{"id":"25328a5d-728e-465b-b74f-6f943d78c2a1","arxiv_id":"2412.02803","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"M-IFGSM, a masked iterative FGSM attack on CLIP, reduces top-1 accuracy to 12.5% on training renders and 35.4% on test renders of 3D Gaussian Splatting models.","lead":"This paper presents M-IFGSM, an adversarial attack that adds masked noise to 2D images of objects to fool the CLIP vision-language model. The authors then build 3D Gaussian Splatting models from the perturbed images and measure how well the attack survives in rendered views.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The test-render accuracy drop is not isolated from reconstruction artifacts: without a same-epsilon random or non-adversarial corruption control, the Section 3.2 results could reflect generic 3DGS degradation rather than adversarial transfer.","rationale":"The reader's conditional verdict is appropriate. The paper's central empirical claim is that M-IFGSM perturbations engineered in 2D persist through 3D Gaussian Splatting and degrade CLIP on novel views. The strongest evidence is Table 2, where adversarial test renders drop to 35.4% top-1 accuracy from 91.2%. The load-bearing gap is that the only comparison is clean versus attacked; there is no control for non-adversarial corruption. Because 3DGS optimization is not a fixed renderer, a perturbed training set can change reconstruction quality in ways that are unrelated to the adversarial objective, and any such global artifact would reduce CLIP accuracy. Without a same-budget random-noise control, the observed drop cannot be attributed to the adversarial optimization. This is not a disagreement with the general possibility that adversarial perturbations transfer through differentiable pipelines; it is a measurement-identification problem in this specific evaluation. Secondary weaknesses, including the white-box setting, lack of perceptual validation, and absence of error bars, reinforce the need for the control but are not the single decisive issue. If the control shows that random noise does not degrade accuracy, the core claim is supported and conditional acceptance is warranted; if not, the claim is overstated. Thus the verdict remains conditional pending this experiment.","tokens_in":7630,"tokens_out":4470,"duration_ms":49545,"concrete_test":"Train three additional 3DGS models per object using the same 35-image training set as in Section 2.3: (1) M-IFGSM adversarial images, (2) images with uniform random noise of the same L-infinity magnitude as measured from the M-IFGSM images, and (3) images with a non-targeted FGSM perturbation of the same magnitude. Render the same six held-out camera positions and evaluate CLIP ViT-B/16. If the random-noise 3DGS renders have top-1 accuracy statistically indistinguishable from the M-IFGSM renders, the observed degradation is explained by reconstruction artifacts and the adversarial-transfer claim is unsupported; if they remain near the clean baseline of 91.2%, the adversarial signal is confirmed. Report per-class counts and bootstrap confidence intervals because each class has only six test renders.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim requires that the accuracy drop in adversarial 3DGS renders is caused specifically by the adversarial signal surviving the 3DGS optimization, not by generic reconstruction failure. Section 3.2 compares adversarial 3DGS models only to clean 3DGS models; there is no control trained on images with random noise or non-adversarial perturbations of the same magnitude. M-IFGSM adds RGB perturbation before 3DGS reconstruction, so the optimizer may fit that noise in ways that produce blur, floaters, or color shifts in rendered novel views. Any such artifact would reduce CLIP accuracy even without adversarial optimization. The paper also does not report the perturbation budget (epsilon) or the achieved L-infinity/L2 norms, and it provides no human perceptual validation for the claim that the noise is nearly imperceptible. Table 2 further shows inconsistent transfer, with Couch and Hydrant test renders remaining at 0.833 top-1 accuracy, and each class has only six test renders, so the average of 35.4% is fragile without error bars. If equal-magnitude random noise causes a comparable drop, the adversarial component of the attack is not the load-bearing cause.