3DGAA: 3D Gaussian Adversarial Attack Framework

• 3DGAA is a family of adversarial methods using 3D Gaussian Splatting to manipulate scene representations for fooling detection systems.
• The framework exploits full 14-dimensional Gaussian parameter optimization via differentiable rendering to combine geometry- and appearance-based attacks.
• Attack strategies range from poisoning training views and inducing resource overload to direct Gaussian perturbations for physical camouflage.

Searching arXiv for papers on 3D Gaussian-based adversarial attacks and closely related 3DGS attack/defense work. 3D Gaussian-based Adversarial Attack (3DGAA) denotes a family of adversarial methods built around 3D Gaussian Splatting (3DGS) as the attacked representation, the optimization substrate, or both. In the narrow sense, the term names the framework introduced in "3DGAA: Realistic and Robust 3D Gaussian-based Adversarial Attack for Autonomous Driving" (Zhang et al., 14 Jul 2025). In the broader research sense, it covers several related attack patterns: poisoning multi-view training images so that adversarial properties are absorbed into a learned Gaussian scene, directly perturbing Gaussian attributes through differentiable rendering, embedding viewpoint-specific malicious appearances or backdoors, and optimizing physically realizable camouflage over 3DGS objects and scenes (Zhang et al., 14 Jul 2025). The literature does not use the term uniformly, but the papers collectively establish 3DGS as a security-critical intermediate representation rather than only a rendering primitive (Hull et al., 30 May 2025).

1. Scope and taxonomy

Recent work shows that “3DGAA” is not a single attack recipe but a class of attack formulations tied to how 3DGS scenes are constructed and used. Some methods attack training views and let the 3DGS optimization absorb the perturbation into the learned representation; some attack Gaussian parameters directly; some implant viewpoint-triggered malicious behavior; and some optimize physical camouflage for downstream detectors in autonomous-driving settings (Zeybey et al., 2024).

A useful organizing distinction is whether the adversary acts indirectly through image evidence or directly on the Gaussian scene. "Gaussian Splatting Under Attack: Investigating Adversarial Noise in 3D Objects" attacks 2D RGB training images with masked iterative perturbations and then reconstructs a poisoned 3DGS object from those views, so the final artifact is an adversarial 3DGS model but the optimization is not over Gaussian primitives themselves (Zeybey et al., 2024). By contrast, DAGGER in "3D Gaussian Splat Vulnerabilities" and the framework named 3DGAA optimize Gaussian attributes through the differentiable renderer against downstream perception models (Hull et al., 30 May 2025). A third line of work uses poisoning to produce persistent, conditional malicious behavior inside the scene representation, as in viewpoint-specific backdoors and illusory objects (Hong et al., 29 Apr 2025).

Representative paper	Attack locus	Primary goal
"Gaussian Splatting Under Attack" (Zeybey et al., 2024)	Masked 2D training-view perturbation	Transfer adversarial behavior into reconstructed 3DGS
"Poison-splat" (Lu et al., 2024)	Poisoned training images	Inflate Gaussian count, memory, and time
"3D Gaussian Splat Vulnerabilities" (Hull et al., 30 May 2025)	Training-time poisoning and direct Gaussian PGD	Hide viewpoint-specific content or fool detectors
"3DGAA" (Zhang et al., 14 Jul 2025)	Full 14D Gaussian optimization	Physically realistic detector evasion
"GaussTrap" (Hong et al., 29 Apr 2025)	Backdoor views during 3DGS optimization	Trigger malicious renderings at selected viewpoints

This taxonomy suggests that 3DGAA research is best understood as spanning integrity attacks, availability/resource attacks, backdoor attacks, and physical attacks, all centered on the same 3D Gaussian representation.

2. Representation and optimization domain

The technical core of 3DGAA is the 3DGS scene itself. A common formalization writes the scene as

$$\mathcal{G} = \{g_1,\ldots,g_n\}, \qquad g_i = (\mathbf{p}_i,\mathbf{c}_i,s_i,r_i,\alpha_i),$$

with Gaussian attributes including position, color or spherical-harmonic coefficients, scale, rotation, and opacity (Hull et al., 30 May 2025). This matters because differentiable rendering makes the full pipeline

$$\mathcal{G}\xrightarrow{R}\text{rendered image}\xrightarrow{M}\text{task output}$$

amenable to gradient-based optimization on the scene parameters themselves (Hull et al., 30 May 2025).

