Gaussian splash protection method for malicious 3D editing

Abstract

The invention provides a Gaussian splash protection method for malicious 3D editing. The Gaussian splash protection method is used for effectively preventing unauthorized three-dimensional content from being tampered. The method comprises two core designs of a multi-difference optimization strategy and visual angle focus gradient fusion. In multi-difference optimization, semantic deviation and edit direction deviation of guide conditions are maximized to stably destroy an edit trajectory. In view point focus gradient fusion, 3D perturbations are adaptively optimized by dynamically emphasizing the contribution of the most challenging view angle. The protected 3D scene generated by the method can effectively resist 3D editing from different perspectives while the vivid rendering quality is kept, and the protection capability for malicious editing behaviors is remarkably improved.

Description

Technical Field

[0001] This invention belongs to the field of 3D graphics processing and artificial intelligence security, specifically a Gaussian splatter protection method for malicious 3D editing. This method is used to prevent malicious 3D editing operations based on a diffusion model. Specifically, the invention focuses on generating protected 3D objects that are effectively protected from multiple perspectives, achieving protection against malicious editing behaviors. This method is suitable for preventing unauthorized content tampering and protecting the security and integrity of 3D digital assets. Background Art

[0002] 3D Gaussian Splatting (3DGS) technology has gradually become an important framework for the new generation of 3D modeling and editing. It can achieve extremely high real-time performance while maintaining realistic rendering quality. In recent years, 3DGS has been widely integrated into various text-guided 3D editing systems, such as GaussianEditor, DreamCatalyst, and EditSplat. These systems combine natural language prompts with pre-trained image diffusion models (such as InstructPix2Pix and ControlNet), allowing users to quickly edit the appearance, semantic attributes, or local details of objects in 3D scenes through text instructions. Due to the advantages of simple operation and precise editing, this process is being widely used in scenarios such as virtual reality, digital asset generation, film and television games.

[0003] However, these technologies also pose potential security risks: anyone with access to a 3D rendered model could potentially use editing operations to forge identities, tamper with information, and other malicious purposes, leading to the spread of false information and privacy leaks. While recent 2D image editing protection schemes (such as AdvDM, Mist, and AdvPaint) can introduce perturbation suppression and diffusion editing effects in image space, they suffer from the following limitations in 3D scenarios. The following are several key image editing protection methods and their characteristics:

[0004] 1. Perturbation methods based on noise prediction offset: For example, AdvDM maximizes the error of the diffusion model during image denoising to interfere with its reconstruction capabilities, thereby limiting editing quality. However, this method only works within a single perspective and cannot capture the perspective consistency requirements in three-dimensional space.

[0005] 2. Protection methods based on attention mechanism interference: For example, AdvPaint manipulates the self-attention or cross-attention mechanisms in the diffusion model to induce the model to incorrectly focus on non-editable areas, thereby weakening semantic consistency. Although it achieves some results in 2D images, in 3D scenes, its attention shift is difficult to maintain synchronization across viewpoints, resulting in unstable protection results.

[0006] 3. Protection methods based on latent space disruption: Methods such as the Posterior Collapse Attack introduce perturbations into the latent space of the diffusion model, disrupting the structure of the latent variables and causing the generated content to deviate from the intended semantics. However, these methods typically rely on fixed image distributions and specific model structures, making them unsuitable for iterative 3D rendering optimization.

[0007] In summary, current protection methods for 2D image editing have achieved good performance in 2D image editing, but still have significant shortcomings when directly applied to 3D scenes. These are mainly manifested in the following aspects: 2D perturbations make it difficult to express the structural characteristics of 3D space and lack multi-view consistency modeling, resulting in unstable protection effects; 3D editing processes are iterative and optimization-driven, and simply embedded pixel-level perturbations are easily eliminated during the editing optimization process, making it difficult to achieve long-term protection. Therefore, there is an urgent need for a new protection method that can directly act on the 3DGS Gaussian representation structure, has the ability to express perturbations consistently from multiple perspectives, and can resist attacks from multiple 3D editors. Summary of the Invention

[0008] To address the above issues, the present invention proposes a Gaussian splatter protection method against malicious 3D editing, which includes the following steps:

[0009] 1. A Gaussian splatter protection method for malicious 3D editing, comprising the following steps:

