AdvSplat: Adversarial Attacks on Feed-Forward Gaussian Splatting Models

arXiv 2026.03

Yiran Qiao, Yiren Lu, Yunlai Zhou, Rui Yang, Linlin Hou, Yu Yin, Jing Ma
Case Western Reserve University
Paper Code
Ref.
Novel Views
Clean
Clean reference photograph of the kitchen, looking at the white cabinets, the stove and the table with a plant on it. Clean reference photograph of the same room from the far corner, looking past the fridge towards the bathroom door.
Novel view rendered from the clean reconstruction: the kitchen comes back sharp, with the cabinets, stove and plant all intact.
Second novel view rendered from the clean reconstruction, looking past the fridge to the bathroom, clean and sharp.
Third novel view rendered from the clean reconstruction, a slight shift of the same corner, equally sharp.
Attacked
The same kitchen reference photograph after the attack, its surfaces covered in a faint mottled colour pattern. The same corner reference photograph after the attack, its white wall and fridge covered in the same mottled colour pattern.
Novel view rendered from the attacked reconstruction: the same kitchen, washed out and hazy, with its detail bleached away.
Second novel view rendered from the attacked reconstruction, where a pale smear has swallowed the right-hand side of the room.
Third novel view rendered from the attacked reconstruction, degraded further until the smear covers most of the frame.

AdvSplat attacks a feed-forward 3D Gaussian Splatting model as a black box, without ever touching its weights or gradients. Adding only a subtle perturbation to the input views, which still read as the same room, is enough to degrade the rendered novel views severely.

Abstract

3D Gaussian Splatting (3DGS) is increasingly recognized as a powerful paradigm for real-time, high-fidelity 3D reconstruction. However, its per-scene optimization pipeline limits scalability and generalization, and prevents efficient inference. Recently emerged feed-forward 3DGS models address these limitations by enabling fast reconstruction from a few input views after large-scale pretraining, without scene-specific optimization. Despite their advantages and strong potential for commercial deployment, the use of neural networks as the backbone also amplifies the risk of adversarial manipulation. In this paper, we introduce AdvSplat, the first systematic study of adversarial attacks on feed-forward 3DGS. We first employ white-box attacks to reveal fundamental vulnerabilities of this model family. We then develop two improved, practically relevant, query-efficient black-box algorithms that optimize pixel-space perturbations via a frequency-domain parameterization: one based on gradient estimation and the other gradient-free, without requiring any access to model internals. Extensive experiments across multiple datasets demonstrate that AdvSplat can significantly disrupt reconstruction results by injecting imperceptible perturbations into the input images. Our findings surface an overlooked yet urgent problem in this domain, and we hope to draw the community’s attention to this emerging security and robustness challenge.

Motivation

Two-panel figure. Panel (a), PGD for image classification: a clean photograph of a dog, labelled Dog, gets a random start added to it, and the resulting current image is passed through a frozen model to a loss. A gradient step then ascends that loss surface and the result is projected back into an L2 ball of radius epsilon around the clean image, a loop repeated for T steps, ending in an adversarial image that still looks like the dog but is labelled Cat. A large arrow, headed adapt PGD to feed-forward 3DGS, carries three points down to panel (b): perturb reference views, freeze the reconstruction model, maximise rendering error. Panel (b), effect on novel-view synthesis: two scenes, a white bathroom and a red dining room, each shown as a clean row and an attacked row with two reference views and two novel views. Both clean rows render sharply; in the attacked rows the bathroom comes back almost entirely black and the dining room collapses into a dark smear. A radar map on the right plots clean against attacked over PSNR, LPIPS, DINO, CLIP and SSIM, the attacked polygon sitting well inside the clean one on every axis.

(a) PGD is the standard way to attack an image classifier: from a randomly perturbed start, it repeatedly takes a gradient step that raises the model’s loss and projects the result back into an ε-ball around the clean image, so that after T steps the picture still reads as a dog to us while the model calls it a cat.

