Adversarial Attacks in Weight-Space Classifiers
Authors: Tamir Shor
Ethan Fetaya
Chaim Baskin
Alex M. Bronstein
Venue: Accepted by TMLR ()

Abstract: Implicit Neural Representations (INRs) have been recently garnering increasing interest in
various research fields, mainly due to their ability to represent large, complex data in a compact and continuous manner. Past work further showed that numerous popular downstream
tasks can be performed directly in the INR parameter-space. Doing so can substantially
reduce the computational resources required to process the represented data in their native domain. A major difficulty in using modern machine-learning approaches, is their high
susceptibility to adversarial attacks, which have been shown to greatly limit the reliability
and applicability of such methods in a wide range of settings. In this work, we show that
parameter-space models trained for classification are inherently robust to adversarial attacks
– without the need of any robust training. To support our claims, we develop a novel suite of
adversarial attacks targeting parameter-space classifiers, and furthermore analyze practical
considerations of such attacks.

Published in Transactions on Machine Learning Research (02/2026)
Adversarial Attacks in Weight-Space Classifiers"
Tamir Shor
tamir seriir.shorriee
Department of Computer Science
Technion Israel Institute of Techmology Haifo, Isrell
Ethan Fetaya
chann.fetaya Aaiutaaaaabb.cc
Faculty of Engineering
Bor-Ban University
Romat Gon, Israel
Chaim Baskin
chaimbaskin@@byu.com
School of Electrical and Computer Engineering
Ben- Cun-Garion University of the Negev
Be err Sheva, Israel
Alex Bronstein
Monn@esttechion..co
Technion Israel Institute of Technology, Haifa, Isruel Institute of Science and Technology, Austria
Reviewed OpenReview: https: openreview. net/ forum? id= eOLybAlsls
Abstract
Implicit Neural Representations (INRs) have been recently garnering increasing interest various research fields, mainly due their ability represent large, complex data in a compact, continuous manner. Past work further showed that numerous popular downstream tasks can be performed directly in the INR. paramoter-space. Doing reduce the compulational resources required to process the represented data in their na- tive domain. A major difficulty in using modern machine-learning approaches, is their high susceptibility to adversarial attacks, which have been shown to greatly limit the reliability and applicability of such methods in a wide range of settings. In this work, we perform an in-depth security analysis of the behavior of weight-space classifiers under adversarial attacks. Our study reveals that parameter-space models trained for classification exhibit increased robustness to standard white-box adversarial attacks compared to standard clas- sifiers that operate in the original signal space. This is achieved without the need of any robust training. We source this robust behavior to the phenomenon of gradient-obfuscation promoted during the INR optimization process, and pinpoint the limitations of this robust- ness under alternative adversarial approaches. To support our claims, we develop a novel suite of adversarial attacks targeting parameter-space classifiers, and furthermore analyze practical considerations of such attacks.
substantially
1 Introduction
Implicit Neural Representations (INRs) represent arbitrary signal neural network that predicts signal values based on spatial or temporal coordinates. These representations have recently been raising increased interest due to their ability to efficiently and compactly encode high-dimensional data while maintaining high input fidelity, and have further been shown to be capable of learning additional intrinsic knowledge
latent within the original signal-domain representation (Sizznann et al. 2020 Wang et al.] 2021 While
*Code available httpp::////.. httppa://iiee thub. wwtp://aanirrroo////rraaaaaaaaaa Saateeer--pppppaaattaaaeeee

---

Published in Transactions on Machine Learning Research (02/2026)
MNIST Full PGD
-NIST-Signal Domain
Clean Modulations
Perturbed Modulations
Clean Latents
Perturbed Latents
t-SNE projection of modulation vectors fitted for clean and adversarially-perturres data for parameter-span and signal-space classifiers.
Figure 1:
INRs are inherently designed to fit one specific signal (rather than gencralizing across an entire dataset); several recent. works have proposed ways to use these representations to achieve a variely of dlwnnst tasks by using some neural meta-network operating directly over the parameter-space of the INR of each
signal within the dataset (Chen & Wang 2022 Dupont al., 2022 Lee et al., 2021 Navon et al. 2023b).
In these settings, each data sample is received in the nalive signal space, converted to its compressed INR representation by fitting neural model, and finally the meta-network performs the designated downstream task over the implicit representation encoded by the model's parameters. These approaches alleviate chal- lenges of processing high-dimensional data, often avoiding complex, specialized architectures and reducing computational demands.
Adversarial attacks are known be a major concern for the use of neural networks across variety of tasks. In this work, explore to the best of our knowledge, for the first time the adversarial robustness of parameter-space classifiers. We start by framing the problem: any attack on a parameter-space classifier must be simultancously optimized to reduce classification performance while also satisfy some constraint incurring the original, signal domain data fidelity. Since no prior studies have addressed this setting, we first formulate a novel set of possible white-box attacks over several data modalities. We then proceed to show that parameter-space classification models are inherently more robust whitc-box adversarial attacks in comparison to the signal-domain classification problem counterpart.
We attribute the relative robustness observed in experiments to mechanism of gradient obfuscation inherent to the INR pipeline. Firstly, adversarial attacks commonly exploit the locally linear nature of modern deep classifiers in high-dimensional spaces to create perturbations that, while bounded, are heavily amplified by the classifier to create significant data manipulations in deeper layers TTggle & Kulkarni 2021 Romano et al. 2020). In the setting parameter-space classification, however, an INR optimization loop is embedded into the inference process. This optimization is disjoint from the downstream objective and is dedicated expressing global data features. We hypothesize that this process acts as functional scrubber: due to the spectral bias of INRs towards low-frequency components (Sitzmann et al. 2020), the optimization reconstructs the global signal structure while elfectively failing to fit the high-frequency adversarial pertur- bations. Consequently, the adversarial pattern is attenuated-or cerubbe-froom the representation before it reaches the classifier.
Secondly, as we later show in section 4.5 poses significant computational difficulties for white-box attacker, as attacking the INR given a perturbed signal requires backpropagation through an internal optimization loop.
performing adversarial attacks over parameter-space classifiers
In summary, this paper makes the following contributions:
We propose several novel types of adversarial white-box attacks for parameter-space classifiers, balancing accuracy and computational resource consumption.
2

---

Published in Transactions on Machine Learning Research (02/2026)
2. We analyze the behavior of parameter-space classifiers under adversarial attacks, and supply evidence of relative robustness of such classifiers to gradient-based white-box adversarial attacks (compared to signal-domain counterparts). We empirically study the origin of this inherent robustness, piupointing to gradient obfuscation originated from the internal INR optimization loop.
3. We explore and mark the limitations of this robust behavior under gradient-free attacks.
4. To substantiate our claims on 3D data, we also formulate novel adversarial attack for voxel-grid data representations, and demonstrate its performance in both parameter-space and signal-space classification settings.
2
Related Work
The analysis of trained neural network parameters has raised incrcasing interest in recent years, evolving from statistical analysis to sophisticated deep learning on neural functionals. (Eilertsen et al. 2020) was one of the first works considering this idea, performing trained network parameter analysis to identify optimization hyperparameters. (Unterthiner et al., (020) showed that trained CNN classíficr parameters can be used directly attain a good assessment of classification accuracy without running the full model's forward pass. Recent advancements have introduced equivariant architectures to process these parameters more effectively: (Navon et al. 2023a) proposed DWSNets to respect permutation symmetries in weight spaces, while (Zhou ct al. 2023 and (Zhou et al.) 2024) introduced Neural Functional Transformers (NFTss and Universal Neural Functionals (UNFs) to leverage attention mechanisms for processing weights of diverse architectures.
Dupont et al. 2022 were the first to demonstrate that neural network parameters, specifically of SIREN (Sizzmann 2020) models, could be used the direct and only input for training meta-learner models for classification, generative, and inttaiiputtatin tasks. This domain has expanded generative modeling of weight spaces, where (Peebles et al. 2022) and (Schürholt et al. 2024 employ diffusion and hyper- representations to generate manipulate model parameters.
In the context of adversarial robustness, our work relates to the phenomenon of gradient obfuscation and purification. (Athalyc et al. 2018) famously categorized defenses relying on shattered or vanishing gradi- ents phenomena often observed unrolled optimization loops as causing a false sense of security. Simi- larly, Yang et al. 2022) analyzed Deep Equilibrium Models (DEQs), finding that their fixed-point nature can mask gradients, necessitating implicit differentiation for effective evaluation. Conceptually, the 'scrub- bing' effect observe parallels adversarial purification methods, such DiffPure (Nie et al.) 2022 which use generative processes to cleanse inputs. While (Luo et al. 2024) recently proposed training INRs specif- ically to enhance data robustness, our work uncovers the inherent robustness of parameter-space classifiers to white-box gradient-based adversarial attacks, that arises without such explicit robust training. Finally, regarding 3D data, adversarial attacks have primarily focused on point clouds (Xiang et al. 2019 Liu et al. 2019a) or neural radiance fields (Fu et al. (202)), leaving voxel-based parameter-space classification largely unexplored.
3 Method
3.1
Implicit neural representations
Let X' denote a class of signals of the form : R. -> Rn (for clarity, we consider the domain and the co-domain to be finite Euclidean spaces; a more general formulation is straighttfrrwad). Given a specific signal æ, the fitting of implicit neural representation consists of fitting neural model F, parameterized by 0 E y so to approximate in the sense of some norm, (Chen & Wang 2022 Dupont et al. 2022
0* (z) arg min REy
Fo - x11xx
(1)
In what follows, we denote the representation obtained by solving the minimization problem in equation map R :: X V, that R 0 (x:). For the sake of clarity, we wish to stress that F and R
3

