Shape Prior Guided Attack: Sparser Perturbations on 3D Point Clouds

Abstract

Deep neural networks are extremely vulnerable to malicious input data. As 3D data is increasingly used in vision tasks such as robots, autonomous driving and drones, the internal robustness of the classification models for 3D point cloud has received widespread attention. In this paper, we propose a novel method named SPGA (Shape Prior Guided Attack) to generate adversarial point cloud examples. We use shape prior information to make perturbations sparser and thus achieve imperceptible attacks. In particular, we propose a Spatially Logical Block (SLB) to apply adversarial points through sliding in the oriented bounding box. Moreover, we design an algorithm called FOFA for this type of task, which further refines the adversarial attack in the process of breaking down complicated problems into sub-problems. Compared with the methods of global perturbation, our attack method consumes significantly fewer computations, making it more efficient. Most importantly of all, SPGA can generate examples with a higher attack success rate (even in a defensive situation), less perturbation budget and stronger transferability.

Adversarial Attacks and Defenses on 3D Point Cloud Classification: A Survey

“…Shape Prior Guided Attack [85] is a method that adds points by using a shape prior, or prior knowledge of the structure of the object, to guide the generation of the perturbations. This method introduces Spatial Feature Aggregation (SPGA), which divides a point cloud into sub-groups and introduces structure sparsity to generate adversarial point sets.…”

“…Datasets ModelNet10 [119] [67], [107], [130], [82] ModelNet40 [119] [60], [67], [65], [63], [62], [61], [59], [57], [58], [54] [53], [98], [78], [131], [101], [132], [107], [133], [130], [73] [56], [96], [82], [79], [64], [100], [134], [106], [135], [76], [85], [136] ShapeNet [120] [61], [57], [55], [98], [131], [79], [93], [105] ScanObjectNN [121] [63], [132], [113], [107], [130] KITTI [126] [67], [137] ScanNet [19] [113], [106] 3D-MNIST…”

“…PointNet [19] [60], [67], [66], [65], [63], [62], [61], [57], [58], [55] [54], [53], [98], [101], [74], [132], [113], [107], [133], [130] [89], [73], [56], [96], [82], [79], [93], [105], [64], [100] [137], [134], [106], [135], [76], [85], [136] PointNet++ [138] [60], [66], [65], [63], [62], [61], [59], [57], [58], [55] [54], [53], [98], [78], [131], [101], …”

PointCA: Evaluating the Robustness of 3D Point Cloud Completion Models against Adversarial Examples

“…Implementation details. We analyze the adversarial point clouds generated by Geometry PointCA under three mainstream defenses: Simple Random Sampling (SRS), Outlier Removal (OR), and Statistic Outlier Removal (SOR) (Huang et al 2022;Shi et al 2022).…”