{"id":"2b81ffc4-cd4e-4750-9a16-e42bbfe90e58","arxiv_id":"2411.09749","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"A survey that organizes adversarial attacks using differentiable rendering into five attacker goals and five scene manipulation categories, claiming to be the first such unified framework.","lead":"A team reviews 28 papers on using 3D rendering software to create adversarial attacks on AI vision models. The paper proposes a framework that groups these attacks by attacker goal and scene component, and highlights research gaps; the framework is useful but contains fixable errors.","discovery_kind":"review","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The survey's completeness and category-assignment reliability are not established; internal inconsistencies (non-attack rows, missing works, unreproducible counts) undermine the comparative and gap-analysis claims.","rationale":"The reader's weakest assumption was that the five goals and five manipulation categories are complete and correctly assigned; my stress-test identifies the same issue as the most load-bearing concern. The paper's contribution is explicitly comparative: it claims to facilitate easy comparison, identify research gaps, and derive prevalence statistics (e.g., texture attacks are the most prevalent). Every one of these outputs depends on the accuracy of the corpus and its labels. The internal evidence is sufficient to doubt that accuracy: Papernot et al. 2016b is not an attack, and Hu et al. 2023 and Jiang et al. 2024 are absent from the 28-work list while appearing in the target-model table. The counts reported in Section 2 and Section 4 cannot be verified from the tables as given, so the headline contribution is, at best, unvalidated. The framework itself may still be useful, and all identified problems are fixable with an audit and correction pass, so a conditional acceptance with mandatory revisions is the appropriate posture. Since the reader already reached CONDITIONAL, no verdict adjustment is needed.","tokens_in":10029,"tokens_out":2319,"duration_ms":24318,"concrete_test":"Reconstruct the survey corpus by applying the stated selection criteria to a forward citation search for differentiable rendering methods (NeRF, 3D Gaussian Splatting, PyTorch3D, Neural Mesh Renderer) combined with adversarial attack terms; independently classify each included work's attacker goal and manipulated scene component from the original paper; then reconcile Table 1 and Table 2 by checking that every Table 2 work appears in Table 1 and that the 28-row list matches the corpus. Recompute all reported counts. If any category count shifts by more than one, or if Papernot et al. 2016b remains classified as an attack, the survey's comparative statistics and research-gap conclusions are not supported.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's central claim is that its five-goal/five-manipulation framework is the first comprehensive, attacker-task guided survey, enabling reliable comparison and gap identification. This requires that the 28-work corpus is complete and correctly typed, and that each work's assignment to goals and manipulation categories is accurate. Both are insecure. The paper reports 28 works and 24 attacks, but Table 1 marks Papernot et al. 2016b as an attack even though that paper is a position paper on the science of security, not an adversarial attack using differentiable rendering. Table 2 includes Hu et al. 2023 and Jiang et al. 2024, which do not appear among the 28 rows of Table 1; both are differentiable-rendering attacks that should affect the counts and the gap analysis. The claimed category counts (misclassification 18, misdetection 17, reduce confidence 10, motion/depth 1 each; texture 15, geometry 7, pose 5, illumination 2, sensors 1) cannot be reproduced from Table 1's cells as printed. With at least one non-attack paper counted and at least two attack papers missing, the 'most prevalent' texture claim and the conclusion that illumination and sensors are underexplored may be artifacts of the flawed inventory rather than properties of the literature. This is an internal consistency and scope problem, not a disagreement with external consensus.