---

Published in Transactions on Machine Learning Research (02/2026)
are two related yet distinct functions in notation, F is the INR. projecting spatial conditioning onto signal values (e.g., if F represents signal x, F maps pixel coordinates to pixel values at each coordinate). Conversely, R is an optimization process of the INR given a signal. Namely, given a signal I, R finds the best set of paramoters # (namcly, the best INR, F) to represent x.
3.2 Prrameter-Space Classifiers
In contrast to conventional classifiers operating directly on the signal space X, parameter-space classifiers operate on the signal INRs, R(X) C V. We denote a parameter-space classifier as My, parameterized by v; the model receives the representation parameters 0 = R(x) as the input and outputs the predicted class label è = My (f) as the output.
Even for small neural representation models, the parameler space y is often high-dimensionall increasing difficulties related to computational resources and overfitting when training the classification models on it (Navon al. 2023a bj. Functas (Dupont et al. 2022) cope with this issuc of increased parameter-space dimensionality by partitioning the parameter space into shared weights and sample-specific biases. Namely, instead of optimizing an entire distinct MLP model for every represented signal (e.g. image) from the dataset, Functas optimize a single MLP for the entire dataset. For every specific sample in the dataset, an INR is optimized by maintaing the global set of weights, and only optimizing the set of biases to present each distinct data sample. Mathematically, denoting the entire set of weights of each INR Vw and the entire set of biases V% (so that y V. U3)), all samples share a single vector of weights 0wr Yo across collection of reprosented signals, while allowing to fit individual modulation vectors v(z)) Rd of fixed dimension with learned shared linear decoder W such that each signal has individual vector of biases, (z(x) Wr(z). This technique was successfully demonstrated with using the SIREN (Sitzmann et al. 2020 models as the MLP backbone for neural representations.
As previously mentioned, relates to the entire set of parameters of the INR F. For SIRENs (used in this paper), 0 composed of a set of weight parameters Ow, shared across all data samples within a dataset, and set of bias parameters 0s, that are distinet for each represented signal. Nonetheless, for convenience (and with slight abuse of notation) for the rest of the paper we denote parameters 6, governing the representation of every F, as 0.
3.3 Threat Model
In this work we explore a setting where the adversary operates the signal domain X, but the classification occurs in the parameter domain V. The rational for this choice, rather than applying perturbations in parameter-space, is two-fold. First, bounding attacks in parameter-space is difficult to define. The signal- domain response of adversarial perturbation applied in weight-space is difficult to evaluate and define in such manner that applies to a wide-enough set of neural representations. We defer the study of this matter to future work. Second, the core of our work is the exploration of adversarial robustness of weight-space classifiers in comparison to signal-space classifiers. For a fair comparison, we perturb both types of pipelines in signal domain.
Adversary Goal We consider untargeted evasion sctting. Given clean input signal x X' with ground-truth label y (or the model's clean prediction ğ Ma (R))))) the adversary aims to find a perturbation 8 such that the parameter-space classifier Ma misclassifies the implicit representation of the perturbed signal. Formally, the adversary seeks to maximize a loss objective L (e.g., Cross-Entropy):
max L (M& (M + +)))
(2)
8
subject to the perturbation constraints defined below.
Adversary Capabilities The adversary is capable of modifying the data input, but is constrained by the nature of the INR pipeline.
4

---

Published in Transactions on Machine Learning Research (02/2026)
Signal-Domain Constraint: The adversary can only add perturbations 8 to the imput signal z in its native domain. The perturbation is bounded by norm budget ||ö|| S e (e.g., Tro or Lo for voxel grids) to ensure the attack remains imperceptible or physically realizable.
Indirect Parameter Manipulation: Crucially, the adversary cannot directly manipulate the INR parameters 0. The adversarial parameters fddo are a derived quantity resulting from the modulation optimization process R. Thus, the adversary must solve bi-level optimization problem: finding 5 in signal space that, after passing through the non-linear optimization mapping R(x + 8), results in Onde that lies in the error region of Me-
Adversary Knowledge We assume a White-Box setting, where the adversary has complete trans- parency regarding the system components. Specifically, the adversary has full knowledge of the classifier weights 1,, the INR architecture, and the specific algorithm used for (including the optimizer, learning rate, and number of steps n)). While the adversary theoretically possesses the information required to compute ex- act gradients via backpropagation through time (BPTT), the optimization process R may involve hundreds of steps, making full gradient computation computationally expensive or memory-prohibiiiiv. Consequently, our evaluation considers adversaries with varying computational budgets (including the full budget), utilizing both approximate methods (e.g., section 3.4.2 and exact. methods (e.g. sections 3.4. 3.4.5
Defense Sctting - The defender employs a standard parameter-space classifier Md trained on clean mod- ulation vectors. We explicitly exclude adversarial training or preprocessing defenses from the defender's strategy. This ensures that our results measure the inherent robustness properties of the parameter-space architecture itself, rather than the efficacy of a specific defense algorithm.
3.4 Parameter-Space Adversarial Attacks
Given a pre-trained parameter-space classification model Ms. our objective is to optimize an adversarial perturbation in signal domain under some Lg(x'')-orm bound,
max 8
(R(x + 0)), (R(x)))) s.t. 10) Se,
(3)
where d denotes a distance in the class label domain.
Note that while the signal is attacked in its native domain, the classifier M accepts its input in the repre- sentation domain. The two domains are related by the map a function whose pointwise value requires the solution of an optimization problem via a nunerical algorithm. While backpropagating through this optimization process is possible (e.g. via automatic differentiation or implicit differentiation (Navon et al., 2020 as we later show in Section doing dramatically increases computational resources required for perturbation optimization, thus posing additional practical challenges for potential attacker, in addition to the inherent difficulty of optimizing such an attack that stems from the inference pipeline itself, as motivated in section II
In the following scctions, we propose five different adversarial attacks, addressing these challenges that are absent in the traditional signal-domain adversarial allack settings.
3.4.1 Full Projected Gradient Descent (PGD)
A straightforward approach to solving equation 3 is by performing projected gradient descent (PGD) and backpropagating through both the classification model M and the modulation optimization steps collectively denoted R(z). While backpropagation through Mp can be performed based on common first-order differen- tiation methods, potential attacker must allow gradient flow through the modulation optimization steps performed in the forward pass of R. This requires differentiation through those optimization steps, namely via second-order differentiation and optimization. As we further show in section 4.5 this may substantially increase the amount of computational resource required for the attacker.
The full PGD attack pipeline is portrayed in figure D each PGD itcration, the current perturbation is added the original signal. Then, the perturbation kept frozen and the perturbed signal is being optimized for the corresponding INR 0*, that is being fed into the parameter-space classifier M.
5

---

Published in Transactions on Machine Learning Research (02/2026)
Optimized
Remains Frozen
SIREN (MLP)
INR Sampling
Medullatoo Victor
Modulation Optimization R(x)
Modulation Vector
Parameter Classifier MC
Logits
Parameter-space classifier adversarial attack pipeline for single PGD iteration. Orange blocks are optimized, blue blocks remain frozen.
Figure 2:
3.4.2 Truncated Modulation Optimization (TMO)
Given the potentially immense computational resources required for full PGD attack optimization, we explore several attacks bypassing the need for full socond-order differentiation in perturbation optimization In Trancated Modulation Oplimization (TMO) apply a principle similar to the Truncated Backpropagation Through Time algorithm, widely used in RNN optimization. Since computational resources required for full PGD linearly grow with the number of modulation optimization steps n, in this attack we fix certain parameter - controlling the number of modulation optimization steps through which gradients would flow in attack optimization. Namely, rather than performing the forward pass of R consisting of n modulation optimization iterations, only T optimization steps are performed, all which will be backpropagated through. Since the full number of modulation optimization steps n is inherent within the attacked model, an adversarial perturbation optimized for duration of modulation steps might. fail to fool the classifier al inference time (even if the attack succeeded after steps). To alleviate this gap, when optimizing perturbation 8 for given data sample z, we first the full optimization steps of R(x) to find the 'clean' modulation vector. In every PGD iteration to follow, the t optimization steps are initialized from the previously optimized "clean" modulation.
adversarial
3.4.3
Backpropagation Over Truncation Through Optimization of Modulation (BOTTOM)
TMO (section 3.4.2 while computationally light, suffers from the limitation performing fewer modulation optimization steps per every PGD iteration. Model behavior observed by the attacking algorithm therefore deviates from the full forward process of the attacked model. In Backpropagation Over Truncation Through Oplimizalion of Modulation (BOTTOM) modulation optimization steps per every sample z, while also alleviating the computational prices described in scction 3.4.1 For every PGD itcration, the n steps performed in the forward pass of R are divided into [ optimization segments. In each segment, second order differentiation is performed through 7 modulation optimization steps.
address this, and propose allack that performs the full n
The attacker given the flexibility to balance between computational resource consumption (lower 7 values) and fidelity of gradients the full forward pass in (higher values).
3.4.4 Imposition of Constraints via Orthogonal Projection (ICOP)
Proposed attacks in previous sections focus on perturbations applied in signal domain. In this section we further propose attack applied in INR domain. The main challenge here is efficiently constraining the

---

Published in Transactions on Machine Learning Research (02/2026)
adversarial perturbation while perturb the neural representation of the signal, still must constrain the response of every applied perturbation in signal domain. Namely, unlike the formulation in equation here we must impose F(o) S B. The need to query the Functa model F' to assess this response makes it difficult to apply any trivial, immediate projection a given perturbation onto the feasible set. We therefore propose Imposilion of Constrainls via Orthogonal Projection (TCOP) - this method relies on two approaches to impose soft constraints over the perturbations First, after every PGD step we compute a projection loss, measuring constraint violation in Li: Cproj. |IC, - Bll We then iteratively take small gradient steps qf Oproj. = ā - 7) 03"0, until constraint satisfaction.
Secondly, to discourage perturbation steps from severely breaking signal-domain constraints, we also found it useful to project the maximized classification loss to be orthogonal to (1) (namely, the perturbation-indueed deviation in signal-domain) in every perturbation gradient step. We enforce soft- constraints in optimization, and then impose hard constraints over the optimized perturbation to ensure feasibility. This is done by computing over F()) clamped onto the feasible set.
26
3.4.5 Implicit Differentiation
Implicit differentiation provides a principled mechanism for computing gradients in bilevel optimization problems, where the output of an inner optimization procedure is implicitly defined by the stationarity conditions of an objective function. In our adversarial setting (equation 3) although the perturbation 8 is applied directly in the signal domain, the classification loss depends on the output of the implicit representation mapping R, whose evaluation itself requires solving an optimization problem (equation I Explicit differentiation through this process (e.g., via. unrolling or backpropagation through time) leads to computational graphs whose size scales linearly with the number of modulation optimization steps, incurring substantial memory and runtime costs (sections 3.4. 3.4.3
3.4.33
To mitigate this overhead, we additionally investigate an implicit differentiation (ID) baseline. Let d(xr, 5) denote the adversarial classification loss (as defined in equation 3 and let 200,x) denote the INR re- construction objective minimized in equation [ Assuming that the inner optimizatiin solved to local optimum 0 = R(x), the optimal parameters satisfy the first-order stationarity condition
VoL x) O.
Implicit differentiation exploits the fact that this condition must remain satisfied under an infinitesimall perturbation of the input. Specifically, for an infinitesimal change da in the signal and the corresponding change d0 in the optimal parameters, the perturbed solution must. satisfy
VoL(1" + d0, x + dx) = =0.
(4)
A first-order Taylor expansion of this expression around (0", x) yields the linear system
Vi x) dl + V2. L(0" x) dx = 0.
Hessian
Solving for d0 and applying the chain rule gives the implicit gradient of the adversarial objective with respect to the perturbation:
ad
Od
VOLL L. 0(x + 8)
D0- 2V
(5)
06
06
80 Equation 5 avoids explicit evaluation of dz and therefore eliminates the need to backpropagate through the modulation optimization trajectory used to solve equation [ As result, the memory footprint of this attack remains constant with respect to the number modulation optimization steps, in contrast to the explicit. differentiation-bassed at tacks presented in sections 3.4.1 3.4.4
Validity and limitations The implicit formulation relies on two standard assumptions: (i) stationarity, namely that the inner optimization is solved sufficiently close to local optimum such that [|V R 0, and

