PatchPoison: Poisoning Multi-View Datasets to Degrade 3D Reconstruction Prajas Wadekar
Venkata Sai Pranav Bachina* Kunal Bhosikar* Ankit Gangwal Charu Sharma
International Institute of Information Technology, Hyderabad, India {prajas.wadekar, kunal.bhosikar}@research.iiit.ac.in
arXiv:2604.13153v1 [cs.CV] 14 Apr 2026
{gangwal, charu.sharma}@iiit.ac.in
Figure 1. Clean vs. poisoned 3DGS reconstructions on the NeRF-Synthetic dataset. Quantitative performance drops significantly due to corrupted feature matching, which reduces valid feature correspondences used during reconstruction.
Abstract 3D Gaussian Splatting (3DGS) has recently enabled highly photorealistic 3D reconstruction from casually captured multi-view images. However, this accessibility raises a privacy concern: publicly available images or videos can be exploited to reconstruct detailed 3D models of scenes or objects without the owner’s consent. We present PatchPoison, a lightweight dataset-poisoning method that prevents unauthorized 3D reconstruction. Unlike global perturbations, PatchPoison injects a small high-frequency adversarial patch, a structured checkerboard, into the periphery of each image in a multi-view dataset. The patch is designed to corrupt the feature-matching stage of Structurefrom-Motion (SfM) pipelines such as COLMAP by introduc* Equal contribution. Accepted at 1st IEEE/CVF CVPR Workshop on Security, Privacy, and Adversarial Robustness in 3D Generative Vision Models (SPAR-3D), 2026.
ing spurious correspondences that systematically misalign estimated camera poses. Consequently, downstream 3DGS optimization diverges from the correct scene geometry. On the NeRF-Synthetic benchmark, inserting a 12 × 12 pixel patch increases reconstruction error by 6.8× in LPIPS, while the poisoned images remain unobtrusive to human viewers. PatchPoison requires no pipeline modifications, offering a practical, “drop-in” preprocessing step for content creators to protect their multi-view data.
1. Introduction The rapid progress of neural 3D reconstruction has made it increasingly easy to convert a collection of casually captured photographs into a high-fidelity 3D model. Modern approaches such as Neural Radiance Fields (NeRF) [12] and 3DGS [8] can reconstruct photorealistic scenes from a short video or a small set of multi-view images. As a result,
a simple video walkthrough of a room, a person, or a physical object can now be used to reconstruct a detailed and renderable 3D representation of the scene. While this capability enables many creative and industrial applications, it also introduces a privacy risk: publicly shared images or videos can be silently repurposed to reconstruct a 3D model of a scene or person without the knowledge or consent of the content owner. Existing approaches to protecting 3D assets typically operate on protecting the 3DGS model, not the dataset. For example, watermarking and steganography methods [6, 16, 19] embed ownership signals directly into a trained 3DGS representation, implicitly assuming that reconstruction has already taken place. Other works explore poisoning attacks on the training process itself [5, 11], which require access to or participation in the model training pipeline making them less practical in real-world settings where such access is restricted or unavailable. Other Gaussian splatting pipelines like TGC-based geometric cloak [15] take in a single image and use Triplane Gaussian splatting to prevent reconstruction using triplane gaussian splatting by making the renders shape a specific way. These methods are designed for single-image inputs and do not extend to multi-view settings. None of these methods protect already shared multiview images. Most modern neural reconstruction systems, including NeRF and 3DGS, follow a canonical two-stage pipeline. First, a SfM stage estimates camera poses and a sparse scene structure by extracting keypoints and matching features across images [14]. In practice, this step is commonly performed using systems such as COLMAP [13]. Second, a per-scene optimization stage fits a scene representation, either a neural radiance field or a set of 3D Gaussian primitives, to reproduce the input views given the estimated camera poses. This dependency creates a critical vulnerability: if the camera poses estimated during the SfM stage are incorrect, the downstream reconstruction stage cannot recover a coherent scene representation. Consequently, we identify this dependency as a critical vulnerability that can be leveraged for privacy protection. In this work, we instead intervene earlier in the pipeline by poisoning the multi-view image dataset [1] itself. Our key observation is that the feature-matching stage of SfM pipelines such as COLMAP is highly sensitive to repetitive high-frequency patterns. By inserting a small checkerboard patch at a fixed corner of every image in the dataset, we introduce a dense set of artificial keypoints that are consistently detected across views. Because these patchinduced keypoints appear at identical image coordinates in every view, the feature matcher establishes strong but incorrect correspondences between them. These correspondences are geometrically inconsistent with the true scene structure, causing bundle adjustment to estimate severely
distorted camera poses. Once the camera poses are corrupted, downstream neural reconstruction methods such as NeRF or 3DGS fail to recover a coherent scene representation. Importantly, the patch occupies only a tiny portion of each image, making the poisoned dataset visually indistinguishable from the original to human observers. Contributions. Our contributions are: 1. We identify the feature-matching stage of SfM pipelines as a practical stage for protecting multi-view datasets from unauthorized 3D reconstruction. 2. We propose PatchPoison, a lightweight datasetpoisoning method that inserts a small checkerboard patch to corrupt camera pose estimation and degrade reconstruction while preserving visual fidelity. 3. We demonstrate experimentally that a patch as small as 12 × 12 pixels can significantly degrade 3DGS reconstruction while remaining visually imperceptible in the poisoned images.
