Source-linked AI summary
Extending Adversarial Attacks and Defenses to Deep 3D Point Cloud Classifiers
Daniel Liu, Ronald Yu, Hao Su
TL;DR
The paper addresses limited evidence on adversarial robustness in 3D point cloud classifiers, despite the security importance of such robustness and extensive 2D research. It adapts white-box and black-box attacks and defenses to PointNet and PointNet++, finding that these classifiers are susceptible to attacks but more easily defended than 2D image classifiers.
Problem
Adversarial robustness in 3D deep learning has received less study than in 2D image models despite security implications and safety-critical 3D object identification.
Method
The paper preliminarily evaluates adapted white-box and black-box attacks and defenses on PointNet and PointNet++, including perturbation constraints exploiting 3D point-cloud structure.
Results
Deep 3D point cloud classifiers are susceptible to simple gradient-based adversarial attacks but are more easily defended than 2D image classifiers.
Takeaways & Limitations
The study provides a foundation for further research on understanding adversarial behavior and improving robustness in neural networks handling 3D data.
Takeaways & Limitations
The study is preliminary, and input restoration may remove both unperturbed and perturbed points.
Abstract
from arXiv · showhide
3D object classification and segmentation using deep neural networks has been extremely successful. As the problem of identifying 3D objects has many safety-critical applications, the neural networks have to be robust against adversarial changes to the input data set. There is a growing body of research on generating human-imperceptible adversarial attacks and defenses against them in the 2D image classification domain. However, 3D objects have various differences with 2D images, and this specific domain has not been rigorously studied so far. We present a preliminary evaluation of adversarial attacks on deep 3D point cloud classifiers, namely PointNet and PointNet++, by evaluating both white-box and black-box adversarial attacks that were proposed for 2D images and extending those attacks to reduce the perceptibility of the perturbations in 3D space. We also show the high effectiveness of simple defenses against those attacks by proposing new defenses that exploit the unique structure of 3D point clouds. Finally, we attempt to explain the effectiveness of the defenses through the intrinsic structures of both the point clouds and the neural network architectures. Overall, we find that networks that process 3D point cloud data are weak to adversarial attacks, but they are also more easily defensible compared to 2D image classifiers. Our investigation will provide the groundwork for future studies on improving the robustness of deep neural networks that handle 3D data.
1. Introduction
This section frames adversarial robustness for 3D point-cloud classifiers as an underexplored problem and outlines an evaluation of attacks and defenses on PointNet-family models. The paper reports that attacks effective in 2D also affect point clouds, while simple defenses exploit 3D structure.
- 3D deep-learning research has advanced classification, segmentation, and detection, but lags in studying adversarial robustness and related network behavior.
- Adversarial perturbations threaten deep-learning systems because they can be imperceptible, effective, and transferable across models.
- The paper evaluates adversarial behavior in PointNet and PointNet++, which apply shared pointwise multilayer perceptrons followed by global max-pooling.
- White-box and black-box attacks are effective against undefended point-cloud classifiers.
- Simple defenses are effective against white-box attacks and may exploit intrinsic properties of point clouds and neural-network architectures.
- The paper concludes that 3D point-cloud classifiers remain susceptible to simple attacks but are more easily defended than 2D counterparts.
2. Related works
Prior work established many adversarial attacks and defenses for 2D image classifiers, while adversarial point-cloud research was only recent. 3D shape classification itself spans point-cloud, mesh, and voxel representations.
- Research on 2D convolutional networks includes optimization-based attacks, FGSM, iterative and momentum extensions, JSMA, DeepFool, and Carlini-Wagner attacks.
- Adversarial attacks have also been studied for malware detection and 2D image segmentation, while point-cloud attacks emerged only recently.
- Defense techniques include adversarial training and defensive distillation.
- 3D shape classification uses point-cloud, mesh, and voxel representations.
3. White-box adversarial attacks
The paper adapts white-box attacks to 3D point clouds by constraining perturbations at different granularities and introducing methods that reduce visible shape distortion. These approaches include gradient-based perturbations, point-selection attacks, surface projection, and norm clipping.
- Attack setting: The study evaluates targeted and untargeted adversarial attacks on PointNet and PointNet++ point-cloud classifiers.Targeted attacks seek a specific incorrect class, whereas untargeted attacks seek any class other than the correct label.
- Gradient-based attacks: The adapted attacks constrain perturbation magnitude on epsilon-ball surfaces at different dimensions of the point cloud.The constraints vary from individual coordinate dimensions to individual points or the entire point cloud.
- Gradient-based attacks: The normalized gradient L2 method constrains each point’s perturbation while allowing arbitrary directions in 3D space.Each point’s three coordinate perturbations are normalized by that point’s L2 norm.
- Gradient-based attacks: The gradient L2 method permits diverse perturbation magnitudes and directions, whereas the coordinate-wise sign method restricts perturbation directions.The gradient L2 method can create outliers by assigning larger perturbations to high-gradient features; normalized gradient L2 avoids such outliers while retaining directional flexibility.
- Jacobian-based saliency map: The 3D Jacobian-based saliency attack selects the point with the highest total saliency at each iteration and changes all its coordinates according to their gradients.The method aggregates gradients across the three dimensions of each point and uses an untargeted variant of the original saliency attack.
- Reducing perceptibility: Surface projection and clipping norms reduce perceptibility by preserving point-cloud shape or matching perturbation distances to nearby clean points.Surface projection clips points to their corresponding triangle edges, while norm clipping limits large outlying perturbations using average nearby-point distances.