---

Published in Transactions on Machine Learning Research (02/2026)
(ii) invertibility of the Hessian Dg at 8" In practice, INR optimization is performed for finite number of steps and typically does not reach exact stationarity, while the Hessian may be Ill-condiiione singular due to the non-convexity of the objective. In our implementation, we address the latter by applying damped identity regularization when computing Hesssa vector products.
Importantl, implicit differentiation yields gradients corresponding to the fixed-point solution of the inner optimization, rather than to the finite, truncated optimization trajectory actually executed during inference. As we demonstrate empirically in Section [1.]] this mismatch limits the effectiveness of implicit gradients for adversarial optimization in our setting, causing this baseline to underperform explicit unrolling- based attacks despite its favorable computational properties.
3.5 BVA Voxel-Grid Space Adversarial Attack
To study adversarial attacks over 3D structures, we must choose how to represent them, so that we can establish appropriate attack perturbation and constraints. Out of the most common conventions for 3D data representations voxel-grids, mesh-grids and point-clouds in this work we specifically study adversarial perturbations over voxel-grid data. The reason for this choice is that our experiments show that due to the highly irregular structure of mesh-grids and point-clouds, fitting the dataset-shared set of INR weights (0w. in notation from section 3.1 yields poor results, preventing achieving implicit representations of adequate signal fidelity.
While adversarial attacks over 3D have been studied in the past for mesh-grids (Xu et al. 2022 and point clouds (Liu et al. 2019a), to the best of our knowledge no similar work had so far been done the context of voxel-grid representations. Since we wish to perform adversarial attacks over INR classifiers of voxel grids, and compare robustness to corresponding signal-domain classifier, we develop Binary Voxel Atlack (BVA) novel adversarial attack applied over roxel-grid data.
Voxel-grid reprosentations are traditionally binary spatial occupancy maps. Therefore, an adversarial attack performing addition of a real-valued adversarial perturbation bounded in Coo is not applicable. Since our attacked signal is a binary map, we opt to establish an adversarial attack in the from bit flipping (namely, bit attack). Given a voxel-grid input signal æ E {0, HXWxDD (where H, W, D are grid spatial dimensions), we formulate our attack as:
max 8
| ( ( 0).ls.t.llploo = B
(6)
where d E {0, HXXDD is the optimized binary adversarial perturbation, and @ denotes the bit-wise xor operation (performing bit switch over x entries where has logical value of 1). 8 is chosen to be bounded in Co norm, namely bounding the number of bits flipped x.
This formulation calls for the incorporation of binary optimization tochniques, as trivial binarization of 8 (e.g. by thresholding) is non-differentiable To optimize ō as a binary mask follow the binary optimization technique presented in (lliadis et al. 2020). This method maintains two congruent masks binary mask & and a real mask T_. + is used for forward and backpropagation, where each gradient step applics the gradients calculated for & over &.. The latter is then binarized (without gradient tracking) to produce $b for the next iteration.
To demonstrate relative robustness of parameter-space classifiers over voxel-grid data, in section 4.2.1 we first exemplify the efficacy of signal-domain attacks using BVA. Then, in scction 4.2.2 we employ BVA in parameter-space allacks and demonst increased adversarial robustness to -rased attacks. We emphasize that equation 0 is specific instance of equation 3 and therefore all parameter-space attacks previously proposed in section 3 can be performed voxel-grids using BVA.
4 Results
In the following sections we demonstrate the relative robustness of Sarameter-Space classifiers over 3 differ- ent datasets MNIST (Deng) 2012), Fashion-MNIST (Xiao et al.] (007)) and ModcINet10 (Wu et al. 2015). MNIST and MNSS are chosen to represent the prevalent and heavily-studied modality 2D images.
While current adversarial robustness and computer-vision literature tends to focus more challenging and
8

---

Published in Transactions on Machine Learning Research (02/2026)
diverse datasets (e.g. CIFAR100, ImageNet), applicability of these datasets in the parameter-space classifi- cation setting is currently limited. This is because state-of-the-art parameter-space classification algorithms proposed thus far have yet to achieve classification satisfactory classification accuracies on such complex datascts (Navon ct al.) 2023a b Chen & Wang 2022]. ModelNet is used to demonstrate our findings over one of the modalities where usage of INRs naturally useful, due to commonly large dimnensionality. Following the approach from (Dupont et al., 2022), for cach dataset X' we first optimize a set of modulation vectors {v,Vr Vo E X3. Then, we train a single MLP classifier over this modulation dataset. Finally, every pre-trained classifier is attacked with each of the five attacks presented in section 3.4 We emphasize ro- bust adversarial training is being done in any stage of this experimentation scheme. Attack formulations and results for 2D data are presented in section 4.1 and for 3D data in section 4.2. In section 4.5 we fur- ther retonstrate the sense of adversarial robustines stemming from the added computational costs induced by performing adversarial attacks over deep weight-space classifiers, posing added practical challenges for potential attackers. Full training details are further specified in the appendix.
4.1 Robustness For 2D Data
We evaluate the adversarial robustness of parameter-space classifiers on MNIST and Fashion-MNIST across all attacks in our proposed suite. To ensure comparison against a strong and widely accepted baseline, that is not reliant solely on white-box PGD attacks, we also assess robustness under the Atto-Attack framework Croce& & Hein (2200)). Clean and adversarial INR classification accuracy over 2D data classifiers is shown in table In the notations of equation 3 q oo is chosen as B = 256 for every table entry. Clean column represents classifier accuracy without. introducing any adversarial perturbations.
Results indicate four major trends - First, increased adversarial robustness is measured for both MNIST and Fashion-MNIST, where only Auto-Attack used with the largest considered attack bound manages to severely harm classification accuracy, to an extent similar to that commonly observed in adversarial atlcck over conventional classifiers operating in signal-domain. For MNIST, while the Auto-Attack, TMO and BOTTOM attacks are the only attacks that managed to incur any above-marginal decrease in classification accuracy, it is still markedly lower than the accuracy decrease of around 60% that is traditionally observed in similarly-bounded PGD attacks over signal-domain classifiers without any robust training (Wong et al., 2020). While higher-bounded attacks over the Fashion-MNIST dataset have been more successful, we claim their success is substantially lower than the effect of a similarly constrained attack over a signal-domain classifier.
To show this, we train four baseline signal-domain classifiers and altack with PGD using similar Exx norm constraints and PGD iteration number. We use Vision- Transformers (ViTs) (Dosovitskiy) 2020) due to their outstanding record in natural image classification (Han et al. 2022), and two convolutional models for their ubiquity and foundational role in computer-vision. To experiment with models of different sizes we train a ViT-Large model and R8snet as well as a ViT-Base model and a compact, 2-layer CNN. Full architecture details are included in the appendix. We compare the robust accuracy of these four Signal-space classifiers under standard 100-iteration PGD attack, with that of our parameter-space classifier subjected to all attacks from section 3.4 Results, shown in figure 3 show parameter-space classifiers exhibit significantly higher robustness under white- box attacks, especially for lower attack bounds. These results highlight the relative robustness of parameter-space classifiers to white-box adversarial attacks. Under Auto-attack (that does not rely strictly on gradients and white-box attacks) this trends is maintained, however the absolute robustness of parameter-space models lessened. As further shown Section 4.4 this trend likely caused by gradient-obfuscation appearing in gradient-based attack optimization over weight-space classifiers.
The second indicated trend is that the full PGD attack demonstrates lower adversarial potential compared to BOTTOM and TMO attacks in all experiments. We attribute this to the fact that in full-PGD the numerous steps of second-order optimization required for standard PGD in our case encourage vanishing gradients phenomena, namely allenuating gradient information backpropagated through the modulation optimization process R. These difficulties are added to the computational encumbrance of running full PGD (sec soction ( and further stress the need in initial methods developed here (soctions 3.4.2 3.4.2 as well as further related research. While computationally lightest, implicit differentiation proves less potent than most explicit methods. We attribute this to the strong dependence of this method in fulfillment
9

---

Published in Transactions on Machine Learning Research (02/2026)
Signal-Space vs. Parameter-Space Classification Robustness
1.0
ICOP
Implicit
0.8
Full
Robust Accuracy
TMO
0.6
BOTTOM
ViT-B
ViT-L
0.4
Small CNN
ResNet18
0.2
0.0
0.00
0.02
0.04
0.06
0.08
0.10
0.12
0.14
0.16
Infinity Norm Constraint
Figure 3: Robust accuracy the Fashion-MNIST dataset under Loo norm constraints for parameter-space (solid curves) and signal-space (dotted curves) classifier attacks.
of specified optimality conditions and strict stationarity assumptions required by the implicit function theorem (i.e., 2 R 0). In realistic adversarial settings constrained by finite optimization budgets, these KKT conditions are rarely fully satisfied. Consequently, explicit unrolling provides more faithful gradient estimate of the actual optimization trajectory compared to the theoretical fixed-point approximation assumed by implicit differentiation.
Signal-Space Classification Robustness
0.8
Robust Accuracy
0.6
0.4
TMO
0.2
BOTTOM
Implicit
0.0
ICOP
Signal Domain
-0.01 0.00
0.01 0.02 0.03 0.04 0.05 0.06
Bit Flip Ratio
Figure 4: BVA robust accuracy for signal-space classifier and weight-space classifier the M1delNet10 dataset, under Lo norm constraints.
Another observation that our proposed attack suite outperforms Auto-Attack in diminishing classification accuracy under almost all considered attack bounds. This advantage of our suite over Auto-Attack accom- panies the substantially-lower (40x faster) optimization times required for optimization of our proposed attacks (see appendix for the complete analysis), that could potentially hinder the use of Auto-Attach in
10