2. Related Works Neural 3D Reconstruction Pipelines. Modern approaches to multi-view 3D reconstruction aim to recover photorealistic scene representations from collections of images. NeRF [12] represents scenes as continuous volumetric radiance fields parameterized by a multilayer perceptron and render novel views through differentiable volume rendering, while subsequent work such as Mip-NeRF 360 [1] improves reconstruction quality for large and unbounded scenes. More recently, 3DGS [8] replaces implicit neural representations with explicit anisotropic 3D Gaussians that can be efficiently rasterized to achieve real-time rendering and high-fidelity reconstruction. Despite their differences in representation, these methods rely on a similar preprocessing pipeline to estimate camera poses and sparse geometry from input images. In practice, SfM systems such as COLMAP [13], building upon classical multi-view reconstruction pipelines [14], are widely used for camera calibration prior to neural optimization. Recent learning-based alternatives such as DUSt3R [17] and MASt3R [9] attempt to replace traditional feature matching with learned dense correspondences, suggesting potential future directions for extending reconstruction attacks to learning-based pose estimation pipelines. Adversarial Attacks on 3D Representations. Several works have explored adversarial attacks targeting neural 3D representations and rendering systems. Poison-Splat [11] introduces a poisoning strategy that maximizes Total Variation in reconstructed scenes, causing excessive densification and dramatically increasing the computational cost of 3DGS training. Other work investigates attacks on the behavior of trained models, such as GaussTrap [5], which
implants viewpoint-triggered backdoors into 3DGS models, and IPA-NeRF [7], which optimizes adversarial perturbations over training views to degrade novel-view synthesis. Additional research explores adversarial manipulation of reconstructed 3D models themselves; for example, Gaussian Splatting Under Attack [18] introduces adversarial perturbations that significantly degrade CLIP-based recognition on rendered views. While these approaches target the training process, rendering behavior, or downstream recognition tasks, they assume access to the reconstruction or training pipeline. In contrast, our work operates purely at the dataset level and aims to corrupt the upstream pose estimation stage used by standard reconstruction pipelines. Physical and Patch-Based Attacks on Reconstruction. Another line of work studies physical adversarial patterns designed to interfere with camera pose estimation during image capture. The Kaleidoscopic Background Attack (KBA) [4] introduces specially designed visual patterns placed in the scene background that disrupt feature matching and degrade reconstruction quality. While conceptually related to our approach, such attacks require printing and physically placing adversarial objects in the scene prior to image capture, and the resulting patterns are visually conspicuous. In contrast, our method operates digitally on already-captured multi-view images and introduces only a small patch occupying a tiny region of the image, making the perturbation unobtrusive to human observers. Watermarking and Protection of 3D Assets. Another direction of research focuses on protecting the ownership of reconstructed 3D assets through watermarking or steganography. Methods such as GS-Hider [19] and GaussianStego [10] embed hidden messages within trained 3DGS models, while other approaches including WATERGS [16], GaussianMarker [6], and GuardSplat [3] insert digital watermarks to enable ownership verification of reconstructed scenes. Geometry Cloak [15] integrates watermark in such way that the rendered 3D model from a single image displays a pattern if viewed from a particular view. However, these approaches assume that the 3D reconstruction has already been created. In contrast, our method prevents unauthorized reconstruction by poisoning the multiview dataset.
3. Background Modern neural 3D reconstruction pipelines typically follow a two-stage process consisting of camera pose estimation from images followed by scene representation optimization. In this section we briefly review the components of this pipeline that are relevant to our technique.
3.1. Structure-from-Motion (SfM) Given a set of images I = {Ii }N i=1 , SfM estimates camera parameters and a sparse scene structure by identifying visual correspondences across images. Systems such as COLMAP [13] first detect local features (e.g., SIFT keypoints) in each image and match them across image pairs using descriptor similarity. These matches are filtered through geometric verification (typically using RANSAC) to remove inconsistent correspondences. The remaining matches are then used to estimate camera poses and triangulate 3D points. A global bundle adjustment step jointly refines camera poses and 3D points by minimizing reprojection error across all observations.
3.2. Neural Reconstruction from Known Poses Once camera poses have been estimated, neural reconstruction methods optimize a scene representation to reproduce the input views. NeRF [12] model the scene as a continuous radiance field parameterized by a neural network, while 3DGS [8] represents the scene as a collection of anisotropic 3D Gaussians that are efficiently rasterized during rendering. Both approaches assume that camera poses are known and accurate. During training, the scene parameters are optimized so that rendered images from the estimated camera poses match the original input images.
3.3. Sensitivity to Pose Errors The success of neural reconstruction critically depends on the accuracy of the camera poses estimated by SfM. If incorrect feature correspondences are introduced during the matching stage, the resulting bundle adjustment optimization may produce inconsistent or distorted camera poses. Because neural reconstruction methods rely on these poses to establish geometric consistency between views, such pose errors propagate directly to the final reconstruction, often leading to distorted geometry or optimization failure. This makes SfM feature matching a natural attack surface for poisoning.