[0010] S1, based on multi-view image data, using 3D Gaussian splash technology to construct a 3D Gaussian splash original scene model G, the 3D scene is composed of multiple Gaussian distributions, each Gaussian contains parameters such as position μ, covariance ∑, color c and opacity α;

[0011] S2, initialize the perturbation parameters Δ = {Δμ, Δ∑, Δα, Δc}, set the initial perturbations of all Gaussian parameters to zero as the starting state of perturbation optimization;

[0012] S3, adopts a wide-view sampling strategy to select several key views with the largest view difference and uniform distribution from the preset view set to enhance the multi-view consistency during optimization;

[0013] S4, based on the double difference loss function, the perturbation parameters are optimized for multiple rounds of iterations, where the double difference includes the semantic feature difference and the guidance direction difference;

[0014] S5 uses a perspective focus weighting mechanism to dynamically assign weights to gradient contributions based on the loss size of each perspective, guiding the perturbation to be more fully optimized at perspectives with poor protection effects;

[0015] S6, applies the final perturbation to the Gaussian parameters to generate a protected 3D scene, and verifies its protection against editing through multi-view editing tests.

[0016] 2. The Gaussian splatter protection method for malicious 3D editing according to claim 1, wherein the wide-viewing angle sampling strategy of step S3 specifically comprises the following steps:

[0017] S31, a set of camera poses generated when building a 3D scene In the example, the external parameter information of each view is extracted, where the external parameter includes the camera center position vector and the rotation matrix R∈SO(3);

[0018] S32, define the viewing distance function d(v i ,v j ), including translation difference and rotation difference. The translation difference is calculated by the L2 norm of the two camera position vectors, and the rotation difference is calculated by the angle between the two rotation matrices. Specifically:

[0019]

[0020] Among them, D max represents the maximum translation distance in view space, and trace(·) represents the trace of the matrix. Both distances are mapped to [0,1] and have equal weights;

[0021] S33, randomly initialize the sampling set V1 = {v ref}, and iteratively select the perspective farthest from any perspective from the candidate perspective set and add it to the sampling set:

[0022]

[0023] S34, repeatedly performing the above greedy selection until N representative perspectives with the widest distribution are obtained, which serve as the key perspective set for perturbation optimization and evaluation. The wide perspective sampling can be adjusted by setting the maximum sampling number N to adapt to different scene complexities and editing distribution characteristics;

[0024] S35, rendering perspective v, obtaining rendered image R v (G).

[0025] 3. The Gaussian splatter protection method for malicious 3D editing according to claim 1, wherein the dual difference optimization strategy in step S4 specifically comprises the following steps:

[0026] S41, using the encoder ε and denoiser ∈ in InstructPix2Pix, calculate the rendered image I of the original view v vThe encoding and editing features of

[0027] S42, calculating the rendered image R of the viewing angle v during the editing process v Coding and editing features of (G+Δ);

[0028] S43, constructs the semantic feature difference loss, which is used to measure the semantic difference between the perturbed rendered image and the original image in the latent space, expressed as:

[0029]

[0030] S44, constructs the guidance direction difference loss, which is used to measure the degree of deviation of the perturbed image in the editing guidance direction of the diffusion model. The calculation method is as follows:

[0031]

[0032] Where Y is the editing text prompt library, which consists of 415 prompt sentences in DreamFusion, and t is the number of diffusion steps. is the k-th iteration image under the viewing angle v;

[0033] S45, combining the above two types of losses, defines the overall optimization objective function as:

[0034] L total =L reder +λ FD L FD +λ GD L GD (6)

[0035] Among them, L render is the rendering loss, defined as the L2 distance between the rendered view and the original view. FD ,λ GD Adjustable hyperparameters to control semantic and guidance weights;

[0036] S44, iteratively optimizing the perturbation parameter Δ={Δμ, Δ∑, Δα, Δc} through multiple rounds of gradient ascent to cause the three-dimensional Gaussian scene to deviate from the editing behavior of the diffusion model.

