{"id":"ec86a561-d5c6-488f-b491-52567ca1d92f","arxiv_id":"2506.00280","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":2,"one_line_summary":"3DGS scenes can be poisoned or directly perturbed to embed view-dependent adversarial content that misleads YOLOv8 and Faster R-CNN object detectors.","lead":"The paper demonstrates two attacks on 3D Gaussian Splatting (3DGS), a popular neural rendering method. One hides adversarial images that show up only from specific camera angles; the other directly tweaks the scene's stored parameters to fool object detectors.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"CLOAK's claimed view-dependent 3DGS vulnerability is not established: the poisoned training images already contain the adversarial textures, so without a clean-scene control the YOLOv8 failures may be due to trivial data poisoning rather than SH-based view-dependence.","rationale":"The reader identified the missing clean-scene baseline as the weakest assumption, and I agree that this is a central experimental gap. My stress-test sharpens the concern: the missing control is not merely about rendering artifacts or detector angle-dependence; it is about whether CLOAK demonstrates a 3DGS-specific vulnerability at all. Since the attack dataset itself specifies the adversarial texture at the targeted viewpoints, a 3DGS trained on that data reproducing those textures is expected behavior, not evidence of an SH-specific attack surface. The paper's open-source code and qualitative demonstrations are real supporting evidence, but they do not replace the quantitative controls needed to attribute the detector failures to the learned view-dependent representation. DAGGER has its own weaknesses (a single successful example, no perceptual-quality measurement), but CLOAK is the claimed 'first' contribution and therefore the more load-bearing. If the proposed control tests show that a clean 3DGS detects the car reliably at overhead views and that direct poisoned frames do not fully explain the misses, the concern is resolved and the central claim becomes substantially stronger. Until then, a conditional verdict is appropriate.","tokens_in":4943,"tokens_out":6329,"duration_ms":68094,"concrete_test":"Train a clean 3DGS scene from the same 210 benign car renders (no adversarial textures) and render YOLOv8 detections from the same 80 overhead viewpoints; if clean overhead views are also missed at a comparable rate, then the reported CLOAK misses are not attributable to the adversarial embedding. Additionally, run YOLOv8 directly on the poisoned training frames that supervise the 80 overhead views without any 3DGS reconstruction; if those frames also produce ~78/80 misses, then CLOAK's effect is fully explained by the injected training images, and the 3DGS representation contributes nothing beyond reproducing the poisoned supervision.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"The central novelty claim for CLOAK is that 3DGS's SH-based view-dependent appearance lets an adversary embed adversarial content visible only from chosen viewpoints. The load-bearing assumption is that the reported YOLOv8 failures (78/80 overhead misses, Section 4.1) are caused by this learned view-dependence rather than by the trivial fact that the poisoned training set already contains road/stop-sign textures at exactly the 80+20 targeted camera poses. Section 4.1 provides no control: no clean 3DGS trained on all 210 benign views, no baseline where the same poisoned rendered frames are passed through YOLOv8 without 3DGS, and no analysis of whether the SH coefficients encode a view-dependent function beyond memorizing per-view supervision. Because 3DGS optimizes a single global representation, inconsistent training views force a compromise; the attack's success may reflect that compromise or simple overfitting to training views, not a generalizable SH vulnerability. The qualitative setup also confounds geometry with appearance: a top-down view of a car whose roof is textured like a road is not car-like regardless of SH. Without a clean-scene control, the attack cannot be distinguished from poisoning any 3D reconstruction pipeline with inconsistent images. This gap is load-bearing because the paper's 'first attack leveraging view-dependent Gaussian appearances' claim rests on it.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper introduces two attacks on 3D Gaussian Splatting (3DGS): CLOAK, a training-time data poisoning attack that uses Spherical Harmonic (SH) view-dependent appearance to hide adversarial textures that appear only from attacker-chosen viewpoints, and DAGGER, a white-box post-training attack that directly perturbs Gaussian attributes via projected gradient descent to fool a downstream object detector. The CLOAK experiments render a car with a road texture from overhead and a stop-sign texture from behind, then report that YOLOv8 misses the car in 78 of 80 overhead views. The DAGGER experiments show a single Faster R-CNN misclassification of a car as a person with confidence above 70% in 11 iterations. The paper claims