arXiv:2606.03499cs.CV2026-06

首次系统分析3D高斯溅射中攻击的阶段可检测性,揭示不同阶段信号差异。

Characterizing Detectability in 3DGS Poisoning: A Stage-wise Benchmark

论文配图:Characterizing Detectability in 3DGS Poisoning: A Stage-wise Benchmark
图 1 · 摘自论文原文
  • 按重建流程分阶段评估中毒攻击的检测信号,捕捉多阶段异质特征。
  • 后期阶段如训练动态和高斯参数统计提供强检测线索,早期阶段效果差。
  • 适用于研究3DGS安全性的研究人员,尤其关注防御与溯源方向。

3D高斯溅射(3DGS)已成为实时新视角合成的主流表示方法,但近期研究显示其易受多种中毒攻击,包括幻觉物体注入、计算开销放大及事后水印。尽管威胁面扩大,现有研究多聚焦攻击成功率,而防御与检测仍被忽视。从检测角度出发,3DGS重建流程的多阶段特性带来关键挑战与机遇:各阶段生成异质中间表示,中毒痕迹的取证信号具有阶段依赖性——某阶段引入的攻击仅在后续阶段显现。为此,我们提出Poison-3DGS基准,用于阶段化刻画3DGS中的中毒检测能力。该基准涵盖多样场景与攻击类型,暴露多视图图像、几何结构、训练动态及高斯参数等阶段特异性伪影。通过系统分析发现:第一,检测能力在不同阶段差异显著,无单一阶段对所有攻击均占优;第二,不同攻击类型呈现独特阶段信号,检测效果高度依赖观测位置;第三,后期信号如训练动态与高斯参数统计提供早期不可见的强线索。本工作建立首个系统性框架,为未来3DGS系统的鲁棒性与可靠性研究奠定基础。

原文摘要 · Abstract (English)

3D Gaussian Splatting (3DGS) has rapidly emerged as a leading representation for real-time novel view synthesis, but recent work shows it is vulnerable to diverse poisoning attacks, including illusory object injection, computation cost amplification, and post hoc model watermarking. Despite this expanding threat surface, existing studies focus mainly on attack success, while defense and detection remain underexplored. From a detection perspective, a key challenge and opportunity arise from the multi-stage nature of the 3DGS reconstruction pipeline, which produces heterogeneous intermediate representations. Forensic signals for detecting poisoning are inherently stage dependent: an attack introduced at one stage may produce signals that emerge only at later stages. This motivates a stage-wise view of detectability that goes beyond single-stage evaluation. We introduce Poison-3DGS, a benchmark for stage-wise characterization of poisoning detection in 3DGS. It exposes stage-specific artifacts, including multi-view images, geometry, training dynamics, and Gaussian parameters, across a diverse set of scenes and attacks. Using it, we conduct a systematic study of detectability across pipeline stages. Our analysis reveals several insights. First, detectability varies significantly across stages, and no single stage consistently dominates across attack types. Second, different attacks exhibit distinct stage-specific forensic signals, so detection effectiveness depends critically on where signals are observed. Third, later-stage signals such as training dynamics and Gaussian parameter statistics provide strong cues not observable at earlier stages. Overall, our work provides a principled benchmark and the first systematic characterization of stage-dependent detectability in 3DGS, offering a foundation for future research on robust and reliable 3DGS systems.

3DGS中毒检测安全阶段分析

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。