Pith. sign in

REVIEW 4 major objections 8 minor 50 references

DefenseSplat claims that zeroing high-frequency wavelet bands of poisoned training views blocks 3DGS adversarial attacks without clean labels, and demonstrates the benefit across three benchmarks and three attack strengths.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-02 21:39 UTC pith:UACLODAS

load-bearing objection Useful first defense against Poison-Splat-style attacks on 3DGS, but the frequency-localization premise is supported only by proxy evidence and the clean-input cost is understated. the 4 major comments →

arxiv 2602.19323 v2 pith:UACLODAS submitted 2026-02-22 cs.CV

DefenseSplat: Enhancing the Robustness of 3D Gaussian Splatting via Frequency-Aware Filtering

Yiran Qiao , Yiren Lu , Yunlai Zhou , Rui Yang , Linlin Hou , Yu Yin , Jing Ma This is my paper
classification cs.CV MSC 68T4568U10
keywords 3D Gaussian Splattingadversarial defensewavelet transformfrequency filteringPoison-Splatdenial-of-service defensescale regularization3D reconstruction robustness
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

DefenseSplat claims that adversarial attacks on 3D Gaussian Splatting, such as Poison-Splat, concentrate most of their harmful energy in high-frequency wavelet subbands of the input images. The paper therefore proposes a two-step defense that requires no clean ground-truth images: first, decompose each poisoned training view with a discrete wavelet transform, set the LH/HL/HH subbands to zero, and reconstruct with the inverse transform; second, add a ReLU-based scale-regularization loss that penalizes elongated Gaussians, which are the primitives most likely to overfit consistent adversarial textures. On Mip-NeRF 360, Tanks-and-Temples, and LLFF, the method reports substantially higher PSNR/SSIM, lower LPIPS, and lower training time, Gaussian count, and GPU memory than undefended 3DGS and two related baselines, while clean-data PSNR degrades by only about 1.75%. The paper argues this opens the first practical defense route for server-side 3DGS training.

Core claim

The paper's central claim is that zeroing the three high-frequency wavelet subbands (LH, HL, HH) before feeding images to 3DGS optimization removes the bulk of adversarial perturbation while preserving the scene, because the low-frequency LL subband carries over 95% of total energy and the attack concentrates in high frequencies. A companion scale-regularization loss, L_scale = ReLU(nu - tau), constrains elongated Gaussians that would otherwise form to fit consistent adversarial textures. The result is that defended training finishes faster, uses fewer Gaussians and less GPU memory, and renders higher-fidelity images than undefended training and than the two baselines tested, across three st

What carries the argument

The core mechanism is wavelet-domain gating: a single-level discrete wavelet transform decomposes each RGB channel into LL, LH, HL, and HH subbands; the high-frequency coefficients are set to zero and the inverse DWT reconstructs the filtered image (Eq. 8). This removes high-frequency noise while retaining spatial layout via the LL subband. The second component is a ReLU-thresholded scale-variance regularizer (Eq. 9) that penalizes only the elongated Gaussians (normalized variance above tau) that the optimization would otherwise use to fit consistent adversarial textures, leaving spherical and flat Gaussians untouched.

Load-bearing premise

The defense assumes adversarial perturbations on input views are concentrated in high-frequency wavelet bands, so that zeroing those bands removes attack noise while leaving the scene's low-frequency content intact; if an attack puts meaningful energy in the low-frequency band, the filter removes real content and fails.

What would settle it

Craft a Poison-Splat variant that maximizes perturbation energy in the LL wavelet subband (e.g., by inverse-wavelet projecting the noise so it lives mostly in LL, constrained to the same epsilon) and measure whether DefenseSplat's PSNR and Gaussian-count improvements collapse while 3DGS remains damaged. If the defended PSNR drops to near-undefended levels while clean PSNR also drops, the frequency-localization premise is refuted.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • DefenseSplat works without clean ground-truth supervision, so it can be inserted into any existing 3DGS training pipeline as a preprocessing step.
  • Filtering high-frequency subbands reduces Gaussian count and memory, which directly counters the denial-of-service vector of Poison-Splat attacks.
  • The defense is a plug-and-play module that can be combined with other methods (e.g., CompactGS) to improve both robustness and efficiency.
  • On clean inputs the method trades about 1.75% PSNR for roughly 2x reduction in Gaussian count and memory, a favorable robustness-fidelity trade-off for server deployment.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The same wavelet gate could be tested against the earlier two-stage 2D attack on 3DGS, and possibly against adversarial perturbations on NeRF-style renderers, since those also operate on input images.
  • The paper's own Table 5 shows that at epsilon=64/255 the LL matching rate drops 19.31%, indicating the attack is beginning to reach low frequencies; an editor's inference is that a production defense should monitor the LL/HL matching-rate ratio and switch to a content-aware filter when it crosses unity.
  • The scale-regularization loss is independent of the wavelet step; one could ablate it alone on clean or poisoned data to separate the effects of filtering vs. regularization on Gaussian count and fidelity.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 8 minor