[0037] 4. The Gaussian splatter protection method for malicious 3D editing according to claim 1, wherein the viewing angle weighting mechanism of step S5 specifically comprises the following steps:

[0038] S51, calculate the total loss corresponding to each sampling perspective v∈V The intrusive nature of the editing used to reflect this perspective;

[0039] S52, according to Construct nonlinear normalized weight ωv , specifically:

[0040]

[0041] Where τ>0 is a smoothing term, and γ>0 controls the degree of focus of perspective importance;

[0042] S53, the gradient corresponding to each viewing angle Multiply by its weight ω v , and summarize the weighted gradients into the overall perturbation optimization direction:

[0043]

[0044] S54, using the above-mentioned focused weighted gradient, updates the perturbation parameters so that the optimization is prioritized on the perspectives with weak protection capabilities, thereby improving the overall editing resistance.

[0045] Beneficial effects: Compared with the existing technology, the present invention provides a Gaussian splash protection method against malicious 3D editing, which can effectively interfere with the editing trajectory of malicious editing, realize semantic protection of 3D Gaussian scenes, and produce the following beneficial effects:

[0046] 1. Strong 3D Consistency: This invention incorporates a multi-view loss aggregation strategy and spatial consistency constraint mechanism into the perturbation optimization process, ensuring stable and consistent protection across multiple viewpoints. Through key viewpoint sampling and loss alignment, perturbation failure caused by viewpoint switching is effectively avoided, achieving full spatial suppression of 3D editing trajectories.

[0047] 2. Strong perturbation effectiveness: The guided difference loss proposed in this paper specifically perturbs the editing direction of the diffusion model, significantly disrupting the model's feature guidance path during semantic reconstruction. Because this loss optimizes backward from the intermediate noise estimation stage of the diffusion process, the generated perturbation is not easily eliminated across multiple editing iterations, resulting in greater stability and sustainability.

[0048] 3. Strong versatility: Most existing image space perturbation methods rely on specific two-dimensional input formats or model architectures, which often lead to failure in three-dimensional editing scenarios. In contrast, the present invention directly acts on the Gaussian parameter space, combines the differentiable rendering mechanism with the editing behavior guidance loss, and achieves a close integration of perturbation and three-dimensional structure, thereby improving the versatility and cross-system adaptability of the method. This method can be widely applied to a variety of mainstream 3DGS editing frameworks, such as GaussianEditor, EditSplat, DreamCatalyst, etc., and can continuously resist different types of three-dimensional semantic tampering without relying on a specific editor structure.

[0049] 4. High Visual Quality: This invention comprehensively considers image rendering losses during the perturbation optimization process, ensuring that perturbations suppress editing effects without introducing noticeable visual artifacts or structural damage. The optimized results maintain a natural, realistic visual appearance in the rendered image, allowing for seamless integration into everyday use scenarios, ensuring excellent concealment and practicality. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] Figure 1 This is an overall flow chart of a Gaussian splash protection method for malicious 3D editing according to the present invention.

[0051] Figure 2 This is a visualization and detailed comparison of the Gaussian splatter protection method for malicious 3D editing and other methods of the present invention;

[0052] Figure 3 This is a visualization of the defensive effects of the Gaussian splatter protection method against malicious 3D editing for different editing schemes according to the present invention;

[0053] Figure 4 This figure compares the results of the Gaussian splatter protection method for malicious 3D editing and other methods on the face, girl, bear, and bicycle datasets. DETAILED DESCRIPTION

[0054] The present invention provides a Gaussian splash protection method against malicious 3D editing. By constructing an original three-dimensional Gaussian scene, adopting a dual-difference optimization mechanism and a multi-view gradient weighting strategy, it actively interferes with the diffusion model editing behavior in the three-dimensional editing system, thereby generating a protected three-dimensional scene that has editing resistance under multiple iterations and multi-view conditions, and is used to resist semantic manipulation or malicious tampering.

[0055] The invention will be further described below with reference to specific embodiments.

[0056] Example 1:

[0057] In the initial stage, the multi-view images collected are jointly reconstructed using a 3D Gaussian splattering technique to construct a raw 3D Gaussian scene representation. This scene is composed of several Gaussian-distributed spheres, each containing parameters such as position, covariance, color, and opacity. These spheres are used to characterize the spatial and appearance information of each structural element in the scene, providing a basic representation for the subsequent generation of protective perturbations.

[0058] like Figure 1As shown in the figure, learnable perturbation variables are introduced into the original Gaussian scene. These perturbations include position, covariance, color, and opacity. These perturbations are initialized to zero and participate in the subsequent optimization process. For each sampled viewpoint, a differentiable renderer is used to render the perturbed 3D scene and calculate the difference between the perturbations and the original image.

