{"id":"5ca022c5-b5f0-430d-82df-5c9618995758","arxiv_id":"2602.19323","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"Zeroing high-frequency wavelet subbands of training views before 3D Gaussian Splatting suppresses Poison-Splat adversarial artifacts, yielding more robust training and rendering across Mip-NeRF 360, Tanks-and-Temples, and LLFF.","lead":"A preprocessing defense for 3D Gaussian Splatting removes high-frequency noise from training images by zeroing wavelet subbands, which blocks the Poison-Splat attack while preserving low-frequency scene content. Because it needs no clean ground-truth data or adversarial training, it can be plugged into existing 3D reconstruction pipelines to harden them against cost-inflating attacks.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Frequency-localization premise is evidenced only by matching-rate proxies, not by direct perturbation-energy measurements, and the paper's own LLFF clean-input results contradict the 'no significant clean-data impairment' part of the central claim.","rationale":"The reader's weakest_assumption correctly identified the frequency-localization premise as the load-bearing assumption. I agree that this is the most important vulnerability, but I sharpen it: the paper's existing evidence (matching-rate drops and clean-image energy ratios) does not directly establish that the perturbation's energy is concentrated in high-frequency subbands, and the paper's own Table 5 indicates the assumption starts failing at the upper end of the tested attack strengths. In addition, I found a second, independent inconsistency that the reader did not flag: the clean-input trade-off claim is stated broadly but the appendix's LLFF results show a large clean degradation, contradicting the abstract and RQ3. This matters because the central claim includes 'without substantially compromising clean-data performance.' Because the experimental tables otherwise consistently support the method's robustness under Poison-Splat, and both concerns are addressable with additional analysis (direct perturbation-energy measurement and fuller reporting of clean-input results), the appropriate outcome remains conditional acceptance rather than rejection. The reader's CONDITIONAL verdict is therefore unchanged, but the conditions should include the energy analysis and transparent reporting of all clean-data results.","tokens_in":20712,"tokens_out":6089,"duration_ms":63280,"concrete_test":"Compute the level-1 channel-wise DWT of the Poison-Splat perturbations delta = I_adv - I_clean on Tanks-and-Temples for epsilon = 16, 32, and 64/255, and report the percentage of total L2 perturbation energy contained in the LL subband versus the LH/HL/HH subbands. If the high-frequency energy fraction is large (e.g., >80%) at all tested epsilons, the frequency-localization premise is confirmed. If the LL fraction is substantial (e.g., >30% at epsilon=32/255, or growing rapidly with epsilon), then Eq. (8) is removing mostly clean-image content rather than attack energy, and the defense's robustness benefit must be attributed to generic low-pass smoothing or the scale regularization rather than targeted high-frequency attack removal.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim has two load-bearing pillars: (i) adversarial perturbations on 3DGS inputs are concentrated in high-frequency subbands, so zeroing LH/HL/HH in Eq. (8) removes attack energy while preserving scene content, and (ii) this filtering does not significantly impair clean-input training. Pillar (i) is supported in Sec. 3.2 and Fig. 1 only by (a) matching-rate drops of SuperPoint/LightGlue keypoints across subbands and (b) energy ratios of clean images. Neither measures the perturbation's own frequency content. Since DWT is orthonormal, the perturbation energy can be decomposed across subbands: E[||delta||^2] = E_LL + E_LH + E_HL + E_HH. If Poison-Splat places a large fraction of its energy in LL (e.g., smooth, consistent low-frequency corruption), Eq. (8) removes little attack energy but still destroys legitimate high-frequency scene structure. The paper's own Table 5 shows this is not hypothetical: at epsilon=64/255, the LL matching rate drops 19.31%, approaching the high-frequency drop of 25.61%, meaning the clean separation already degrades in the tested range. Pillar (ii) is contradicted by the appendix: Table 7 reports Clean+Ours on LLFF with PSNR falling from 31.29 to 28.39 (-9.3%), SSIM from 0.9431 to 0.8919 (-5.4%), and LPIPS from 0.1224 to 0.1992 (+63%). The main text (Sec. 4.2, RQ3) reports only the Mip-NeRF 360 / Tanks-and-Temples numbers (1.75% PSNR, 2.5% SSIM, 11% LPIPS) and concludes clean degradation is insignificant, ignoring the LLFF result. Additionally, no ablation removes Eq. (8) while keeping the scale regularizer, so the marginal contribution of wavelet filtering is never isolated. These gaps leave the core mechanism under-supported even though the experimental tables are broadly consistent.