PaperlayerView exact revision on arXiv

Source-linked AI summary

Generating 3D Adversarial Point Clouds

Chong Xiang, Charles R. Qi, Bo Li

arXiv:1809.07016v4cs.CRcs.CVcs.LG

TL;DR

The paper addresses limited study of adversarial attacks on irregular 3D point clouds, where methods designed for 2D images are unsuitable. It proposes perturbation and generation attacks against PointNet with tailored metrics, and reports success rates higher than 99% for targeted attacks.

  • Problem

    Adversarial examples for 3D point clouds have received less attention, while point-cloud irregularity, arbitrary point insertion, and unsuitable Lp norms complicate adapting 2D attack methods.

  • Method

    The paper develops adversarial point perturbation and point generation attacks against PointNet, alongside six perturbation metrics tailored to point-cloud attack tasks.

  • Results

    Attack success rates exceed 99% for all targeted attacks in the reported extensive evaluations.

  • Takeaways & Limitations

    The work provides a baseline and guideline for future research on adversarial examples in 3D learning models.

  • Takeaways & Limitations

    Real-world realization of the attacks remains an open question, and the evaluations focus on PointNet.

Abstract

from arXiv · show

Deep neural networks are known to be vulnerable to adversarial examples which are carefully crafted instances to cause the models to make wrong predictions. While adversarial examples for 2D images and CNNs have been extensively studied, less attention has been paid to 3D data such as point clouds. Given many safety-critical 3D applications such as autonomous driving, it is important to study how adversarial point clouds could affect current deep 3D models. In this work, we propose several novel algorithms to craft adversarial point clouds against PointNet, a widely used deep neural network for point cloud processing. Our algorithms work in two ways: adversarial point perturbation and adversarial point generation. For point perturbation, we shift existing points negligibly. For point generation, we generate either a set of independent and scattered points or a small number (1-3) of point clusters with meaningful shapes such as balls and airplanes which could be hidden in the human psyche. In addition, we formulate six perturbation measurement metrics tailored to the attacks in point clouds and conduct extensive experiments to evaluate the proposed algorithms on the ModelNet40 3D shape classification dataset. Overall, our attack algorithms achieve a success rate higher than 99% for all targeted attacks

1. Introduction

The paper studies targeted adversarial attacks against 3D point-cloud models, addressing challenges that make image-based attacks unsuitable. It proposes perturbation and generation attacks and reports success rates above 99% for targeted attacks.

  • Target model: The paper targets PointNet, a widely adopted model used in autonomous driving, indoor-scene segmentation, and AI-assisted shape design.PointNet is also described as robust to ordinary point perturbations and corruptions, making it a challenging benchmark.
  • Motivation: 3D point clouds pose attack-specific challenges because they are irregular, allow points at arbitrary positions, and vary in cardinality.These properties remove regular pixel locations and make standard Lp perturbation measurements unsuitable.
  • Approach: The authors propose adversarial point perturbation and adversarial point generation for irregular point-cloud data.Perturbation shifts existing points negligibly, while generation adds independent points or clusters with generic or meaningful shapes.
  • Results: 100% success was achieved for scattered adversarial points, while adding three, two, and one adversarial shapes achieved 99.3%, 98.2%, and 78.8%, respectively.The reported results distinguish attack effectiveness by the number and type of generated additions.
  • Evaluation: The paper introduces six perturbation metrics tailored to point-cloud attack tasks and evaluates the methods extensively.The evaluation uses representative point-cloud data and the PointNet model.
  • Implications: The work provides baseline robustness analysis for 3D point-cloud models and discusses implications for potential defenses.It also discusses transferability of 3D adversarial point clouds and combining PointNet with CNNs for image defenses.

2. Related Work

Prior adversarial-example research focused largely on 2D data, while existing 3D efforts either projected objects into images or used ineffective, unmodified attack algorithms. This paper instead studies attacks against models that directly process 3D objects.

  • Existing adversarial-example research: Earlier work established adversarial examples for neural networks and extended them to data such as images, natural language, and audio.The related literature motivates extending adversarial-example analysis beyond these modalities.
  • PointNet: PointNet uses max pooling to convert unordered, variable-length point sets into fixed-length global features.Its critical-point and upper-bound analysis addressed missing points and random perturbations, not adversarial manipulations.
  • 3D research gap: Several 3D studies projected physical objects into 2D images rather than attacking models that directly process 3D objects.This leaves direct 3D-model robustness insufficiently studied.
  • 3D research gap: One prior analysis found PointNet more robust than 3D CNNs but used existing algorithms and did not effectively attack PointNet.The paper positions its algorithms as an extensive and effective study of 3D adversarial point-cloud generation.

