Research map / Adversarial robustness and security / Black-box and transfer attacks
NoPain: No-box Point Cloud Attack via Optimal Transport Singular Boundary
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes NoPain, a no-box, classifier-free point cloud attack that finds singular boundaries of a feature-space data manifold via semi-discrete optimal transport and samples adversarial features along them, decoded by a pretrained autoencoder without iterative optimization.
Problem
Point cloud adversarial attacks overfit surrogate model parameters and produce poorly transferable samples, and existing attacks need gradients, queries, or iterative per-sample optimization.
Approach
Solve a semi-discrete optimal transport map from Gaussian noise to latent features of the target data; the non-differentiable positions (dihedral angles between neighboring hyperplanes above a threshold) define singular boundaries, and adversarial latent codes are interpolated along them and decoded, requiring no classifier information or iterative optimization.
Key results
- On ModelNet40 with PointNet++ as surrogate, NoPain-PD reaches 100% ASR on PointNet and 88.7% on DGCNN, versus at most 54.5% for the best baseline (SI-Adv) on PointNet.
- NoPain-PD achieves 71.1% ASR on ShapeNetPart PointNet vs 32.4% for HiT-ADV, and NoPain-PF gets 97.7% ASR on ModelNet40 PointNet.
- Against defenses (SRS, SOR, DUP-Net, IF-Defense), NoPain-PD reaches 98.4% ASR on PointNet under SRS and 87.9% on DGCNN under SRS, with AGT of about 0.026-0.032 s per sample versus several seconds to tens of seconds for baselines.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use NoPain-PD instead of the strongest listed baseline | Point cloud transfer attack · ModelNet40, PointNet | ASR: 54.5 -> 100 | Helped |
| Use NoPain-PD instead of the strongest listed baseline | Point cloud transfer attack · ModelNet40, PointConv | ASR: 69.5 -> 82.8 | Helped |
| Use NoPain-PD instead of the strongest listed baseline | Point cloud transfer attack · ModelNet40, DGCNN | ASR: 67.3 -> 88.7 | Helped |
| Use NoPain-PD instead of SI-ADV | Point cloud transfer attack · ModelNet40, PCT | ASR: 91.3 -> 85.7 | Hurt |
| Use NoPain-PD instead of the strongest listed baseline | Point cloud transfer attack · ShapeNetPart, PointNet | ASR: 32.4 -> 71.1 | Helped |
| Use NoPain-PD instead of SI-ADV | Point cloud transfer attack · ShapeNetPart, PointConv | ASR: 77.2 -> 63.3 | Hurt |
| Use NoPain-PD instead of the strongest listed baseline | Point cloud transfer attack · ShapeNetPart, DGCNN | ASR: 28.7 -> 75.0 | Helped |
| Use NoPain-PD instead of SI-ADV | Point cloud transfer attack · ShapeNetPart, PCT | ASR: 26.9 -> 53.3 | Helped |
| Increase the angle threshold τ (ablation) | NoPain · ModelNet40 | ASR | Helped |
| Increase the angle threshold τ (ablation) | NoPain · ModelNet40 | CD | Hurt |
| Set the number of neighbors K to 10 or 11 (ablation) | NoPain · ModelNet40 | ASR | Helped |
| Set the number of neighbors K to 10 or 11 (ablation) | NoPain · ModelNet40 | CD | Helped |
Surprising findings
- The white-box HiT-ADV transfers worse than black-box baselines, supporting the overfitting argument.
- IF-Defense substantially lowers ASR for all methods, with NoPain-PD still reaching only about 52-70%.
Limitations
- Relies on pretrained autoencoders (PointFlow, PointDiffusion) for the target dataset; performance depends on encoder/decoder quality.
- Hyperparameters (K, tau) tuned per dataset; ASR varies strongly with threshold tau.
- Lower ASR on some models (e.g., PointConv 72-83% on ModelNet40) and under IF-Defense.
Experimental setup
Datasets: ModelNet40 ShapeNetPart
Benchmarks: ModelNet40 ShapeNetPart
Metrics: attack success rate (ASR) Chamfer distance (CD) average time cost (s)
Baselines: AdvPC AOF SI-Adv SS-attack HiT-ADV
Builds on: PointFlow PointDiffusion SS-attack AOF HiT-ADV
Closest papers by meaning
- Less Is More: Sparse and Cooperative Perturbation for Point Cloud Attacks (AAAI 2026 · similarity 0.85)
- A Critical Revisit of Adversarial Robustness in 3D Point Cloud Recognition with Diffusion-Driven Purification (ICML 2023 · similarity 0.84)
- Analyzing and Improving Optimal-Transport-based Adversarial Networks (ICLR 2024 · similarity 0.83)
- PubDef: Defending Against Transfer Attacks From Public Models (ICLR 2024 · similarity 0.83)
- Hide in Thicket: Generating Imperceptible and Rational Adversarial Perturbations on 3D Point Clouds (CVPR 2024 · similarity 0.83)
- Curvature-Invariant Adversarial Attacks for 3D Point Clouds (AAAI 2024 · similarity 0.82)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.