pith. sign in

arxiv: 2604.13153 · v1 · submitted 2026-04-14 · 💻 cs.CV · cs.CR· cs.LG

PatchPoison: Poisoning Multi-View Datasets to Degrade 3D Reconstruction

Prajas Wadekar , Venkata Sai Pranav Bachina , Kunal Bhosikar , Ankit Gangwal , Charu Sharma This is my paper

Pith reviewed 2026-05-10 15:21 UTC · model grok-4.3

classification 💻 cs.CV cs.CRcs.LG
keywords dataset poisoningadversarial patch3D Gaussian SplattingStructure-from-Motionmulti-view reconstructioncamera pose estimationprivacy protectionNeRF-Synthetic
0
0 comments X

The pith

A small high-frequency checkerboard patch added to multi-view images can prevent accurate 3D reconstruction by corrupting camera pose estimates.

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper shows that inserting a tiny structured patch into the corner of each image in a dataset disrupts the feature matching process used by standard Structure-from-Motion tools. This leads to systematically wrong camera positions, which in turn causes 3D Gaussian Splatting to produce severely degraded scene geometry. A sympathetic reader would care because casual photos and videos are now routinely turned into detailed 3D models without owner consent, and this offers a simple way for creators to block that use. The patch is designed to remain visually unobtrusive while delivering large increases in reconstruction error on standard benchmarks. The method needs no changes to existing reconstruction pipelines and acts as a preprocessing step.

Core claim

PatchPoison places a 12 by 12 pixel high-frequency checkerboard patch in the periphery of every image. The patch generates spurious feature correspondences that mislead COLMAP-style SfM pipelines into estimating misaligned camera poses. These pose errors then cause the subsequent 3D Gaussian Splatting optimization to diverge from the true scene structure, producing unusable reconstructions. The approach requires no modification to the reconstruction software and leaves the images looking normal to human viewers.

What carries the argument

A small high-frequency adversarial checkerboard patch placed in the image periphery that introduces spurious correspondences to misalign estimated camera poses in SfM pipelines.

If this is right

  • Reconstruction error on the NeRF-Synthetic benchmark rises by a factor of 6.8 in LPIPS.
  • The poisoned images remain visually unobtrusive to human viewers.
  • Protection works as a drop-in preprocessing step without any pipeline modifications.
  • The effect propagates from pose misalignment through the full 3D Gaussian Splatting optimization.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The same patch strategy could be tested on real-world casual video or photo collections to measure real-world effectiveness.
  • Detection or removal techniques for such localized high-frequency patterns might become necessary in reconstruction pipelines.
  • Content creators could embed the patch generation into camera apps or sharing platforms for automatic privacy protection.
  • Similar localized perturbations might affect other multi-view methods that rely on feature matching for pose recovery.

Load-bearing premise

The patch will reliably produce pose errors in standard SfM tools that cannot be filtered out or compensated for, causing the downstream 3D reconstruction to fail.

What would settle it

Applying the patch to the NeRF-Synthetic dataset and measuring no large increase in LPIPS error after running COLMAP followed by 3DGS, or finding that the patch can be removed by simple image filtering before reconstruction.

Figures

Figures reproduced from arXiv: 2604.13153 by Ankit Gangwal, Charu Sharma, Kunal Bhosikar, Prajas Wadekar, Venkata Sai Pranav Bachina.

