DefenseSplat: Enhancing the Robustness of 3D Gaussian Splatting via Frequency-Aware Filtering¶

Conference: ECCV 2026
arXiv: 2602.19323
Code: https://github.com/yrqiao/DefenseSplat
Area: 3D Vision
Keywords: 3D Gaussian Splatting, adversarial defense, wavelet transform, frequency-domain analysis, adversarial robustness

TL;DR¶

DefenseSplat significantly improves the robustness of 3DGS against adversarial attacks without clean ground-truth supervision. It decomposes input images using the wavelet transform and filters out high-frequency subbands to suppress adversarial perturbations, while introducing a ReLU-based scale regularization loss to constrain the generation of elongated Gaussians.

Background & Motivation¶

With explicit Gaussian ellipsoid representations and differentiable rasterization, 3D Gaussian Splatting (3DGS) has comprehensively outperformed NeRF in rendering speed, visual quality, and interpretability, rapidly becoming the mainstream paradigm in the field of 3D reconstruction. 3DGS is widely applied in robotics, autonomous driving, and medical imaging, and is especially suitable for deployment on cloud servers where high-quality scene representations are automatically constructed from user-uploaded multi-view images. However, precisely because it explicitly fits object textures and edges and dynamically adjusts the number of Gaussian primitives through adaptive density control, 3DGS is extremely sensitive to input image quality. Tiny, human-imperceptible adversarial perturbations can cause massive artifacts in the reconstructed results while substantially increasing training time, rendering VRAM footprints, and the number of Gaussian primitives, potentially leading to denial-of-service on servers.

Adversarial attacks against 3DGS are still in their infancy. Poison-Splat injects adversarial noise into input images through bi-level optimization, inducing a massive number of elongated Gaussians during 3DGS training to consume computational resources while degrading rendering quality. Facing such attacks, existing defense methods are rendered almost entirely ineffective: standard adversarial training assumes a fixed network architecture and supervised classification, which is incompatible with the self-supervised, architecture-free nature of 3DGS; traditional 2D image denoising (Gaussian blur, bilateral filtering) suppresses perturbations but also erases edge details critical for 3D reconstruction; and frequency-domain filtering (e.g., Fourier transform) ignores spatial structure information, leading to limited defense effectiveness. Crucially, 3DGS training lacks the concept of "clean ground-truth input," preventing adversarial training with clean labels as done in image classification.

The core insight of this paper stems from a simple yet overlooked fact: adversarial perturbations are not uniformly distributed in the frequency domain. Core Idea: By decomposing the corrupted input images into high- and low-frequency subbands via the wavelet transform, it is observed that adversarial noise is concentrated in high-frequency components that are easily disrupted by multi-view consistency. Therefore, directly filtering out high-frequency components can eliminate adversarial artifacts while keeping the low-frequency main structures of the scene unaffected, further supported by scale regularization to suppress the generation of elongated Gaussians.

Method¶

Overall Architecture¶

DefenseSplat is a three-stage pipeline that directly pre-processes input images without requiring clean ground truth. First, a single-level discrete wavelet transform (DWT) is applied to each attacked multi-view image, obtaining four subbands: LL (low frequency), LH, HL, and HH. Then, all high-frequency subband (LH, HL, HH) coefficients are set to zero, retaining only the LL subband to reconstruct the filtered images via the inverse discrete wavelet transform (iDWT). Finally, these filtered images are fed into the standard 3DGS training process as inputs, combined with a scale regularization loss in a ReLU form to restrict the generation of high-variance Gaussians (i.e., elongated Gaussians). After training, the final defended multi-view images are rendered. It also includes an optional fine-grained filtering branch that selectively preserves high-frequency subbands using multi-view consistency, thereby restoring authentic textures erroneously removed by coarse filtering.