(b) The same loop carries over to feed-forward 3DGS almost unchanged, perturb the reference views instead of a single image, keep the reconstruction model frozen, and maximise rendering error instead of a class score. What comes back is far worse than a flipped label. The perturbed reference views still look like ordinary photographs of the room, yet every novel view rendered from them falls apart: the bathroom returns almost entirely black, and the dining room collapses into a dark smear. The radar map puts the two side by side over PSNR, SSIM, LPIPS, CLIP and DINO, and the attacked scores sit well inside the clean ones on every axis.

This probe is white-box, the gradient step needs the model’s own gradients, which a real attacker would rarely have. That it works at all is what motivates AdvSplat: if feed-forward 3DGS is this fragile when the gradients are handed to you, the question worth asking is how much of the damage survives when they are not, which is the black-box setting the rest of this work operates in.

Pipeline

Pipeline of AdvSplat. On the left, two reference views are partitioned into patches and passed through a DCT into blue coefficient maps, which a low-frequency filter combines with sampled yellow noise; an inverse DCT turns the sum into green perturbed images, which are rendered by a black box marked with a question mark, the feed-forward 3DGS model whose parameters are unknown. The right half splits into two rows. The gradient-based row above and the gradient-free row below each run from iteration t equals 1 to t equals T over a contour map of the loss drawn as grey ellipses with a red star at the maximum: the upper row follows a red gradient arrow towards that star, the lower row samples inside a red dashed ellipse instead. Both end at an optimal noise block marked with a red check.

Pipeline of our proposed method, including gradient-based and gradient-free variants. The blue blocks denote the DCT coefficient maps, the yellow blocks denote the sampled noise, the green blocks denote the images after iDCT, and the purple blocks denote the rendered images. The black box in the center is the feed-forward 3DGS model with unknown parameters, illustrated by the gray block. The gray ellipses depict a contour map of the loss function, and the red star indicates the maximum. The red arrow inside the ellipse shows the gradient direction, while the red dashed ellipse indicates the noise sampling region. Finally, the noise sample marked with a red checkmark is the optimal perturbation we seek.

