGG
Mist+3DGS
SDS++DGS
AdyPantt33DSS
DEGaus (Ours)
Text prompt: "Tum him into Einstein"
Text prompt: "Turn her into old lady"
Text prompt: "Tum the bear statue into asiatic black bear"
Figure 3: Visual comparison with existing methods. Comparisons include AdvDM [22], Mist [21],
SDS [36], and AdyPaint [16]. Our DEGauss is resistant to 3D editing achieves optimal visualization in preserving the original 3D scene. The editing method used is GaussianEditor.
Quantitative comparison with existing methods. Our DEGauss achieves the superior PSNR while offering the optimal resistance to 3D editing. The editing method used is GaussianEditor Red indicates optimal and orange indicates suboptimal. f: higher is better, J: lower better.
Table 1:
Method
face
girl
PSNR1
CLIIPL
CLIP--TJ
CL.IP-DY
PSNR
CL.PP
CI.IP-TJ.
CLIP-DJ
AdvDM [22]+3DGS
32.63
0.9235
0,2465
0.0710
30.83
0.8716
0.2401
0.0586
Mist [21]+3DGS
33.63
0.9599
0,2539
0.0828
32.63
0.9131
0.2588
0.0872
SDS [36]+3DGS
32.39
0.9707
0.2493
0.0863
34.97
0.9573
0.2631
0.1071
AdvPaint [16]+3DGS
32.95
0.8996
0,2266
0.0355
32.93
0.8514
0.2434
0.0464
DEGauss (Ours)
33.92
0.8860
0.2193
0.0325
35.59
0.8689
0.2380
0.0446
Method
bear
bicycle
PSNRT
CLIP
CLIP-TU
CLIP-DJ
PSNR1
CLIP
CLIP-TU
CLIP-DL
AdvDM [22]+3DGS
29.26
0.9072
0.3057
0.0378
29.84
0.9385
0.2514
0.0732
Mist [21]+3DGS
31.10
0.9564
0,3106
0.0373
32.52
0.9675
0.2380
0.0567
SDS [36]+3DGS
31.30
0.9546
0.3107
0.0378
32.59
0.9724
0.2415
0.0616
AdvPaint [16]+3DGS
30.77
0.9046
0.3011
0.0314
30.89
0.9257
0.2464
0.0576
DEGauss (ours)
32.20
0.8949
0.2940
0,0256
32.84
0,9358
0.2336
0.0535
clearly illustrate that our DEGauss is able to effectively suppress malicious editing while maintaining higher degree of visual consistency with the original 3D scene.
4.3
Generalization
To further evaluate the generalization of our DEGauss, we conduct experiments on SOTA different 3D editing methods, including GaussianEditor [7], DGE [4], DreamCatalyst [18] and EditSplat [19]. As shown in Fig. 4, our DEGauss preserves the original 3D appearance against GaussianEditor without introducing visible artifacts. addition, for DGE and EditSplat, although subtle color modifications observed, our DEGauss effectively prevents structural editing and maintains overall geometric

---

Edtto
DGE
DreamCatalyat No Protection DECauss (Ours)
EditSplat
No Protection DEGauss (Ours)
No Protection
DEGauss (Ours)
No Protection DEGiaus (Ours)
Text prompt: "Tum her into Elom Musk
Text prompt: "Change the bicyle color to bright rea
Figure 4: Visualization of generalization experiments. The editing methods include GaussianEd- itor [7], DGE [4], DreamCatalyst [18], and EditSplat [19]. Our DEGauss significantly resist 3D editing from different existing schemes.
Table 2: Quantitative analysis of generalization experiments. Our DEGauss is outstanding against different editing schemes. "Ori" and "Ours" refer to the non-protected and our protection results, and "Diff" refers the difference between "Ori" and "Ours". 1: higher is better, 1: lower better.
face
CLIP
CLIP-T
CLIP-D
Method
Ori
Our
Diff
Ori
Ourl
Difft
Ori
Our
Diff
GaussianEditor [7]
T.000
0.886
0.114
0.284
0.219
0.065
0.084
0.033
0.051
DGE [4]
1.000
0.890
0.110
0.253
0.230
0.023
0.089
0.050
0.039
DreamCatalyst [18]
1.000
0.896
0.104
0.277
0.248
0.029
0.089
0.044
0.045
EditSplat [19]
1.000
0.933
0.067
0.248
0.236
0.012
0.083
0.053
0.030
girl
CLIP
CLIP-T
CLIP-D
Method
Ori
Our
Difft
Ori
Ourl
Difft
Ori
Ourl
Diff
GaussianEditoor [7]
1.000
0.869
0.131
0.260
0.238
0.022
0.120
0.045
0.075
DGE [4]
1.000
0.919
0.081
0.259
0.250
0.009
0.119
0.067
0.052
DreanCatalyst [18]
1.000
0.821
0.179
0.265
0.244
0.021
0.096
0.064
0,032
EditSplat [19]
1.000
0.942
0.058
0.276
0.265
0.011
0.124
0.085
0.039
bear
CLIP
CLIP-T
CLIP-D
Method
Ori
Our
Difft
Ori
Our
Difft
Ori
Ourl
Diff
GaussianEditor [7]
1.000
0.895
0.105
0.313
0.294
0.019
0.062
0.026
0.036
DGE [4]
1.000
0.890
0.110
0.310
0.298
0.012
0.071
0.023
0.048
DreamCatalyst [18]
1.000
0.917
0.083
0.333
0.305
0.028
0.074
0.035
0.039
EditSplat [19]
1.000
0.935
0.065
0.312
0.309
0.003
0.051
0.028
0.023
bicycle
CLIP
CLiP-T
CLIP-D
Method
Ori
Our
Diftt
Ori
Our.
Difft
Ori
Our,
Difft
GaussianEditor [7]
1.000
0.939
0.061
0.270
0.234
0.036
0.076
0.054
0.022
DGE [4]
1.000
0.956
0.044
0.293
0.261
0.032
0.098
0.088
0.010
DreamCatalyst [18]
1.000
0.955
0.045
0.269
0.243
0.026
0.092
0.057
0.035
EditSplat [19]
1.000
0.951
0,049
0,280
0.272
0.008
0.116
0.093
0,023
and semantic integrity. for DreamCatalyst, our perturbations lead to the generation of noisy and chaotic outputs, significantly disrupting the intended editing direction. These results collectively demonstrate that our DEGauss robustly resists unauthorized 3D editing in the state-of-the- editing pipelines, highlighting its strong generalization to diverse editing paradigms.

---

(3) wio App
(b) w/o Aco
(c) wio Wide-view sampling (d) w/o View-tocal weighting
(6) Full components
Figure 5: Visualization of the ablation on key components. The editing model GaussianEditor and the text prompt is "Make him wear a Venetian mask".
Table reports the CLIP-based similarity scores between our DEGauss results and the original samples under different 3D editing methods. The samples protected by DEGauss consistently achieve significantly lower similarity under all evaluated editors, indicating that the introduced perturbations effectively disrupt the expected editing trajectories regardless of the editing scheme applied.
4.4 Ablation Studies
Ablation on Key Components. We perform an ablation study on the key components of our framework, the visual results are shown Fig. 5. When the feature discrepancy loss is removed, the edited images exhibit noticeable degradation in quality. While without the guidance discrepancy loss, the outputs retain the intended semantic edits, leading to the weakest defense performance. In the absence of wide-view sampling view-focus weighting, the results inconsistent in multi-vies i.e., some views are effectively defended while others are poorly. In contrast, when all components are integrated, our method achieves the strongest overall protection against malicious editing.
Ablation on Hyperparameters. We ver- ify the effect of noise strength on stealth- iness by uniformly adjusting the perturba- tion hyperparameter À (jointly APD and ÅGD), as shown Table 3. can be observed that reducing À improves noise stealthiness (higher PSNR score), while decreasing defense performance (higher
Table 3: Noise Stealthiness Defense Strength. Red indicates optimal and orange indicates suboptimal.
PSNRT
CLIP
CLIP-T
CLIP-D
1e-4
27.47
0.8147
0.2018
0.0171
1e-5
33.92
0.8860
0.2193
0.0325
1e-6
34.80
0.9617
0.2692
0.0555
CLIP scores). When 1e-5, noise invisibility and defense ability reach a trade-off.
We conduct ablation study on the hyperparameters of loss function, as shown in Table 4. When the weight of the feature discrepancy loss is re- duced, the PSNR score drops to low- est, indicating poor visual quality in the generated samples. Alternatively, decreasing the weight of the guidance discrepancy loss leads to the highest PSNR, but the defense becomes ineffective and the edited result will retain more the expected semanties. In contrast, chose hyperparameter setting achieves balanced trade-off between visual fidelity and editing resistance.
Table 4: Ablation experiments on hyperparameters. The
editing model is GaussianEditor. Red indicates optimal and
orange indicates suboptimal.
AFD *0.1
ĀGD
PSNRÍ
CLIP
CLIP-TI
CLIP-D,
31.56
0.8825
0.2297
0.0594
*0.1
36.17
0.9244
0.2295
0.1020
33.92
0.8860
0.2193
0.0325
5 Conclusions
In this paper, we propose DEGauss, a novel defense framework dedicated to protecting 3DGS from malicious editing. Unlike 2D defense approaches that focus only on image space, our DEGauss optimizes perturbations in 3D space to maintain consistent protection across multiple views. Specifi- cally, we elaborate the view-focal gradient fusion mechanism and the qual-discrepancy optimization strategy that jointly disturb the direction of multi-view editing during iterative editing, thus preventing the expected semantic editing. Experimental results indicate that our DEGauss can effectively defend unauthorized 3D editing in different scenes while maintaining high fidelity visual quality.
10