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes DefenseSplat, an input-side defense for 3D Gaussian Splatting against the Poison-Splat adversarial attack. The method performs a one-level discrete wavelet transform on each input image, zeros the LH/HL/HH high-frequency subbands, applies the inverse DWT, and adds a ReLU-based scale regularization loss that discourages elongated Gaussians. The authors first analyze matching-rate degradation in low- and high-frequency wavelet subbands, concluding that adversarial perturbations are concentrated in high frequencies while low frequencies retain scene content. They then evaluate the method on Mip-NeRF 360, Tanks-and-Temples, and LLFF, reporting improved PSNR/SSIM/LPIPS, reduced training time, fewer Gaussians, and lower GPU memory relative to 3DGS, CompactGS, and Difix3D+, across attack strengths 16/255, 32/255, and 64/255. Clean-input experiments are reported to assess the robustness/fidelity trade-off. The central claim is that simple high-frequency wavelet filtering yields robust 3DGS training without significantly impairing clean reconstruction quality.","tokens_in":21173,"tokens_out":3146,"duration_ms":29729,"significance":"If the central claim holds, DefenseSplat would be a useful, simple, and inexpensive first defense for 3DGS, a topic that is genuinely underexplored. The paper ships extensive per-scene tables on three datasets, tests three attack strengths, reports resource-consumption metrics that are directly relevant to denial-of-service concerns, and includes a clean-input check. The approach is interpretable and does not require clean ground-truth supervision. These are real strengths. The significance is, however, conditional: the empirical premise that Poison-Splat energy is concentrated in high-frequency wavelet bands is supported only indirectly, and the clean-input results in the appendix substantially weaken the 'no significant clean-data impairment' part of the central claim.","major_comments":[{"comment":"The load-bearing premise — adversarial perturbations on 3DGS inputs manifest as high-frequency noise — is established only through SuperPoint/LightGlue matching-rate drops and clean-image energy ratios. Neither measures the perturbation's own frequency content. Since DWT is orthonormal, one can directly compute E[||delta||^2] = E_LL + E_LH + E_HL + E_HH for the Poison-Splat perturbations. Table 5 shows the premise degrading at epsilon=64/255: LL matching drops 19.31%, nearly the high-frequency drop of 25.61%. If a non-negligible fraction of delta energy lies in LL, Eq. (8) removes genuine low-frequency scene structure while leaving attack energy in place. Please report direct subband energy ratios of the perturbation itself across attack strengths, and discuss what fraction of the attack energy Eq. (8) actually removes.","section":"Sec. 3.2, Eq. (8), Table 5"},{"comment":"The main text states that on clean inputs 'our method does not exhibit any significant performance degradation' and reports only Mip-NeRF 360 and Tanks-and-Temples numbers (1.75% PSNR, 2.5% SSIM, 11% LPIPS). The appendix Table 7 shows a different picture on LLFF: clean PSNR drops from 31.29 to 28.39 (-9.3%), SSIM from 0.9431 to 0.8919 (-5.4%), and LPIPS from 0.1224 to 0.1992 (+63%). This is a substantial clean-input impairment on one of the three benchmark datasets and directly contradicts the unqualified wording of the central claim. The main-text RQ3 discussion must report all three datasets and re-frame the claim as dataset-dependent, or provide a justification for why the LLFF degradation is acceptable.","section":"Sec. 4.2 (RQ3) vs. Appendix Table 7"},{"comment":"The paper's own limitation statement says evaluation is limited to Poison-Splat, and Appendix B.1 concedes that as attack strength increases, 'the target of the attack gradually shifts from high-frequency to low-frequency components' and that the LL matching drop may exceed the