Graz University of Technology

As feed-forward 3D Gaussian splatting scales to more views, anchor-based compression fixes the decoder-facing representation but lets support-to-anchor fusion grow with view count. CrossPressor leaves released checkpoints untouched and routes support features before K/V projection with coverage-cycled offsets, spreading retained spatial evidence across support views and fusion layers. At 256 views it keeps 1.85% of dense QK interactions, cutting cross-view latency from 125.28 ms to 4.80 ms while rendering quality stays close to dense fusion.

As feed-forward 3D Gaussian splatting scales to more views, anchor-based compression fixes the decoder-facing representation but lets support-to-anchor fusion grow with view count. CrossPressor leaves released checkpoints untouched and routes support features before K/V projection with coverage-cycled offsets, spreading retained spatial evidence across support views and fusion layers. At 256 views it keeps 1.85% of dense QK interactions, cutting cross-view latency from 125.28 ms to 4.80 ms while rendering quality stays close to dense fusion.

The paper introduces LLMLeak, a novel attack vector in which malicious software that runs locally but cannot reach the internet directly encodes a secret into a URL and presents the referenced site as information needed for a benign task such as migrating a software library, inducing the LLM to fetch that URL through its web-fetch tool so the attacker receives the encoded secret via an attacker-controlled DNS or web server; evaluation on eleven open-parameter models shows a 79.7% attack success rate, with a case study on real-world chatbots.

The paper introduces LLMLeak, a novel attack vector in which malicious software that runs locally but cannot reach the internet directly encodes a secret into a URL and presents the referenced site as information needed for a benign task such as migrating a software library, inducing the LLM to fetch that URL through its web-fetch tool so the attacker receives the encoded secret via an attacker-controlled DNS or web server; evaluation on eleven open-parameter models shows a 79.7% attack success rate, with a case study on real-world chatbots.