---
title: 'AdvSplat: Robustness in Feed-Forward 3DGS'
url: https://www.emergentmind.com/topics/advsplat
type: topic
---

# AdvSplat: Robustness in Feed-Forward 3DGS

Searching arXiv for AdvSplat and closely related feed-forward 3D Gaussian Splatting robustness work.
AdvSplat is a study of adversarial robustness in feed-forward 3D Gaussian Splatting (3DGS), focusing on models that reconstruct a Gaussian scene representation from a small number of input views in a single forward pass rather than via per-scene optimization. It frames robustness not as label flipping but as degradation of novel-view synthesis and reconstruction quality, and introduces a white-box baseline together with two query-efficient black-box attacks that operate through a frequency-domain parameterization of pixel-space perturbations. The central finding is that feed-forward 3DGS models can be significantly disrupted by imperceptible perturbations to the input images, across pose-known and pose-free architectures, on both indoor and outdoor benchmarks [2603.23686].

## 1. Problem setting and conceptual scope

The paper studies feed-forward 3DGS models that map a small set of input images and camera parameters directly to Gaussian primitives. In the experiments, the setting uses **2 views** as input. The victim architectures are **DepthSplat** as a pose-known feed-forward 3DGS model, and **NoPoSplat** and **AnySplat** as pose-free feed-forward 3DGS models [2603.23686].

A feed-forward 3DGS model is written as
$$
\bm{f_{\theta}:\{(\bm{I}^i,\bm{P}^i)\}_{i=1}^{N}\mapsto \{(\bm{\mu}_j,\alpha_j,\bm{\Sigma}_j,\bm{c}_j)\}_{j=1}^{H\times W\times N},
$$
where $\bm{I}^i$ denotes an input image, $\bm{P}^i$ a camera projection matrix, $\bm{\mu}_j$ a Gaussian mean, $\alpha_j$ an opacity, $\bm{\Sigma}_j$ a covariance, and $\bm{c}_j$ spherical harmonics coefficients. This formulation makes explicit that the attack surface is an end-to-end differentiable input-to-output mapping from pixels to a structured 3D representation [2603.23686].

The vulnerability argument rests on several properties stated in the paper. First, reconstruction quality depends on learned neural features, so small pixel perturbations can alter internal representations and predicted Gaussian parameters. Second, the reconstruction objective is differentiable, enabling direct optimization of an attack loss over rendered outputs rather than over class labels. Third, the input space is high-dimensional because the attack acts on high-resolution images. Fourth, transfer attacks are reported to be weak, which makes direct query-based black-box optimization more relevant than conventional cross-model transfer. The paper also emphasizes realistic commercial or API-like deployment scenarios in which an attacker has only input-output access [2603.23686].

## 2. Threat models and attack objective

AdvSplat considers two threat models: a **white-box attack** with full access to model weights and gradients, and a **black-box attack** with access only to model inputs and outputs. The white-box setting is used primarily to reveal fundamental vulnerability, while the black-box setting is treated as the practically relevant case [2603.23686].

The attack objective is reconstruction degradation. Rather than inducing misclassification, the adversary seeks to make rendered novel views visually and quantitatively poor. The reconstruction attack uses the loss
$$
\mathcal{L}=\text{MSE}(\bm{I}_t,\bm{I}_t^r)+\lambda\text{LPIPS}(\bm{I}_t,\bm{I}_t^r),
$$
with **$\lambda=0.05$** in the reported setup. Here $\bm{I}_t$ denotes the input at step $t$, and $\bm{I}_t^r$ the rendered output at step $t$ [2603.23686].

The white-box method is implemented with **PGD** on this reconstruction loss. The black-box setting is instantiated by two algorithms. One is a **gradient-based black-box attack** using **NES-style gradient estimation**. The other is a **gradient-free black-box attack** using **CMA-ES**. Both attacks optimize perturbations in a frequency-domain parameterization rather than directly in pixel space [2603.23686].

| Attack variant | Access model | Optimization mechanism |
|---|---|---|
| White-box PGD | Full weights/gradients | PGD on reconstruction loss |
| Gradient-based black-box | Inputs and outputs only | NES-style gradient estimation |
| Gradient-free black-box | Inputs and outputs only | CMA-ES |

A common misconception is that robustness analysis for 3DGS should mirror image classification. AdvSplat instead treats the renderer and Gaussian predictor as a reconstruction system whose failure mode is geometric and photometric collapse. This matters because a perturbation can degrade Gaussian colors, opacities, and overall point-cloud structure even when the perturbed input remains nearly unchanged to human observers [2603.23686].

