Adversarial shape perturbations on 3D point clouds

Abstract

The importance of training robust neural network grows as 3D data is increasingly utilized in deep learning for vision tasks, like autonomous driving. We examine this problem from the perspective of the attacker, which is necessary in understanding how neural networks can be exploited, and thus defended. More specifically, we propose adversarial attacks based on solving different optimization problems, like minimizing the perceptibility of our generated adversarial examples, or maintaining a uniform density distribution of points across the adversarial object surfaces. Our four proposed algorithms for attacking 3D point cloud classification are all highly successful on existing neural networks, and we find that some of them are even effective against previously proposed point removal defenses.

Minimal Adversarial Examples for Deep Learning on 3D Point Clouds

“…Adversarial Point Clouds. There exist a few studies on adversarial attacks and defenses for point cloud classification [30,13,12,31,27]. For instance, Xiang et al [30] first suggested an optimisation algorithm based on C&W framework [16] using the Chamfer and Hausdorff distance.…”

“…Several works suggest viable perturbation techniques on point clouds. For instance, adversarial point clouds can be generated by perturbing points individually [30] or in bundles [30,12,31]. It is also possible to mix newly added points with perturbed points in a point cloud to make an adversarial example [12].…”

“…For instance, adversarial point clouds can be generated by perturbing points individually [30] or in bundles [30,12,31]. It is also possible to mix newly added points with perturbed points in a point cloud to make an adversarial example [12]. Alternatively, some methods opt to drop points based on point saliency [36,28].…”

“…Alternatively, some methods opt to drop points based on point saliency [36,28]. There are also works [12,27] that further consider perceptibility constraints applied to local meshes.…”

Physically Realizable Adversarial Examples for LiDAR Object Detection

“…[44,36] proposed saliency-based approaches for removing points. Several structured methods have been also introduced to perturb point clouds with the goal of preserving physical fidelity [23].…”