PaperlayerView exact revision on arXiv

Source-linked AI summary

AdvPC: Transferable Adversarial Perturbations on 3D Point Clouds

Abdullah Hamdi, Sara Rojas, Ali Thabet, Bernard Ghanem

arXiv:1912.00461v2cs.CVcs.CRcs.LG

TL;DR

Existing 3D point-cloud attacks transfer poorly across networks and are vulnerable to simple defenses. AdvPC addresses these gaps by adding an adversarial loss after auto-encoder reconstruction, producing data-driven perturbations. Across four point-cloud networks, it reports improved transferability and defense resistance over prior attacks.

  • Problem

    Current 3D point-cloud attacks have limited transferability across networks and are vulnerable to simple defenses such as Statistical Outlier Removal.

  • Method

    AdvPC optimizes a perturbation using both classifier loss on the perturbed input and adversarial loss after auto-encoder reconstruction.

  • Results

    AdvPC achieves better transferability across four point-cloud networks, including 24.9% average transferability versus 11.5% for 3D-Adv and 8.92% for KNN Attack.

  • Takeaways & Limitations

    AdvPC produces perturbations that are more transferable and more robust against popular defenses than other evaluated 3D attacks.

Abstract

from arXiv · show

Deep neural networks are vulnerable to adversarial attacks, in which imperceptible perturbations to their input lead to erroneous network predictions. This phenomenon has been extensively studied in the image domain, and has only recently been extended to 3D point clouds. In this work, we present novel data-driven adversarial attacks against 3D point cloud networks. We aim to address the following problems in current 3D point cloud adversarial attacks: they do not transfer well between different networks, and they are easy to defend against via simple statistical methods. To this extent, we develop a new point cloud attack (dubbed AdvPC) that exploits the input data distribution by adding an adversarial loss, after Auto-Encoder reconstruction, to the objective it optimizes. AdvPC leads to perturbations that are resilient against current defenses, while remaining highly transferable compared to state-of-the-art attacks. We test AdvPC using four popular point cloud networks: PointNet, PointNet++ (MSG and SSG), and DGCNN. Our proposed attack increases the attack success rate by up to 40% for those transferred to unseen networks (transferability), while maintaining a high success rate on the attacked network. AdvPC also increases the ability to break defenses by up to 38% as compared to other baselines on the ModelNet40 dataset.

1 Introduction

AdvPC targets two weaknesses in existing 3D point-cloud attacks: poor transfer across networks and vulnerability to simple defenses. It uses an auto-encoder-based data adversarial loss to generate perturbations that generalize across unseen classifiers.

  • 3D point-cloud networks are vulnerable to small input perturbations, creating security concerns for applications such as self-driving.
  • Attack transferability means generating a perturbation with one accessible victim network and applying it directly to an unseen, inaccessible network.
  • Existing 3D attacks are limited by weak transferability across networks and susceptibility to Statistical Outlier Removal.
  • AdvPC adds a data adversarial loss after auto-encoder reconstruction while also optimizing the perturbation against the classifier before reconstruction.
  • Up to 40%, AdvPC's reported gain over prior attacks on ModelNet40 uses the same maximum perturbation norms while targeting transferability.

2 Related Work

Prior work established distinct trade-offs between optimization-based and learning-based adversarial attacks, while AdvPC combines their respective strengths for 3D point clouds. Its stated evaluation includes defense-breaking performance against existing baselines.

  • 3D point-cloud networks: PointNet, PointNet++, and later point-cloud networks differ in how they aggregate point features, providing varied architectures for adversarial-attack evaluation.
  • Adversarial attacks: Learning-based image attacks generally transfer better, whereas optimization-based attacks generally achieve higher success rates on victim networks.
  • Adversarial attacks: AdvPC combines an auto-encoder that captures data-distribution properties with per-sample optimization to target both victim-network success and transferability.
  • Adversarial attacks: Up to 38%, AdvPC's reported improvement over prior 3D attacks concerns breaking the cited defenses on ModelNet40.

3 Methodology

AdvPC optimizes a constrained point perturbation so a classifier is fooled both before and after auto-encoder reconstruction. The method combines network and data adversarial objectives under a perturbation norm budget.