---

Acknowledgments
The authors are very indebted to the anonymous referees for their critical comments and suggestions for the improvement of this paper. This work was supported by the National Key Research and Devel- opment Program of China (200002))000002),, National Natural Science Foundation China (Nos. 62376285, 61673396), Natural Science Foundation of Shandong Province (No: ZR2022MF260),
1000102),
References
[1] Jonathan T. Barron, Ben Mildenhall, Dor Verbin, Pratul Srinivasan, and Peter Hedman. Mip-NeRF 360: Unhounded Anti-Aliased Neural Radiance Fields. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 1460-5469) 2022.
[2] Tim Brooks. Aleksander Holynski, and Alexei A. Efros. InstructPix2Pix: Learning to Follow Image Editing Instructions. In /EEE/CVF Conference Computer Vision and Pattern Recognition, pages 18392-18402, 2023.
[3] Junkun Chen and Yuxiong Wang. ProEdit: Simple Progression is All You Need for High-Quality 3D Scene Editing. In Advances in Neural Information Processing Syxtems, volume 37, pages 4934-4955, 2024.
[4] Minghao Chen, Iro Laina, and Andrea Vedaldi. DGE: Direct Gaussian 3D Editing by Consistent Multi-view Editing. European Conference on Computer Vision, page 94-92, 2024.
[5] Ruoxi Chen, Haibo Jin, Yixin Liu, Jinyin Chen, Haohan Wang, and Lichao Sun. EditShield: Protect- ing Unauthorized Image Editing by Instruction-guice guidedd Diffusion Models. In European Conference on Computer Vision, page 126-142, 2024.
Xinquan Chen, Xitong Gao, Juanjuan Zhao, Kejiang Ye, and Cheng-Zhong Xu. AdvDiffuser: Natural Adversarial Example Synthesis with Diffusion Models. IEEE/CVF International Conference on Computer Vision, pages 4562-4572, 2023.
[7] Yiwen Chen, Zilong Chen, Chi Zhang, Feng Wang, Xiaofeng Yang, Yikai Wang, Zhongang Cai, Lei Yang. Huaping Liu, and Guosheng Lin. GaussianEditor: Swift and Controllable 3D Editing with Gaussian Splatting. IEEE/CVF Conference Computer Vision and Pattern Recognition, pages 21476-21485, 2024.
[8] June Suk Choi, Kyungmin Lee, Jongheon Jeong, Saining Xie, Jinwoo Shin, and Kimin Lee. DiffusionGuard: A Robust Defense Against Malicious Diffusion based Image Editing. In International Conference on Learning Representations, 2025.
Rinon Gal, Or Patashnik, Haggai Maron, Amit H. Bermano, Gal Chechik, and Danicl Cohen-On Or. StyleGAN- NADA: CLIP-guided domain adaptation image generators. ACM Transactions on Graphics, 41(4):141:1- 141:13, 2022.
[10] Zhongliang Guo. Lei Fang, Jingyu Lin, Yifei Qian, Shuai Zhao, Zeyu Wang. Junhao Dong, Cunjian Chen, Ognjen Arandjelović, and Chun Pong Lau. Grey-box Attack against Latent Diffusion Model-based Image Editing by Posterior Collapse. arXiv preprint arXiv.2408. 109011 2024.
[11] Ayaan Haque, Matthew Tancik, Alexci A. Efros, Aleksander Holynski, and Angjoo Kanazawa. Instruct- NcRF2NoRF: Editing 3D Scenes with Instructions. In International Conference on Computer Vision, pages 16633116933, 2023.
[12] Kai He, Chin-Hsuan Wu, and Igor Gilitschenski. CTRL-D: Controllable Dynamic 3D Scene Editing with Personalized 2D Diffusion. JEEE/CVF Conference on Computer Vision and Pattern Recognition, 2025.
[13] Jonathan Ho. Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. In Advances in Neural Information Processing Systems, volume 574, pages 6840-6851, 2020.
[14] Robert Hönig, Javier Rando, Nicholas Carlini, and Florian Tramèr. Adversarial Perturbations Cannot Reliably Protect Artists From Generative AI. In International Conference Learning Representations, 2025.
[15] Yi Huang. Jiancheng Huang, Yifan Liu, Mingfu Yan. Jiaxi Lv, Jianzhuang Liu, Wei Xiong, He Zhang, Liangliang Cao, and Shifeng Chen. Diffusion Model- Based Image Editing: A Survey, IEEE Transactions Pattern Analysis and Machine Intelligence, pages 1-27, 2025.

---

[16] Joonsung Jeon. Woo Jae Kim, Suhyeon Ha, Sooel Son, and Sung-eui Yoon. AdvPaint: Protecting Images from Inpainting Manipulation via Adversarial Attention Disruption. In International Conference on Learning Reprexentatioss 2025.
[17] Bernhard Kerbl, Georgios Kopanas, Thomas Leimkuchler, and George Drettakis. 3D Gaussian Splatting for Real-Time Radiance Field Rendering. ACM Transactions on Graphics, 12:1):139:1113:11, 2023.
[18] Jiwook Kim, Sconho Lee, Jacyo Shin, Jiho Choi, and Hyunjung Shim. DreamCatalyst: Fast and High- Quality 3D Editing via Controlling Editability and Identity Preservation. In International Conference on Learning Representations, 2025.
[19] Dong In Lee. Hyeongcheol Park, Jiyoung Seo, Eunbyung Park, Hyunje Park, Ha Dam Baek, Shin Sangheon. Sangmin kim, and Sangpil Kim. EditSplat: Multi- View Fusion and Attention- Attention-Guided Optimization for Consistent 3D Scene Editing with 3D Gaussian Splatting. In IEEE/CVE Conference on Computer Vision and Pattern Recognition, 2025.
[20] Yuhan Li, Yishun Dou, Yue Shi, Yu Lei. Xuanhong Chen, Yi Zhang, Peng Zhou, and Bingbing Ni. FocalDreamer: Text-Driven 3D Editing via Focal-Fusion Assembly. In Proceedings of AAAI Conference Artificial Intelligence, volume 38, pages 3279-3287 2024.
[21] Chumeng Liang and Xiaoyu Wu. Mist: Towards Improved Adversarial Examples for Diffusion Models. arXiv preprint arXiv. 2305. 2683, 2023.
[22] Chumeng Liang, Xiaoyu Wu, Yang Hua, Jiaru Zhang, Yiming Xue. Tao Song, Zhengui Xue, Ruhui Ma, and Haibing Guan. Adversarial Example Does Good: Preventing Painting Imitation from Diffusion Models via Adversarial Examples. In International Conference on Machine Learning, pages 20763-20786, 2023.
[23] Ling Lo, Cheng Yu Yeo. Honghan Shuai, and Wenhuang Cheng, Distraction is All You Need: Memory- Efficient Image Immunization against Computer Vision and Pattern Recognition, pages
Image Editing. In IEEE/CVF Conference on 2024.
[24] Guan Luo, Tianxing Xu, Yingtian Liu, Xiaoxiong Fan, Fanglue 7hang, and Songhai Zhang. 3D Gaussian Editing with A Single Image. In ACM Multimedia, pages 6627 6636, 2024.
[25] Xingjun Ma, Yifeng Gao, Yixu Wang, Ruofan Wang, Xin Wang, Ye Sun, Yifan Ding, and et al. Safety Scale: A Comprehensive Survey of Large Model Safety. arXiv preprint arXiv.2502.05206 2025.
[26] Tarik Can Ozden, Ozgur Kara, Oguzhan Akcin, Kerem Zaman, Shashank Srivastava, Sandeep P. Chinchali, and James M. Rehg. Optimization-Fre Image Immunization Against Diffusion- Beatus Editing, arXiv preprint xrXiv:2411.17951 2024.
[27] Ben Poole, Ajay Jain, Jonathan T. Barron, and Ben Mildenhall. DreamFusion: Text-to-3D using 2D Diffusion. In International Conference on Learning Representations. 2023.
[28] Yansong Qu, Dian Chen, Xinyang Li, Xiaofan Li, Shengehuan Zhang. Liujuan Cao, and Rongrong Ji. Drag Your Gaussian: Effective Drag- Based Editing with Score Distillation for 3D Gaussian Splatting. In ACM SIGGRAPH, 2025.
[29] Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bjom Ommer. Hlihh-Resouue Image Synthesis with Latent Diffusion Models. In IEEE/CVF Conference on Computer Vision and Puttern Recognition, pages 10674-10685, 2022.
[30] Hadi Salman, Alaa Khaddaj. Guillaume Leclere, Andrew Ilyas, and Aleksander Madry. Raising the Cost of Malicious Al-Powered Image Editing. In International Conference on Machine Learning. 2023.
[31] Chunyen Shih, Lixuan Peng. Jiawei Liao, Ernie Chu, Chengfu Chou, Juncheng Chen. Pixel Not Barrier: An Effective Evasion Attack for Pixel- Domain Diffusion Models. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 39, pages 6905-6913, 2025.
[32] Can Wang, Ruixiang Jiang, Menglei Chai, Mingming Hc, Dongdong Chen, and Jing Liao. Artt-Art: Text-Driven Neural Radiance Fields Stylization. IEEE Transactions on Visualization and Computer Graphics, 30(8):9983 2024.
[33] Yuxuan Wang. Xuanyu Yi, Zike Wu, Na Zhao, Long Chen, and Hanwang Zhang. View-Consistent 3D Editing with Gaussian Splatting, In European Conference on Computer Vision, pages 404-420, 2024.
[34] Jing Wu, Jiawang Bian, Xinghui Li, Guangrun Wang, Ian Reid, Philip Torr, and Victor Adrian Prisacariu. GaussCtrl: Multi-Ven View Consistent Text- Driven 3D Gaussian Splatting Editing. In European Conference Computer Vision, page 55-71, 2024.
12

