G&G Attack: General and Geometry-Aware Adversarial Attack on the Point Cloud
Source abstract
Abstract
Deep neural networks have been shown to produce incorrect predictions when imperceptible perturbations are introduced into the clean input. This phenomenon has garnered significant attention and extensive research in 2D images. However, related work on point clouds is still in its infancy. Current methods suffer from issues such as generated point outliers and poor attack generalization. Consequently, it is not feasible to rely solely on overall or geometry-aware attacks to generate adversarial samples. In this paper, we integrate adversarial transfer networks with the geometry-aware method to introduce adversarial loss into the attack target. A state-of-the-art autoencoder is employed, and sensitivity maps are utilized. We use the autoencoder to generate a sufficiently deceptive mask that covers the original input, adjusting the critical subset through a geometry-aware trick to distort the point cloud gradient. Our proposed approach is quantitatively evaluated in terms of the attack success rate (ASR), imperceptibility, and transferability. Compared to other baselines on ModelNet40, our method demonstrates an approximately 38% improvement in ASR for black-box transferability query attacks, with an average query count of around 7.84. Comprehensive experimental results confirm the superiority of our method.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Adversarial Robustness in Machine Learning · High-Velocity Impact and Material Behavior · Physical Unclonable Functions (PUFs) and Hardware Security
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
College of Computer, National University of Defense Technology, Changsha 410073, China
Beijing Institute for Advanced Study, National University of Defense Technology, Beijing 100020, China
College of Advanced Interdisciplinary Studies, National University of Defense Technology, Changsha 410073, China
Funding
National Key R&D Program of China · National Natural Science Foundation of China · Postgraduate Scientific Research Innovation Project of Hunan Province
References (58)
Show source-provided references
1. Dual-Graph Attention Convolution Network for 3-D Point Cloud Classification10.1109/TNNLS.2022.3162301 ↗
2. WiSE–a satellite-based system for remote monitoring10.1002/sat.1176 ↗
3. LFT-Net: Local Feature Transformer Network for Point Clouds Analysis
4. Multi-Task Y-Shaped Graph Neural Network for Point Cloud Learning in Autonomous Driving10.1109/TITS.2022.3150155 ↗
5. A 3-D-Point-Cloud System for Human-Pose Estimation10.1109/TSMC.2014.2329266 ↗
6. Goodfellow, I.J., Shlens, J., and Szegedy, C. (2014). Explaining and Harnessing Adversarial Examples. arXiv.
7. Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., and Fergus, R. (2014). Intriguing properties of neural networks. arXiv.
8. Cui, Y., Zhang, B., Yang, W., Yi, X., and Tang, Y. (2018, January 8–13). Deep CNN-based Visual Target Tracking System Relying on Monocular Image Sensing. Proceedings of the 2018 International Joint Conference on Neural Networks (IJCNN), Rio de Janeiro, Brazil.10.1109/IJCNN.2018.8489650 ↗
9. Eykholt, K., Evtimov, I., Fernandes, E., Li, B., Rahmati, A., Xiao, C., Prakash, A., Kohno, T., and Song, D. (2018, January 18–23). Robust Physical-World Attacks on Deep Learning Visual Classification. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), Salt Lake City, UT, USA.10.1109/CVPR.2018.00175 ↗
10. Komkov, S., and Petiushko, A. (2021, January 10–15). AdvHat: Real-World Adversarial Attack on ArcFace Face ID System. Proceedings of the 2020 25th International Conference on Pattern Recognition (ICPR), Milan, Italy.10.1109/ICPR48806.2021.9412236 ↗
11. Kurakin, A., Goodfellow, I.J., and Bengio, S. (2018). Adversarial examples in the physical world. Artificial Intelligence Safety and Security, Chapman and Hall/CRC.10.1201/9781351251389-8 ↗
12. Papernot, N., McDaniel, P., Goodfellow, I., Jha, S., Celik, Z.B., and Swami, A. (2017, January 2–6). Practical black-box attacks against machine learning. Proceedings of the 2017 ACM on Asia Conference on computer and Communications Security, Abu Dhabi, United Arab Emirates.10.1145/3052973.3053009 ↗
13. Ilyas, A., Engstrom, L., Athalye, A., and Lin, J. (2018, January 10–15). Black-box adversarial attacks with limited queries and information. Proceedings of the International Conference on Machine Learning, Stockholm, Sweden.
14. Dong, Y., Liao, F., Pang, T., Su, H., Zhu, J., Hu, X., and Li, J. (2018, January 18–23). Boosting Adversarial Attacks With Momentum. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), Salt Lake City, UT, USA.10.1109/CVPR.2018.00957 ↗
15. Geometry-aware generation of adversarial point clouds10.1109/TPAMI.2020.3044712 ↗
16. Rethinking Perturbation Directions for Imperceptible Adversarial Attacks on Point Clouds10.1109/JIOT.2022.3222159 ↗
17. Point Cloud Upsampling via Perturbation Learning10.1109/TCSVT.2021.3099106 ↗
18. Madry, A., Makelov, A., Schmidt, L., Tsipras, D., and Vladu, A. (2019). Towards Deep Learning Models Resistant to Adversarial Attacks. arXiv.
