Source-linked AI summary
Learning-Based Reconstruction Attacks on Coordinate-Obfuscated Point Clouds
Mohammad Waquas Usmani, Susmit Shannigrahi, Michael Zink
TL;DR
Selective coordinate encryption reduces the cost of protecting point cloud video, but the security of leaving some coordinates visible remains uncertain. This paper evaluates PointNet and Random Forest reconstruction attacks under X and 2X granularities, finding that fully encrypted X coordinates are difficult to recover while 2X leaks enough neighboring information for accurate reconstruction. The results show that encryption granularity is central to resistance against reconstruction attacks.
Problem
It is unclear whether the visible coordinates and attributes left by selective encryption reveal enough information to recover encrypted point cloud geometry.
Method
The paper evaluates PointNet and Random Forest models that reconstruct encrypted coordinates from visible spatial, geometric, color, and neighboring-coordinate features under X and 2X encryption.
Results
Fully encrypted X coordinates remain difficult to reconstruct, whereas 2X leaks sufficient information through neighboring visible coordinates for accurate reconstruction.
Takeaways & Limitations
Selective coordinate encryption security depends strongly on encryption granularity, requiring a balance between computational efficiency and resistance to reconstruction attacks.
Takeaways & Limitations
More advanced models, larger or object-specific datasets, point-cloud upsampling attacks, and additional encryption granularities remain to be evaluated.
Abstract
from arXiv · showhide
Volumetric video based on point cloud representations enables immersive virtual and augmented reality applications but introduces significant challenges for efficient and secure content delivery. Prior work proposed a selective coordinate encryption framework for point clouds that encrypts only a subset of coordinates, reducing computational costs while visually degrading unauthorized content. However, it remains unclear whether the remaining unencrypted information is sufficient to enable content reconstruction. In this paper, we evaluate the robustness of selective coordinate encryption against machine learning-based reconstruction attacks. We consider an attacker with access to selectively encrypted point clouds attempting to recover encrypted coordinates without decryption by exploiting spatial and geometric correlations in the unencrypted data. We evaluate PointNet and Random Forest models under two encryption granularities: \texttt{X}, where all $X$ coordinates are encrypted, and \texttt{2X}, where every second $X$ coordinate is encrypted. Our results show that reconstructing fully encrypted $X$ coordinates remains challenging, whereas the \texttt{2X} scheme leaks sufficient information through neighboring coordinates to enable accurate reconstruction. These findings demonstrate that the security of selective coordinate encryption depends strongly on encryption granularity.
1 Introduction
Selective coordinate encryption reduces protection costs but leaves visible spatial and geometric information that may support reconstruction attacks. This study evaluates PointNet and Random Forest attacks under X and 2X encryption granularities, finding that X reconstruction is difficult while 2X exposes enough neighboring information for accurate recovery.
- Motivation: Point clouds create computational and bandwidth overheads that can increase latency and motion-to-photon delay in immersive applications.Their large data volume contributes to motion sickness through increased delivery latency.
- Motivation: Transport-layer encryption protects communication channels but does not provide efficient protection tailored to point cloud streaming.Prior studies examined individual point cloud encryption, while volumetric video streams received comparatively little attention.
- Motivation: Selective coordinate encryption encrypts only chosen coordinates, reducing computational overhead while degrading unauthorized visual quality.The remaining unencrypted information creates the central question of whether attackers can recover protected coordinates.
- Threat and approach: Machine learning can exploit spatial and geometric relationships in visible point cloud data to predict encrypted coordinates without decryption.Visible coordinates and attributes may leak sufficient information for recovery.
- Threat and approach: The evaluation uses PointNet and Random Forest models under X encryption, which encrypts all X coordinates, and 2X encryption, which encrypts every second X coordinate.Models use combinations of spatial, geometric, and color features.
- Findings: Reconstructing fully encrypted X coordinates remains challenging, whereas 2X exposes neighboring visible X coordinates that enable significantly accurate geometric reconstruction.For X, surface normal n_x and visible Y and Z coordinates provide the most useful reconstruction information.
2 Background and Related Work
The paper situates its attack within point cloud completion and reconstruction research while distinguishing it from conventional completion. It specifically tests whether visible coordinates and attributes in selectively encrypted point clouds reveal protected geometry.
- Background: Point clouds represent 3D objects or scenes as spatial coordinates with optional attributes, and sequences of frames form volumetric video for 6DoF experiences.Common attributes include color and surface normals.
- Prior work: Prior selective encryption work protected subsets of spatial coordinates while leaving other coordinates, attributes, and metadata unencrypted to balance distortion and computational efficiency.Encrypting only the X coordinate reduced encryption and decryption times relative to full point cloud encryption.
- Prior work: Attribute-based selective coordinate encryption was integrated into ABE-VVS for volumetric video delivery, reducing server and cache CPU usage while improving client QoE.