---

[35] Tianxing Xu, Wenbo Hu, Yukun Lai, Ying Shan, and Songhai Zhang. Texture-GS Disentangling the Ge- omeery and Texture for 3D Gaussian Splatting Editing. In European Conference Computer Vision, pages 37-53, Cham, 2024.
[36] Haotian Xue, Chumeng Liang. Xiaoyu Wu, and Yongxin Chen. Toward effective protection against diffu- sion based mimicry through score distillation. International Conference on Learning Representations. 2024.
[37] Lvmin Zhang, Anyi Rao, and Maneesh Agrawala. Adding Conditional Control Text-to lext-to-Image Diffusion Models. JEEE/CVF International Conference on Computer Vision, pages
2023.
[38] Zhixing Zhang, Ligong Han, Armab Ghosh, Dimitris Metaxas. and Jian Ren. SINE: SINgle Image Editing with Text-to-Image Diffusion Models. In JEEE/CVF Conference on Computer Vision and Puttern Recognition, pages 6027-6037, 2023.
[39] Yian Zhao, Wanshi Xu, Yang Wu. Weiheng Huang. Zhongqian Sun, and Wei Yang. ProGDE: Progressive Gaussian Differential Field for Controllable and Flexible 3D Editing. arXiv preprint arXi:2411.081.52. 2024.
[40] Boyang Zheng, Chumeng Liang, and Xiaoyu Wu. Targeted Attack Improves Protection against Unautho- rized Diffusion Customization. In International Conference Learning Representations, 2025,
13

---

NeurIPS Paper Checklist
1. Claims
Question: the main claims made the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
The abstract and introduction clearly state the claims made, and the claims made are consistent with theoretical and experimental results.
Justification:
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much results can he expected to generalize to other settings.
is fine to include aspirational goals as motivation long is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification:
We provide limitations section in the Supplementary Material.
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those not discussed in the paper.
The authors are encouraged create separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g.. independence assumptions, noiseless settings, model well- speciffcciiiin.nnn asymptotic approximations only holding locally). The authors should reflect how these assumptions might he violated practice what the implications would
The authors should reflect on a few datasets or with a few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
scope the claims made, e.g., the approach was only tested
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or speech-to text system might not be used reliably to provide closed captions
online lectures because fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't It acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play important role in developing norms that preserve the integrity the community. Reviewers will be specifically instructed not penalize honesty concerning limitations.
3. Theory assumptions and proofs
For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof?
Question:
Answer: [Yes]
Justification: All theorems, formulas and proof's in the paper are numbered and cross cross- referenced, and the theorems and reasoning relied upon have been attributed.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proof's in the paper should be numbered and cross- reosseeeferenced.
14

---

All assumptions should be clearly stated or referenced in the statement of any theorems.
The proof' can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main experimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Answer: [Yes]
Justification: We give a description all the parameters in the main paper and the algorithm in the Supplementary Material, which will be sufficient to support our algorithmic reproductions.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments. No answer to this question will not be perceived well by the reviewers: Making the paper reproducible important, regardless whether the code and data are provided or not.
the contribution is dataset and/or model, the authors should describe the steps taken make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of a large language model), releasing model checkpoint, or other means that are appropriate to the research performed.
example, contribution
While NeurlPS does not require releasing code, the conference does require submissions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) the contribution is primarily a new algorithm, the paper should make clear how to reproduce that algorithm.
(b) If the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) If the contribution is a new model (e.g.. a large language model), then there should either be a way to access this model for reproducing the results way to reproduce the model (c.g.. with an open-source dataset instructions for how construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome to describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access the model is limited in some way (e.g.. registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instructions to faithfully reproduce the main experimental results, as described supplemental material?
Answer:
[No]
Justification:
We will open access to the code after the paper is accepted.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines
http:://iips.ccpcppeee
Galdee/CooeeSuuee stneeubbiisiiooooooooo for more details.
While we encourage the release of code and data, we understand that this might not possible,
so "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g.. for a new open-soure benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurlPS code and data submission guidelines (https: : //ni/s/ps..//////// cc/public/ gu.ides/CoodeSuttmneessooooool for more details.
15

---

The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the proposed method and baselines. If only a subset of experiments are reproducible, they should state which ones are omitted from script and why.
At submission time, to preserve anonymity, authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code is permitted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (e.g.. data splits, hyperparameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: Yes]
Justification: We have provided the experimental setup in Section 4.1 of the paper and more detailed addition is given in the Supplementary Material.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to level of detail that is necessary appreciate the results and make of them.
The full details can be provided either with the code, in appendix, supplemental material,
7. Experiment statistical significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate informa- tion about the statistical significance of the experiments?
Answer: [No]
Justification: Instead including error bars, we selected the average of multiple runs the experi- mental results.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confidence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to library function, bootstrap, etc.)
The assumptions made should be given (e.g.. Normally distributed emrors)
It should be clear whether the error bar is the standard deviation the standard error of the mean.
It is OK to report I-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error than state that they not verified.
96% CI. if the hypothesis of Normality of errors
asymmetric distributions, authors should be careful not show in tables or figures symmetric error bars that would yicld results that are out of range (c.g. negative error rates). error bars are reported tables or plots, The authors should explain the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments compute resources
Question: For each experiment, does the paper provide sufficient information on the computer resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Answer:
[Yes]
Justification:
We have provide sufficient information on the computer resources.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
16

---

The paper should provide the amount of compute required for each of the individual experimental runs well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary failed experiments that didn't 't make into the paper).
9. Code of ethics
Question:
Does the research conducted in the paper conform, in every respect, with the NeurIPS Code httpp//eltt//iiiccccde.....eeee
Ethics
Answer:
[Yes]
Justification:
The research conducted in this thesis in all respects consistent with the NeurPPS Code Ethics.
Guidelincs:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure preserve anonymity (c.g., if there is a special considcration duc laws regulations in their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification:
We discuss the social impacts in the Supplementary Material.
Guidelines:
The answer NA means that there is no socictal impact of the work performed.
the authors answer NA or No. they should explain why their work has no societal impact or why the paper does not address socictal impact.
Examples negative societal impacts include potential malicious or unintended uses (e.g.. disinformation, generating fake profiles, surveillance), fairness considcrations (c.g., deploy- ment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will he foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to negative applications, the authors should point it out. For example, it is legitimate point out that an improvement in the quality generative models could used to generate deepfakes for disinformation. other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used intended but gives incorrect results, and harms following from (intentional unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release models, providing defenses in addition attacks, mechanisms for monitor- ing misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML).
11. Safeguards
Does the paper describe safeguards that have been put in place responsible release data or models that have a high risk for misuse (e.g. pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification: Our work does not involve the release of high-risk models or datasets (e.g., large pretrained language models, generative models, or scraped data). All datasets used are publicly available and licensed for research use.
Guidelines:
The answer NA means that the paper poses such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines restrictions to access the model or implementing safety filters.
17

---

Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but encourage authors take this into account and make best faith effort.
12. Licenses for existing assets
Question: Are the creators original owners of assets (e.g., code, data, models), used in the paper, properly credited and the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification:
Our assets used in the paper have been noted cited.
Guidelines:
The answer NA means that the paper does not existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset is used and, possible, include a URL.
The name of the license (c.g., CC-BY 4.0) should be included for cach asset. scraped from particular source (e.g.. website), the copyright terms of service of that source should provided.
assets are released, license, copyright information, and terms of use the package should be provided. For popular datasets, paperswi thcode. com/ datasstss has curated licenses for some datasets. Their licensing guide can help determine the license of a dataset.
For existing datasets that are re-pac re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
this information not available online, the authors are encouraged to reach out to the asset's creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Justification: We did not introduce new assets.
Guidelines:
The answer NA means that the paper does not release new assets.
Rescarchers should communicate the details of the datasct/code/model as part of their sub- missions via structured templates. This includes details about training, license, limitations,
The paper should discuss whether and how consent was obtained from people whose asset is used.
At submission time. remember to anonymize your assets (if applicable). You can either create an amonymized URL or include anonymized zip file.
14. Crowdsourcing and research with human subjects
Question: For crowdsoureing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, well as details about compensation (if any)?
Answer: [NA]
Justification: The paper does not involve crowdsoureing nor research with human subjects.
Guidelincs:
The answer NA means that the paper does not involve crowdsourcing research with human subjects.
Including this information in the supplemental material is fine, but if the main contribution of the paper involves human subjects, then as much detail as possible should included the main paper.
According to the NeurIPS Code of Fahics, workers involved data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals equivalent for research with human subjects
Does the paper describe potential risks incurred by study participants, whether such risks were disclosed the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Question:
18

