REVIEW 2 major objections 3 minor 10 references
3D Gaussian Splat Vulnerabilities
T0 review · 2 major / 3 minor · reviewed 2026-08-07 · deepseek-v4-flash
Pith's one-line read This paper introduces two attacks on 3D Gaussian Splatting scenes: CLOAK hides adversarial content in view-dependent colors, and DAGGER perturbs Gaussian attributes directly to fool object detectors.
desk verdict Plausible new attacks on 3DGS, but the flagship CLOAK result lacks the control needed to support the view-dependence claim. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The machinery is the spherical harmonic (SH) color encoding used in 3DGS, augmented with projected gradient descent (PGD) for the direct attack. Each Gaussian stores SH coefficients rather than a fixed RGB value, so its rendered color is a continuous function of viewing direction; CLOAK exploits this by making the training data contain different textures at different camera poses, forcing the SH coefficients to learn both appearances. DAGGER treats the scene file as a differentiable parameter vector and runs PGD on the SH coefficients of targeted Gaussians, masked so that gradients flow only to the target object, then re-renders and feeds the image to a detector to update the perturbation under an $\ell^2$ norm constraint with budget $\epsilon$.
What would settle it
Render the same Blender car scene from the 80 overhead camera poses without any CLOAK poisoning and run YOLOv8: if the detector already misses the car on many of those clean views, the reported 78 out of 80 misses cannot be attributed to the attack. For DAGGER, check whether the perturbed Gaussian scene still fools Faster R-CNN after re-rendering from viewpoints not used in the PGD optimization and after saving and reloading the scene file; if the misclassification does not survive, the effect is an optimization artifact rather than a persistent scene manipulation.
Extended reading notes
Core claim
The paper's central claim is that 3D Gaussian Splatting, which renders scenes from view-dependent colored Gaussians, has exploitable vulnerabilities that let an adversary hide adversarial content in plain sight. CLOAK works by swapping the target object's appearance in a subset of training images taken from attacker-chosen camera poses, so the learned spherical harmonic coefficients encode a benign look for ordinary viewpoints and a hostile look, such as a road or stop sign, for chosen viewpoints; the paper reports that this causes YOLOv8 to fail to detect the victim car in 78 of 80 overhead views. DAGGER instead assumes access to the trained Gaussian scene and applies projected gradient descent to the color-related spherical harmonic attributes, masking gradients for non-target objects, which the paper shows makes Faster R-CNN misclassify objects such as a car as a person or stop sign with high confidence in roughly 11 iterations. The underlying discovery is that the same view-dependent mechanism that makes 3DGS visually efficient also provides a natural hiding place for adversarial content.
Load-bearing premise
The load-bearing premise is that the reported missed detections and misclassifications come from the attack itself rather than from rendering artifacts or the object detector's natural angle-dependent behavior, because the experiments do not compare against a clean, unpoisoned scene at the same adversarial viewpoints.
Editorial extensions
If this is right
- Any safety-critical pipeline that trains 3DGS on untrusted image collections must treat those images as a poisoning vector, since a few modified frames can embed adversarial content that only appears from specific viewpoints.
- Object detectors running on rendered views of a 3DGS scene cannot by themselves distinguish a genuine scene from one optimized to mislead them, because both attacks produce high-confidence failures in the reported experiments.
- A direct-access attack like DAGGER means that even a clean-looking 3DGS scene, once built, can be altered through Gaussian attributes to cause targeted misclassifications such as 'car' becoming 'person' or 'stop sign'.
- Defenses for 3DGS need to cover both the training stage, by monitoring for view-inconsistent appearances, and the scene stage, by validating Gaussian attribute distributions, since the two attacks target different parts of the pipeline.
Reading between the lines
- A natural evaluation extension is to render the same Blender car scene from the 80 overhead poses without any CLOAK poisoning and run YOLOv8, to isolate whether the reported 78 missed detections come from the embedded textures or from the detector's own angle-dependent behavior.
- The paper demonstrates CLOAK only against YOLOv8 and DAGGER only against Faster R-CNN, so a testable extension is to check whether the attacks transfer across detectors and renderers, which would broaden or bound the claimed threat.