## 3. Frequency-domain parameterization and black-box optimization

The main algorithmic contribution is a **frequency-domain parameterization of pixel-space perturbations**. The input image is divided into blocks of size **$n=8$**, transformed with the DCT-II basis, and only the top-left low-frequency **$s\times s$** coefficients are perturbed, with **$s=3$** in the experiments. The perturbation is then mapped back to pixel space by iDCT [2603.23686].

The DCT basis is defined as
$$
\bm{C}_{k,i}=\gamma(k)\cos\!\left(\frac{\pi}{n}\left(i+\frac{1}{2}\right)k\right),
$$
with $\gamma(0)=\sqrt{\frac{1}{n}}$ and $\gamma(k)=\sqrt{\frac{2}{n}}$ for $k\ge 1$. For block $j$, the DCT coefficients are
$$
\bm{F}^j = \bm{C}^j \bm{I}_b^j \bm{C}^{j\top}.
$$
Only the low-frequency sub-block is modified:
$$
\bm{F}_{0:s-1,\,0:s-1}^j + \bm{\delta}^j.
$$
The paper’s interpretation is that keeping high frequencies fixed preserves imperceptibility while reducing optimization dimensionality and query cost [2603.23686].

The **NES-style** black-box attack estimates gradients by querying positive and negative perturbation probes in DCT space, then inserts the estimated gradient into a PGD-like update. The **CMA-ES** variant samples candidate perturbations from a Gaussian search distribution, scores them with the same reconstruction loss, ranks them, and updates the distribution from the top half of candidates. In both cases, the frequency-domain search is presented as the key factor improving query efficiency relative to naïve random search [2603.23686].

This design is notable because the perturbation is still applied in pixel space, but the search is constrained in frequency space. A plausible implication is that AdvSplat exploits the fact that low-frequency perturbations can remain visually unobtrusive while still shifting the neural features that govern Gaussian prediction. The paper states the result more directly as a dimensionality reduction and efficiency benefit, and its DCT ablation supports that interpretation [2603.23686].

## 4. Experimental protocol and quantitative findings

The experiments use the datasets **RE10K** and **DL3DV**, covering indoor and outdoor scenes. Hardware is **4 NVIDIA RTX A6000 GPUs**. The attack uses **10,000** iterations, step size **$\eta = 2/255$**, perturbation bound **$\ell_\infty = 8/255$**, **$M=40$** NES samples, and **$\mathcal{B}=40$** CMA-ES population size. Performance is evaluated on rendered images against ground truth using **PSNR** ↓, **SSIM** ↓, **LPIPS** ↑, **CLIP similarity** ↓, and **DINO similarity** ↓ [2603.23686].

On **RE10K**, black-box attacks produce large degradations. For **DepthSplat**, clean performance is **21.09 PSNR / 0.710 SSIM / 0.228 LPIPS / 0.956 CLIP / 0.930 DINO**, which drops under the gradient-based black-box attack to **7.57 / 0.289 / 0.581 / 0.740 / 0.492**, and under the gradient-free attack to **9.73 / 0.437 / 0.514 / 0.803 / 0.727**. For **NoPoSplat**, clean performance **22.50 / 0.781 / 0.165 / 0.957 / 0.938** drops to **17.64 / 0.523 / 0.417 / 0.893 / 0.816** and **14.02 / 0.397 / 0.549 / 0.856 / 0.729**. For **AnySplat**, clean performance **18.94 / 0.672 / 0.271 / 0.928 / 0.938** drops to **12.80 / 0.431 / 0.588 / 0.813 / 0.791** and **14.49 / 0.460 / 0.561 / 0.859 / 0.832** [2603.23686].

On **DL3DV**, the same pattern holds. For **DepthSplat**, clean performance **22.21 / 0.785 / 0.165 / 0.963 / 0.909** drops to **14.38 / 0.546 / 0.448 / 0.837 / 0.738** and **16.59 / 0.588 / 0.396 / 0.851 / 0.798**. For **NoPoSplat**, clean performance **21.91 / 0.745 / 0.173 / 0.960 / 0.903** drops to **19.80 / 0.582 / 0.338 / 0.886 / 0.819** and **17.17 / 0.425 / 0.439 / 0.858 / 0.722**. For **AnySplat**, clean performance **19.34 / 0.639 / 0.285 / 0.950 / 0.923** drops to **15.47 / 0.467 / 0.502 / 0.867 / 0.815** and **17.52 / 0.497 / 0.481 / 0.876 / 0.839** [2603.23686].

