Research map / Point clouds / Point cloud classification
Invisible Backdoor Attack against 3D Point Cloud Classifier in Graph Spectral Domain
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes IBAPC, an invisible 3D point cloud backdoor attack that implants a learned trigger added to the graph spectral (GFT) coefficients of the point cloud, trained alternately with the victim classifier.
Problem
Existing 3D point cloud backdoor attacks achieve high attack success but their spatial deformations (added point balls, large rotations) are visible to human inspection and detectable in the graph spectral domain.
Approach
Implant the backdoor trigger as a learned perturbation on the graph Fourier coefficients of the point cloud across all frequencies, so global shape and local points share the deformation; the trigger function and victim DNN are optimized alternately with a distance penalty for stealthiness.
Key results
- IBAPC achieves 66.79% most-similar selections in human inspection over 816 trials from 102 participants, versus 14.33% for PointPBA-I, 3.92% for IRBA and 14.95% for NRBdoor.
- On MN40 with PointNet++, IBAPC's L2 distance is 0.362 versus 2.533 for PointPBA-O (about 14.29% of it), with ASR 92.08%.
- IBAPC achieves competitive ASR (e.g., 94.50% on MN40 with DGCNN) while being about 2% below the best attack in most cases.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| implant the trigger in graph spectral space instead of directly perturbing point positions (ablation) | IBAPC on ModelNet40 with DGCNN · ModelNet40 | ASR: 49.62% -> 94.50% | Helped |
| apply random rotation, jitter, random scaling, and shift augmentation (ablation) | IBAPC on ModelNet40 with DGCNN · ModelNet40 | ASR: 94.50 -> 87.36 | Hurt |
| increase poison rate (ablation) | IBAPC on ModelNet40 and ModelNet10 · ModelNet40; ModelNet10 | ASR | Helped |
| vary the target class (ablation) | IBAPC on ModelNet40 and ModelNet10 · ModelNet40; ModelNet10 | ASR | No clear effect |
| use IBAPC rather than the strongest baseline attack | 3D point-cloud classifiers across the evaluated datasets · ModelNet40; ModelNet10; ShapeNetPart | ASR | Mixed |
| use graph-spectral triggers rather than the spatial-domain baseline triggers | 3D point-cloud classifiers across the evaluated settings · ModelNet40; ModelNet10; ShapeNetPart | L2 distance | Helped |
| use IBAPC triggers in the human inspection study | DGCNN trained on ModelNet40 · Human inspection evaluation | selected as most similar to benign point cloud: 66.79% | Helped |
| apply saliency-based defense to IBAPC | IBAPC with DGCNN on ModelNet40 · ModelNet40 | ASR: 95.63% -> 87.45% | Hurt |
| apply saliency-based defense to IBAPC rather than PointPBA-I or PointBA X | IBAPC · ModelNet40 | ASR after defense: 87.45%; 4.90%; 10.36% | Helped |
| apply all data augmentations at once to IBAPC rather than PointPBA-O | IBAPC and PointPBA-O with DGCNN on ModelNet40 · ModelNet40 | ASR: 87.36; 2.17 | Helped |
| apply SOR with varying k-nearest-neighbor settings | IBAPC rather than PointPBA-I · ModelNet40 and ModelNet10 | ASR after defense | Helped |
| apply SSD and retrain on the cleaned training set | IBAPC with DGCNN on ModelNet40 · ModelNet40 | ASR after defense: 88.81% | Hurt |
Surprising findings
- Trigger applied directly in spatial point positions instead of the graph spectral domain yields only 49.62% ASR versus 94.50% for IBAPC.
Limitations
- Attack uses a dirty-label (altered label) setting that could alarm defenders; clean-label variant left to future work.
- ASR is slightly lower (about 2%) than the best existing attacks in most cases.
- SSD defense still yields 88.81% ASR for the retrained model, indicating the trigger is not fully removed by spectral signature defense.
Experimental setup
Datasets: ModelNet40 ModelNet10 ShapeNetPart
Benchmarks: ModelNet40 ModelNet10 ShapeNetPart
Metrics: attack success rate benign accuracy L2 distance graph spectral residual human inspection similarity rate
Baselines: PointPBA-I PointPBA-O PointBA-X IRBA NRBdoor
Builds on: PointPBA IRBA NRBdoor PointBA-X Doan et al. backdoor training
Closest papers by meaning
- A Dual Stealthy Backdoor: From Both Spatial and Frequency Perspectives (AAAI 2024 · similarity 0.84)
- WaveAttack: Asymmetric Frequency Obfuscation-based Backdoor Attacks Against Deep Neural Networks (NeurIPS 2024 · similarity 0.84)
- Toward Availability Attacks in 3D Point Clouds (ICML 2024 · similarity 0.83)
- Explicitly Perceiving and Preserving the Local Geometric Structures for 3D Point Cloud Attack (AAAI 2024 · similarity 0.83)
- Invisible Backdoor Attack against Self-supervised Learning (CVPR 2025 · similarity 0.83)
- Curvature-Invariant Adversarial Attacks for 3D Point Clouds (AAAI 2024 · similarity 0.82)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.