AdvSplat: Robustness in Feed-Forward 3DGS

• AdvSplat is a study of adversarial robustness in feed-forward 3D Gaussian Splatting that reveals how imperceptible perturbations dramatically degrade reconstruction quality.
• The research introduces a frequency-domain parameterization using DCT to optimize both white-box PGD and query-efficient black-box attacks.
• Experimental results on indoor and outdoor benchmarks demonstrate significant performance drops across pose-known and pose-free architectures.

Searching arXiv for AdvSplat and closely related feed-forward 3D Gaussian Splatting robustness work. AdvSplat is a study of adversarial robustness in feed-forward 3D Gaussian Splatting (3DGS), focusing on models that reconstruct a Gaussian scene representation from a small number of input views in a single forward pass rather than via per-scene optimization. It frames robustness not as label flipping but as degradation of novel-view synthesis and reconstruction quality, and introduces a white-box baseline together with two query-efficient black-box attacks that operate through a frequency-domain parameterization of pixel-space perturbations. The central finding is that feed-forward 3DGS models can be significantly disrupted by imperceptible perturbations to the input images, across pose-known and pose-free architectures, on both indoor and outdoor benchmarks (Qiao et al., 24 Mar 2026).

1. Problem setting and conceptual scope

The paper studies feed-forward 3DGS models that map a small set of input images and camera parameters directly to Gaussian primitives. In the experiments, the setting uses 2 views as input. The victim architectures are DepthSplat as a pose-known feed-forward 3DGS model, and NoPoSplat and AnySplat as pose-free feed-forward 3DGS models (Qiao et al., 24 Mar 2026).

A feed-forward 3DGS model is written as

$\bm{f_{\theta}:\{(\bm{I}^i,\bm{P}^i)\}_{i=1}^{N}\mapsto \{(\bm{\mu}_j,\alpha_j,\bm{\Sigma}_j,\bm{c}_j)\}_{j=1}^{H\times W\times N},$

where $\bm{I}^i$ denotes an input image, $\bm{P}^i$ a camera projection matrix, $\bm{\mu}_j$ a Gaussian mean, $\alpha_j$ an opacity, $\bm{\Sigma}_j$ a covariance, and $\bm{c}_j$ spherical harmonics coefficients. This formulation makes explicit that the attack surface is an end-to-end differentiable input-to-output mapping from pixels to a structured 3D representation (Qiao et al., 24 Mar 2026).

The vulnerability argument rests on several properties stated in the paper. First, reconstruction quality depends on learned neural features, so small pixel perturbations can alter internal representations and predicted Gaussian parameters. Second, the reconstruction objective is differentiable, enabling direct optimization of an attack loss over rendered outputs rather than over class labels. Third, the input space is high-dimensional because the attack acts on high-resolution images. Fourth, transfer attacks are reported to be weak, which makes direct query-based black-box optimization more relevant than conventional cross-model transfer. The paper also emphasizes realistic commercial or API-like deployment scenarios in which an attacker has only input-output access (Qiao et al., 24 Mar 2026).

2. Threat models and attack objective

AdvSplat considers two threat models: a white-box attack with full access to model weights and gradients, and a black-box attack with access only to model inputs and outputs. The white-box setting is used primarily to reveal fundamental vulnerability, while the black-box setting is treated as the practically relevant case (Qiao et al., 24 Mar 2026).

The attack objective is reconstruction degradation. Rather than inducing misclassification, the adversary seeks to make rendered novel views visually and quantitatively poor. The reconstruction attack uses the loss

$$\mathcal{L}=\text{MSE}(\bm{I}_t,\bm{I}_t^r)+\lambda\text{LPIPS}(\bm{I}_t,\bm{I}_t^r),$$

with $\lambda=0.05$ in the reported setup. Here $\bm{I}_t$ denotes the input at step $\bm{I}^i$0, and $\bm{I}^i$1 the rendered output at step $\bm{I}^i$2 (Qiao et al., 24 Mar 2026).

The white-box method is implemented with PGD on this reconstruction loss. The black-box setting is instantiated by two algorithms. One is a gradient-based black-box attack using NES-style gradient estimation. The other is a gradient-free black-box attack using CMA-ES. Both attacks optimize perturbations in a frequency-domain parameterization rather than directly in pixel space (Qiao et al., 24 Mar 2026).

Attack variant	Access model	Optimization mechanism
White-box PGD	Full weights/gradients	PGD on reconstruction loss
Gradient-based black-box	Inputs and outputs only	NES-style gradient estimation
Gradient-free black-box	Inputs and outputs only	CMA-ES

A common misconception is that robustness analysis for 3DGS should mirror image classification. AdvSplat instead treats the renderer and Gaussian predictor as a reconstruction system whose failure mode is geometric and photometric collapse. This matters because a perturbation can degrade Gaussian colors, opacities, and overall point-cloud structure even when the perturbed input remains nearly unchanged to human observers (Qiao et al., 24 Mar 2026).