---

Published in Transactions on Machine Learning Research (02/2026)
our setting (even in cases where it is theoretically more-potent). Lastly, conclude that the INR-domain attack (TCOP) failed to impose any actual effect on classification accuracy. We attribute this result to the heuristic nature of the approaches used to constrain the LNR-domain perturbation's response in the signal domain (section 3.4.4). We still include it within our suite of proposed attacks, as it proved more efficient when initiated over 3D data (section 4.2
Table 1: MNIST & Pashion-MNIST
Classification Accuracy for any value, Coo
attack bound (oquation 3
is B
256
MNIST
Fashion- MNIIS
Clean
Full
TMO
BOTTOM
ICOP
Implicis
Auto- AttckAAtack
BOTTOM
ICOP
Implicit
Attto-Allak
0.976
0.949
0.941
0,989
0.965
0.957
0,868
0.891
0,791
0.77
0.79
0.891
0.826
0,808
8
0.976
0.915
0.91
0,906
0.965
0.946
0.948
0.891
0.67
0.64
0.658
0.8904
0.792
0.645
16
0.976
0.866
0.825
0.821
0.961
0.926
0.502
0.891
0.54
0.44
0.438
0.89
0.745
0.351
0.976
0.803
0.7035
0.919
0.801
0.341
0.69
4.2
Robustness For 3D Data
In section wC survey adversarial robustness of classifiers INR for 2D data. The importance of this baseline is comparability to the widely studied adversarial robustness of 2D classifiers. Nonetheless, practical advantages using INRs for 2D data are usually limited, since common grid representations suffice for most common tasks. Data modalities of larger dimensions, such as 3D data, however, more commonly gain from using INRs for achieving downstream tasks, including classification (Jiang al.) 2020 Molaei al. 2023; Niemeyer et al. 2020). We use the ModelNet 10 dataset (Wu et. al. 2015 consisting of 4900 3D CAD models given in gesh representation.
4.2.1 Signal Space Attack
To demonstrate relative adversarial robustness over 3D data under the BVA attack (section 3.5 we must first demonstrate its prowess in attenuating signal-domain classification accuracy. To do so we train a voxel- grid classification model based on Point- Voxel CNN layers proposed by (Liu et al. 2019b). We train the classifier over ModelNet10, converting every mesh-grid sample to a voxel-grid of dimension 15 15 x 15 using Trimesh (Dawson-Haggorty et al.)). Then, we attack this trained model with BVA for wide range of Lo bounds and assess attacked classification accuracy. Results are displayed in figure A showing BVA is efficient over the tested signal-space classifier, inducing exponential decay of classification accuracy with growth in number of flipped voxel bits.
4.2.2 Parameter Space Attack
Figure compares the robust accuracy of the signal domain (black) and parameter-space classifirss, where the parameter-space classifier is attacked with TMO, BOTTOM, ICOP, and implicit attacks. We note that we do not experiment with the full PGD attack in parameter-space INR classifier, since to optimize INR for the ModelNet10 dataset with sufficient. input signal fidelity, we performed 500 modulation optimization iterations per sample. While computation times for doing so are not very high (several scconds), backpropagation through these 500 optimization steps calls for infcasible memory and compute time requirements, and also lead to severe vanishing/ewe eeploddigpiiggggg gradient issues. We further elaborate on these considerations in the appendix.
with Auto-Attack for the 3D
The data from figure 4 is presented numerically in the appendix.
4.3 Qualitative Results
In this section we provide qualitative evidence for the relative robustness of parameter-space classifiers. Adversarial attacks are known to effectively exploit the amplifications of small input-space perturbations [Goodfellow] 2014 Haleta al., 2021]. We attribute the robustness of parameter-space classificrs to the attacker's inability to directly perturb the classifier's input, instead requiring a constrained signal-domain perturbation that remains effective after modulation optimization (equation 1]. This is deemed to be sub-
11

---

Published in Transactions on Machine Learning Research (02/2026)
stantially more challenging for the attacker, modulation optimization tends to attenuate adversarial effects fed input to the classifier (figure 5).
To illustrate this phenomenon, we report the mean amplification, measured as the difference in activation values between perturbed and clean imput data, for each layer in our pipeline (figure 2 These measurements, shown in figure 5 were calculated using the MNTST dataset, with every sample propagated through the pipeline after being perturbed by each attack in our suite with constraint of 32 To further validate 256
the relationship between attack success and amplification, differentiate between robust and non-robust samples.
Successful attacks demonstrate an average amplification approximately three times greater than that of failed attacks. In both cases, amplification sharply plummets upon entering the first classifier layer (layer 10) and remains consistently low subsequent layers. These findings indicate that adversarial amplification within the INR layers has negligible impact on the downstream classification model. This supports our claim that modulation optimization effectively obfuscates the adversarial potency of perturbations applicd in the signal domain. Importantly; this effect is not observed for signal-domain classifiers, figure illustrates the mean amplification difference measured through model activation layers over MNIST data, similarly to figure 5 for the signal-domain classifier trained according to section A.3.2 The adversarial amplification is not attenuated, but rather drastically inflated. Results for other attack constraints and datasets are reported in the appendix.
show in figure G This
Successful Attacks
Failed Attacks
Mean Activation Norm Difference
120
BOTTOM
Implicit
40
100
Full PGD
80
TMO
30
ICOP
60
INR Layers
20
Classifier Layers
40
10
20
0
-10
0
2
4
8
10
12
2
4
6
8
10
12
Layer
Layer
Figure 5: Adversarial amplification across pipeline layers showing modulation optimization's atten- uation of adversarial amplification ion evaluated over the MNIST dataset.
In figure 1 demonstrate the effect of adversarial perturbations applied in signal-domain the latent rep- resentations attained from perturbed data, and compare between parameter-space classifiers and traditional signal-space classifiers. To this end, as a signal-domain baseline, we first train a convolutional autoencoder over the MNIST dataset. For a fair comparison, this autoencoder is trained disjointly from the downstream classification task. We then train a classifier over the learned latent space, and finally perform 100 iterations of signal-domain adversarial attack over this classifier. The bottom half of figure Iillustrates t-SNE projec- tion of the trained autoencoder's latent representations before (left) and after (right) the adversarial attack. The top half of the plot corresponds to parameter-space classifiers, showing t-SNE projections of INR mod- ulations optimized for clean (right) data and for data attacked with our full-PGD attack (section 3.4.1 Prior to the attacks, the latent space of both signal and parameter-space domains sis well-structured,, with clear separation between the different classes. However, after the allack, the model operating strictly in signal-domain (i.e. the autoencoder baseline) experiences severe disruption of this structure classes of ad- versarial samples within the classificr's latent input space are no longer distinct and are instead intermixed. This indicates significant deterioration in the class separability, highlighting the impact of the adversarial perturbations the latent space. Adversarial attacks optimized for the parameter-space classifier, the
12

---

Published in Transactions on Machine Learning Research (02/2026)
other hand, seem inconsequential to the imput-space structure of the parameter-space classifier, inchuding class separability. These conclusions are well-correlated with those from figure 5
Successful Attacks
Failed Attacks
Mean Activation Norm Difference
16
Signal Domain
14
14
Encoder Layers
12
Classifier Layers
12
10
10
8
6
6
4
1
3
0
2
3
Layer
Layer
Figure 6: Signal-Domain Amplification -through encoder and downstream classifier layers
4.4 Theoretical Exploration of the Robustness Mechanism
In this section we wish to justify our hypothesis that the observed relative resistance of parameter-space classifiers to white-box attacks stems from a functional scrubbing effect inherent to the INR optimization loop. To achieve this, we provide empirical evidence to substantiate this claim and characterize the security profile of these models against adaptive attacks.
4.4.1 Qualitative Analysis
To understand how the INR pipeline processes adversarial perturbations, analyze the layer-wise amplifi- cation of perturbations using the Mean Activation Norm Difference (MAND) metric.
As shown in Figure 5 the parameter-space pipeline exhibits a unique behavior: while perturbations are amplified during the modulation optimization steps (Layers 0-9), this amplification collapses to near-zero at the input of the parameter-space classifier (Layer 10). This strongly-aligus our hypothesis that the INR optimization acts as a low-pass filter (i.e. 'scrubber"). Due to the spectral bias of the architecture and the limited number of optimization steps, the INR prioritizes fitting the global signal structure while failing to fit the high-frequency adversarial noise. Consequeutly, the noise is effectively removed from the representation before it reaches the downstream classifier.
In contrast, as discussed in 4.3 signal-domain classifiers exhibit continuous amplification the perturbation throughout the encoder and classifier layers, explaining their susceptibility to standard first-order attacks.
4.4.2 BPDA Analysis
The 'scrubbing" phenomenon described above implies that the gradient of the loss with respect to the adversarial perturbation, V&C, vanishes as it is backpropagated through the optimization loop. This creates state of gradient obfuscation, where standard gradient-based attacks (like PGD) fail because they rely on informative gradients.
To determine the model is fully inherently robust or reliant on gradient-masking, we evaluate against the Backward Pass Differentiable Approximation (BPDA) attack (Athalye al.) 2018). BPDA is an adaptive at- tack designed to bypass shattered or vanishing gradients. It approximates the gradients of non-differentiable ill-conditioned layers (in our case, the optimization mapping R(-)) by replacing them with differentiable
13