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes M-IFGSM (Masked Iterative Fast Gradient Sign Method), an adversarial attack that applies masked perturbations to 2D images of objects, then uses those adversarially perturbed images to reconstruct 3D Gaussian Splatting (3DGS) models. The authors evaluate the attack on CLIP ViT-B/16 zero-shot classification using eight object classes from CO3D, reporting that top-1 accuracy on rendered views drops from 95.4% to 12.5% for training-view renders and from 91.2% to 35.4% for test-view renders. The central claim is that 2D masked adversarial noise survives 3DGS reconstruction and degrades CLIP classification on novel views, with the noise being nearly imperceptible to humans.","tokens_in":7862,"tokens_out":2824,"duration_ms":28886,"significance":"If fully supported, the result would be a useful demonstration that 2D adversarial perturbations can survive a 3D reconstruction pipeline and affect a vision-language model on held-out views, which is relevant to the security of 3D vision systems. The paper is transparent in reporting per-class results, and the train/test split is clearly defined. However, the evidence currently provided is not sufficient to establish the central claim: there is no control for generic reconstruction artifacts, no statistical characterization of the small per-class test-render samples, no reported perturbation budget, and no transfer test beyond the exact CLIP model used to generate the attack. These are load-bearing gaps because the paper's headline numbers depend on them.","major_comments":[{"comment":"The claimed transfer of adversarial noise to 3DGS renders is not separated from generic reconstruction artifacts. The adversarial 3DGS models are compared only against clean 3DGS models; there is no control trained on images corrupted with equal-magnitude random noise or non-adversarial perturbations. Because M-IFGSM adds RGB perturbations before 3DGS optimization, the reconstruction could suffer from blur, floaters, or color shifts that reduce CLIP accuracy even without any adversarial intent. Adding a same-epsilon random-noise control is necessary to establish that the accuracy drop is caused by the adversarial signal rather than by generic degradation.","section":"§3.2, Table 2"},{"comment":"The reported test-render averages are statistically fragile. Each class contributes only six test renders, the averages are presented without error bars or confidence intervals, and the per-class results vary widely: Couch and Hydrant retain 0.833 top-1 accuracy in adversarial test renders, while Suitcase drops to 0.000. The paper's claim that the attack 'effectively transfers' to novel views therefore needs per-class confidence intervals or a paired statistical test across the eight classes; without this, the 35.4% average is not a reliable estimate.","section":"§3.2, Table 2"},{"comment":"The perturbation budget is never reported. The manuscript defines an epsilon parameter and an early-stopping threshold tau, but it does not state the value of epsilon used, nor the achieved L-infinity or L2 norms of the perturbations. The abstract's claim that the noise is 'nearly imperceptible' is therefore unsupported by quantitative evidence; there is also no human perceptual study or perceptual similarity metric. The authors should report the actual perturbation magnitudes and provide some perceptual evaluation, even a small human study or a standard metric such as LPIPS.","section":"§2.2, Eq. (1)-(2)"},{"comment":"The attack is generated and evaluated with the same CLIP ViT-B/16 model, and the early-stopping criterion requires the true-class probability to reach zero. This means the attack's success on the training images is partially by construction, and the paper does not test whether the adversarially perturbed images or the 3DGS renders transfer to a different classifier. Reporting transfer to a second model (e.g., a different CLIP backbone or a ResNet trained on ImageNet) is important to support the general security claim in the abstract and conclusions.","section":"§3.1, Table 1"},{"comment":"The paper acknowledges that the couch mask perturbs only one of two couches and that some test views show diminished attack effect, but it does not analyze how these failure cases affect the headline averages. The authors should either exclude or separately discuss such cases, or report results both with and without them, so readers can see how