Figure 1
Figure 1. Figure 1: Clean vs. poisoned 3DGS reconstructions on the NeRF-Synthetic dataset. Quantitative performance drops significantly due to [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: PatchPoison pipeline. A small high-frequency patch inserted into each image induces spurious feature correspondences during Structure-from-Motion, leading to incorrect camera pose estimation and degraded 3D Gaussian Splatting reconstruction. Spatial frequency. We control the frequency of the checkerboard pattern via the block size b ∈ {1, 2, 4, 8, 10, 16, 20, 25, 50} pixels. Color contrast. We vary the int… view at source ↗
Figure 3
Figure 3. Figure 3: Qualitative evaluation on the NeRF-Synthetic dataset. These renders are generated from the poisoned images, illustrating the structural degradation and severe visual artifacts introduced by the PatchPoison attack across multiple views. We omit views that resulted in entirely black renders, which consti￾tuted the majority of the overall outputs. Patch Size Poisoned vs Render Poisoned vs Original SSIM↓ PSNR↓… view at source ↗
Figure 4
Figure 4. Figure 4: Examples of synthetic pattern variants evaluated. [PITH_FULL_IMAGE:figures/full_fig_p007_4.png] view at source ↗
Figure 6
Figure 6. Figure 6: Results on Mip-NeRF 360 scenes. In structured scenes such as bicycle, PatchPoison introduces visible distortions. In complex natural scenes such as garden, the patch blends into the background, reducing visual artifacts while still increasing recon￾struction error. MUST3R [2]) that avoid explicit keypoint matching may be more resilient. This suggests that future work should ex￾plore adaptive or content-awa… view at source ↗
Figure 5
Figure 5. Figure 5: Trade-off between reconstruction degradation and imperceptibility. An effective method should lie in the bottom￾right region. PatchPoison achieves this optimal balance, while baselines either fail to degrade reconstruction or introduce visi￾ble artifacts. Patch Poisoned vs Render GT vs Poisoned SSIM↑ PSNR↑ LPIPS↓ SSIM↓ PSNR↓ LPIPS↑ 2% 0.923 ± 0.035 30.57 ± 1.66 0.119 ± 0.039 0.982 36.37 0.008 6% 0.878 ± 0.… view at source ↗
read the original abstract

3D Gaussian Splatting (3DGS) has recently enabled highly photorealistic 3D reconstruction from casually captured multi-view images. However, this accessibility raises a privacy concern: publicly available images or videos can be exploited to reconstruct detailed 3D models of scenes or objects without the owner's consent. We present PatchPoison, a lightweight dataset-poisoning method that prevents unauthorized 3D reconstruction. Unlike global perturbations, PatchPoison injects a small high-frequency adversarial patch, a structured checkerboard, into the periphery of each image in a multi-view dataset. The patch is designed to corrupt the feature-matching stage of Structure-from-Motion (SfM) pipelines such as COLMAP by introducing spurious correspondences that systematically misalign estimated camera poses. Consequently, downstream 3DGS optimization diverges from the correct scene geometry. On the NeRF-Synthetic benchmark, inserting a 12 X 12 pixel patch increases reconstruction error by 6.8x in LPIPS, while the poisoned images remain unobtrusive to human viewers. PatchPoison requires no pipeline modifications, offering a practical, "drop-in" preprocessing step for content creators to protect their multi-view data.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit. Tearing a paper down is the easy half of reading it; the pith above is the substance, this is the friction.

Referee Report

4 major / 3 minor

Summary. The paper presents PatchPoison, a lightweight poisoning method that injects a small 12x12 high-frequency checkerboard patch into the periphery of each image in a multi-view dataset. The patch is intended to introduce spurious correspondences during the feature-matching stage of SfM pipelines such as COLMAP, systematically misaligning estimated camera poses and causing downstream 3D Gaussian Splatting optimization to diverge from correct geometry. On the NeRF-Synthetic benchmark, the approach is reported to increase reconstruction error by 6.8x in LPIPS while remaining visually unobtrusive.

Significance. If the central mechanism holds and generalizes, the work would be significant for privacy protection in computer vision, offering a practical drop-in preprocessing step that requires no pipeline modifications. The empirical demonstration on synthetic data indicates a potentially strong effect size, but the significance is currently limited by the absence of mechanism verification and real-world testing.

major comments (4)
  1. [Abstract] Abstract: the 6.8x LPIPS increase is stated without error bars, number of runs, random seeds, or comparisons to baselines or alternative patches, making it impossible to assess statistical reliability or effect robustness.
  2. [§4] §4 (Methods): no ablation is described in which SfM is run with the patch present and then the patch is removed before 3DGS optimization; such a control is required to isolate whether degradation stems from pose misalignment or from direct high-frequency corruption of the Gaussian optimization.
  3. [§5] §5 (Experiments): no quantitative pose-error metrics (mean rotation or translation error relative to ground-truth COLMAP poses) are reported to confirm that the patch produces the claimed systematic misalignment rather than other failure modes.
  4. [§5] §5 (Experiments): evaluation is confined to the NeRF-Synthetic benchmark; results on real captured multi-view datasets are essential to determine whether natural background texture and additional views allow COLMAP to ignore or filter the peripheral artifact.
minor comments (3)
  1. [Abstract] Abstract: replace '12 X 12' with consistent mathematical notation '12×12'.
  2. Figure captions should explicitly label clean vs. poisoned reconstructions and include quantitative LPIPS values for each example.
  3. [Related Work] Related-work section should cite prior adversarial-patch attacks on feature detectors and SfM pipelines for context.