---

Published in Transactions on Machine Learning Research (02/2026)
approsiiatioon-scccffallll the identity function-during the backward pass:
[²R(z)) R
We evaluate the parameter-space classifier against BPDA with 5 random restarts, on both MNIST and Fashion-MNIST across varying perturbation bounds. The results are presented in Table
Table 2: Robustness against Adaptive Attack (BPDA). The significant drop in accuracy indicates that the model relies on gradient obfuscation. For any given value, the Loe attack bound is B 256
Robust Accuracy
8
16
32
MNIST
0.095
0.092
0.087
0.076
Fashion-MIN MINIST
0.167
0.163
0.16
0.159
The results Table 2 reveal that when the gradient obfuscation mechanism is bypassed, the robust accuracy 32). We denote that the robust accuracy of paramter-space
drops significantly (e.g., 9% on MNIST commonly-measuree for conventional signal-domain classifiers classifiers still remains much higher than that under PGD or BPDA attack/Athalye et al. (2018). The main conclusion to be drawn from these results is that valid adversarial direction exists and can be found if the gradient masking is circumvented. Namely, the high robustness against white-box attacks reported in table is result of the optimization loop attenu- ating gradients. The main challenge posed for white-box attacks over parameter-spate classifiers gradient obfuscation, rather than complete elimination for gradient information useful for adversarial purposes. While this does not provide thcoretical socurity, it imposes practical barrier, forcing adversarics employ com- putationally expensive adaptive allacks rather (han standard first-order methods.
Combined with conclusions from drawn in section 4.1 frame weight-space classifiers inherently adver- sarially robust to gradient-based white box attacks, whilst mcasuring limited and inconclusive robustnoss to gradient-free free attacks (due to gradient obfuscation).
4.5
Computational Resource Analysis
In addition to empirical robustness, parameter-space classifiers introduce substantial computational overhead for attackers. These difficulties stem from the optimization process inherent within the classification pipeline's inference process. We measure the per-sample runtime of adversarial optimization on an NVIDIA RTX-2080 GPU and compare it to clean inference. For the MNIST classifier with 512-dimensional modulation vectors and 100 PGD iterations, clean inference requires 1.5 seconds per sample, while attack optimization requires 150 seconds per sample, 100x increase. Additional results related to the increased memory and time resources required for attack execution are reported in the appendix.
The analysis of runtime required for adversarial optimization is especially relevant when considering Auto- Attack - in table g we compare the per-sample exccution time of Auto-Attack with that of 100 PGD steps of each attack in our suite. AutoAttack is an ensemble of four attacks - APGD-CE (Croce & Hein 2020b).
APGD-DI.R (Croce& & Hein (020b),, FAB (Croce & Hein 2020a) and Square (Andriushchenko et al. [2220] Since the per-sample execution of each attack component is dependent on its respective predecessor, the runtime indicated in the column of each component is the runtime of executing that component in addition to running all preceding components (for single sample).
Table 3: Per-sample runtime (in seconds) for Auto-Attack and the parameter-space suite the proposed attack suite is significantly faster than Auto-Attack.
Attack Suite
Runtime (in seconds)
APGD-CE
APGD-DER
FAB
Square
AutoAttack
10.15
94.19
215.8
426.68
Full-PGD
TMO
BOTTOM
ICOP
Implici
Parameter--paac-SSute
9.8
2.51
10.3
6.07
18.97
Results show that running full Auto-Attack (APGD-CE through Square) would require runtime larger by factor of 40 when compared to our parameter-space attack suite, while providing comparable adversarial
14

---

Published in Transactions on Machine Learning Research (02/2026)
prowess (table p. In the best-case (only APGD-CE is run), which is notably less common in Auto-Attack runs against robust models, Auto-Attack runtimes are similar to those of attacks from our suite. We refer the reader to appendix C for a deeper discussion of considerations discussed in this section.
5 Discussion
In this work we presented the first thorough systematic study of adversarial robustness in parameter-space classifiers. Our in-depth security analysis positions weight-spacc classifiers as adversarially robust to white- box gradient-basod attacks, especially in comparison to conventional classifiers operating in signal domain. We also mark the limitations of this robust behavior, showing it weakens and polentially fails under the presence of gradient-free attacks (BPDA and black-bon box components of auto-attack). This leads us to the framing of the gradient-obfuscation phenomenon as a major reason for the observed behavior of increased robustness. The observed robustness further-stressed by an analysis of the heavy computational costs required for optimizing different types of adversarial attacks over these parameter-space classifiers. Furthermore, we've presented the challenges involved in translating common PGD-based attacks onto models performing classification directly in deep parameter-space, and addressed these challenges by developing novel set of five different adversarial attacks designed for parameter-space classification. This work highlights robustness to white-box gradient-basee based adversarial attacks defining feature of parameter-space classifiers and provides a foundation for advancing secure and scalable learning systems.
Despite these promising results, several limitations remain. Parameter-space classifiers are not yet widely deployed computer vision, constraining immediate applicability. Nonetheless, with the rapid growth of research interest in the field, we expect our findings encourage the adoption of parameter-space methods. Furthermore, our evaluation focused datasets where current parameter-space methods achieve competitive clean accuracy, which limited exploration more complex benchmarks. Finally, work is focused inherent robustness for white-box gradient-basel attacks. Given the mcasured inherent robustness measured for gradient-based atlacks, we believe the development of active robust training approaches can push this robust behavior to extend to gradient- and black box attack methods as well. We defer the exploration of back-box attack paradigms and adversarial pre- traitingning techniques to future work.
References
Maksym Andriushchenko, Francesco Croce, Nicolas Flammarion, and Matthias Hein. Square attack: query- efficient black-box adversarial attack via random search. In European conference computer vision, pp. 484-501. Springer, 2020.
Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give a false sense of sccurity: Circunventing defenses to adversarial examples. In International conference on machine learning, pp. 274-283. PMLR, 2018.
Yinbo Chen and Xiaolong Wang. Transformers as meta-learners for implicit neural reprosentations. European Conference on Computer Vision, pp. 170 187. Springer, 2022.
Francesco Croce and Matthias Hein. Minimally distorted adversarial examples with a fast adaptive boundary attack. In International conference on machine learning, pp. 2196-2205. PMLR, 2020a.
Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In International conference on machine learning, pp. 2206-2216. PMLR, 2020b.
Dawgon-Haggerty et al. trimesh. URL https://brimeeh.oogg
Li Deng. The mnist database of handwritten digit images for machine learning research [best of the web).
IEEE signal processing magazine, 29(6):141 142, 2012.
Alexey Dosovitskiy, An image is worth 16x16 words: Transformers for image recognition at scale, arXiv preprint ar Xix:22000. 11929, 2020.
15

---

Published in Transactions on Machine Learning Research (02/2026)
Emilien Dupont, Hyunjik Kim, SM Eslami, Danilo Rezende, and Dan Rosenbaum. From data to functa: Your data point is function and you can treat it like one. arXiv preprint arXiv:2201. 12204, 2022.
Gabriel Eilertsen, Daniel Jönsson, Timo Ropinski, Jonas Unger, and Anders Ynnerman. Classifying the classifier: dissecting the weight space of neural networks. In ECAT 2020, pp- 1119-1126. TOS Press, 2020.
Yonggan Fu, Ye Yuan; Souvik Kundu, Shang Wu, Shunyao Zhang, and Yingyan Lin. Nerfool: Uncovering the vulnerability of generalizable neural radiance fields against adversarial perturbations. In International Conference on Machine Learning (ICML), 2023.
Ian J Goodfellow. Explaining and harnessing adversarial examples. arXiv preprint orXiv:1412.677 2014.
Pavlo Haleta, Dmytro Likhomanov, and Oleksandra Sokol. Multitask adversarial attack with dispersion amplification. EURASIP Journal on Information Security, (1)1(1):10, 2021.
Kai Han, Yunhe Wang, Hanting Chen, Xinghao Chen, Jianyuan Guo, Zhenhua Liu, Yehui Tang, An Xiao, Chunjing Xu, Yixing Xu, et al. A survey on vision transformer. IEEE transactions on pattern analysis and machine intelligence, 45(1):87-110, 2022.
Michael Iliddi,, Leonidas Spinoulas, and Aggelos K Katsaggelos. Deepbinarymask: Learning a binary mask for video compressive sensing. Digital Signal Processing, 96:102591, 2020.
Ganesh B Ingle and Milind V Kulkarni. Adversarial deep learning allacks a review. Informalion and Communication Technology for Competitive Strategies (ICTCS 2020) Intelligent. Strategies for ICT, pp- 311 323, 2021.
Chiyu Jiang, Avneesh Sud, Ameesh Makadia, Jingwei Huang, Matthias Nicßner, Thomas Funkhouser, et al. Local implicit grid representations for 3d scenes. In Proceedings of the IEEE/CVE Conference on Computer Vision and Pattern Recognátion, pp. 6001-6010, 2020.
Jaeho Lee, Jihoon Tack, Namhoon Lee, and Jinwoo Shin. Meta-learning sparse implicit neural representa- tions. Advances in Neurol Information Processing Systems, 34:11769-111 11780, 2021.
Daniel Liu, Ronald Yu, and Hao Su. Extending adversarial attacks and defenses to deep 3d point cloud classifiers. In 2019 IEEE International Conference on Image Processing (ICIP), pp. 2279 2283, IEEE, 2019a.
Zhijian Liu, Haotian Tang, Yujun Lin, and Song Han. Point-voxel enn for efficient 3d deep learning. Advances in neural information processing systems, 32, 2019b.
Ziyuan Luo, Anderson Rocha, Haoliang Li, Ka Chun Cheung, Simon See, and Renjie Wan. Adversarial data robustness via implicit neural representation. In International Conference Learning Representations (ICLR), 2024.
Amirali Molaci, Amirhossein Aminimehr, Armin Tavakoli, Amirhossein Kazerouni, Bobby Azad, Reza Azad, and Dorit Merhof. Implicit. neural representation in medical imaging: A comparative survey. In Proceedings of the IEEE/CVF International Conference Computer Vision, pp. 2381 2391, 2023.
Aviv Navon, Idan Achituve, Haggai Maron, Gal Chechik, and Ethan Fetaya. Auxiliary learning by implicit differentiation. arXiv preprint XrXi::2007.0880 026999, 2020.
Aviv Navon, Aviv Shamsian, Idan Achituve, Ethan Fetaya, Gal Chechik, and Haggai Maron. Equivariant architectures for learning in deep weight spaces. In International Conference on Machine Learning, pp. 25890-25816. PMLR, 2023a.
Aviv Navon, Aviv Shamsian, Idan Achituve, Ethan Felaya, Gal Chechik, and Haggai Maron. Equivariant architectures for learning in deep weight spaces. In Andreas Krause, Emma Brunskill, Kyunghyun Cho, Barbara Engelhardt, Sivan Sabato, and Jonathan Scarlctt (ods.), Proceedings of the 40th International Conference on Machine Learning, volume 202 of Proceedings of Machine Learning Research, pp. 25790- 25816. PMLRR 23 29 Jul 2023b. URL httpss:/proocedding/ mlr. wwwps//eeaaap....p v202 2a.000//avvn2a...1. html
16