%%{init: {'flowchart': {'rankSpacing': 24, 'nodeSpacing': 28, 'padding': 6, 'wrappingWidth': 400}}}%%
flowchart TD
    A["Attacked Multi-View Images"] --> B["DWT Decomposition<br/>LL / LH / HL / HH"]
    B --> C["Zero Out High-Frequency Subbands<br/>Keep LL Only"]
    C --> D["iDWT Reconstruction<br/>Filtered Images"]
    D --> E["3DGS Training<br/>+ Scale Regularization Loss"]
    E --> F["Render Defended Images"]
    B -->|Optional Branch| G["Fine-Grained Consistency Filtering<br/>TSP Sorting -> Neighborhood Matching"]
    G --> D

Key Designs¶

1. Frequency-Domain Vulnerability Analysis: Why Adversarial Attacks Primarily Disrupt High Frequencies

The authors first quantitatively evaluate the cross-view consistency changes across different frequency bands before and after attacks using deep image matching (SuperPoint + LightGlue). To perform multi-view matching efficiently and accurately, they model camera pose sequencing as a Traveling Salesperson Problem (TSP) and employ the Lin-Kernighan algorithm to solve for a smooth camera trajectory. This allows each image to be matched only with its adjacent images along the path, both avoiding the O(n^2) complexity of brute-force matching and resolving matching failures caused by random sequencing. The matching rate is defined as the ratio of matched keypoints to the total number of extracted keypoints. Experiments across three datasets (Mip-NeRF 360, Tanks-and-Temples, and LLFF) consistently demonstrate that the matching rate drop in high-frequency bands (LH + HL) after attacks (15%–20%) is far more severe than in the low-frequency band (LL, only 3%–5%). Meanwhile, the HH subband has a negligible energy ratio (<0.08%) and corresponds to diagonal textures that are rare in natural images, making it negligible. This observation forms the empirical foundation of the entire defense strategy: adversarial perturbations are essentially high-frequency noise, and attackers tend to inject a large number of high-frequency artifacts into the input to maximize 3DGS training loss.

2. Coarse-Grained Filtering: Directly Discarding High-Frequency Subbands

Based on the above analysis, the most direct defense mechanism is to zero out all high-frequency subbands. Given an attacked image \(I'\), a single-level wavelet decomposition is performed to extract the LL subband, which is then used along with the three zeroed-out high-frequency subbands to reconstruct the filtered image \(I_f = \texttt{iDWT}(\texttt{DWT}(I')_{LL}, 0, 0, 0)\) via iDWT. Although seemingly brutal, this step is supported by two rationales. First, the LL subband carries more than 95% of the total energy of the image, keeping the main structures and low-frequency content (lighting, large color patches) of the scene largely unaffected; even when the attack intensity increases to 64/255, the LL subband still retains most useful information. Second, 3DGS possesses an inherent self-suppression mechanism during optimization: when consistency across multiple views is low (i.e., residual artificial textures after filtering), the Gaussians automatically average colors in these regions to minimize the L1 loss, leading to a blurring effect that further dissipates residual artifacts. This means that the combination of filtering and the intrinsic smoothing of 3DGS forms a two-layer defense chain, eliminating the need for an explicit denoising network.

3. ReLU Scale Regularization: Suppressing Overfitting of Elongated Gaussians to Residual Textures

Although coarse-grained filtering removes the vast majority of high-frequency perturbations, a small portion of residual textures with strong multi-view consistency remains. When fitting these textures, 3DGS generates a large number of elongated Gaussians to precisely match the patterns, leading to an explosion in the number of Gaussian primitives and a spike in VRAM usage, which weakens the defense effect. To address this issue, the authors design an extremely simple scale regularization loss \(\mathcal{L}_{scale} = \text{ReLU}(\nu - \tau)\), where \(\nu\) is the normalized variance of a single Gaussian along its three principal axes, and \(\tau\) is a preset threshold. This loss only activates gradient propagation when \(\nu > \tau\), meaning it exclusively penalizes elongated Gaussians (where scales along the three axes differ vastly) without affecting two key types of Gaussians: small spherical Gaussians used to reconstruct fine details, and large flat Gaussians used to cover large smooth regions—both of which have normalized variances lower than elongated Gaussians. Experiments show that adding this loss further reduces the number of Gaussians by 15%–30%, with concurrent declines in GPU memory and rendering time, achieving the best balance across almost all metrics.

4. Fine-Grained Consistency Filtering (Optional): Selectively Preserving Real Textures in High Frequencies

The "one-size-fits-all" strategy of coarse-grained filtering inherently discards real high-frequency details (such as texture edges and fine structures) alongside noise, leading to over-smoothing in flat regions. To address this, an optional, finer-grained filtering strategy is introduced: TSP sorting is first applied to establish neighborhood relationships across perspectives, followed by feature matching between the high-frequency subbands of adjacent views. Only high-frequency coefficients that consistently appear in neighboring views are preserved, while random, non-consistent coefficients are discarded. This approach eliminates adversarial noise (since noise does not repeat across views) while retaining authentic high-frequency information like building edges and texture patterns. Experiments indicate that fine-grained filtering yields a slight improvement in PSNR and SSIM (~0.02 dB) but carries higher pre-processing complexity. Thus, the authors set it as an optional component, allowing system deployments to trade off efficiency and quality.