3. Problem Formulation

The paper formulates targeted attacks on point-cloud classifiers, where an adversary seeks a legitimate input classified as a chosen target class. It models attacks as either shifting existing points or adding new points.

  • Point-cloud representation: A point cloud is an unordered set of surface-sampled 3D points represented as an array in R^n×3.Its irregular, non-grid structure distinguishes it from image data.
  • Challenges: Irregularity, arbitrary point placement, and a large generative search space make direct adaptation of image attacks difficult.These properties motivate attack algorithms designed specifically for point clouds.
  • Scope: The study focuses on targeted classification attacks and notes that extension to segmentation is possible.The adversary is not allowed to remove points so the object surface remains covered.
  • Targeted attacks: A targeted attack aims to make a 3D model classify an adversarial input as a selected target class.The formulation uses a perturbation metric between the original and adversarial point clouds.
  • Attack types: Perturbation attacks shift existing points, whereas generation attacks add k new points and produce x′ = x ∪ z.The adversarial point cloud can therefore contain n + k points rather than preserving the original cardinality.

4. Adversarial Point Perturbation

This attack perturbs existing point correspondences by shifting points and bounds the resulting change with an Lp norm.

  • Adversarial point perturbation shifts each original point s_i to its corresponding adversarial point s′_i.The perturbation is represented by the coordinate difference between corresponding points.
  • The Lp norm measures distance between the original point set S and corresponding adversarial set S′.Because point correspondences are available, the section uses the standard fixed-shape perturbation metric.
  • The perturbation vectors {δ_i} are optimized with an L2 norm bound to generate the adversarial cloud.The optimization directly produces the shifts applied to the original points.

5. Adversarial Point Generation

Point generation adds new points without removing the original cloud, ranging from independent points to a small number of plausible adversarial shapes.

  • Generated-point attacks add independent points or 1-3 adversarial shapes while leaving the original object unchanged.The shapes may be generic clusters or meaningful objects such as small airplanes.
  • Perturbation metrics: Hausdorff distance uses the maximum nearest-point deviation, whereas Chamfer measurement averages those nearest-point distances.These metrics accommodate adversarial clouds with dimensionality different from the original.
  • Perturbation metrics: The number of added points counts generated points farther from the object surface than threshold T_thre.This count is reported as an additional metric rather than optimized with gradient-based methods.
  • Independent point generation: The initialize-and-shift method starts added points at existing coordinates, optimizes their positions, and discards barely shifted points.Initialization near PointNet critical points improves efficiency because those positions help determine object categories.
  • Perturbation metrics: Hausdorff and Chamfer measurements are selected because they better measure unobtrusiveness when adversarial and original clouds have different dimensionality.

5.2. Generating Adversarial Clusters

Adversarial clusters are compact added point sets positioned near the object surface, with initialization and optimization designed to form plausible localized shapes.

  • Perturbation metrics: Cluster attacks minimize generated-cluster radius while encouraging the cluster to remain close to the object surface.The intended appearance is a small ball-like attachment that does not arouse suspicion.
  • Perturbation metrics: Farthest distance controls the maximum pairwise distance within a point set to encourage formation of a shaped cluster.A bounded farthest pairwise distance keeps cluster points within a limited region.
  • Perturbation metrics: Chamfer measurement pushes added clusters toward the original object surface, while the number of added clusters is bounded to 1-3.The cluster count is treated as an additional attack-performance metric.
  • Attacking algorithm: The cluster objective balances Farthest Distance loss and Chamfer Measurement loss with weight µ.S_i denotes the ith adversarial cluster, S_0 the original object, and m the number of clusters.
  • Attacking algorithm: DBSCAN clusters selected critical points and filters low-density outliers before cluster positions and shapes are optimized.The procedure identifies the k largest clusters after selecting critical points from target-class objects.
  • Attacking algorithm: The attack optimizes Equation 8 with gradient-based algorithms to find cluster positions and shapes.