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a task-based survey framework for adversarial attacks that use differentiable rendering. It defines five attacker goals (misclassification, misdetection, reduce confidence, misestimate motion, misestimate depth) and five scene-manipulation categories (geometry, texture, pose, illumination, sensors), and it reports a corpus of 28 works classified as 3 surveys, 1 metrics paper, and 24 attacks. The survey also inventories attacked DNN models and attacker access levels, discusses digital and physical attack domains, and proposes future directions centered on target diversity, modern model architectures, real-world phenomena, and tooling.","tokens_in":10281,"tokens_out":8655,"duration_ms":72768,"significance":"A reliable, task-based survey of differentiable-rendering attacks would be a genuinely useful contribution because this literature is fragmented across goals, scene representations, and rendering toolchains. The paper's five-goal/five-manipulation framing is a sensible organizing device, and the inventory of attacked models plus the digital/physical domain discussion add practical value. However, the central claims of the paper are comprehensiveness and the identification of research gaps from quantitative counts, and those claims are not currently reproducible from the tables and text. If the corpus is corrected and the counts recomputed from a consistent per-work category table, the survey could serve as a reference; in its present form the quantitative findings are not trustworthy.","major_comments":[{"comment":"The paper states that the 28 works are categorized as 3 surveys, 1 metrics paper, and 24 attacks, and it derives goal counts from the 24 attacks (18 misclassification, 17 misdetection, 10 reduce confidence, 1 motion, 1 depth). Table 1 as printed is inconsistent with that classification: Wiyatno et al. [2019] is an adversarial-examples survey but is labeled A; Papernot et al. [2016b] is a position paper on the science of security and privacy but is labeled A; and Papernot et al. [2016a] is an early adversarial-examples paper that does not use differentiable rendering but is labeled A. Moreover, Bolya et al. [2020] is an error-analysis toolbox rather than an attack, so the overall corpus is not a clean set of differentiable-rendering attack works. Because these rows enter the attack base or the corpus, the counts and the later claim that texture attacks are the most prevalent (Sec. 4) are not reliable as printed.","section":"Sec. 2, Table 1"},{"comment":"Table 2 lists Hu et al. [2023] and Jiang et al. [2024] as attacked-model columns, but neither work appears in Table 1 or in the stated 28-work corpus. Conversely, eight Table 1 rows (Bolya, Cao, Li et al. 2024b, Machado, Papernot et al. 2016a, Papernot et al. 2016b, Wiyatno, Yuan) have no corresponding column in Table 2. This mismatch means the corpus is not consistently defined across the two central tables, so the comprehensiveness claim in Sec. 1.1 and the research-gap analysis in Sec. 6 must be re-derived after the inventory is reconciled.","section":"Table 2"},{"comment":"The manipulation-category counts in Sec. 4 (texture 15, geometry 7, pose 5, illumination 2, sensors 1) are central to the survey's gap analysis, but the paper does not provide a per-work mapping of the 28 works to these five categories. The colored cells in Table 1 are not enumerated in the text, and after the misclassified rows and missing works are corrected the counts will change. The authors should provide an explicit per-work category table and recompute all counts and gap statements from it.","section":"Sec. 4"},{"comment":"The survey's selection criteria are not stated. The abstract and Sec. 1.1 claim comprehensiveness ('We reviewed 28 works from top venues'), yet no search protocol or inclusion/exclusion criteria are given. Without such a protocol the reader cannot distinguish a deliberate scope restriction from an omission; given the Table 1/Table 2 mismatch and the presence of Hu et al. 2023 and Jiang et al. 2024 in the references, the 'first comprehensive' claim is not defensible as written.","section":"Sec. 1.1"}],"minor_comments":[{"comment":"The phrase 'are key ingredient needed to produce' should be 'are key ingredients needed to produce'.","section":"Abstract"},{"comment":"The sentence that lists surveys on NeRF and 3D Gaussian Splatting is a run-on and should be split for readability.","section":"Sec. 1.1"},{"comment":"The citation key 'Chen and Wang., 2024' contains a stray period inside the author field and should be reformatted.","section":"References"},{"comment":"The quotation formatting around 'sticker-mode' is inconsistent, with an opening quotation mark missing before the word in the text.","section":"Sec. 5.2"},{"comment":"Presenting works as columns and models as rows makes the table hard to scan; transposing it so each row is a work and each column a model would better match the reader's expectations for an attacked-model inventory.","section":"Table 2"}],"recommendation":"major_revision","confidential_remarks":"The inventory inconsistencies are the main obstacle to publication. In particular, the counting of surveys and position papers as attacks in Table 1, and the appearance of Hu et al. 2023 and Jiang et al. 2024 in Table 2 but not Table 1, are not merely cosmetic: they affect the survey's headline statistics and gap analysis. I would ask the authors for a corrected, consistent corpus table and a short reproducibility statement describing how the 28 works were selected and how the category counts were computed."