3. Frequency-domain parameterization and black-box optimization

The main algorithmic contribution is a frequency-domain parameterization of pixel-space perturbations. The input image is divided into blocks of size $\bm{I}^i$3, transformed with the DCT-II basis, and only the top-left low-frequency $\bm{I}^i$4 coefficients are perturbed, with $\bm{I}^i$5 in the experiments. The perturbation is then mapped back to pixel space by iDCT (Qiao et al., 24 Mar 2026).

The DCT basis is defined as

$\bm{I}^i$6

with $\bm{I}^i$7 and $\bm{I}^i$8 for $\bm{I}^i$9. For block $\bm{P}^i$0, the DCT coefficients are

$\bm{P}^i$1

Only the low-frequency sub-block is modified:

$\bm{P}^i$2

The paper’s interpretation is that keeping high frequencies fixed preserves imperceptibility while reducing optimization dimensionality and query cost (Qiao et al., 24 Mar 2026).

The NES-style black-box attack estimates gradients by querying positive and negative perturbation probes in DCT space, then inserts the estimated gradient into a PGD-like update. The CMA-ES variant samples candidate perturbations from a Gaussian search distribution, scores them with the same reconstruction loss, ranks them, and updates the distribution from the top half of candidates. In both cases, the frequency-domain search is presented as the key factor improving query efficiency relative to naïve random search (Qiao et al., 24 Mar 2026).

This design is notable because the perturbation is still applied in pixel space, but the search is constrained in frequency space. A plausible implication is that AdvSplat exploits the fact that low-frequency perturbations can remain visually unobtrusive while still shifting the neural features that govern Gaussian prediction. The paper states the result more directly as a dimensionality reduction and efficiency benefit, and its DCT ablation supports that interpretation (Qiao et al., 24 Mar 2026).

4. Experimental protocol and quantitative findings

The experiments use the datasets RE10K and DL3DV, covering indoor and outdoor scenes. Hardware is 4 NVIDIA RTX A6000 GPUs. The attack uses 10,000 iterations, step size $\bm{P}^i$3, perturbation bound $\bm{P}^i$4, $\bm{P}^i$5 NES samples, and $\bm{P}^i$6 CMA-ES population size. Performance is evaluated on rendered images against ground truth using PSNR ↓, SSIM ↓, LPIPS ↑, CLIP similarity ↓, and DINO similarity ↓ (Qiao et al., 24 Mar 2026).

On RE10K, black-box attacks produce large degradations. For DepthSplat, clean performance is 21.09 PSNR / 0.710 SSIM / 0.228 LPIPS / 0.956 CLIP / 0.930 DINO, which drops under the gradient-based black-box attack to 7.57 / 0.289 / 0.581 / 0.740 / 0.492, and under the gradient-free attack to 9.73 / 0.437 / 0.514 / 0.803 / 0.727. For NoPoSplat, clean performance 22.50 / 0.781 / 0.165 / 0.957 / 0.938 drops to 17.64 / 0.523 / 0.417 / 0.893 / 0.816 and 14.02 / 0.397 / 0.549 / 0.856 / 0.729. For AnySplat, clean performance 18.94 / 0.672 / 0.271 / 0.928 / 0.938 drops to 12.80 / 0.431 / 0.588 / 0.813 / 0.791 and 14.49 / 0.460 / 0.561 / 0.859 / 0.832 (Qiao et al., 24 Mar 2026).

On DL3DV, the same pattern holds. For DepthSplat, clean performance 22.21 / 0.785 / 0.165 / 0.963 / 0.909 drops to 14.38 / 0.546 / 0.448 / 0.837 / 0.738 and 16.59 / 0.588 / 0.396 / 0.851 / 0.798. For NoPoSplat, clean performance 21.91 / 0.745 / 0.173 / 0.960 / 0.903 drops to 19.80 / 0.582 / 0.338 / 0.886 / 0.819 and 17.17 / 0.425 / 0.439 / 0.858 / 0.722. For AnySplat, clean performance 19.34 / 0.639 / 0.285 / 0.950 / 0.923 drops to 15.47 / 0.467 / 0.502 / 0.867 / 0.815 and 17.52 / 0.497 / 0.481 / 0.876 / 0.839 (Qiao et al., 24 Mar 2026).

