Research map / Point clouds / Point cloud classification
Explicitly Perceiving and Preserving the Local Geometric Structures for 3D Point Cloud Attack
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes Multi-grained Geometry-aware Attack (MGA), a 3D point cloud adversarial attack that constrains perturbations via multi-scale, multi-layer local diffusion-wavelet spectral coefficients instead of global distance losses.
Problem
Adversarial attacks on point cloud classifiers rely on global distance losses (Chamfer, Hausdorff) or global surface constraints that cannot accurately preserve detailed local geometry, producing noticeable perturbations.
Approach
Builds a K-NN graph over the point cloud and uses adaptive local diffusion-wavelet filter banks at multiple scales and multiple layers (coarse-to-fine) and constrains the filtered coefficients between benign and adversarial point clouds, replacing global distance losses in the regularizer.
Key results
- On ModelNet40 with PointNet, MGA reaches 100% ASR with CD 0.0001 and HD 0.0046, versus SI-Adv at CD 0.0002 and HD 0.0205.
- On ShapeNetPart, MGA achieves 100% ASR on all three victim models with lowest CD and HD among compared attacks.
- Under defenses on PointNet (ModelNet40), MGA attains 84.7% ASR against IF-Defence versus 61.2% for SI-Adv.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use MGA rather than the strongest reported baseline SI-Adv | PointNet on ModelNet40 · ModelNet40 | CD: 0.0002 -> 0.0001 | Helped |
| Use MGA rather than the strongest reported baseline SI-Adv | DGCNN on ModelNet40 · ModelNet40 | CD: 0.0004 -> 0.0002 | Helped |
| Use MGA rather than the strongest reported baseline SI-Adv | PointConv on ModelNet40 · ModelNet40 | CD: 0.0003 -> 0.0002 | Helped |
| Use MGA rather than SI-Adv | PointNet on ShapeNetPart · ShapeNetPart | CD: 0.0010 -> 0.0003 | Helped |
| Use MGA rather than SI-Adv | DGCNN on ShapeNetPart · ShapeNetPart | CD: 0.0009 -> 0.0004 | Helped |
| Use MGA rather than SI-Adv | PointConv on ShapeNetPart · ShapeNetPart | CD: 0.0008 -> 0.0003 | Helped |
| Replace Diffusion Wavelet with Monic Cubic Wavelet (ablation) | MGA on PointNet, ModelNet40 · ModelNet40 | CD: 0.0001 -> 0.0008 | Hurt |
| Replace Diffusion Wavelet with Tight Hann Wavelet (ablation) | MGA on PointNet, ModelNet40 · ModelNet40 | CD: 0.0001 -> 0.0003 | Hurt |
| Set filter scales to M=2 (ablation) | MGA on PointNet, ModelNet40 · ModelNet40 | CD: 0.0001 -> 0.0048 | Hurt |
| Set filter scales to M=4 (ablation) | MGA on PointNet, ModelNet40 · ModelNet40 | CD: 0.0001 -> 0.0019 | Hurt |
| Set filter scales to M=6 (ablation) | MGA on PointNet, ModelNet40 · ModelNet40 | CD: 0.0001 -> 0.0009 | Hurt |
| Set filter scales to M=8 (ablation) | MGA on PointNet, ModelNet40 · ModelNet40 | CD: 0.0001 -> 0.0002 | Hurt |
Surprising findings
- Ablation shows M=12 scales is slightly better than M=10 but costs much more time, so M=10 was chosen.
Limitations
- Larger scale and layer counts improve imperceptibility but increase time cost.
- Evaluated only on classification with three victim models and targeted attacks.
Experimental setup
Datasets: ModelNet40 ShapeNetPart
Benchmarks: ModelNet40 ShapeNetPart
Metrics: attack success rate Chamfer distance Hausdorff distance
Baselines: PGD AdvPC IFGM LG-GAN GSDA SI-Adv
Builds on: diffusion wavelets C&W attack SI-Adv GSDA
Closest papers by meaning
- Curvature-Invariant Adversarial Attacks for 3D Point Clouds (AAAI 2024 · similarity 0.90)
- Hide in Thicket: Generating Imperceptible and Rational Adversarial Perturbations on 3D Point Clouds (CVPR 2024 · similarity 0.90)
- Manifold Constraints for Imperceptible Adversarial Attacks on Point Clouds (AAAI 2024 · similarity 0.89)
- Imperceptible 3D Point Cloud Attacks on Lattice-based Barycentric Coordinates (AAAI 2025 · similarity 0.89)
- Seeing is Not Believing: Adversarial Natural Object Optimization for Hard-Label 3D Scene Attacks (CVPR 2025 · similarity 0.87)
- Toward Availability Attacks in 3D Point Clouds (ICML 2024 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.