Simulated Author's Rebuttal

4 responses · 0 unresolved

We thank the referee for the constructive and detailed feedback. We address each major comment point-by-point below, providing clarifications and committing to revisions that strengthen the empirical support and transparency of the work without altering its core claims.

read point-by-point responses

  1. Referee: [Abstract] Abstract: the 6.8x LPIPS increase is stated without error bars, number of runs, random seeds, or comparisons to baselines or alternative patches, making it impossible to assess statistical reliability or effect robustness.

    Authors: We agree that statistical details are essential. In the revised manuscript we update both the abstract and §5 to report LPIPS with standard deviation error bars computed over five independent runs (different random seeds for patch placement, COLMAP initialization, and 3DGS optimization). We also add a comparison table showing the checkerboard patch against random high-frequency noise and uniform patches, confirming that the structured 12×12 checkerboard yields the largest and most consistent degradation. revision: yes

  2. Referee: [§4] §4 (Methods): no ablation is described in which SfM is run with the patch present and then the patch is removed before 3DGS optimization; such a control is required to isolate whether degradation stems from pose misalignment or from direct high-frequency corruption of the Gaussian optimization.

    Authors: This control is a valuable addition. We have performed the suggested ablation and include the results in the revised §5: SfM is executed on the poisoned images, after which the patch is removed from the images before 3DGS training. The resulting LPIPS error drops substantially relative to the fully poisoned case yet remains higher than the clean baseline, indicating that pose misalignment is the dominant failure mode while a secondary high-frequency effect persists. revision: yes

  3. Referee: [§5] §5 (Experiments): no quantitative pose-error metrics (mean rotation or translation error relative to ground-truth COLMAP poses) are reported to confirm that the patch produces the claimed systematic misalignment rather than other failure modes.

    Authors: We have added these metrics to the revised experiments. A new table in §5 reports mean rotation error (degrees) and translation error (meters) of COLMAP poses against ground-truth for both clean and poisoned scenes. The poisoned poses exhibit 4–7× larger errors, directly correlating with the observed 3DGS divergence and supporting the claimed mechanism of systematic misalignment. revision: yes

  4. Referee: [§5] §5 (Experiments): evaluation is confined to the NeRF-Synthetic benchmark; results on real captured multi-view datasets are essential to determine whether natural background texture and additional views allow COLMAP to ignore or filter the peripheral artifact.

    Authors: We acknowledge the limitation of relying solely on synthetic data. In the revision we expand §5 and the discussion to analyze how natural textures and denser view sampling could interact with the peripheral patch, including a qualitative example on a real multi-view sequence. Because ground-truth poses are unavailable for most real datasets, we cannot provide the same quantitative controls; we therefore treat full real-world benchmarking as future work while arguing that the high-frequency peripheral design remains likely to disrupt feature matching. revision: partial

Circularity Check

0 steps flagged

No circularity: purely empirical poisoning technique with direct metric validation

full rationale

The paper proposes an empirical dataset-poisoning method (small peripheral checkerboard patch) and evaluates its effect on downstream SfM + 3DGS reconstruction error via direct experiments on the NeRF-Synthetic benchmark. No mathematical derivation, parameter fitting, or first-principles prediction is claimed or present; success is measured by observed LPIPS increase (6.8x) rather than any quantity that reduces to the input by construction. None of the enumerated circularity patterns apply: there are no self-definitional equations, fitted inputs renamed as predictions, or load-bearing self-citations. The central claim is an empirical observation, not a tautological reduction.