Summary. The paper proposes DefenseSplat, an input-side defense for 3D Gaussian Splatting against the Poison-Splat adversarial attack. The method performs a one-level discrete wavelet transform on each input image, zeros the LH/HL/HH high-frequency subbands, applies the inverse DWT, and adds a ReLU-based scale regularization loss that discourages elongated Gaussians. The authors first analyze matching-rate degradation in low- and high-frequency wavelet subbands, concluding that adversarial perturbations are concentrated in high frequencies while low frequencies retain scene content. They then evaluate the method on Mip-NeRF 360, Tanks-and-Temples, and LLFF, reporting improved PSNR/SSIM/LPIPS, reduced training time, fewer Gaussians, and lower GPU memory relative to 3DGS, CompactGS, and Difix3D+, across attack strengths 16/255, 32/255, and 64/255. Clean-input experiments are reported to assess the robustness/fidelity trade-off. The central claim is that simple high-frequency wavelet filtering yields robust 3DGS training without significantly impairing clean reconstruction quality.

Significance. If the central claim holds, DefenseSplat would be a useful, simple, and inexpensive first defense for 3DGS, a topic that is genuinely underexplored. The paper ships extensive per-scene tables on three datasets, tests three attack strengths, reports resource-consumption metrics that are directly relevant to denial-of-service concerns, and includes a clean-input check. The approach is interpretable and does not require clean ground-truth supervision. These are real strengths. The significance is, however, conditional: the empirical premise that Poison-Splat energy is concentrated in high-frequency wavelet bands is supported only indirectly, and the clean-input results in the appendix substantially weaken the 'no significant clean-data impairment' part of the central claim.

major comments (4)
  1. [Sec. 3.2, Eq. (8), Table 5] The load-bearing premise — adversarial perturbations on 3DGS inputs manifest as high-frequency noise — is established only through SuperPoint/LightGlue matching-rate drops and clean-image energy ratios. Neither measures the perturbation's own frequency content. Since DWT is orthonormal, one can directly compute E[||delta||^2] = E_LL + E_LH + E_HL + E_HH for the Poison-Splat perturbations. Table 5 shows the premise degrading at epsilon=64/255: LL matching drops 19.31%, nearly the high-frequency drop of 25.61%. If a non-negligible fraction of delta energy lies in LL, Eq. (8) removes genuine low-frequency scene structure while leaving attack energy in place. Please report direct subband energy ratios of the perturbation itself across attack strengths, and discuss what fraction of the attack energy Eq. (8) actually removes.
  2. [Sec. 4.2 (RQ3) vs. Appendix Table 7] The main text states that on clean inputs 'our method does not exhibit any significant performance degradation' and reports only Mip-NeRF 360 and Tanks-and-Temples numbers (1.75% PSNR, 2.5% SSIM, 11% LPIPS). The appendix Table 7 shows a different picture on LLFF: clean PSNR drops from 31.29 to 28.39 (-9.3%), SSIM from 0.9431 to 0.8919 (-5.4%), and LPIPS from 0.1224 to 0.1992 (+63%). This is a substantial clean-input impairment on one of the three benchmark datasets and directly contradicts the unqualified wording of the central claim. The main-text RQ3 discussion must report all three datasets and re-frame the claim as dataset-dependent, or provide a justification for why the LLFF degradation is acceptable.
  3. [Sec. 5 and Appendix B.1] The paper's own limitation statement says evaluation is limited to Poison-Splat, and Appendix B.1 concedes that as attack strength increases, 'the target of the attack gradually shifts from high-frequency to low-frequency components' and that the LL matching drop may exceed the high-frequency drop. These statements undermine the generalizability claim ('we believe our defense strategy is broadly generalizable') without further evidence. At minimum, the paper should test against the Zeybey et al. 2D attack cited in Sec. 1.1, or clearly restrict the robustness claim to Poison-Splat-like attacks. As written, the concluding generality claim is not supported by the experiments.
  4. [Tables 1-3 and Sec. 4.1] The comparisons against CompactGS and Difix3D+ are informative, but neither is a defense method. The paper does not compare against simple frequency-domain baselines such as Gaussian blurring, bilateral filtering, or wavelet soft-thresholding with adaptively chosen thresholds. Because Eq. (8) is a hard zeroing operation, it is important to show that the proposed filtering outperforms these standard baselines on the same metrics; otherwise the specific contribution of the frequency-aware design (as opposed to generic smoothing) is not established. Also, all reported numbers appear to come from a single training run; please add standard deviations over multiple seeds or state that the reported trends were stable across runs.
minor comments (8)
  1. [Sec. 5] Typo: 'Disscusion' should be 'Discussion'.
  2. [Sec. 3.1, Eq. (4)] The text says 'I(x,y) denotes the pixel intensity of a given poison.' Presumably this should be 'a given image'.
  3. [Sec. 3.1, Eq. (1)] G(x;Sigma) is written without an explicit mean parameter; the text says x is the center but the formula omits (x - mu). Please clarify the notation.
  4. [Table 3] Typo: 'Tansk-and-Temples' should be 'Tanks-and-Temples'.
  5. [Fig. 1] The percentages in the caption are not defined in the main text; a one-sentence explanation of what the four values represent would aid readability.
  6. [Sec. 3.2] The TSP formulation and the pose-loss weights w_g and w_t are introduced but their exact values are not reported. Please state them in the implementation details so the analysis is reproducible.
  7. [Sec. 4.2, RQ4] Ablation of the scale loss is only implicit through Ours vs. Ours+ReLU. A separate table isolating Eq. (9) with and without the filtering component would better support the claim that both components are necessary.
  8. [Appendix B.1] Appendix Table 5 reports matching rates for only Train and Truck scenes. Please state whether these are representative or add the full-dataset numbers.

