Research map / Adversarial robustness and security / Attacks on text and graphs
Advancing Adversarial Robustness in GNeRFs: The IL2-NeRF Attack
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes IL2-NeRF, an iterative L2-norm adversarial attack on generalizable NeRFs (IBRNet, GNT) that perturbs source views, and compares it against the L∞ NeRFool attack across LLFF, DeepVoxels and Synthetic datasets.
Problem
Adversarial robustness of generalizable Neural Radiance Field (GNeRF) models, which existing attacks (NeRFool) only study under the L∞ norm.
Approach
An iterative PGD-style attack that constrains source-view perturbations in the L2 norm, with a separate perturbation variable updated via normalized sign-gradient steps and a weighted loss over multiple RGB and density terms, extending NeRFool to a new threat model.
Key results
- On IBRNet/LLFF, IL2-NeRF at epsilon=128 gives average PSNR 13.949 versus NeRFool's 12.613 at epsilon=8, while IL2-NeRF epsilon=256 gives 12.230 and is lower than NeRFool on most LLFF scenes.
- At epsilon=256 IL2-NeRF achieves average SSIM 0.399 on IBRNet/LLFF versus NeRFool's 0.510 at epsilon=8.
- On DeepVoxels with GNT, IL2-NeRF (epsilon=256) gives average PSNR 13.140 versus NeRFool's 16.533.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use IL2-NeRF at ε=256 instead of NeRFool at ε=8 | IBRNet on LLFF · LLFF | PSNR: 12.613 -> 12.230 | Helped |
| Use IL2-NeRF at ε=256 instead of NeRFool at ε=8 | IBRNet on LLFF · LLFF | SSIM: 0.510 -> 0.399 | Helped |
| Use IL2-NeRF at ε=256 instead of NeRFool at ε=8 | IBRNet on LLFF · LLFF | LPIPS: 0.468 -> 0.579 | Helped |
| Use IL2-NeRF at ε=256 instead of NeRFool at ε=8 | GNT on LLFF · LLFF | PSNR: 13.871 -> 12.470 | Helped |
| Use IL2-NeRF at ε=256 instead of NeRFool at ε=8 | GNT on LLFF · LLFF | SSIM: 0.482 -> 0.330 | Helped |
| Use IL2-NeRF at ε=256 instead of NeRFool at ε=8 | GNT on LLFF · LLFF | LPIPS: 0.374 -> 0.494 | Helped |
| Use IL2-NeRF at ε=256 instead of NeRFool at ε=8 | IBRNet on DeepVoxels · DeepVoxels | PSNR: 11.652 -> 10.700 | Helped |
| Use IL2-NeRF at ε=256 instead of NeRFool at ε=8 | IBRNet on DeepVoxels · DeepVoxels | SSIM: 0.745 -> 0.691 | Helped |
| Use IL2-NeRF at ε=256 instead of NeRFool at ε=8 | IBRNet on DeepVoxels · DeepVoxels | LPIPS: 0.278 -> 0.335 | Helped |
| Use IL2-NeRF at ε=256 instead of NeRFool at ε=8 | GNT on DeepVoxels · DeepVoxels | PSNR: 16.533 -> 13.140 | Helped |
| Use IL2-NeRF at ε=256 instead of NeRFool at ε=8 | GNT on DeepVoxels · DeepVoxels | SSIM: 0.842 -> 0.629 | Helped |
| Use IL2-NeRF at ε=256 instead of NeRFool at ε=8 | GNT on DeepVoxels · DeepVoxels | LPIPS: 0.149 -> 0.331 | Helped |
Surprising findings
- Comparable attack strength is achieved only at much larger L2 budgets (epsilon=128-256) than the L∞ budget of 8, because the L2 epsilon measures total energy rather than per-pixel magnitude.
- Learning rate variation from 0.001 to 0.1 produced negligible changes in SSIM and LPIPS, per the authors' learning-rate study.
Limitations
- IL2-NeRF only matches NeRFool at much larger epsilon values, and the authors acknowledge it does not beat NeRFool under smaller L2 bounds.
- Evaluation is limited to two GNeRF models and three datasets, with some results mixed (e.g., SSIM 0.629 vs 0.842 for GNT on DeepVoxels, and a large LPIPS outlier for Synthetic).
- Comparisons use mismatched epsilon values across norms, making direct comparison less clean.
Experimental setup
Datasets: LLFF DeepVoxels Synthetic
Benchmarks: LLFF DeepVoxels Synthetic
Metrics: PSNR SSIM LPIPS L2 distance
Baselines: NeRFool
Builds on: NeRFool PGD IBRNet GNT
Closest papers by meaning
- NeRFail: Neural Radiance Fields-Based Multiview Adversarial Attack (AAAI 2024 · similarity 0.91)
- InsertNeRF: Instilling Generalizability into NeRF with HyperNet Modules (ICLR 2024 · similarity 0.86)
- GL-NeRF: Gauss-Laguerre Quadrature Enables Training-Free NeRF Acceleration (NeurIPS 2024 · similarity 0.85)
- RAMP: Boosting Adversarial Robustness Against Multiple $l_p$ Perturbations for Universal Robustness (NeurIPS 2024 · similarity 0.85)
- A²RNet: Adversarial Attack Resilient Network for Robust Infrared and Visible Image Fusion (AAAI 2025 · similarity 0.85)
- GREAT Score: Global Robustness Evaluation of Adversarial Perturbation using Generative Models (NeurIPS 2024 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.