Results

RE10K
DL3DV
Ref.
Novel Views
Ref.
Novel Views
DP
DepthSplat on RE10K, reference view 1, clean DepthSplat on RE10K, reference view 2, clean
DepthSplat on RE10K, novel view 1 rendered from clean inputs
DepthSplat on RE10K, novel view 2 rendered from clean inputs
DepthSplat on RE10K, novel view 3 rendered from clean inputs
DepthSplat on DL3DV, reference view 1, clean DepthSplat on DL3DV, reference view 2, clean
DepthSplat on DL3DV, novel view 1 rendered from clean inputs
DepthSplat on DL3DV, novel view 2 rendered from clean inputs
DepthSplat on DL3DV, novel view 3 rendered from clean inputs
DP+Ours (GB)
DepthSplat on RE10K, reference view 1, perturbed by our gradient-based attack DepthSplat on RE10K, reference view 2, perturbed by our gradient-based attack
DepthSplat on RE10K, novel view 1 rendered from inputs perturbed by our gradient-based attack
DepthSplat on RE10K, novel view 2 rendered from inputs perturbed by our gradient-based attack
DepthSplat on RE10K, novel view 3 rendered from inputs perturbed by our gradient-based attack
DepthSplat on DL3DV, reference view 1, perturbed by our gradient-based attack DepthSplat on DL3DV, reference view 2, perturbed by our gradient-based attack
DepthSplat on DL3DV, novel view 1 rendered from inputs perturbed by our gradient-based attack
DepthSplat on DL3DV, novel view 2 rendered from inputs perturbed by our gradient-based attack
DepthSplat on DL3DV, novel view 3 rendered from inputs perturbed by our gradient-based attack
DP+Ours (GF)
DepthSplat on RE10K, reference view 1, perturbed by our gradient-free attack DepthSplat on RE10K, reference view 2, perturbed by our gradient-free attack
DepthSplat on RE10K, novel view 1 rendered from inputs perturbed by our gradient-free attack
DepthSplat on RE10K, novel view 2 rendered from inputs perturbed by our gradient-free attack
DepthSplat on RE10K, novel view 3 rendered from inputs perturbed by our gradient-free attack
DepthSplat on DL3DV, reference view 1, perturbed by our gradient-free attack DepthSplat on DL3DV, reference view 2, perturbed by our gradient-free attack
DepthSplat on DL3DV, novel view 1 rendered from inputs perturbed by our gradient-free attack
DepthSplat on DL3DV, novel view 2 rendered from inputs perturbed by our gradient-free attack
DepthSplat on DL3DV, novel view 3 rendered from inputs perturbed by our gradient-free attack
NP
NoPoSplat on RE10K, reference view 1, clean NoPoSplat on RE10K, reference view 2, clean
NoPoSplat on RE10K, novel view 1 rendered from clean inputs
NoPoSplat on RE10K, novel view 2 rendered from clean inputs
NoPoSplat on RE10K, novel view 3 rendered from clean inputs
NoPoSplat on DL3DV, reference view 1, clean NoPoSplat on DL3DV, reference view 2, clean
NoPoSplat on DL3DV, novel view 1 rendered from clean inputs
NoPoSplat on DL3DV, novel view 2 rendered from clean inputs
NoPoSplat on DL3DV, novel view 3 rendered from clean inputs
NP+Ours (GB)
NoPoSplat on RE10K, reference view 1, perturbed by our gradient-based attack NoPoSplat on RE10K, reference view 2, perturbed by our gradient-based attack
NoPoSplat on RE10K, novel view 1 rendered from inputs perturbed by our gradient-based attack
NoPoSplat on RE10K, novel view 2 rendered from inputs perturbed by our gradient-based attack
NoPoSplat on RE10K, novel view 3 rendered from inputs perturbed by our gradient-based attack
NoPoSplat on DL3DV, reference view 1, perturbed by our gradient-based attack NoPoSplat on DL3DV, reference view 2, perturbed by our gradient-based attack