4. Methodology 4.1. Problem Formulation Let I = {Ii }N i=1 be a clean multi-view image dataset captured from camera poses C1 = {Ci }N i=1 . A Structure-fromMotion pipeline Φ estimates camera poses from the dataset: Cˆ1 = Φ(I). A reconstruction module R then produces a scene representation G1 = R(I, Cˆ1 ). Our goal is to construct a poisoned dataset I ∗ = {Ii∗ }N i=1 such that: D(Ii , Ii∗ ) ≈ 0 ∗
∀i ∗
D R(I , Φ(I )), G1 ) ≫ ϵ
(1) (2)
where Eq. (1) enforces imperceptibility of the perturbation, and Eq. (2) enforces reconstruction degradation. The distance function D(·) measures perceptual similarity using metrics such as SSIM, PSNR, and LPIPS.
4.2. Pipeline Targeting the SfM stage. COLMAP’s reconstruction pipeline consists of feature extraction (e.g., SIFT), feature matching, geometric verification (RANSAC), and bundle adjustment. Among these stages, feature matching is particularly vulnerable: it relies on local appearance descriptors to establish correspondences between images. Patterns that generate strong, repeatable high-frequency responses can produce consistent but incorrect matches across views.
camera poses. We measure reconstruction quality by comparing rendered images against the poisoned inputs: cost1 = SSIM(I ∗ , R(G2 , C2 )), PSNR(·), LPIPS(·) (4) which should be low, indicating poor reconstruction quality. Imperceptibility (cost2 ). We measure visual similarity between clean and poisoned datasets as: cost2 = SSIM(I, I ∗ ), PSNR(·), LPIPS(·) (5) which should be high, ensuring that perturbations remain visually imperceptible.
5. Experiments Patch-induced spurious correspondences. A checkerboard pattern contains dense high-frequency structures that produce numerous corner-like keypoints with strong descriptor responses. When the same patch is inserted at a fixed image location across all views, these patch-induced keypoints appear consistent across images and are matched with high confidence by the SfM pipeline. However, these correspondences are not associated with any real 3D structure in the scene and therefore violate geometric consistency constraints (e.g., epipolar geometry). As a result, bundle adjustment attempts to reconcile incompatible constraints, leading to incorrect or unstable camera pose estimates. These corrupted poses subsequently cause downstream neural reconstruction methods such as 3D Gaussian Splatting to fail or produce distorted geometry (Fig. 2). Patch construction. Given an image Ii ∈ RH×W ×3 , we generate a checkerboard patch M ∈ {0, 1}P ×P with block size b pixels. The patch is placed at a fixed corner of the image and blended with strength α ∈ [0, 1]. The poisoned image is defined as: Ii∗ = Ii ⊙ (1 − αMΩ ) + αMΩ ,
(3)
where MΩ denotes the patch embedded in region Ω and zero elsewhere. The patch is deterministic and parameterized by (P, b, α, ∆c). In practice, we choose parameters such that the patch occupies a small fraction of the image while still inducing strong feature responses.
4.3. Evaluation Protocol We evaluate the effectiveness of the attack using two complementary criteria. Reconstruction degradation (cost1 ). Let G2 = R(I ∗ , Φ(I ∗ )) be the reconstructed scene from the poisoned dataset, and let C2 = Φ(I ∗ ) be the corresponding
5.1. Setup Datasets. We evaluate PatchPoison on the NeRFSynthetic [12] dataset and the Mip-NeRF 360 [1] dataset, covering both object-centric scenes and complex real-world unbounded environments. Reconstruction pipeline. We use the official 3D Gaussian Splatting implementation [8] with COLMAP for camera pose estimation. All models are trained for 30,000 iterations using default hyperparameters. Baselines. As no prior work studies dataset poisoning for multi-view reconstruction, we compare PatchPoison against a range of standard baselines: (i) a clean dataset, representing an upper bound on reconstruction quality; (ii) geometric transformations of the input images, including rotations, scaling, shearing, and translational shifts; and (iii) image perturbations such as Gaussian blur, Gaussian noise, and JPEG compression. Metrics. We evaluate reconstruction quality by comparing rendered images from the reconstructed scene against the poisoned inputs (Poisoned vs Render), and imperceptibility by comparing poisoned images against the original inputs (Poisoned vs Original). We report SSIM, PSNR, and LPIPS, averaged over three independent runs.
5.2. Ablations We systematically analyze the design choices of PatchPoison to understand which factors contribute most to reconstruction degradation while preserving imperceptibility. Patch size. We vary the patch size P ∈ {12, 24, 48, 76, 100, 148, 200} pixels on 800 × 800 images, corresponding to approximately 1.5% to 25% of the image width.
Figure 2. PatchPoison pipeline. A small high-frequency patch inserted into each image induces spurious feature correspondences during Structure-from-Motion, leading to incorrect camera pose estimation and degraded 3D Gaussian Splatting reconstruction.
Spatial frequency. We control the frequency of the checkerboard pattern via the block size b ∈ {1, 2, 4, 8, 10, 16, 20, 25, 50} pixels. Color contrast. We vary the intensity difference between bright and dark regions of the checkerboard using ∆c ∈ {5, 10, 25, 50, 75, 100, 125, 150, 175, 200}. Alpha blending. We control patch visibility using blending strength α ∈ {5, 10, . . . , 255}/255. Pattern type. We evaluate different pattern structures, including checkerboards, lines, circles, and their combinations, to analyze how their geometric layout and spatial frequency affect feature detection and matching. Poisoning ratio. We vary the fraction of poisoned training images from 5% to 100% to evaluate the robustness of the method under partial poisoning.
