AegisRF: Adversarial Perturbations Guided with Sensitivity for Protecting Intellectual Property of Neural Radiance Fields

TL;DR

This work addresses the protection of Neural Radiance Field (NeRF) IP against unauthorized downstream use by injecting adversarial perturbations into NeRF pre-rendering outputs. The proposed AegisRF framework comprises a Perturbation Field that generates appearance and geometry perturbations $(\delta^\mathbf{c}, \delta^\sigma)$ and a Sensitivity Field that learns spatially varying sensitivity $s$ to constrain geometric perturbations via soft clamping, resulting in imperceptible yet effective perturbations. Training optimizes a protection objective that degrades target models and a naturalness objective that preserves rendering quality, enabling robust IP protection across tasks such as multi-view classification and voxel-based 3D localization. The approach demonstrates superior disruption of downstream models while maintaining high visual fidelity, indicating practical potential for secure NeRF deployment across diverse modalities and downstream applications.

Abstract

As Neural Radiance Fields (NeRFs) have emerged as a powerful tool for 3D scene representation and novel view synthesis, protecting their intellectual property (IP) from unauthorized use is becoming increasingly crucial. In this work, we aim to protect the IP of NeRFs by injecting adversarial perturbations that disrupt their unauthorized applications. However, perturbing the 3D geometry of NeRFs can easily deform the underlying scene structure and thus substantially degrade the rendering quality, which has led existing attempts to avoid geometric perturbations or restrict them to explicit spaces like meshes. To overcome this limitation, we introduce a learnable sensitivity to quantify the spatially varying impact of geometric perturbations on rendering quality. Building upon this, we propose AegisRF, a novel framework that consists of a Perturbation Field, which injects adversarial perturbations into the pre-rendering outputs (color and volume density) of NeRF models to fool an unauthorized downstream target model, and a Sensitivity Field, which learns the sensitivity to adaptively constrain geometric perturbations, preserving rendering quality while disrupting unauthorized use. Our experimental evaluations demonstrate the generalized applicability of AegisRF across diverse downstream tasks and modalities, including multi-view image classification and voxel-based 3D localization, while maintaining high visual fidelity. Codes are available at https://github.com/wkim97/AegisRF.

Figures (6)

• Figure 1: (a) Geometric perturbations without consideration of their varying impact on rendering quality lead to significant degradation in rendering quality. (b) Our novel approach mitigates this by measuring the sensitivity of rendering quality to geometric perturbations and adaptively constraining their magnitudes. For example, perturbations are restricted on empty spaces (red point), where disruptions can cause introduction of new artifacts, while larger perturbations are applied on more complex regions (green point), where such disruptions can be better masked by the existing structural complexity.
• Figure 2: Overview of . For a 3D point $(\mathbf{x}, \mathbf{d})$, the Perturbation Field creates appearance ($\delta^\mathbf{c}$) and geometry ($\delta^\sigma$) perturbations, while the Sensitivity Field predicts sensitivity ($s$) to adaptively constrain geometry perturbations ($\hat{\delta}^\sigma$). These perturb NeRF outputs ($\mathbf{c}$, $\sigma$) into perturbed versions ($\mathbf{c}'$, $\sigma'$), forming adversarial examples in various data forms, aiming to disrupt target unauthorized downstream task ($\mathcal{L}_{\text{pro}}$) while preserving rendering quality ($\mathcal{L}_{\text{nat}}$).
• Figure 3: Visualizations of rendered images and model predictions on NeRF, NeRFail, Adv-FT ($\lambda_\text{pro} = 1$ for 3D localization, $\lambda_\text{pro} = 0.003$ for multi-view classification), and our . Our shows superior rendering quality compared to NeRFail and Adv-FT.
• Figure 4: Comparison of naturalness (col. 1-3) and disruption efficacy (col. 4-7) of our sensitivity-guided adaptive approach with a fixed, non-adaptive perturbation bound $\epsilon$. Our strategy leads to the best balance between naturalness and protection performance.
• Figure 5: Images rendered from NeRF (col. 1) and (col. 2), pixel-wise perturbation (col. 3), and sensitivity averaged along each ray of the pixel (col. 4).