19. Yang, J., Zhang, Q., Fang, R., Ni, B., Liu, J., and Tian, Q. (2021). Adversarial Attack and Defense on Point Sets. arXiv.
20. Huang, Q., Dong, X., Chen, D., Zhou, H., Zhang, W., and Yu, N. (2022, January 18–24). Shape-Invariant 3D Adversarial Point Clouds. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), New Orleans, LA, USA.10.1109/CVPR52688.2022.01490 ↗
21. Rusu, R.B., Marton, Z.C., Blodow, N., Holzbach, A., and Beetz, M. (2009, January 11–15). Model-based and learned semantic object labeling in 3D point cloud maps of kitchen environments. Proceedings of the 2009 IEEE/RSJ International Conference on Intelligent Robots and Systems, St Louis, MO, USA.10.1109/IROS.2009.5354759 ↗
22. Liu, D., Yu, R., and Su, H. (2019, January 22–25). Extending Adversarial Attacks and Defenses to Deep 3D Point Cloud Classifiers. Proceedings of the 2019 IEEE International Conference on Image Processing (ICIP), Taipei, Taiwan.10.1109/ICIP.2019.8803770 ↗
23. Hamdi, A., Rojas, S., Thabet, A., and Ghanem, B. (2020, January 23–28). Advpc: Transferable adversarial perturbations on 3d point clouds. Proceedings of the Computer Vision–ECCV 2020: 16th European Conference, Glasgow, UK. Proceedings, Part XII 16.10.1007/978-3-030-58610-2_15 ↗
24. Zheng, T., Chen, C., Yuan, J., Li, B., and Ren, K. (2019, January 27–28). PointCloud Saliency Maps. Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), Seoul, Republic of Korea.10.1109/ICCV.2019.00168 ↗
25. Boosting 3d adversarial attacks with attacking on frequency10.1109/ACCESS.2022.3171659 ↗
26. Daniel Liu, R.Y., and Su, H. (2020, January 23–28). Adversarial Shape Perturbations on 3D Point Clouds. Proceedings of the ECCV 2020 Workshops, Glasgow, UK.
27. Xiang, C., Qi, C.R., and Li, B. (2019, January 15–20). Generating 3D Adversarial Point Clouds. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), Long Beach, CA, USA.10.1109/CVPR.2019.00935 ↗
28. Guo, C., Gardner, J., You, Y., Wilson, A.G., and Weinberger, K. (2019, January 10–15). Simple black-box adversarial attacks. Proceedings of the International Conference on Machine Learning, Long Beach, CA, USA.
29. Learning black-box attackers with transferable priors and query feedback
30. Li, X., Chen, Z., Zhao, Y., Tong, Z., Zhao, Y., Lim, A., and Zhou, J.T. (2021, January 10–17). Pointba: Towards backdoor attacks in 3d point cloud. Proceedings of the IEEE/CVF International Conference on Computer Vision, Montreal, QC, Canada.10.1109/ICCV48922.2021.01618 ↗
31. The art of defense: Letting networks fool the attacker10.1109/TIFS.2023.3278458 ↗
32. Xiang, T., Zhang, C., Song, Y., Yu, J., and Cai, W. (2021, January 10–17). Walk in the cloud: Learning curves for point clouds shape analysis. Proceedings of the IEEE/CVF International Conference on Computer Vision, Montreal, QC, Canada.10.1109/ICCV48922.2021.00095 ↗
33. Fan, H., Su, H., and Guibas, L.J. (2017, January 21–26). A point set generation network for 3d object reconstruction from a single image. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, Honolulu, HI, USA.10.1109/CVPR.2017.264 ↗
34. Qi, C.R., Su, H., Mo, K., and Guibas, L.J. (2017, January 21–26). PointNet: Deep Learning on Point Sets for 3D Classification and Segmentation. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), Honolulu, HI, USA.
35. Sheshappanavar, S.V., and Kambhamettu, C. (2022, January 2–4). SimpleView++: Neighborhood Views for Point Cloud Classification. Proceedings of the 2022 IEEE 5th International Conference on Multimedia Information Processing and Retrieval (MIPR), Virtual.10.1109/MIPR54900.2022.00013 ↗
36. Guyon, I., Luxburg, U.V., Bengio, S., Wallach, H., Fergus, R., Vishwanathan, S., and Garnett, R. (2017). PointNet++: Deep Hierarchical Feature Learning on Point Sets in a Metric Space. Advances in Neural Information Processing Systems, Curran Associates, Inc.