---

Published in Transactions on Machine Learning Research (02/2026)
Weili Nie, Brandon Guo, Yujia Huang, Chaowei Xiao, Arash Vahdat, and Anima Anandkumar. Diffusion models for adversarial purification. In International Conference on Machine Learning (TCML), 2022.
Michael Niemeyer, Lars Mescheder, Michael Oechsle, and Andreas Geiger. Differentiable volumetric ren- dering: Learning implicit 3d representations without 3d supervision. In Proceedings of the IEEE/CVP conference computer vision and pattern recognition, pp. 3504-3515, 2020.
William Peebles, Lija Radosavovic, Tim Brooks, Alexei A Efros, and Jitendra Malik. Learning to learn with generative models of neural network checkpoints. arXiv preprinl ar Xrx::2200. 12892, 2022.
Yaniv Romano, Aviad Aberdam, Jeremias Sulam, and Michael Elad. Adversarial noise attacks of deep learning architectures: Stability analysis via sparse-modeled signals. Journal of Mathematical Imaging and Vision,
2020.
Konstantin Schürholt, Michael W Mahoney, and Damian Borth. Towards scalable and versatile weight space learning. aixiv preprint arXiv:2400 06. 09997, 2024.
Vincent Sitzmann, Julien Martel, Alexander Bergman, David Lindell, and Gordon Wetzstein. Implicit neural representations with periodic activation functions. Advances in neural information processing systems, 33: 7462-74 7473, 2020.
Thomas Unterthiner, Daniel Keysers, Sylvain Gelly, Olivier Bousquet, and Ilya Tolstikhin. Predicting neural network accuracy from weights. arXie preprint or 2xXx:2000..11444 2020.
Zirui Wang, Shangzhe Wu, Weidi Xie, Min Chen, and Victor Adrian Prisacariu. Nerf : Neural radiance fields without known camera parameters. orXie preprint arXi::2102.07064, 2021.
Ross Wightman. Pytorch image models. http::///ghhhhb.o.orrrrrraaaaaar
2019.
Eric Wong, Leslie Rice, and J Zico Kolter. Fast is better than free: Revisiting adversarial training. arXiv preprint "Xix:2001.0390/ 2020.
Zhirong Wu, Shuran Song, Aditya Khosla, Fisher Yu, Linguang Zhang, Xiaoou Tang, and Jianxiong Xiao. 3d shapenets: A deep representation for volumetric shapes. Tn Proceedings of the IEFE conference computer vision and pattern recognition, pp. 1912 1920, 2015.
Chong Xiang, Charles R Qi, and Bo Li. Generating 3d adversarial point clouds. In IEEE/CVF Conference on Computer Vision and Pottern Recognition (CVPR), 2019.
Han Xiao, Kashif Rasul, and Roland Vollgraf. Pashion-mnist novel image cataset for benchmarking machine learning algorithms. arXiv preprint arXiu: 70110708.77777 2017.
Huangxinxin Xu, Fazhi He, Linkun Fan, and Junwei Bai. D3advm: A direct 3d adversarial sample atlack inside mesh data. Computer Aided Geometric Design, 97:102122, 2022.
Zonghan Yang, Tianyu Pang, and Yang Liu. A closer look at the adversarial robustness of deep equilibrium models. In Advances in Neural Information Processing Systems (NeurIPS). 2022.
Allan Zhou, Kaien Yang, Yiding Jiang, Kaylee Burns, Winnie Xu, Samuel Sokota, Zico Kolter, and Chelsea Finn. Neural functional transformers. In Advances in Neural Information Processing Systems (NeurIPS), 2023.
Allan Zhou, Chelsea Finn, and James Harrison. arXiv:2402.05232, 2024.
Universal
neural functionals.
arXio preprint
17

---

Published in Transactions on Machine Learning Research (02/2026)
A Training Regime, Hyperparameters & Technical Details
A.1
Functaset Generation
A.1.1 MNIST & Fashion-MNIST
All experiments described in this section have been conducted on a single NVIDIA RTX-2080 GPU. Following [Dupont et al., 2022), for each of the three datasets considered in this paper, we first train SIREN [Sizzmann
et al. 2020) jointly over the entire training set. For MNIST and Pashion-MNIST we optimize modulation vectors of dimension 512 for 6 epochs of 3 modulation optimization steps per-sample, with a learning- ratein of 0.000005 and a batch size of 128. We use 10 SIREN layers with hidden dimension of 256. We then proceed to creating the Functaset, which is the dataset of modulation vectors conditioning the SIREN for per-sample representation. For each sample we optimize for 10 modulation optimization steps, with a learning-rate of 0.01. For clean training and evaluation we also found it useful to perform gradient clipping to an L2 norm of 1 during internal modulation optimization.
A.1.2 ModelNet10
For ModelNct10 we similarly follow (Dupont ct al. 2022), however we first convert the Mesh-grid data onto voxelgrid, as previously mentioned (section 3.5 Each voxelgrid is resampled to dimension 15 15 x 15. Due to the increased dimensionality, to the one used for the MNIST dataset. After training the shared SIREN weights, each modulation vector is further optimized for 500 modulation optimization steps.
train 2048- doa--dimensional Functa modulations with SIREN similar
A.2
Adversarial Attacks
After the Functaset is generated, we proceed to executing our develop suite of adversarial atlacks section For MNIST and Fashion-MNIs' all attacks are executed over 10 modulation optimization steps per adversarial perturbation, similarly to optimization in the clean case. BOTTOM and TMO optimization segments are chosen at 5 steps per-sample. For implicit differentiation, we've found it most useful to optimize each perturbed image using L-BFGS, rather than gradient methods (which have been used in other attacks). Each L-BFGS optimization is carried for most 20 iterations. For ModelNet10, ICOP,TMO and BOTTOM attacks are performed for total of 500 modulation optimization steps per perturbed voxelgrid, with attack segments again chosen al 5 steps. Implicit differentiation atlack is also performed with at most. 20 ilerations of L-BFGS. All attacks are carried-out for 100 PGD iterations, with early-stop of 3 iterations of constant loss for the implicit method. We use the Adam optimizer in all experiments.
3.4
A.3 Baseline Models
A.3.1 Classifier Baselines
In this section we specify implementation and training details related to the signal-space classifier baseline CNN and ViT architectures used in section 4 In section 4.1 we train 4 signal-domain classifiers small CNN, ResNet18, ViT-Large/16 16 and Vit-Base/I0 For the ViTs we leverage pre-trained models from Wiihtmman 2019), and finetune for our classification task using lincar probe prior to applying Softmax. For the Resnet we train from scratch, and project encoded data with a linear probe followed by a Softmax. For the Small-CNN we use two convolutional layers with ReLU activations, and a single MaxPooling operation between them. For all baselines we train over the Fashion-MNIST training set for 5 epochs with learning-rats of 0.0001.
A.3.2 Autoencoder Baselines
we present a qualitative analysis of adversarial perturbation amplification across pipeline layers, along with t-SNE projections of modulation spaces before and after adversarial perturbation. To connect these observations to the inherent adversarial robustness of parameter-space classifiers, we include comparison with signal-space classifier. In order to propose signal-space classifier with an appropriate
In section 4.3
18

---

Published in Transactions on Machine Learning Research (02/2026)
counterpart to the explored parameter-space model modulation space, choose to train classifiers operating over latent spaces trained by autoencoders. We model each autoencoder activations and train with a self-supervised reconstruction objective for 10 epochs. After the autoencoder is trained, we freeze and train a linear classifier with 2 hidden layers and single ReLU activation on top of it. The frowen encoder layers acis as the INR counterpart ligure D and the MLP head is parallelized the parameter-space classifier. We use latent dimension of 128 for all encoders.
3-layer CNN with ReLU
B Additional Results
B.1
Robustness For 2D Data
B.1.1 MNIST
We explore trends exhibited in figure 5 for additional attack bounds. Figure showcases adversarial amplifi- cation (similarly figure 5) across different attack bound for the full-PGD attack. Adversarial obfuscation drawn from figure arises here well.
Successful Attacks
Failed Attacks
Mean Activation Norm Difference
70
15
4
60
8
16
10
50
32
INR Layers
40
5
Classifier Layers
30
0
20
10
-5
-10
0
2
4
6
8
10
12
10
12
Layer
Layer
Figure 7: Signal-Domain Amplificatio through encoder and downstream classifier layers, across dif-
ferent constraints & for full PGD attack
256
B.1.2 FaShion-MNIST
figure illustrates adversarial amplification across pipeline layers, similarly to figure 5 Trends of correlation between amplification and adversarial success, as well as evident obfuscation of adversarial affect between INR and classifier segments, are consistent with findings from section 4.3
Similarly figure we test amplification patterns of signal-domain classifier (section A.3.2 for the Fashion-MNIST dataset as well. We again observe consistency across both datascts the signal domain classifiers proves to be much more sensitive adversarial examples propagated through the encoder-classifer pipeline.
figure 10 exhibits the affect of adversarial attacks in signal-domain over the underlying modulation vectors (for parameter-space classifiers) and latent vectors (for signal-space classifiers) received as classifier input. Similarly to figure ! for both parameter-space and signal-space model, a well-formed latent space is ob- served before the incorporation of adversarial perturbation. After attacking with PGD, the corresponding modulation vectors fed into the parameter-space classifier remain almost unchanged, whilst the latent space observed by the signal-domain classifier is heavily deformed.
19

---

Published in Transactions on Machine Learning Research (02/2026)
Successful Attacks
Failed Attacks
Mean Activation Norm Difference
60
BOTTOM
100
Implicit
50
Full PGD
80
40
TMO
ICOP
30
60
INR Layers
Classifier Layers
20
40
10
20
-10
0
2
4
6
8
10
12
10
12
Layer
Layer
Figure 8: Adversarial amplification across pipeline layers showing modulation optimization's 's's atten- uation of adversarial amplification.
Successful Attacks
Failed Attacks
Mean Activation Norm Difference
2.0
Signal Domain
Encoder Layers
25
Classifier Layers
1.5
20
1.0
15
0.5
10
0.0
5
-0.5
3
3
Layer
Layer
Figure 9: Signal-Domain Amplification through encoder and downstream classifier layers
20