A Complete Example¶

Taking the bonsai scene in Mip-NeRF 360 as an example with an attack intensity of \(\epsilon=16/255\). The original 3DGS training on attacked images requires 47 minutes, 4.88M Gaussians, and 18.5GB of VRAM, yielding a PSNR of only 27.38. After coarse-grained filtering with DefenseSplat, the LH/HL subband coefficients of the input images are entirely zeroed out, while the LL subband is preserved. The 3DGS training time decreases to 24 minutes (a reduction of ~50%), the number of Gaussians drops to 0.89M (an 82% reduction), VRAM usage drops to 11.5GB, and the PSNR increases to 30.78. When scale regularization is added, the number of Gaussians is further reduced to 0.86M, and VRAM usage drops to 10.5GB. This is because the defense not only removes noise but also substantially simplifies the high-frequency complexity of the scene—3DGS no longer requires a vast number of Gaussians to fit spurious textures, allowing optimization resources to be concentrated on the low-frequency main structures.

Key Experimental Results¶

Main Results¶

Dataset	Metric	3DGS (Attacked)	CompactGS	Difix3D+	Ours	Ours+ReLU
Mip-NeRF 360	PSNR ↑	25.18	24.95	24.52	27.32	27.47
Mip-NeRF 360	Training Time ↓	1:01:01	1:22:26	0:45:44	0:34:26	0:33:49
Mip-NeRF 360	Gaussians ↓	5.91M	3.00M	3.65M	2.24M	2.16M
Mip-NeRF 360	GPU Memory ↓	20965	21072	15894	12567	11400
Tanks-and-Temples	PSNR ↑	24.88	24.37	24.75	26.29	26.42
Tanks-and-Temples	Training Time ↓	0:31:22	0:43:29	0:24:12	0:18:56	0:19:19
Tanks-and-Temples	Gaussians ↓	2.76M	1.73M	1.71M	1.06M	1.01M
Tanks-and-Temples	GPU Memory ↓	10089	10930	7749	6296	5858

Ablation Study¶

Config	PSNR (Mip-NeRF 360)	Gaussians	Note
Full (Coarse-grained filtering + Scale regular.)	27.47	2.16M	full model
w/o Scale Regularization (Coarse filtering only)	27.32	2.24M	Removing regularization increases Gaussians by 3.7% and decreases PSNR by 0.15
Fine-grained filtering instead of coarse	27.49	2.19M	Quality slightly improved but complex, optional
No filtering (original 3DGS)	25.18	5.91M	Defenseless, Gaussian count explodes
Clean images + defense (Clean+Ours+ReLU)	28.79	1.79M	Drops by only 0.3 dB on clean data, acceptable

Key Findings¶

Scale regularization loss is the most cost-effective design: adding only a single line of \(\text{ReLU}(\nu - \tau)\) computation consistently yields improvements in terms of Gaussian count, VRAM usage, and FPS, without affecting the normal functions of small spherical and large flat Gaussians. It is an extremely elegant regularization approach.
The performance drop of the defense on clean data is negligible (PSNR < 2%, SSIM < 3%), because the LL subband retains over 95% of the original energy, and the loss of high-frequency details has limited impact on the overall reconstruction quality. This is crucial in cloud deployment scenarios, where the quality of normal user requests should not be significantly degraded due to the addition of defenses.
As the attack intensity increases from 16/255 to 64/255, adversarial noise begins to penetrate low-frequency components (the matching rate drop in low frequencies increases from 2.4% to 19.3%). However, even under this extreme setting, DefenseSplat outperforms all baselines because high-frequency filtering still removes some perturbations. Nonetheless, the authors point out that excessively strong attacks (>64/255) exceed the range of human imperceptibility and are unlikely to occur in realistic threat models.