these are the first attacks of their kind and releases code for reproducibility.","tokens_in":5247,"tokens_out":3166,"duration_ms":32333,"significance":"If the attacks are established as described, the paper would make a meaningful contribution by identifying a new attack surface in 3DGS—view-dependent appearance via SH—and by demonstrating a direct white-box attack on the Gaussian representation itself. The open-source release is a concrete strength for reproducibility and downstream defense research. However, the significance is conditional: the central CLOAK claim that the view-dependence mechanism (rather than trivial per-view data poisoning) causes the detector failures is not currently supported by the evidence, and the DAGGER demonstration rests on a single anecdotal example. The paper would be a useful addition to the adversarial ML literature once these gaps are addressed.","major_comments":[{"comment":"The single successful DAGGER example does not establish that the attack reliably deceives Faster R-CNN. The paper reports one scene, one targeted misclassification ('car' → 'person'), and no error bars, multiple runs, or comparisons against a random-perturbation baseline. Given that white-box PGD on 2D images typically requires multiple runs and statistical evaluation, the authors should provide results across several scenes, random seeds, and attack budgets (e.g., different epsilon values), and include a baseline with Gaussian attributes perturbed randomly within the same L2 norm to show that the gradient-based optimization is what drives the misclassification.","section":"Sec. 4.1, Eq. (1)"},{"comment":"The abstract claims CLOAK is 'the first attack that leverages view-dependent Gaussian appearances,' but the related work discussion does not provide enough detail to substantiate this. The authors cite Zeybey et al. (2024) as a poisoning attack on CLIP ViT-B/16, but they do not state whether that attack also uses view-dependent rendering or SH; if it does, the novelty claim needs to be narrowed or qualified. The discussion should clarify the exact technical distinction, either by describing the prior method's mechanism or by citing a source that makes the absence of view-dependence explicit.","section":"Sec. 2, novelty claim"}],"minor_comments":[{"comment":"The phrase 'an \"person\"' contains a typo; it should be 'a \"person\"'.","section":"Sec. 4.2"},{"comment":"The learning rate is specified as alpha = epsilon * 2 / steps, but 'steps' is never defined; please specify the number of PGD iterations used.","section":"Sec. 4.2"},{"comment":"The caption reads 'OurCLOAKattack' without spaces; this appears to be a formatting error.","section":"Fig. 1 caption"}],"recommendation":"major_revision","confidential_remarks":"The paper is a short contribution with promising ideas but the evidence is anecdotal. The CLOAK control experiments are essential before publication; the DAGGER evaluation also needs to be more thorough. The open-source release is commendable and should be acknowledged in any revision."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: this is a plausible, clearly written paper on two attacks against 3D Gaussian Splatting, but the main claimed novelty — CLOAK, using SH view-dependence to conceal adversarial content — is not actually established by the experiments as written, because there is no clean-scene control.\n\nWhat's genuinely new: CLOAK is the first attack I know of that uses spherical harmonic view-dependent appearance to hide adversarial textures from specific viewpoints. That's a nice idea. The authors correctly identify that 3DGS's SH coefficients make view-dependent appearance a first-class property, which older NeRF-based attacks didn't exploit. DAGGER is a more straightforward extension — PGD applied to Gaussian attributes — but it's cleanly formulated and it works against Faster R-CNN in a white-box setting. Open-sourcing the code is also good practice.\n\nWhere it gets soft: the CLOAK evaluation. The training set consists of 210 rendered views: 110 benign, 80 with a \"road\" texture on the car, 20 with a \"stop sign\". They report YOLOv8 misses 78 of 80 overhead views. But they don't show what happens with a clean 3DGS trained on all 210 benign views, nor do they feed the poisoned rendered frames directly to YOLOv8 without 3DGS. So the failures could be explained by trivial data poisoning — the detector simply sees the road texture it already knows — rather than by the SH-based view-dependence doing anything special. The stress-test note is right on this. The geometry is also confounded: a top-down view of a car textured like a road is not car-like even if SH did nothing. So the central novelty claim rests on a missing control. This is fixable; a proper ablation would either confirm SH matters or reveal that the attack is equivalent to standard dataset poisoning.\n\nDAGGER's evaluation is thinner: a single successful misclassification, no error bars, no multiple runs or scenes. The formulation is fine, but the empirical support is anecdotal.