Pith. sign in

REVIEW 3 major objections 6 minor 48 references

Adding a thin, learnable Gaussian shell to a 3D face avatar can redirect what vision-language models infer about age, gender, and expression, without visibly changing the face.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-02 07:46 UTC pith:VSPP3BJK

load-bearing objection First credible 3DGS-shell attack on VLM face attributes: real contribution, but evaluation cherry-picks the best iteration and the semantic anchor is never validated. the 3 major comments →

arxiv 2607.16280 v1 pith:VSPP3BJK submitted 2026-07-09 cs.CV

3D FaceShell: Attribute Transfer in 3D Face Avatars as a VLM Defense Mechanism

Weston Bondurant , Srijan Das , Hieu Le , Stephanie Schuckers This is my paper
classification cs.CV
keywords 3D Gaussian Splattingvision-language modelsface attribute inferenceadversarial perturbationprivacy defenseattribute transferidentity preservationmulti-view consistency
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

This paper claims that the semantic reading a vision-language model (VLM) gives to a 3D face avatar can be redirected by adding a thin, learnable shell of Gaussians and changing only their color and opacity. The shell is optimized so that rendered views of the avatar match the embedding of a synthetic target face with opposite attributes, making the VLM see age, gender, ethnicity, expression, hair, and eye color differently while the human-recognizable face stays nearly unchanged. The reported outcome is a single 3D perturbation that transfers across multiple black-box VLMs and novel viewpoints, with perceptual distance (LPIPS) around 0.15 and identity similarity (ArcFace) around 0.76, comparable semantics to aggressive 2D attacks but with far less visual degradation. The work matters because 3D avatars are persistent assets: once shared, every rendering can be parsed by a VLM, and existing 2D defenses protect only a single view.

Core claim

The central claim is that VLM-level attribute interpretation of 3D face avatars can be steered by an additive Gaussian shell without touching the underlying geometry. Starting from a frozen 3D Gaussian Splatting (3DGS) face, the method places 50,000 auxiliary Gaussians near the surface and optimizes only their color and opacity. Rendered views at five camera poses are aligned in cosine similarity to the embedding of a pose-matched target image synthesized by Stable Diffusion from an OpenPose pose map and a multi-attribute prompt. Multi-encoder supervision (SigLIP and CLIP), stochastic augmentations, landmark-mask consistency, and YUV chroma regularization keep the perturbation localized. The

What carries the argument

The central object is the 'learnable Gaussian shell': a second set of 50,000 Gaussians initialized by jittering the positions of the frozen 3DGS base Gaussians, with only color and opacity learnable. It carries the entire perturbation because the base geometry and appearance remain fixed. The shell is supervised through multi-view cosine-similarity alignment (Eq. 4) between augmented rendered views and the embedding of a synthetic target image, replacing a text objective with an image-injection objective (Eq. 2). Face-aware regularizers—landmark mask consistency (Eq. 5), YUV chroma penalty (Eq. 6), and progressive opacity clamping—are what keep the perturbation visually inconspicuous and ide

Load-bearing premise

The entire semantic content of the attack is imported from one synthetic target image: if that image does not actually display the requested attributes, the shell cannot make a VLM see them, no matter how well the embedding is aligned.

