mlsanityData to 14 Oct 2026

IPA-NeRF: Illusory Poisoning Attack Against Neural Radiance Fields

arXiv 2407.11921 ↗First posted 16 Jul 2024cs.CV cs.CRcited by 5

On the map: LLM safety and security → Backdoor and data poisoning attacks

Abstract (arXiv)

Neural Radiance Field (NeRF) represents a significant advancement in computer vision, offering implicit neural network-based scene representation and novel view synthesis capabilities. Its applications span diverse fields including robotics, urban mapping, autonomous navigation, virtual reality/augmented reality, etc., some of which are considered high-risk AI applications. However, despite its widespread adoption, the robustness and security of NeRF remain largely unexplored. In this study, we contribute to this area by introducing the Illusory Poisoning Attack against Neural Radiance Fields (IPA-NeRF). This attack involves embedding a hidden backdoor view into NeRF, allowing it to produce predetermined outputs, i.e. illusory, when presented with the specified backdoor view while maintaining normal performance with standard inputs. Our attack is specifically designed to deceive users or downstream models at a particular position while ensuring that any abnormalities in NeRF remain undetectable from other viewpoints. Experimental results demonstrate the effectiveness of our Illusory Poisoning Attack, successfully presenting the desired illusory on the specified viewpoint without impacting other views. Notably, we achieve this attack by introducing small perturbations solely to the training set. The code can be found at https://github.com/jiang-wenxiang/IPA-NeRF.

Key facts. Cited by 5 papers in the map (data through 14 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 33 of its 47 references that are in the map. First posted on arXiv 16 Jul 2024.

Builds on

33 of 47 references.

Closest ancestors · 2

Same direction, newest first

  1. 2021Sleeper Agent: Scalable Hidden Trigger Backdoors for Neural Networks Trained from Scratch16 Jun
  2. 2021Rethinking the Backdoor Attacks' Triggers: A Frequency Perspective7 Apr

Other references · 31

  1. 2022Instant Neural Graphics Primitives with a Multiresolution Hash Encodingcited by 3,723
  2. 2021Mip-NeRF 360: Unbounded Anti-Aliased Neural Radiance Fieldscited by 2,032
  3. 2021Mip-NeRF: A Multiscale Representation for Anti-Aliasing Neural Radiance Fieldscited by 1,964
  4. 2020pixelNeRF: Neural Radiance Fields from One or Few Imagescited by 1,584
  5. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,055
  6. 2021IBRNet: Learning Multi-View Image-Based Renderingcited by 703
  7. 2022Google Scanned Objects: A High-Quality Dataset of 3D Scanned Household Itemscited by 612
  8. 2023Nerfstudio: A Modular Framework for Neural Radiance Field Developmentcited by 600
  9. 2020Backdoor Learning: A Surveycited by 426
  10. 2019A Survey of Deep Learning Techniques for Autonomous Drivingcited by 403
  11. 2019Hidden Trigger Backdoor Attackscited by 371
  12. 2020Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networkscited by 349
19 more
  1. 2020Weight Poisoning Attacks on Pre-trained Modelscited by 341
  2. 2019Label-Consistent Backdoor Attackscited by 296
  3. 2020Backdoor Attacks Against Deep Learning Systems in the Physical Worldcited by 134
  4. 2019TBT: Targeted Neural Network Attack with Bit Trojancited by 113
  5. 2020An Embarrassingly Simple Approach for Trojan Attack in Deep Neural Networkscited by 97
  6. 2021Poison Ink: Robust and Invisible Backdoor Attackcited by 50
  7. 2022ViewFool: Evaluating the Robustness of Visual Recognition to Adversarial Viewpointscited by 48
  8. 2020Backdoor Attacks against Transfer Learning with Pre-trained Deep Learning Modelscited by 44
  9. 2021DeepPayload: Black-box Backdoor Attack on Deep Learning Models through Neural Payload Injectioncited by 44
  10. 2021PointBA: Towards Backdoor Attacks in 3D Point Cloudcited by 35
  11. 2023Towards Transferable Targeted 3D Adversarial Attack in the Physical Worldcited by 25
  12. 2021Subnet Replacement: Deployment-stage backdoor attack against deep neural networks in gray-box settingcited by 21
  13. 2022Few-shot Backdoor Attacks via Neural Tangent Kernelscited by 15
  14. 2023NeRFool: Uncovering the Vulnerability of Generalizable Neural Radiance Fields against Adversarial Perturbationscited by 10
  15. 2023Adv3D: Generating 3D Adversarial Examples for 3D Object Detection in Driving Scenarios with NeRFcited by 10
  16. 2023Targeted Adversarial Attacks on Generalizable Neural Radiance Fieldscited by 10
  17. 2023Shielding the Unseen: Privacy Protection through Poisoning NeRF with Spatial Deformationcited by 4
  18. 2024Noise-NeRF: Hide Information in Neural Radiance Fields using Trainable Noisecited by 4
  19. 2023Steganography for Neural Radiance Fields by Backdooringcited by 3

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 2; 2026: 3.

5 papers.

  1. 2025StealthAttack: Robust 3D Gaussian Splatting Poisoning via Density-Guided Illusionscited by 6
  2. 2026Spectral Defense Against Resource-Targeting Attack in 3D Gaussian Splattingcited by 1
  3. 2025ComplicitSplat: Downstream Models are Vulnerable to Blackbox Attacks by 3D Gaussian Splat Camouflagescited by 0
  4. 2026StegoNGP: 3D Cryptographic Steganography using Instant-NGPcited by 0
  5. 2026PatchPoison: Poisoning Multi-View Datasets to Degrade 3D Reconstructioncited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2024IPR-NeRF: Ownership Verification meets Neural Radiance Field
  2. 2024Protecting NeRFs' Copyright via Plug-And-Play Watermarking Base Model
  3. 2024AdvIRL: Reinforcement Learning-Based Adversarial Attacks on 3D NeRF Models
  4. 2024Backdoor Attacks against No-Reference Image Quality Assessment Models via a Scalable Trigger
  5. 2023CopyRNeRF: Protecting the CopyRight of Neural Radiance Fields
  6. 2024ID-NeRF: Indirect Diffusion-guided Neural Radiance Fields for Generalizable View Synthesis
  7. 2024Are NeRFs ready for autonomous driving? Towards closing the real-to-simulation gap
  8. 2024Transparency Attacks: How Imperceptible Image Layers Can Fool AI Perception