Less Adaptation, More Transfer: Spectral View Randomization for 3D Point Cloud Transfer Attacks
Source abstract
Abstract
Point cloud perception is important in autonomous driving, robotics, and other security-critical 3D systems, yet learned point cloud classifiers remain vulnerable to transferable adversarial perturbations. A central difficulty in transfer-based black-box attacks is surrogate overfitting: an update that is highly effective on an accessible source model may not generalize to an unknown target architecture. We introduce SpecEOT, a source-agnostic and graph-spectral expectation-over-transformation attack. A fixed graph Fourier transform (GFT) basis is constructed from each clean point cloud. At every optimization iteration, each non-identity view independently samples a frequency band and a perturbation sign from uniform distributions; the resulting view gradients are averaged with equal weights and used to update the adversarial point cloud through projected Adam ascent. We evaluate the stochastic method over repeated seeds, extend the ablation to two source architectures, and analyze the interaction between band count and randomization strength while reporting computational cost and assessing robustness to Gaussian jitter and point dropout. SpecEOT achieves strong transferability on ModelNet40 and ShapeNet.
Source: crossref · Quality: baseline
Affiliations
Software College, Northeastern University, Shenyang 110169, China
Funding
National Natural Science Foundation of China · Fundamental Research Funds for the Central Universities
References (31)
Show source-provided references
1. Chen, X., Ma, H., Wan, J., Li, B., and Xia, T. (2017). Multi-view 3d object detection network for autonomous driving. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, IEEE.10.1109/CVPR.2017.691 ↗
2. Deep learning for 3d point clouds: A survey10.1109/TPAMI.2020.3005434 ↗
3. Ma, X., Qin, C., You, H., Ran, H., and Fu, Y. (2022). Rethinking Network Design and Local Geometry in Point Cloud: A Simple Residual MLP Framework. Proceedings of the International Conference on Learning Representations 2022, OpenReview.
4. Liu, R., Lam, K.Y., Zhou, W., Wu, S., Zhao, J., Hu, D., and Gong, M. (2025). STBA: Towards Evaluating the Robustness of DNNs for Query-Limited Black-box Scenario. Proceedings of the IEEE Transactions on Multimedia 2025, IEEE.10.1109/TMM.2025.3535328 ↗
5. Yang, M., Liu, D., Tang, K., Zhou, P., Chen, L., and Chen, J. (2024). Hiding Imperceptible Noise in Curvature-Aware Patches for 3D Point Cloud Attack. Proceedings of the European Conference on Computer Vision 2024, Springer.10.1007/978-3-031-73404-5_25 ↗
6. Lou, T., Jia, X., Gu, J., Liu, L., Liang, S., He, B., and Cao, X. (2024). Hide in thicket: Generating imperceptible and rational adversarial perturbations on 3d point clouds. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition 2024, IEEE.10.1109/CVPR52733.2024.02296 ↗
7. Tang, K., Du, Z., Peng, W., Wang, X., Liu, D., Liu, L., and Tian, Z. (2025). Imperceptible 3D Point Cloud Attacks on Lattice-based Barycentric Coordinates. Proceedings of the AAAI Conference on Artificial Intelligence 2025, AAAI.10.1609/aaai.v39i19.34294 ↗
8. He, B., Liu, J., Li, Y., Liang, S., Li, J., Jia, X., and Cao, X. (2023). Generating transferable 3d adversarial point cloud via random perturbation factorization. Proceedings of the AAAI Conference on Artificial Intelligence 2023, AAAI.10.1609/aaai.v37i1.25154 ↗
9. Hamdi, A., Rojas, S., Thabet, A., and Ghanem, B. (2020). Advpc: Transferable adversarial perturbations on 3d point clouds. Proceedings of the European Conference on Computer Vision 2020, Springer.10.1007/978-3-030-58610-2_15 ↗
10. Liu, D., and Hu, W. (2022). Imperceptible transfer attack and defense on 3d point cloud classification. Proceedings of the IEEE Transactions on Pattern Analysis and Machine Intelligence, IEEE.10.1109/TPAMI.2022.3193449 ↗
11. Chen, H., Zhao, S., Yang, X., Yan, H., He, Y., Xue, H., Qian, F., and Su, H. (2024). Anf: Crafting transferable adversarial point clouds via adversarial noise factorization. Proceedings of the IEEE Transactions on Big Data, IEEE.10.1109/TBDATA.2024.3436593 ↗
12. Transferable and undefendable point cloud attacks via medial axis transform10.1016/j.cagd.2026.102515 ↗
13. Tang, K., Liu, X., Peng, W., Wang, X., Liu, D., Zhu, P., Lu, C., and Tian, Z. (2026). Rethinking Transferable Adversarial Attacks on Point Clouds from a Compact Subspace Perspective. arXiv.
