Research map / Adversarial robustness and security / Certified and empirical robustness
NeRFool: Uncovering the Vulnerability of Generalizable Neural Radiance Fields against Adversarial Perturbations
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| increase number of source views from four to ten (IBRNet, eps=8) (ablation) | IBRNet · LLFF | PSNR degradation: 0.44 larger PSNR reduction with ten vs four views | Hurt |
| perturb density (sigma_adv) instead of color (ablation) | IBRNet and MVSNeRF · LLFF | PSNR: perturbing density gives comparable degradation to both; perturbing color alone is weak on IBRNet | Helped |
| use GNT instead of IBRNet as the GNeRF backbone under attack | GNeRF backbone · LLFF | PSNR under NeRFool eps=16: GNT drop 11.17 vs IBRNet drop larger at eps=16 | Helped |
| use MVSNeRF instead of IBRNet as the GNeRF backbone under attack | GNeRF backbone · LLFF | PSNR under NeRFool eps=16: MVSNeRF reaches 14.91 vs GNT 12.49 under eps=16 | Helped |
| transfer perturbations optimized on one target view to other views (vs view-specific) (ablation) | IBRNet · LLFF | PSNR: transfer 23.36 vs view-specific 13.30 (attack weaker) | Hurt |
| add NeRFool+ (novel view sampling via Slerp/interpolated poses and geometric depth error maximization) vs transferred NeRFool | GNeRF (IBRNet/GNT/MVSNeRF) · LLFF | PSNR: up to 17.26 lower PSNR on GNT at eps=16 vs clean | Helped |
| add depth error maximization loss (L_depth) to NeRFool+ (ablation) | NeRFool+ on IBRNet · LLFF (fern, farther target views) | PSNR degradation: 1.92 larger PSNR degradation on fern | Helped |
| per-scene finetuning of IBRNet (ablation) | IBRNet · LLFF (fern, flower, fortress, horns) | PSNR under attack: fern adv 14.02 without ft vs 13.93 with ft; clean rises 22.22 to 24.10 | Hurt |
| adversarial pretraining of GNT (eps=8, 1 iteration) (ablation) | GNT · LLFF (fortress) | PSNR under adversarial test: 10.39 higher PSNR on fortress (25.01 vs 14.62) | Helped |
| adversarial pretraining of GNT (ablation) | GNT · LLFF (clean) | clean PSNR: 0.40 to 2.18 PSNR reduction across scenes | Hurt |
| adversarial finetuning (instead of pretraining) of GNT (ablation) | GNT · LLFF (4 scenes avg) | PSNR under adversarial test: 5.20 PSNR improvement averaged over four scenes | Helped |
| adversarial finetuning of IBRNet and GNT (ablation) | IBRNet and GNT · LLFF | clean PSNR: GNT clean PSNR consistently boosted; 0.87 improvement on flowers | Helped |
Closest papers by meaning
- Advancing Adversarial Robustness in GNeRFs: The IL2-NeRF Attack (CVPR 2025 · similarity 0.95)
- NeRFail: Neural Radiance Fields-Based Multiview Adversarial Attack (AAAI 2024 · similarity 0.91)
- Learning Robust Generalizable Radiance Field with Visibility and Feature Augmented Point Representation (ICLR 2024 · similarity 0.90)
- InsertNeRF: Instilling Generalizability into NeRF with HyperNet Modules (ICLR 2024 · similarity 0.89)
- Rad-NeRF: Ray-decoupled Training of Neural Radiance Field (NeurIPS 2024 · similarity 0.88)
- ColNeRF: Collaboration for Generalizable Sparse Input Neural Radiance Field (AAAI 2024 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.