Research map / Point clouds / Point cloud classification
Manifold Constraints for Imperceptible Adversarial Attacks on Point Clouds
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Adds manifold constraints (distance and angle preservation on a bijective invertible-autoencoder parameter shape) to existing point cloud attacks like IFGM and C&W to improve imperceptibility of adversarial point clouds.
Problem
Adversarial attacks on 3D point clouds produce perturbations that are poorly imperceptible because they ignore distortion of the underlying 2-manifold surface, i.e., manifold-aware distortion.
Approach
Use an invertible auto-encoder to build a bijective mapping between a point cloud and a simple parameter shape (square plate or sphere), then enforce local distance and angle preservation constraints on the parameter shape during the attack, transferring them back to the point cloud via the inverse mapping.
Key results
- IFGM-S reaches 100% ASR on PointNet on ModelNet40 with CD 0.37 and HD 1.68, versus IFGM's CD 0.96 and HD 22.62.
- Manifold-aware distortion (Table 2) is lower for IFGM-S than all baselines across PointNet, DGCNN and PointConv on ModelNet40.
- Dropping the distance or angle term alone still reaches 100% ASR but gives larger perturbations than the combined constraints.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Add sphere-based manifold constraints to IFGM | IFGM · ModelNet40, PointNet | CD: 0.96 -> 0.37 | Helped |
| Add sphere-based manifold constraints to IFGM | IFGM · ShapeNet Part, PointNet | CD: 5.87 -> 0.95 | Helped |
| Use sphere instead of square plate as the parameter shape (ablation) | IFGM with manifold constraints · ModelNet40, PointNet | CD: 0.40 -> 0.37 | Helped |
| Remove invertibility (ablation) | IFGM-S · ShapeNet Part, PointNet | CD: 0.95 -> 2.67 | Hurt |
| Replace distance-and-angle constraints with an l2 constraint (ablation) | IFGM-S · ShapeNet Part, PointNet | ASR: 1.00 -> 0.76 | Hurt |
| Remove the angle constraint (ablation) | IFGM-S · ShapeNet Part, PointNet | HD: 12.21 -> 23.56 | Hurt |
| Remove the distance constraint (ablation) | IFGM-S · ShapeNet Part, PointNet | HD: 12.21 -> 22.02 | Hurt |
| Use EMD instead of distance-and-angle constraints (ablation) | IFGM-S · ShapeNet Part, PointNet | HD: 12.21 -> 19.38 | Hurt |
| Add an auto-encoder filter (ablation) | IFGM-S · ShapeNet Part and ModelNet40 | transferability and undefendability | Helped |
| Use a 3D closed parameter shape (sphere or cube) instead of a 2D shape (square or circular plate) (ablation) | Bijective manifold mapping · ShapeNet Part | reconstruction CD | Helped |
Surprising findings
- An l2-norm constraint on the parameter shape caps ASR at only 76% on ShapeNet Part and 81% on ModelNet40 after 100 iterations.
- Earth mover's distance on the parameter shape gives lower CD/HD than any single constraint term but still underperforms the combined distance and angle constraints.
Limitations
- Relies on a learned invertible auto-encoder whose mapping quality varies by object category, with elongated shapes like earphones and mugs showing larger reconstruction error.
- Perturbation size measured by HD increases when the optional AE filter is added for transferability and undefendability.
Experimental setup
Datasets: ModelNet40 ShapeNet Part
Benchmarks: ModelNet40 ShapeNet Part
Metrics: attack success rate Chamfer distance Hausdorff distance l2-norm on parameter shape manifold-aware distortion
Baselines: Drop-600 FGM PGD IFGM C&W AdvPC LG-GAN GeoA3 SI-Adv ITA
Builds on: IFGM C&W attack Chamfer distance constraint AdvPC
Closest papers by meaning
- Imperceptible 3D Point Cloud Attacks on Lattice-based Barycentric Coordinates (AAAI 2025 · similarity 0.92)
- Curvature-Invariant Adversarial Attacks for 3D Point Clouds (AAAI 2024 · similarity 0.91)
- Hide in Thicket: Generating Imperceptible and Rational Adversarial Perturbations on 3D Point Clouds (CVPR 2024 · similarity 0.91)
- Explicitly Perceiving and Preserving the Local Geometric Structures for 3D Point Cloud Attack (AAAI 2024 · similarity 0.89)
- Seeing is Not Believing: Adversarial Natural Object Optimization for Hard-Label 3D Scene Attacks (CVPR 2025 · similarity 0.85)
- Toward Availability Attacks in 3D Point Clouds (ICML 2024 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.