NoPoSplat on DL3DV, novel view 1 rendered from inputs perturbed by our gradient-based attack
NoPoSplat on DL3DV, novel view 2 rendered from inputs perturbed by our gradient-based attack
NoPoSplat on DL3DV, novel view 3 rendered from inputs perturbed by our gradient-based attack
NP+Ours (GF)
NoPoSplat on RE10K, reference view 1, perturbed by our gradient-free attack NoPoSplat on RE10K, reference view 2, perturbed by our gradient-free attack
NoPoSplat on RE10K, novel view 1 rendered from inputs perturbed by our gradient-free attack
NoPoSplat on RE10K, novel view 2 rendered from inputs perturbed by our gradient-free attack
NoPoSplat on RE10K, novel view 3 rendered from inputs perturbed by our gradient-free attack
NoPoSplat on DL3DV, reference view 1, perturbed by our gradient-free attack NoPoSplat on DL3DV, reference view 2, perturbed by our gradient-free attack
NoPoSplat on DL3DV, novel view 1 rendered from inputs perturbed by our gradient-free attack
NoPoSplat on DL3DV, novel view 2 rendered from inputs perturbed by our gradient-free attack
NoPoSplat on DL3DV, novel view 3 rendered from inputs perturbed by our gradient-free attack
AP
AnySplat on RE10K, reference view 1, clean AnySplat on RE10K, reference view 2, clean
AnySplat on RE10K, novel view 1 rendered from clean inputs
AnySplat on RE10K, novel view 2 rendered from clean inputs
AnySplat on RE10K, novel view 3 rendered from clean inputs
AnySplat on DL3DV, reference view 1, clean AnySplat on DL3DV, reference view 2, clean
AnySplat on DL3DV, novel view 1 rendered from clean inputs
AnySplat on DL3DV, novel view 2 rendered from clean inputs
AnySplat on DL3DV, novel view 3 rendered from clean inputs
AP+Ours (GB)
AnySplat on RE10K, reference view 1, perturbed by our gradient-based attack AnySplat on RE10K, reference view 2, perturbed by our gradient-based attack
AnySplat on RE10K, novel view 1 rendered from inputs perturbed by our gradient-based attack
AnySplat on RE10K, novel view 2 rendered from inputs perturbed by our gradient-based attack
AnySplat on RE10K, novel view 3 rendered from inputs perturbed by our gradient-based attack
AnySplat on DL3DV, reference view 1, perturbed by our gradient-based attack AnySplat on DL3DV, reference view 2, perturbed by our gradient-based attack
AnySplat on DL3DV, novel view 1 rendered from inputs perturbed by our gradient-based attack
AnySplat on DL3DV, novel view 2 rendered from inputs perturbed by our gradient-based attack
AnySplat on DL3DV, novel view 3 rendered from inputs perturbed by our gradient-based attack
AP+Ours (GF)
AnySplat on RE10K, reference view 1, perturbed by our gradient-free attack AnySplat on RE10K, reference view 2, perturbed by our gradient-free attack
AnySplat on RE10K, novel view 1 rendered from inputs perturbed by our gradient-free attack
AnySplat on RE10K, novel view 2 rendered from inputs perturbed by our gradient-free attack
AnySplat on RE10K, novel view 3 rendered from inputs perturbed by our gradient-free attack
AnySplat on DL3DV, reference view 1, perturbed by our gradient-free attack AnySplat on DL3DV, reference view 2, perturbed by our gradient-free attack
AnySplat on DL3DV, novel view 1 rendered from inputs perturbed by our gradient-free attack
AnySplat on DL3DV, novel view 2 rendered from inputs perturbed by our gradient-free attack
AnySplat on DL3DV, novel view 3 rendered from inputs perturbed by our gradient-free attack

