ML Security PapersPoInit-of-View: Poisoning Initialization of Views Transfers Across Multiple 3D Reconstruction Systems
Weijie Wang 1,2, Songlong Xing 1, Zhengyu Zhao 3, Nicu Sebe 1, Bruno Lepri 2
Published on arXiv
2604.16540
Input Manipulation Attack
OWASP ML Top 10 — ML01
Key Finding
Surpasses single-view baseline by 25.1% in PSNR and 16.5% in SSIM in black-box transfer settings from 3DGS to NeRF
PoInit-of-View
Novel technique introduced
Poisoning input views of 3D reconstruction systems has been recently studied. However, we identify that existing studies simply backpropagate adversarial gradients through the 3D reconstruction pipeline as a whole, without uncovering the new vulnerability rooted in specific modules of the 3D reconstruction pipeline. In this paper, we argue that the structure-from-motion (SfM) initialization, as the geometric core of many widely used reconstruction systems, can be targeted to achieve transferable poisoning effects across diverse 3D reconstruction systems. To this end, we propose PoInit-of-View, which optimizes adversarial perturbations to intentionally introduce cross-view gradient inconsistencies at projections of corresponding 3D points. These inconsistencies disrupt keypoint detection and feature matching, thereby corrupting pose estimation and triangulation within SfM, eventually resulting in low-quality rendered views. We also provide a theoretical analysis that connects cross-view inconsistency to correspondence collapse. Experimental results demonstrate the effectiveness of our PoInit-of-View on diverse 3D reconstruction systems and datasets, surpassing the single-view baseline by 25.1% in PSNR and 16.5% in SSIM in black-box transfer settings, such as 3DGS to NeRF.
Key Contributions
- Identifies SfM initialization as a transferable attack vector across diverse 3D reconstruction systems
- Optimizes adversarial perturbations to introduce cross-view gradient inconsistencies at projections of 3D points
- Achieves transferable poisoning effects, surpassing single-view baselines by 25.1% PSNR and 16.5% SSIM in black-box settings
🛡️ Threat Analysis
Crafts adversarial perturbations on input images that cause misclassification/corruption at inference time in 3D reconstruction systems, specifically targeting keypoint detection and feature matching to degrade rendered view quality.