ComplicitSplat: Black-box 3DGS Attack

• ComplicitSplat is a black-box attack on 3D Gaussian Splatting that uses standard spherical harmonics shading to create camouflage visible only from targeted viewpoints.
• By manipulating training images without accessing downstream detector details, the attack induces severe detection accuracy drops and high success rates across various architectures.
• The attack operates in both synthetic and physical domains, revealing critical vulnerabilities in 3D scene reconstruction pipelines used in autonomous and surveillance systems.

Searching arXiv for the cited papers to ground the article with current metadata and related context. ComplicitSplat is a black-box attack on 3D Gaussian Splatting (3DGS) that exploits standard spherical harmonics (SH) shading to induce viewpoint-specific camouflage in reconstructed scenes. By manipulating only the training images used to build a 3DGS scene, the attack causes scene objects to present benign appearances from untargeted views and adversarial appearances from attacker-chosen directions, thereby inducing misdetections or misclassifications in downstream object detectors without requiring access to detector architecture, weights, outputs, or source code (Hull et al., 16 Aug 2025). Within the emerging security literature on 3DGS, ComplicitSplat extends the attack surface identified by prior work on view-dependent adversarial textures and direct Gaussian perturbation, but does so under a stricter black-box threat model (Hull et al., 30 May 2025).

1. Conceptual basis and threat model

ComplicitSplat is defined as the first demonstrated black-box attack that targets the 3DGS representation of scenes by exploiting standard SH shading to create viewpoint-specific camouflages (Hull et al., 16 Aug 2025). The core premise is that 3DGS stores color not as a fixed RGB value per primitive, but as SH coefficients that permit view-dependent appearance. Under normal training, these coefficients are fit so that rendered appearance matches captured images across viewpoints. ComplicitSplat uses the same mechanism adversarially: carefully crafted images are inserted into the training set for selected camera angles, causing the learned SH representation to encode distinct appearances for different directions.

The attack assumes knowledge of the process of constructing a 3DGS model from images, but not of the downstream detector. The attacker does not need access to the downstream object detector’s model architecture, weights, or outputs, and no modification or knowledge of 3DGS optimization internals or downstream tasks is required (Hull et al., 16 Aug 2025). This places ComplicitSplat in a broader threat class than white-box downstream attacks, because the induced 3D scene can affect any later consumer of the representation, including object detection and navigation systems.

A central feature is viewpoint specificity. The attack defines targeted viewpoint regions by a central direction and an angular threshold. Within those regions, adversarially textured images replace benign ones during training; outside them, training images remain unchanged. This yields a scene whose rendered output varies continuously with angle, revealing camouflage only from attacker-specified directions. The paper describes this camouflage as smooth and continuous across angles and achievable without visible artifacts from untargeted views (Hull et al., 16 Aug 2025).

2. Mechanism in 3D Gaussian Splatting

3DGS represents a scene as a collection of 3D Gaussian splats, each parameterized in part by SH coefficients that determine view-dependent color. ComplicitSplat leverages this representational flexibility rather than perturbing a trained model directly. The attacker starts from a dataset

$\mathcal{D} = \{(x_i, c_i)\}_{i=1}^N,$

where $x_i$ is an image and $c_i$ is the camera pose. The attacker then defines targeted viewpoint regions $R_1^*, \ldots, R_n^*$, each centered on a reference camera direction with an angular threshold (Hull et al., 16 Aug 2025).

For each training sample, the image is conditionally replaced if its pose falls within a targeted region. The modified dataset is

$\mathcal{D}' = \{(A(x_i,c_i), c_i)\}_{i=1}^N,$

with

$$A(x,c) = \begin{cases} \tilde{x}^{(j)} & \text{if } c \in R_j^* \ x & \text{otherwise.} \end{cases}$$

Training 3DGS on $\mathcal{D}'$ causes the resulting scene to display the adversarial camouflage only from the specified viewpoints (Hull et al., 16 Aug 2025).

