Research map / Point clouds / Point cloud classification
Hide in Thicket: Generating Imperceptible and Rational Adversarial Perturbations on 3D Point Clouds
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes HiT-ADV, a shape-based adversarial attack on point cloud classifiers that hides Gaussian-kernel deformations in complex, high-curvature regions and suppresses digital strength to improve physical transfer.
Problem
Point-based adversarial attacks on 3D point clouds leave detectable outliers and are easily defended, while existing shape-based attacks cause irrational, perceptible deformations, hurting imperceptibility.
Approach
Search for attack regions via a saliency and imperceptibility (SI) score based on local curvature variation, then deform these regions with Nadaraya-Watson-weighted Gaussian kernels under new imperceptibility regularizers (kernel, hide, Chamfer); for physical attacks, apply benign resampling and benign rigid transformations to suppress digital-only adversarial strength.
Key results
- HiT-ADV achieves 100% ASR on PointNet and DGCNN for both ModelNet40 and ShapeNet Part while obtaining the lowest CSD (0.4709 on PointNet/ModelNet40 vs. 0.9500 for 3D-ADV best prior).
- Under defenses, HiT-ADV reaches 100% ASR against adversarial training on DGCNN and 99.76% on PointNet, versus at most ~64% for prior methods.
- Physical attack via 3D printing and rescanning succeeds with HiT-ADV, as shown qualitatively.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use HiT-ADV instead of 3D-ADV | PointNet · ModelNet40 | CSD: 0.9500 -> 0.4709 | Helped |
| Use HiT-ADV instead of 3D-ADV | PointNet · ShapeNet Part | CSD: 2.1603 -> 0.9810 | Helped |
| Use HiT-ADV instead of 3D-ADV | DGCNN · ModelNet40 | CSD: 1.0206 -> 0.1946 | Helped |
| Use HiT-ADV instead of 3D-ADV | DGCNN · ShapeNet Part | CSD: 2.3788 -> 0.6629 | Helped |
| Use HiT-ADV instead of GeoA3 | PointNet · ModelNet40 | Uniform: 0.2919 -> 0.2883 | Helped |
| Use HiT-ADV instead of 3D-ADV | PointNet · ShapeNet Part | Uniform: 0.2103 -> 0.1874 | Helped |
| Remove Lker (ablation) | HiT-ADV · ModelNet40 | CSD: 0.4709 -> 0.6145 | Hurt |
| Remove Lcha (ablation) | HiT-ADV · ModelNet40 | Uniform: 0.2883 -> 0.3412 | Hurt |
| Remove Lhide (ablation) | HiT-ADV · ModelNet40 | CSD: 0.4709 -> 0.8828 | Hurt |
| Use all three regularization terms (Lker, Lcha and Lhide) (ablation) | HiT-ADV · ModelNet40 | ASR (%): 100.00 | No clear effect |
Surprising findings
- Point-based adversarial training is largely ineffective against shape-based attacks such as HiT-ADV.
Limitations
- Reliance on shape deformation may require larger search space and make robustness against shape-based attacks an open problem.
- KNN distance is slightly worse than methods that only regularize with KNN loss.
Experimental setup
Datasets: ModelNet40 ShapeNet Part
Benchmarks: ModelNet40 ShapeNet Part
Metrics: attack success rate curvature standard deviation distance (CSD) uniform metric KNN distance
Baselines: IFGSM IFGM 3D-ADV KNN attack GeoA3 SI-ADV AOF MeshAttack Eps-iso
Builds on: C&W attack PointNet DGCNN MaxOT GeoA3
Closest papers by meaning
- Curvature-Invariant Adversarial Attacks for 3D Point Clouds (AAAI 2024 · similarity 0.92)
- Manifold Constraints for Imperceptible Adversarial Attacks on Point Clouds (AAAI 2024 · similarity 0.91)
- Explicitly Perceiving and Preserving the Local Geometric Structures for 3D Point Cloud Attack (AAAI 2024 · similarity 0.90)
- Imperceptible 3D Point Cloud Attacks on Lattice-based Barycentric Coordinates (AAAI 2025 · similarity 0.89)
- Seeing is Not Believing: Adversarial Natural Object Optimization for Hard-Label 3D Scene Attacks (CVPR 2025 · similarity 0.89)
- PointCVaR: Risk-Optimized Outlier Removal for Robust 3D Point Cloud Classification (AAAI 2024 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.