PhantomSplat: Stealthy Post-Reconstruction Attacks on 3D Gaussian Splatting

3D Gaussian Splatting (3DGS) has become a widely adopted representation for 3D scene reconstruction, real-time rendering, and downstream perception. As optimized 3DGS representations are increasingly distributed and reused as scene assets, their integrity after reconstruction becomes an important security concern: a compromised asset may be directly consumed by downstream systems even when the original data and reconstruction process are trusted. Existing 3DGS attacks primarily target the construction stage through poisoned training views or perturbed inputs, leaving this post-reconstruction failure mode largely unexplored. We study whether an already optimized 3DGS asset can be transformed into a self-contained, view-dependent malicious representation while remaining visually plausible under benign inspection. We propose PhantomSplat, which injects a small set of low-opacity adversarial Gaussians while keeping the original representation fixed. The design targets three requirements for asset-level security evaluation: localized adversarial behavior, benign-view consistency, and structural inconspicuousness. Surface-constrained placement reduces detectable geometric artifacts, while bounded opacity optimization limits degradation under normal views. A first-order rendering surrogate further makes this constrained optimization practical without repeated full-scene rendering. Across diverse scenes and downstream perception models, PhantomSplat induces strong target-view effects while largely preserving the original asset under benign views. On Mip-NeRF360, PhantomSplat achieves 33.96 dB attack-view PSNR while retaining 29.62 dB benign-view PSNR, compared with 30.36 dB for the clean asset, with an average optimization time of 4.25 minutes. These findings reveal a gap in current 3DGS security assumptions and motivate post-reconstruction integrity verification before scene assets are deployed in downstream systems.