Highlights & Insights¶

Analyzing defenses using the wavelet transform is highly ingenious: DWT naturally provides a joint "spatial + frequency" representation, enabling both frequency-band decomposition to analyze perturbation distributions and precise reconstruction of spatial-domain images via iDWT. A single mathematical tool fulfills both analysis and defense roles without introducing any additional network overhead.
Leveraging 3DGS's own consistency and optimization as a second line of defense: The small amount of residual artifacts after coarse-grained filtering is automatically smoothed out by 3DGS's multi-view L1 loss. Instead of training an external denoising network, the authors "borrow" the physical properties of 3DGS optimization, yielding an exceptionally lightweight and clever system-level design.
Scale regularization in a ReLU form is a characteristic "one-line code fix": The normalized variance can be computed in just a few lines of PyTorch during backpropagation without relying on any external libraries. It accurately diagnoses and target "elongated Gaussians"—the critical pain point of defense effectiveness—without collateral damage to normal Gaussians, making the design clean and succinct.
Integrating the multi-view matching efficiency solution with TSP is intriguing: Modeling camera pose sequencing as a Traveling Salesperson Problem leverages a large and mature mathematical tool, optimizing the matching pipeline to O(n log n) complexity rather than brute-force O(n^2). This interdisciplinary philosophy is worth applying to other scenarios that require sequential multi-view data processing.

Limitations & Future Work¶

The paper only validates defense performance on Poison-Splat and its variant, Adaptive Attack. Although the authors state that high-frequency perturbation is a universal vulnerability of 3DGS attacks, if future attacks specifically bypass high-frequency filtering (e.g., injecting perturbations only in low frequencies or using physical-world attacks with adversarial textures), the current method may fail.
Coarse-grained filtering still incurs a 1.75% drop in PSNR on clean data, reflecting that the loss of high-frequency details is an inevitable cost. For tasks requiring fine texture reconstruction (such as digital cultural relics and high-fidelity facial reconstruction), this degradation may be unacceptable. While fine-grained filtering offers some improvement, its gains are limited and introduce additional complexity.
A systematic comparison with generic diffusion-model-based denoising methods is lacking. Since Difix3D+ is not designed purely for adversarial defense, future work could compare the performance of more advanced diffusion post-processing methods (e.g., DDRM, DiffPure) in 3DGS defense.
In essence, this method is a preprocessing-based defense that is decoupled from 3DGS training, and theoretically can serve as a plug-and-play module integrated into any 3DGS variant. However, this paper has not conducted experimental validation in this regard.

vs Poison-Splat: Poison-Splat is currently the strongest adversarial attack method against 3DGS, generating attacked images via bi-level optimization. DefenseSplat is the first defense method specifically designed for 3DGS, performing preprocessing directly in the frequency domain without relying on adversarial training or clean ground truth.
vs FreGS / 3D-GSW: FreGS and 3D-GSW also utilize frequency-domain analysis to improve 3DGS reconstruction quality (addressing over-reconstruction and guided splitting, respectively), but they are designed to enhance performance rather than defend against adversarial attacks. DefenseSplat borrows the same mathematical tool, DWT, but shifts the analytical focus from "reconstruction error" to "the frequency distribution of adversarial perturbations."
vs Traditional 2D Defenses (Gaussian Blur / Bilateral Filtering): Although traditional spatial-domain filtering can denoise, it blurs all edges indiscriminately. DefenseSplat preserves low-frequency structures in the LL subband via DWT, ensuring a more controllable impact on reconstruction quality, while leveraging multi-view consistency in 3DGS for secondary suppression.

Rating¶

Novelty: ⭐⭐⭐⭐ The first defense method against 3DGS. The perspective of applying DWT to adversarial perturbation analysis is novel, and the formulation of scale regularization is elegant yet simple in principle.
Experimental Thoroughness: ⭐⭐⭐⭐⭐ Conducts comprehensive comparisons across 3 standard datasets, various attack intensities, clean data, and adaptive attack variants. Detailed per-scene results are provided in the appendix, and ablation studies cover every key design component.
Writing Quality: ⭐⭐⭐⭐⭐ Clearly elaborates the motivation, presenting a complete logical flow from challenges and observations to solutions. The progression across the 3 layers (frequency-domain analysis → coarse filtering → scale regularization) is clear at a glance.
Value: ⭐⭐⭐⭐ Fills a void in 3DGS defense. The method is simple yet practical, making it suitable for direct integration into existing 3DGS pipelines. However, its generalizability might be restricted by attack types, requiring validation against more diverse attacks in the future.