Shape-invariant 3D Adversarial Point Clouds

Huang, Qidong; Dong, Xiaoyi; Chen, Dongdong; Zhou, Hang; Zhang, Weimin; Yu, Nenghai

doi:10.1109/cvpr52688.2022.01490

Cited by 33 publications

(20 citation statements)

References 23 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…A related attack, though not exactly in the frequency domain, was proposed by Huang et al [78]. This attack is based on applying reversible coordinate transformations to points in the original point cloud, which reduces one degree of freedom and limits their movement to the tangent plane.…”

Section: ) Transform Attacksmentioning

confidence: 99%

“…This method takes advantage of the inherent properties of point clouds, bypassing the need for knowledge about the target model, and is therefore applicable to any model. Huang et al [78] proposed two versions of their attack, one white-box and the other black-box. The black-box attack relies on queries and saliency maps generated from a separate white-box surrogate model to craft adversarial perturbations that fool the target model.…”

Section: Adversarial Knowledgementioning

confidence: 99%

“…Datasets ModelNet10 [119] [67], [107], [130], [82] ModelNet40 [119] [60], [67], [65], [63], [62], [61], [59], [57], [58], [54] [53], [98], [78], [131], [101], [132], [107], [133], [130], [73] [56], [96], [82], [79], [64], [100], [134], [106], [135], [76], [85], [136] ShapeNet [120] [61], [57], [55], [98], [131], [79], [93], [105] ScanObjectNN [121] [63], [132], [113], [107], [130] KITTI [126] [67], [137] ScanNet [19] [113], [106] 3D-MNIST…”

Section: ) Understanding the Role Of Frequencymentioning

confidence: 99%

“…PointNet [19] [60], [67], [66], [65], [63], [62], [61], [57], [58], [55] [54], [53], [98], [101], [74], [132], [113], [107], [133], [130] [89], [73], [56], [96], [82], [79], [93], [105], [64], [100] [137], [134], [106], [135], [76], [85], [136] PointNet++ [138] [60], [66], [65], [63], [62], [61], [59], [57], [58], [55] [54], [53], [98], [78], [131], [101], …”

Section: ) Understanding the Role Of Frequencymentioning

confidence: 99%

See 3 more Smart Citations

Adversarial Attacks and Defenses on 3D Point Cloud Classification: A Survey

Naderi,

Bajić

2023

IEEE Access

View full text Add to dashboard Cite

Deep learning has successfully solved a wide range of tasks in 2D vision as a dominant AI technique. Recently, deep learning on 3D point clouds has become increasingly popular for addressing various tasks in this field. Despite remarkable achievements, deep learning algorithms are vulnerable to adversarial attacks. These attacks are imperceptible to the human eye, but can easily fool deep neural networks in the testing and deployment stage. To encourage future research, this survey summarizes the current progress on adversarial attack and defense techniques on point-cloud classification. This paper first introduces the principles and characteristics of adversarial attacks and summarizes and analyzes adversarial example generation methods in recent years. Additionally, it provides an overview of defense strategies, organized into data-focused and model-focused methods. Finally, it presents several current challenges and potential future research directions in this domain. INDEX TERMS 3D deep learning, deep neural network, adversarial examples, adversarial defense, machine learning security, 3D point clouds.

show abstract

Section: ) Transform Attacksmentioning

confidence: 99%

Section: Adversarial Knowledgementioning

confidence: 99%

Section: ) Understanding the Role Of Frequencymentioning

confidence: 99%

Section: ) Understanding the Role Of Frequencymentioning

confidence: 99%

See 2 more Smart Citations

Adversarial Attacks and Defenses on 3D Point Cloud Classification: A Survey

Naderi,

Bajić

2023

IEEE Access

View full text Add to dashboard Cite

show abstract

“…Compared to the 2D counterparts, 3D adversarial attack often shows less transferability due to the very difference among point cloud recognition models, thus Hamdi et al [52] introduced autoencoder-based reconstruction into optimization to improve the adversarial transferability. To guarantee the surface-level smoothness and fairness, the geometry-aware methods like GeoA 3 [10], shape constrained methods like SiAdv [53] and ITA [54] are designed to boost the attack imperceptibility. To perform the more practical adversarial attack in autonomous driving, Cao et al [55] and Sun et al [12], [56] systematically implemented point cloud attack to the LiDAR perception module and demonstrated the security threats brought by 3D adversarial objects.…”

Section: D Adversarial Attack and Defensementioning

confidence: 99%

PointCAT: Contrastive Adversarial Training for Robust Point Cloud Recognition

Huang¹,

Dong²,

Chen³

et al. 2022

Preprint

Self Cite

View full text Add to dashboard Cite

Notwithstanding the prominent performance achieved in various applications, point cloud recognition models have often suffered from natural corruptions and adversarial perturbations. In this paper, we delve into boosting the general robustness of point cloud recognition models and propose Point-Cloud Contrastive Adversarial Training (PointCAT). The main intuition of PointCAT is encouraging the target recognition model to narrow the decision gap between clean point clouds and corrupted point clouds. Specifically, we leverage a supervised contrastive loss to facilitate the alignment and uniformity of the hypersphere features extracted by the recognition model, and design a pair of centralizing losses with the dynamic prototype guidance to avoid these features deviating from their belonging category clusters. To provide the more challenging corrupted point clouds, we adversarially train a noise generator along with the recognition model from the scratch, instead of using gradient-based attack as the inner loop like previous adversarial training methods. Comprehensive experiments show that the proposed PointCAT outperforms the baseline methods and dramatically boosts the robustness of different point cloud recognition models, under a variety of corruptions including isotropic point noises, the LiDAR simulated noises, random point dropping and adversarial perturbations.

show abstract