6. Results For all experiments, we evaluate our approach using two primary criteria: reconstruction quality and imperceptibility. Reconstruction quality (Poisoned vs. Render) measures the fidelity of the model’s output, computed as the reconstruction cost between the rendered images and the poisoned training dataset containing the high-frequency patch. Imperceptibility (Poisoned vs. Original) quantifies the stealthiness of the modification by calculating the difference between the poisoned images and the clean, original
dataset. Results on the NeRF-Synthetic dataset are averaged across all eight scenes. In cases where the poisoned and original images remain identical, the Peak Signal-to-Noise Ratio (PSNR) is infinite. Overview. PatchPoison consistently degrades reconstruction quality while preserving visual fidelity of the input images. Even small perturbations significantly disrupt the reconstruction pipeline by corrupting feature correspondences, while remaining nearly imperceptible. Why checkerboard patterns are effective. SIFT detects scale-space extrema in the Difference-of-Gaussian pyramid. A checkerboard pattern with block size b = 4–8 pixels generates dense high-contrast extrema at the native image scale, producing distinctive descriptors. Since the patch is placed at identical pixel locations across all views, these descriptors match with very high confidence, dominating the matching stage. These correspondences are geometrically inconsistent, causing bundle adjustment to fail and yielding distorted reconstructions (Fig. 3).
6.1. Effect of Patch Size Table 1 shows the effect of patch size on reconstruction degradation and imperceptibility. Even very small patches (12 × 12 pixels) significantly degrade reconstruction quality (SSIM drops from 0.969 to 0.793). As patch size increases, degradation initially improves; however, for very large patches (e.g., 200 pixels), performance partially recovers because the model begins to reconstruct the checkerboard pattern itself.
Poisoned vs Render Scene
SSIM↑
Poisoned vs Original
PSNR↑
LPIPS↓
SSIM↓
PSNR↓
LPIPS↑
1.000 1.000 1.000 1.000 1.000 1.000 1.000 1.000
inf inf inf inf inf inf inf inf
0.000 0.000 0.000 0.000 0.000 0.000 0.000 0.000
0.983 0.983 0.983 0.983 0.983 0.983 0.983 0.983
21.07 21.07 21.07 21.07 21.07 21.07 21.07 21.07
0.027 0.026 0.027 0.026 0.026 0.027 0.026 0.021
Clean Baseline chair drums ficus hotdog lego materials mic ship
0.990 ± 0.000 0.966 ± 0.000 0.993 ± 0.000 0.989 ± 0.000 0.965 ± 0.001 0.957 ± 0.000 0.981 ± 0.000 0.912 ± 0.000
chair drums ficus hotdog lego materials mic ship
0.798 ± 0.002 0.799 ± 0.001 0.862 ± 0.001 0.735 ± 0.008 0.679 ± 0.001 0.752 ± 0.005 0.872 ± 0.004 0.690 ± 0.009
33.54 ± 0.00 27.91 ± 0.00 35.90 ± 0.10 37.58 ± 0.01 32.72 ± 0.02 29.64 ± 0.02 35.00 ± 0.09 31.42 ± 0.00
0.023 ± 0.000 0.057 ± 0.000 0.010 ± 0.000 0.025 ± 0.000 0.051 ± 0.001 0.076 ± 0.000 0.036 ± 0.001 0.124 ± 0.000
Poisoned (size 100 , block size 4) 13.19 ± 0.07 15.40 ± 0.10 18.46 ± 0.08 15.28 ± 0.08 12.49 ± 0.19 16.13 ± 0.15 18.95 ± 0.39 19.63 ± 0.18
0.346 ± 0.001 0.359 ± 0.003 0.185 ± 0.001 0.424 ± 0.001 0.485 ± 0.007 0.384 ± 0.005 0.288 ± 0.001 0.452 ± 0.005
Table 2. Per-scene reconstruction and imperceptibility metrics on NeRF-Synthetic, comparing clean and poisoned data (patch size 100) over 3 runs.