---

Answer: [NA]
Justification:
The paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer means that paper does not involve crowdsourcing nor research with human subjects.
Depending on the country which research is conducted, approval (or equivalent) may be required for any human subjects research. If you ohtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and expect authors adhere to the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applica- ble), such the institution conducting the review.
16. Declaration of LLM usage
Question: Does the paper describe usage LLMs it an important. original. or non-standard component the core methods this research? Note that if the LLM used only for writing, editing, or formatting purposes and does not impact the core methodology, scientific rigorousness, or originality of the rescarch, declaration is not required.
Answer: [NA]
Justification: The core methed development in this research does not involve LLMs as any important, original, non-standard components.
Guidelines:
The answer NA means that the method development in this research does not involve LLMs as any important, original, or non-standard components.
Please refer our LLM policy httpps//eerrrss....//fftreeeeeee //tp///r......coootootrr//////// for what should or should not be described.
19


Reviews:
[{"review_id": "ZQOkxR1QPt", "reviewer": "Reviewer_gPnN", "summary": "The paper proposes a defense method against malicious 3D editing in gaussian splatting. The method aims to ensure that the perturbations are effective in multiple viewpoints by sampling multiple cameras and focusing on the most challenging ones, and further boost this by maximizing the discrepancy between IP2P features as well as IP2P guidance features. They also propose view-focal gradient fusion, where viewpoints are selected that they are far away from each other to avoid focusing on samples from locally close viewpoints, and assigns weights to viewpoints based on the difficulties. Qualitative and quantitative results show that this strategy results in a strong protection compared to baseline methods that are not dedicated for 3D editing (e.g., AdvDM, Mist, SDS).", "questions": "**Questions**\n- Is it possible to tweak the noise strength down to make it more stealthy while sacrificing some defense strength?\n- What is the wall clock optimization time for each method (baselines and proposed method)?\n- Would it be possible to use baseline methods combined with some techniques introduced in this paper such as viewpoint sampling? Is there any ablation done in this regard?\n\n\n**Minor points**\n- Typo in Table 3 caption: \"GasussianEditor\".\n- Typo in Figure 5 caption: \"GausussianEditor\".", "limitations": "yes", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 2, "significance": 3, "originality": 3, "strengths_and_weaknesses": "**Strengths**\n- The motivation to design a defense method dedicated for 3D gaussian splatting editing is clear. \n- The paper proposes a novel method to tackle non-trivial challenges that arise when optimizing adversarial noise for 3D objects such as protection being non-uniform across different viewpoints (wide-view sampling and view-focal weighting).\n- Extensive results show that the method results in stronger protection strength compared to baseline methods.\n- The proposed method seems to preserve the quality of the original image better thanks to the 3D-specific design components.\n\n**Weaknesses**\n- Table 2 lacks a comparator or a baseline and is thus not very straightforward to understand.\n- The paper lacks a wall time comparison against baseline methods. Is the proposed method slower or is comparable to other methods?\n- Although better compared to baseline methods, the adversarial noise is still quite visible on the defended object. Is it possible to tweak the noise strength down to make it more stealthy while sacrificing some defense strength?", "was_revised": true, "final_justification": "Most of my previous concerns have been addressed by the author rebuttal. I think the paper solves a well-motivated problem, and some of the weaknesses in the manuscript that needs revision are the parts related to clarity (e.g., table presentation can be done much more clearly), and I think these weaknesses can be sufficiently addressed through minor revisions. The results in Table R4 is interesting and reassuring, which can be included in the appendix of the final draft. I think overall the contribution of this work is valuable, and therefore raise my rating to 5.", "rebuttal": "Thank you for your insightful comments and for helping us improve our work. We have carefully consider and respond point by point to your comments as follows.\n\n**Weakness 1: Table 2 lacks a baseline.**\n\n**Answer:** Thanks for your valuable comment. We have added the unprotected results and the differences before and after protection into Table 2 to show our attack effects more intuitively and clearly, as shown in Table R1. It is observed that our DEGauss significantly and consistently reduces the CLIP similarity with the normal editing results, which proves the effectiveness and generalization of our method under different editing schemes. We only present results for two scenes due to page limitations. The updated complete table and related discussion will be added in the revised version.\n\nTable R1: Quantitative analysis of generalization. “Ori” and “Ours” refer to the non-protected and our protection results, and “Diff” refers to the difference between “Ori” and “Ours”.\n\n|  |  |  |  |  |  | face |  |  |  |  |  |\n|---|:---:|:---:|:---:|---|:---:|:---:|:---:|---|:---:|:---:|:---:|\n|  |  | CLIP |  |  |  | CLIP-T |  |  |  | CLIP-D |  |\n| Method | Ori | Our $\\downarrow$ | Diff $\\uparrow$ |  | Ori | Our $\\downarrow$ | Diff $\\uparrow$ |  | Ori | Our $\\downarrow$ | Diff $\\uparrow$ |\n| GaussianEditor | 1.000  | 0.886  | 0.114  |  | 0.284  | 0.219  | 0.065  |  | 0.084  | 0.033  | 0.051  |\n| DGE | 1.000  | 0.890  | 0.110  |  | 0.253  | 0.230  | 0.023  |  | 0.089  | 0.050  | 0.039  |\n| DreamCatalyst | 1.000  | 0.896  | 0.104  |  | 0.277  | 0.248  | 0.029  |  | 0.089  | 0.044  | 0.045  |\n| EditSplat | 1.000  | 0.933  | 0.067  |  | 0.248  | 0.236  | 0.012  |  | 0.083  | 0.053  | 0.030  |\n|  |  |  |  |  |  | **bear** |  |  |  |  |  |\n|  |  | CLIP |  |  |  | CLIP-T |  |  |  | CLIP-D |  |\n| Method | Ori | Our $\\downarrow$ | Diff $\\uparrow$ |  | Ori | Our $\\downarrow$ | Diff $\\uparrow$ |  | Ori | Our $\\downarrow$ | Diff $\\uparrow$ |\n| GaussianEditor | 1.000  | 0.895  | 0.105  |  | 0.313  | 0.294  | 0.019  |  | 0.062  | 0.026  | 0.036  |\n| DGE | 1.000  | 0.890  | 0.110  |  | 0.310  | 0.298  | 0.012  |  | 0.071  | 0.023  | 0.048  |\n| DreamCatalyst | 1.000  | 0.917  | 0.083  |  | 0.333  | 0.305  | 0.028  |  | 0.074  | 0.035  | 0.039  |\n| EditSplat | 1.000  | 0.935  | 0.065  |  | 0.312  | 0.309  | 0.003  |  | 0.051  | 0.028  | 0.023  |\n\n**Weakness 2 & Question 2: Comparison of wall time with 2D defense methods.**\n\n**Answer:** Thanks for your helpful suggestion. We have evaluated the wall-clock optimization time for our DEGauss and all 2D defense methods over a complete optimization of 2000 iterations, using a consistent 3D setting for all experiments. As shown in Table R2, the wall-clock time of our method is slightly higher than that of AdvDM, Mist, and SDS, as the multi-view weighting strategy incurs additional computational costs. However, our cost is shorter than AdvPaint, because we only compute gradients using a subset of feature maps rather than the full attention map used in AdvPaint. Although some 2D-based defense methods achieve shorter time in simple settings, they perform worse in multi-view 3D protection (higher CLIP scores). Therefore, our DEGauss framework remains comparable to other methods. We will add the table and related discussion in the revised version.\n\nTable R2: Comparison of wall-clock time and defense performance with 2D defense methods. **Bold** indicates the best result.\n \n|  | AdvDM+3DGS | Mist+3DGS | SDS+3DGS | AdvPaint+3DGS | DEGauss (Ours) |\n|:---:|:---:|:---:|:---:|:---:|:---:|\n| Wall-Clock Time $\\downarrow$ | 520.06s | 675.49s | **361.01s** | 959.08s | 893.07s |\n| CLIP $\\downarrow$ | 0.9235 | 0.9599 | 0.9707 | 0.8996 | **0.8860** |\n\n**Weakness 3 & Question 3: Is it possible to tweak the noise strength down to make it more stealthy while sacrificing some defense strength?**\n\n**Answer:** Yes, it is possible to improve stealthiness by reducing noise strength. We verified the effect of noise strength on stealthiness by uniformly adjusting the perturbation hyperparameter $\\lambda$ (jointly $\\lambda_{FD}$ and $\\lambda_{GD}$), as shown in Table R3. It can be observed that reducing $\\lambda$ improves noise stealthiness (higher PSNR score), while decreasing defense performance (higher CLIP scores). When $\\lambda =1e\\mbox{-}5$, noise invisibility and defense ability reach a trade-off. We will add this experiment to the revised paper.\n\nTable R3: Noise Stealthiness vs. Defense Strength. **Bold** indicates the best result.\n \n| $\\lambda$ | PSNR $\\uparrow$ | CLIP $\\downarrow$ | CLIP-T $\\downarrow$ | CLIP-D $\\downarrow$ |\n|---|:---:|:---:|:---:|:---:|\n| $1e\\mbox{-}4$ | 27.47  | **0.8147** | **0.2018** | **0.0171** |\n| $1e\\mbox{-}5$ | 33.92  | 0.8860  | 0.2193  | 0.0325  |\n| $1e\\mbox{-}6$ | **34.80** | 0.9617  | 0.2692  | 0.0555  |\n\n**Question 1: Would it be possible to use baseline methods combined with some techniques introduced in this paper.