What would settle it

Human-verify a set of target images from the paper's Stable Diffusion pipeline and rerun the shell optimization only on target images that lack a requested attribute (for instance, a subtle expression). If the injection rate for that attribute remains at the no-attack baseline, the semantic effect is shown to come from the target image, not from the shell optimization. A complementary check is to compare injection rates for attributes that Stable Diffusion renders reliably versus poorly; the latter should consistently fail.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • One optimized shell transfers attribute-steering to multiple black-box VLMs (VideoLLaMA3, LLaVA-NeXT, LLaVA-OV, BLIP-2) and to a closed commercial model, so a single avatar-level perturbation affects a range of models.
  • The perturbation is view-consistent: training on five fixed camera poses gives strong injection on a held-out novel view, and multi-view training outperforms single-view training by 55.6% relative injection rate on VideoLLaMA3.
  • Multi-attribute targets are more effective than single-attribute: shifting all attributes together raises hair-color transfer by 50.7% and expression transfer by 96.7% relative to isolated attacks.
  • The perceptual and identity cost is much smaller than 2D baselines: LPIPS 0.1499 vs 0.38–0.46, identity similarity 0.7629 vs 0.49–0.53.
  • The shell remains effective under JPEG compression, resizing, screen-photography artifacts, and re-rendering, outperforming the leading 2D baseline in these settings.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The method's ceiling is set by the synthetic target image: Table 2 shows weak expression (IR 17.9%) and hair-color (IR 21.1%) transfer, which is consistent with Stable Diffusion rendering those attributes poorly; verifying target images before optimization would separate shell failures from image-generator failures.
  • The transfer claim is partly built into model choice: the tested VLMs use SigLIP or CLIP encoders, the same families used for supervision; testing on VLMs with different visual encoder families would delimit how far the steering generalizes.
  • Because the shell leaves geometry frozen, the same mechanism could plausibly extend to 4D dynamic avatars by tying shell parameters over time, which the paper lists as future work.
  • A practical defense variant would push attributes toward a plausible decoy profile rather than any target, allowing a user to control what unknown VLMs infer without committing to a specific false attribute.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper proposes 3D FaceShell, a method for steering VLM attribute inference from 3D Gaussian Splatting face avatars. A learnable shell of auxiliary Gaussians is added to a frozen 3DGS representation, and only the shell's color/opacity is optimized by multi-view cosine-similarity alignment to a Stable-Diffusion-generated target image that encodes the desired attribute changes. The authors report that this perturbation increases attribute injection and mismatch rates across several VLMs while keeping LPIPS low and ArcFace identity similarity high, with ablations, robustness tests, a user study, and a new 100-face benchmark. The central claim is that VLM semantic interpretation of 3D faces can be manipulated in a view-consistent way without visibly degrading the face.

Significance. If the claims hold, 3D FaceShell is a genuinely new attack surface: existing defenses are mostly 2D, while this method operates in the 3D Gaussian parameter space and demonstrates cross-view transfer. The additive shell design, with frozen baseline geometry, is a clean and well-motivated mechanism, and the paper includes useful ablations (multi-view training, losses, number of Gaussians, encoder ensembling) plus a small user study supporting the fidelity claim. The benchmark of 100 reconstructed celebrity avatars and the focus on VLM attribute inference rather than identity detection are valuable contributions. However, the evaluation protocol has load-bearing weaknesses: the semantic anchor is unverified, the per-source stopping criterion is tied to the main evaluation model, and the tested VLMs share the visual encoders used in training. These issues do not invalidate the core idea, but they must be addressed before the quantitative claims can be taken at face value.

major comments (3)
  1. [§4.1 / Eq. (2)] The only semantic supervision is cosine-similarity alignment to a single Stable Diffusion target image I_tar. The paper never verifies that I_tar actually exhibits the requested attributes. If SD/OpenPose fails to render an attribute, that attribute cannot be injected regardless of shell optimization. Table 2's weak expression (17.9%) and hair-color (21.1%) transfer rates fit this signature, yet the authors interpret them as intrinsic attribute difficulty without measuring the anchor. Please report per-attribute verification of I_tar (human or VLM) and, ideally, include a control that optimizes directly against the text prompt T'_tar. This is load-bearing because the central claim is targeted attribute transfer; without anchor verification, the reported rates are upper bounds set by an external component.
  2. [§5.2, Selection Criteria] The stopping rule selects, per source face, the iteration with the highest injection accuracy subject to LPIPS < 0.165, and injection accuracy is measured with VideoLLaMA3. The main results in Table 1 are reported on frontal (training) views, so the VideoLLaMA3 IR/MR numbers are optimized over training iterations by construction. Even if the 20-face validation set is used to choose the threshold, applying the same per-face criterion to the 100 test faces makes the comparison to fixed-iteration baselines uneven. Please report results at a fixed iteration or use a selection metric that does not involve the evaluated VLMs (e.g., LPIPS only). Table 3's held-out view is more convincing, but it still inherits the snapshot-selection issue.
  3. [§5.1 / Table 1 / Model selection] Training uses exactly the SigLIP and CLIP visual encoders, and all four test VLMs (VideoLLaMA3, LLaVA-NeXT, LLaVA-OV, BLIP-2) use one of these two encoder families. Thus the 'black-box' transfer claim is partly built into the architecture choice. Table 4's Gemini result is the only evidence for transfer to an unknown encoder, and there the margin over 2D baselines shrinks. Please add at least one VLM whose visual encoder is neither SigLIP nor CLIP (e.g., DINOv2- or ConvNeXt-based), or explicitly restrict the claim to encoders within the training family. This is important for the paper's general claim of model-agnostic VLM semantic steering.
minor comments (6)
  1. [Title / §1] The paper calls 3D FaceShell a 'defense mechanism', but the method is fundamentally an attack that injects attributes and causes mismatches. The threat model for a defender is not stated. Please clarify whether the avatar owner applies the shell, and how that protects against malicious VLMs.
  2. [Fig. 4] The caption says 'validation results on VideoLLaMA3 used to select the best-performing samples', but the axes are unlabelled. It is unclear what 'injection accuracy' means here and how the LPIPS threshold was derived.
  3. [Table 2] The 'Individual' row is not described in enough detail: which attributes are held fixed, and are the target prompts constructed with opposite values for the non-target attributes? Please specify the exact prompt/target-image protocol.
  4. [Table 3] The row label 'Front View Training – Validation View' is confusing. It seems to mean 'model trained only on the front view, evaluated on the validation view'; please rename for clarity.
  5. [References] Reference [16] is incomplete ('Over 90 ...'). Several other references also lack venue/publisher details; please run a consistency check.
  6. [Eq. (5)] The double vertical bars in the rendered equations are malformed in the submitted PDF; please fix the LaTeX for L_landmarks.

