Research map / Point clouds / Point cloud classification
Toward Availability Attacks in 3D Point Clouds
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes FC-EM, a feature-collision error-minimization availability attack for 3D point clouds that avoids the degeneracy caused by Chamfer-distance regularization in bi-level poisoning.
Problem
Availability attacks that make 3D point cloud data unlearnable to unauthorized models; directly extending 2D error-minimization and adversarial-poison methods with Chamfer-distance regularization leads to degenerate, weak poisons.
Approach
Replace the cross-entropy loss used when optimizing the poison with a class-wise feature collision loss (cosine similarity in feature space) so the poison and model update in different directions, which prevents degeneracy under distance regularization and yields shortcuts in feature space.
Key results
- On ModelNet40, FC-EM reduces PointNet test accuracy to 27.67% versus 82.98% for EM and 86.22% for REG-EM (clean 90.70%).
- On IntrA, FC-EM drives PointNet++ and DGCNN F1-score to 0.000 while keeping Chamfer distance around 0.9-2.0e-4.
- Under defenses (PGD, TRADES, Mixup, Rsmix, IF-Defense), FC-EM gives the lowest accuracy in every setting on ModelNet40 (e.g., 27.67% with no defense, 49.59% under PGD).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| use FC-EM instead of AP-T | PointNet on ModelNet40 · ModelNet40 | accuracy: 61.95% -> 27.67% | Helped |
| use FC-EM instead of AP-T | PointNet++ on ModelNet40 · ModelNet40 | accuracy: 56.33% -> 31.12% | Helped |
| use FC-EM instead of AP-T | DGCNN on ModelNet40 · ModelNet40 | accuracy: 57.45% -> 32.46% | Helped |
| use FC-EM instead of AP-T | PointNet on ScanObjectNN · ScanObjectNN | accuracy: 49.74% -> 33.21% | Helped |
| use FC-EM instead of AP-T | PointNet++ on ScanObjectNN · ScanObjectNN | accuracy: 34.77% -> 27.71% | Helped |
| use FC-EM instead of AP-T | DGCNN on ScanObjectNN · ScanObjectNN | accuracy: 26.68% -> 23.41% | Helped |
| use FC-EM instead of REG-EM | PointNet++ on IntrA · IntrA | F1-score: 0.545 -> 0.000 | Helped |
| reduce batch size from 128 to 32 (ablation) | FC-EM on ModelNet40 · ModelNet40 | accuracy: 27.67% -> 29.01% | Hurt |
| increase batch size from 128 to 512 (ablation) | FC-EM on ModelNet40 · ModelNet40 | accuracy: 27.67% -> 36.91% | Hurt |
| lower beta from 1.0 to 0.1 (ablation) | FC-EM on ModelNet40 · ModelNet40 | accuracy: 27.67% -> 19.73% | Helped |
| raise beta from 1.0 to 20.0 (ablation) | FC-EM on ModelNet40 · ModelNet40 | accuracy: 27.67% -> 59.28% | Hurt |
| replace Chamfer restriction with l-infinity restriction (ablation) | FC-EM on ModelNet40 · ModelNet40 | accuracy: 27.67% -> 59.52% | Hurt |
Surprising findings
- Regularized error-minimization (REG-EM) poisons barely change test accuracy as the regularization strength beta varies, which the authors attribute to poison degeneracy.
- Cross-entropy-trained models yield a feature collision loss that fails to converge and even increases, indicating the two losses optimize in different directions.
Limitations
- Poisons still show some sparsity disparity and clustering artifacts, so imperceptibility is not perfect.
- Availability attacks lose much effectiveness when even 1% of the training data is clean (poison ratio study).
- Malicious use of availability attacks to corrupt 3D models is acknowledged as a risk.
Experimental setup
Datasets: ModelNet40 ScanObjectNN IntrA BFM-2017 OmniObject3D
Benchmarks: ModelNet40 ScanObjectNN IntrA BFM-2017 face dataset OmniObject3D
Metrics: clean test accuracy F1-score Chamfer distance Hausdorff distance
Baselines: EM AP AP-T REG-EM REG-AP REG-AP-T
Builds on: unlearnable examples adversarial poisons supervised contrastive loss
Closest papers by meaning
- Explicitly Perceiving and Preserving the Local Geometric Structures for 3D Point Cloud Attack (AAAI 2024 · similarity 0.87)
- Hide in Thicket: Generating Imperceptible and Rational Adversarial Perturbations on 3D Point Clouds (CVPR 2024 · similarity 0.87)
- Curvature-Invariant Adversarial Attacks for 3D Point Clouds (AAAI 2024 · similarity 0.86)
- Imperceptible 3D Point Cloud Attacks on Lattice-based Barycentric Coordinates (AAAI 2025 · similarity 0.85)
- Seeing is Not Believing: Adversarial Natural Object Optimization for Hard-Label 3D Scene Attacks (CVPR 2025 · similarity 0.85)
- Manifold Constraints for Imperceptible Adversarial Attacks on Point Clouds (AAAI 2024 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.