**\n\n**Answer:** Yes, our View-Focal Gradient Fusion strategy (VFGF), include wide-view sampling and view-focal weighting, can be integrated into the baseline methods to boost their performance, as shown in Table R4. It can be seen that our strategy improves the attack performance of all baseline methods, validating the effectiveness of this strategy in multi-view attacks. However, these enhanced baseline methods still appear inferior to our DEGauss, which further highlights the comprehensive advantage of our method. We will include this ablation study and the corresponding analysis in the revised manuscript.\n\nTable R4: Quantitative comparison of baseline methods with and without the integration of our View-Focal Gradient Fusion (VFGF). **Bold** indicates the best result.\n \n|  |  | AdvDM |+VFGF | | Mist |+VFGF | | SDS |+VFGF | | AdvPaint |+VFGF  | | DEGauss (Ours) |\n|:---:|:---:|:---:|:---:|:---:|:---:|:---:|:---:|:---:|:---:|:---:|:---:|:---:|:---:|:---:|\n| | CLIP $\\downarrow$ | 0.9235  | 0.9131  | | 0.9599  | 0.9359  | | 0.9707  | 0.9455  | | 0.8996  | 0.8920  | | **0.8860**  |\n| face | CLIP-T $\\downarrow$ | 0.2465  | 0.2399   | | 0.2539  | 0.2206  | | 0.2493  | 0.2314  | | 0.2266  | 0.2205  | | **0.2193**  |\n|  | CLIP-D $\\downarrow$ | 0.0710  | 0.0679  | | 0.0828  | 0.0792  | | 0.0863  | 0.0853  | | 0.0355  | 0.0330  | | **0.0325**  |\n| | | | | | | | | | | | | | | |\n| | CLIP $\\downarrow$ | 0.9072  | 0.8993  | | 0.9564  | 0.9227  | | 0.9546  | 0.9503  | | 0.9046  | 0.8984  | | **0.8949**  |\n| bear | CLIP-T $\\downarrow$ | 0.3057  | 0.2988  | | 0.3106  | 0.3084  | | 0.3107  | 0.3036  | | 0.3011  | 0.2996   | | **0.2940**  |\n|  | CLIP-D $\\downarrow$ | 0.0378  | 0.0337  | | 0.0373  | 0.0349  | | 0.0378  | 0.0317  | | 0.0314  | 0.0295 |  | **0.0256**  |\n\n**Minor points: typo.**\n\n**Answer:** We have revised the indicated typo and double checked the manuscript to avoid similar typos in the next version. Many thanks for your careful reading.\n\n\n**Thanks again for your insightful feedback. We will incorporate all relevant experiments and discussions into the revised version as suggested. If you have any further questions, we would be glad to offer further explanation.**"}, {"review_id": "9b40GYmOZ0", "reviewer": "Reviewer_Uu15", "summary": "The authors propose DEGauss, a novel defense framework targeting malicious 3D editing in Gaussian Splatting. Unlike prior 2D defenses, DEGauss targets on building spatial correlations across multiple views and addresses the limitations of iterative degradation. The method introduces a view-focal gradient fusion mechanism to adaptively prioritize perturbations across viewpoints, and a dual discrepancy optimization strategy to jointly maximize semantic and directional editing divergence. Experiments across diverse scenes and state-of-the-art editing show that DEGauss provides robust multi-view resistance.", "questions": "See the weaknesses", "limitations": "See the weaknesses", "rating": 3, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 2, "significance": 2, "originality": 2, "strengths_and_weaknesses": "Strengths:\n\n(1) The paper is well-written and easy to understand.\n\n(2) The theoretical derivation of the paper is sound and clearly organized.\n\nWeaknesses:\n\n(1) The primary concern lies in the motivation of the task itself. Rather than resisting editing effects, the more fundamental and meaningful challenge in defending against malicious editing is to automatically identify which edits are likely to produce harmful outcomes. In fact, resistance can be implemented in a much simpler and more straightforward manner—for example, by directly disabling the editing optimization process, which I believe would offer a more complete form of protection.\n\n(2) In addition, the paper does not provide a clear definition of what constitutes a “malicious” edit, and the visual examples shown in the paper are ambiguous. For instance, editing a subject to resemble an “Asiatic black bear” may not intuitively be perceived as malicious. As mentioned in point (1), I believe the real challenge in defending against malicious editing lies in defining and identifying malicious intentions, rather than simply mitigating their visual effects.\n\n(3) The paper also lacks a clear definition or metric of successful resistance. What is the expected effect achieved by a successful resistance? Why is a straightforward solution like directly stopping the editing process considered insufficient? These questions should be addressed to clarify the necessity and contribution of the proposed method.", "was_revised": true, "final_justification": "I am convinced with the W1 and W2, thus I would like to raise my score to 3.", "rebuttal": "Thank you for your thoughtful feedback. We have provided point-by-point responses to your concerns as follows.\n\n**Weakness 1: Why not identify harmful edits or simply disable the editing process?**\n\n**Answer:** We would like to clarify that the **(1) core motivation of our task** is to empower content owners to proactively protect their personal 3D digital assets from unauthorized or malicious editing by others. For instance, 3D avatars shared on social platforms can be arbitrarily modified by others, resulting in risks such as impersonation or reputational damage. By applying our protection, the protected 3D assets become resistant to unauthorized modifications, ensuring its authenticity and integrity of 3D avatars in above scenarios. This represents a **user-centric defense paradigm**, enabling asset owners to directly safeguard their content at the source.\n\n**(2)** In contrast, intent-based approaches represent a **platform-centric protection paradigm** that focuses on preventing the occurrence of malicious editing operations. Such methods typically rely on platform or model operators to monitor and regulate user activities. For example, the platform is responsible for monitoring user activity and can directly stop editing operations when malicious editing behavior is detected. While intent-based moderation is valuable for overall platform governance, it does not address the content owner’s need for proactive self-protection.\n\n**(3)** Our task and intent-based methods represent **fundamentally different perspectives**: we focus on user empowerment and protection from the **perspective of content owner**, whereas intent-based solutions approach the problem from the **perspective of platform** monitoring and intervention.\n\n**(4)** In addition, we would like to emphasize that resisting or disrupting malicious editing effects via adversarial noise is **widely recognized** in current research, especially in the area of 2D image editing protection (e.g., AdvDM (ICML’2023) [1], PhotoGuard (ICML’2023) [2], EditShild (ECCV’2024) [3], FaceLock (CVPR’2025) [4], and DiffusionGuard (ICLR’2025) [5]). **Our DEGauss** follows this well-established paradigm and, for the first time, extends it to the emerging domain of 3D editing. As 3D content takes on an essential role in social interaction and digital communication, robust protection of 3D assets is becoming ever more crucial. Our research provides an important foundation for achieving this goal and directly addresses the evolving security needs of generative AI systems.\n\n[1] Adversarial Example Does Good: Preventing Painting Imitation from Diffusion Models via Adversarial Examples. ICML, 2023.\n\n[2] Raising the Cost of Malicious AI-Powered Image Editing. ICML, 2023.\n\n[3] EditShield: Protecting Unauthorized Image Editing by Instruction-guided Diffusion Models. ECCV, 2024.\n\n[4] Edit Away and My Face Will Not Stay: Personal Biometric Defense against Malicious Generative Editing, CVPR, 2025.\n\n[5] DiffusionGuard: A Robust Defense Against Malicious Diffusion-based Image Editing. ICLR, 2025.\n\n**Weakness 2: Explanation of the definition for “malicious” editing and case examples.**\n\n**Answer:** We follow the widely adopted definition of “malicious” editing in previous works [1,2,3,4,5], which refers to **any unauthorized or harmful modification** to the appearance or semantics of 3D assets. The “Asian black bear” example mentioned in this paper is a simple illustrative case that demonstrates our defense's ability to **resist arbitrary operations** by others. The paper also provides more representative examples, such as “turning a person into someone else” (e.g., modifying facial features to resemble a celebrity) or “adding offensive or damaging attributes” (e.g., making someone appear to be on fire). Such cases can cause misrepresentation, defamation, or privacy violations, and are broadly recognized as malicious in the context of digital avatar protection.\n\nWe would also like to clarify that our core motivation is to empower individuals to proactively protect their digital assets from malicious tampering, rather than identifying malicious intent or reviewing user behavior at the model or platform level. For most users, it is impossible to control the intentions or intervene in editing process of others. Therefore, we focus on providing a user-centric defense paradigm that can effectively defend against attacks regardless of the intent. In this way, everyone is enable to safeguard their personal digital 3D assets from unauthorized or harmful modifications.\n\n**Weakness 3: Explanation of how to measure successful resistance.**\n\n**Answer 3:** In this paper, successful resistance is defined as making the editing results deviate from the original editing intention. Specifically, we measure both the visual and quantitative differences between the edited 3D asset and the target editing result to determine the effectiveness of resistance. Quantitative metrics widely used in recent studies [3,4,5] are employed to measure semantic differences, including CLIP, CLIP-T, and CLIP-D.  