Circularity Check

0 steps flagged

No significant circularity: transfer rates are measured on held-out VLMs/views against an external anchor, not derived from the training objective.

full rationale

3D FaceShell is an empirical optimization attack, not a first-principles derivation. The optimization objective (Eq. 4) maximizes cosine similarity between rendered views of the perturbed avatar and the embedding of an externally generated target image Itar (Eq. 2). The reported Injection Rate and Mismatch Rate are open-ended text outputs of held-out black-box VLMs, which are not the same function as the cosine-similarity training loss; therefore the successes are not true by construction. The Stable-Diffusion anchor is an external input whose attribute fidelity is never verified, but this is a validity/bottleneck limitation, not a circular step: it does not make the shell output equal to the target image or to the metric. The per-face early-stopping selection on a 20-face VideoLLaMA3 validation set is a possible evaluation-protocol concern but is not a definitional reduction, and the paper also evaluates novel views and other VLMs. There are no load-bearing self-citations or imported uniqueness theorems. No specific circular step can be quoted or exhibited.

Axiom & Free-Parameter Ledger

6 free parameters · 7 axioms · 1 invented entities

The ledger shows the paper introduces one new component (the Gaussian shell) and relies on a set of domain assumptions typical for this literature (differentiable rendering, embedding-to-text transfer, VLM/3D-reconstruction external benchmarks). There are no 'fitted predictions': the claim is empirical. The hand-chosen hyperparameters that most affect the reported results are the LPIPS selection gate (0.165), the λs, and N_shell; their sensitivities are partially mapped by ablations (Tables 5 and 8).