Circularity Check

0 steps flagged

No circular derivation: the defense is an input pre-filter validated against an external attack and clean benchmarks; the frequency-localization premise is an empirical assumption, not a fitted output.

full rationale

The paper's derivation chain is not circular. Eq. (8) is a fixed wavelet-domain operation (zeroing LH/HL/HH after DWT) applied to input images; it contains no parameter fitted to the reported PSNR/SSIM/LPIPS or to Poison-Splat attack outcomes. Eq. (9) uses a manually chosen threshold (tau=1.6 derived from a reference Gaussian with scales [1,1,10], and lambda_scale=1e5), not a value fitted to evaluation results. The central claim is supported by external comparisons against Poison-Splat at multiple attack strengths and by clean-input evaluations, so the 'prediction' of robustness is not identical to the analysis that motivated the filter. The frequency-localization premise (Sec. 3.2, Observations 1 and 2) is an empirical hypothesis evidenced by matching-rate changes and energy ratios; even if this evidence is indirect, that is a correctness/evidence concern, not circularity. The paper's own appendix actually undermines part of the clean-input claim (Table 7: LLFF Clean+Ours PSNR drops 31.29->28.39), but a contradictory result is not a circular step. Self-citations ([24], [25], [33]) appear only in related-work or motivation passages and are not load-bearing for the defense result. Thus the paper is self-contained against external benchmarks and warrants a low circularity score.

Axiom & Free-Parameter Ledger

4 free parameters · 7 axioms · 0 invented entities

The central design rests on empirically motivated assumptions rather than a derivation. The main debt is the high-frequency-localization of the attack: all downstream claims inherit this observational premise, which is demonstrated only for Poison-Splat. Hyperparameters tau and lambda_scale are set by hand, and the matching pipeline's weights are not specified, so the supporting analysis is not fully reproducible. No fitted parameters are used to force the reported PSNR numbers.

free parameters (4)
  • tau = 1.6
    Scale-loss threshold in Eq. (9); chosen by hand from a reference Gaussian with scales [1,1,10] whose normalized variance is 1.6875 (Appendix A). It decides which elongated Gaussians are penalized, and no sensitivity analysis is reported.
  • lambda_scale = 1e5
    Weight of L_scale in the total loss (Sec. 4.1); set without an ablation or sensitivity study. It controls how strongly the scale regularizer competes with reconstruction objectives.
  • DWT level l = 1
    Decomposition level chosen "for simplicity and without loss of effectiveness" (Sec. 3.2); filters more aggressively at higher levels and the choice is not justified experimentally.
  • pose-loss weights w_g, w_t = not reported
    Weights in Eq. (5) used to build the TSP camera trajectory for matching-rate analysis; values are not given, so the vulnerability analysis is not exactly reproducible.
axioms (7)
  • domain assumption Poison-Splat adversarial perturbations are concentrated in high-frequency wavelet subbands (LH/HL) while LL remains largely consistent.
    Sec. 3.2 and Fig. 1/Tab. 4. This is the empirical foundation for zeroing high-frequency coefficients in Eq. (8); it is inferred from matching-rate drops and is not proven for other attacks.
  • domain assumption The LL subband retains >95% of image energy and therefore sufficient scene content for 3DGS reconstruction.
    Sec. 4.2 and Fig. 1 bottom; used to argue clean-input quality loss is small. Energy ratio is dataset-dependent and not a fidelity guarantee.
  • domain assumption 3DGS naturally blurs multi-view-inconsistent low-frequency artifacts because L1/SSIM fitting averages across views.
    Sec. 3.3; this is why the residual adversarial textures in the LL band are claimed to vanish without explicit denoising.
  • domain assumption Elongated Gaussians are the main mechanism by which consistent fake textures are overfit; penalizing them preserves small spherical and large flat Gaussians.
    Sec. 3.3, Eq. (9); the paper asserts this classification of Gaussian shapes and uses it to motivate the ReLU regularization.
  • standard math DWT is invertible and zeroing high-frequency coefficient sets followed by iDWT yields a valid pixel image.
    Eq. (4) and Eq. (8); relies on standard wavelet filter banks.
  • domain assumption TSP-ordered sequential multi-view matching (SuperPoint + LightGlue) gives an unbiased consistency measure.
    Sec. 3.2; if matching rates are biased by trajectory order, the frequency-localization conclusion could be an artifact of the measurement.
  • domain assumption Poison-Splat perturbs only image content, not camera poses/intrinsics; clean COLMAP poses are available.
    Appendix A states the attack is applied only to multi-view images while COLMAP sparse reconstruction remains unchanged. If an attack also poisoned poses, DefenseSplat would not address it.