The specific framework named 3DGAA makes this explicit by using the full 14-dimensional parameterization of each Gaussian primitive,

$\mathbf{g}_j \in \mathbb{R}^{14},$

with position $\mathbf{x}\in\mathbb{R}^3$, rotation $\mathbf{q}\in\mathbb{R}^4$, scale $\mathbf{s}\in\mathbb{R}^3$, color $\mathbf{c}\in\mathbb{R}^3$, and opacity $\alpha\in\mathbb{R}$ (Zhang et al., 14 Jul 2025). The paper further partitions these into geometry-related dimensions

$$\mathcal{K}_g = \{x, y, z, s_x, s_y, s_z, q_w, q_x, q_y, q_z\}$$

and appearance-related dimensions

$\mathcal{K}_a = \{c_r, c_g, c_b, \alpha\},$

which provides a direct vocabulary for discussing geometry-only, appearance-only, or joint attacks (Zhang et al., 14 Jul 2025).

Direct Gaussian attacks are typically formulated as constrained optimization through the renderer. DAGGER uses

$$\mathcal{G}\xrightarrow{R}\text{rendered image}\xrightarrow{M}\text{task output}$$0

with a PGD-style update on selected Gaussian parameters $$\mathcal{G}\xrightarrow{R}\text{rendered image}\xrightarrow{M}\text{task output}$$1 (Hull et al., 30 May 2025). BiTAA extends this pattern to a dual-task setting by learning $$\mathcal{G}\xrightarrow{R}\text{rendered image}\xrightarrow{M}\text{task output}$$2 and rendering multi-view images $$\mathcal{G}\xrightarrow{R}\text{rendered image}\xrightarrow{M}\text{task output}$$3 that jointly suppress detection and bias monocular depth (Zhang et al., 24 Sep 2025). AdLift, although defensive in purpose, is also important conceptually because it optimizes a protected 3DGS scene under hard image-space constraints on rendered views rather than hand-designed budgets on heterogeneous Gaussian attributes: $$\mathcal{G}\xrightarrow{R}\text{rendered image}\xrightarrow{M}\text{task output}$$4 This suggests that view-space constraints are a natural way to control invisibility in 3DGS-native optimization (Hong et al., 8 Dec 2025).

3. Indirect, poisoning-based, and backdoor attacks

A substantial part of the 3DGAA literature attacks 3DGS indirectly by poisoning the image evidence used to build the Gaussian scene. In "Gaussian Splatting Under Attack," the central method is Masked Iterative Fast Gradient Sign Method (M-IFGSM), which perturbs only the segmented object region in 2D training images and then reconstructs clean and adversarial 3DGS models from the two image sets (Zeybey et al., 2024). The attack is white-box against CLIP ViT-B/16, uses SAM masks, and evaluates whether adversarial behavior survives from train views into novel rendered views after 3D reconstruction. The key distinction is explicit: gradients flow from CLIP to image pixels, not through the 3DGS renderer into Gaussian parameters (Zeybey et al., 2024).

Resource-targeting poisoning takes the same indirect route but changes the objective. "Poison-splat: Computation Cost Attack on 3D Gaussian Splatting" formulates a bilevel optimization in which the attacker poisons training images to maximize a computation-cost metric of the trained 3DGS model,

$$\mathcal{G}\xrightarrow{R}\text{rendered image}\xrightarrow{M}\text{task output}$$5

and approximates the outer objective through image total variation to induce over-densification, memory blow-up, slower rendering, and in extreme cases denial-of-service (Lu et al., 2024). This established that 3DGAA need not target semantic misclassification; it can target adaptive computational structure.

Backdoor-style poisoning attacks make the malicious behavior conditional on viewpoint. "GaussTrap: Stealthy Poisoning Attacks on 3D Gaussian Splatting for Targeted Scene Confusion" implants attack views, stabilization views, and ordinary training views in a three-stage schedule so that the resulting 3DGS renders attacker-chosen content at designated trigger viewpoints while preserving high-quality rendering elsewhere (Hong et al., 29 Apr 2025). The trigger is camera pose rather than a pixel pattern, and viewpoint ensemble stabilization uses neighboring camera rotations to suppress artifacts near the trigger viewpoint (Hong et al., 29 Apr 2025).