The paper characterizes the procedure as linear in dataset size and requiring no additional gradient optimization. This distinguishes ComplicitSplat from direct latent-space or parameter-space adversarial attacks, since the manipulation occurs at the image level prior to scene optimization. A plausible implication is that the attack is operationally compatible with standard 3DGS training pipelines wherever image collection or preprocessing can be influenced.

Illustrative examples in the reported summary include turning the roof of a car into a texture resembling asphalt when viewed from above, or making a stop sign appear as a clock when seen straight-on (Hull et al., 16 Aug 2025). These examples are consistent with the general attack principle: the object identity inferred by a downstream detector is destabilized by angularly localized appearance changes encoded into SH.

3. Empirical performance across detector families

ComplicitSplat was evaluated against three major detector families: single-stage detectors, multi-stage detectors, and transformer-based detectors. Specifically, the reported models are YOLOv3, YOLOv5, YOLOv8, YOLOv11, Faster R-CNN (FRCNN), and DETR (Hull et al., 16 Aug 2025). The paper reports that the attack consistently caused severe drops in detection accuracy measured by [email protected] and achieved high Attack Success Rates (ASR) across all tested detectors.

For cars camouflaged as “grass” or “road,” the reported ASR values reach up to 100% for YOLOv8, 89% for FRCNN, and 75% for DETR, while YOLOv3 and YOLOv5 also exhibit substantial ASR in the 20–60% range (Hull et al., 16 Aug 2025). For stop signs camouflaged as “clock” faces or “soccer balls,” the reported maxima are 84% for FRCNN, 63% for YOLOv11, and 54% for DETR. The paper also reports substantial AP degradation, with drops as much as $-0.5$ to $-0.6$ AP in challenging settings.

Detector category	Models reported	Reported outcomes
Single-stage	YOLOv3, YOLOv5, YOLOv8, YOLOv11	High ASR; YOLOv8 up to 100% on cars
Multi-stage	Faster R-CNN	Up to 89% ASR on cars; up to 84% on stop signs
Transformer-based	DETR	Up to 75% ASR on cars; up to 54% on stop signs

These results are significant because the attack is detector-agnostic at execution time. The manipulated 3DGS scene is produced before downstream inference, and the attack therefore transfers across heterogeneous architectures. This suggests that the vulnerability is rooted less in any single detector design than in the representational degrees of freedom afforded by 3DGS SH shading.

4. Synthetic and physical instantiations

The reported experiments span both synthetic and real-world settings (Hull et al., 16 Aug 2025). In synthetic scenarios, Blender was used to generate rendered scenes containing adversarial camouflages, including overhead vehicle views and head-on stop-sign views. These controlled settings establish that the attack works in fully digital pipelines and can be studied under precisely specified view geometries.

The physical-domain study is more operationally consequential. Physical toy cars were painted with camouflage and scanned via photogrammetry using PolyCam; images from these scans were then merged with benign views to train 3DGS scenes. The resulting attack successfully transferred to downstream detectors in the physical domain, with reported ASR values of 59%–99% across detectors, and with Faster R-CNN, YOLOv8, and DETR described as most vulnerable (Hull et al., 16 Aug 2025).

This physical transfer result indicates that the attack is not restricted to synthetic render-space artifacts. Instead, it can survive practical image acquisition and reconstruction workflows. A plausible implication is that data provenance and capture integrity become security-critical components of 3DGS-based perception stacks, particularly when reconstruction pipelines incorporate heterogeneous image sources.

5. Relation to prior 3DGS attack literature

ComplicitSplat belongs to a short but technically distinct line of work on adversarial vulnerabilities in 3DGS. The most closely related prior paper introduces CLOAK and DAGGER as two separate attack mechanisms on 3DGS scenes (Hull et al., 30 May 2025).

CLOAK is described as the first attack designed to conceal multiple adversarial cloaked textures in 3DGS scenes by exploiting view-dependent Gaussian appearances and SH. Its mechanism is also data-level: for targeted poses $c \in C^*$, benign images are replaced with adversarial images, yielding a modified training set

$x_i$0

with

$x_i$1

In experiments with YOLOv8, a car rendered from 80 benign viewpoints was consistently detected, but evaded detection in 78/80 adversarial overhead views (Hull et al., 30 May 2025).

