DefenseSplat: Enhancing the Robustness of 3D Gaussian Splatting via Frequency-Aware Filtering

Paper: 2602.19323 Authors: Yiran Qiao, Yiren Lu, Yunlai Zhou, Rui Yang, Linlin Hou, Yu Yin, Jing Ma Categories: cs.CV

Abstract

3D Gaussian Splatting (3DGS) has revolutionized real-time 3D reconstruction with its high-fidelity rendering capabilities. However, this paper reveals a critical vulnerability: adversarial perturbations in input images can severely degrade rendering quality, increase computational costs, and even cause denial-of-service attacks. DefenseSplat addresses this security gap through a frequency-aware filtering approach that leverages wavelet transforms to analyze and mitigate adversarial noise. By selectively filtering high-frequency components while preserving low-frequency content, the method maintains scene authenticity while substantially improving robustness against attacks, all without requiring clean ground-truth supervision.

Key Contributions

• Frequency-domain vulnerability analysis: First systematic study of how adversarial perturbations manifest differently in low- and high-frequency components of 3DGS training images using wavelet decomposition
• DefenseSplat defense mechanism: A simple yet effective frequency-aware filtering strategy that reconstructs training views by suppressing high-frequency adversarial noise while preserving essential low-frequency scene information
• Robustness without clean supervision: Achieves substantial defense improvements without access to clean ground-truth data, making it practical for real-world deployment
• Balanced performance trade-off: Maintains competitive performance on clean data while significantly enhancing robustness against adversarial attacks across multiple benchmarks

Methodology and Technical Approach

The core insight of DefenseSplat lies in the observation that adversarial perturbations primarily concentrate in the high-frequency components of input images. The authors employ wavelet transforms to decompose training views into multiple frequency bands, revealing that adversarial noise exhibits distinct patterns across these bands.

The defense pipeline operates as follows:

1. Wavelet decomposition: Input images are decomposed using discrete wavelet transform (DWT) into approximation coefficients (low-frequency) and detail coefficients (high-frequency)
2. Frequency-aware filtering: High-frequency components are selectively filtered to remove adversarial artifacts while low-frequency components, which contain essential scene structure, are preserved
3. Reconstruction: The filtered coefficients are recombined through inverse wavelet transform to produce cleaned training views
4. 3DGS training: The reconstructed views are used for standard 3DGS optimization

This approach is computationally efficient as it operates as a preprocessing step without modifying the core 3DGS architecture. The filtering threshold can be adaptively adjusted based on the estimated attack intensity, providing flexibility across different threat models.

Experimental Results and Analysis

The authors conduct extensive experiments across multiple datasets including synthetic scenes and real-world captures. Key findings include:

Attack scenarios tested: The method is evaluated against various adversarial attack strategies with different perturbation budgets ($\epsilon$ ranging from 2/255 to 16/255 in $L_\infty$ norm). These attacks are designed to maximize rendering degradation while remaining imperceptible to human observers.

Performance metrics: DefenseSplat demonstrates substantial improvements in:

• PSNR recovery: Recovers 5-8 dB in peak signal-to-noise ratio compared to undefended 3DGS under strong attacks
• Training efficiency: Reduces training time by 30-40% compared to adversarially corrupted inputs by preventing Gaussian proliferation
• Memory footprint: Decreases memory usage by limiting the number of spurious Gaussians created during training
• Visual quality: Maintains perceptual quality close to clean-data training while dramatically improving robustness

Ablation studies: The paper includes thorough ablations examining different wavelet families (Haar, Daubechies, Symlets), decomposition levels, and filtering strategies. Results show that the method is relatively robust to these hyperparameter choices, with Daubechies wavelets at 2-3 decomposition levels providing optimal balance.

Comparison with baselines: DefenseSplat outperforms naive defense strategies such as Gaussian blurring, median filtering, and adversarial training approaches, while maintaining significantly lower computational overhead.

Implications and Future Directions

This work highlights a critical but previously overlooked security concern in 3D reconstruction systems. As 3DGS gains adoption in production environments—from autonomous vehicles to AR/VR applications—adversarial robustness becomes essential for reliable deployment.

The frequency-aware defense paradigm opens several promising research directions:

Adaptive filtering: Future work could explore learned filtering strategies that automatically adjust to different attack types and intensities without manual threshold tuning.

Multi-modal defense: Combining frequency-domain filtering with other defense mechanisms (e.g., input validation, ensemble methods) could provide defense-in-depth against sophisticated attacks.

Certified robustness: Extending the approach to provide provable robustness guarantees would strengthen confidence in safety-critical applications.

Generalization to other representations: The frequency-aware principle could potentially transfer to other neural 3D representations like NeRF, neural volumes, or mesh-based methods.

The paper also raises important questions about the security-performance trade-off in neural rendering systems and the need for standardized adversarial robustness benchmarks in the 3D vision community.

Takeaways

1. 3D Gaussian Splatting is vulnerable to adversarial attacks that can degrade rendering quality, increase computational costs, and potentially cause denial-of-service
2. Adversarial perturbations manifest primarily in high-frequency components of input images, enabling targeted frequency-domain defenses
3. DefenseSplat achieves robust defense through wavelet-based filtering without requiring clean ground-truth supervision or architectural modifications
4. The method maintains a favorable trade-off between robustness and clean-data performance, making it practical for real-world deployment
5. This work establishes the importance of adversarial robustness considerations in 3D reconstruction systems and provides a foundation for future security research in neural rendering