5.3. Generating Adversarial Objects

Adversarial objects begin as meaningful shapes, such as small airplanes, which are modified, positioned in vulnerable regions, and optimized under proximity and shape constraints.

  • Meaningful adversarial objects are slightly modified and placed so they resemble benign nearby objects.This design is intended to reduce suspicion compared with arbitrary added points.
  • The attack evaluates object modifications with Lp, specifically L2, Chamfer measurement, and a 1-3 cluster-count bound.L2 limits shape modification, Chamfer encourages proximity to the original object, and cluster count measures attack performance.
  • The objective balances L2 loss for the modified cluster with Hausdorff Distance loss relative to the original object using weight µ.S_i0 is the corresponding real-world cluster, S_i the adversarial cluster, and S_0 the original object.
  • The pipeline extracts target-class critical points, clusters them with DBSCAN, selects the k largest clusters, initializes meaningful objects there, and optimizes Equation 9.
  • The modified clusters may use arbitrary orientations because different orientations are described as unlikely to arouse suspicion.

6. Experiment Results

Experiments on ModelNet40 evaluate perturbation and point-generation attacks against PointNet, alongside transferability and robustness analyses. The attacks achieve near-perfect targeted success, while transfer attacks remain limited and PointNet shows promising robustness in a separate MNIST setting.

  • Experimental Setup: ModelNet40 experiments use 12,311 CAD models across 40 categories, with 1,024 sampled surface points and 2,250 victim-target attack pairs.The PointNet structure follows the original model, with 9,843 training and 2,468 testing objects.
  • Adversarial Point Perturbation: 100% targeted success is achieved for point-shifting attacks while the adversarial point cloud remains nearly indistinguishable visually.The attack optimizes under an L2 perturbation constraint and records the smallest perturbation found.
  • Adversarial Point Generation: 100% success is obtained for independent-point generation under both Hausdorff and Chamfer constraints.Hausdorff produces larger distance loss and more added points, whereas Chamfer produces more obvious outliers.
  • Adversarial Point Generation: 99.3% success is achieved when adding three adversarial clusters, improving substantially over using fewer clusters.The average farthest cluster distance decreases from 0.5401 with one cluster to 0.1818 with three clusters.
  • Adversarial Point Generation: 97.3% success is achieved when adding three adversarial objects, although predefined shapes make this attack more challenging than adversarial clusters.Object-like shapes are described as less suspicious, and additional objects may further improve performance.
  • Robustness Analysis: Crafted examples hardly transfer as targeted attacks to PointNet++, DGCNN, augmented PointNet, or PointNet with different initialization.In a separate MNIST experiment, PointNet achieves relatively high test accuracy and promising defense properties against adversarial examples.

7. Conclusion

The paper proposes multiple adversarial point-cloud attacks against PointNet and evaluates them extensively using six tailored perturbation metrics. The resulting attacks exceed 99% success under an acceptable perturbation budget, providing a baseline for future 3D adversarial-example research.

  • Conclusion: The proposed attacks include adversarial point perturbation and adversarial point generation, targeting the widely used PointNet model.The paper also introduces six perturbation metrics and evaluates the algorithms extensively.
  • Conclusion: Higher than 99% attack success is achieved with an acceptable perturbation budget across the proposed algorithms.The authors position these results as a baseline and guideline for future research on 3D adversarial examples.

A. Additional Quantitative Results

Additional results compare attack cases and perturbation metrics for generated clusters, objects, shifted points, and independent points. The Hausdorff constraint yields smaller largest distances than Chamfer, suggesting fewer and less noticeable outliers.

  • Additional Quantitative Results: Additional tables report best-, average-, and worst-case results for adversarial cluster and adversarial object attacks.Best cases use the least distance losses among successfully attacked victim-target pairs.
  • Additional Quantitative Results: The point-shifting distance distribution is summarized with a cumulative distribution function, while independent-point additions are analyzed through nearest-point-pair distance distributions.These figures provide complementary views of perturbation magnitude and spatial placement.

B. Additional Visualization Results

Additional visualizations show adversarial clusters and adversarial objects for victim objects from more categories. The results are presented in Figures 6 and 7.

  • Additional Visualization Results: Figures 6 and 7 visualize adversarial clusters and adversarial objects, respectively, across victim objects beyond bottles.These visualizations extend the examples shown for the primary evaluation cases.
Loading 1809.07016v4…