- If view-dependent adversarial embeddings generalize beyond 3DGS to other radiance-field representations that use directional color encodings, such as NeRF, the threat model would extend beyond a single rendering technique; the paper does not test this.
- A defensive idea suggested by the attack design is to compare renderings from multiple viewpoints and flag objects whose identity changes sharply with angle, a consistency check that the paper does not propose.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper introduces two attacks on 3D Gaussian Splatting (3DGS): CLOAK, a training-time data poisoning attack that uses Spherical Harmonic (SH) view-dependent appearance to hide adversarial textures that appear only from attacker-chosen viewpoints, and DAGGER, a white-box post-training attack that directly perturbs Gaussian attributes via projected gradient descent to fool a downstream object detector. The CLOAK experiments render a car with a road texture from overhead and a stop-sign texture from behind, then report that YOLOv8 misses the car in 78 of 80 overhead views. The DAGGER experiments show a single Faster R-CNN misclassification of a car as a person with confidence above 70% in 11 iterations. The paper claims these are the first attacks of their kind and releases code for reproducibility.
Significance. If the attacks are established as described, the paper would make a meaningful contribution by identifying a new attack surface in 3DGS—view-dependent appearance via SH—and by demonstrating a direct white-box attack on the Gaussian representation itself. The open-source release is a concrete strength for reproducibility and downstream defense research. However, the significance is conditional: the central CLOAK claim that the view-dependence mechanism (rather than trivial per-view data poisoning) causes the detector failures is not currently supported by the evidence, and the DAGGER demonstration rests on a single anecdotal example. The paper would be a useful addition to the adversarial ML literature once these gaps are addressed.
major comments (2)
- [Sec. 4.1, Eq. (1)] The single successful DAGGER example does not establish that the attack reliably deceives Faster R-CNN. The paper reports one scene, one targeted misclassification ('car' → 'person'), and no error bars, multiple runs, or comparisons against a random-perturbation baseline. Given that white-box PGD on 2D images typically requires multiple runs and statistical evaluation, the authors should provide results across several scenes, random seeds, and attack budgets (e.g., different epsilon values), and include a baseline with Gaussian attributes perturbed randomly within the same L2 norm to show that the gradient-based optimization is what drives the misclassification.
- [Sec. 2, novelty claim] The abstract claims CLOAK is 'the first attack that leverages view-dependent Gaussian appearances,' but the related work discussion does not provide enough detail to substantiate this. The authors cite Zeybey et al. (2024) as a poisoning attack on CLIP ViT-B/16, but they do not state whether that attack also uses view-dependent rendering or SH; if it does, the novelty claim needs to be narrowed or qualified. The discussion should clarify the exact technical distinction, either by describing the prior method's mechanism or by citing a source that makes the absence of view-dependence explicit.
minor comments (3)
- [Sec. 4.2] The phrase 'an "person"' contains a typo; it should be 'a "person"'.
- [Sec. 4.2] The learning rate is specified as alpha = epsilon * 2 / steps, but 'steps' is never defined; please specify the number of PGD iterations used.
- [Fig. 1 caption] The caption reads 'OurCLOAKattack' without spaces; this appears to be a formatting error.
Circularity Check
No material circularity: CLOAK and DAGGER are empirical demonstrations, and the CLOAK evaluation gap is an experimental-control concern rather than a definitional reduction.
full rationale
The paper's derivations do not reduce to their inputs by construction. CLOAK appears only in a training-time poisoning form: the attacked dataset is explicitly defined by replacing images at targeted camera poses (Eq. 1), and the reported YOLOv8 failures are then measured on rendered views. That is an empirical consequence of training on poisoned images, not a fitted parameter renamed as a prediction. The absence of a clean-scene control in Sec. 4.1 weakens the attribution of the detector failures to spherical-harmonic view-dependence, but this is an experimental confound and not a circular step. DAGGER is a direct white-box PGD optimization against the same detector used for evaluation (Eqs. 2-3); optimizing and testing on the same model is standard adversarial-attack methodology, not circular reasoning. The paper makes no load-bearing use of self-citations: none of the cited prior works in the references overlap with the authors' own prior results, and the central claims stand independently of the citations to Kerbl et al. and Madry et al. The attacks are self-contained empirical demonstrations, so the circularity burden is minimal.