- Research gap: The resilience of selective coordinate encryption against machine learning reconstruction attacks remained unexplored, particularly whether visible data could recover encrypted geometry.The paper addresses this gap by evaluating modern machine learning models.
- Related methods: Existing point cloud completion research includes geometric, PointNet-based, GAN-based, Transformer-based, and point upsampling approaches.
- Related methods: PointNet-family and other learning-based methods have supported point cloud classification, segmentation, completion, reconstruction, and upsampling.
- Contribution: Unlike conventional completion, this work infers selectively encrypted coordinates from visible coordinates, neighborhood information, and other point attributes within protected point clouds.It evaluates PointNet and Random Forest models to quantify information leakage.
3 Methodology
The methodology models an unauthorized attacker who uses visible point cloud information to reconstruct encrypted coordinates. It evaluates PointNet and Random Forest regression across two encryption granularities and multiple feature configurations.
- Threat Model: The threat model distributes selectively encrypted point clouds through CDN streaming while authorized users decrypt protected coordinates for volumetric video playback.
- Threat Model: The attacker lacks decryption keys but can exploit visible coordinates, surface normals, colors, and metadata to reconstruct protected geometry.The attacker is assumed to know the encryption granularity and methodology.
- Threat Model: The attack predicts encrypted coordinate values from correlations among neighboring points, unencrypted coordinates, surface normals, and color attributes rather than breaking the encryption scheme.
- Preprocessing: Frames are normalized to a unit sphere, and PointNet inputs are truncated to 100,000 points while Random Forest operates on individual points.
- Encryption settings: The X scheme encrypts every point’s X coordinate, whereas 2X encrypts every second point’s X coordinate and leaves alternating X coordinates visible.
- Features: X-scheme models use visible Y and Z coordinates, surface normals, color, curvature, and neighborhood distance computed from k=16 nearest neighbors.
- Features: 2X models add previous and next unencrypted X coordinates, P_X and N_X, to the X-scheme features.
- Models: PointNet regression learns local and global geometric features directly from point cloud data to predict encrypted X coordinates.
4 Evaluation
The evaluation measures reconstruction of encrypted X coordinates using normalized point-to-point and geometric metrics across X and 2X encryption granularities. Fully encrypted X coordinates remain difficult to recover, while neighboring visible coordinates make 2X reconstruction substantially more accurate.
- Evaluation Metrics: The evaluation uses MAE for coordinate error, CD for average bidirectional geometric similarity, and HD for maximum nearest-neighbor deviation.All metrics are reported in normalized coordinate units.
- X Encryption: For X encryption, PointNet and Random Forest perform similarly, with PointNet providing up to 4% lower MAE across most configurations.Models M3 and M4 achieve the lowest error, while local curvature and neighborhood distance provide little benefit.
- X Encryption: 27.9% MAE: PointNet M3 improves over the Zeroed-X baseline of 35.0%, but fully encrypted X-coordinate reconstruction remains challenging.The result is reported for point-to-point reconstruction accuracy.
- X Encryption: Random Forest M4 achieves the lowest X-scheme CD of 0.11 and HD of 0.52, compared with Zeroed-X values of 0.4295 and 0.8540.Surface normals provide useful geometric information, while HD remains sensitive to localized outliers.
- 2X Encryption: Approximately 3% MAE: Random Forest M4 is the best 2X configuration, while interpolation reaches 4.1% and Random Forest M7 reaches 4.2%.The neighboring coordinates provide the main information source, while additional attributes can improve on interpolation.
- 2X Encryption: Random Forest M4 reduces 2X CD to 0.009, compared with 0.013 for interpolation and 0.04 for the baseline.The result indicates improved geometric reconstruction when neighboring coordinates are incorporated.
- 2X Encryption: For 2X reconstruction, HD is higher than the baseline across most machine-learning configurations and interpolation because occasional large errors create localized outliers.This contrasts with substantial improvements in MAE and CD.
5 Discussion and Conclusions
Reconstruction attacks reveal that selective coordinate encryption leaks information unevenly: fully encrypted X coordinates remain difficult to recover, while 2X encryption permits accurate reconstruction. Future work should test stronger models, broader datasets, alternative attacks, and additional encryption granularities.
- Discussion and Conclusions: Reconstruction attacks depend strongly on encryption granularity: fully encrypted X coordinates remain difficult to recover, whereas 2X encryption enables accurate reconstruction.The 2X scheme leaks sufficient information through neighboring visible coordinates.
- Discussion and Conclusions: Machine learning exploits neighboring coordinates and the n_x surface-normal component as primary sources of information leakage in the 2X scheme.Protecting additional coordinate dimensions or surface normals may improve resistance against reconstruction attacks.
- Discussion and Conclusions: Future evaluations should examine advanced models, larger and object-specific datasets, point-cloud upsampling attacks, and additional encryption granularities.These directions may further improve attack performance or clarify robustness against alternative attack strategies.