37. Pct: Point cloud transformer10.1007/s41095-021-0229-5 ↗
38. Vaswani, A., Shazeer, N., Parmar, N., Uszkoreit, J., Jones, L., Gomez, A.N., Kaiser, Ł., and Polosukhin, I. (2017). Attention is all you need. Advances in Neural Information Processing Systems, Neural Information Processing Systems Foundation, Inc. (NeurIPS).
39. Zhao, H., Jiang, L., Jia, J., Torr, P.H., and Koltun, V. (2021, January 10–17). Point transformer. Proceedings of the IEEE/CVF International Conference on Computer Vision, Montreal, QC, Canada.10.1109/ICCV48922.2021.01595 ↗
40. Kim, J., Hua, B.S., Nguyen, T., and Yeung, S.K. (2021, January 10–17). Minimal Adversarial Examples for Deep Learning on 3D Point Clouds. Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), Montreal, QC, Canada.10.1109/ICCV48922.2021.00770 ↗
41. Ma, C., Meng, W., Wu, B., Xu, S., and Zhang, X. (2020, January 12–16). Efficient joint gradient based attack against sor defense for 3d point cloud classification. Proceedings of the 28th ACM International Conference on Multimedia, Virtual.10.1145/3394171.3413875 ↗
42. Carlini, N., and Wagner, D. (2017, January 22–26). Towards evaluating the robustness of neural networks. Proceedings of the 2017 IEEE Symposium on Security and Privacy (sp), San Jose, CA, USA.10.1109/SP.2017.49 ↗
43. Li, K., Zhang, Z., Zhong, C., and Wang, G. (2022, January 18–24). Robust Structured Declarative Classifiers for 3D Point Clouds: Defending Adversarial Attacks With Implicit Gradients. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), New Orleans, LA, USA.10.1109/CVPR52688.2022.01486 ↗
44. Improving transferability of 3D adversarial attacks with scale and shear transformations10.1016/j.ins.2024.120245 ↗
45. Sun, J., Zhang, Q., Kailkhura, B., Yu, Z., Xiao, C., and Mao, Z.M. (2022). Benchmarking Robustness of 3D Point Cloud Recognition Against Common Corruptions. arXiv.
46. Zhou, Y., and Tuzel, O. (2017). VoxelNet: End-to-End Learning for Point Cloud Based 3D Object Detection. arXiv.10.1109/CVPR.2018.00472 ↗
47. Query-efficient black-box adversarial attack with customized iteration and sampling10.1109/TPAMI.2022.3169802 ↗
48. Tu, C.C., Ting, P., Chen, P.Y., Liu, S., Zhang, H., Yi, J., Hsieh, C.J., and Cheng, S.M. (February, January 27). Autozoom: Autoencoder-based zeroth order optimization method for attacking black-box neural networks. Proceedings of the AAAI Conference on Artificial Intelligence, Honolulu, HI, USA.
49. Brendel, W., Rauber, J., and Bethge, M. (2017). Decision-based adversarial attacks: Reliable attacks against black-box machine learning models. arXiv.
50. Dong, Y., Su, H., Wu, B., Li, Z., Liu, W., Zhang, T., and Zhu, J. (2019, January 15–20). Efficient decision-based black-box adversarial attacks on face recognition. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, Long Beach, CA, USA.10.1109/CVPR.2019.00790 ↗
51. Sundararajan, M., Taly, A., and Yan, Q. (2017, January 6–11). Axiomatic attribution for deep networks. Proceedings of the International Conference on Machine Learning, Sydney, Australia.
52. Metrics for evaluating 3D medical image segmentation: Analysis, selection, and tool10.1186/s12880-015-0068-x ↗
53. Diederik, P.K., and Jimmy, B. (2014). Adam: A method for stochastic optimization. arXiv.
54. Wu, Z., Song, S., Khosla, A., Yu, F., Zhang, L., Tang, X., and Xiao, J. (2015, January 7–12). 3d shapenets: A deep representation for volumetric shapes. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, Boston, MA, USA.
55. Sun, Y., Chen, F., Chen, Z., and Wang, M. (2021, January 17–19). Local aggressive adversarial attacks on 3d point cloud. Proceedings of the Asian Conference on Machine Learning, Virtual.
56. Dynamic graph cnn for learning on point clouds
57. Li, Y., Bu, R., Sun, M., Wu, W., Di, X., and Chen, B. (2018). Pointcnn: Convolution on x-transformed points. Advances in Neural Information Processing Systems, Neural Information Processing Systems Foundation, Inc. (NeurIPS).
58. Zhou, H., Chen, K., Zhang, W., Fang, H., Zhou, W., and Yu, N. (2019, January 27–28). Dup-net: Denoiser and upsampler network for 3d adversarial point clouds defense. Proceedings of the IEEE/CVF International Conference on Computer Vision, Seoul, Republic of Korea.10.1109/ICCV.2019.00205 ↗