\n\nOverall: the ideas are legitimate and the paper is worth a serious referee in a security or 3DV venue, but it needs major revision on the experiments. If the authors add the missing baselines and some breadth, this could be a solid contribution. As it stands, I would not cite it yet.\n\nRecommendation: send to peer review, but expect heavy revision.","headline":"Plausible new attacks on 3DGS, but the flagship CLOAK result lacks the control needed to support the view-dependence claim.","tokens_in":5783,"tokens_out":2361,"would_cite":false,"duration_ms":22027,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper introduces two attacks on 3D Gaussian Splatting scenes: CLOAK hides adversarial content in view-dependent colors, and DAGGER perturbs Gaussian attributes directly to fool object detectors.","keywords":["3D Gaussian Splatting","adversarial attack","view-dependent rendering","spherical harmonics","object detection","data poisoning","projected gradient descent","autonomous driving"],"falsifier":"Render the same Blender car scene from the 80 overhead camera poses without any CLOAK poisoning and run YOLOv8: if the detector already misses the car on many of those clean views, the reported 78 out of 80 misses cannot be attributed to the attack. For DAGGER, check whether the perturbed Gaussian scene still fools Faster R-CNN after re-rendering from viewpoints not used in the PGD optimization and after saving and reloading the scene file; if the misclassification does not survive, the effect is an optimization artifact rather than a persistent scene manipulation.","tokens_in":1573,"feed_emoji":"🚗","tokens_out":1882,"duration_ms":61479,"temperature":0.7,"pith_summary":"This paper claims that 3D Gaussian Splatting (3DGS), a fast-growing rendering technique for real-time novel-view synthesis, has a security blind spot: its view-dependent appearance model can be weaponized. Two attacks are introduced. CLOAK poisons the training images so that an object such as a car renders normally from most angles but shows an adversarial texture, such as a road or stop sign, only from attacker-chosen viewpoints, causing YOLOv8 to miss the car in 78 of 80 overhead views. DAGGER assumes white-box access to the trained scene and uses projected gradient descent to perturb Gaussian color coefficients, making Faster R-CNN misclassify a car as a person, elephant, or stop sign with high confidence in as few as 11 iterations. If these attacks hold, any safety-critical system that builds a 3DGS scene from untrusted imagery and then runs object detection must treat the scene itself as an attack surface.","feed_headline":"3D scene attacks hide cars and fool detectors","feed_subtitle":"CLOAK and DAGGER exploit 3D Gaussian Splatting to hide objects from specific viewpoints and force misclassifications.","key_machinery":"The machinery is the spherical harmonic (SH) color encoding used in 3DGS, augmented with projected gradient descent (PGD) for the direct attack. Each Gaussian stores SH coefficients rather than a fixed RGB value, so its rendered color is a continuous function of viewing direction; CLOAK exploits this by making the training data contain different textures at different camera poses, forcing the SH coefficients to learn both appearances. DAGGER treats the scene file as a differentiable parameter vector and runs PGD on the SH coefficients of targeted Gaussians, masked so that gradients flow only to the target object, then re-renders and feeds the image to a detector to update the perturbation under an $\\ell^2$ norm constraint with budget $\\epsilon$.","core_discovery":"The paper's central claim is that 3D Gaussian Splatting, which renders scenes from view-dependent colored Gaussians, has exploitable vulnerabilities that let an adversary hide adversarial content in plain sight. CLOAK works by swapping the target object's appearance in a subset of training images taken from attacker-chosen camera poses, so the learned spherical harmonic coefficients encode a benign look for ordinary viewpoints and a hostile look, such as a road or stop sign, for chosen viewpoints; the paper reports that this causes YOLOv8 to fail to detect the victim car in 78 of 80 overhead views. DAGGER instead assumes access to the trained Gaussian scene and applies projected gradient descent to the color-related spherical harmonic attributes, masking gradients for non-target objects, which the paper shows makes Faster R-CNN misclassify objects such as a car as a person or stop sign with high confidence in roughly 11 iterations. The underlying discovery is that the same view-dependent mechanism that makes 3DGS visually efficient also provides a natural hiding place for adversarial content.","pith_inferences":["A natural evaluation extension is to render the same Blender car scene from the 80 overhead poses without any CLOAK poisoning and run YOLOv8, to isolate whether the reported 78 missed detections come from the embedded textures or from the detector's own angle-dependent behavior.","The paper demonstrates CLOAK only against YOLOv8 and DAGGER only against Faster R-CNN, so a