Research map / Point clouds / Point cloud classification
ConcreTizer: Model Inversion Attack via Occupancy Classification and Dispersion Control for 3D Point Cloud Restoration
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes ConcreTizer, a model inversion attack that restores 3D LiDAR point cloud scenes from voxel-based feature extractor outputs by classifying voxel occupancy and supervising block-wise to control VoI dispersion.
Problem
Model inversion attacks on voxel-based 3D point cloud feature extractors in autonomous vehicles, where zero-padded empty voxels are ambiguous and non-empty voxels disperse through convolution layers, causing conventional point regression to fail.
Approach
Reframe point restoration as per-voxel occupancy classification (with sigmoid focal loss) instead of coordinate regression, and split the inversion network at downsampling layers into blocks trained with block-wise supervision (Dispersion-Controlled Supervision) so that VoI spread is contained and masked at each stage.
Key results
- At the deepest layer, ConcreTizer outperforms the UltraLiDAR generative approach by 23.4% (CD) and 12.4% (F1) on KITTI, and by 21.1% (CD) and 4.5% (F1) on Waymo.
- Restored scenes yield 75.5% to 87.0% of original 3D detection AP on KITTI and 62.6% to 75.7% on Waymo, while Point Regression yields 0 and UltraLiDAR is lower on Waymo.
- Using 2, 3, or 4 DCS blocks performs best, while 10 DCS blocks performs significantly worse than a single end-to-end model.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use voxel occupancy classification instead of point regression (ablation) | ConcreTizer inversion attack · KITTI and Waymo | restoration performance | Helped |
| Use Sigmoid Focal loss instead of BCE loss for occupancy classification (ablation) | ConcreTizer VOC · KITTI, deeper feature layers | restoration performance | Helped |
| Add dispersion-controlled supervision to VOC (ablation) | ConcreTizer · KITTI, deeper feature layers | restoration performance | Helped |
| Use 10 DCS instances instead of no partitioning (ablation) | ConcreTizer · KITTI | restoration performance | Hurt |
| Use downsampling-aligned partitioning with 2, 3, or 4 DCS instances instead of 10 (ablation) | ConcreTizer · KITTI | restoration performance | Helped |
| Use ConcreTizer instead of UltraLiDAR | 3D point cloud restoration · KITTI and Waymo | 3D object detection accuracy: 58.32 -> 66.25; 56.08 -> 59.48; 59.00 -> 64.27; 54.19 -> 65.03; 0.2328 -> 0.4245; 0.1602 -> 0.4369; 0.2179 -> 0.4100; 0. | Helped |
Surprising findings
- Splitting the inversion network into 10 DCS blocks degrades restoration substantially due to error accumulation across blocks.
- Point cloud rotation and scaling augmentations as defenses cause sharp utility loss because labels are not transformed at test time.
Limitations
- Assumes the feature extractor parameters are known to the attacker (white-box setting).
- Experiments restricted to voxel-based extractors; point set and graph representations not studied.
- Training uses cropped regions near the LiDAR origin (about 1/16 of range) due to GPU memory limits.
Experimental setup
Datasets: KITTI Waymo
Benchmarks: KITTI Waymo
Metrics: Chamfer Distance Hausdorff Distance F1 score AP_3D APH
Baselines: Point Regression UltraLiDAR VOC (BCE loss)
Builds on: Point Regression inversion Sigmoid Focal loss OpenPCDet
Closest papers by meaning
- PointCVaR: Risk-Optimized Outlier Removal for Robust 3D Point Cloud Classification (AAAI 2024 · similarity 0.87)
- Hide in Thicket: Generating Imperceptible and Rational Adversarial Perturbations on 3D Point Clouds (CVPR 2024 · similarity 0.86)
- Target-Guided Adversarial Point Cloud Transformer Towards Recognition Against Real-world Corruptions (NeurIPS 2024 · similarity 0.86)
- Unlearnable 3D Point Clouds: Class-wise Transformation Is All You Need (NeurIPS 2024 · similarity 0.86)
- Explicitly Perceiving and Preserving the Local Geometric Structures for 3D Point Cloud Attack (AAAI 2024 · similarity 0.85)
- Improving Robustness of 3D Point Cloud Recognition from a Fourier Perspective (NeurIPS 2024 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.