free parameters (6)
  • LPIPS selection threshold = 0.165
    Evaluation-protocol gate in §5.2: per face, the training iteration with highest injection accuracy is reported only if LPIPS < 0.165. This directly shapes the headline IR/MR numbers in Tables 1–4; baselines get no equivalent selection.
  • Regularization weights (λ_landmarks, λ_chroma, λ_Y) = 500; 0.4; 10.0 (λ_chroma cosine-annealed from λ_0)
    Hand-chosen in §5.1. Ablations (Table 5) show identity similarity drops 17.6–24.1% when the landmark or chroma loss is removed, so the reported fidelity depends on these values.
  • Opacity clamp schedule O_max = −0.5 − 2.5C, C = ½(1−cos(πp))
    Hand-chosen annealing schedule (§5.1). Removing the clamp degrades LPIPS by ~25% (Table 5, 'No Clamp'), so it materially affects the perceptual claim.
  • Number of shell Gaussians N_shell = 50,000
    Hand-chosen in §4.2. Ablation (Table 8) shows VideoLLaMA3 IR varies from 40.7% (25k) to 52.3% (100k), so the headline accuracy depends on this choice.
  • Optimizer settings = Adam, lr = 0.1, 10,000 iterations
    Chosen in §5.1; combined with the per-iteration selection rule, the long training budget is what makes the best-of-optimization reporting possible.
  • Camera set and augmentation ranges = K=5 poses (azimuth 270°/255°/285°, elevation ±15°); quantization ±2/255, crop 0.8–1.0, brightness/contrast ±10%
    Chosen in §5.1. Removing augmentations cuts VideoLLaMA3 IR by 60.9% (Table 5), so these choices are load-bearing for the robustness claim.
axioms (7)
  • domain assumption 3DGS rendering R(G;π) is differentiable and photorealistic enough that optimizing shell color/opacity transfers to unseen renders (§3, Eq. 1).
    Standard in the 3DGS literature; the paper validates only via Table 9 distortions, not across arbitrary lighting/cameras.
  • domain assumption VLM factorizes as LLM∘VE and attribute decisions are governed by the visual encoder embedding; aligning embeddings shifts the LLM's attribute text output (§3, §4.3).
    Core to the method; only tested on VLMs whose encoders are in the SigLIP/CLIP families used for training.
  • domain assumption Stable Diffusion + OpenPose target images (Itar) faithfully instantiate the requested multi-attribute set and preserve pose (§4.1, Eq. 2).
    Unverified in the paper; Table 2's weak Expression (17.9%) and Hair Color (21.1%) injection rates suggest this assumption partially fails.
  • domain assumption IMDB-WIKI metadata (age, gender, ethnicity at capture time) is ground truth for Mismatch Rate and for 'opposite attribute' initialization (§5.2).
    Metadata is noisy (inferred/imputed); MR is computed against these labels.
  • domain assumption LPIPS < 0.165 and ArcFace similarity are adequate proxies for 'human-recognizable appearance' and identity (§5.2, §5.3).
    Partially validated by the 13-participant user study (Table 12).
  • domain assumption FaceLift (and LGM for generalization, Table 10) reconstructions preserve source identity (§5.2, Appendix A.1).
    Reconstruction fidelity is taken for granted; identity is then measured against the 2D source image.
  • domain assumption MediaPipe landmark masks correctly localize identity-critical regions (eyes, nose, lips) (§4.4).
    Mask quality gates where perturbations are suppressed.
invented entities (1)
  • Gaussian shell (learnable auxiliary Gaussians) no independent evidence
    purpose: Additive perturbation carrier on top of a frozen 3DGS avatar; only color/opacity are optimized so geometry and identity stay fixed (§4.2).
    Not a physical postulate; it is a method component. Its role is supported only by in-paper ablations (shell-count scaling, Table 8; loss ablations, Table 5). No external benchmark independently validates the shell construct.

pith-pipeline@v1.3.0-alltime-deepseek · 16725 in / 25049 out tokens · 245810 ms · 2026-08-02T07:46:18.322499+00:00 · methodology

0 comments
read the original abstract

Photorealistic 3D face avatars are increasingly deployed as reusable digital assets across applications such as telepresence, animation, and personalized media. At the same time, vision-language models (VLMs) can infer sensitive attributes from rendered images with open-ended semantic reasoning without any fine-tuning. This creates a new privacy challenge: once a 3D face avatar is shared, any of its renderings can be analyzed to extract high-level facial attributes. Existing defenses largely operate in 2D image space and do not address identity-preserving semantic manipulation of 3D facial representations. We propose 3D FaceShell, a framework for steering VLM interpretations of faces rendered from 3D models while preserving geometric fidelity and facial identity. 3D FaceShell augments the original 3D representation with a learnable Gaussian shell that produces subtle, spatially distributed perturbations optimized through multi-view embedding alignment. The perturbations are designed to be visually inconspicuous yet sufficient to redirect VLM-based attribute inference in a view-consistent manner. Extensive experiments on reconstructed celebrity face avatars and multiple black-box VLMs demonstrate that 3D FaceShell significantly increases attribute injection and mismatch rates while maintaining high perceptual similarity and identity consistency. Our results show that it is possible to manipulate VLM-level semantic interpretation of 3D faces without compromising their human-recognizable appearance.

Figures

Figures reproduced from arXiv: 2607.16280 by Hieu Le, Srijan Das, Stephanie Schuckers, Weston Bondurant.