  • AdvPC Attack Pipeline: AdvPC adds a perturbation ∆ to point cloud X, producing X ′ = X +∆ for attack optimization.
  • AdvPC Attack Loss: The attack seeks misclassification of both the perturbed input X ′ and its reconstruction G(X ′) by classifier F.
  • AdvPC Attack Pipeline: The auto-encoder reconstructs perturbed point clouds toward the learned data distribution, making attack gradients more data-dependent and less victim-network-dependent.
  • Examples and classifiers: The evaluated examples target PointNet, PointNet++ MSG/SSG, and DGCNN, with perturbed clouds shown alongside their resulting predictions.
  • AdvPC Attack Loss: AdvPC uses PGD with an ℓ∞ norm-budget constraint to limit the magnitude of the added perturbation.
  • AdvPC Attack Loss: The objective combines network and data adversarial losses using γ to trade off attack success before and after auto-encoder reconstruction.

4 Experiments

Experiments evaluate AdvPC against 3D-Adv and KNN Attack on ModelNet40 across four point-cloud networks, norm budgets, transfer settings, and defenses. AdvPC consistently improves transferability and defense resilience, with 24.9% average transferability versus 11.5% and 8.92% for the baselines.

  • Experimental setup: Experiments use ModelNet40, four victim networks, and attacks constrained by ℓ∞ norm budgets in [0, 0.75].The networks are PointNet, PointNet++ MSG, PointNet++ SSG, and DGCNN; attacks use 1,024 sampled points per object.
  • Experimental setup: The experiments also include targeted attacks, whose results are reported in the supplement.The main experiments described here focus on untargeted attacks.
  • Transferability: AdvPC consistently achieves better transferability than 3D-Adv and KNN Attack across tested networks and norm budgets.Table 1 evaluates untargeted attack success at ϵ∞=0.18 and ϵ∞=0.45, while Fig. 4 varies the norm budget for DGCNN attacks transferred to other networks.
  • Transferability: 24.9% average transferability is achieved by AdvPC, compared with 11.5% for 3D-Adv and 8.92% for KNN Attack.The score averages off-diagonal transferability-matrix values across victim and transfer networks.
  • Attacking defenses: AdvPC outperforms the baselines against all evaluated point-cloud defenses when DGCNN is both the attack victim and evaluation network.Table 2 evaluates untargeted attacks at ϵ∞=0.18 and ϵ∞=0.45 under multiple defenses.

5 Analysis

The analysis examines how AdvPC’s AE-loss weight affects attack success and transferability, compares network sensitivity, and studies AE reconstruction as a defense and transformation mechanism.

  • Ablation Study: Adding the AE loss with γ > 0 tends to reduce victim-network attack success while improving transferability; γ = 0.25 balances both objectives.Results are averaged over all norm-budgets for four victim networks.
  • Network Sensitivity: DGCNN tends to be the most robust network to varying-norm adversarial perturbations across AdvPC, 3D-Adv, and KNN Attack.The authors suggest dynamically updated convolution neighborhoods may explain this robustness.
  • Ablation Study: AdvPC transferability is measured as the average success rate on transfer networks across all norm-budgets ϵ∞.The ablation varies γ between 0 and 1 and reports victim-network success alongside transferability.
  • Effect of the Auto-Encoder: AE reconstruction preserves unperturbed point-cloud details and classifier predictions while recovering natural-looking shapes from perturbed inputs.The reconstruction behavior helps explain why the AE is a strong defense against attacks in Table 2.
  • Effect of the Auto-Encoder: AdvPC can remain effective after AE reconstruction, whereas 3D-Adv and KNN perturbations are cleaned so PointNet predicts the correct class.AdvPC-reconstructed samples may shift toward similar-looking classes, such as a toilet becoming chair-like.
  • Additional Analysis: Replacing the AE with other 3D generative models or replacing optimization with learning produced less-than-satisfactory attack success.These alternatives were evaluated as supplementary experiments.

6 Conclusions

AdvPC formulates network-transferable perturbations by fooling a classifier both before and after Auto-Encoder reconstruction, while targeting robustness to point-cloud defenses. The paper evaluates this approach using standard point-cloud distances, attack constraints, and multiple classifier architectures.