DAGGER differs more sharply from ComplicitSplat. It assumes white-box access to both the 3DGS scene representation and the downstream detector, and directly perturbs Gaussian attributes including SH coefficients, position, scale, rotation, and alpha via projected gradient descent. Denoting the Gaussian set by $x_i$2, with each $x_i$3, the attack optimizes a subset $x_i$4 through the differentiable renderer to maximize detection loss under a perturbation budget (Hull et al., 30 May 2025). Reported examples include forcing a “car” to be detected as “person,” “elephant,” or “stop sign” by Faster R-CNN in as few as 11 PGD steps with $x_i$5, with incorrect-label confidence consistently above 70%.

Against this backdrop, ComplicitSplat can be understood as occupying the black-box, training-data manipulation end of the 3DGS attack spectrum. CLOAK already demonstrated the feasibility of viewpoint-conditional adversarial appearance under data manipulation, whereas DAGGER showed the power of direct differentiable perturbation. ComplicitSplat extends the first line by emphasizing downstream black-box transfer across detector families and by documenting success in both synthetic and physical reconstructions (Hull et al., 16 Aug 2025).

6. Ablations, limitations, and security implications

The reported ablations indicate that lowering the order of SH coefficients in 3DGS did not consistently mitigate the attack (Hull et al., 16 Aug 2025). This matters because SH order reduction is an intuitively plausible defense: restricting view-dependent expressivity might appear to reduce attack capacity. The reported result suggests that such a measure is not, by itself, a reliable safeguard.

The attack is also reported to be more effective from higher camera altitudes, including aerial or satellite views (Hull et al., 16 Aug 2025). This implies a particularly acute risk for aerial vehicle identification and surveillance. More broadly, the paper frames the threat in terms of safety- and mission-critical systems, especially autonomous vehicles and robotic systems that rely on 3DGS for efficient novel-view synthesis from static images.

The security concern is not limited to detector accuracy in isolation. Because the attack can embed concealed, viewpoint-specific content while preserving benign appearance from most other views, both human inspection and automated validation may fail if they do not sample the targeted regions. This suggests that conventional spot-checking of reconstructions may under-detect adversarially conditioned view sectors. The earlier 3DGS vulnerabilities paper makes a similar point in noting that concealment of adversarial textures or objects can evade both human and AI oversight while preserving realism from most viewpoints (Hull et al., 30 May 2025).

The available summaries do not present a developed defense framework for ComplicitSplat. In the related CLOAK/DAGGER work, the authors motivate the need for robust defensive strategies and mention possible future mitigation directions such as consistency enforcement across views, physical consistency checks, and adversarial training, but explicitly note that defenses are not deeply discussed (Hull et al., 30 May 2025). This suggests that systematic defense design for 3DGS-specific attack surfaces remains an open research problem.

7. Position within 3DGS security research

ComplicitSplat is situated at the intersection of novel-view synthesis, adversarial machine learning, and robotic perception security. Its defining contribution is to show that standard 3DGS shading methods alone suffice to create black-box, viewpoint-specific camouflage that transfers across downstream detector classes and into physical reconstruction pipelines (Hull et al., 16 Aug 2025). This reframes 3DGS not merely as a rendering substrate but as a potential adversarial medium whose view-dependent realism can be weaponized.

The attack also sharpens an emerging distinction between attacks on the reconstruction process and attacks on downstream models. In DAGGER, the adversary optimizes directly against the downstream detector through a differentiable path; in ComplicitSplat, the adversary instead compromises the upstream 3D scene in a model-agnostic way (Hull et al., 30 May 2025). That distinction is consequential for deployment: black-box attacks are typically easier to operationalize in settings where downstream model details are unavailable or proprietary.

A plausible implication is that future evaluation of 3DGS systems in safety-critical settings will need to treat the reconstruction pipeline, the capture dataset, and the view-dependent shading representation as part of the attack surface. ComplicitSplat demonstrates that vulnerabilities can emerge not from exotic architectural modifications, but from standard and otherwise desirable components of 3DGS itself.