Research map / Adversarial robustness and security / Attacks on text and graphs
NeRFail: Neural Radiance Fields-Based Multiview Adversarial Attack
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes NeRFail, a NeRF-based multiview adversarial attack that perturbs 3D points via pixel-to-3D mappings so that classifiers misclassify NeRF renderings from both seen and unseen views, and the perturbation can be inherited by retrained NeRFs.
Problem
Adversarial perturbations are usually crafted per 2D image or per dataset, not for 3D scenes; the goal is a perturbation that deceives downstream classifiers on NeRF renderings across multiple viewpoints, including unseen ones.
Approach
A pixel-to-3D transformation (NeRF-based argmax-density mapping plus distance-weighted nearest-neighbor inverse mapping) lets an attack optimize a universal 3D perturbation over a set of camera views, which can then be injected into NeRF training data to poison a retrained NeRF.
Key results
- NeRFail reaches 100% ASR on DA-T for Inception v3 at epsilon=32 with 3 views, and 96.5% on RN-T, versus 84.5% for IGSM and 93.0% for UAP on DA-T at epsilon=32 (IGSM 84.5% at eps 32).
- On ViT-B/16 at epsilon=32, NeRFail-S achieves ASR of 99.0% to 100.0% across DA-T, DA-V, RN-T, RN-V, while UAP reaches 2.2% and 1.4% on RN-T and RN-V.
- Perturbations computed on the training views carry over to NeRFs retrained on poisoned data, giving RN-T/RN-V ASR up to 92-96.5% for Inception v3 at epsilon=32, while IGSM and UAP fail to transfer to NeRF.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| use NeRFail instead of UAP | Inception v3 multiview attack · RN-T | ASR: 2.9 % -> 50.2 % | Helped |
| use NeRFail instead of UAP | Inception v3 multiview attack · RN-V | ASR: 2.5 % -> 42.4 % | Helped |
| use NeRFail-S instead of NeRFail | Inception v3 multiview attack · DA-T | ASR: 66.0 % -> 72.6 % | Helped |
| use NeRFail instead of UAP | ViT-B/16 multiview attack · DA-T | ASR: 100.0 % -> 98.9 % | Hurt |
| use NeRFail instead of UAP | ViT-B/16 multiview attack · DA-V | ASR: 97.3 % -> 77.3 % | Hurt |
| use NeRFail instead of UAP | ViT-B/16 multiview attack · RN-T | ASR: 2.2 % -> 80.6 % | Helped |
| increase ϵ from 8 to 16 (ablation) | NeRFail on Inception v3 · DA-T | ASR: 6.0 % -> 100.0 % | Helped |
| increase ϵ from 16 to 32 (ablation) | NeRFail on Inception v3 · RN-V | ASR: 52.0 % -> 92.0 % | Hurt |
| increase p from 2 to 3 (ablation) | NeRFail on Inception v3 · DA-T | ASR: 36.5 % -> 100.0 % | Helped |
| increase p from 3 to 4 (ablation) | NeRFail on Inception v3 · DA-V | ASR: 38.0 % -> 33.0 % | Hurt |
| increase m1 from 0 to 8 (ablation) | NeRFail on Inception v3 · DA-T | ASR: 98.5 % -> 100.0 % | Helped |
| increase m1 from 8 to 16 (ablation) | NeRFail on Inception v3 · DA-T | ASR: 100.0 % -> 96.0 % | Hurt |
Surprising findings
- NeRFail-S, the simpler and faster variant, consistently outperforms the more optimized NeRFail in ASR, though it produces more visible perturbations.
- UAP outperforms NeRFail on ViT-B/16 for directly attacked images, attributed to background perturbations.
Limitations
- Perturbations at small epsilon (8) yield poor ASR for most attacks; NeRFail needs epsilon around 32 for high ASR.
- NeRFail-S produces more noticeable perturbations than NeRFail.
- Performance drops for hard target classes in targeted attacks (e.g., materials at 3.5% ASR).
Experimental setup
Datasets: NeRF synthetic dataset (8 objects, 400 views each)
Benchmarks: NeRF synthetic dataset
Metrics: attack success rate (ASR) L0 norm L2 norm iterations time
Baselines: IGSM UAP NeRFool Viewfool
Builds on: NeRF Universal Adversarial Perturbation IGSM DeepFool
Closest papers by meaning
- Advancing Adversarial Robustness in GNeRFs: The IL2-NeRF Attack (CVPR 2025 · similarity 0.91)
- NeRFool: Uncovering the Vulnerability of Generalizable Neural Radiance Fields against Adversarial Perturbations (ICML 2023 · similarity 0.91)
- Aug-NeRF: Training Stronger Neural Radiance Fields With Triple-Level Physically-Grounded Augmentations (CVPR 2022 · similarity 0.90)
- NeRFReN: Neural Radiance Fields With Reflections (CVPR 2022 · similarity 0.88)
- Rad-NeRF: Ray-decoupled Training of Neural Radiance Field (NeurIPS 2024 · similarity 0.87)
- Mask-Based Modeling for Neural Radiance Fields (ICLR 2024 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.