testable extension is to check whether the attacks transfer across detectors and renderers, which would broaden or bound the claimed threat.","If view-dependent adversarial embeddings generalize beyond 3DGS to other radiance-field representations that use directional color encodings, such as NeRF, the threat model would extend beyond a single rendering technique; the paper does not test this.","A defensive idea suggested by the attack design is to compare renderings from multiple viewpoints and flag objects whose identity changes sharply with angle, a consistency check that the paper does not propose."],"forward_implications":["Any safety-critical pipeline that trains 3DGS on untrusted image collections must treat those images as a poisoning vector, since a few modified frames can embed adversarial content that only appears from specific viewpoints.","Object detectors running on rendered views of a 3DGS scene cannot by themselves distinguish a genuine scene from one optimized to mislead them, because both attacks produce high-confidence failures in the reported experiments.","A direct-access attack like DAGGER means that even a clean-looking 3DGS scene, once built, can be altered through Gaussian attributes to cause targeted misclassifications such as 'car' becoming 'person' or 'stop sign'.","Defenses for 3DGS need to cover both the training stage, by monitoring for view-inconsistent appearances, and the scene stage, by validating Gaussian attribute distributions, since the two attacks target different parts of the pipeline."],"supporting_citations":[{"why":"Defines the 3D Gaussian Splatting representation and differentiable rendering pipeline that both attacks target.","marker":"[1]"},{"why":"Supplies the projected gradient descent method that DAGGER generalizes to 3D Gaussian attributes.","marker":"[5]"},{"why":"Prior 3DGS attack that perturbed training images to increase computational cost, which CLOAK and DAGGER contrast by targeting downstream detectors.","marker":"[4]"},{"why":"Previous 3DGS adversarial noise work that the paper positions against CLOAK's hidden view-dependent content approach.","marker":"[8]"},{"why":"Demonstrates related novel-view adversarial attacks on face recognition via 3D reconstruction, motivating the view-dependent threat model.","marker":"[6]"}],"fun_headline_variants":["View-dependent 3D attacks hide cars from cameras","CLOAK and DAGGER expose 3D Gaussian dangers","3D Gaussian tricks hide objects and mislead AI","Adversarial 3D edits deceive detectors from one angle","Viewpoint-specific 3D attacks conceal threats"],"cache_read_input_tokens":7936,"weakest_assumption_plain":"The load-bearing premise is that the reported missed detections and misclassifications come from the attack itself rather than from rendering artifacts or the object detector's natural angle-dependent behavior, because the experiments do not compare against a clean, unpoisoned scene at the same adversarial viewpoints.","fun_headline_variants_meta":{"raw":{"variants":["View-dependent 3D attacks hide cars from cameras","CLOAK and DAGGER expose 3D Gaussian dangers","3D Gaussian tricks hide objects and mislead AI","Adversarial 3D edits deceive detectors from one angle","Viewpoint-specific 3D attacks conceal threats"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.00024,"raw_usage":{"total_tokens":1482,"prompt_tokens":871,"completion_tokens":611,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":487,"completion_tokens_details":{"reasoning_tokens":531}},"tokens_in":487,"tokens_out":611,"duration_ms":6083,"temperature":1.0,"reasoning_tokens":531,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-07T12:08:12.893206+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Render the same Blender car scene from the 80 overhead camera poses without any CLOAK poisoning and run YOLOv8: if the detector already misses the car on many of those clean views, the reported 78 out of 80 misses cannot be attributed to the attack. For DAGGER, check whether the perturbed Gaussian scene still fools Faster R-CNN after re-rendering from viewpoints not used in the PGD optimization and after saving and reloading the scene file; if the misclassification does not survive, the effect is an optimization artifact rather than a persistent scene manipulation.","supporting_citations":[{"cited_title":"Kerbl, G","cited_arxiv_id":null,"evidence_quote":"Defines the 3D Gaussian Splatting representation and differentiable rendering pipeline that both attacks target."},{"cited_title":"Madry, A","cited_arxiv_id":null,"evidence_quote":"Supplies the projected gradient descent method that DAGGER generalizes to 3D Gaussian attributes."},{"cited_title":"Zeybey, M","cited_arxiv_id":null,"evidence_quote":"Previous 3DGS adversarial noise work that the paper positions against CLOAK's hidden view-dependent content approach."},{"cited_title":"Shahreza and S","cited_arxiv_id":null,"evidence_quote":"Demonstrates related novel-view adversarial attacks on face recognition via 3D reconstruction, motivating the view-dependent threat model."}],"review_version":1}