Figure 1
Figure 1. Figure 1: Illustration of our 3D FaceShell method. By optimizing a minimally percep￾tible 3D Gaussian shell, our method successfully subverts VLM attribute predictions across rendered views while preserving the original facial identity and photorealistic appearance. Abstract. Photorealistic 3D face avatars are increasingly deployed as reusable digital assets across applications such as telepresence, anima￾tion, and … view at source ↗
Figure 2
Figure 2. Figure 2: Multi-Attributed Target Image Generation. (1) OpenPose extracts the structural pose from a source face. (2) A Stable Diffusion model, conditioned on this pose and a target attribute text prompt, synthesizes a pose-aligned, se￾mantically different target image. The proposed framework consists of four key components: (a) Multi￾attributed target image generation, which synthesizes pose-aligned target faces wi… view at source ↗
Figure 3
Figure 3. Figure 3: The 3D FaceShell Optimization Pipeline. 3D Operations (Green): A learn￾able Gaussian shell is initialized over a frozen 3DGS baseline and shell parameters are iteratively optimized and Gaussian color is regulated (Lchroma). 2D Operations (Gray): Rendered views are generated to guide feature alignment in shell Gaussians (Lfeature) and enforce identity preservation (Llandmarks). of the chroma-constrained tex… view at source ↗
Figure 4
Figure 4. Figure 4: Validation results on VideoL￾LaMA3 used to select the best-performing samples during optimization. Selection Criteria. To determine the optimal stopping point for our adver￾sarial optimization and ensure consis￾tent perceptual fidelity, we evaluate the training progression on a validation set consisting of 20 separate faces. As illus￾trated in [PITH_FULL_IMAGE:figures/full_fig_p010_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: 3D FaceShell achieves superior perceptual fidelity over baselines. While state￾of-the-art 2D attacks introduce severe pixelated noise, color distortion, and structural warping to shift VLM perception, our method produces visually inconspicuous pertur￾bations that successfully preserve original photorealism and facial identity. 5.5 Ablation Studies Impact of Losses and Augmentation. In [PITH_FULL_IMAGE:fig… view at source ↗
Figure 6
Figure 6. Figure 6: Progression of spatial LPIPS activation averaged across 100 subjects [PITH_FULL_IMAGE:figures/full_fig_p022_6.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

48 extracted references · 15 linked inside Pith

  1. [1]

    In: 2017 12th IEEE International Conference on Automatic Face & Gesture Recognition (FG 2017)

    Agustsson, E., Timofte, R., Escalera, S., Baro, X., Guyon, I., Rothe, R.: Apparent and real age estimation in still images with deep residual regressors on appa- real database. In: 2017 12th IEEE International Conference on Automatic Face & Gesture Recognition (FG 2017). pp. 87–94 (2017)

    2017

  2. [2]

    AlDahoul, N., Tan, M.J.T., Kasireddy, H.R., Zaki, Y.: Exploring vision language models for facial attribute recognition: Emotion, race, gender, and age (2024), https://arxiv.org/abs/2410.24148

    Pith/arXiv arXiv 2024

  3. [3]

    IEEE Transactions on Pattern Analysis and Machine Intelligence43(1), 172–186 (2021).https://doi.org/10

    Cao, Z., Hidalgo, G., Simon, T., Wei, S.E., Sheikh, Y.: Openpose: Realtime multi- person 2d pose estimation using part affinity fields. IEEE Transactions on Pattern Analysis and Machine Intelligence43(1), 172–186 (2021).https://doi.org/10. 1109/TPAMI.2019.2929257

    arXiv 2021

  4. [4]

    IEEE/CVF Winter Conference on Ap- plications of Computer Vision 2026

    Chaubey, A., Guan, X., Soleymani, M.: Face-llava: Facial expression and attribute understanding through instruction tuning. IEEE/CVF Winter Conference on Ap- plications of Computer Vision 2026

    2026

  5. [5]

    IEEE Transactions on Pattern Anal- ysisandMachineIntelligence44(10),5962–5979(Oct2022).https://doi.org/10

    Deng, J., Guo, J., Yang, J., Xue, N., Kotsia, I., Zafeiriou, S.: Arcface: Additive angular margin loss for deep face recognition. IEEE Transactions on Pattern Anal- ysisandMachineIntelligence44(10),5962–5979(Oct2022).https://doi.org/10. 1109/tpami.2021.3087709,http://dx.doi.org/10.1109/TPAMI.2021.3087709

    arXiv 2021

  6. [6]

    Dong, Y., Chen, H., Chen, J., Fang, Z., Yang, X., Zhang, Y., Tian, Y., Su, H., Zhu, J.: How robust is google’s bard to adversarial image attacks? (2023),https: //arxiv.org/abs/2309.11751

    Pith/arXiv arXiv 2023

  7. [7]

    In: The Thirty-eighth Annual Conference on Neural Information Processing Systems (2024),https:// openreview.net/forum?id=6AeIDnrTN2

