Shape-invariant 3D Adversarial Point Clouds

1. Introduction

• Prior point-cloud attacks either produced noticeable perturbations or focused on white-box settings, limiting performance on defended or unseen models.The introduction identifies robustness testing when model details are unavailable as a motivation for black-box attacks.Source: §1 · p. 1
• The paper adopts a shape-invariant perspective to address perturbation imperceptibility and black-box attack efficiency.The introduction notes that model details may be withheld from robustness testers under trade-secret protections.Source: §1 · pp. 1–2
• Perturbing the top-ranked 30% of points degraded white-box recognition accuracy by over 40% across different models.The paper presents this as evidence that shape-invariant white-box attacks are possible.Source: §1 · p. 2
• On ModelNet40, top-ranked 30% points overlapped 75.8% between model pairs and 40.3% among triples, versus random-sampling rates of 30% and 9%.The comparison used PointNet, PointNet++, DGCNN, and CurveNet.Source: §1 · p. 2
• The black-box attack transfers a surrogate model's sensitivity ranking to the target and perturbs one point-wise basis per query step.Each basis combines a point with its certified best direction.Source: §1 · p. 2
• The point-cloud sensitivity map assigns each point a non-negative score measuring recognition-confidence variation under shape-invariant perturbation.Points are ranked by score, and the map is computed for each input on a white-box model.Source: §1 · p. 2

2.1. Point Cloud Recognition

• Point-cloud recognition methods include PointNet, which applies pointwise multilayer perceptrons and max-pooling, and PointNet++, which hierarchically abstracts local features.DGCNN uses neighborhood graphs; the paper evaluates its black-box attack on six representative recognition models.Source: §2.1 · p. 2

2.2. Existing 3D Adversarial Attacks and Defenses

• 3D attacks include point shifting, adding, and dropping, while defenses include preprocessing, adversarial training, gather-vector, and provable methods.Point-shifting methods use gradient descent or optimization; point-adding and point-dropping methods change the input point count.Source: §2.2 · pp. 2–3

2.3. Query-based Black-box Adversarial Attacks

• Image-based query attacks are decision-based or score-based: the former use queried labels, while the latter use confidence scores.The paper extends score-based black-box attacks to 3D point-cloud recognition, which it describes as under-researched.Source: §2.3 · p. 3

3.1. Point Cloud Sensitivity Maps

• The reversible coordinate transformation reduces each point’s freedom and confines its movement to the tangent plane by setting the transformed z′ coordinate to zero.The transformed frame uses BA, CO′, and O′O as its x′, y′, and z′ axes.Source: §3.1 · p. 3
• Each point’s sensitivity is its maximal loss-variation rate along the tangent plane, scored using the transformed-coordinate gradients.The normal vector is estimated from neighboring points using the last unit eigenvector of a 3 × 3 positive semi-definite matrix.Source: §3.1 · pp. 3–4

3.2. Shape-invariant White-box Attack

• The white-box attack iteratively optimizes the transformed point cloud with gradients, then applies the inverse transform to recover the adversarial point cloud.The rotation matrices are updated iteratively to inherit shape invariance.Source: §3.2 · pp. 4–5

3.3. Shape-invariant Black-box Attack

• For black-box attacks, a surrogate model ranks points by sensitivity, and each query perturbs one top-ranked point along or against its mapped direction.The attacker uses model-output logits and assumes access to a white-box surrogate model.Source: §3.3 · p. 5

4.1. Setup

• Evaluation uses ModelNet40 and ShapeNetPart, with 1,024 sampled points per object and six recognition model types.The main manuscript reports ModelNet40 results and uses DGCNN as the black-box surrogate; ShapeNetPart and PointNet-surrogate results are in supplementary materials.Source: §4.1 · pp. 5–6

4.2. Efficiency of Sensitivity Maps

• Perturbing points in descending sensitivity-map order degrades PAConv recognition accuracy more than ascending or random order.The comparison uses a unified step size of 0.03 and is presented as validation of the sensitivity-map ranking.Source: §4.2 · p. 6, Figure 4 · p. 6

4.3. White-box Performance

• The white-box attack achieves nearly 100% ASR with the least geometry distance cost and lower time than regular gradient-based attacks.It also outperforms baselines on outlier-removal defenses, which the authors link to perturbations lying mainly along the shape surface with fewer outliers.Source: §4.3 · p. 7

