Research map / Adversarial robustness and security / Black-box and transfer attacks
Towards Transferable Targeted 3D Adversarial Attack in the Physical World
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes TT3D, which reconstructs a 3D textured mesh from multi-view images via grid-based NeRF and adversarially fine-tunes the NeRF feature grids and MLPs (plus vertex coordinates) to produce transferable targeted 3D adversarial examples that can be 3D-printed.
Problem
Transferable targeted adversarial attacks in the 3D domain remain unexplored; existing mesh-based texture attacks overfit, have poor targeted transferability, and produce unnatural distortions, especially for physical attacks.
Approach
Instead of directly perturbing vertex colors in high-dimensional mesh space, perform dual adversarial optimization over the appearance feature grid and appearance MLP parameters of a grid-based NeRF reconstructed from multi-view images, with auxiliary vertex-coordinate changes and naturalness regularization (appearance, Chamfer, Laplacian, edge-length losses).
Key results
- TT3D (MLP+Grid) reaches 78.85% to 88.98% ASR on ResNet-101 surrogate across victim models, versus 4.91% for enhanced mesh-based MeshAdv on RN-50 and 99.90% white-box on RN-101 for mesh method.
- Against DenseNet-121 surrogate, TT3D achieves 36.49% to 96.74% ASR while the enhanced mesh baseline gets 1.10% to 3.91% on black-box victims.
- Physical 3D-printed adversarial objects achieve 76.45% to 91.55% ASR across three backgrounds and viewpoints against ResNet-101 and DenseNet-121.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Optimize both appearance MLP and feature-grid parameters instead of optimizing mesh vertex colors | TT3D with ResNet-101 surrogate · ImageNet classes, random viewpoints; ResNet-50 victim | ASR (%): 4.91 -> 78.85 | Helped |
| Add MLP parameter optimization to feature-grid optimization (ablation) | TT3D with ResNet-101 surrogate · ImageNet classes, random viewpoints; ResNet-50 victim | ASR (%): 64.85 -> 78.85 | Helped |
| Add feature-grid optimization to MLP parameter optimization (ablation) | TT3D with ResNet-101 surrogate · ImageNet classes, random viewpoints; ResNet-50 victim | ASR (%): 40.48 -> 78.85 | Helped |
| Add vertex-coordinate optimization alongside texture optimization (ablation) | TT3D with ResNet-101 surrogate · ImageNet classes, random viewpoints; VGG-16 victim | ASR (%): 52.00 -> 58.29 | Helped |
| Add vertex-coordinate optimization alongside texture optimization (ablation) | TT3D with ResNet-101 surrogate · ImageNet classes, random viewpoints; ResNet-101 victim | ASR (%): 91.60∗ -> 88.98∗ | Hurt |
| Add vertex-coordinate optimization alongside texture optimization (ablation) | TT3D with DenseNet-121 surrogate · ImageNet classes, random viewpoints; VGG-16 victim | ASR (%): 46.60 -> 57.59 | Helped |
| Add vertex-coordinate optimization alongside texture optimization (ablation) | TT3D with DenseNet-121 surrogate · ImageNet classes, random viewpoints; DenseNet-121 victim | ASR (%): 94.28∗ -> 96.74∗ | Helped |
| Increase regularization weight β from 10² to 10⁴ (ablation) | TT3D · ImageNet classes | ASR (%): 100% -> 76% | Hurt |
Surprising findings
- Optimizing geometry alone hardly achieves successful targeted attacks, but adding vertex-coordinate changes to texture optimization improves transferability.
Limitations
- Mesh-based baseline is an enhanced variant of MeshAdv with no color constraints, so comparison depends on that modification
- Cross-task results (zero-shot detection 76.94%, captioning 32.33%) are modest
- Geometry-only and geometric-NeRF optimization are costly or ineffective, with vertex optimization requiring a compromise
Experimental setup
Datasets: IM3D
Benchmarks: IM3D (100 objects, 30 categories)
Metrics: attack success rate (ASR)
Baselines: MeshAdv (enhanced mesh-based optimization) MLP-only optimization Grid-only optimization Tex-only optimization
Builds on: NeRF grid-based representation (Instant-NGP style) MeshAdv Expectation Over Transformation marching cubes
Closest papers by meaning
- Seeing is Not Believing: Adversarial Natural Object Optimization for Hard-Label 3D Scene Attacks (CVPR 2025 · similarity 0.86)
- Explicitly Perceiving and Preserving the Local Geometric Structures for 3D Point Cloud Attack (AAAI 2024 · similarity 0.85)
- Hide in Thicket: Generating Imperceptible and Rational Adversarial Perturbations on 3D Point Clouds (CVPR 2024 · similarity 0.85)
- Towards Robust 3D Pose Transfer with Adversarial Learning (CVPR 2024 · similarity 0.85)
- AIM: Additional Image Guided Generation of Transferable Adversarial Attacks (AAAI 2025 · similarity 0.85)
- PubDef: Defending Against Transfer Attacks From Public Models (ICLR 2024 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.