Characterizing Detectability in 3DGS Poisoning: A Stage-wise Benchmark

2026-06-02

AI Summary

This work addresses the vulnerability of 3D Gaussian Splatting (3DGS) to poisoning attacks and fills a critical gap in the lack of systematic investigation into detection capabilities across its multi-stage reconstruction pipeline. We introduce, for the first time, a stage-wise detectability perspective and present Poison-3DGS—the first stage-level benchmark for poisoning detection in 3DGS. Through comprehensive analysis, we examine how heterogeneous signals—including multi-view images, geometric structures, training dynamics, and Gaussian parameters—respond to diverse attacks at different pipeline stages. Our study reveals that later stages, particularly training dynamics and Gaussian statistics, contain crucial forensic cues invisible in earlier phases, substantially enhancing detection performance. These findings provide both theoretical grounding and practical guidance for developing robust 3DGS systems resilient to adversarial manipulation.

Abstract

3D Gaussian Splatting (3DGS) has rapidly emerged as a leading representation for real-time novel view synthesis, but recent work shows it is vulnerable to diverse poisoning attacks, including illusory object injection, computation cost amplification, and post hoc model watermarking. Despite this expanding threat surface, existing studies focus mainly on attack success, while defense and detection remain underexplored. From a detection perspective, a key challenge and opportunity arise from the multi-stage nature of the 3DGS reconstruction pipeline, which produces heterogeneous intermediate representations. Forensic signals for detecting poisoning are inherently stage dependent: an attack introduced at one stage may produce signals that emerge only at later stages. This motivates a stage-wise view of detectability that goes beyond single-stage evaluation. We introduce Poison-3DGS, a benchmark for stage-wise characterization of poisoning detection in 3DGS. It exposes stage-specific artifacts, including multi-view images, geometry, training dynamics, and Gaussian parameters, across a diverse set of scenes and attacks. Using it, we conduct a systematic study of detectability across pipeline stages. Our analysis reveals several insights. First, detectability varies significantly across stages, and no single stage consistently dominates across attack types. Second, different attacks exhibit distinct stage-specific forensic signals, so detection effectiveness depends critically on where signals are observed. Third, later-stage signals such as training dynamics and Gaussian parameter statistics provide strong cues not observable at earlier stages. Overall, our work provides a principled benchmark and the first systematic characterization of stage-dependent detectability in 3DGS, offering a foundation for future research on robust and reliable 3DGS systems.

Problem

• 3D Gaussian Splatting
• poisoning attacks
• detectability
• stage-wise analysis
• forensic signals

Innovation

• 3D Gaussian Splatting
• poisoning detection
• stage-wise benchmark
• forensic signals
• training dynamics