14. Chung, F.R. (1997). Spectral Graph Theory, American Mathematical Society.
15. Rahaman, N., Baratin, A., Arpit, D., Draxler, F., Lin, M., Hamprecht, F., Bengio, Y., and Courville, A. (2019). On the spectral bias of neural networks. Proceedings of the International Conference on Machine Learning, PMLR.
16. Hu, Q., Liu, D., and Hu, W. (2022). Exploring the devil in graph spectral domain for 3d point cloud attacks. Proceedings of the European Conference on Computer Vision, Springer.10.1007/978-3-031-20062-5_14 ↗
17. Hu, S., Liu, D., and Hu, W. (2026). Improving the Transferability of Point Cloud Attack via Spectral-Aware Admix and Optimization Designs. Proceedings of the Artificial Neural Networks and Machine Learning, Springer.10.1007/978-3-032-04546-1_33 ↗
18. Athalye, A., Engstrom, L., Ilyas, A., and Kwok, K. (2018). Synthesizing Robust Adversarial Examples. Proceedings of the International Conference on Machine Learning, PMLR.
19. Wang, T., Ying, Z., and Li, Q. (2023). Boost adversarial transferability by uniform scale and mix mask method. arXiv.10.1007/978-981-96-0850-8_14 ↗
20. Zheng, M., Wu, K., Fan, Y., Huang, R., and Wu, B. (2026). Seeking flat minima over diverse surrogates for improved adversarial transferability: A theoretical framework and algorithmic instantiation. Proceedings of the IEEE Transactions on Pattern Analysis and Machine Intelligence, IEEE.10.1109/TPAMI.2026.3679726 ↗
21. Madry, A., Makelov, A., Schmidt, L., Tsipras, D., and Vladu, A. (2018). Towards deep learning models resistant to adversarial attacks. Proceedings of the International Conference on Learning Representations, OpenReview.
22. Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., and Fergus, R. (2014). Intriguing properties of neural networks. Proceedings of the International Conference on Learning Representations, OpenReview.
23. Goodfellow, I., Shlens, J., and Szegedy, C. (2015). Explaining and harnessing adversarial examples. Proceedings of the International Conference on Learning Representations, OpenReview.
24. Carlini, N., and Wagner, D. (2017). Towards evaluating the robustness of neural networks. Proceedings of the 2017 IEEE Symposium on Security and Privacy (sp), IEEE.10.1109/SP.2017.49 ↗
25. Wen, Y., Lin, J., Chen, K., Chen, C.P., and Jia, K. (2020). Geometry-aware generation of adversarial point clouds. Proceedings of the IEEE Transactions on Pattern Analysis and Machine Intelligence, IEEE.
26. Xiang, C., Qi, C.R., and Li, B. (2019). Generating 3d adversarial point clouds. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, IEEE.10.1109/CVPR.2019.00935 ↗
27. Tsai, T., Yang, K., Ho, T.Y., and Jin, Y. (2020). Robust adversarial objects against deep learning models. Proceedings of the AAAI Conference on Artificial Intelligence 2020, AAAI.10.1609/aaai.v34i01.5443 ↗
28. Qi, C.R., Su, H., Mo, K., and Guibas, L.J. (2017). Pointnet: Deep learning on point sets for 3d classification and segmentation. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, IEEE.
29. Qi, C.R., Yi, L., Su, H., and Guibas, L.J. (2017). Pointnet++: Deep hierarchical feature learning on point sets in a metric space. Proceedings of the Advances in Neural Information Processing Systems, Curran Associates Inc.
30. Dynamic graph cnn for learning on point clouds10.1145/3326362 ↗
31. Wu, X., Jiang, L., Wang, P.S., Liu, Z., Liu, X., Qiao, Y., Ouyang, W., He, T., and Zhao, H. (2014). Point transformer v3: Simpler faster stronger. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, IEEE.