Axiom & Free-Parameter Ledger

0 free parameters · 1 axioms · 0 invented entities

The method rests on standard domain assumptions about SfM pipelines rather than new axioms or entities; no free parameters are introduced or fitted in the abstract description.

axioms (1)
  • domain assumption High-frequency patterns in image periphery can introduce spurious feature matches that systematically degrade camera pose estimation in COLMAP-style SfM.
    Invoked to justify why the checkerboard patch corrupts the reconstruction pipeline.

pith-pipeline@v0.9.0 · 5530 in / 1301 out tokens · 116402 ms · 2026-05-10T15:21:33.768357+00:00 · methodology

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

19 extracted references · 19 canonical work pages

  1. [1]

    Barron, Ben Mildenhall, Dor Verbin, Pratul P

    Jonathan T. Barron, Ben Mildenhall, Dor Verbin, Pratul P. Srinivasan, and Peter Hedman. Mip-NeRF 360: Unbounded anti-aliased neural radiance fields. InIEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2022. 2, 4

    work page 2022

  2. [2]

    Must3r: Multi-view network for stereo 3d reconstruc- tion

    Yohann Cabon, Lucas Stoffl, Leonid Antsfeld, Gabriela Csurka, Boris Chidlovskii, Jerome Revaud, and Vincent Leroy. Must3r: Multi-view network for stereo 3d reconstruc- tion. InCVPR, 2025. 8

    work page 2025

  3. [3]

    Guardsplat: efficient and robust water- marking for 3d gaussian splatting

    Zixuan Chen, Guangcong Wang, Jiahao Zhu, Jianhuang Lai, and Xiaohua Xie. Guardsplat: efficient and robust water- marking for 3d gaussian splatting. InProceedings of the Computer Vision and Pattern Recognition Conference, pages 16325–16335, 2025. 3

    work page 2025

  4. [4]

    Kalei- doscopic background attack: Disrupting pose estimation with multi-fold radial symmetry textures.arXiv preprint arXiv:2507.10265, 2025

    Xinlong Ding, Hongwei Yu, Jiawei Li, Feifan Li, Yu Shang, Bochao Zou, Huimin Ma, and Jiansheng Chen. Kalei- doscopic background attack: Disrupting pose estimation with multi-fold radial symmetry textures.arXiv preprint arXiv:2507.10265, 2025. 3

    work page arXiv 2025

  5. [5]

    Gausstrap: Stealthy poisoning attacks on 3d gaus- sian splatting for targeted scene confusion.arXiv preprint arXiv:2504.20829, 2025

    Jiaxin Hong, Sixu Chen, Shuoyang Sun, Hongyao Yu, Hao Fang, Yuqi Tan, Bin Chen, Shuhan Qi, and Jiawei Li. Gausstrap: Stealthy poisoning attacks on 3d gaus- sian splatting for targeted scene confusion.arXiv preprint arXiv:2504.20829, 2025. 2

    work page arXiv 2025

  6. [6]

    Gaussianmarker: Uncertainty-aware copyright protection of 3d gaussian splat- ting.Advances in Neural Information Processing Systems, 37:33037–33060, 2024

    Xiufeng Huang, Ruiqi Li, Yiu-ming Cheung, Ka Chun Cheung, Simon See, and Renjie Wan. Gaussianmarker: Uncertainty-aware copyright protection of 3d gaussian splat- ting.Advances in Neural Information Processing Systems, 37:33037–33060, 2024. 2, 3

    work page 2024

  7. [7]

    Ipa-nerf: Illusory poison- ing attack against neural radiance fields.arXiv preprint arXiv:2407.11921, 2024

    Wenxiang Jiang, Hanwei Zhang, Shuo Zhao, Zhong- wen Guo, and Hao Wang. Ipa-nerf: Illusory poison- ing attack against neural radiance fields.arXiv preprint arXiv:2407.11921, 2024. 3

    work page arXiv 2024

  8. [8]

    3D Gaussian Splatting for real-time radiance field rendering.ACM Transactions on Graphics, 42 (4), 2023

    Bernhard Kerbl, Georgios Kopanas, Thomas Leimk ¨uhler, and George Drettakis. 3D Gaussian Splatting for real-time radiance field rendering.ACM Transactions on Graphics, 42 (4), 2023. 1, 2, 3, 4

    work page 2023

  9. [9]