---

Published in Transactions on Machine Learning Research (02/2026)
Fashion-MNIST- Full PGD
Clean Data Modulations
Perturbed Data Modulations
Fashion-MNIST Siinal Domain
Clean Data Latents
Perturbed Data Latents
Figure 10: t-SNE projection of modulation vectors fitted for clean and adversariialy-perturbed data for parameter-space and signal-space classifiers.
21

---

Published in Transactions on Machine Learning Research (02/2026)
B.2 Robustness For 3D Data
In this section we report additional results for the ModelNet dataset. In table ! we report numerical results for the data from figure | The first two columns represent the same attack constraints in absolute bit numbers (c) and bit numbers relative to the entire volume (matching horizontal axis in figure 4
Table 4: ModelNet10 from equation
Robust Classification Accuracy - for any given & value, attack bound
B e in Lo (i.e.
number of flipped signal bits).
Flip Ratio
Clean
TMO
BOTTOM
ICOP
Implicit
10
0.003
0.734
0.669
0.663
0.66
0.722
20
0.006
0.734
0.6475
0.634
0.6475
0.708
40
0.012
0.734
0.647
0.623
0.641
0.696
80
0.024
0.734
0.643
0.616
0.581
0.67
100
0.03
0.734
0.6412
0.609
0.557
0.657
200
0.06
0.734
0.594
0.576
0.41
0.613
C
Computational Resource Analysis
In sections we provide evidence for the adversarial robustness of parameter-space classifiers based on classification accuracies under the presence of adversarial perturbations. In this section, we expand the discussion from section 4.5 to support these claims from different, practical perspective.
We show that orthogonally to the efficacy of adversarial attacks over parameter-space classifiers, attacking these classifiers also poses significant added computational difficulties for the potential attacker. In section 4.5 we report the computation times required for a single modulation optimization step during a single PGD iteration on an NVIDIA RTX-20S0 GPU (approximately 0,015 seconds for the the 3-layer classifier used for the MNIST experiments, and 0.005 seconds for the single-layer classifier used for the Fashion-MNISTT experiments). For the ModelNet10 dataset with 2048-dimensional modulation vectors, the measured runtime is 0.02 seconds. Even for a small number of PGD steps, increasing the number of modulation optimization steps an aspect controlled by the model, not the attacker increases attack optimization times within several orders of magnitude. Importantly, this increase docs not significantly impact the computation time required for "clean" (unperturbed) inference. For instance, with 100 modulation optimization steps set by the model to solve equation optimization of 100 PGD iterations would require the attacker to invest 150 seconds per-sample. In table 3 we report the per-sample execution time of Auto-Attack with that of 100 PGD steps of each attack in our suite. showing marked increased costs for running this attack. especially when compared with our developed suite.
D 'clean" inference would require 1.5 seconds per sample, while perturbation
On top of computation time increase, attacking parameter-space classifiers via explicit differentiation also poses challenge for the attacker in terms of memory consumption. Tested on the same hardware, we find that GPU memory consumption for the full PGD attack over the ModelNet10 classifier grows lincarly with number of modulation optimization sleps, with a slope of 0.1705( [1705[3rdd.1 Stdest The corresponding GB ). Namely, in order to perform full PGD
cocfficient for the smaller MNIST data is 0.049 Mod.Steps (equation 3.4.1 attack over the ModelNet10 data, every additional modulation optimization step included in "clean" model training induces roughly 170 additional megabytes for the attacker's backpropagation. Backpropagating through the 500 modulation optimization steps used in creation of the ModelNet10 INR dataset in our experiments would require 85 Gigabytes of GPU memory, greatly increasing optimization costs. The increase in modulation optimization steps holds no more than marginal prices for the 'innocent" (non-altacker) user in INR dataset. optimization, as this process does not require 2nd-order differentiation. Implicit differentiation (equation 3.4.5) offers the attacker constant- constant-memory attacks (in our experiments 526 MB for MNIST, 986 MB for ModclNet10), however the cost of higher sensitivity to optimality condition satisfaction (as shown in section
22