Block Size
Figure 3. Qualitative evaluation on the NeRF-Synthetic dataset. These renders are generated from the poisoned images, illustrating the structural degradation and severe visual artifacts introduced by the PatchPoison attack across multiple views. We omit views that resulted in entirely black renders, which constituted the majority of the overall outputs. Patch Size clean 12 24 48 76 100 148 200
Poisoned vs Render
clean 1 2 4 6 8 10 16 25 50
Poisoned vs Render
Poisoned vs Original
SSIM↓
PSNR↓
LPIPS↑
SSIM↑
PSNR↑
LPIPS↓
0.969 ± 0.026 0.952 ± 0.029 0.953 ± 0.027 0.788 ± 0.106 0.751 ± 0.068 0.828 ± 0.131 0.795 ± 0.065 0.850 ± 0.071 0.842 ± 0.103 0.815 ± 0.150
32.97 ± 3.26 20.63 ± 0.34 20.62 ± 0.32 16.75 ± 4.54 14.66 ± 3.14 17.75 ± 3.16 16.80 ± 3.48 18.80 ± 1.75 18.30 ± 3.03 17.98 ± 5.66
0.050 ± 0.035 0.073 ± 0.038 0.080 ± 0.035 0.342 ± 0.154 0.398 ± 0.096 0.268 ± 0.195 0.348 ± 0.096 0.244 ± 0.116 0.251 ± 0.146 0.309 ± 0.232
1.000 0.983 0.983 0.983 0.983 0.983 0.984 0.985 0.988 0.990
inf 21.07 21.07 21.07 21.07 21.07 21.07 21.07 21.07 21.07
0.000 0.022 0.031 0.026 0.025 0.026 0.028 0.028 0.026 0.022
Poisoned vs Original
SSIM↓
PSNR↓
LPIPS↑
SSIM↑
PSNR↑
LPIPS↓
0.969 ± 0.026 0.793 ± 0.106 0.798 ± 0.110 0.775 ± 0.091 0.809 ± 0.101 0.773 ± 0.072 0.770 ± 0.075 0.774 ± 0.117
32.96 ± 3.26 18.06 ± 5.82 18.32 ± 5.82 16.91 ± 3.06 17.42 ± 4.80 16.19 ± 2.64 15.75 ± 3.25 16.32 ± 6.51
0.050 ± 0.035 0.336 ± 0.147 0.322 ± 0.155 0.354 ± 0.121 0.302 ± 0.165 0.365 ± 0.096 0.374 ± 0.106 0.348 ± 0.163
1.000 0.9996 0.9988 0.9958 0.9900 0.9831 0.9639 0.9350
inf 39.03 33.47 27.45 23.44 21.07 17.69 15.14
0.000 0.0016 0.0036 0.0083 0.0163 0.0259 0.0468 0.0738
Table 1. Reconstruction Degradation and Imperceptibility for different scenes in the NeRF-Synthetic dataset with different sizes of adversarial patch.
Imperceptibility decreases monotonically with patch size, highlighting that smaller patches provide the best trade-off between effectiveness and stealth. Table 2 shows consistent degradation across all scenes, demonstrating robustness of the attack.
6.2. Effect of Spatial Frequency Table 3 evaluates the effect of block size. Very small blocks (b = 1, 2) are ineffective because the pattern resembles noise and is often ignored by feature detectors. Moderate frequencies (b = 4) produce the strongest degradation, as they generate stable, repeatable keypoints that dominate feature matching and introduce spurious correspondences.
Table 3. Reconstruction degradation and imperceptibility across different checkerboard block sizes (frequency of the pattern) for NeRF-Synthetic Dataset.
Variant All Patterns Checkerboard + Circles Checkerboard + Diagonal Lines Checkerboard Only Circles Only Diagonal Lines + Circles Diagonal Lines Only Intersecting Lines Parallel Lines
Poisoned vs Render
Poisoned vs Original
SSIM↑
PSNR↑
LPIPS↓
SSIM↓
PSNR↓
LPIPS↑
0.822 ± 0.053 0.809 ± 0.088 0.820 ± 0.078 0.801 ± 0.094 0.878 ± 0.115 0.859 ± 0.095 0.773 ± 0.096 0.809 ± 0.102 0.956 ± 0.032
18.97 ± 1.96 17.98 ± 3.10 18.49 ± 1.82 16.91 ± 3.53 23.89 ± 6.66 21.24 ± 4.68 17.47 ± 4.81 19.00 ± 6.20 30.33 ± 2.93
0.294 ± 0.074 0.304 ± 0.132 0.291 ± 0.113 0.324 ± 0.146 0.190 ± 0.155 0.230 ± 0.143 0.353 ± 0.133 0.314 ± 0.144 0.073 ± 0.046
0.983 0.983 0.983 0.983 0.996 0.986 0.987 0.996 0.991
21.23 21.02 21.29 21.07 33.50 30.00 32.45 34.97 36.00
0.026 0.027 0.026 0.026 0.016 0.023 0.022 0.016 0.015
Table 4. Reconstruction quality and imperceptibility across different synthetic patterns variants on NeRF-Synthetic scenes.
6.3. Effect of Pattern Type Table 4 compares different pattern structures. Checkerboard patterns achieve the strongest degradation, confirming that dense corner-like structures are most effective at generating consistent but incorrect correspondences. Other patterns such as lines or circles are less effective due to weaker feature responses. Figure 4 shows how the different patches look like.