sensitive the average drop is to these known failure modes.","section":"§3.2, Table 2 and Figure 4"}],"minor_comments":[{"comment":"There are numerous typographical and formatting issues: 'Conf idence' has an unintended space, 'iiii' appears instead of 'iv' in the list of reconstruction stages, and Figure 4's caption contains 'veiw' instead of 'view'.","section":"General"},{"comment":"The reference list uses inconsistent formatting (e.g., 'Li u. a.' and 'Schonberger und Frahm') and several entries lack full bibliographic information. The CLIP citation appears as a general 'Vision-Language Intelligence' paper rather than the original CLIP paper; the authors should cite Radford et al. (2021) for CLIP.","section":"References"},{"comment":"The notation Clipmin,max is not defined clearly; it should specify that clipping is applied per-pixel to the valid RGB range, and the bounds min and max should be named explicitly.","section":"§2.2, Eq. (1)-(2)"},{"comment":"The statement 'Our pipeline is designed with flexibility in mind' is not supported by experiments on any model other than CLIP; either add such experiments or temper the claim.","section":"§2.2"},{"comment":"The checkpoint name 'sam-vit-h-4b899' may be a typo or nonstandard; the standard SAM checkpoint names are 'sam_vit_h_4b8939' or similar. Please verify.","section":"§2.4"}],"recommendation":"major_revision","confidential_remarks":"The manuscript addresses a relevant and timely topic, and the basic pipeline (masked adversarial perturbation followed by 3DGS reconstruction) is clear. The main experiment is underpowered as presented: eight classes and six test renders per class, no control condition, no error bars, no perturbation magnitude reporting, and no transferability check. These are fixable with additional experiments, so I am recommending major revision rather than rejection. I would also note that the 'nearly imperceptible' claim is a stated contribution but is not substantiated; a perceptual study or at least a quantitative distortion metric would be needed."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short version: the paper asks a fair question—does a masked 2D adversarial perturbation survive 3D Gaussian Splatting reconstruction and still fool CLIP on held-out renders? The answer they give is “yes, sometimes,” which is worth knowing. The method is not novel: M-IFGSM is IFGSM restricted to a SAM mask. The new bit is the test of transfer through 3DGS, and they report a real effect on train renders (95.4% to 12.5%) and a weaker, class-dependent effect on test renders (91.2% to 35.4%).\n\nWhat the paper does well: it is honest. The pipeline is simple and reproducible, and the authors call out the couch masking failure where only one of two couches is perturbed. The numbers are consistent with the figures, and the test-render weakness is visible in their own Table 2.\n\nThe soft spots are load-bearing. First, there is no control with random or non-adversarial noise at the same epsilon. The 3DGS optimizer is fitting perturbed images, so generic reconstruction artifacts—blur, floaters, color shifts—could themselves drop CLIP accuracy. Without that control you cannot attribute the drop to adversarial signal. Second, they never report epsilon or the achieved perturbation norm, so “nearly imperceptible” is asserted, not demonstrated. Third, the evaluation is eight classes, six test renders per class, one CLIP model, no error bars. Fourth, the attack is white-box against the same CLIP model used for evaluation, so the train-render success is partly by construction; they do not test transfer to another model.\n\nNone of these are fatal to the idea. They are fatal to the paper in its current form. This is a preliminary demonstration, not a measured vulnerability claim.