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Punchline: this is the first survey that seriously organizes adversarial attacks via differentiable rendering, and the five-goal, five-component framework is a genuinely useful lens. But the paper's internal numbers don't hold up—several works are mistyped, two attacks are missing from the corpus table, and the headline counts don't reproduce from the tables as printed. As a reference, it's not trustworthy yet.\n\nWhat's new and good: the survey fills a real gap. Kato et al. and the NeRF/Gaussian Splatting surveys don't cover adversarial use, and adversarial-ML surveys skip differentiable rendering. This paper puts them together. The framework—misclassification, misdetection, reduce confidence, misestimate motion, misestimate depth crossed with geometry, texture, pose, illumination, sensors—is the right kind of organizing device. The coverage of representative works (MeshAdv, Adv3D, DTA, ACTIVE, RAUCA, ViewFool, Distracting Downpour, LiDAR-ADV) is broad enough to orient a newcomer. The gap analysis pointing at illumination and sensors as underexplored is sensible.\n\nWhere it's soft: the corpus is not clean. The paper reports 28 works: 3 surveys, 1 metrics paper, 24 attacks. Table 1 marks Wiyatno et al. 2019 as an attack, but that's a survey. Papernot et al. 2016b is a position paper on the science of security, not a differentiable-rendering attack. Those two mistypings already break the count. At the same time, Hu et al. 2023 and Jiang et al. 2024 appear in the attacked-models table but never enter the 28-work list, so the corpus isn't closed. The stated category counts (18 misclassification, 17 misdetection, 10 reduce confidence, texture 15, geometry 7, etc.) don't reproduce from Table 1's cells. This matters because the whole contribution is comparative. If the inventory is wrong, the \"texture is most prevalent\" and \"illumination is underexplored\" conclusions may be artifacts of the table, not properties of the literature. These are fixable—re-run the inclusion criteria, correct the typings, regenerate the numbers—but they need to be fixed.\n\nThis is a survey, so no new math or experiments. The value is entirely in whether the organization is accurate. Right now it's a good skeleton with some data-quality problems.\n\nBottom line: I'd bring it to peer review, not desk reject, but with a clear demand to fix the corpus and recount. Once that's done it could be a standard entry point for researchers new to this area. I wouldn't cite it in its current form.\n\nRecommendation: engage with it—either in review or before releasing a v3—but don't treat the current statistics as reliable.","headline":"A useful first map of differentiable-rendering attacks, but the survey's own counts don't hold together; fix the corpus and it's worth citing.","tokens_in":10842,"tokens_out":3810,"would_cite":false,"duration_ms":36576,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper maps every differentiable-rendering adversarial attack into five attacker goals and five scene manipulations, exposing texture attacks as dominant and lighting and sensor attacks as rare.","keywords":["differentiable rendering","adversarial attacks","neural radiance fields","3D Gaussian splatting","attacker goals","scene manipulation","survey","autonomous driving"],"falsifier":"A literature search that finds a published differentiable-rendering adversarial attack that does not fit any combination of the five goals and five manipulations—for example, an attack that only alters material reflectance or camera lens distortion—would refute the survey's claim that the framework is exhaustive.","tokens_in":9817,"feed_emoji":"🎭","tokens_out":11031,"duration_ms":87125,"temperature":0.7,"pith_summary":"Differentiable rendering—Neural Radiance Fields, 3D Gaussian Splatting, and related tools—lets an attacker optimize not pixels but the underlying 3D scene: geometry, texture, lighting, object pose, or camera parameters. This survey argues that the resulting