No abstract

Deep neural network (DNN) has replaced humans to make decisions in many security-critical senses such as face recognition and automatic drive. Essentially, researchers try to teach DNN to simulate human behavior. However, many evidences show that there is a huge gap between humans and DNN, which has raised lots of security concern. Adversarial sample is a common way to show the gap between DNN and humans in recognizing objects with similar appearance. However, we argue that the difference is not limited to adversarial samples. Hence, this paper explores such differences in a new way by generating fooling samples in 3D point cloud domain. Specifically, the fooling point cloud is hardly recognized by human vision but is classified to the target class by the victim 3D point cloud DNN (3D DNN) with more than 99.99 % confidence. Furthermore, to search for the optimal fooling point cloud, a new evolutionary algorithm named Multielites Harris Hawk Optimization (MEHHO) with enhanced exploitation ability is designed. On one hand, our experiments demonstrate that: (1) 3D DNN tends to learn high-level features of one object; (2) 3D DNN that makes decisions relying on more points is more robust; and (3) the gap is hardly learned by 3D DNN. On the other hand, the comparison experiments show that the designed MEHHO outperforms the SOTA evolutionary algorithms w.r.t. statistics and convergence results.