PatchPoison: Poisoning Multi-View Datasets to Degrade 3D Reconstruction

A team of researchers led by Prajas Wadekar, Venkata Sai Pranav Bachina, Kunal Bhosikar, Ankit Gangwal, and Charu Sharma has introduced PatchPoison, a novel method to protect multi-view image datasets from being used to create unauthorized 3D reconstructions. The technique addresses a growing privacy concern: the ease with which publicly available photos or videos can be fed into advanced systems like 3D Gaussian Splatting (3DGS) to generate detailed 3D models of private scenes or objects without consent.

PatchPoison works by injecting a small, structured adversarial patch—a high-frequency checkerboard pattern—into the periphery of each image in a dataset. This lightweight, 'drop-in' preprocessing step requires no modification to existing 3D reconstruction pipelines. The patch is designed to systematically sabotage the critical feature-matching stage of standard Structure-from-Motion (SfM) pipelines, such as the popular COLMAP tool, by introducing spurious correspondences that misalign estimated camera poses.

The result is a catastrophic failure in downstream 3DGS optimization, which relies on accurate camera poses to reconstruct correct scene geometry. In tests on the NeRF-Synthetic benchmark, inserting just a 12x12 pixel patch increased the reconstruction error metric (LPIPS) by 6.8 times, effectively rendering the 3D output unusable. Crucially, the poisoned images remain visually unobtrusive to human viewers, making the protection stealthy. The research was presented at the CVPR 2026 Workshop on Security, Privacy, and Adversarial Robustness in 3D Generative Vision Models (SPAR-3D).