4. Defenses
The paper evaluates adversarial training and two input-restoration defenses that remove points based on assumptions about clean point clouds. Outlier and salient-point removal exploit point-cloud structure, while adversarial training uses generated adversarial examples.
- Defense methods: The evaluation includes adversarial training and two input-restoration methods designed to remove perturbed points.The restoration methods make assumptions about clean input point clouds.
- Adversarial training: Adversarial training generates fast gradient L2 examples during training and averages losses on clean and adversarial batches.This trains the network to adjust for adversarial samples.
- Input restoration: Outlier removal identifies points with unusually high average Euclidean distance to their k-nearest neighbors and discards them.The method assumes natural-shape points are uniformly sampled along the surface.
- Input restoration: Salient-point removal discards points assumed to have relatively large gradient magnitudes.The method may remove both unperturbed and perturbed points.
5. Evaluation
The evaluation uses PointNet and PointNet++ on ModelNet-40 and a 16-class ModelNet-Unique subset, with specified perturbation budgets and defense settings.
- Models and data: PointNet and PointNet++ are evaluated using ModelNet-40 shapes, with 1024 sampled points per shape after centering and scaling.ModelNet-40 contains over 2400 models across 40 classes.
- Models and data: Most experiments use ModelNet-Unique, a hand-picked subset of 16 classes with more distinguishable shapes.The subset is intended to evaluate attacks between very different object classes.
- Attack settings: The experiments use epsilon values of 1 for whole-cloud L2 attacks, 0.05 for normalized gradient attacks, and 0.5 for JSMA, with 10 iterations for iterative attacks.Targeted iterative gradient L2 attacks use epsilon 5 because they are harder to generate successfully.
- Defense settings: Defense evaluations use fast gradient L2 adversarial training with epsilon 1, 10-neighbor outlier filtering, and removal of 100 salient points.Outlier perturbations exceeding the mean distance by 1 standard deviation are clipped.
6. Results
Attacks are highly effective against undefended point-cloud classifiers, including nearly imperceptible and targeted attacks. Simple point-removal defenses outperform adversarial training in the reported evaluations, while robustness varies by architecture and attack type.
- White-box attacks: Undefended PointNet and PointNet++ are extremely vulnerable to adversarial attacks, with PointNet++ generally showing higher error rates for iterative gradient L2 attacks.PointNet++ is more resistant to JSMA, which the authors attribute to hierarchical grouping of nearby features.
- Defenses: Adversarial training halves iterative gradient L2 success and reduces fast gradient L2 and JSMA success rates by more than four times.It is much less effective against normalized iterative gradient L2, suggesting limited transfer across perturbation distributions.
- Defenses: Outlier and salient-point removal outperform adversarial training and also defend against attacks producing small perturbations.Salient-point removal causes relatively little clean-input classification damage compared with other methods.
- Defenses: Outlier removal is the best defense, at the expense of 2.6% lower accuracy on unperturbed inputs.This is the paper’s reported clean-accuracy trade-off for the strongest defensive method.
- Perceptibility: Gradient projection is the least perceptible attack, yet exceeds 20% success on both networks for ModelNet-40 with barely visible input changes.Iterative gradient L2 with clipping norms reaches 45.2% success on PointNet for ModelNet-Unique and higher on PointNet++.
- Targeted attacks: Targeted iterative gradient L2 attacks achieve a 79.6% average success rate and 97.0% average confidence on successful attacks.The heat map reports success for every source-label and target-class pair.
- Black-box attacks: Transfer attacks are evaluated between regular and adversarially trained PointNet and PointNet++ using only perturbations successful on the source model.Fast gradient L2 transfers better than iterative gradient L2, consistent with the reported explanation that iterative attacks overfit their crafted model.
- Black-box attacks: Adversarially trained PointNet resists perturbations generated by normally trained PointNet, while attacks successful on adversarially trained PointNet more often fool undefended PointNet.The authors interpret this as robustness to simple transfer attacks from the same architecture.
7. Discussion
PointNet and PointNet++ remain vulnerable to adversarial attacks that preserve overall point-cloud shape, suggesting their inputs can lie close to learned decision boundaries. Defenses exploit perturbation structure, input priors, and max-pooling behavior to restore or expose informative points.
- PointNet and PointNet++ perform poorly against shape-preserving adversarial attacks despite robustness to varying densities and random perturbations.
- Small perturbations can cross the networks’ decision boundaries, indicating that input point clouds may lie close to those boundaries.
- Adversarial training enlarges the effective space between clean samples and decision boundaries by adjusting boundaries for adversarial perturbations.
- Outlier removal moves inputs toward clean-like local point distributions without directly changing learned network parameters.
- Removing outliers or salient points exposes points hidden by max-pooling, allowing them to represent overall shape and support accurate predictions.
8. Conclusion
This work preliminarily evaluates adversarial attacks and defenses for 3D point-cloud classifiers and examines defenses that exploit point-cloud structure. It finds that deep 3D classifiers are susceptible to simple gradient-based attacks but more easily defended than 2D image classifiers.
- The study examines adversarial attacks and defenses for 3D point-cloud classifiers including PointNet and PointNet++.
- The authors propose methods to reduce adversarial perturbation perceptibility and examine simple defenses exploiting 3D point-cloud structure.
- Deep 3D point-cloud classifiers remain susceptible to simple gradient-based adversarial attacks but are more easily defended than 2D image classifiers.
- The work is intended to provide a foundation for further research on network behavior in adversarial settings and robustness for safety-critical 3D applications.