Robustness Certification for Point Cloud Models

Abstract

The use of deep 3D point cloud models in safety-critical applications, such as autonomous driving, dictates the need to certify the robustness of these models to semantic transformations. This is technically challenging as it requires a scalable verifier tailored to point cloud models that handles a wide range of semantic 3D transformations. In this work, we address this challenge and introduce 3DCertify, the first verifier able to certify robustness of point cloud models. 3DCertify is based on two key insights: (i) a generic relaxation based on first-order Taylor approximations, applicable to any differentiable transformation, and (ii) a precise relaxation for global feature pooling, which is more complex than pointwise activations (e.g., ReLU or sigmoid) but commonly employed in point cloud models. We demonstrate the effectiveness of 3DCertify by performing an extensive evaluation on a wide range of 3D transformations (e.g., rotation, twisting) for both classification and part segmentation tasks. For example, we can certify robustness against rotations by ±60°for 95.7% of point clouds, and our max pool relaxation increases certification by up to 15.6%.

3DeformRS: Certifying Spatial Deformations on Point Clouds

“…We used their official implementation and pre-trained weights, and note that 3DCertify certifies a 100-instance subset of the test set. We note that the certified accuracies reported in [28] are w.r.t. the correctlyclassified samples from such subset.…”

“…PointGuard [27] provided tight robustness guarantees against modification, addition, and deletion of points. 3DCertify [28] generalized DeepG [5] to 3D point clouds and proposed 3DCertify, a verification approach to certify robustness against common 3D transformations. PointGuard has the benefit of low computational cost (compared to that of exact verification), but does not allow for spatial deformations.…”

“…In particular, we consider four linear, rigid and deformable transformations: (1) rotation, (2) translation, (3) shearing, and (4) the general affine transformation. Furthermore, we follow prior work [28] and consider two nonlinear transformations: (5) tapering and (6) twisting. As a summary, we report all the deformation flows and their corresponding parameters in Table 1, and visualize some of their effects in Figure 2.…”

“…We further compare 3DeformRS and 3DCertify [28], which is, to the best of our knowledge, the current stateof-the-art certification approach against spatial deformations. 3DCertify's analysis focuses exclusively on Point-Net and ModelNet40.…”

“…In particular, the seminal work of Liu et al [27] certified point cloud DNNs against modification, addition, and deletion of points. Furthermore, Lorenz et al [28] recently proposed a verification approach to certify against 3D transformations.…”