attacks, although scattered across many papers with different goals, fit a single attacker-task framework: five attacker goals (misclassification, misdetection, confidence reduction, motion misestimation, depth misestimation) crossed with five scene manipulations (geometry, texture, pose, illumination, sensors). The paper's own tally of 28 works shows texture attacks are by far the most common (15) while illumination (2) and sensor (1) attacks are rare. A sympathetic reader should care because organizing the field this way turns scattered results into a map of what is known and, most importantly, what is not—most visibly, the near absence of lighting and camera-based attacks.","feed_headline":"First survey maps 3D adversarial attacks by goal and scene edit","feed_subtitle":"It reveals texture attacks dominate while lighting and sensor hacks remain nearly unexplored.","key_machinery":"The survey's load-bearing object is the crossover of attacker goals and 'scene components' that can be manipulated through the differentiable rendering pipeline. Attacker goals are the five threat-model categories—misclassification, misdetection, reduce confidence, misestimate motion, misestimate depth. Scene manipulations are the five categories of geometry (mesh vertices, point clouds), texture (color, UV maps, reflectance), object pose and translation, illumination (light sources), and sensors (camera and LiDAR parameters). The differentiable renderer is the enabling mechanism: because rendering is differentiable, gradients of the victim DNN's loss flow backward through the renderer to the 3D scene parameters, allowing gradient-based optimization of any manipulated component. The survey's tables cross these two dimensions and use the resulting counts as evidence of which attack surfaces are crowded and which remain open.","core_discovery":"The central claim is that all existing adversarial attacks using differentiable rendering can be classified by the attacker's goal and by the scene component manipulated, and that this classification is exhaustive and useful. The paper offers a framework with five goals (misclassification, misdetection, reduce confidence, misestimate motion, misestimate depth) and five manipulation categories (geometry, texture, pose, illumination, sensors), then places each of 28 surveyed works in the resulting matrix. The statistical picture that emerges is the paper's main finding: texture manipulation accounts for 15 of the 24 attack papers, geometry for 7, pose for 5, illumination for 2, and sensors for 1; misclassification is the most common goal (18), followed by misdetection (17) and confidence reduction (10), while motion and depth misestimation each have only a single attack. This distribution, the paper argues, reveals that the field has concentrated on visual appearance while neglecting scene-level parameters like lighting and camera settings, and it uses that gap to motivate four future directions: broader target diversity, state-of-the-art models and new modalities, physically realistic phenomena, and better tools and pipelines.","pith_inferences":["If the framework is right, the scarcity of illumination and sensor attacks is likely a tooling artifact—current differentiable renderers make whole-scene lighting control difficult—so the grid's lopsidedness may reflect engineering limits rather than the true vulnerability surface.","A direct testable extension is to build an illumination-only or camera-parameter-only attack with a modern renderer and measure physical transferability; the framework predicts the least-explored cells are the most promising for new attacks.","As robots and drones adopt NeRF and Gaussian Splatting for scene representation, the same manipulations—for example, rain-like geometry that corrupts optical flow—could be repurposed against embodied perception stacks, not just image classifiers and detectors."],"forward_implications":["Researchers gain a common coordinate system (goal × manipulated component) for comparing attacks that previously had no shared vocabulary.","The dominance of texture attacks (15 of 24 attack papers) implies that defensive work against adversarial textures is the most urgent, while illumination and sensor attacks are largely open threat surfaces.","Because differentiable rendering produces physically plausible scene edits, the surveyed attacks can transfer from digital simulations to physical objects, threatening real-world systems such as autonomous driving.","The near absence of motion and depth misestimation attacks (one each) suggests those goals are understudied rather than practically