    Fan, Z., Wang, K., Wen, K., Zhu, Z., Xu, D., Wang, Z.: Lightgaussian: Unbounded 3d gaussian compression with 15x reduction and 200+ FPS. In: The Thirty-eighth Annual Conference on Neural Information Processing Systems (2024),https:// openreview.net/forum?id=6AeIDnrTN2

    2024

  8. [8]

    arXiv preprint arXiv:2407.21783 (2024)

    Grattafiori, A., Dubey, A., Jauhri, A., Pandey, A., Kadian, A., Al-Dahle, A., Let- man, A., Mathur, A., Schelten, A., Vaughan, A., et al.: The llama 3 herd of models. arXiv preprint arXiv:2407.21783 (2024)

    Pith/arXiv arXiv 2024

  9. [9]

    Guo, Q., Pang, S., Jia, X., Liu, Y., Guo, Q.: Efficient generation of targeted and transferable adversarial examples for vision-language models via diffusion models (2024),https://arxiv.org/abs/2404.10335

    Pith/arXiv arXiv 2024

  10. [10]

    In: Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV) Workshops

    Horváth, A., Józsa, C.M.: Targeted adversarial attacks on generalizable neural radiance fields. In: Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV) Workshops. pp. 3718–3727 (October 2023)

    2023

  11. [11]

    ACM Transactions on Graphics42(4) (July 2023),https://repo-sam.inria.fr/fungraph/3d-gaussian-splatting/

    Kerbl, B., Kopanas, G., Leimkühler, T., Drettakis, G.: 3d gaussian splatting for real-time radiance field rendering. ACM Transactions on Graphics42(4) (July 2023),https://repo-sam.inria.fr/fungraph/3d-gaussian-splatting/

    2023

  12. [12]

    Li, B., Zhang, Y., Guo, D., Zhang, R., Li, F., Zhang, H., Zhang, K., Zhang, P., Li, Y., Liu, Z., Li, C.: Llava-onevision: Easy visual task transfer (2024),https: //arxiv.org/abs/2408.03326

    Pith/arXiv arXiv 2024

  13. [13]

    Li, F., Zhang, R., Zhang, H., Zhang, Y., Li, B., Li, W., Ma, Z., Li, C.: Llava-next- interleave: Tackling multi-image, video, and 3d in large multimodal models (2024), https://arxiv.org/abs/2407.07895

    Pith/arXiv arXiv 2024

  14. [14]

    In: International conference on machine learning

    Li, J., Li, D., Savarese, S., Hoi, S.: Blip-2: Bootstrapping language-image pre- training with frozen image encoders and large language models. In: International conference on machine learning. pp. 19730–19742. PMLR (2023)

    2023

  15. [15]

    In: Proceedings of the IEEE/CVF conference on computer vision and pattern recognition

    Li, Y., Li, Y., Dai, X., Guo, S., Xiao, B.: Physical-world optical adversarial attacks on 3d face recognition. In: Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. pp. 24699–24708 (2023) 3D FaceShell 17

    2023

  16. [16]

    Li, Z., Zhao, X., Wu, D.D., Cui, J., Shen, Z.: A frustratingly simple yet highly effective attack baseline: Over 90

  17. [17]

    In: Advances in Neural Information Processing Systems (NeurIPS) (2023)

    Liu, H., Li, C., Wu, Q., Lee, Y.J.: Visual instruction tuning. In: Advances in Neural Information Processing Systems (NeurIPS) (2023)

    2023

  18. [18]

    In: Proceedings of the IEEE/CVF International Conference on Computer Vision

    Lou, T., Jia, X., Liang, S., Liang, J., Zhang, M., Xiao, Y., Cao, X.: 3d gaussian splatting driven multi-view robust physical adversarial camouflage generation. In: Proceedings of the IEEE/CVF International Conference on Computer Vision. pp. 28752–28762 (2025)

    2025

  19. [19]

    In: Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV)

    Lyu, W., Zhou, Y., Yang, M.H., Shu, Z.: Facelift: Learning generalizable single im- age 3d face reconstruction from synthetic heads. In: Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV). pp. 12691–12701 (October 2025)

    2025

  20. [20]

    IEEE Access11, 144274–144295 (2023)

    Naderi, H., Bajić, I.V.: Adversarial attacks and defenses on 3d point cloud classi- fication: A survey. IEEE Access11, 144274–144295 (2023)

    2023

  21. [21]

