Geometric Adversarial Attacks and Defenses on 3D Point Clouds

Lang, Itai; Kotlicki, Uriel; Avidan, Shai

doi:10.1109/3dv53792.2021.00127

Cited by 10 publications

(10 citation statements)

References 38 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The outlier loss and the uniform loss encourage the generator to preserve the point cloud shape. Besides these GAN-based attacks, Lang et al [93] proposed an attack that alters the reconstructed geometry of a 3D point cloud using an autoencoder trained on semantic shape classes, while Mariani et al [94] proposed a method for creating adversarial attacks on surfaces embedded in 3D space, under weak smoothness assumptions on the perceptibility of the attack.…”

Section: ) Generative Strategiesmentioning

confidence: 99%

Adversarial Attacks and Defenses on 3D Point Cloud Classification: A Survey

Naderi,

Bajić

2023

IEEE Access

View full text Add to dashboard Cite

Deep learning has successfully solved a wide range of tasks in 2D vision as a dominant AI technique. Recently, deep learning on 3D point clouds has become increasingly popular for addressing various tasks in this field. Despite remarkable achievements, deep learning algorithms are vulnerable to adversarial attacks. These attacks are imperceptible to the human eye, but can easily fool deep neural networks in the testing and deployment stage. To encourage future research, this survey summarizes the current progress on adversarial attack and defense techniques on point-cloud classification. This paper first introduces the principles and characteristics of adversarial attacks and summarizes and analyzes adversarial example generation methods in recent years. Additionally, it provides an overview of defense strategies, organized into data-focused and model-focused methods. Finally, it presents several current challenges and potential future research directions in this domain. INDEX TERMS 3D deep learning, deep neural network, adversarial examples, adversarial defense, machine learning security, 3D point clouds.

show abstract

Section: ) Generative Strategiesmentioning

confidence: 99%

Adversarial Attacks and Defenses on 3D Point Cloud Classification: A Survey

Naderi,

Bajić

2023

IEEE Access

View full text Add to dashboard Cite

show abstract

“…Zheng et al [38] observe that saliency of the point cloud networks is localized and network rely on a small subset of the signal for the task. This observation has led to extensive work in privacy and security [54,55,56,57] utilizing the localized saliency used to design adversarial attack (and defence) mechanisms on the trained models. We note that our setting significantly differs from adversarial attack work since we protect the dataset that can be used to train arbitrary models while adversarial methods focus on attacking/protecting the robustness of model predictions.…”

Section: Related Workmentioning

confidence: 99%

Learning to Censor by Noisy Sampling

Chopra¹,

Java²,

Singh³

et al. 2022

Preprint

View full text Add to dashboard Cite

Point clouds are an increasingly ubiquitous input modality and the raw signal can be efficiently processed with recent progress in deep learning. This signal may, often inadvertently, capture sensitive information that can leak semantic and geometric properties of the scene which the data owner does not want to share. The goal of this work is to protect sensitive information when learning from point clouds; by censoring the sensitive information before the point cloud is released for downstream tasks. Specifically, we focus on preserving utility for perception tasks while mitigating attribute leakage attacks. The key motivating insight is to leverage the localized saliency of perception tasks on point clouds to provide good privacy-utility trade-offs. We realise this through a mechanism called Censoring by Noisy Sampling (CBNS ), which is composed of two modules: i) Invariant Sampler: a differentiable point-cloud sampler which learns to remove points invariant to utility and ii) Noisy Distorter: which learns to distort sampled points to decouple the sensitive information from utility, and mitigate privacy leakage. We validate the effectiveness of CBNS through extensive comparisons with state-ofthe-art baselines and sensitivity analyses of key design choices. Results show that CBNS achieves superior privacy-utility trade-offs on multiple datasets.

show abstract

“…However, this form of robustness quantification only holds for the concrete samples and does not consider adversarial transformations. The latter problem was addressed by a recent line of work that extended the well-studied problem of adversarial attacks for images to the 3D point cloud domain by considering adversarial point perturbation and generation [20,23,28,29,53,60,62], real-world adversarial objects for LIDAR sensors [6], occlusion attacks [55], and adversarial rotations [66]. The adversarial vulnerability of 3D point cloud models has spurred the development of corresponding defense methods, based on perturbation measurement [62], outlier removal and upsampling [67], and adversarial training [28,65].…”

Section: Background and Related Workmentioning

confidence: 99%

Robustness Certification for Point Cloud Models

Lorenz

Ruoss

Balunović

et al. 2021

2021 IEEE/CVF International Conference on Computer Vision (ICCV)

View full text Add to dashboard Cite

The use of deep 3D point cloud models in safety-critical applications, such as autonomous driving, dictates the need to certify the robustness of these models to real-world transformations. This is technically challenging, as it requires a scalable verifier tailored to point cloud models that handles a wide range of semantic 3D transformations. In this work, we address this challenge and introduce 3DCertify, the first verifier able to certify the robustness of point cloud models. 3DCertify is based on two key insights: (i) a generic relaxation based on first-order Taylor approximations, applicable to any differentiable transformation, and (ii) a precise relaxation for global feature pooling, which is more complex than pointwise activations (e.g., ReLU or sigmoid) but commonly employed in point cloud models. We demonstrate the effectiveness of 3DCertify by performing an extensive evaluation on a wide range of 3D transformations (e.g., rotation, twisting) for both classification and part segmentation tasks. For example, we can certify robustness against rotations by ±60°for 95.7% of point clouds, and our max pool relaxation increases certification by up to 15.6%.* This work was done while the author was at ETH Zurich.ness against these attacks. However, as demonstrated in the image recognition domain, such defenses are usually broken by more powerful attacks [1,49], resulting in an arms race between stronger defenses and even stronger attacks.To break this cycle, one ideally needs a proof that a deep learning model is robust against any adversarial attack, under some threat model. This proof is usually obtained by invoking a neural network verifier on a deep learning model and a model input, where the verifier attempts to provide a certificate that the model is robust to any transformation of this input. While plenty of verifiers have been proposed in the image recognition domain [5,19,42,44,48,56,64], no such verifier exists for 3D point cloud models.

show abstract

Geometric Adversarial Attacks and Defenses on 3D Point Clouds

Cited by 10 publications

References 38 publications

Adversarial Attacks and Defenses on 3D Point Cloud Classification: A Survey

Adversarial Attacks and Defenses on 3D Point Cloud Classification: A Survey

Learning to Censor by Noisy Sampling

Robustness Certification for Point Cloud Models

Contact Info

Product

Resources

About