safe, and the paper explicitly lists them as future directions."],"supporting_citations":[{"why":"introduces NeRF, the implicit scene representation that several surveyed attacks use for rendering and reconstruction.","marker":"[Mildenhallet al., 2020]"},{"why":"introduces 3D Gaussian Splatting, the real-time differentiable renderer the survey identifies as a key tool.","marker":"[Kerblet al., 2023]"},{"why":"provides the first differentiable-rendering parametric adversary and the gradient chain rule for geometry attacks.","marker":"[Liuet al., 2019]"},{"why":"MeshAdv, which perturbs mesh vertices with a neural mesh renderer, anchors the geometry attack category.","marker":"[Xiaoet al., 2019]"},{"why":"demonstrates pose-based misclassification and anchors the pose manipulation category.","marker":"[Alcornet al., 2019]"},{"why":"uses a differentiable LiDAR simulator and anchors the sensor/point-cloud attack category.","marker":"[Caoet al., 2019]"},{"why":"the only surveyed attack on depth misestimation, using expectation over transformation and texture conversion against monocular depth models.","marker":"[Zhenget al., 2024]"},{"why":"the only surveyed attack on motion misestimation, using rain-like geometry against optical flow.","marker":"[Schmalfusset al., 2023]"},{"why":"defines the attack surface and threat-model framing the survey builds on.","marker":"[Papernotet al., 2016b]"},{"why":"the existing 2D/3D adversarial robustness survey whose threat-model definitions the paper adopts.","marker":"[Liet al., 2024b]"}],"fun_headline_variants":["Texture attacks rule 3D adversarial landscape, survey finds","Adversarial rendering survey: texture hacks widespread, lighting ignored","New taxonomy maps 3D attacks: texture dominates, sensors rare","First taxonomy for 3D adversarial attacks exposes texture bias"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The survey's framework and gap analysis stand on the completeness of its five attacker goals and five scene-manipulation categories and on every surveyed work being an attack correctly assigned to one cell of that matrix.","fun_headline_variants_meta":{"raw":{"variants":["Texture attacks rule 3D adversarial landscape, survey finds","Adversarial rendering survey: texture hacks widespread, lighting ignored","New taxonomy maps 3D attacks: texture dominates, sensors rare","First taxonomy for 3D adversarial attacks exposes texture bias"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000522,"raw_usage":{"total_tokens":2516,"prompt_tokens":925,"completion_tokens":1591,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":541,"completion_tokens_details":{"reasoning_tokens":1520}},"tokens_in":541,"tokens_out":1591,"duration_ms":12089,"temperature":1.0,"reasoning_tokens":1520,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T20:20:42.347529+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"A literature search that finds a published differentiable-rendering adversarial attack that does not fit any combination of the five goals and five manipulations—for example, an attack that only alters material reflectance or camera lens distortion—would refute the survey's claim that the framework is exhaustive.","supporting_citations":[{"cited_title":"Mildenhall, P","cited_arxiv_id":null,"evidence_quote":"introduces NeRF, the implicit scene representation that several surveyed attacks use for rendering and reconstruction."},{"cited_title":"Kerbl, G","cited_arxiv_id":null,"evidence_quote":"introduces 3D Gaussian Splatting, the real-time differentiable renderer the survey identifies as a key tool."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"provides the first differentiable-rendering parametric adversary and the gradient chain rule for geometry attacks."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"MeshAdv, which perturbs mesh vertices with a neural mesh renderer, anchors the geometry attack category."},{"cited_title":"Alcorn, Q","cited_arxiv_id":null,"evidence_quote":"demonstrates pose-based misclassification and anchors the pose manipulation category."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"uses a differentiable LiDAR simulator and anchors the sensor/point-cloud attack category."},{"cited_title":"Zheng, C","cited_arxiv_id":null,"evidence_quote":"the only surveyed attack on depth misestimation, using expectation over transformation and texture conversion against monocular depth models."},{"cited_title":"Schmalfuss, L","cited_arxiv_id":null,"evidence_quote":"the only surveyed attack on motion misestimation, using rain-like geometry against optical flow."}],"review_version":1}