表征3DGS投毒中的可检测性：分阶段基准测试
Characterizing Detectability in 3DGS Poisoning: A Stage-wise Benchmark
AI总结：
针对3DGS易受多种投毒攻击的问题，提出分阶段基准Poison-3DGS，系统研究各阶段可检测性差异，发现不同攻击在不同阶段产生独特取证信号，后期阶段（如训练动态和高斯参数统计）提供早期不可观测的强线索。
摘要：
3D高斯泼溅（3DGS）已迅速成为实时新视角合成的主要表示方法，但近期研究表明它易受多种投毒攻击，包括虚幻物体注入、计算成本放大和事后模型水印。尽管威胁面不断扩大，现有研究主要关注攻击成功，而防御和检测仍探索不足。从检测角度看，3DGS重建流程的多阶段特性产生了异构的中间表示，这既是关键挑战也是机遇。检测投毒的取证信号本质上是阶段依赖的：在一个阶段引入的攻击可能仅在后续阶段产生信号。这促使我们采用超越单阶段评估的分阶段可检测性视角。我们引入Poison-3DGS，一个用于分阶段表征3DGS投毒检测的基准。它暴露了跨多种场景和攻击的阶段特定伪影，包括多视图图像、几何、训练动态和高斯参数。利用该基准，我们对流水线各阶段的可检测性进行了系统研究。分析揭示了若干见解。首先，可检测性在不同阶段间差异显著，且没有任何单一阶段在所有攻击类型中持续占优。其次，不同攻击表现出不同的阶段特定取证信号，因此检测有效性关键取决于信号在何处被观测到。第三，后期阶段的信号（如训练动态和高斯参数统计）提供了早期阶段不可观测的强线索。总体而言，我们的工作提供了一个原则性基准，并首次系统表征了3DGS中阶段依赖的可检测性，为未来研究鲁棒可靠的3DGS系统奠定了基础。
英文摘要：
3D Gaussian Splatting (3DGS) has rapidly emerged as a leading representation for real-time novel view synthesis, but recent work shows it is vulnerable to diverse poisoning attacks, including illusory object injection, computation cost amplification, and post hoc model watermarking. Despite this expanding threat surface, existing studies focus mainly on attack success, while defense and detection remain underexplored. From a detection perspective, a key challenge and opportunity arise from the multi-stage nature of the 3DGS reconstruction pipeline, which produces heterogeneous intermediate representations. Forensic signals for detecting poisoning are inherently stage dependent: an attack introduced at one stage may produce signals that emerge only at later stages. This motivates a stage-wise view of detectability that goes beyond single-stage evaluation. We introduce Poison-3DGS, a benchmark for stage-wise characterization of poisoning detection in 3DGS. It exposes stage-specific artifacts, including multi-view images, geometry, training dynamics, and Gaussian parameters, across a diverse set of scenes and attacks. Using it, we conduct a systematic study of detectability across pipeline stages. Our analysis reveals several insights. First, detectability varies significantly across stages, and no single stage consistently dominates across attack types. Second, different attacks exhibit distinct stage-specific forensic signals, so detection effectiveness depends critically on where signals are observed. Third, later-stage signals such as training dynamics and Gaussian parameter statistics provide strong cues not observable at earlier stages. Overall, our work provides a principled benchmark and the first systematic characterization of stage-dependent detectability in 3DGS, offering a foundation for future research on robust and reliable 3DGS systems.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