  • Conclusion: The conclusion reports better transferability across four popular point-cloud networks and improved robustness against popular defenses than other 3D attacks.The paper identifies future extensions to detection, segmentation, and robust training.
  • Distance and constraints: AdvPC preserves point correspondence by perturbing existing points, enabling exact ℓp measurement under equal-sized aligned point sets.The evaluation uses ℓ2 and ℓ∞ distances, with ℓ∞ limiting each perturbation coordinate.
  • AdvPC approach: The Auto-Encoder is trained to reconstruct point clouds, then frozen while perturbations are optimized against the classifier and reconstructed sample.The learned data distribution is used to make attacks less dependent on the victim network.
  • Attack formulation: The attack formulation supports targeted and untargeted objectives through soft or hard distance constraints on the perturbation.The soft-constraint formulation can use distances including ℓ2, Chamfer, and Earth Mover Distance, while hard constraints can be optimized with PGD.
  • AdvPC approach: AdvPC adds a data adversarial loss that fools the classifier on both the perturbed input and its Auto-Encoder reconstruction.The pipeline combines network adversarial loss with data adversarial loss and is optimized end-to-end.

C Qualitative Results

The qualitative results show targeted and untargeted AdvPC examples for PointNet, PointNet++, and DGCNN, with perturbed clouds producing adversarial predictions.

  • Targeted attacks: Targeted AdvPC examples use PointNet, PointNet++ MSG/SSG, and DGCNN as victim networks, and each perturbed prediction matches its specified target.Unperturbed clouds are shown in black and perturbed clouds in blue.
  • Untargeted attacks: Untargeted AdvPC examples use PointNet, PointNet++ MSG/SSG, and DGCNN, with predictions shown for the perturbed point clouds.The examples compare black unperturbed clouds with blue perturbed clouds.
  • Experimental setting: The experiments use ModelNet40, which contains 12,311 CAD models from 40 classes, with 9,843 training and 2,468 testing models.Each object is sampled to 1,024 points, and the attacks use four victim networks.

D.2 Adversarial Attack Methods

The attack study compares AdvPC with 3D-Adv and KNN-Attack under controlled optimization settings, norm budgets, and several point-cloud defenses.

  • Attack configuration: AdvPC and the baselines use Adam with learning rate η = 0.01, two perturbation initializations, and 200 attack iterations.The loss margin is κ = 30 for 3D-Adv and AdvPC, and κ = 15 for KNN-Attack.
  • Norm-budget evaluation: The constrained experiments evaluate ℓ∞ budgets from 0 to 0.75 and ℓ2 budgets from 0 to 7.The ranges are selected to reach 100% victim-network success while allowing transferability evaluation.
  • Evaluation metrics: At zero perturbation, classification accuracies are 92.8% for PointNet, 91.5% for PointNet++ MSG, 91.5% for PointNet++ SSG, and 93.7% for DGCNN.Attack success is measured as the percentage of attacked samples misclassified by the victim network.
  • Defense evaluation: The defense evaluation compares AdvPC and baselines against SOR, SRS, DUP-Net, adversarial training, and a separately trained Auto-Encoder.The study uses a 10% drop rate for SRS and an up-sampling rate of 2 for DUP-Net.

E Full Transferability Results

Across ℓ∞ and ℓ2 budgets, AdvPC is evaluated for victim-network success and transfer to other networks, with reported results favoring its transferability over 3D-Adv and KNN-Attack.

  • ℓ∞ transferability: AdvPC consistently achieves better untargeted transferability than 3D-Adv and KNN-Attack across all evaluated networks, especially on DGCNN, under selected ℓ∞ budgets.The table uses ε∞ = 0.18 and ε∞ = 0.45, and higher attack success rates indicate better attacks.
  • ℓ2 transferability: AdvPC consistently achieves better untargeted transferability than the comparison attacks across all evaluated networks, especially on DGCNN, under selected ℓ2 budgets.The table uses ε2 = 1.8 and ε2 = 4.0, with higher attack success rates indicating better attacks.
  • Budget sensitivity: Across different ε∞ budgets, AdvPC transfers better to other networks than 3D-Adv and KNN-Attack.The figure reports success on victim networks and transfer networks for attacks optimized with different ε∞ budgets.
  • Budget sensitivity: Across different ε2 budgets, AdvPC transfers better to other networks than 3D-Adv and KNN-Attack.The comparison evaluates attack success on victim and transfer networks across varying ε2 budgets.
  • Transferability matrices: The transferability matrices organize rows by victim network and columns by transfer network, with each element averaging transfer success across ε∞ or ε2 budgets.The diagonal represents transfer results involving the same network, while off-diagonal entries summarize cross-network transfer.