Qualitative results on RE10K and DL3DV (ε = 8/255). DP denotes DepthSplat, NP denotes NoPoSplat, and AP denotes AnySplat. GB denotes the gradient-based variant, and GF denotes the gradient-free variant. All baselines use clean inputs, whereas our method uses the optimized adversarial examples as inputs.

Different Attack Strength

RE10K
DL3DV
Ref.
Novel Views
Ref.
Novel Views
Gradient-Based
2/255
RE10K reference view 1, perturbed by our gradient-based attack at epsilon 2/255 RE10K reference view 2, perturbed by our gradient-based attack at epsilon 2/255
RE10K novel view 1 rendered after our gradient-based attack at epsilon 2/255
RE10K novel view 2 rendered after our gradient-based attack at epsilon 2/255
RE10K novel view 3 rendered after our gradient-based attack at epsilon 2/255
DL3DV reference view 1, perturbed by our gradient-based attack at epsilon 2/255 DL3DV reference view 2, perturbed by our gradient-based attack at epsilon 2/255
DL3DV novel view 1 rendered after our gradient-based attack at epsilon 2/255
DL3DV novel view 2 rendered after our gradient-based attack at epsilon 2/255
DL3DV novel view 3 rendered after our gradient-based attack at epsilon 2/255
4/255
RE10K reference view 1, perturbed by our gradient-based attack at epsilon 4/255 RE10K reference view 2, perturbed by our gradient-based attack at epsilon 4/255
RE10K novel view 1 rendered after our gradient-based attack at epsilon 4/255
RE10K novel view 2 rendered after our gradient-based attack at epsilon 4/255
RE10K novel view 3 rendered after our gradient-based attack at epsilon 4/255
DL3DV reference view 1, perturbed by our gradient-based attack at epsilon 4/255 DL3DV reference view 2, perturbed by our gradient-based attack at epsilon 4/255
DL3DV novel view 1 rendered after our gradient-based attack at epsilon 4/255
DL3DV novel view 2 rendered after our gradient-based attack at epsilon 4/255
DL3DV novel view 3 rendered after our gradient-based attack at epsilon 4/255
8/255
RE10K reference view 1, perturbed by our gradient-based attack at epsilon 8/255 RE10K reference view 2, perturbed by our gradient-based attack at epsilon 8/255
RE10K novel view 1 rendered after our gradient-based attack at epsilon 8/255
RE10K novel view 2 rendered after our gradient-based attack at epsilon 8/255
RE10K novel view 3 rendered after our gradient-based attack at epsilon 8/255
DL3DV reference view 1, perturbed by our gradient-based attack at epsilon 8/255 DL3DV reference view 2, perturbed by our gradient-based attack at epsilon 8/255
DL3DV novel view 1 rendered after our gradient-based attack at epsilon 8/255
DL3DV novel view 2 rendered after our gradient-based attack at epsilon 8/255
DL3DV novel view 3 rendered after our gradient-based attack at epsilon 8/255
Gradient-Free
2/255
RE10K reference view 1, perturbed by our gradient-free attack at epsilon 2/255 RE10K reference view 2, perturbed by our gradient-free attack at epsilon 2/255
RE10K novel view 1 rendered after our gradient-free attack at epsilon 2/255
RE10K novel view 2 rendered after our gradient-free attack at epsilon 2/255
RE10K novel view 3 rendered after our gradient-free attack at epsilon 2/255
DL3DV reference view 1, perturbed by our gradient-free attack at epsilon 2/255 DL3DV reference view 2, perturbed by our gradient-free attack at epsilon 2/255
DL3DV novel view 1 rendered after our gradient-free attack at epsilon 2/255
DL3DV novel view 2 rendered after our gradient-free attack at epsilon 2/255
DL3DV novel view 3 rendered after our gradient-free attack at epsilon 2/255
4/255
RE10K reference view 1, perturbed by our gradient-free attack at epsilon 4/255 RE10K reference view 2, perturbed by our gradient-free attack at epsilon 4/255
RE10K novel view 1 rendered after our gradient-free attack at epsilon 4/255
RE10K novel view 2 rendered after our gradient-free attack at epsilon 4/255
RE10K novel view 3 rendered after our gradient-free attack at epsilon 4/255
DL3DV reference view 1, perturbed by our gradient-free attack at epsilon 4/255 DL3DV reference view 2, perturbed by our gradient-free attack at epsilon 4/255
DL3DV novel view 1 rendered after our gradient-free attack at epsilon 4/255
DL3DV novel view 2 rendered after our gradient-free attack at epsilon 4/255
DL3DV novel view 3 rendered after our gradient-free attack at epsilon 4/255
8/255
RE10K reference view 1, perturbed by our gradient-free attack at epsilon 8/255 RE10K reference view 2, perturbed by our gradient-free attack at epsilon 8/255
RE10K novel view 1 rendered after our gradient-free attack at epsilon 8/255
RE10K novel view 2 rendered after our gradient-free attack at epsilon 8/255
RE10K novel view 3 rendered after our gradient-free attack at epsilon 8/255
DL3DV reference view 1, perturbed by our gradient-free attack at epsilon 8/255 DL3DV reference view 2, perturbed by our gradient-free attack at epsilon 8/255
DL3DV novel view 1 rendered after our gradient-free attack at epsilon 8/255
DL3DV novel view 2 rendered after our gradient-free attack at epsilon 8/255
DL3DV novel view 3 rendered after our gradient-free attack at epsilon 8/255

Qualitative results as the perturbation budget grows. Rows are grouped by variant, gradient-based above and gradient-free below, and within each group the budget runs ε = 2/255, 4/255, 8/255. The left group is the RE10K scene and the right group the DL3DV scene. Every reference view shown is already perturbed at that budget, and the novel views beside it are rendered from the reconstruction fitted to those views.

Citation

If you find our work helpful, please consider citing us:

@article{qiao2026advsplat,
  title={{AdvSplat}: Adversarial Attacks on Feed-Forward Gaussian Splatting Models},
  author={Qiao, Yiran and Lu, Yiren and Zhou, Yunlai and Yang, Rui and Hou, Linlin and Yin, Yu and Ma, Jing},
  journal={arXiv preprint arXiv:2603.23686},
  year={2026}
}