\n\nWho it’s for: researchers working on 3D adversarial robustness or 3DGS security will find it a useful data point and a good checklist for designing proper controls. It deserves a serious referee if the authors add the missing controls, report perturbation budgets, and scale the evaluation. As submitted, I would not accept it for a top venue, but I would not desk-reject it outright—send it to peer review with the clear expectation of major revision, because the question is legitimate and the authors are transparent about limitations.","headline":"Plausible demo that masked 2D IFGSM noise can survive 3DGS reconstruction and hurt CLIP on some rendered views, but the missing controls and tiny evaluation keep it a preliminary result, not a demonstrated vulnerability.","tokens_in":8392,"tokens_out":2849,"would_cite":false,"duration_ms":30497,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Masked adversarial noise survives 3D Gaussian Splatting reconstruction and cuts CLIP's top-1 accuracy on training-view renders from 95.4% to 12.5%.","keywords":["adversarial attacks","3D Gaussian Splatting","CLIP","vision-language models","M-IFGSM","masked perturbations","zero-shot object detection","radiance field robustness"],"falsifier":"A direct check is to compare M-IFGSM against random Gaussian noise of the same $\\ell_\\infty$ magnitude applied to the same masked regions: if the random-noise renders produce a similar drop in CLIP top-1 accuracy, the reported 12.5% and 35.4% figures would be a masking artifact rather than evidence that adversarial gradients transfer through 3DGS.","tokens_in":7436,"feed_emoji":"🎯","tokens_out":10138,"duration_ms":94472,"temperature":0.7,"pith_summary":"The paper sets out to show that a 2D adversarial attack can survive a full 3D reconstruction pipeline and keep fooling a vision-language classifier. It introduces M-IFGSM, an iterative fast-gradient-sign attack whose updates are multiplied by a segmentation mask so that only the target object is changed; the resulting images are used to train a 3D Gaussian Splatting model. The reported effect is that CLIP's top-1 accuracy on renders from training camera positions drops from 95.4% to 12.5%, and on held-out test camera positions from 91.2% to 35.4%, with confidence shifting from the true class to misclassifications. If that holds, reconstructed 3D scenes can carry human-invisible errors into downstream classification, which matters for robotics, autonomous driving, and surveillance.","feed_headline":"83-point drop: 3D renders inherit masked 2D attack","feed_subtitle":"Noise confined to the object's silhouette survives Gaussian Splatting, cutting CLIP accuracy to 12.5%.","key_machinery":"The load-bearing object is the masked update rule $X_{N+1}^{\\mathrm{adv}} = \\mathrm{Clip}\\left(X^{\\mathrm{inv}} + M \\odot \\left(X_N^{\\mathrm{adv}} + \\epsilon \\cdot \\mathrm{sign}(\\nabla_X J)\\right)\\right)$, where $M$ is a Segment Anything segmentation mask and $X^{\\mathrm{inv}}$ is the untouched background. M-IFGSM iterates this rule until the true-class probability reaches zero, then the attacked images are fed into 3D Gaussian Splatting, whose optimization bakes the localized noise into the Gaussians' appearance parameters; rendering those Gaussians with a tile-based rasterizer produces the views that CLIP then misclassifies.","core_discovery":"The central claim is that masked 2D adversarial perturbations become part of the 3D representation during Gaussian Splatting optimization and reappear in rasterized renders. Using eight CO3D classes, the authors report that CLIP ViT-B/16's top-1 accuracy falls from 95.4% to 12.5% on training-view renders and from 91.2% to 35.4% on test-view renders, while the model's confidence in the true label is replaced by confidence in wrong labels. The authors describe the added noise as nearly imperceptible to human observers, and they attribute the attack's transfer to the mask focusing all perturbation energy on the object itself.","pith_inferences":["A testable next step the paper does not run is to backpropagate through the 3DGS rasterizer and perturb the Gaussian parameters directly, which would likely close the train/test gap the authors observe for unseen camera positions.","The large per-class spread in the paper's rendered-view table (suitcase test renders stay at 0% top-1 while couch and hydrant stay near 83%) suggests that multi-view fusion or render-time smoothing could average the attack out, a defensive direction the paper does not explore.","Because M-IFGSM only needs a differentiable classifier and a segmentation mask, the same 2D-to-3D transfer should generalize to other vision-language and detection models, with the attack's real-world harm depending on whether an adversary can get manipulated images into the reconstruction pipeline."],"forward_implications":["Training-view renders of an adversarially reconstructed 3DGS model classify the true object only 12.5% of the time, against 95.4% for a clean model.","Novel test-view renders still drop from 