3DOSA: Unified Radiance Fields of 3D Objects and Scenes for Physically Realizable Adversarial Attacks in Autonomous Driving

Achieving multi-view consistency in physical adversarial attacks requires an accurate 3D representation of the target object that captures intricate surface geometry. Recently, 3D Gaussian Splatting (3DGS) provides a promising representation for adversarial optimization due to its explicit and differentiable modeling of 3D objects and scenes. However, existing 3DGS-based attacks typically optimize physical adversarial camouflages without any physical environmental context or rely on 2D masks to identify optimizable Gaussians in the 3D scene, which can cause gradients to leak beyond the intended perturbation boundaries. In addition, volumetric Gaussians are difficult to align precisely with object surfaces, which can produce floating artifacts and geometric distortions that make the resulting camouflage physically undeployable. To address these limitations, we propose 3DOSA, a general physical attack framework that unifies the 3D object and the scene within a single adversarial radiance field. 3DOSA introduces an explicit spatial decoupling mechanism to isolate target Gaussians from the surrounding scene and prevent gradient leakage into background and non-printable regions. We further incorporate 2D Gaussian Splatting (2DGS) to represent adversarial Gaussians as planar surfels that closely adhere to the object surface. This representation suppresses floating artifacts and preserves the geometric fidelity of the object to maintain the physical realizability of the adversarial camouflage. We primarily evaluate 3DOSA on stereo matching, which imposes cross-view consistency beyond the multi-view requirements of general physical attacks, and further evaluate its versatility to object detection. Extensive experiments in simulated and physical environments demonstrate strong attack performance and robustness across diverse viewpoints and models.