    IEEE Transactions on Biometrics, Behavior, and Identity Science (2026)

    Narayan, K., Vibashan, V., Patel, V.M.: Facexbench: Evaluating multimodal llms on face understanding. IEEE Transactions on Biometrics, Behavior, and Identity Science (2026)

    2026

  22. [22]

    org/abs/2511.20223

    Nie, S., Zhang, J., Yan, J., Shan, S., Chen, X.: V-attack: Targeting disentangled value features for controllable adversarial attacks on lvlms (2025),https://arxiv. org/abs/2511.20223

    arXiv 2025

  23. [23]

    Niu, Z., Ren, H., Gao, X., Hua, G., Jin, R.: Jailbreaking attack against multimodal large language model (2024),https://arxiv.org/abs/2402.02309

    Pith/arXiv arXiv 2024

  24. [24]

    arXiv preprint arXiv:2303.08774 (2023)

    OpenAI: Gpt-4 technical report. arXiv preprint arXiv:2303.08774 (2023)

    Pith/arXiv arXiv 2023

  25. [25]

    In: Proceedings of the AAAI conference on artificial intelligence

    Qi, X., Huang, K., Panda, A., Henderson, P., Wang, M., Mittal, P.: Visual ad- versarial examples jailbreak aligned large language models. In: Proceedings of the AAAI conference on artificial intelligence. vol. 38, pp. 21527–21536 (2024)

    2024

  26. [26]

    Qian, S., Kirschstein, T., Schoneveld, L., Davoli, D., Giebenhain, S., Nießner, M.: Gaussianavatars:Photorealisticheadavatarswithrigged3dgaussians.In:Proceed- ings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. pp. 20299–20309 (2024)

    2024

  27. [27]

    In: International conference on machine learning

    Radford, A., Kim, J.W., Hallacy, C., Ramesh, A., Goh, G., Agarwal, S., Sastry, G., Askell, A., Mishkin, P., Clark, J., et al.: Learning transferable visual models from natural language supervision. In: International conference on machine learning. pp. 8748–8763. PmLR (2021)

    2021

  28. [28]

    International Journal of Computer Vision126(2-4), 144–157 (2018)

    Rothe, R., Timofte, R., Gool, L.V.: Deep expectation of real and apparent age from a single image without facial landmarks. International Journal of Computer Vision126(2-4), 144–157 (2018)

    2018

  29. [29]

    In: European Conference on Computer Vision (ECCV)

    Tang, J., Chen, Z., Chen, X., Wang, T., Zeng, G., Liu, Z.: Lgm: Large multi-view gaussian model for high-resolution 3d content creation. In: European Conference on Computer Vision (ECCV). pp. 1–18 (September 2024)

    2024

  30. [30]

    In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)

    Taubner, F., Zhang, R., Tuli, M., Lindell, D.B.: Cap4d: Creating animatable 4d portrait avatars with morphable multi-view diffusion models. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). pp. 5318–5330 (June 2025)

    2025

  31. [31]

    arxiv 2023

    Team, G., Anil, R., Borgeaud, S., Alayrac, J.B., Yu, J., Soricut, R., Schalkwyk, J., Dai, A.M., Hauth, A., Millican, K., et al.: Gemini: A family of highly capable multimodal models. arxiv 2023. arXiv preprint arXiv:2312.11805 (2024)

    Pith/arXiv arXiv 2023

  32. [32]

    Advances in Neural Information Processing Systems37, 103619–103651 (2024) 18 W

    Tömekçe, B., Vero, M., Staab, R., Vechev, M.: Private attribute inference from images with vision-language models. Advances in Neural Information Processing Systems37, 103619–103651 (2024) 18 W. Bondurant et al

    2024

  33. [33]

    Neurocomputing p

    Wang, M., Zhou, J., Li, T., Meng, G., Chen, K.: A survey on physical adversarial attacks against face recognition systems. Neurocomputing p. 132485 (2025)

    2025

  34. [34]

    Wilson, E., Bindschaedler, V., Jörg, S., Sheikholeslam, S., Butler, K., Jain, E.: Towards privacy-preserving photorealistic self-avatars in mixed reality (2025), https://arxiv.org/abs/2507.22153

    Pith/arXiv arXiv 2025

  35. [35]

    In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) (2024)

    Wu, G., Yi, T., Fang, J., Xie, L., Zhang, X., Wei, W., Liu, W., Tian, Q., Wang, X.: 4d gaussian splatting for real-time dynamic scene rendering. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) (2024)