91.2% to 35.4% top-1 accuracy, so the effect is not limited to memorized viewpoints.","Because the perturbation is confined to the object silhouette and reported as nearly imperceptible, human inspection alone is not a reliable defense.","The same masked-attack pipeline is described as model-agnostic, so other differentiable classifiers besides CLIP are exposed to the same transfer.","The couch failure case shows that when segmentation misses an object instance, the clean instance can keep the prediction correct, making mask coverage a direct control variable for attack success."],"supporting_citations":[{"why":"The CLIP vision-language model is the victim whose zero-shot classification is attacked.","marker":"Li u. a. (2022)"},{"why":"3D Gaussian Splatting is the reconstruction pipeline whose renders are evaluated.","marker":"Kerbl u. a. (2023)"},{"why":"Segment Anything produces the masks that confine the perturbation to the object.","marker":"Kirillov u. a. (2023)"},{"why":"CO3D supplies the eight object classes and multi-view images.","marker":"Reizenstein u. a. (2021)"},{"why":"FGSM is the base method M-IFGSM extends to masked iterative attacks.","marker":"Goodfellow u. a. (2015)"},{"why":"The ViT-B/16 architecture defines how CLIP processes the 224x224 image patches.","marker":"Dosovitskiy u. a. (2021)"},{"why":"Structure-from-Motion initializes the point cloud for the 3DGS optimization.","marker":"Schonberger und Frahm (2016)"}],"fun_headline_variants":["Masked attack on 3D renders slashes CLIP accuracy to 12.5%","3D Gaussian Splatting vulnerable to nearly imperceptible adversarial noise","Adversarial mask on 3D objects fools CLIP: 95.4% to 12.5%","M-IFGSM attack on Gaussian Splatting cuts CLIP accuracy to 12.5%","Nearly imperceptible noise on 3D objects drops CLIP accuracy to 12.5%"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The paper assumes that noise placed only on the object in a handful of training photographs will survive the 3D reconstruction optimization and still degrade classification when the model is rendered from camera positions that were never part of the attack.","fun_headline_variants_meta":{"raw":{"variants":["Masked attack on 3D renders slashes CLIP accuracy to 12.5%","3D Gaussian Splatting vulnerable to nearly imperceptible adversarial noise","Adversarial mask on 3D objects fools CLIP: 95.4% to 12.5%","M-IFGSM attack on Gaussian Splatting cuts CLIP accuracy to 12.5%","Nearly imperceptible noise on 3D objects drops CLIP accuracy to 12.5%"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.001519,"raw_usage":{"total_tokens":6089,"prompt_tokens":954,"completion_tokens":5135,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":570,"completion_tokens_details":{"reasoning_tokens":5011}},"tokens_in":570,"tokens_out":5135,"duration_ms":33974,"temperature":1.0,"reasoning_tokens":5011,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T23:04:43.307086+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"A direct check is to compare M-IFGSM against random Gaussian noise of the same $\\ell_\\infty$ magnitude applied to the same masked regions: if the random-noise renders produce a similar drop in CLIP top-1 accuracy, the reported 12.5% and 35.4% figures would be a masking artifact rather than evidence that adversarial gradients transfer through 3DGS.","supporting_citations":[{"cited_title":"2023 Kerbl , Bernhard ; Kopanas , Georgios ; Leimk \\\"u hler , Thomas ; Drettakis , George: 3D Gaussian Splatting for Real-Time Radiance Field Rendering","cited_arxiv_id":null,"evidence_quote":"3D Gaussian Splatting is the reconstruction pipeline whose renders are evaluated."},{"cited_title":"2023 Kirillov , Alexander ; Mintun , Eric ; Ravi , Nikhila ; Mao , Hanzi ; Rolland , Chloe ; Gustafson , Laura ; Xiao , Tete ; Whitehead , Spencer ; Berg , Alexander C","cited_arxiv_id":null,"evidence_quote":"Segment Anything produces the masks that confine the perturbation to the object."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"CO3D supplies the eight object classes and multi-view images."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"The ViT-B/16 architecture defines how CLIP processes the 224x224 image patches."},{"cited_title":"Frahm , Jan-Michael: Structure-From-Motion Revisited","cited_arxiv_id":null,"evidence_quote":"Structure-from-Motion initializes the point cloud for the 3DGS optimization."}],"review_version":1}