F.1 ℓ∞Defense Results

Across untargeted point-cloud defense evaluations, AdvPC consistently outperforms the other attacks under both ℓ∞ and ℓ2 settings. The experiments cover DGCNN, PointNet++, and PointNet victims across multiple defenses and norm budgets.

  • ℓ∞ defenses: AdvPC consistently outperforms the other attacks under ℓ∞ untargeted defenses for DGCNN, PointNet++ SSG, PointNet++ MSG, and PointNet.The evaluations use norm budgets ϵ∞ = 0.18 and ϵ∞ = 0.45.
  • Evaluation: The experiments report attack success rates, with higher values indicating better attack performance.The tables evaluate attacks and defenses on the same listed victim network.
  • ℓ2 defenses: AdvPC consistently outperforms the other attacks under ℓ2 untargeted defenses for DGCNN, PointNet++ SSG, PointNet++ MSG, and PointNet.The evaluations use norm budgets ϵ2 = 1.8 and ϵ2 = 4.0.

G.1 Ablation Study (hyperparameter γ)

The ablations examine how γ affects attack success, transferability, network sensitivity, and Auto-Encoder reconstruction. Adding the AE loss improves transferability but reduces victim-network success, motivating γ = 0.25.

  • Hyperparameter γ: Adding the AE loss with γ > 0 improves transferability but tends to reduce attack success on the victim network.Results are averaged over all ϵ∞ and ϵ2 norm budgets for four victim networks.
  • Hyperparameter γ: γ = 0.25 is selected to balance attack success and transferability in the experiments.The same value is used throughout the experiments.
  • Architecture sensitivity: DGCNN is affected the least by adversarial perturbations among the evaluated networks.Sensitivity is evaluated under 3D-Adv, KNN, and AdvPC attacks across increasing norm budgets.
  • Architecture sensitivity: Dynamic convolution neighborhoods may hinder attacks by changing gradient directions across iterations.The paper presents this dynamic behavior as a possible explanation for DGCNN’s higher robustness.
  • Auto-Encoder effect: The AE preserves unperturbed predictions, cleans 3D-Adv and KNN perturbations, but AdvPC remains effective after reconstruction.After AE reconstruction, AdvPC samples can resemble objects from different classes, such as a Chair resembling a Toilet.

G.4 Ablation Study on the Losses

The loss ablations compare soft and hard constraints and several distance objectives using ASR, transferability, and final perturbation norm. Hard constraints improve transferability, while EMD performs poorly relative to Chamfer and ℓ2 losses.

  • Constraint choice: Hard constraints improve transferability because constraining the attack norm allows optimization to learn more from the AE data distribution.The comparison considers constrained and unconstrained attacks across four networks.
  • Evaluation criteria: The ablations evaluate Attack Success Rate, transferability, and final perturbation norm.They compare soft and hard formulations under constrained and unconstrained settings.
  • Loss choice: EMD performs poorly, whereas Chamfer loss is comparable to the ℓ2 loss.The comparison covers EMD, Chamfer distance, ℓ2, and ℓ∞ objectives.

H Defenses Results (Targeted Attacks)

Targeted-defense experiments show that AdvPC outperforms the baselines in most defenses but fails in some. The targeted objective is difficult because the original and reconstructed samples may be required to reach different target labels.

  • Targeted defense results: AdvPC still outperforms the baselines in most defenses but fails in some defenses.The paper attributes these failures to the difficulty of the targeted optimization.
  • Optimization limitation: The targeted setting can require the reconstructed point cloud to fool the classifier toward an unspecified label different from the specified target.This mismatch makes the optimization in Eq (22) difficult and reduces attack success.
  • Targeted defense results: AdvPC consistently outperforms the other attacks across the reported targeted-defense tables for DGCNN, PointNet++ SSG, PointNet++ MSG, and PointNet.The tables use 1 - accuracy, where higher values indicate better attack performance.
  • Alternative natural priors: GAN discriminators could not distinguish original and attacked samples, so the GAN-based natural-prior approach was abandoned in favor of AE optimization.Both l-GAN and r-GAN failed under soft ℓ2 and hard ℓ∞ settings.
  • Learning-based attack: A learned attack mildly succeeds on untargeted attacks but produces much larger average Chamfer distances than optimization-based attacks.The comparison is reported for PointNet.
Loading 1912.00461v2…