pith-pipeline@v1.3.0-alltime-deepseek · 20399 in / 12557 out tokens · 110098 ms · 2026-08-02T21:39:04.108356+00:00 · methodology

0 comments
read the original abstract

3D Gaussian Splatting (3DGS) has emerged as a powerful paradigm for real-time and high-fidelity 3D reconstruction from posed images. However, recent studies reveal its vulnerability to adversarial corruptions in input views, where imperceptible yet consistent perturbations can drastically degrade rendering quality, increase training and rendering time, and inflate memory usage, even leading to server denial-of-service. In our work, to mitigate this issue, we begin by analyzing the distinct behaviors of adversarial perturbations in the low- and high-frequency components of input images using wavelet transforms. Based on this observation, we design a simple yet effective frequency-aware defense strategy that reconstructs training views by filtering high-frequency noise while preserving low-frequency content. This approach effectively suppresses adversarial artifacts while maintaining the authenticity of the original scene. Notably, it does not significantly impair training on clean data, achieving a desirable trade-off between robustness and performance on clean inputs. Through extensive experiments under a wide range of attack intensities on multiple benchmarks, we demonstrate that our method substantially enhances the robustness of 3DGS without access to clean ground-truth supervision. By highlighting and addressing the overlooked vulnerabilities of 3D Gaussian Splatting, our work paves the way for more robust and secure 3D reconstructions.

Figures

Figures reproduced from arXiv: 2602.19323 by Jing Ma, Linlin Hou, Rui Yang, Yiran Qiao, Yiren Lu, Yunlai Zhou, Yu Yin.

Figure 1
Figure 1. Figure 1: Effects of Attacks for 3DGS. Top: Matching Rate (a signal for multi-view consistency) in low-frequency (L) and high-frequency components (H) of the clean/attacked images. Medium: Two examples showing the comparison between low￾and high-frequency components on the same image after attack. Bottom: Energy ratios of different frequency components in clean images. The left side shows results on the Mip-NeRF 360… view at source ↗
Figure 2
Figure 2. Figure 2: The overview of our proposed method. pecially in scenarios where significant performance degra￾dation are not acceptable. Our main contribution can be summarized as: • We investigate an important yet previously unexplored problem of defending 3DGS against adversarial attacks. We analyze the significance of this problem and identify the unique challenges it presents. • We introduce a novel frequency-aware d… view at source ↗
Figure 3
Figure 3. Figure 3: To accurately measure image matching, we order the [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Comparison of reconstruction quality of all methods and ground truth (GT) on Mip-NeRF 360 and Tanks-and-Temples datasets. [PITH_FULL_IMAGE:figures/full_fig_p008_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Comparison of reconstruction quality of all methods and ground truth (GT) on Mip-NeRF 360 datasets (bonsai & kitchen). [PITH_FULL_IMAGE:figures/full_fig_p019_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: Comparison of reconstruction quality of all methods and ground truth (GT) on Tanks-and-Temples datasets (Caterpillar & Train). [PITH_FULL_IMAGE:figures/full_fig_p020_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: Comparison of reconstruction quality of all methods and ground truth (GT) on LLFF datasets (fern & horns). [PITH_FULL_IMAGE:figures/full_fig_p021_7.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

50 extracted references · 6 linked inside Pith

  1. [1]

    Square attack: a query-efficient black-box adversarial attack via random search

    Maksym Andriushchenko, Francesco Croce, Nicolas Flam- marion, and Matthias Hein. Square attack: a query-efficient black-box adversarial attack via random search. InEuropean conference on computer vision, pages 484–501. Springer,

