LPF-Defense: 3D adversarial defense based on frequency analysis

Abstract

The 3D point clouds are increasingly being used in various application including safety-critical fields. It has recently been demonstrated that deep neural networks can successfully process 3D point clouds. However, these deep networks can be misclassified via 3D adversarial attacks intentionality designed to perturb some point cloud’s features. These misclassifications may be due to the network’s overreliance on features with unnecessary information in training sets. As such, identifying the features used by deep classifiers and removing features with unnecessary information from the training data can improve network’s robustness against adversarial attacks. In this paper, the LPF-Defense framework is proposed to discard this unnecessary information from the training data by suppressing the high-frequency content in the training phase. Our analysis shows that adversarial perturbations are found in the high-frequency contents of adversarial point clouds. Experiments showed that the proposed defense method achieves the state-of-the-art defense performance against six adversarial attacks on PointNet, PointNet++, and DGCNN models. The findings are practically supported by an expansive evaluation of synthetic (ModelNet40 and ShapeNet) and real datasets (ScanObjectNN). In particular, improvements are achieved with an average increase of classification accuracy by 3.8% on Drop100 attack and 4.26% on Drop200 attack compared to the state-of-the-art methods. The method also improves models’ accuracy on the original dataset compared to other available methods. (To facilitate research in this area, an open-source implementation of the method and data is released at https://github.com/kimianoorbakhsh/LPF-Defense.).

Adversarial Attacks and Defenses on 3D Point Cloud Classification: A Survey

“…The approach for target selection will depend on the specific objectives in a given scenario. For example, Wu et al [98] and Naderi et al [99] have utilized the latter approach, while Ma et al [64] have explored both strategies in their work.…”

“…This is the author's version which has not been fully edited and content may change prior to final publication. Citation information: DOI 10.1109/ACCESS.2023.3345000 c: Low Pass Frequency-Defense (LPF-Defense)In LPF-Defense[99], deep models are trained with the lowfrequency version of the original point clouds. More specifically, using the Spherical Harmonic Transform (SHT)[114], original point clouds are transformed from the spatial to the frequency domain.…”

A physically realizable backdoor attack on 3D point cloud deep learning

“…Following this, a nonlinear binary classifier CRT : C → {0, 1} is trained to discern whether the point cloud has been polluted by an Considering that current backdoor defense methods for 3D point clouds are very limited, we additionally introduce two adversarial defense algorithms oriented toward 3D point clouds in Tab.V. [40] observed that the attack pattern typically resides in the high-frequency portion of the spherical harmonic domain and consequently designed a low-pass filter (LPF) to eliminate the attack. [41] proposed a denoise and upsampling(DUP) method to tackle the attack.…”