Poison (%) clean 5 10 25 50 75 100
Poisoned vs Render
Poisoned vs Original
SSIM↓
PSNR↓
LPIPS↑
SSIM↑
PSNR↑
LPIPS↓
0.969 ± 0.026 0.967 ± 0.028 0.937 ± 0.095 0.857 ± 0.138 0.762 ± 0.082 0.782 ± 0.113 0.761 ± 0.084
32.97 ± 3.26 32.08 ± 3.15 29.68 ± 7.85 22.47 ± 6.11 15.16 ± 3.68 16.54 ± 5.91 15.68 ± 3.43
0.050 ± 0.035 0.054 ± 0.038 0.106 ± 0.167 0.222 ± 0.198 0.386 ± 0.096 0.352 ± 0.168 0.378 ± 0.102
1.000 0.9992 0.9983 0.9958 0.9915 0.9873 0.9831
inf inf inf inf inf inf 21.07
0.000 0.0013 0.0026 0.0065 0.0129 0.0194 0.0258
Table 7. Reconstruction quality and imperceptibility under varying poisoning levels with limited training data on NeRF-Synthetic scenes, reported as mean ± std across scenes. Figure 4. Examples of synthetic pattern variants evaluated. Kernel Size
Alpha clean 0.001 0.1 0.25 0.5 0.75 1
Poisoned vs Render
Poisoned vs Original
SSIM↓
PSNR↓
LPIPS↑
SSIM↑
PSNR↑
LPIPS↓
0.969 ± 0.026 0.970 ± 0.029 0.783 ± 0.073 0.774 ± 0.070 0.770 ± 0.064 0.787 ± 0.089 0.803 ± 0.084
32.97 ± 3.26 33.26 ± 3.67 17.49 ± 2.48 16.57 ± 3.49 16.37 ± 3.47 16.95 ± 2.88 17.05 ± 4.60
0.050 ± 0.035 0.050 ± 0.039 0.349 ± 0.096 0.364 ± 0.097 0.374 ± 0.088 0.344 ± 0.133 0.321 ± 0.138
1.000 1.000 0.984 0.984 0.983 0.983 0.983
inf inf 40.89 33.07 27.05 23.58 21.07
0.000 0.000 0.015 0.019 0.023 0.025 0.026
Table 5. Reconstruction quality and imperceptibility across different transparency value for the data on NeRF-Synthetic scenes, reported as mean ± std across scenes. White clean 5 10 25 50 100 200 255
Poisoned vs Render
Poisoned vs Render
3 7 11 21
Poisoned vs Original
SSIM↑
PSNR↑
LPIPS↓
SSIM↓
PSNR↓
LPIPS↑
0.980 ± 0.017 0.987 ± 0.011 0.991 ± 0.010 0.998 ± 0.001
37.45 ± 5.14 40.60 ± 5.57 43.83 ± 7.19 48.21 ± 5.94
0.031 ± 0.025 0.022 ± 0.020 0.016 ± 0.020 0.006 ± 0.010
0.978 0.940 0.913 0.857
33.76 29.91 28.29 25.87
0.069 0.149 0.190 0.265
Table 8. Reconstruction quality and imperceptibility across different Gaussian blur kernel sizes for NeRF-Synthetic scenes. Values represent mean ± std across scenes. Stddev 5 10 25 50
# of scenes 8 8 7 4
Poisoned vs Render
Poisoned vs Original
SSIM↑
PSNR↑
LPIPS↓
SSIM↓
PSNR↓
LPIPS↑
0.851 ± 0.027 0.649 ± 0.029 0.321 ± 0.044 0.260 ± 0.207
31.48 ± 2.44 28.57 ± 1.34 22.86 ± 0.93 17.68 ± 1.43
0.151 ± 0.029 0.351 ± 0.029 0.599 ± 0.094 0.686 ± 0.346
0.691 0.372 0.133 0.070
36.57 30.39 22.36 16.49
0.105 0.316 0.647 0.895
Poisoned vs Original
SSIM↓
PSNR↓
LPIPS↑
SSIM↑
PSNR↑
LPIPS↓
0.969 ± 0.026 0.964 ± 0.028 0.958 ± 0.029 0.795 ± 0.104 0.781 ± 0.073 0.805 ± 0.080 0.781 ± 0.068 0.772 ± 0.080
32.97 ± 3.26 33.41 ± 3.54 33.43 ± 4.22 18.62 ± 5.28 17.18 ± 3.54 18.80 ± 2.91 16.58 ± 3.29 16.18 ± 3.30
0.050 ± 0.035 0.050 ± 0.038 0.056 ± 0.040 0.331 ± 0.152 0.357 ± 0.102 0.310 ± 0.120 0.360 ± 0.094 0.366 ± 0.106
1.000 0.992 0.987 0.984 0.984 0.983 0.983 0.983
inf 55.11 49.15 41.23 35.22 29.20 23.18 21.07
0.000 0.003 0.008 0.014 0.018 0.021 0.025 0.026
Table 6. Reconstruction quality and imperceptibility across different white values which represents the color difference between the checkerboard pattern for NeRF-Synthetic scenes.
6.4. Effect of Color Contrast and Transparency Table 5 shows that even low transparency (α = 0.1) is sufficient to significantly degrade reconstruction while maintaining high imperceptibility. Increasing α provides limited additional degradation but reduces visual similarity. Table 6 shows that low contrast values fail to disrupt reconstruction, while moderate contrast (∆c = 25) achieves a good balance. Higher contrast improves attack consistency across scenes but reduces imperceptibility.
6.5. Effect of Training Data Volume Table 7 shows that PatchPoison remains effective even when only 50% of the dataset is poisoned. At lower poisoning rates (e.g., 25%), the attack shows higher variance, indicating inconsistent degradation.