  2. [2]

    3d gaussian splatting: Survey, technologies, challenges, and opportunities.IEEE Transactions on Circuits and Systems for Video Technology,

    Yanqi Bao, Tianyu Ding, Jing Huo, Yaoli Liu, Yuxin Li, Wenbin Li, Yang Gao, and Jiebo Luo. 3d gaussian splatting: Survey, technologies, challenges, and opportunities.IEEE Transactions on Circuits and Systems for Video Technology,

  3. [3]

    Mip-nerf 360: Unbounded anti-aliased neural radiance fields

    Jonathan T Barron, Ben Mildenhall, Dor Verbin, Pratul P Srinivasan, and Peter Hedman. Mip-nerf 360: Unbounded anti-aliased neural radiance fields. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 5470–5479, 2022. 6

    2022

  4. [4]

    Structure-aware sparse-view x-ray 3d re- construction

    Yuanhao Cai, Jiahao Wang, Alan Yuille, Zongwei Zhou, and Angtian Wang. Structure-aware sparse-view x-ray 3d re- construction. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 11174– 11183, 2024. 1

    2024

  5. [5]

    Superpoint: Self-supervised interest point detection and description

    Daniel DeTone, Tomasz Malisiewicz, and Andrew Rabi- novich. Superpoint: Self-supervised interest point detection and description. InProceedings of the IEEE conference on computer vision and pattern recognition workshops, pages 224–236, 2018. 5

    2018

  6. [6]

    Pearson edu- cation india, 2009

    Rafael C Gonzalez.Digital image processing. Pearson edu- cation india, 2009. 4

    2009

  7. [7]

    Explaining and harnessing adversarial examples.arXiv preprint arXiv:1412.6572, 2014

    Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples.arXiv preprint arXiv:1412.6572, 2014. 3

    Pith/arXiv arXiv 2014

  8. [8]

    Splatad: Real-time li- dar and camera rendering with 3d gaussian splatting for au- tonomous driving

    Georg Hess, Carl Lindstr ¨om, Maryam Fatemi, Christoffer Petersson, and Lennart Svensson. Splatad: Real-time li- dar and camera rendering with 3d gaussian splatting for au- tonomous driving. InProceedings of the Computer Vision and Pattern Recognition Conference, pages 11982–11992,

  9. [9]

    Deep learning low-cost photogrammetry for 4d short-term glacier dynamics moni- toring.PFG – Journal of Photogrammetry, Remote Sensing and Geoinformation Science, 2024

    Francesco Ioli, Nicol `o Dematteis, Daniele Giordan, Francesco Nex, and Pinto Livio. Deep learning low-cost photogrammetry for 4d short-term glacier dynamics moni- toring.PFG – Journal of Photogrammetry, Remote Sensing and Geoinformation Science, 2024. 5

    2024

  10. [10]

    Waterf: Robust water- marks in radiance fields for protection of copyrights

    Youngdong Jang, Dong In Lee, MinHyuk Jang, Jong Wook Kim, Feng Yang, and Sangpil Kim. Waterf: Robust water- marks in radiance fields for protection of copyrights. InPro- ceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 12087–12097, 2024. 4

    2024

  11. [11]

    3d-gsw: 3d gaussian splatting for robust watermarking

    Youngdong Jang, Hyunje Park, Feng Yang, Heeju Ko, Euijin Choo, and Sangpil Kim. 3d-gsw: 3d gaussian splatting for robust watermarking. InProceedings of the Computer Vi- sion and Pattern Recognition Conference, pages 5938–5948,

  12. [12]

    Focal frequency loss for image reconstruction and synthesis

    Liming Jiang, Bo Dai, Wayne Wu, and Chen Change Loy. Focal frequency loss for image reconstruction and synthesis. InProceedings of the IEEE/CVF international conference on computer vision, pages 13919–13929, 2021. 4

    2021

  13. [13]

    Splatam: Splat track & map 3d gaussians for dense rgb-d slam

    Nikhil Keetha, Jay Karhade, Krishna Murthy Jatavallabhula, Gengshan Yang, Sebastian Scherer, Deva Ramanan, and Jonathon Luiten. Splatam: Splat track & map 3d gaussians for dense rgb-d slam. InProceedings of the IEEE/CVF Con- ference on Computer Vision and Pattern Recognition, pages 21357–21366, 2024. 1

    2024

  14. [14]

    3d gaussian splatting for real-time radiance field rendering.ACM Trans

    Bernhard Kerbl, Georgios Kopanas, Thomas Leimk ¨uhler, and George Drettakis. 3d gaussian splatting for real-time radiance field rendering.ACM Trans. Graph., 42(4):139–1,

  15. [15]

    Autosplat: Constrained gaussian splatting for autonomous driving scene reconstruction