    2024

  36. [36]

    Wu, T., Yuan, Y.J., Zhang, L.X., Yang, J., Cao, Y.P., Yan, L.Q., Gao, L.: Recent advances in 3d gaussian splatting (2024),https://arxiv.org/abs/2403.11134

    Pith/arXiv arXiv 2024

  37. [37]

    In: Proceed- ings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) (June 2019)

    Xiang, C., Qi, C.R., Li, B.: Generating 3d adversarial point clouds. In: Proceed- ings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) (June 2019)

    2019

  38. [38]

    In: Proceed- ings of the IEEE/CVF conference on computer vision and pattern recognition

    Yang, X., Liu, C., Xu, L., Wang, Y., Dong, Y., Chen, N., Su, H., Zhu, J.: Towards effective adversarial textured 3d meshes on physical face recognition. In: Proceed- ings of the IEEE/CVF conference on computer vision and pattern recognition. pp. 4119–4128 (2023)

    2023

  39. [39]

    Yin, Z., Cao, Y., Liu, H., Wang, T., Chen, J., Ma, F.: Towards robust multimodal large language models against jailbreak attacks (2025),https://arxiv.org/abs/ 2502.00653

    Pith/arXiv arXiv 2025

  40. [40]

    In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) (June 2024)

    Yu, Z., Chen, A., Huang, B., Sattler, T., Geiger, A.: Mip-splatting: Alias-free 3d gaussian splatting. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) (June 2024)

    2024

  41. [41]

    Zeybey,A.,Ergezer,M.,Nguyen,T.:Gaussiansplattingunderattack:Investigating adversarial noise in 3d objects (2024),https://arxiv.org/abs/2412.02803

    Pith/arXiv arXiv 2024

  42. [42]

    In: Proceedings of the IEEE/CVF international conference on computer vision (2023)

    Zhai, X., Mustafa, B., Kolesnikov, A., Beyer, L.: Sigmoid loss for language im- age pre-training. In: Proceedings of the IEEE/CVF international conference on computer vision (2023)

    2023

  43. [43]

    Zhang, B., Li, K., Cheng, Z., Hu, Z., Yuan, Y., Chen, G., Leng, S., Jiang, Y., Zhang, H., Li, X., Jin, P., Zhang, W., Wang, F., Bing, L., Zhao, D.: Videollama 3: Frontier multimodal foundation models for image and video understanding (2025), https://arxiv.org/abs/2501.13106

    Pith/arXiv arXiv 2025

  44. [44]

    Zhang, D., Liu, Y., Lin, L., Zhu, Y., Chen, K., Qin, M., Li, Y., Wang, H.: Hravatar: High-qualityandrelightablegaussianheadavatar.In:ProceedingsoftheComputer Vision and Pattern Recognition Conference (2025)

    2025

  45. [45]

    In: Proceedings of the Computer Vision and Pattern Recognition Confer- ence (2025)

    Zhang, J., Ye, J., Ma, X., Li, Y., Yang, Y., Chen, Y., Sang, J., Yeung, D.Y.: Any- attack: Towards large-scale self-supervised adversarial attacks on vision-language models. In: Proceedings of the Computer Vision and Pattern Recognition Confer- ence (2025)

    2025

  46. [46]

    In: Proceedings of the IEEE conference on computer vision and pattern recognition

    Zhang, R., Isola, P., Efros, A.A., Shechtman, E., Wang, O.: The unreasonable effectiveness of deep features as a perceptual metric. In: Proceedings of the IEEE conference on computer vision and pattern recognition. pp. 586–595 (2018)

    2018

  47. [47]

    Advances in Neural Information Processing Systems36, 54111–54138 (2023)

    Zhao, Y., Pang, T., Du, C., Yang, X., Li, C., Cheung, N.M.M., Lin, M.: On eval- uating adversarial robustness of large vision-language models. Advances in Neural Information Processing Systems36, 54111–54138 (2023)

    2023

  48. [48]

    landmark shell

    Zhou, F., Zhou, Q., Ling, H., Lu, X.: Adversarial attacks on both face recognition and face anti-spoofing models (2025),https://arxiv.org/abs/2405.16940 3D FaceShell 19 A Appendix In Section A.1, we provide additional ablation studies, detailing the performance impact of calculating our landmark consistency loss directly in the 3D space and analyzing the ...

    Pith/arXiv arXiv 2025