[0059] To improve the consistency and robustness of edit protection across multiple viewpoints, we first sampled a wide range of key viewpoints in view space. Using a greedy sampling strategy based on maximum view distance, we selected the viewpoints with the largest spatial distance and the most significant pose changes from the original rendered scene as representatives to construct an optimized viewpoint set. This sampling strategy effectively accounts for variations in viewing direction in 3D space, thereby improving the global consistency of perturbation optimization.

[0060] like Figure 1 As shown in the optimization phase, to ensure the perturbation's protective effectiveness across different viewpoints, a dual-difference loss function is designed as the optimization objective. First, a semantic feature difference loss is introduced. The image encoder of the diffusion model extracts semantic vectors from the original and perturbed images, measuring the degree of deviation from their latent space structures. Second, a guided direction difference loss is introduced. This intervention weakens the model's responsiveness to text editing prompts by intervening in the noise prediction vectors in the intermediate stages of the diffusion model. The two weighted functions form a total loss function, which drives the iterative update of the perturbation parameters.

[0061] To further enhance the focus of optimization, a perspective weighting mechanism is introduced to dynamically adjust the gradient contribution based on the loss value at different perspectives. Perspectives with weaker protection are assigned higher optimization weights, thereby improving the consistency and stability of global protection.

[0062] After the optimization is complete, the final perturbation parameters are applied to the original Gaussian representation to generate the protected 3D scene. Subsequently, tests were conducted using existing 3D editors (such as DreamCatalyst and EditSplat) under multiple editing prompts (such as "turn him into Einstein" and "turn the bear into a giant panda"). The results showed that while the added perturbation maintained a natural and realistic visual appearance, it effectively suppressed the diffusion model's ability to respond to semantic instructions, resulting in significant offsets, errors, or editing failures in the generated image. This validates the method's extensive protection capabilities and excellent visual quality under multiple perspectives.

[0063] This paper provides a Gaussian splatter protection method against malicious 3D editing. By constructing a pristine 3D Gaussian scene, introducing structured perturbation variables, and combining dual-difference loss optimization with a viewpoint weighting mechanism, this method effectively disrupts and protects against text-guided 3D editing. While maintaining pristine visual quality and geometric consistency, this method applies a stabilizing inhibitory effect to the multiple iterations of the diffusion model, significantly reducing the model's ability to respond to editing commands.

[0064] Figure 2 This figure shows the visualization results and detailed comparison of the Gaussian splatter protection method proposed by the present invention against malicious 3D editing, compared with other methods. As can be seen, given the same editing prompt (e.g., "Turn him into Einstein"), the unprotected original 3D scene is successfully modified by the diffusion model, and the proposed method successfully disrupts the diffusion model's editing path from multiple representative perspectives.

[0065] Figure 3 This visualization shows the effectiveness of the Gaussian splatter protection method presented in this invention against malicious 3D editing, as seen in different editing scenarios. As can be seen, without protection, the diffusion model accurately generates the target semantic transformation effect under various editing commands. However, after introducing the protected 3D scene presented in this invention, no significant editing effect is observed under the same set of editing commands.

[0066] Figure 4 This figure compares the results of our Gaussian splatter protection method against malicious 3D editing with other methods on the face, girl, bear, and bicycle datasets. As can be seen, the perturbations generated by our method effectively suppress the semantic editing process of the diffusion model, resulting in blurring, distortion, failure, or complete non-responsiveness in the edited results.

[0067] The above description is merely a preferred embodiment of the present application and is not intended to limit the present application. Various modifications and variations are possible for those skilled in the art. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the present application shall be included within the scope of protection of the present application.

[0068] Although the above describes the specific implementation methods of the present invention, it does not limit the scope of protection of the present invention. Those skilled in the art should understand that various modifications or variations that can be made by those skilled in the art on the basis of the technical solution of the present invention without creative work are still within the scope of protection of the present invention.