"StealthAttack: Robust 3D Gaussian Splatting Poisoning via Density-Guided Illusions" goes further by injecting malicious Gaussian points into low-density regions identified by kernel density estimation, while also adding adaptive Gaussian noise to innocent views to weaken multi-view consistency during training (Ke et al., 2 Oct 2025). Its objective explicitly balances target-view illusion fidelity against preservation of non-target views: $$\mathcal{G}\xrightarrow{R}\text{rendered image}\xrightarrow{M}\text{task output}$$6 This suggests a poisoning-based 3DGAA can combine primitive injection with training-view manipulation rather than choosing only one.

4. Direct Gaussian optimization and physical-world attacks

Direct attacks on Gaussian parameters are the most literal instantiation of 3DGAA. DAGGER in "3D Gaussian Splat Vulnerabilities" attacks a trained 3DGS scene without access to the original training images by directly updating Gaussian parameters under a norm-bounded PGD objective, and the reported experiments specifically perturb SH/color attributes to fool Faster R-CNN (Hull et al., 30 May 2025). The same paper also introduces CLOAK, a training-data manipulation attack that exploits view-dependent spherical-harmonic appearance to hide adversarial content visible only from attacker-chosen viewpoints (Hull et al., 30 May 2025). Taken together, CLOAK and DAGGER separate training-time appearance poisoning from post-training white-box Gaussian optimization.

Physical camouflage work makes 3DGAA a deployable object-generation framework rather than only a digital renderer attack. PGA reconstructs a real object or scene with 3DGS, renders from many views, restricts perturbations with SAM masks, and optimizes the Gaussian appearance parameters—ultimately only the zero-order SH term—against Faster R-CNN under a min-max background-adjustment objective and additional constraints such as NPS and primary-color regularization (Lou et al., 2 Jul 2025). The method is explicitly framed as a physical attack on vehicle detection and uses few-shot 3DGS reconstruction instead of manual meshes (Lou et al., 2 Jul 2025).

The framework named 3DGAA generalizes this idea by optimizing the full 14-dimensional Gaussian parameterization of a 3DGS object against detector confidence while regularizing geometric drift with

$$\mathcal{G}\xrightarrow{R}\text{rendered image}\xrightarrow{M}\text{task output}$$7

and combining this with a detector-confidence objective over viewpoints (Zhang et al., 14 Jul 2025). It also introduces a physical filtering module—topological pruning plus structural denoising—and a physical augmentation module composed of imaging degradation, photometric variation, shadow projection, and adaptive occlusion (Zhang et al., 14 Jul 2025). Within the supplied corpus, this paper is the clearest example of a joint geometry-and-appearance 3DGAA for autonomous driving.

R-PGA narrows the optimization variable to intrinsic Gaussian albedo but strengthens the physical model. It replaces view-dependent SH appearance with a relightable 3DGS representation carrying physically disentangled attributes and optimizes

$$\mathcal{G}\xrightarrow{R}\text{rendered image}\xrightarrow{M}\text{task output}$$8

under Hard Physical Configuration Mining, which samples persistent worst-case configurations according to difficulty scores and approximates a Log-Sum-Exp robust objective (Lou et al., 27 Mar 2026). A plausible implication is that 3DGAA is evolving from generic differentiable rendering attacks toward physically disentangled, worst-case-robust optimization.

BiTAA shows that the same Gaussian perturbation can couple tasks. It optimizes $$\mathcal{G}\xrightarrow{R}\text{rendered image}\xrightarrow{M}\text{task output}$$9 so that rendered views simultaneously minimize a detector-confidence loss and enforce a signed log-depth shift inside detector-derived ROIs,

$\mathbf{g}_j \in \mathbb{R}^{14},$0

with $\mathbf{g}_j \in \mathbb{R}^{14},$1 controlling near/far bias (Zhang et al., 24 Sep 2025). This is significant because it moves 3DGAA from single-task detector evasion to cross-task camera-perception manipulation.

5. Extensions beyond classical scene optimization

The attack surface of 3DGAA is no longer limited to classical per-scene 3DGS optimization. AdvSplat targets feed-forward 3DGS models that map a few input images directly to Gaussian parameters in one forward pass. It perturbs the input reference images, not the stored Gaussian scene, but the adversarial effect propagates through Gaussian prediction and rendering, degrading reconstruction quality in white-box and query-efficient black-box settings (Qiao et al., 24 Mar 2026). Its main black-box contribution is low-frequency DCT parameterization for NES and CMA-ES queries, which suggests that input-side 3DGAA on feed-forward models requires a different efficiency strategy than scene-parameter PGD (Qiao et al., 24 Mar 2026).