White-box PGD is stronger still. The appendix reports, for example, **DepthSplat on DL3DV** degrading from **22.21 PSNR / 0.785 SSIM / 0.165 LPIPS** to **6.54 / 0.202 / 0.625**, and **NoPoSplat on RE10K** degrading from **22.50 / 0.781 / 0.165** to **8.82 / 0.268 / 0.692** [2603.23686].

These results establish two distinct points. First, the models are vulnerable in principle, because full-gradient attacks are highly destructive. Second, the vulnerability persists under realistic black-box access, because query-based attacks without model internals still produce severe metric degradation [2603.23686].

## 5. Qualitative effects, ablations, and transferability

The reported qualitative outcome is that the input perturbations remain nearly unchanged to human eyes under the **$\ell_\infty = 8/255$** bound, yet the rendered novel views become **heavily distorted**, **black-artifact corrupted**, or **nearly completely collapsed**. The paper further reports that point-cloud visualizations show drastic changes in **Gaussian colors**, **opacities**, and **overall point-cloud structure**, indicating disruption of the underlying 3D representation rather than only the final image formation stage [2603.23686].

The DCT ablation compares optimization **with DCT** and **no DCT**. The reported finding is that DCT-based low-frequency parameterization reaches **higher loss with the same number of queries** for both the gradient-based and gradient-free variants. The interpretation given in the paper is efficiency through reduced effective dimensionality [2603.23686].

Sensitivity to attack strength is evaluated at **$2/255$**, **$4/255$**, **$8/255$**, and **$16/255$**. The general trend is that larger $\epsilon$ worsens reconstruction more strongly. The paper notes that at higher budgets some metrics can become anomalous because outputs may degenerate toward nearly all-white renderings, but visual quality still degrades. This is important because it separates metric behavior from perceptual collapse in extreme cases [2603.23686].

Transferability is studied in the appendix across models on **RE10K**. Transfer attacks are reported to **degrade performance**, but only **mildly**, and to be far weaker than query-based attacks. The paper therefore argues that feed-forward 3DGS models are **not easily attacked via cross-model transfer** and that direct query-based optimization is needed [2603.23686].

A common misunderstanding in adversarial ML is that weak transfer implies practical safety. AdvSplat argues the opposite for this domain: poor transferability does not confer robustness when query-efficient black-box attacks are available. That distinction is central to the paper’s deployment-oriented security framing [2603.23686].

## 6. Relation to adjacent 3DGS research

AdvSplat belongs to a different research axis from methods that improve feed-forward reconstruction quality. **AdaptSplat** studies sparse-view novel view synthesis and 3D reconstruction, arguing that a generic VFM-based pipeline can be improved by a single **Frequency-Preserving Adapter (FPA)** of about **1.5M parameters**, using **2D discrete wavelet transform (DWT)** on shallow features and dual injection into a **multi-view Transformer** and **DPT decoder**. Its stated goals are improved cross-domain generalization and sharper geometric fidelity, especially by countering high-frequency attenuation in deep features [2605.10239]. AdvSplat, by contrast, studies how imperceptible perturbations to the input can destroy feed-forward reconstruction quality [2603.23686].

The relationship to optimization-based 3DGS is also distinct. **DC4GS** addresses **adaptive density control** during training by introducing **Directional Consistency (DC)** into split decisions and split placement, with the reported effect of reducing primitive count by up to **30%** in some scenes while improving or maintaining quality. Its mechanism concerns densification in conventional 3DGS training, not adversarial manipulation of feed-forward predictors [2510.26921]. This suggests that robustness questions in feed-forward 3DGS do not reduce to the geometry-management issues studied in optimization-time splat densification.

A third nearby but orthogonal direction is interpretability. **XSPLAIN** is an **ante-hoc, prototype-based interpretability framework** for **3DGS classification**, built around a voxel-aggregated PointNet backbone and an invertible orthogonal transformation that preserves decision boundaries exactly while improving explanation quality. It addresses transparency of splat-based classifiers rather than robustness of feed-forward reconstruction models [2602.10239]. Taken together, these works indicate that feed-forward splat systems are now being evaluated not only for fidelity and efficiency, but also for security, interpretability, and deployability.

A plausible implication is that the feed-forward 3DGS literature is entering a systems phase in which architectural quality, generalization, attack surface, and explanation mechanisms are all active concerns. AdvSplat’s explicit contribution within that broader landscape is to establish adversarial robustness as an urgent open problem for feed-forward Gaussian Splatting [2603.23686].

Source: https://www.emergentmind.com/topics/advsplat