    Mustafa Khan, Hamidreza Fazlali, Dhruv Sharma, Tongtong Cao, Dongfeng Bai, Yuan Ren, and Bingbing Liu. Autosplat: Constrained gaussian splatting for autonomous driving scene reconstruction. In2025 IEEE International Conference on Robotics and Automation (ICRA), pages 8315–8321. IEEE,

  16. [16]

    Tanks and temples: Benchmarking large-scale scene reconstruction.ACM Transactions on Graphics, 36(4), 2017

    Arno Knapitsch, Jaesik Park, Qian-Yi Zhou, and Vladlen Koltun. Tanks and temples: Benchmarking large-scale scene reconstruction.ACM Transactions on Graphics, 36(4), 2017. 6

    2017

  17. [17]

    Compact 3d gaussian representation for radiance field

    Joo Chan Lee, Daniel Rho, Xiangyu Sun, Jong Hwan Ko, and Eunbyung Park. Compact 3d gaussian representation for radiance field. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 21719– 21728, 2024. 7

    2024

  18. [18]

    An effective heuristic algorithm for the traveling-salesman problem.Operations research, 21(2):498–516, 1973

    Shen Lin and Brian W Kernighan. An effective heuristic algorithm for the traveling-salesman problem.Operations research, 21(2):498–516, 1973. 5

    1973

  19. [19]

    Lightglue: Local feature matching at light speed

    Philipp Lindenberger, Paul-Edouard Sarlin, and Marc Polle- feys. Lightglue: Local feature matching at light speed. In Proceedings of the IEEE/CVF international conference on computer vision, pages 17627–17638, 2023. 5

    2023

  20. [20]

    Delving into transferable adversarial examples and black- box attacks.arXiv preprint arXiv:1611.02770, 2016

    Yanpei Liu, Xinyun Chen, Chang Liu, and Dawn Song. Delving into transferable adversarial examples and black- box attacks.arXiv preprint arXiv:1611.02770, 2016. 3

    Pith/arXiv arXiv 2016

  21. [21]

    Darenerf: Direction-aware representation for dy- namic scenes

    Ange Lou, Benjamin Planche, Zhongpai Gao, Yamin Li, Tianyu Luan, Hao Ding, Terrence Chen, Jack Noble, and Ziyan Wu. Darenerf: Direction-aware representation for dy- namic scenes. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 5031– 5042, 2024. 4

    2024

  22. [22]

    Manigaussian: Dynamic gaus- sian splatting for multi-task robotic manipulation

    Guanxing Lu, Shiyi Zhang, Ziwei Wang, Changliu Liu, Ji- wen Lu, and Yansong Tang. Manigaussian: Dynamic gaus- sian splatting for multi-task robotic manipulation. InEu- ropean Conference on Computer Vision, pages 349–366. Springer, 2024. 1 9

    2024

  23. [23]

    Poison-splat: Computation cost attack on 3d gaussian splatting.arXiv preprint arXiv:2410.08190, 2024

    Jiahao Lu, Yifan Zhang, Qiuhong Shen, Xinchao Wang, and Shuicheng Yan. Poison-splat: Computation cost attack on 3d gaussian splatting.arXiv preprint arXiv:2410.08190, 2024. 2, 3, 1

    Pith/arXiv arXiv 2024

  24. [24]

    Bard-gs: Blur-aware reconstruction of dynamic scenes via gaussian splatting

    Yiren Lu, Yunlai Zhou, Disheng Liu, Tuo Liang, and Yu Yin. Bard-gs: Blur-aware reconstruction of dynamic scenes via gaussian splatting. InProceedings of the Computer Vision and Pattern Recognition Conference, pages 16532–16542,

  25. [25]

    Segment then splat: A uni- fied approach for 3d open-vocabulary segmentation based on gaussian splatting.arXiv preprint arXiv:2503.22204, 2025

    Yiren Lu, Yunlai Zhou, Yiran Qiao, Chaoda Song, Tuo Liang, Jing Ma, and Yu Yin. Segment then splat: A uni- fied approach for 3d open-vocabulary segmentation based on gaussian splatting.arXiv preprint arXiv:2503.22204, 2025. 3

    arXiv 2025

  26. [26]

    Towards deep learn- ing models resistant to adversarial attacks.arXiv preprint arXiv:1706.06083, 2017

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learn- ing models resistant to adversarial attacks.arXiv preprint arXiv:1706.06083, 2017. 2, 3

    Pith/arXiv arXiv 2017

  27. [27]

    Gaussian splatting slam

    Hidenobu Matsuki, Riku Murai, Paul HJ Kelly, and An- drew J Davison. Gaussian splatting slam. InProceedings of the IEEE/CVF Conference on Computer Vision and Pat- tern Recognition, pages 18039–18048, 2024. 1