    Grounding image matching in 3d with mast3r, 2024

    Vincent Leroy, Yohann Cabon, and Jerome Revaud. MASt3R: Matching and stereo 3d reconstruction.arXiv preprint arXiv:2406.09756, 2024. 2, 8

    work page arXiv 2024

  10. [10]

    Gaussianstego: A gen- eralizable stenography pipeline for generative 3d gaussians splatting.arXiv preprint arXiv:2407.01301, 2024

    Chenxin Li, Hengyu Liu, Zhiwen Fan, Wuyang Li, Yifan Liu, Panwang Pan, and Yixuan Yuan. Gaussianstego: A gen- eralizable stenography pipeline for generative 3d gaussians splatting.arXiv preprint arXiv:2407.01301, 2024. 3

    work page arXiv 2024

  11. [11]

    Poison-splat: Computation cost attack on 3d gaussian splatting

    Jiahao Lu, Yifan Zhang, Qiuhong Shen, Xinchao Wang, and Shuicheng Y AN. Poison-splat: Computation cost attack on 3d gaussian splatting. InThe Thirteenth International Con- ference on Learning Representations, 2025. 2

    work page 2025

  12. [12]

    Srinivasan, Matthew Tancik, Jonathan T

    Ben Mildenhall, Pratul P. Srinivasan, Matthew Tancik, Jonathan T. Barron, Ravi Ramamoorthi, and Ren Ng. NeRF: Representing scenes as neural radiance fields for view synthesis. InEuropean Conference on Computer Vision (ECCV), 2020. 1, 2, 3, 4

    work page 2020

  13. [13]

    Structure-from-motion revisited

    Johannes Lutz Sch ¨onberger and Jan-Michael Frahm. Structure-from-motion revisited. InIEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2016. 2, 3

    work page 2016

  14. [14]

    Seitz, and Richard Szeliski

    Noah Snavely, Steven M. Seitz, and Richard Szeliski. Photo tourism: exploring photo collections in 3d.ACM Trans. Graph., 25(3):835–846, 2006. 2

    work page 2006

  15. [15]

    Geometry cloak: Preventing tgs-based 3d re- construction from copyrighted images.Advances in Neural Information Processing Systems, 37:119361–119385, 2024

    Qi Song, Ziyuan Luo, Ka Chun Cheung, Simon See, and Renjie Wan. Geometry cloak: Preventing tgs-based 3d re- construction from copyrighted images.Advances in Neural Information Processing Systems, 37:119361–119385, 2024. 2, 3

    work page 2024

  16. [16]

    Water-gs: Toward copyright protection for 3d gaussian splatting via universal watermarking.arXiv preprint arXiv:2412.05695, 2024

    Yuqi Tan, Xiang Liu, Shuzhao Xie, Bin Chen, Shu-Tao Xia, and Zhi Wang. Water-gs: Toward copyright protection for 3d gaussian splatting via universal watermarking.arXiv preprint arXiv:2412.05695, 2024. 2, 3

    work page arXiv 2024

  17. [17]

    DUSt3R: Geometric 3d vision made easy

    Shuzhe Wang, Vincent Leroy, Yohann Cabon, Boris Chidlovskii, and Jerome Revaud. DUSt3R: Geometric 3d vision made easy. InIEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2024. 2, 8

    work page 2024

  18. [18]

    Gaussian splatting under attack: Investigat- ing adversarial noise in 3d objects.arXiv preprint arXiv:2412.02803, 2024

    Abdurrahman Zeybey, Mehmet Ergezer, and Tommy Nguyen. Gaussian splatting under attack: Investigat- ing adversarial noise in 3d objects.arXiv preprint arXiv:2412.02803, 2024. 3

    work page arXiv 2024

  19. [19]

    Gs-hider: Hiding messages into 3d gaussian splatting.Advances in Neural Information Process- ing Systems, 37:49780–49805, 2024

    Xuanyu Zhang, Jiarui Meng, Runyi Li, Zhipei Xu, Yongbing Zhang, and Jian Zhang. Gs-hider: Hiding messages into 3d gaussian splatting.Advances in Neural Information Process- ing Systems, 37:49780–49805, 2024. 2, 3

    work page 2024