Adversarial Robustness of Implicit Neural Representation-Based Classifiers

Implicit neural representations (INRs) encode data as continuous coordinate-based functions parameterized by neural networks, shifting downstream tasks such as image recognition to operate on functional rather than discrete representations. Despite their increasing adoption, the adversarial robustness of INR-based classification pipelines remain largely underexplored. In this work, we present the first systematic study of adversarial robustness in INR-based classifiers. A key challenge is that generating an INR requires $\text{\emph{training}}$ a neural network for each input sample, resulting in an optimization-in-the-loop forward pass that renders standard gradient-based attacks computationally prohibitive. To address this, we design surrogate models that amortizes the INR-generation process, serving as a practical proxy for attacking INR-based classifiers. We also develop speed-up techniques that substantially reduce the training cost of the surrogate. We show that in contrast to recent work, INR-based classifiers are vulnerable: under adversarial input perturbations, classification accuracy collapses to near zero. Moreover, existing countermeasures designed to operate on discrete representations offer limited protection.

Modern AI can store a picture not as a grid of pixels, but as a small neural network that recreates the image on demand. Researchers have built image-recognition systems on top of this compact format, and some recent work suggested these systems might be naturally harder to fool with the tiny, deliberately crafted distortions that trick ordinary AI --- but no one had tested this claim carefully. Testing it was difficult: turning each image into its own neural network is a slow process that blocks the standard tools attackers rely on. We got around this by building fast "stand-in" models that imitate this conversion step, letting us apply standard attacks for the first time. We found these systems are not safe after all. Almost invisible changes to an image collapsed their accuracy to nearly zero, and the same weakness appeared on 3D shapes. Existing defenses offered little protection. Our findings warn that recognition systems built on this compact image format must be thoroughly stress-tested before they can be trusted in real-world applications.