high-frequency drop. These statements undermine the generalizability claim ('we believe our defense strategy is broadly generalizable') without further evidence. At minimum, the paper should test against the Zeybey et al. 2D attack cited in Sec. 1.1, or clearly restrict the robustness claim to Poison-Splat-like attacks. As written, the concluding generality claim is not supported by the experiments.","section":"Sec. 5 and Appendix B.1"},{"comment":"The comparisons against CompactGS and Difix3D+ are informative, but neither is a defense method. The paper does not compare against simple frequency-domain baselines such as Gaussian blurring, bilateral filtering, or wavelet soft-thresholding with adaptively chosen thresholds. Because Eq. (8) is a hard zeroing operation, it is important to show that the proposed filtering outperforms these standard baselines on the same metrics; otherwise the specific contribution of the frequency-aware design (as opposed to generic smoothing) is not established. Also, all reported numbers appear to come from a single training run; please add standard deviations over multiple seeds or state that the reported trends were stable across runs.","section":"Tables 1-3 and Sec. 4.1"}],"minor_comments":[{"comment":"Typo: 'Disscusion' should be 'Discussion'.","section":"Sec. 5"},{"comment":"The text says 'I(x,y) denotes the pixel intensity of a given poison.' Presumably this should be 'a given image'.","section":"Sec. 3.1, Eq. (4)"},{"comment":"G(x;Sigma) is written without an explicit mean parameter; the text says x is the center but the formula omits (x - mu). Please clarify the notation.","section":"Sec. 3.1, Eq. (1)"},{"comment":"Typo: 'Tansk-and-Temples' should be 'Tanks-and-Temples'.","section":"Table 3"},{"comment":"The percentages in the caption are not defined in the main text; a one-sentence explanation of what the four values represent would aid readability.","section":"Fig. 1"},{"comment":"The TSP formulation and the pose-loss weights w_g and w_t are introduced but their exact values are not reported. Please state them in the implementation details so the analysis is reproducible.","section":"Sec. 3.2"},{"comment":"Ablation of the scale loss is only implicit through Ours vs. Ours+ReLU. A separate table isolating Eq. (9) with and without the filtering component would better support the claim that both components are necessary.","section":"Sec. 4.2, RQ4"},{"comment":"Appendix Table 5 reports matching rates for only Train and Truck scenes. Please state whether these are representative or add the full-dataset numbers.","section":"Appendix B.1"}],"recommendation":"major_revision","confidential_remarks":"The paper addresses a real gap and the experimental effort is substantial, but the central claim is currently overstated in two places: the frequency-localization premise is not directly measured, and the clean-input degradation on LLFF contradicts the main-text summary. Both are fixable within the manuscript's scope by adding direct perturbation-energy analysis and by re-reporting clean-input results honestly, but they require new experiments and text changes. I do not see a fundamental flaw in the method itself; rather, the issue is that the evidence does not yet support the breadth of the claim."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The useful thing here is the first input-side defense for 3DGS against the Poison-Splat DoS-style attack. The idea is simple: apply a discrete wavelet transform to each training view, zero out the high-frequency subbands (LH/HL/HH), reconstruct, and add a regularizer that penalizes elongated Gaussians. The experiments are consistent and fairly extensive: three datasets, three attack strengths, clean-input controls, and per-scene tables in the appendix. On attacked data, the method cuts training time, Gaussian count, and peak memory while improving PSNR/SSIM over the undefended baseline and over CompactGS and Difix3D+.\n\nThe paper earns credit for testing clean inputs and for being explicit that only one 3DGS attack (Poison-Splat) currently exists. The failure modes it reports for Difix3D+ — texture smoothing and invented detail — ring true.