# 3DGAA: Realistic and Robust 3D Gaussian-based Adversarial Attack for Autonomous Driving

arXiv: https://arxiv.org/abs/2507.09993 · HTML: https://mlsanity.com/paper/2507.09993/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- Builds on 39 of its 53 references that are in the map.
- First posted on arXiv 14 Jul 2025.

## Builds on (most cited first, 30 of 39)

- [Deep Residual Learning for Image Recognition](https://mlsanity.com/paper/1512.03385/) (2015)
- [The Unreasonable Effectiveness of Deep Features as a Perceptual Metric](https://mlsanity.com/paper/1801.03924/) (2018)
- [Faster R-CNN: Towards Real-Time Object Detection with Region Proposal Networks](https://mlsanity.com/paper/1506.01497/) (2015)
- [Explaining and Harnessing Adversarial Examples](https://mlsanity.com/paper/1412.6572/) (2014)
- [Mask R-CNN](https://mlsanity.com/paper/1703.06870/) (2017)
- [3D Gaussian Splatting for Real-Time Radiance Field Rendering](https://mlsanity.com/paper/2308.04079/) (2023)
- [Fully Convolutional Networks for Semantic Segmentation](https://mlsanity.com/paper/1411.4038/) (2014)
- [Deformable DETR: Deformable Transformers for End-to-End Object Detection](https://mlsanity.com/paper/2010.04159/) (2020)
- [SSD: Single Shot MultiBox Detector](https://mlsanity.com/paper/1512.02325/) (2015)
- [Towards Evaluating the Robustness of Neural Networks](https://mlsanity.com/paper/1608.04644/) (2016)
- [YOLOv3: An Incremental Improvement](https://mlsanity.com/paper/1804.02767/) (2018)
- [CARLA: An Open Urban Driving Simulator](https://mlsanity.com/paper/1711.03938/) (2017)
- [Rethinking Atrous Convolution for Semantic Image Segmentation](https://mlsanity.com/paper/1706.05587/) (2017)
- [DINO: DETR with Improved DeNoising Anchor Boxes for End-to-End Object Detection](https://mlsanity.com/paper/2203.03605/) (2022)
- [LRM: Large Reconstruction Model for Single Image to 3D](https://mlsanity.com/paper/2311.04400/) (2023)
- [DreamGaussian: Generative Gaussian Splatting for Efficient 3D Content Creation](https://mlsanity.com/paper/2309.16653/) (2023)
- [LGM: Large Multi-View Gaussian Model for High-Resolution 3D Content Creation](https://mlsanity.com/paper/2402.05054/) (2024)
- [Adversarial Patch](https://mlsanity.com/paper/1712.09665/) (2017)
- [Neural 3D Mesh Renderer](https://mlsanity.com/paper/1711.07566/) (2017)
- [Fooling automated surveillance cameras: adversarial patches to attack person detection](https://mlsanity.com/paper/1904.08653/) (2019)
- [A Survey on 3D Gaussian Splatting](https://mlsanity.com/paper/2401.03890/) (2024)
- [ShapeShifter: Robust Physical Adversarial Attack on Faster R-CNN Object Detector](https://mlsanity.com/paper/1804.05810/) (2018)
- [Cameras as Rays: Pose Estimation via Ray Diffusion](https://mlsanity.com/paper/2402.14817/) (2024)
- [Dual Attention Suppression Attack: Generate Adversarial Camouflage in Physical World](https://mlsanity.com/paper/2103.01050/) (2021)
- [3D Gaussian as a New Era: A Survey](https://mlsanity.com/paper/2402.07181/) (2024)
- [On Physical Adversarial Patches for Object Detection](https://mlsanity.com/paper/1906.11897/) (2019)
- [Universal Physical Camouflage Attacks on Object Detectors](https://mlsanity.com/paper/1909.04326/) (2019)
- [FCA: Learning a 3D Full-coverage Vehicle Camouflage for Multi-view Physical Adversarial Attack](https://mlsanity.com/paper/2109.07193/) (2021)
- [DTA: Physical Camouflage Attacks using Differentiable Transformation Network](https://mlsanity.com/paper/2203.09831/) (2022)
- [Physical Adversarial Attack on Vehicle Detector in the Carla Simulator](https://mlsanity.com/paper/2007.16118/) (2020)

## Built on by (most cited first, 2 of 2)

- [AdvScene: Rethinking Adversarial Patch Evaluation Through Scene Robustness](https://mlsanity.com/paper/2605.30578/) (2026)
- [Meshless Domain Randomization via Explicit Parameter Perturbation of 3D Gaussian Splatting](https://mlsanity.com/paper/2607.22890/) (2026)

## Abstract (arXiv)

Camera-based perception in connected and autonomous vehicles remains exposed to physical adversarial attacks. Prior attacks often either optimize image-plane textures, weakening cross-view consistency, or rely on shape modifications that are difficult to fabricate and deploy. Both cases limit their value for security and safety assessment of camera-based perception. This paper introduces a fabrication-first framework that learns view-consistent, geometry-preserving adversarial wraps for vehicles. The method performs three-dimensional multi-view optimization with a 3D Gaussian splatting surrogate to enforce consistency under an expectation over viewpoint, illumination, and occlusion, while the final artifact is constrained to print-only textures that keep vehicle geometry unchanged. We evaluate the framework through matched CARLA simulations, controlled miniature-vehicle physical evidence, and tests on multiple modern detectors. The wraps produce substantial and stable reductions in detection confidence and average precision across views while maintaining perceptual realism. Ablation studies isolate the effects of physical filtering, physical augmentation, and shape-consistency regularization, while efficiency analyses report convergence time and memory profiles. Additional experiments report ASR, mIoU-based segmentation degradation, cross-detector transfer against physical attack baselines, perturbation-area fairness diagnostics, and robustness under common input preprocessing defenses. By coupling three-dimensional optimization with a geometry-preserving realization, the study supports a practical pathway to systematically stress-test camera perception in safety-critical autonomous driving systems and provides evidence that can inform defense design and evaluation protocols in information forensics and security.