Assumptions & free parameters
free parameters (2)
- DAGGER epsilon (L2 attack budget) =
5.0
- CLOAK viewpoint split =
110 benign / 80 road / 20 stop sign
assumptions (3)
- domain assumption 3DGS training converges so that spherical harmonic coefficients encode the view-dependent appearances present in the training images.
- domain assumption The target detection models (YOLOv8 and Faster R-CNN) produce gradients that are informative for optimization and are differentiable end-to-end.
- domain assumption The rendered images from the attacked viewpoints are visually realistic enough for the detectors to process them as normal images.
Cite this review
Pith. "Pith review of 3D Gaussian Splat Vulnerabilities." pith.science (2026). https://pith.science/paper/RN3T47EG
@misc{pith2026250600280,
author = {Pith},
title = {Pith review of: 3D Gaussian Splat Vulnerabilities},
year = {2026},
howpublished = {\url{https://pith.science/paper/RN3T47EG}},
note = {Machine review of arXiv:2506.00280}
}
read the original abstract
With 3D Gaussian Splatting (3DGS) being increasingly used in safety-critical applications, how can an adversary manipulate the scene to cause harm? We introduce CLOAK, the first attack that leverages view-dependent Gaussian appearances - colors and textures that change with viewing angle - to embed adversarial content visible only from specific viewpoints. We further demonstrate DAGGER, a targeted adversarial attack directly perturbing 3D Gaussians without access to underlying training data, deceiving multi-stage object detectors e.g., Faster R-CNN, through established methods such as projected gradient descent. These attacks highlight underexplored vulnerabilities in 3DGS, introducing a new potential threat to robotic learning for autonomous navigation and other safety-critical 3DGS applications.
Figures
Reference graph
Works this paper leans on
- [1]
-
[2]
H. Li, J. Li, D. Zhang, C. Wu, J. Shi, C. Zhao, H. Feng, E. Ding, J. Wang, and J. Han. VDG : Vision - Only Dynamic Gaussian for Driving Simulation , 2024 a
work page 2024
-
[3]
Y. Li, B. Xie, S. Guo, Y. Yang, and B. Xiao. A Survey of Robustness and Safety of 2D and 3D Deep Learning Models against Adversarial Attacks . ACM CSur., 56 0 (6), 2024 b
work page 2024
-
[4]
J. Lu, Y. Zhang, Q. Shen, X. Wang, and S. Yan. Poison-splat: Computation Cost Attack on 3D Gaussian Splatting , 2024. arXiv:2410.08190 [cs]
arXiv 2024
- [5]
-
[6]
H. Shahreza and S. Marcel. Comprehensive Vulnerability Evaluation of Face Recognition Systems to Template Inversion Attacks via 3D Face Reconstruction . TPAMI, 45 0 (12): 0 14248--14265, 2023
work page 2023
-
[7]
Y.Zheng, X. Chen, Y. Zheng, S. Gu, R. Yang, B. Jin, P. Li, C. Zhong, Z. Wang, L. Liu, C. Yang, D. Wang, Z. Chen, X. Long, and M. Wang. GaussianGrasper : 3D Language Gaussian Splatting for Open - Vocabulary Robotic Grasping . IEEE Robotics and Automation Letters, 9 0 (9): 0 7827--7834, 2024
work page 2024
- [8]
Show all 10 references
-
[9]
X. Zhou, Z. Lin, X. Shan, Y. Wang, D. Sun, and M. Yang. DrivingGaussian : Composite Gaussian Splatting for Surrounding Dynamic Autonomous Driving Scenes . In ( CVPR ) , 2024
2024
-
[10]
write newline
" write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 gl...
Reviewed August 7, 2026 · model on record in the stance chip above.
Discussion (0). Sign in to comment.