On Adversarial Robustness of 3D Point Cloud Classification under Adaptive Attacks

Sun, Jiachen; Koenig, Karl; Cao, Yulong; Chen, Qi Alfred; Mao, Z. Morley

doi:10.48550/arxiv.2011.11922

Cited by 5 publications

(8 citation statements)

References 26 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Zhou et al (2019) and Dong et al (2020) proposed to leverage input randomization techniques to mitigate such vulnerabilities. Sun et al (2020b) conducted adaptive attacks on existing defenses and analyzed the application of adversarial training on point cloud recognition. Zhao et al (2020) discovered that adversarial rotation greatly degrades the perception performance.…”

Section: Related Workmentioning

confidence: 99%

“…In the literature, the vast majority of research on robustness in 3D point cloud recognition has concentrated on the critical difficulties of robustness against adversarial examples. Adversarial training has been adapted to defend against various threats to point cloud learning (Sun et al, 2020b;. However, we find that the inevitable sensor inaccuracy and physical constraints will result in a number of common corruption on point cloud data.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Benchmarking Robustness of 3D Point Cloud Recognition Against Common Corruptions

Sun¹,

Zhang²,

Kailkhura³

et al. 2022

Preprint

Self Cite

View full text Add to dashboard Cite

Deep neural networks on 3D point cloud data have been widely used in the real world, especially in safety-critical applications. However, their robustness against corruptions is less studied. In this paper, we present ModelNet40-C, the first comprehensive benchmark on 3D point cloud corruption robustness, consisting of 15 common and realistic corruptions. Our evaluation shows a significant gap between the performances on ModelNet40 and ModelNet40-C for state-of-the-art (SOTA) models. To reduce the gap, we propose a simple but effective method by combining PointCutMix-R and TENT after evaluating a wide range of augmentation and testtime adaptation strategies. We identify a number of critical insights for future studies on corruption robustness in point cloud recognition. For instance, we unveil that Transformer-based architectures with proper training recipes achieve the strongest robustness. We hope our in-depth analysis will motivate the development of robust training strategies or architecture designs in the 3D point cloud domain. Our codebase and dataset are included in https://github. com/jiachens/ModelNet40-C.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Benchmarking Robustness of 3D Point Cloud Recognition Against Common Corruptions

Sun¹,

Zhang²,

Kailkhura³

et al. 2022

Preprint

Self Cite

View full text Add to dashboard Cite

show abstract

“…Task Description: In this task, we aim to generate realistic adversarial traffic scenes against point cloud segmentation algorithms, while satisfying certain semantic knowledge rules. To generated adversarial LiDAR scenes containing various fore-/background rather than the point cloud of single 3D object as existing works Lang et al [2020], Sun et al [2020a], a couple of challenges should be considered: First, LiDAR scenes with millions of points are hard to be directly operated; Second, generated scenes need to be realistic and follow traffic rules. Since there are no existing baselines to directly compare with, we implement three methods: (1) Point Attack: a point-wise attack baseline Xiang et al [2019] that adds small disturbance to points; (2) Pose Attack: a scene generation method developed by us that searches poses of a fixed number of vehicles; (3) Scene Attack: a semantically controllable traffic generative method based on our T-VAE and SCG.…”

Section: Adversarial Traffic Scenes Generationmentioning

confidence: 99%

Semantically Adversarial Driving Scenario Generation with Explicit Knowledge Integration

Ding¹,

Hu²,

Li³

et al. 2021

Preprint

View full text Add to dashboard Cite

Deep Generative Models (DGMs) are known for their superior capability in generating realistic data. Extending purely data-driven approaches, recent specialized DGMs may satisfy additional controllable requirements such as embedding a traffic sign in a driving scene, by manipulating patterns implicitly in the neuron or feature level. In this paper, we introduce a novel method to incorporate domain knowledge explicitly in the generation process to achieve semantically controllable scene generation. We categorize our knowledge into two types to be consistent with the composition of natural scenes, where the first type represents the property of objects and the second type represents the relationship among objects. We then propose a tree-structured generative model to learn complex scene representation, whose nodes and edges are naturally corresponding to the two types of knowledge respectively. Knowledge can be explicitly integrated to enable semantically controllable scene generation by imposing semantic rules on properties of nodes and edges in the tree structure. We construct a synthetic example to illustrate the controllability and explainability of our method in a clean setting. We further extend the synthetic example to realistic autonomous vehicle driving environments and conduct extensive experiments to show that our method efficiently identifies adversarial traffic scenes against different state-of-the-art 3D point cloud segmentation models satisfying the traffic rules specified as the explicit knowledge.Preprint. Under review.

show abstract

“…Structural stability: Plenty of researches have discussed defense strategies against intentional attacks for PC networks [38,18,42,19,14,28,41,37], the majority of these studies were with respect to embedded defense modules, such as outlier removal. However, there has been little discussion about the stability of the intrinsic ar-chitectures for PC networks.…”

Section: Reliability Of Pc Networkmentioning

confidence: 99%

“…However, there has been little discussion about the stability of the intrinsic ar-chitectures for PC networks. Inspired by the experiments of [28] who investigated the impacts of different pooling layers on the robustness, we attempt to replace the maxpooling in PointNet with multifarious pooling layers. As table 4 shows, although PointNet with average and sumpooling sacrifice 3.3% and 10.4% accuracies in the classification task of the test set, the success rates of OPA on them plummet from 98.7% to 44.8% and 16.7% respectively, and the requested perturbation magnitudes are dramatically increased, which stands for enhanced stabilization.…”

Section: Reliability Of Pc Networkmentioning

confidence: 99%

Explainability-Aware One Point Attack for Point Cloud Neural Networks

Tan¹,

Kotthaus²

2021

Preprint

View full text Add to dashboard Cite

With the proposition of neural networks for point clouds, deep learning has started to shine in the field of 3D object recognition while researchers have shown an increased interest to investigate the reliability of point cloud networks by fooling them with perturbed instances. However, most studies focus on the imperceptibility or surface consistency, with humans perceiving no perturbations on the adversarial examples. This work proposes two new attack methods: one-point attack (OPA) and critical traverse attack (CTA), which go in the opposite direction: we restrict the perturbation dimensions to a human cognizable range with the help of explainability methods, which enables the working principle or decision boundary of the models to be comprehensible through the observable perturbation magnitude. Our results show that the popular point cloud networks can be deceived with almost 100% success rate by shifting only one point from the input instance. In addition, we attempt to provide a more persuasive viewpoint of comparing the robustness of point cloud models against adversarial attacks. We also show the interesting impact of different point attribution distributions on the adversarial robustness of point cloud networks. Finally, we discuss how our approaches facilitate the explainability study for point cloud networks. To the best of our knowledge, this is the first point-cloud-based adversarial approach concerning explainability. Our code is available at https://github.com/Explain3D/ Exp-One-Point-Atk-PC. Figure 1: One point attack for point cloud networks. With the saliency map provided by the explainability method, only one point needs to be perturbed in the point set of the original instance to fool the most popular point cloud networks.

show abstract

On Adversarial Robustness of 3D Point Cloud Classification under Adaptive Attacks

Cited by 5 publications

References 26 publications

Benchmarking Robustness of 3D Point Cloud Recognition Against Common Corruptions

Benchmarking Robustness of 3D Point Cloud Recognition Against Common Corruptions

Semantically Adversarial Driving Scenario Generation with Explicit Knowledge Integration

Explainability-Aware One Point Attack for Point Cloud Neural Networks

Contact Info

Product

Resources

About