4.4. Black-box Performance

• On unseen black-box models, the attack achieves comparable ASR with fewer queries and less point modification than SimBA and SimBA+.The comparison uses a unified step size of 0.32 (Table 3).Source: §4.4 · p. 7, Table 3 · p. 7
• Larger black-box attack step sizes reduce queries under nearly 100% ASR, while increasing l2-norm and Chamfer distances.Under point dropout, ASR degrades by up to 36.3% on PAConv, SimpleView, and PointNet, while query needs increase.Source: Figure 5 · p. 7, §4.4 · p. 8

4.5. Qualitative Results

• Visualized adversarial point clouds contain hardly any outliers because perturbations lie almost along the shape surface.The authors characterize the resulting attacks as threatening while retaining shape invariance and satisfying imperceptibility.Source: §4.5 · p. 8, Figure 6 · p. 8

• The Point-Cloud Sensitivity Map measures recognition-confidence variation when each point receives an explicitly constrained shape-invariant perturbation.Source: §5 · p. 8
• Guided by the map, the authors extend shape-invariant adversarial point-cloud attacks from white-box to black-box settings.They describe this as the first query-based black-box attack on point-cloud recognition, to their knowledge.Source: §5 · p. 8
• Experiments support the method's effectiveness and practicality, with superior shape invariance.Source: §5 · p. 8

• On PointNet++, the query-based attack reaches 95.8% ASR with 417.0 average queries, versus 92.6% and 987.9 for the saliency map.Source: A. The Primary Motivation · p. 9
• The saliency map measures recognition changes after dropping a point, whereas this attack measures changes under slight point perturbations.Source: A. The Primary Motivation · p. 9
• Tangent-plane perturbations are motivated as more invisible because typical gradient maps do not constrain direction and can move points off the surface.The authors realize the tangent gradient map by projecting the gradient map onto tangent planes.Source: A. The Primary Motivation · p. 9

• Large-curvature surfaces, especially edges and corners, can make the estimated normal inaccurate and let perturbed points escape the surface.Smaller steps and more iterations can alleviate this issue, at the cost of more attack time.Source: B. Limitations and Social Impacts · p. 9
• Materializing attacks against self-driving cars would require model outputs, such as predicted logits, to guide attack loops.Source: B. Limitations and Social Impacts · p. 9
• The method is framed as a robustness-evaluation tool, particularly for black-box testing when trade-secret agreements restrict model details.The authors also mention robustness enhancement and reduced data leakage as possible defenses.Source: B. Limitations and Social Impacts · p. 9

C. Proof of Theorem 1

• The new frame’s z′ axis follows the surface normal, while its x′ and y′ axes are derived from the original axes and the projected origin geometry.The proof first relates the origins by OO′ = k n_i, with k = p_i · n_i.Source: C. Proof of Theorem 1 · p. 9
• The proof identifies the axis rotation as R_i and handles the boundary case n_i3 = 1 separately because the general expression’s denominator becomes zero.It concludes that the transformation preserves the rotation matrix’s spectral norm, with ||R_i^⊤||_2^2 = 1.Source: C. Proof of Theorem 1 · pp. 9–10
• The transformation shifts each point by T_i = (p_i · n_i)n_i and then rotates it to obtain its coordinates in the new frame.The reverse transformation applies the inverse rotation and subtracts the translation.Source: C. Proof of Theorem 1 · p. 10

D. More Visualization Results

• Figure 7 presents additional visualizations of the proposed point-cloud sensitivity maps on CurveNet.The passage identifies the model and visualization, but does not state a visual comparison or outcome.Source: D. More Visualization Results · p. 10

E. More Experimental Results

• On ShapeNetPart, the white-box attack maintains over 90% ASR while achieving low Chamfer distance.The evaluation trains PointNet, PointNet++, and CurveNet on ShapeNetPart; Table 5 compares ASR, Chamfer distance, Hausdorff distance, and average time budget.Source: E. More Experimental Results · p. 11, Table 5 · p. 11
• With PointNet as the surrogate, the black-box attack has only few performance degradation and retains better query cost and visual quality than SimBA and SimBA+ on SimpleView, PAConv, and CurveNet.The passage notes that some ASR is sacrificed; Table 6 defines Ours-P as using PointNet and Ours-D as using DGCNN as the surrogate.Source: E. More Experimental Results · p. 11, Table 6 · p. 11