Table 9. Reconstruction quality and imperceptibility across different Gaussian noise standard deviations for NeRF-Synthetic scenes. Values represent mean ± std across scenes. Transform Rotation (15◦ ) Rotation (30◦ ) Rotation (45◦ ) Random Rotation (±45◦ ) Shear X (0.2) Shear XY (0.15) Shear Y (0.2) Random Shear XY (±0.3)
# of scenes 8 8 8 8 8 8 8 7
Poisoned vs Render
Poisoned vs Original
SSIM↑
PSNR↑
LPIPS↓
SSIM↓
PSNR↓
LPIPS↑
0.974 ± 0.023 0.978 ± 0.021 0.972 ± 0.023 0.972 ± 0.024 0.923 ± 0.061 0.918 ± 0.059 0.923 ± 0.055 0.911 ± 0.046
34.88 ± 4.46 35.82 ± 4.03 34.39 ± 4.22 34.53 ± 4.39 28.25 ± 7.38 27.58 ± 7.83 27.61 ± 6.47 24.65 ± 4.06
0.045 ± 0.033 0.038 ± 0.029 0.046 ± 0.033 0.047 ± 0.034 0.110 ± 0.076 0.118 ± 0.076 0.110 ± 0.073 0.143 ± 0.063
0.732 0.690 0.666 0.724 0.699 0.687 0.693 0.670
15.33 14.01 13.42 15.33 14.45 13.95 14.12 13.89
0.288 0.369 0.411 0.300 0.339 0.365 0.348 0.380
Table 10. Reconstruction quality and imperceptibility across different geometric transformations for NeRF-Synthetic scenes. Values represent mean ± std across scenes.
6.6. Comparison with Baselines We compare PatchPoison against Gaussian blur, Gaussian noise, geometric transformations, and JPEG compression. Gaussian blur (Table 8) preserves reconstruction quality, indicating that smoothing does not disrupt feature matching. Table 9 shows that gaussian noise degrades reconstruction but significantly reduces imperceptibility, making it visually noticeable. Geometric transformations (Table 10) do not significantly affect reconstruction, as SfM remains robust to such transformations. JPEG compression (Table 11) produces only marginal degradation. In contrast, PatchPoison uniquely achieves strong reconstruction degradation while maintaining high visual similarity, as illustrated in Fig. 5.
Quality 10 25 50 75
Poisoned vs Render
Poisoned vs Original
SSIM↑
PSNR↑
LPIPS↓
SSIM↓
PSNR↓
LPIPS↑
0.958 ± 0.024 0.959 ± 0.023 0.961 ± 0.025 0.963 ± 0.026
33.39 ± 2.97 32.70 ± 2.61 32.86 ± 3.52 32.26 ± 2.97
0.070 ± 0.056 0.058 ± 0.032 0.054 ± 0.033 0.055 ± 0.037
0.920 0.945 0.958 0.969
30.08 32.61 34.63 36.96
0.093 0.046 0.025 0.012
Table 11. Reconstruction quality and imperceptibility across different JPEG compression quality levels for NeRF-Synthetic scenes. Values represent mean ± std across scenes.
Figure 6. Results on Mip-NeRF 360 scenes. In structured scenes such as bicycle, PatchPoison introduces visible distortions. In complex natural scenes such as garden, the patch blends into the background, reducing visual artifacts while still increasing reconstruction error.
MUST3R [2]) that avoid explicit keypoint matching may be more resilient. This suggests that future work should explore adaptive or content-aware poisoning strategies.
Figure 5. Trade-off between reconstruction degradation and imperceptibility. An effective method should lie in the bottomright region. PatchPoison achieves this optimal balance, while baselines either fail to degrade reconstruction or introduce visible artifacts. Patch 2% 6% 12.5% 25%
Poisoned vs Render
GT vs Poisoned
SSIM↑
PSNR↑
LPIPS↓
SSIM↓
PSNR↓
LPIPS↑
0.923 ± 0.035 0.878 ± 0.104 0.876 ± 0.076 0.752 ± 0.204
30.57 ± 1.66 25.75 ± 2.05 21.50 ± 0.99 15.58 ± 1.88
0.119 ± 0.039 0.164 ± 0.103 0.161 ± 0.069 0.309 ± 0.286
0.982 0.979 0.961 0.893
36.37 27.44 21.10 15.07
0.008 0.014 0.034 0.110
Table 12. Reconstruction quality and imperceptibility aggregated across scenes for different patch sizes in terms of % of the width of the image. Values represent mean ± std across scenes in the MIP-360 dataset.
6.7. Generalization to Real-World Scenes Table 12 evaluates PatchPoison on the Mip-NeRF 360 dataset. While quantitative metrics indicate degradation similar to synthetic scenes, visual inspection reveals that the patch often blends into natural backgrounds, reducing its effectiveness. Figure 6 shows our results on Mip-NeRF 360. Limitation. PatchPoison is less effective in complex realworld scenes with rich textures, where the patch becomes less distinguishable from the background (Fig. 6). Learning-based SfM methods (DUSt3R [17], MASt3R [9],
Ethical considerations. PatchPoison is intended as a tool for content owners to protect multi-view imagery from unauthorized 3D reconstruction. We do not condone its misuse in harmful or deceptive contexts. The release of code will be accompanied by an access policy consistent with responsible disclosure norms.
7. Conclusion We have presented PatchPoison, a simple and effective method for poisoning multi-view image datasets to prevent unauthorized 3D reconstruction with NeRF and 3D Gaussian Splatting. By injecting a small high-frequency checkerboard patch at a fixed corner of each image, PatchPoison corrupts the feature matching stage of COLMAP, leading to misaligned camera poses and severely degraded reconstructions. Crucially, the poisoned images remain visually indistinguishable from the originals by human observers. Extensive experiments across 8 scenes demonstrate consistent effectiveness with a patch as small as 12×12 pixels less than 0.03% of the image area while maintaining poisoned-image fidelity above SSIM = 0.999. PatchPoison operates as a lightweight post-processing step requiring no access to the reconstruction pipeline, making it immediately deployable by content creators.