As demonstrated in Figure 3 and Table 1 of the main paper, our method outperforms existing approaches in both qualitative and quantitative.\n\nFurthermore, in real-world scenarios, asset owners typically do not have permission to access the underlying editing workflow, making it impractical to directly disable the editing process. Therefore, our method, which inject protective perturbations into input images to defend against malicious editing, offers a practical and reliable strategy for asset protection.\n\n**We hope these explanations clear up your confusion. We will provide clearer explanations and analysis in the revised version. If you have any further concerns, we would be pleased to provide more detailed clarification.**"}, {"review_id": "D7zYFDIJNN", "reviewer": "Reviewer_2LZe", "summary": "This paper proposes DEGauss, a novel adversarial attack framework targeting diffusion-based 3D Gaussian Splatting (3DGS) editing. Building upon AdvDM, a 2D adversarial attack formulation for image editing, the authors extend the approach to the 3DGS domain. To enhance attack effectiveness, they introduce two key loss components: Feature Discrepancy Loss and Guidance Discrepancy Loss, which help disrupt the editing process more robustly. Additionally, the paper presents View-Focal Gradient Fusion, a technique designed to ensure balanced viewpoint sampling and adaptive loss weighting in order to the optimization process of adversarial perturbations. As the first work to explore adversarial attacks in 3DGS editing, the paper conducts extensive experiments across various combinations of 2D editing and attack methods, demonstrating superior performance in disrupting the editing pipeline.", "questions": "1. Could you revise the notational conventions used throughout the paper, or provide an explicit explanation of how the semicolon is being used to distinguish function arguments? This would greatly improve clarity.\n2. Are my interpretations of Equations 1, 3, 6, 8–9, and 11 correct? Specifically:\n- Eq. 1: $D_\\phi(I_v^k, I_v, y_{\\text{text}})$\n- Eq. 3: $\\epsilon_\\theta(x_t + \\delta, y_{\\text{text}}, t)$\n- Eq. 6: $D_\\phi(R_v(G^k + \\Delta), y_{\\text{text}})$\n- Eq. 8, 9 and 11: $\\epsilon(R_v(G^k + \\Delta), y_{\\text{text}}, t)$\n3. Can you provide visualizations to support the claim in Line 107 that naïve 2D adversarial attacks fail when applied to 3DGS editing? This would strengthen the motivation for your method.\n4. What are the relative contributions of each loss term (e.g., $L_{\\text{FD}}$, $L_{\\text{GD}}$, and $L_{\\text{render}}$) to the final perturbation $\\Delta$?\n5. How exactly are the baseline methods adapted to the 3DGS setting? Do they follow the same procedure in Algorithm 1, with the difference only in the loss?\n6. Could you please include the baseline similarity values (without DEGauss) in Table 2 to make the effect of your attack more transparent?", "limitations": "Yes", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 2, "significance": 3, "originality": 3, "strengths_and_weaknesses": "**Strengths**\n1. This paper introduces a novel and timely contribution by generalizing adversarial attacks from 2D image editing to 3D Gaussian Splatting (3DGS) editing. To the best of my knowledge, this is the first work to explore adversarial robustness in this context, marking a meaningful step forward in adversarial machine learning for 3D generative models. The mathematical formulation is sound and presented in a coherent manner.\n2. The experimental evaluation is thorough and well-structured. The authors benchmark DEGauss against a wide range of combinations of 2D image editors and adversarial attack methods, demonstrating the effectiveness of the proposed approach in disrupting the editing process. Furthermore, extensive visualizations are provided, supporting the quantitative claims and enhancing the paper’s clarity.\n\n**Weaknesses**\n1. The paper frequently uses a non-standard notation format, e.g., writing functions as $f(a; b, c)$ instead of the more conventional $f(a, b, c)$. This style appears throughout key equations such as Eq. 1, Eq. 3, Eq. 6, and others, and introduces significant ambiguity, especially since the use of a semicolon does not follow established conventions (e.g., semicolon usually used in parameterized distributions like $\\mathcal{N}(x; \\mu, \\sigma^2)$). The lack of an explanation for this notation makes it difficult to interpret equations precisely.\n2. Due to the notational issues, several equations are difficult to parse. For instance, in Eq. 1, the editing model (e.g., InstructNeRF2NeRF) takes both the rendered image and the original image as input, so a clearer version might be written as $D_\\phi(I_v^k, I_v, y_{\\text{text}})$. Similarly, in Eq. 3, the denoising network should arguably be expressed as $\\epsilon_\\theta(x_t + \\delta, y_{\\text{text}}, t)$, and Eq. 6 should likely read $D_\\phi(R_v(G^k + \\Delta), y_{\\text{text}})$. These should be revised to match standard notation and improve interoperability.\n3. In the paragraph starting at Line 107, the authors discuss why 2D adversarial attacks fail when applied directly to the 3DGS setting. However, these arguments are entirely textual. Supporting visualizations would greatly aid readers in understanding the challenges and motivate the proposed modifications.\n4. The rendering loss $L_{\\text{render}}$ in Eq. 12 appears to play a critical role in constraining the adversarial perturbation $\\Delta$, ensuring that the edited result remains close to the original rendering. However, this is only implied, not clearly stated. This term should be explicitly discussed as a regularizer, especially since the adversarial loss components $L_{\\text{FD}}$ and $L_{\\text{GD}}$ are given small weights (1e-5). It would be helpful to know how much each loss component contributes to the final perturbation in practice.\n5. In the supplementary material (Line 452), the authors mention that they \"converted the original optimizations and updates for 2D perturbation to updates for 3DGS parameters.\" However, it is unclear how the baselines are adapted to the 3DGS setting. Do they follow the same update pipeline as DEGauss in Algorithm 1, with only the loss function swapped? Clarifying this setup is important for understanding the fairness and consistency of the comparisons.\n6. Table 2 is meant to demonstrate that DEGauss significantly reduces similarity across editors, indicating successful attack performance. However, it does not include baseline values (i.e., similarity scores without applying DEGauss), which makes the relative effectiveness of the attack hard to evaluate. Including these values would make the table much more informative and complete.\n\n**Conclusion**\n\nDespite some weaknesses in presentation and clarity, particularly around notation, equation interpretation, and baseline details, the core contribution of this paper is novel and promising. As the first attempt at designing adversarial attacks for 3DGS editing, it opens up a new research direction and provides a solid foundation for future work. Therefore, I currently lean toward borderline acceptance, and I would be inclined to raise my score if the authors can adequately address the above questions and concerns.", "was_revised": true, "final_justification": "This paper is the first attempt to investigate the adversarial attack problem in the domain of 3DGS editing. The paper is technically solid and novel. Although there are some issues with the presentation, such as the equation and missing baseline results, the author's rebuttal successfully addresses the most of my concerns. Therefore, I would like to raise my rating to \"accept\".", "rebuttal": "Thank you for your constructive comments and for contributing to the improvement of our paper. We have carefully consider and address them point by point to your comments in the following responses.\n\n**Weakness 1 & Question 1: Explanation of semicolon in Equations.**\n\n**Answer:** Thanks for your valuable suggestion. As suggested, we have replaced all semicolons with commas in all equations in the paper to avoid ambiguity and ensure that the formulas are easy to understand. Our original intention in using semicolons (“;”) was to distinguish between main inputs and conditional inputs in the equations. However, we agree that this notation may lead to confusion or misinterpretation. To improve readability and maintain consistency with common academic conventions, we have now unified the notation and used commas throughout the paper. We appreciate your careful review and constructive feedback on this detail.\n\n**Weakness 2 & Question 2: Explanation of the Equations for editing and denoising models.**\n\n**Answer:** Yes, your understanding is generally correct. We initially used semicolons to separate the main input and conditional input, but this seems to be misleading. In fact, all symbols in the Equations are inputs. Therefore, in Equations (1) and (6), the rendered image $I_v^k$ also needs to be used as the main input for the editing process to perform the editing operations of the diffusion model. Thus, they should be modified as follows: \n\nEq. (1): $D_{\\phi}(I_v^k, I_v, y_{\\text{text}})$, \nEq. (6): $D_{\\phi}(I_v^k, R_v(G^k + \\Delta), y_{\\text{text}})$. \n\nFor the denoising network, which is a key component of the diffusion model, the above inputs are also continued, so Equations (8), (9), and (11) should be rewritten as follows: \n\n$\\epsilon_{\\theta}(I_v^k, R_v(G^k + \\Delta), y_{\\text{text}}, t)$. \n\nSimilarly, in Equation (3), the noisy image $x_t$ after the $t$-th noise addition to the original image also needs to be used as input, as follows: \n\n$\\epsilon_{\\theta}(x_t, x + \\delta, y_{\\text{text}}, t)$.