Research map / 3D vision / Gaussian splatting
Poison-splat: Computation Cost Attack on 3D Gaussian Splatting
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes Poison-splat, a data-poisoning attack that perturbs input images to inflate the Gaussian count, GPU memory and training time of 3D Gaussian Splatting, potentially causing denial of service.
Problem
3D Gaussian Splatting training has input-dependent computational cost (adaptive density control), so an adversary who poisons training images could drive memory and training time toward worst case, causing resource exhaustion or denial of service for 3DGS service providers.
Approach
Formulates the attack as a max-min bi-level problem, approximates the inner 3DGS training with a proxy 3DGS model, uses image total variation (sharpness) as a differentiable surrogate for the number of Gaussians, and optionally bounds perturbations with an L-infinity epsilon ball; the proxy is updated alongside the poisoning to keep multi-view consistency.
Key results
- Constrained attack (epsilon=16/255) raises peak GPU memory up to 8.92x (NS-hotdog, 3336 MB to 29747 MB) and training time up to 2.03x.
- Unconstrained attack increases Gaussian count up to 23.09x (NS-hotdog) and peak GPU memory up to 22.33x (NS-lego, reaching about 78852 MB).
- Black-box attack on Scaffold-GS with epsilon=16/255 increases Gaussians up to 5.01x (NS-lego) and memory up to 1.60x.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Poison input images with ε = 16/255 | 3DGS · Mip-NeRF360 (room) | peak GPU memory: 12316 -> 46238; 3.75x | Helped |
| Remove the perturbation constraint (ε = ∞) | Poison-splat on 3DGS · NeRF-Synthetic (ship) | peak GPU memory: 3692 -> 80956; 21.93x | Helped |
| Transfer constrained Poison-splat to a black-box victim | Scaffold-GS · NeRF-Synthetic (lego), ε = 16/255 | number of Gaussians: 0.414 M -> 2.074 M; 5.01x | Helped |
| Transfer unconstrained Poison-splat to a black-box victim | Scaffold-GS · NeRF-Synthetic (lego), ε = ∞ | training time: 9.77 -> 26.11; 2.67x | Helped |
| Remove the proxy model and maximize total variation independently per view (ablation) | Poison-splat · Mip-NeRF360 (room) | number of Gaussians | Hurt |
| Cap the number of Gaussians during training (ablation) | 3DGS defense · 3D reconstruction | reconstruction quality | Hurt |
Surprising findings
- Simply capping the Gaussian count as a defense markedly degrades reconstruction quality, since 3DGS cannot distinguish necessary fine detail from poisoned texture.
- Image-level TV maximization without a proxy model is substantially less effective than the full method, attributed to multi-view inconsistency.
Limitations
- The number of Gaussians is only a proxy for computational cost; the authors note better metrics (e.g., Gaussian density per tile) may exist.
- Evaluation is on a single NVIDIA A800 GPU with mostly white-box settings; black-box tested on only Scaffold-GS and Mip-Splatting.
Experimental setup
Datasets: NeRF-Synthetic Mip-NeRF360 Tanks-and-Temples
Benchmarks: NeRF-Synthetic Mip-NeRF360 Tanks-and-Temples
Metrics: number of Gaussians peak GPU memory training time rendering speed (FPS)
Baselines: image-level TV maximization attack (naive, no proxy model) clean training Gaussian-count capping defense
Builds on: 3D Gaussian Splatting adversarial attacks (PGD-style sign gradient with epsilon-ball projection) sponge examples
Closest papers by meaning
- RemedyGS: Defend 3D Gaussian Splatting Against Computation Cost Attacks (CVPR 2026 · similarity 0.93)
- SecureGS: Boosting the Security and Fidelity of 3D Gaussian Splatting Steganography (ICLR 2025 · similarity 0.87)
- GuardSplat: Efficient and Robust Watermarking for 3D Gaussian Splatting (CVPR 2025 · similarity 0.84)
- DiffGS: Functional Gaussian Splatting Diffusion (NeurIPS 2024 · similarity 0.84)
- GS-Hider: Hiding Messages into 3D Gaussian Splatting (NeurIPS 2024 · similarity 0.84)
- 3D-GSW: 3D Gaussian Splatting for Robust Watermarking (CVPR 2025 · similarity 0.83)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.