ML Security PapersAdLift: Lifting Adversarial Perturbations to Safeguard 3D Gaussian Splatting Assets Against Instruction-Driven Editing
Ziming Hong 1, Tianyu Huang 1, Runnan Chen 1, Shanshan Ye 2, Mingming Gong 3,4, Bo Han 5, Tongliang Liu 1,4
Published on arXiv
2512.07247
Input Manipulation Attack
OWASP ML Top 10 — ML01
Key Finding
AdLift provides view-consistent and imperceptible adversarial protection of 3DGS assets, defeating state-of-the-art instruction-driven 2D and 3D editing pipelines across arbitrary novel viewpoints
AdLift (Lifted PGD)
Novel technique introduced
Recent studies have extended diffusion-based instruction-driven 2D image editing pipelines to 3D Gaussian Splatting (3DGS), enabling faithful manipulation of 3DGS assets and greatly advancing 3DGS content creation. However, it also exposes these assets to serious risks of unauthorized editing and malicious tampering. Although imperceptible adversarial perturbations against diffusion models have proven effective for protecting 2D images, applying them to 3DGS encounters two major challenges: view-generalizable protection and balancing invisibility with protection capability. In this work, we propose the first editing safeguard for 3DGS, termed AdLift, which prevents instruction-driven editing across arbitrary views and dimensions by lifting strictly bounded 2D adversarial perturbations into 3D Gaussian-represented safeguard. To ensure both adversarial perturbations effectiveness and invisibility, these safeguard Gaussians are progressively optimized across training views using a tailored Lifted PGD, which first conducts gradient truncation during back-propagation from the editing model at the rendered image and applies projected gradients to strictly constrain the image-level perturbation. Then, the resulting perturbation is backpropagated to the safeguard Gaussian parameters via an image-to-Gaussian fitting operation. We alternate between gradient truncation and image-to-Gaussian fitting, yielding consistent adversarial-based protection performance across different viewpoints and generalizes to novel views. Empirically, qualitative and quantitative results demonstrate that AdLift effectively protects against state-of-the-art instruction-driven 2D image and 3DGS editing.
Key Contributions
- First adversarial perturbation framework for protecting 3D Gaussian Splatting assets against instruction-driven diffusion editing, generalizing protection across arbitrary novel views
- Lifted PGD algorithm that combines gradient truncation at the rendered image level with image-to-Gaussian backpropagation to embed strictly bounded adversarial perturbations into 3D Gaussian parameters
- Empirical demonstration that AdLift provides view-consistent, imperceptible protection against state-of-the-art 2D and 3DGS instruction-driven editors
🛡️ Threat Analysis
AdLift crafts gradient-based adversarial perturbations (via Lifted PGD) targeting diffusion-based editing models — the perturbations disrupt the editing model's outputs across arbitrary viewpoints. The core technique is adversarial input manipulation used defensively against inference-time AI editing pipelines.