Claims

1. A Gaussian splatter protection method for malicious 3D editing, characterized in that: The following steps are involved: S1, based on multi-view image data, using 3D Gaussian splash technology to construct a 3D Gaussian splash original scene model G, the 3D scene is composed of multiple Gaussian distributions, each Gaussian contains parameters such as position μ, covariance ∑, color c and opacity α; S2, initialize the perturbation parameters Δ = {Δμ, Δ∑, Δα, Δc}, set the initial perturbations of all Gaussian parameters to zero as the starting state of perturbation optimization; S3, adopts a wide-view sampling strategy to select several key views with the largest view difference and uniform distribution from the preset view set to enhance the multi-view consistency during optimization; S4, based on the double difference loss function, the perturbation parameters are optimized for multiple rounds of iterations, where the double difference includes the semantic feature difference and the guidance direction difference; S5 uses a perspective focus weighting mechanism to dynamically assign weights to gradient contributions based on the loss size of each perspective, guiding the perturbation to be more fully optimized at perspectives with poor protection effects; S6, applies the final perturbation to the Gaussian parameters to generate a protected 3D scene, and verifies its protection against editing through multi-view editing tests.

2. The Gaussian splatter protection method for malicious 3D editing according to claim 1, characterized in that: The wide viewing angle sampling strategy of step S3 specifically includes the following steps: S31, a set of camera poses generated when building a 3D scene In the example, the external parameter information of each view is extracted, where the external parameter includes the camera center position vector and the rotation matrix R∈SO(3); S32, define the viewing distance function d(v i ,v j ), including translation difference and rotation difference. The translation difference is calculated by the L2 norm of the two camera position vectors, and the rotation difference is calculated by the angle between the two rotation matrices. Specifically: Among them, D max represents the maximum translation distance in view space, and trace(·) represents the trace of the matrix. Both distances are mapped to [0,1] and have equal weights; S33, randomly initialize the sampling set V1 = {v ref }, and iteratively select the perspective farthest from any perspective from the candidate perspective set and add it to the sampling set: S34, repeatedly performing the above greedy selection until N representative perspectives with the widest distribution are obtained, which serve as the key perspective set for perturbation optimization and evaluation. The wide perspective sampling can be adjusted by setting the maximum sampling number N to adapt to different scene complexities and editing distribution characteristics; S35, rendering perspective v, obtaining rendered image R v (G).

3. The Gaussian splatter protection method for malicious 3D editing according to claim 1, characterized in that: The dual-difference optimization strategy in step S4 specifically includes the following steps: S41, using the encoder ε and denoiser ∈ in InstructPix2Pix, calculate the rendered image I of the original view v v The encoding and editing features of S42, calculating the rendered image R of the viewing angle v during the editing process v Coding and editing features of (G+Δ); S43, constructs the semantic feature difference loss, which is used to measure the semantic difference between the perturbed rendered image and the original image in the latent space, expressed as: S44, constructs the guidance direction difference loss, which is used to measure the degree of deviation of the perturbed image in the editing guidance direction of the diffusion model. The calculation method is as follows: Where Y is the editing text prompt library, which consists of 415 prompt sentences in DreamFusion, and t is the number of diffusion steps. is the k-th iteration image under the viewing angle v; S45, combining the above two types of losses, defines the overall optimization objective function as: L total =L render +λ FD L FD +λ GD L GD (6) Among them, L render is the rendering loss, defined as the L2 distance between the rendered view and the original view. FD ,λ GD Adjustable hyperparameters to control semantic and guidance weights; S44, iteratively optimizing the perturbation parameter Δ={Δμ, Δ∑, Δα, Δc} through multiple rounds of gradient ascent to cause the three-dimensional Gaussian scene to deviate from the editing behavior of the diffusion model.

4. The Gaussian splatter protection method for malicious 3D editing according to claim 1, characterized in that: The perspective weighting mechanism of step S5 specifically includes the following steps: S51, calculate the total loss corresponding to each sampling perspective v∈V The intrusive nature of the editing used to reflect this perspective; S52, according to Construct nonlinear normalized weight ω v , specifically: Where τ>0 is a smoothing term, and γ>0 controls the degree of focus of perspective importance; S53, the gradient corresponding to each viewing angle Multiply by its weight ω v , and summarize the weighted gradients into the overall perturbation optimization direction: S54, using the above-mentioned focused weighted gradient, updates the perturbation parameters so that the optimization is prioritized on the perspectives with weak protection capabilities, thereby improving the overall editing resistance.

Images