Reviews:
[{"review_id": "8w5OPldi1M", "reviewer": "Reviewer_uzge", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "No", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "### Summary\n\nThis paper studies adversarial robustness for “parameter-space” (weight-space) classifiers that operate on implicit neural representations (INRs) rather than raw signals. It introduces a suite of white-box attacks that explicitly differentiate through the INR-fitting process (full PGD, truncation-based variants TMO/BOTTOM, an INR-domain attack with orthogonal projection ICOP, and an implicit-differentiation attack), plus a Binary Voxel Attack (BVA) for 3D voxel data. Experiments on MNIST, Fashion-MNIST, and ModelNet10 indicate that parameter-space classifiers exhibit greater empirical robustness than standard signal-space classifiers under comparable perturbation budgets, with additional practical attack costs attributed to the need to differentiate through the inner INR optimization.\n\nHaving noted that, the current analysis / evaluation falls short (see \"Things to improve\" below). I view the paper as a promising first step that needs strengthening the attack evaluation and tightening the implicit-differentiation methodology/assumptions, doing a scholarly job at relating this work with existing nearby approaches (as opposed to over-emphasizing novelty by magnifying into a very niche method), and explaining why the conclusions would generalize to more realistic datasets/settings.\n\n### Things I liked\n\n1. The paper frames and studies a previously under-explored threat model: adversarial attacks against classifiers operating in INR parameter spaces. The authors say un-explored, but can consider a more scholarly review of previous works that tackle similar objectives, such as works that hinder adversarial attacks via INR [RCGH-2022], and highlight what simplifying assumptions they make with their simple autoencoder baselines (as inferred from A.3.2) compared adversarial attacks on the latent space of other neural models [KWT-2022, WCCNRG-2023, LC-2024].\n2. If the reported robustness persists under stronger, obfuscation-aware evaluations, this would identify a meaningful defense-by-architecture effect for INR-based pipelines and the proposed attack suite and BVA can become standard tools for this area. Conversely, if robustness is largely due to masked gradients, the paper can still makes a useful contribution by clarifying the evaluation challenges and highlighting where new attack methods (e.g., better implicit differentiation, amortized surrogates, or certified approaches) are needed.\n\n### Things to Improve\n\n1. The central claim of “inherent robustness” is at risk of conflating true robustness with gradient masking/obfuscation arising from the inner optimization loop [QZZZQM-2020]. Hence, I would suggest adding stronger diagnostic attacks, such as BPDA [ACW-2018], EOT [AEIK-2018], BPDA+EOT [TCBM-2020], multi-restart black-box attacks like SPSA/NES (and/or mapping how the proposed ones subsume these). Further, some robustness checks standard in adversarial evaluation are missing, such as (i)gradient-free black-box attacks (do we really need all the white-box attack complexity if we can achieve similar attack-fidelity by black-box attacks), (ii) transfer attacks from surrogate models in parameter space (e.g. attacks trained using gradients from one INR might generalize to others -- see point 3 below), and (iii) multiple random restarts.\n2. The implicit-differentiation attack rests on local optimality and invertibility assumptions, that are nontrivial for nonconvex INR fitting. Some mathematical verification of these conditions for when the ID gradients are reliable (e.g., KKT residuals, Hessian regularity) beyond (only) empirical results would be nice. Think of what diagnostics can highlight that the inner problem is sufficiently solved (e.g., small KKT residuals)? This can also lead to interesting insights about trade-offs and conditions under which truncation remains faithful for BOTTOM and TMO like approaches.\n3. In equation 3, can you highlight the assumptions required for its validity (invertibility of ∂^2 L/∂θ^2 and quality of the inner solve)? Also, curious if the authors though of using a non-differentiable function to make the implicit differentiation imprecise/approximate at best (or measuring how the robustness changes under BPDA or EOT when the inner INR-fitting loop is treated as a nondifferentiable transformation in the backward pass)?\n4. Another class of attacks could be, in similar veins to the clean modulation vector in TMO, is to develop a universal modulation vector, similar to universal adversarial perturbation [MFFF-2017], for the function R and use it in a similar way.\n5. The evaluation is limited to relatively simple datasets (MNIST, Fashion-MNIST) and low-resolution voxel grids (15^3); curious why the authors believe these conclusions would generalize well?\n\n\n### Other improvements\n\n1. The start of the initial paragraphs in each subsection (e.g. 3.3.2, 3.3.3, etc.) is with a `-`. Given this is not standard grammatical formatting, removing them will improve readability. Also, the following paragraphs have no spacing between paragraphs, making it look ugly.\n2. Please improve the use of notions for the INR function and how they are used in technical writing. $F$ defined in sec 3.2 and $R$ in sec 3.3 (and 3.3.1, 3.3.2, etc.) doesn't cleanly define how the two relate to one-another. This creates confusion later in section 3.3.4, where the authors casually mention imposing $F(\\delta) \\leq B$ to equation (2) that as no mention of $F$. Additionally, also improve the writing by revising the second-paragraph in section 3.2 to be more amiable to folks unaware of the verbiage known to people working on this particular topic.\n\n[QZZZQM-2020] Qiu, H., Zeng, Y., Zheng, Q., Zhang, T., Qiu, M., & Memmi, G. (2020). Mitigating advanced adversarial attacks with more advanced gradient obfuscation techniques. arXiv preprint arXiv:2005.13712.\n\n[TCBM-2020] Tramer, F., Carlini, N., Brendel, W. and Madry, A., 2020. On adaptive attacks to adversarial example defenses. Advances in neural information processing systems, 33, pp.1633-1645.\n\n[AEIK-2018] Athalye, A., Engstrom, L., Ilyas, A. and Kwok, K., 2018, July. Synthesizing robust adversarial examples. In International conference on machine learning (pp. 284-293). PMLR.\n\n[ACW-2018] Athalye, A., Carlini, N. and Wagner, D., 2018, July. Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. In International conference on machine learning (pp. 274-283). PMLR.\n\n[RCGH-2022] Rusu, A.A., Calian, D.A., Gowal, S. and Hadsell, R., 2022, June. Hindering adversarial attacks with implicit neural representations. In International Conference on Machine Learning (pp. 18910-18934). PMLR.\n\n[KWT-2022] Kuzina, A., Welling, M., & Tomczak, J. (2022). Alleviating adversarial attacks on variational autoencoders with mcmc. Advances in Neural Information Processing Systems, 35, 8811-8823.\n\n[WCCNRG-2023] Wang, S., Chen, S., Chen, T., Nepal, S., Rudolph, C. and Grobler, M., 2023. Generating semantic adversarial examples via feature manipulation in latent space. IEEE Transactions on Neural Networks and Learning Systems.\n\n[LC-2024] Lu, M. and Chen, B., 2024. On the adversarial robustness of generative autoencoders in the latent space. Neural Computing and Applications, 36(14), pp.8109-8123.\n\n[MFFF-2017] Moosavi-Dezfooli, S. M., Fawzi, A., Fawzi, O., & Frossard, P., 2017. Universal adversarial perturbations. In Proceedings of the IEEE conference on computer vision and pattern recognition. CVP).", "claims_and_evidence_yn": "No", "claims_explanation": "The current analysis / evaluation falls short (see \"Things to improve\" below). I view the paper as a promising first step that needs strengthening the attack evaluation and tightening the implicit-differentiation methodology/assumptions, doing a scholarly job at relating this work with existing nearby approaches (as opposed to over-emphasizing novelty by magnifying into a very niche method), and explaining why the conclusions would generalize to more realistic datasets/settings.\n\nSee detailed comments above.", "audience_yn": "Yes", "audience_explanation": "While highlighted in my review above, quoting one line from above to answer this:\n\nIf the reported robustness persists under stronger, obfuscation-aware evaluations, this would identify a meaningful defense-by-architecture effect for INR-based pipelines and the proposed attack suite and BVA can become standard tools for this area. Conversely, if robustness is largely due to masked gradients, the paper can still makes a useful contribution by clarifying the evaluation challenges and highlighting where new attack methods (e.g., better implicit differentiation, amortized surrogates, or certified approaches) are needed.", "requested_changes": "See the section on \"Thinks to improve\" and \"Other Improvements\" in my review.", "broader_impact_concerns": "Without proper evaluation or deeper understanding, the paper can propagate a false sense of security when using INR-based classification methods.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "aCGPJsPXyU", "reviewer": "Reviewer_Zg74", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "No", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper presents a study to investigate the robustness of parameter-space classifiers against adversarial attacks. The authors first optimize the PGD attack to improve computational efficiency, enabling it to adapt to parameter-space classification setting. Based on this adaptation, they then evaluate the adversarial robustness of parameter-space classifiers. The proposed approach is intuitive and straightforward, and the corresponding experimental results are presented concisely and clearly.\n\nHowever, there exist numerous deficiencies in experimental evaluation, which limit the strength and generality of conclusions. In addition, the paper shows notable shortcomings in writing rigor and overall readability. Given these issues, the current version of the paper does not meet the publication standards required for TMLR.", "claims_and_evidence_yn": "No", "claims_explanation": "The core claim of this paper is that parameter-space classifiers are robust to adversarial attacks. However, the experiments and analyses of this paper do not provide sufficient evidence to support this claim. The reasons are as follows:\n\n1. The paper only evaluates parameter-space classifiers against the PGD attack (and its computationally efficient variants), which is inadequate for demonstrating adversarial robustness.\n\n2. The experimental evaluation relies primarily on the robust accuracy metric. Although the mean activation norm difference (MAND) is reported, the paper does not compare the MAND of parameter-space classifiers with that of common classifiers, which fails to highlight the robustness advantage of parameter-space classifiers.", "audience_yn": "No", "audience_explanation": "The experiments in this paper fail to demonstrate that the parameter-space classifiers possess robustness against adversarial attacks. Furthermore, the paper does not adequately highlight the specific properties of parameter-space classifiers under adversarial attacks. As a result, the findings are unlikely to provide novel insight or practical value to the TMLR's audience.", "requested_changes": "Critical for acceptance:\n\n1. It would be better if the authors could evaluate parameter-space classifiers under more adversarial attack methods, including both classical approaches and recently proposed algorithms. This would help demonstrate the generalizability of the adversarial robustness of parameter-space classifiers.\n\n2. It would be beneficial to provide an analysis to clarify the relationship between MAND metric and robustness accuracy, and compare the differences between common classifier and parameter-space classifier with respect to this metric. This facilitates the analysis of the underlying reasons why the parameter-space classifier maintains high robust accuracy.\n\n\nStrengthen the work:\n\n1. Several notations are not clearly defined prior to their use, which weakens the readability of the article.\n\n2. The use and definition of some notations are inconsistent, for example, the use of the parameter-space classification model in Eq. (2) and Eq. (4).", "broader_impact_concerns": "N/A", "additional_comments": "N/A", "extra_scores": {}, "extra_text": {}}, {"review_id": "T3gP4gYAo0", "reviewer": "Reviewer_o9Y9", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "No", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The paper proposes adversarial attacks for weight-space classifiers. Due to the optimization step in computing implicit neural representations, standard adversarial attacks can be difficult to be applied. The paper proposes several tailored attacks to this end and evaluates them empirically. When comparing them to adversarial attacks of classic classifiers, the authors find implicit neural representation models to be more robust. However, the validity of this conclusion is not fully established.\n\n**Strengths:**\n1. The paper proposes several adversarial attacks in weight-space and introduces them in a logical and well-structured fashion.\n2. The experiments appear comprehensive and well-thought out.\n\n**Weaknesses:**\n1. The Related Works section is surprisingly short: one would expect some mention of standard adversarial attacks and INR methods.\n2. The paper is missing a clear threat model, something that would be expected from a security-adjacent work. For example, the authors chose to attack in signal-domain, before computing the modulation vectors, rather than the modulation vectors themselves (which would allow for much more trivial attacks). But that choice is not explicitly discussed or justified.\n3. It is not clear where the optimality conditions in Section 3.3.5 come from, especially the second one. Should it hold for all $dx, d\\theta$? If so then the problem isn’t feasible to be solved with gradient-based methods as the loss function would be flat in the vicinity of $\\theta^\\star$. The value of this formulation of implicit differentiation is further reduced by the fact that the authors end up using L-BFGS instead. \n4. A relatively straightforward attack is missing: the attacker can train a surrogate model from signal-domain to weight-space. Then they can apply any standard signal-domain attack to INR.\n5. It is very strange that the Full attack is weaker than the BOTTOM and TMO attacks, which are proxies for it. While the authors do speculate that this might be because of vanishing gradients, it doesn’t seem to be actually tested or explored. Actually looking at the gradients would be helpful. Because the same explanation could also cause exploding gradients which the authors do not seem to observe.\n6. The paper claims that weight-space classifiers are more robust than signal-domain classifiers. Yet, the results in Table 1 show more nuanced picture: for example, for MNIST, all weight-space attacks have lower accuracy than Auto-attack at $\\epsilon=4$ and three of them have lower accuracies for $\\epsilon=8,16$. The comparison is further complicated by the clean accuracy of the signal-domain classifiers not being reported.\n7. It is difficult to be convinced in the empirical comparison of the robustness of two different sets of models on two disjoint sets of attacks. Unfortunately, 10 years of adversarial robustness research has shown that models are robust only until the right attack and hyper-parameters are found. Unless there are formal guarantees of robustness, a purely empirical study cannot claim robustness.\n8. The paper also misses an opportunity to establish why would weight-space classifiers be more robust than signal-domain classifiers. That would help significantly in convincing the reader of the validity of the results. For example, could it be that the explicit down-projection in the INR setup results in the adversarial perturbations to be “scrubbed” before they even get to the model? This could be studied by comparing the original attacked image with the reconstructed version of it: I would expect that the norm of the perturbation of the reconstructed image would be lower than the one of the original image. Thus, the “effective $\\epsilon$ could be much lower than the $\\epsilon$ that is applied. \n\nOverall, I believe the paper touches upon an important problem and proposes interesting attacks. That being said, it can benefit from rethinking whether its claims that “weight-space classifiers more robust than signal-domain classifiers” are actually backed by empirical results, an attempt to study why that could be the case, as well as an improvement of the writing and the presentation.", "claims_and_evidence_yn": "No", "claims_explanation": "The main claim of the paper is that weight-space classifiers are more robust than signal-domain classifiers. However, the experimental setup makes it difficult to establish whether this is actually the case. See Weaknesses 6 and 7.", "audience_yn": "Yes", "audience_explanation": "Establishing adversarial attacks and defenses for implicit neural representation models, as well as an understanding of why their robustness properties differ from these of standard classifiers, would be of interest and value to the community.", "requested_changes": "1. **Claim of the paper is that weight-space classifiers are more robust than signal-domain classifiers:** In my view, this claim either has to be substantiated much more extensively and critically, or needs to be dropped altogether.\n2. **Explanation of the robustness of weight-space classifiers:** If weight-space classifiers are indeed more robust than classical classifiers, then a strong and experimentally supported explanation of why that would be the case would further strengthen the main claim of the paper.\n3.  **Explicit threat model:** Adding an explicit threat model, justifying the design choices that the authors have taken would be helpful for the paper.\n4. **Surrogate model attack:** A surrogate model attack would be nice to be added as it is simple and straightforward to implement and might more accessible than the attacks proposed in the paper.\n5. **Presentation quality:** The clarity, language and formatting of the paper need to be improved.", "broader_impact_concerns": "No broader impact concerns beyond the standard disclaimers for adversarial attacks.", "additional_comments": "**Nitpicks:**\n- Some citations are in double parentheses rather than single parentheses.\n- Stray hyphens appear in the beginning of some paragraphs and sections.\n- Often the spacing between paragraphs is missing.\n- There are some very long and confusing sentences. For example the last sentence of the second paragraph of Section 3.3. Or the second sentence after Figure 4.\n- It is not true that adversarial attacks “utilize the highly-nonlinear nature of modern deep classifiers”. A (piece-wise) linear classifier can also be easily attacked. Rather, it is the lack of smoothness that underlies the existence of adversarial examples.\n- Not clear if $\\theta_w$ is shared among all samples, or across clusters of samples.\n- Section 4, “no robust are adversarial training” -> “no robust adversarial training”.\n- Section 4.1, missing space before “2-layer CNN”.\n- Some strange expressions like “adversarial prowess” or “time resource consumption” (latency?).\n- Figures 3 and 4 do not say what dataset the results are on. Figure 5 does not mention neither the dataset nor the model used.\n- While the specific setup of the signal-domain attacks is described in Section 4, the setup for the INR attacks is only available in the appendix which makes comparing them difficult.\n- After Figure 4: $40x$ -> $40\\times$.", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Decision: Accept (poster)