\n\nThe soft spots are real but addressable. The core assumption that adversarial perturbation energy sits in high-frequency subbands is not actually measured. The paper infers it from matching-rate drops per subband and from energy ratios of clean images; those are proxies, not a direct decomposition of the perturbation. Because DWT is orthonormal, the perturbation energy can be decomposed as E_LL + E_LH + E_HL + E_HH, and the paper should show that plot. Table 5 already hints the separation degrades: at epsilon=64/255 the LL matching rate drops 19.31% versus 25.61% for high-frequency, so strong attacks are already corrupting low-frequency content. The defense still helps because it removes some attack, but the stated premise is weaker exactly where the defense is most needed.\n\nSecond, the clean-data cost is understated in the main text. The paper reports a small PSNR/SSIM drop on Mip-NeRF 360 and Tanks-and-Temples and concludes no significant impairment. Appendix Table 7 shows LLFF clean PSNR falls from 31.29 to 28.39 (-9.3%) and LPIPS increases 63%. That is not insignificant, and the main text should have said so.\n\nThird, there is no ablation that removes the wavelet filter while keeping the scale regularizer, so the marginal contribution of Eq. (8) is never isolated. Two hyperparameters (tau, lambda_scale) are hand-set, there are no error bars or multiple seeds, and there is no code release. The single-attack-family evaluation is understandable given the literature, but the 'generalizable to future attacks' claim in the conclusion is speculation.\n\nNone of this sinks the paper. It is a practical, cheap defense against the attack family it targets, and the experiments are an honest effort given the field's current state. It deserves a serious referee. I would ask for a direct frequency-energy decomposition of the perturbation, the LLFF clean numbers in the main text, an ablation separating the two components, and code/data release. With those, this becomes a solid contribution.","headline":"Useful first defense against Poison-Splat-style attacks on 3DGS, but the frequency-localization premise is supported only by proxy evidence and the clean-input cost is understated.","tokens_in":21690,"tokens_out":3164,"would_cite":true,"duration_ms":26273,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":["68T45","68U10"],"pacs":[],"model":"deepseek-v4-flash","headline":"DefenseSplat claims that zeroing high-frequency wavelet bands of poisoned training views blocks 3DGS adversarial attacks without clean labels, and demonstrates the benefit across three benchmarks and three attack strengths.","keywords":["3D Gaussian Splatting","adversarial defense","wavelet transform","frequency filtering","Poison-Splat","denial-of-service defense","scale regularization","3D reconstruction robustness"],"falsifier":"Craft a Poison-Splat variant that maximizes perturbation energy in the LL wavelet subband (e.g., by inverse-wavelet projecting the noise so it lives mostly in LL, constrained to the same epsilon) and measure whether DefenseSplat's PSNR and Gaussian-count improvements collapse while 3DGS remains damaged. If the defended PSNR drops to near-undefended levels while clean PSNR also drops, the frequency-localization premise is refuted.","tokens_in":20627,"feed_emoji":"🛡️","tokens_out":3949,"duration_ms":37061,"temperature":0.7,"pith_summary":"DefenseSplat claims that adversarial attacks on 3D Gaussian Splatting, such as Poison-Splat, concentrate most of their harmful energy in high-frequency wavelet subbands of the input images. The paper therefore proposes a two-step defense that requires no clean ground-truth images: first, decompose each poisoned training view with a discrete wavelet transform, set the LH/HL/HH subbands to zero, and reconstruct with the inverse transform; second, add a ReLU-based scale-regularization loss that penalizes elongated Gaussians, which are the primitives most likely to overfit consistent adversarial textures. On Mip-NeRF 360, Tanks-and-Temples, and LLFF, the method reports substantially higher PSNR/SSIM, lower LPIPS, and lower training time, Gaussian count, and GPU memory than undefended 3DGS and two related baselines, while clean-data PSNR degrades by only about 1.75%. The paper argues this opens the first practical defense route for server-side 3DGS training.","feed_headline":"Zeroing high-frequency bands blocks 3DGS adversarial attacks","feed_subtitle":"A wavelet filter keeps scene content while stripping attack noise, lifting PSNR ~2 points and halving Gaussian count.","key_machinery":"The core mechanism is wavelet-domain gating: a single-level discrete wavelet transform decomposes each RGB channel into LL, LH, HL, and HH subbands; the high-frequency coefficients