White-box PGD is stronger still. The appendix reports, for example, DepthSplat on DL3DV degrading from 22.21 PSNR / 0.785 SSIM / 0.165 LPIPS to 6.54 / 0.202 / 0.625, and NoPoSplat on RE10K degrading from 22.50 / 0.781 / 0.165 to 8.82 / 0.268 / 0.692 (Qiao et al., 24 Mar 2026).

These results establish two distinct points. First, the models are vulnerable in principle, because full-gradient attacks are highly destructive. Second, the vulnerability persists under realistic black-box access, because query-based attacks without model internals still produce severe metric degradation (Qiao et al., 24 Mar 2026).

5. Qualitative effects, ablations, and transferability

The reported qualitative outcome is that the input perturbations remain nearly unchanged to human eyes under the $\bm{P}^i$7 bound, yet the rendered novel views become heavily distorted, black-artifact corrupted, or nearly completely collapsed. The paper further reports that point-cloud visualizations show drastic changes in Gaussian colors, opacities, and overall point-cloud structure, indicating disruption of the underlying 3D representation rather than only the final image formation stage (Qiao et al., 24 Mar 2026).

The DCT ablation compares optimization with DCT and no DCT. The reported finding is that DCT-based low-frequency parameterization reaches higher loss with the same number of queries for both the gradient-based and gradient-free variants. The interpretation given in the paper is efficiency through reduced effective dimensionality (Qiao et al., 24 Mar 2026).

Sensitivity to attack strength is evaluated at $\bm{P}^i$8, $\bm{P}^i$9, $\bm{\mu}_j$0, and $\bm{\mu}_j$1. The general trend is that larger $\bm{\mu}_j$2 worsens reconstruction more strongly. The paper notes that at higher budgets some metrics can become anomalous because outputs may degenerate toward nearly all-white renderings, but visual quality still degrades. This is important because it separates metric behavior from perceptual collapse in extreme cases (Qiao et al., 24 Mar 2026).

Transferability is studied in the appendix across models on RE10K. Transfer attacks are reported to degrade performance, but only mildly, and to be far weaker than query-based attacks. The paper therefore argues that feed-forward 3DGS models are not easily attacked via cross-model transfer and that direct query-based optimization is needed (Qiao et al., 24 Mar 2026).

A common misunderstanding in adversarial ML is that weak transfer implies practical safety. AdvSplat argues the opposite for this domain: poor transferability does not confer robustness when query-efficient black-box attacks are available. That distinction is central to the paper’s deployment-oriented security framing (Qiao et al., 24 Mar 2026).

6. Relation to adjacent 3DGS research

AdvSplat belongs to a different research axis from methods that improve feed-forward reconstruction quality. AdaptSplat studies sparse-view novel view synthesis and 3D reconstruction, arguing that a generic VFM-based pipeline can be improved by a single Frequency-Preserving Adapter (FPA) of about 1.5M parameters, using 2D discrete wavelet transform (DWT) on shallow features and dual injection into a multi-view Transformer and DPT decoder. Its stated goals are improved cross-domain generalization and sharper geometric fidelity, especially by countering high-frequency attenuation in deep features (Xing et al., 11 May 2026). AdvSplat, by contrast, studies how imperceptible perturbations to the input can destroy feed-forward reconstruction quality (Qiao et al., 24 Mar 2026).

The relationship to optimization-based 3DGS is also distinct. DC4GS addresses adaptive density control during training by introducing Directional Consistency (DC) into split decisions and split placement, with the reported effect of reducing primitive count by up to 30% in some scenes while improving or maintaining quality. Its mechanism concerns densification in conventional 3DGS training, not adversarial manipulation of feed-forward predictors (Jeong et al., 30 Oct 2025). This suggests that robustness questions in feed-forward 3DGS do not reduce to the geometry-management issues studied in optimization-time splat densification.

A third nearby but orthogonal direction is interpretability. XSPLAIN is an ante-hoc, prototype-based interpretability framework for 3DGS classification, built around a voxel-aggregated PointNet backbone and an invertible orthogonal transformation that preserves decision boundaries exactly while improving explanation quality. It addresses transparency of splat-based classifiers rather than robustness of feed-forward reconstruction models (Galus et al., 10 Feb 2026). Taken together, these works indicate that feed-forward splat systems are now being evaluated not only for fidelity and efficiency, but also for security, interpretability, and deployability.

A plausible implication is that the feed-forward 3DGS literature is entering a systems phase in which architectural quality, generalization, attack surface, and explanation mechanisms are all active concerns. AdvSplat’s explicit contribution within that broader landscape is to establish adversarial robustness as an urgent open problem for feed-forward Gaussian Splatting (Qiao et al., 24 Mar 2026).