    2024

  28. [28]

    Local light field fusion: Practical view syn- thesis with prescriptive sampling guidelines.ACM Transac- tions on Graphics (ToG), 38(4):1–14, 2019

    Ben Mildenhall, Pratul P Srinivasan, Rodrigo Ortiz-Cayon, Nima Khademi Kalantari, Ravi Ramamoorthi, Ren Ng, and Abhishek Kar. Local light field fusion: Practical view syn- thesis with prescriptive sampling guidelines.ACM Transac- tions on Graphics (ToG), 38(4):1–14, 2019. 6

    2019

  29. [29]

    Nerf: Representing scenes as neural radiance fields for view syn- thesis.Communications of the ACM, 65(1):99–106, 2021

    Ben Mildenhall, Pratul P Srinivasan, Matthew Tancik, Jonathan T Barron, Ravi Ramamoorthi, and Ren Ng. Nerf: Representing scenes as neural radiance fields for view syn- thesis.Communications of the ACM, 65(1):99–106, 2021. 1, 3

    2021

  30. [30]

    Deepfool: a simple and accurate method to fool deep neural networks

    Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, and Pascal Frossard. Deepfool: a simple and accurate method to fool deep neural networks. InProceedings of the IEEE con- ference on computer vision and pattern recognition, pages 2574–2582, 2016. 3

    2016

  31. [31]

    Luca Morelli, Fabio Bellavia, Fabio Menna, and Fabio Re- mondino. Photogrammetry now and then–from hand-crafted to deep-learning tie points–.The International Archives of the Photogrammetry, Remote Sensing and Spatial Informa- tion Sciences, 48:163–170, 2022. 5

    2022

  32. [32]

    Morelli, F

    L. Morelli, F. Ioli, F. Maiwald, G. Mazzacca, F. Menna, and F. Remondino. Deep-image-matching: A toolbox for mul- tiview image matching of complex scenarios.The Interna- tional Archives of the Photogrammetry, Remote Sensing and Spatial Information Sciences, XLVIII-2/W4-2024:309–316,

    2024

  33. [33]

    Counterfactual visual explanation via causally-guided adversarial steering.arXiv preprint arXiv:2507.09881, 2025

    Yiran Qiao, Disheng Liu, Yiren Lu, Yu Yin, Mengnan Du, and Jing Ma. Counterfactual visual explanation via causally-guided adversarial steering.arXiv preprint arXiv:2507.09881, 2025. 3

    arXiv 2025

  34. [34]

    Global filter networks for image classification

    Yongming Rao, Wenliang Zhao, Zheng Zhu, Jiwen Lu, and Jie Zhou. Global filter networks for image classification. Advances in neural information processing systems, 34:980– 993, 2021. 4

    2021

  35. [35]

    Nerf- slam: Real-time dense monocular slam with neural radiance fields

    Antoni Rosinol, John J Leonard, and Luca Carlone. Nerf- slam: Real-time dense monocular slam with neural radiance fields. In2023 IEEE/RSJ International Conference on Intel- ligent Robots and Systems (IROS), pages 3437–3444. IEEE,

  36. [36]

    Language embedded 3d gaussians for open- vocabulary scene understanding

    Jin-Chuan Shi, Miao Wang, Hao-Bin Duan, and Shao- Hua Guan. Language embedded 3d gaussians for open- vocabulary scene understanding. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 5333–5343, 2024. 3

    2024

  37. [37]

    Neurad: Neural rendering for autonomous driving

    Adam Tonderski, Carl Lindstr ¨om, Georg Hess, William Ljungbergh, Lennart Svensson, and Christoffer Petersson. Neurad: Neural rendering for autonomous driving. InPro- ceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 14895–14904, 2024. 1

    2024

  38. [38]

    Image quality assessment: from error visibility to structural similarity.IEEE transactions on image processing, 13(4):600–612, 2004

    Zhou Wang, Alan C Bovik, Hamid R Sheikh, and Eero P Si- moncelli. Image quality assessment: from error visibility to structural similarity.IEEE transactions on image processing, 13(4):600–612, 2004. 4

    2004

  39. [39]

    4d gaussian splatting for real-time dynamic scene rendering

    Guanjun Wu, Taoran Yi, Jiemin Fang, Lingxi Xie, Xiaopeng Zhang, Wei Wei, Wenyu Liu, Qi Tian, and Xinggang Wang. 4d gaussian splatting for real-time dynamic scene rendering. InProceedings of the IEEE/CVF conference on computer vi- sion and pattern recognition, pages 20310–20320, 2024. 3

    2024

  40. [40]