\n\nThese modifications ensure that all relevant variables are clearly and consistently represented in the equations.\n\n**Weakness 3 & Question 3: Can you provide visualizations to support that naïve 2D adversarial attacks fail when applied to 3DGS editing?**\n\n**Answer:** Thanks for your constructive suggestion. We have observed several clear cases where simple 2D adversarial attacks fail when applied to 3DGS setting, as shown in Figure 3 of main paper. However, due to the rebuttal format restrictions, we are unable to provide images, PDFs, or external links on this page. We will add a more intuitive visual demonstration to reinforce this motivation into the main paper, which will further help readers understand these challenges more clearly.\nSpecifically, the core reason why 2D adversarial attacks fail in 3DGS is the lack of multi-view consistency. Perturbations designed for a single view struggle to remain effective in all viewpoints. Furthermore, 2D attacks operate on pixel space and lack control over 3D geometric structure, thus they are ineffective in 3D space.\n\n**Weakness 4 & Question 4: Contributions of each loss component.**\n\n**Answer:** Thank you for your valuable comment. As shown in Table 3 of main paper, we have conducted an ablation study on the weights of $L_{FD}$ and $L_{GD}$, and found that setting both to $1e\\mbox{-}5$ yields optimal performance. These weights are set to a small value because their magnitude differs significantly from that of $L_{render}$.\n\nAdditionally, as suggested, we have performed a comprehensive ablation study to quantify the impact of the attack losses ($L_{FD}$ and $L_{GD}$) and the regularization term $L_{render}$. Specifically, we fix the weight of the rendering loss to 1 as a control variable and adjust the weights of $L_{FD}$ and $L_{GD}$ (jointly denoted as $\\lambda$, as these two are set in balance) to evaluate their influence. As show in the Table R1, increasing the weight $\\lambda$ enhances attack strength (lower CLIP scores) but reduces stealthiness (higher PSNR scores), while decreasing their weight $\\lambda$ improves stealth but weakens the attack effect. When the weight $\\lambda =1e\\mbox{-}5$, the best balance between protection strength and visual fidelity can be achieved. This indicates that attack losses $L_{FD}$ and $L_{GD}$ make important contributions to edit resistance, while rendering loss $L_{render}$ plays a key regularizing role in maintaining the visual quality and structural integrity of 3D assets.\n\nTable R1: Ablation study of each loss component. **Bold** indicates the best result.\n\n| $\\lambda$ | PSNR $\\uparrow$ | CLIP $\\downarrow$ | CLIP-T $\\downarrow$ | CLIP-D $\\downarrow$ |\n|---|:---:|:---:|:---:|:---:|\n| $1e\\mbox{-}4$ | 27.47  | **0.8147** | **0.2018** | **0.0171** |\n| $1e\\mbox{-}5$ | 33.92  | 0.8860  | 0.2193  | 0.0325  |\n| $1e\\mbox{-}6$ | **34.80** | 0.9617  | 0.2692  | 0.0555  |\n\n**Weakness 5 & Question 5: How exactly are the baseline methods adapted to the 3DGS setting?**\n\n**Answer:** Yes, all baseline methods follow the same process as Algorithm 1 and utilize their unique losses to achieve perturbation updates for 3DGS. This is to ensure fairness in comparison. We will provide detailed descriptions in the revised version to ensure that all baselines are described clearly and completely.\n\n**Weakness 6 & Question 6: Include the baseline similarity values (without DEGauss) in Table 2.**\n\n**Answer:** Thank you for your suggestion. We have added the baseline (non-protected) results and the differences before and after protection to the Table R2 to provide a clearer comparison of attack effectiveness. It can be seen that our DEGauss significantly and consistently reduces the CLIP similarity with the normal editing results, more intuitively demonstrating the effectiveness of our method under different editing schemes. We only present results for two scenes due to page limitations. The updated complete table and related discussion will be added in the revised version.\n\nTable R2:  Quantitative analysis of generalization. “Ori” and “Ours” refer to the non-protected and our protection results, and “Diff” refers to the difference between “Ori” and “Ours”.\n \n|  |  |  |  |  |  | face |  |  |  |  |  |\n|---|:---:|:---:|:---:|---|:---:|:---:|:---:|---|:---:|:---:|:---:|\n|  |  | CLIP |  |  |  | CLIP-T |  |  |  | CLIP-D |  |\n| Method | Ori | Our $\\downarrow$ | Diff $\\uparrow$ |  | Ori | Our $\\downarrow$ | Diff $\\uparrow$ |  | Ori | Our $\\downarrow$ | Diff $\\uparrow$ |\n| GaussianEditor | 1.000  | 0.886  | 0.114  |  | 0.284  | 0.219  | 0.065  |  | 0.084  | 0.033  | 0.051  |\n| DGE | 1.000  | 0.890  | 0.110  |  | 0.253  | 0.230  | 0.023  |  | 0.089  | 0.050  | 0.039  |\n| DreamCatalyst | 1.000  | 0.896  | 0.104  |  | 0.277  | 0.248  | 0.029  |  | 0.089  | 0.044  | 0.045  |\n| EditSplat | 1.000  | 0.933  | 0.067  |  | 0.248  | 0.236  | 0.012  |  | 0.083  | 0.053  | 0.030  |\n|  |  |  |  |  |  | **bear** |  |  |  |  |  |\n|  |  | CLIP |  |  |  | CLIP-T |  |  |  | CLIP-D |  |\n| Method | Ori | Our $\\downarrow$ | Diff $\\uparrow$ |  | Ori | Our $\\downarrow$ | Diff $\\uparrow$ |  | Ori | Our $\\downarrow$ | Diff $\\uparrow$ |\n| GaussianEditor | 1.000  | 0.895  | 0.105  |  | 0.313  | 0.294  | 0.019  |  | 0.062  | 0.026  | 0.036  |\n| DGE | 1.000  | 0.890  | 0.110  |  | 0.310  | 0.298  | 0.012  |  | 0.071  | 0.023  | 0.048  |\n| DreamCatalyst | 1.000  | 0.917  | 0.083  |  | 0.333  | 0.305  | 0.028  |  | 0.074  | 0.035  | 0.039  |\n| EditSplat | 1.000  | 0.935  | 0.065  |  | 0.312  | 0.309  | 0.003  |  | 0.051  | 0.028  | 0.023  |\n\n**Thanks again for your constructive comments. We will address your comments by including all pertinent experiments and supplementary details in our revision. If you need further explanations, we are happy to elaborate in more detail.**"}, {"review_id": "HYUMnKwvSu", "reviewer": "Reviewer_2tt7", "summary": "- This paper presents DEGauss, a novel defense framework designed to resist malicious 3D editing in Gaussian splatting scenarios.\n\n- The authors address the limitations of existing 2D defense methods, which fail to handle 3D spatial correlations and are prone to perturbation elimination during 3D editing iterations.", "questions": "- How did the author optimize Equation 12? The Algorithm 1 in the Supplementary Material is not clear.\n- The comparison results between DEGauss and baselines are missing in Table 2.\n- Why doesn't the author output distorted content after malicious editing like in [1]?\n\n\n[1] Ruiz, N., Bargal, S. A., & Sclaroff, S. (2020). Disrupting deepfakes: Adversarial attacks against conditional image translation networks and facial manipulation systems. In Computer Vision–ECCV 2020 Workshops: Glasgow, UK, August 23–28, 2020, Proceedings, Part IV 16 (pp. 236-251). Springer International Publishing.", "limitations": "- Although this paper represents a significant piece of work, there are several aspects that are difficult to comprehend (please see Questions for details), and the writing quality of the paper needs to be improved.", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "**Strengths:**\n- DEGauss is the first framework specifically tailored for defending against 3D malicious editing.\n\n**Weaknesses:**\n- DEGauss is designed for Gaussian splatting and may not directly translate to other 3D formats (e.g., meshes, NeRFs) without further adaptation.\n- The wide-view sampling and iterative optimization might introduce higher computational costs compared to 2D defense methods, though the paper does not explicitly quantify this.\n- The framework of DEGauss relies on pre-trained diffusion models (e.g., InstructPix2Pix), which could limit its performance if these models have inherent biases.", "was_revised": true, "final_justification": "- The authors have addressed my main concern.", "rebuttal": "Thank you for your valuable comments and for your contribution to improving our paper. We have carefully considered your feedback and provide detailed, point-by-point responses as follows:\n\n**Weakness 1: Explanation of transferring DEGauss to other 3D formats (e.g. meshes, NeRFs).**\n\n**Answer:** Thank you for your constructive feedback. While our perturbation modeling is tailored to 3D Gaussian splatting, our main strategies View-Focal Gradient Fusion and Dual Discrepancy Optimization are not restricted to this representation and can be readily adapted to other 3D formats without further adaptation. For example, in meshes or NeRF, when optimizing multiple viewpoints, our View-Focal Gradient Fusion strategy can also be used to apply weights to different viewpoints. These strategies are equally important for other 3D representations, as ensuring multi-view consistency and adaptive gradient emphasis are fundamental challenges across different 3D domains. We will further explore such generalizations in future work.\n\n**Weakness 2: Comparison of computational costs with 2D defense methods.**\n\n**Answer:** Indeed, due to the multi-view nature of 3D optimization, there is an inherent disadvantage in terms of computational cost compared to 2D settings. To ensure fairness, we compared the time consumption and GPU memory usage of the baseline methods extended to 3D defense under the same settings. As shown in Table R1, the wall-clock time and GPU memory of our method is slightly higher than that of AdvDM, Mist, and SDS, due to the additional computational overhead introduced by the multi-view weighting strategy. However, our cost is shorter than AdvPaint, as we only compute gradients using a subset of feature maps rather than the full attention map used in AdvPaint.