AdLift extends the same logic to instruction-driven editing of 3DGS assets. It alternates projected image-space updates on rendered views,

$\mathbf{g}_j \in \mathbb{R}^{14},$2

with image-to-Gaussian fitting updates on a trainable safeguard Gaussian set, yielding what the paper calls Lifted PGD (Hong et al., 8 Dec 2025). Although framed as protection, the mechanism is directly relevant to 3DGAA because it provides a recipe for embedding strictly bounded, view-consistent perturbations into a 3DGS representation.

Related 3D adversarial work outside 3DGS also supplies design patterns. "Hide in Thicket" uses Gaussian kernels over point-cloud anchor regions to construct smooth deformation fields in complex, curvature-varying surface regions, and explicitly argues for hiding perturbations where human observers are less sensitive (Lou et al., 2024). "Geometry-Aware Generation of Adversarial Point Clouds" emphasizes surface smoothness, fairness, and outlier suppression through geometric regularization rather than only small pointwise norms (Wen et al., 2019). These works do not attack 3DGS primitives, but they support a recurring theme: physically plausible 3D adversarial optimization benefits from structured deformation fields and geometry-aware regularization rather than unconstrained per-element perturbations.

6. Evaluation patterns, limitations, and defenses

Across the literature, evaluation falls into a few recurring categories: rendered-view task degradation, novel-view transfer, physical robustness, and system-level resource impact. Task metrics include top-1 and top-5 accuracy and confidence for CLIP-based zero-shot recognition in indirect attacks (Zeybey et al., 2024), [email protected] and mAP for object detection in physical camouflage work (Lou et al., 2 Jul 2025, Zhang et al., 14 Jul 2025, Lou et al., 27 Mar 2026), and AbsRel or signed log-depth displacement for depth estimation in BiTAA (Zhang et al., 24 Sep 2025). Resource attacks additionally report number of Gaussians, peak GPU memory, training time, and FPS (Lu et al., 2024). This suggests that there is still no single standardized benchmark for “3DGAA,” only partially overlapping protocols.

Several limitations recur. Indirect image-space attacks transfer imperfectly to unseen views because they do not directly optimize Gaussian parameters across camera poses (Zeybey et al., 2024). Direct physical attacks often depend on reconstruction quality, segmentation quality, and white-box access to at least one victim model (Lou et al., 2 Jul 2025, Zhang et al., 14 Jul 2025). Some methods optimize only appearance-related parameters, which improves physical realizability but reduces expressiveness relative to full-parameter attacks (Lou et al., 2 Jul 2025, Lou et al., 27 Mar 2026). Others expose incomplete mathematical specificity, such as generic detector losses or missing optimizer details (Hull et al., 30 May 2025, Zhang et al., 24 Sep 2025). A plausible implication is that the field is still converging on robust, comparable formulations rather than settled attack standards.

Defense work has begun to identify common signatures of poisoning-style 3DGAA. DefenseSplat studies poisoned 3DGS training views through a wavelet analysis and argues that attack-induced inconsistency is concentrated much more strongly in high-frequency bands than in low-frequency bands. Its defense keeps only the $\mathbf{g}_j \in \mathbb{R}^{14},$3 wavelet subband,

$\mathbf{g}_j \in \mathbb{R}^{14},$4

and optionally adds a scale regularizer to suppress elongated Gaussians, improving both reconstruction quality and resource usage under Poison-Splat-style attacks without needing clean targets (Qiao et al., 22 Feb 2026). Spectral Defense Against Resource-Targeting Attack in 3D Gaussian Splatting pushes this further by combining a 3D Gaussian-field frequency filter with a 2D anisotropy-based spectral regularizer on rendered images, explicitly targeting abnormal high-frequency Gaussian growth and angularly concentrated spectral energy (Chen et al., 13 Mar 2026). Both defenses are tailored to poisoning/resource attacks rather than direct detector-evasion attacks, so their generality to full-parameter physical 3DGAA remains an open question.

Overall, the current literature supports a precise but broad definition: 3DGAA is the study of adversarial manipulation in which 3D Gaussian Splatting is itself the critical attack medium—whether through poisoned supervision that corrupts learned Gaussians, direct white-box perturbation of Gaussian parameters, relightable and physically deployable camouflage optimization, or lifted perturbations embedded into Gaussian assets. The central research trend is from image-space transfer into 3DGS toward representation-level, multi-view, physically grounded optimization (Hull et al., 30 May 2025, Zhang et al., 14 Jul 2025, Lou et al., 27 Mar 2026).