    Difix3d+: Improving 3d reconstruc- tions with single-step diffusion models

    Jay Zhangjie Wu, Yuxuan Zhang, Haithem Turki, Xuanchi Ren, Jun Gao, Mike Zheng Shou, Sanja Fidler, Zan Goj- cic, and Huan Ling. Difix3d+: Improving 3d reconstruc- tions with single-step diffusion models. InProceedings of the Computer Vision and Pattern Recognition Conference, pages 26024–26035, 2025. 3, 6

    2025

  41. [41]

    Discretized gaussian representation for to- mographic reconstruction

    Shaokai Wu, Yuxiang Lu, Yapan Guo, Wei Ji, Suizhi Huang, Fengyu Yang, Shalayiding Sirejiding, Qichen He, Jing Tong, Yanbiao Ji, et al. Discretized gaussian representation for to- mographic reconstruction. InProceedings of the IEEE/CVF International Conference on Computer Vision, pages 25073– 25082, 2025. 1

    2025

  42. [42]

    Opengaussian: Towards point-level 3d gaussian-based open vocabulary understanding.Advances in Neural Information Processing Systems, 37:19114–19138,

    Yanmin Wu, Jiarui Meng, Haijie Li, Chenming Wu, Yahao Shi, Xinhua Cheng, Chen Zhao, Haocheng Feng, Errui Ding, Jingdong Wang, et al. Opengaussian: Towards point-level 3d gaussian-based open vocabulary understanding.Advances in Neural Information Processing Systems, 37:19114–19138,

  43. [43]

    Wavenerf: Wavelet-based generalizable neural radiance fields

    Muyu Xu, Fangneng Zhan, Jiahui Zhang, Yingchen Yu, Xi- aoqin Zhang, Christian Theobalt, Ling Shao, and Shijian Lu. Wavenerf: Wavelet-based generalizable neural radiance fields. InProceedings of the IEEE/CVF International Con- ference on Computer Vision, pages 18195–18204, 2023. 4

    2023

  44. [44]

    Deformable 3d gaussians for high- fidelity monocular dynamic scene reconstruction

    Ziyi Yang, Xinyu Gao, Wen Zhou, Shaohui Jiao, Yuqing Zhang, and Xiaogang Jin. Deformable 3d gaussians for high- fidelity monocular dynamic scene reconstruction. InPro- ceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 20331–20341, 2024. 3

    2024

  45. [45]

    Gaussian grouping: Segment and edit anything in 3d scenes

    Mingqiao Ye, Martin Danelljan, Fisher Yu, and Lei Ke. Gaussian grouping: Segment and edit anything in 3d scenes. InEuropean conference on computer vision, pages 162–179. Springer, 2024. 3

    2024

  46. [46]

    Gaussian splatting under attack: Investigat- ing adversarial noise in 3d objects.arXiv preprint arXiv:2412.02803, 2024

    Abdurrahman Zeybey, Mehmet Ergezer, and Tommy Nguyen. Gaussian splatting under attack: Investigat- ing adversarial noise in 3d objects.arXiv preprint arXiv:2412.02803, 2024. 2 10

    Pith/arXiv arXiv 2024

  47. [47]

    Fregs: 3d gaussian splatting with progressive frequency regularization

    Jiahui Zhang, Fangneng Zhan, Muyu Xu, Shijian Lu, and Eric Xing. Fregs: 3d gaussian splatting with progressive frequency regularization. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 21424–21433, 2024. 4, 5

    2024

  48. [48]

    Causaladv: Adversarial robustness through the lens of causality.arXiv preprint arXiv:2106.06196, 2021

    Yonggang Zhang, Mingming Gong, Tongliang Liu, Gang Niu, Xinmei Tian, Bo Han, Bernhard Sch ¨olkopf, and Kun Zhang. Causaladv: Adversarial robustness through the lens of causality.arXiv preprint arXiv:2106.06196, 2021. 3

    Pith/arXiv arXiv 2021

  49. [49]

    Drivinggaussian: Composite gaussian splatting for surrounding dynamic au- tonomous driving scenes

    Xiaoyu Zhou, Zhiwei Lin, Xiaojun Shan, Yongtao Wang, Deqing Sun, and Ming-Hsuan Yang. Drivinggaussian: Composite gaussian splatting for surrounding dynamic au- tonomous driving scenes. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 21634–21643, 2024. 1

    2024

  50. [50]

    3d-spatial mul- timodal memory

    Xueyan Zou, Yuchen Song, Ri-Zhao Qiu, Xuanbin Peng, Jianglong Ye, Sifei Liu, and Xiaolong Wang. 3d-spatial mul- timodal memory. InThe Thirteenth International Conference on Learning Representations, 2025. 1 11 DefenseSplat: Enhancing the Robustness of 3D Gaussian Splatting via Frequency-Aware Filtering Supplementary Material A. Additional Implementation D...

    2025