\n\nIt is important to note that, although some 2D-based baseline methods may achieve shorter time in simpler settings, they fail to meet the multi-view consistency requirements necessary for effective 3D protection (higher CLIP scores). In contrast, our DEGauss framework achieves superior protection across all views, while maintaining comparable computational cost to other methods. We will include the complete table and related discussion in the revised version.\n\nTable R1:  Comparison of computational costs and attack performance with 2D defense methods. Bold indicates the best result.\n \n|  | AdvDM+3DGS | Mist+3DGS | SDS+3DGS | AdvPaint+3DGS | DEGauss (Ours) |\n|:---:|:---:|:---:|:---:|:---:|:---:|\n| Wall-Clock Time $\\downarrow$ | 520.06s | 675.49s | **361.01s** | 959.08s | 893.07s |\n| GPU Memory $\\downarrow$ | 15112MiB | 16744MiB | **13508MiB** | 20220MiB | 16938MiB |\n| CLIP $\\downarrow$ | 0.9235 | 0.9599 | 0.9707 | 0.8996 | **0.8860** |\n\n**Weakness 3: Reliance on pre-trained diffusion models.**\n\n**Answer:** Thank you for your valuable feedback.\nWe would like to clarify that the most advanced methods [1,2,3,4,5] for defending against malicious editing currently rely on pre-trained diffusion models, which are used to optimize perturbations through gradient backpropagation, thereby disrupting unauthorized editing in homogenous diffusion models. We follow this paradigm in our approach and demonstrate superior performance, while also exhibiting excellent generalizability to other mainstream editing frameworks, as shown in Table 2 of main paper. Despite the fact that reliance on pre-trained diffusion models inevitably introduces inherent biases, it remains a widely accepted paradigm in this field. We will point out this limitation in the revised paper.\n\n[1] Adversarial Example Does Good: Preventing Painting Imitation from Diffusion Models via Adversarial Examples. ICML, 2023.\n\n[2] Raising the Cost of Malicious AI-Powered Image Editing. ICML, 2023.\n\n[3] EditShield: Protecting Unauthorized Image Editing by Instruction-guided Diffusion Models. ECCV, 2024.\n\n[4] Edit Away and My Face Will Not Stay: Personal Biometric Defense against Malicious Generative Editing, CVPR, 2025.\n\n[5] DiffusionGuard: A Robust Defense Against Malicious Diffusion-based Image Editing. ICLR, 2025.\n\n\n**Question 1: How did the author optimize Equation 12?**\n\n**Answer:** Thank you for your comment. The optimization of Equation 12 follows these steps:\n\na). Overall Loss Calculation: For each view $i$, we compute the total loss $L_{total}^{i}$.\n\nb). Focal Weight Calculation: We then calculate the focal weights $w_i = \\frac{(L_{\\text{total}}^i + \\epsilon)^\\gamma}{\\sum_{V_n} (L_{\\text{total}} + \\epsilon)^\\gamma}$ for each view based on its loss, so that views with higher loss are given greater emphasis in subsequent gradient updates.\n\nc). Perturbation Update: The perturbation $\\Delta^{(k)}$ of $k$ iteration is updated by aggregating the weighted gradients $\\sum_{n=1}^{N} w_n \\cdot \\nabla_{\\Theta^{(k-1)}} L_{\\text{total}}^{n}$ from all sampled views, following a PGD-style step $\\Delta^{(k)} = \\Delta^{(k-1)} - \\eta \\cdot \\text{sign}(\\sum_{n=1}^{N} w_n \\cdot \\nabla_{\\Theta^{(k-1)}} L_{\\text{total}}^{n})$, where $\\text{sign}(.)$ represents a symbolic function, which takes the value 1 or -1 depending on whether the value is positive or negative.\n\nd). Parameter Update: Finally, the parameters of Gaussians $\\Theta^{(k)}$ are optimized by adding the perturbation $\\Theta^{(k)} = \\Theta^{(k-1)}+\\Delta^{(k)}$.\n\nWe will provide a detailed explanation of Algorithm 1 in the supplementary materials, along with step-by-step pseudocode to ensure clarity and ease of understanding.\n\n**Question 2: Baselines are missing in Table 2.**\n\n**Answer:** Thank you for your suggestion. We have added the baseline (non-protected) results and the differences before and after protection to the Table R2 to provide a clearer comparison of attack effectiveness. It is observed that our DEGauss significantly and consistently reduces the CLIP similarity with the normal editing results, more intuitively demonstrating the effectiveness of our method under different editing schemes. We only present results for two scenes due to page limitations. The updated complete table and related discussion will be added in the revised version.\n\nTable R2: Quantitative analysis of generalization. “Ori” and “Ours” refer to the non-protected and our protection results, and “Diff” refers to the difference between “Ori” and “Ours”.\n \n|  |  |  |  |  |  | face |  |  |  |  |  |\n|---|:---:|:---:|:---:|---|:---:|:---:|:---:|---|:---:|:---:|:---:|\n|  |  | CLIP |  |  |  | CLIP-T |  |  |  | CLIP-D |  |\n| Method | Ori | Our $\\downarrow$ | Diff $\\uparrow$ |  | Ori | Our $\\downarrow$ | Diff $\\uparrow$ |  | Ori | Our $\\downarrow$ | Diff $\\uparrow$ |\n| GaussianEditor | 1.000  | 0.886  | 0.114  |  | 0.284  | 0.219  | 0.065  |  | 0.084  | 0.033  | 0.051  |\n| DGE | 1.000  | 0.890  | 0.110  |  | 0.253  | 0.230  | 0.023  |  | 0.089  | 0.050  | 0.039  |\n| DreamCatalyst | 1.000  | 0.896  | 0.104  |  | 0.277  | 0.248  | 0.029  |  | 0.089  | 0.044  | 0.045  |\n| EditSplat | 1.000  | 0.933  | 0.067  |  | 0.248  | 0.236  | 0.012  |  | 0.083  | 0.053  | 0.030  |\n|  |  |  |  |  |  | **bear** |  |  |  |  |  |\n|  |  | CLIP |  |  |  | CLIP-T |  |  |  | CLIP-D |  |\n| Method | Ori | Our $\\downarrow$ | Diff $\\uparrow$ |  | Ori | Our $\\downarrow$ | Diff $\\uparrow$ |  | Ori | Our $\\downarrow$ | Diff $\\uparrow$ |\n| GaussianEditor | 1.000  | 0.895  | 0.105  |  | 0.313  | 0.294  | 0.019  |  | 0.062  | 0.026  | 0.036  |\n| DGE | 1.000  | 0.890  | 0.110  |  | 0.310  | 0.298  | 0.012  |  | 0.071  | 0.023  | 0.048  |\n| DreamCatalyst | 1.000  | 0.917  | 0.083  |  | 0.333  | 0.305  | 0.028  |  | 0.074  | 0.035  | 0.039  |\n| EditSplat | 1.000  | 0.935  | 0.065  |  | 0.312  | 0.309  | 0.003  |  | 0.051  | 0.028  | 0.023  |\n\n**Question 3: Why not output distorted content after malicious editing?**\n\n**Answer:** Thank you for your insightful comment. \nOur primary goal is to protect personal 3D assets from unauthorized or malicious editing. There are two different defense paradigms in this task: (1) disrupting the output results of editing and (2) maintaining the original input appearance. The fomer, exemplified by method [1], disrupts editing by intentionally outputting highly distorted results, thereby degrading the edited asset. In contrast, the latter, which we follow, focuses on maintaining the similarity to the original input and suppressing the effectiveness of malicious editing without introducing severe deformation. This is particularly important for personal digital 3D facial avatars, as facial distortions can lead to the stigmatization or reputational harm of the content owner. Therefore, in scenarios where preserving digital identity integrity is essential, methods that deliberately produce distorted results are not appropriate.\n\nAccordingly, our strategy is to minimize any perceptible damage to the underlying 3D shape and appearance, ensuring that the original quality of the 3D asset is fully preserved. This user-centric defense paradigm is more consistent with real-world needs, enabling individuals to protect their 3D assets without sacrificing visual fidelity.\n\n[1] Ruiz, N., et al. Disrupting deepfakes: Adversarial attacks against conditional image translation networks and facial manipulation systems. ECCV, 2020.\n\n**Thank you again for your valuable feedback. We will revise the paper to incorporate all related experiments and detailed discussions as you suggested. If there are any additional issues, we are happy to provide further explanations.**"}]

Author rebuttal:

Meta-review: The paper proposes DEGauss, a defense framework that disrupts malicious 3D editing for Gaussian splatting. The key idea is to use a view-focal gradient fusion mechanism to emphasize the most difficult views during perturbation optimization, along with a dual discrepancy optimization strategy that maximizes semantic and directional deviations. Strengths highlighted across reviews include novelty (first to address this problem in 3D settings), strong motivation, clear formulation, and extensive experiments showing effective and robust multi-view protection while preserving rendering quality. Concerns raised included unclear notation, missing baseline comparisons, computational cost, definition of malicious edits, and lack of clarity on evaluation metrics. The authors’ rebuttal addressed these with revised notation, added ablations, runtime comparisons, and clarified definitions, which reviewers acknowledged as satisfactory.

During discussion, three reviewers moved from borderline to accept after the rebuttal, citing that the authors provided convincing clarifications and additional experiments that resolved most initial weaknesses. One reviewer maintained concerns about the task framing but raised the score after authors clarified their user-centric motivation and alignment with established defense paradigms in 2D. In the end, all reviewers agreed the paper is technically solid, novel, and addresses an important and timely problem. While clarity and presentation could still be improved, the overall contribution is strong enough to warrant acceptance.
Decision: Accept (poster)