are set to zero and the inverse DWT reconstructs the filtered image (Eq. 8). This removes high-frequency noise while retaining spatial layout via the LL subband. The second component is a ReLU-thresholded scale-variance regularizer (Eq. 9) that penalizes only the elongated Gaussians (normalized variance above tau) that the optimization would otherwise use to fit consistent adversarial textures, leaving spherical and flat Gaussians untouched.","core_discovery":"The paper's central claim is that zeroing the three high-frequency wavelet subbands (LH, HL, HH) before feeding images to 3DGS optimization removes the bulk of adversarial perturbation while preserving the scene, because the low-frequency LL subband carries over 95% of total energy and the attack concentrates in high frequencies. A companion scale-regularization loss, L_scale = ReLU(nu - tau), constrains elongated Gaussians that would otherwise form to fit consistent adversarial textures. The result is that defended training finishes faster, uses fewer Gaussians and less GPU memory, and renders higher-fidelity images than undefended training and than the two baselines tested, across three st","pith_inferences":["The same wavelet gate could be tested against the earlier two-stage 2D attack on 3DGS, and possibly against adversarial perturbations on NeRF-style renderers, since those also operate on input images.","The paper's own Table 5 shows that at epsilon=64/255 the LL matching rate drops 19.31%, indicating the attack is beginning to reach low frequencies; an editor's inference is that a production defense should monitor the LL/HL matching-rate ratio and switch to a content-aware filter when it crosses unity.","The scale-regularization loss is independent of the wavelet step; one could ablate it alone on clean or poisoned data to separate the effects of filtering vs. regularization on Gaussian count and fidelity."],"forward_implications":["DefenseSplat works without clean ground-truth supervision, so it can be inserted into any existing 3DGS training pipeline as a preprocessing step.","Filtering high-frequency subbands reduces Gaussian count and memory, which directly counters the denial-of-service vector of Poison-Splat attacks.","The defense is a plug-and-play module that can be combined with other methods (e.g., CompactGS) to improve both robustness and efficiency.","On clean inputs the method trades about 1.75% PSNR for roughly 2x reduction in Gaussian count and memory, a favorable robustness-fidelity trade-off for server deployment."],"fun_headline_variants":["Zero high-freq bands to block 3DGS attacks","Wavelet trick defends 3DGS from adversarial noise","DefenseSplat: frequency filter foils 3DGS attacks","Stripping high frequencies protects 3DGS rendering","High-frequency cutoff defeats 3DGS adversarial corruption"],"cache_read_input_tokens":2304,"weakest_assumption_plain":"The defense assumes adversarial perturbations on input views are concentrated in high-frequency wavelet bands, so that zeroing those bands removes attack noise while leaving the scene's low-frequency content intact; if an attack puts meaningful energy in the low-frequency band, the filter removes real content and fails.","fun_headline_variants_meta":{"raw":{"variants":["Zero high-freq bands to block 3DGS attacks","Wavelet trick defends 3DGS from adversarial noise","DefenseSplat: frequency filter foils 3DGS attacks","Stripping high frequencies protects 3DGS rendering","High-frequency cutoff defeats 3DGS adversarial corruption"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000565,"raw_usage":{"total_tokens":2526,"prompt_tokens":765,"completion_tokens":1761,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":509,"completion_tokens_details":{"reasoning_tokens":1677}},"tokens_in":509,"tokens_out":1761,"duration_ms":10685,"temperature":1.0,"reasoning_tokens":1677,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-02T21:39:04.108356+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Craft a Poison-Splat variant that maximizes perturbation energy in the LL wavelet subband (e.g., by inverse-wavelet projecting the noise so it lives mostly in LL, constrained to the same epsilon) and measure whether DefenseSplat's PSNR and Gaussian-count improvements collapse while 3DGS remains damaged. If the defended PSNR drops to near-undefended levels while clean PSNR also drops, the frequency-localization premise is refuted.","supporting_citations":[],"review_version":1}