References [1] Jonathan T. Barron, Ben Mildenhall, Dor Verbin, Pratul P. Srinivasan, and Peter Hedman. Mip-NeRF 360: Unbounded anti-aliased neural radiance fields. In IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2022. 2, 4
[2] Yohann Cabon, Lucas Stoffl, Leonid Antsfeld, Gabriela Csurka, Boris Chidlovskii, Jerome Revaud, and Vincent Leroy. Must3r: Multi-view network for stereo 3d reconstruction. In CVPR, 2025. 8 [3] Zixuan Chen, Guangcong Wang, Jiahao Zhu, Jianhuang Lai, and Xiaohua Xie. Guardsplat: efficient and robust watermarking for 3d gaussian splatting. In Proceedings of the Computer Vision and Pattern Recognition Conference, pages 16325–16335, 2025. 3 [4] Xinlong Ding, Hongwei Yu, Jiawei Li, Feifan Li, Yu Shang, Bochao Zou, Huimin Ma, and Jiansheng Chen. Kaleidoscopic background attack: Disrupting pose estimation with multi-fold radial symmetry textures. arXiv preprint arXiv:2507.10265, 2025. 3 [5] Jiaxin Hong, Sixu Chen, Shuoyang Sun, Hongyao Yu, Hao Fang, Yuqi Tan, Bin Chen, Shuhan Qi, and Jiawei Li. Gausstrap: Stealthy poisoning attacks on 3d gaussian splatting for targeted scene confusion. arXiv preprint arXiv:2504.20829, 2025. 2 [6] Xiufeng Huang, Ruiqi Li, Yiu-ming Cheung, Ka Chun Cheung, Simon See, and Renjie Wan. Gaussianmarker: Uncertainty-aware copyright protection of 3d gaussian splatting. Advances in Neural Information Processing Systems, 37:33037–33060, 2024. 2, 3 [7] Wenxiang Jiang, Hanwei Zhang, Shuo Zhao, Zhongwen Guo, and Hao Wang. Ipa-nerf: Illusory poisoning attack against neural radiance fields. arXiv preprint arXiv:2407.11921, 2024. 3 [8] Bernhard Kerbl, Georgios Kopanas, Thomas Leimkühler, and George Drettakis. 3D Gaussian Splatting for real-time radiance field rendering. ACM Transactions on Graphics, 42 (4), 2023. 1, 2, 3, 4 [9] Vincent Leroy, Yohann Cabon, and Jerome Revaud. MASt3R: Matching and stereo 3d reconstruction. arXiv preprint arXiv:2406.09756, 2024. 2, 8 [10] Chenxin Li, Hengyu Liu, Zhiwen Fan, Wuyang Li, Yifan Liu, Panwang Pan, and Yixuan Yuan. Gaussianstego: A generalizable stenography pipeline for generative 3d gaussians splatting. arXiv preprint arXiv:2407.01301, 2024. 3
[11] Jiahao Lu, Yifan Zhang, Qiuhong Shen, Xinchao Wang, and Shuicheng YAN. Poison-splat: Computation cost attack on 3d gaussian splatting. In The Thirteenth International Conference on Learning Representations, 2025. 2 [12] Ben Mildenhall, Pratul P. Srinivasan, Matthew Tancik, Jonathan T. Barron, Ravi Ramamoorthi, and Ren Ng. NeRF: Representing scenes as neural radiance fields for view synthesis. In European Conference on Computer Vision (ECCV), 2020. 1, 2, 3, 4 [13] Johannes Lutz Schönberger and Jan-Michael Frahm. Structure-from-motion revisited. In IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2016. 2, 3 [14] Noah Snavely, Steven M. Seitz, and Richard Szeliski. Photo tourism: exploring photo collections in 3d. ACM Trans. Graph., 25(3):835–846, 2006. 2 [15] Qi Song, Ziyuan Luo, Ka Chun Cheung, Simon See, and Renjie Wan. Geometry cloak: Preventing tgs-based 3d reconstruction from copyrighted images. Advances in Neural Information Processing Systems, 37:119361–119385, 2024. 2, 3 [16] Yuqi Tan, Xiang Liu, Shuzhao Xie, Bin Chen, Shu-Tao Xia, and Zhi Wang. Water-gs: Toward copyright protection for 3d gaussian splatting via universal watermarking. arXiv preprint arXiv:2412.05695, 2024. 2, 3 [17] Shuzhe Wang, Vincent Leroy, Yohann Cabon, Boris Chidlovskii, and Jerome Revaud. DUSt3R: Geometric 3d vision made easy. In IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2024. 2, 8 [18] Abdurrahman Zeybey, Mehmet Ergezer, and Tommy Nguyen. Gaussian splatting under attack: Investigating adversarial noise in 3d objects. arXiv preprint arXiv:2412.02803, 2024. 3 [19] Xuanyu Zhang, Jiarui Meng, Runyi Li, Zhipei Xu, Yongbing Zhang, and Jian Zhang. Gs-hider: Hiding messages into 3d gaussian splatting. Advances in Neural Information Processing Systems, 37:49780–49805, 2024. 2, 3