On the Generation and Mitigation of Harmful Geometry in Image-to-3D Models

TL;DR

This paper systematically studies the risks of harmful geometry generation in image-to-3D models, evaluates current safeguards, and proposes a stacked defense to reduce such risks, highlighting the need for improved moderation techniques.

Contribution

It provides the first comprehensive measurement of harmful geometry risks in image-to-3D models and evaluates existing safeguards, proposing a stacked defense approach.

Findings

Current models can effectively generate harmful geometries.

Less than 0.3% of harmful geometries trigger moderation flags.

A stacked defense reduces harmful retention to <1% with 11% false positives.

Abstract

Recent advances in image-to-3D models have significantly improved the fidelity and accessibility of 3D content creation. Such a powerful reconstruction capability that enables creative design can also be misused by the adversary to generate harmful geometries, which can be further fabricated via 3D printers and pose real-world risks. However, such risks are largely underexplored: it remains unclear how well current image-to-3D models can produce these harmful geometries, and whether existing safeguards can reliably prevent such generation. To fill this gap, we conduct a systematic measurement study of harmful geometry generation and mitigation. We first describe this risk through three kinds of unsafe categories: direct-use physical hazards, risky templates or components, and deceptive replicas. Each category is instantiated with representative objects. We evaluate both open-source and commercial image-to-3D models under original, degraded, viewpoint-shifted, and semantically camouflaged inputs. We consider different evaluation metrics, including geometric validity, multi-view VLM-based semantic scoring, targeted human validation, and controlled physical fabrication. The results reveal a concerning reality that current image-to-3D models can effectively reconstruct the harmful geometries, while fewer than 0.3% of such geometries trigger commercial moderation flags. As a first step toward mitigation, we evaluate three representative safeguard families, including input moderation, model-level benign alignment, and output-level filtering. We find that existing safeguards have distinct weaknesses. We further develop a stacked defense that can reduce harmful retention to <1%, but still at 11% overall false-positive cost. Taken together, our findings demonstrate that the risk in current system and encourage better geometry-aware safeguards for moderation.