Research map / Point clouds / Point cloud classification
Adversarial point cloud attacks
Craft and defend against imperceptible adversarial perturbations on point clouds.
37 accepted papers at ICML, NeurIPS, ICLR, CVPR and AAAI (2019–2026) · an approach in Point cloud classification, keyword cluster “adversarial · convolution · invariant”
State History Benchmarks Tried Checklist Preprints Who Export
Where it stands
Quiet None of the tracked benchmarks has a report from 2025–26.
15 papers in 2023–24 and 8 in 2025–26 (at ICML, NeurIPS, ICLR, CVPR and AAAI); its share of the topic shrank, from 6.5% to 3.1%.
No longer reported by papers here: ModelNet40, DGCNN (ASR, last in 2024); ModelNet40, PointNet (ASR (%), last in 2024).
How this is decided
A benchmark is tracked when at least four papers of this approach report their own method on the same dataset and metric in at least two different years. Its record is the best number reported up to 2024 compared with the best reported in 2025–26: still improving means at least 1% better, flat means at most 0.2% better with at least two papers from 2025–26 trying. Numbers on a different scale from the rest (a fraction among percentages) and far outliers are left out. Results come from different papers with different setups, so they are signals, not head-to-head comparisons. The share of papers is counted at ICML, NeurIPS, ICLR, CVPR and AAAI.
How it got here
Most cited paper of each year
- 2019 · Generating 3D Adversarial Point Clouds (CVPR 2019 · 340 citations)
- 2020 · Robust Adversarial Objects against Deep Learning Models (AAAI 2020 · 131 citations)
- 2021 · PointGuard: Provably Robust 3D Point Cloud Classification (CVPR 2021 · 62 citations)
- 2022 · Shape-Invariant 3D Adversarial Point Clouds (CVPR 2022 · 95 citations)
- 2023 · Generating Transferable 3D Adversarial Point Cloud via Random Perturbation Factorization (AAAI 2023 · 33 citations)
- 2024 · Hide in Thicket: Generating Imperceptible and Rational Adversarial Perturbations on 3D Point Clouds (CVPR 2024 · 26 citations)
- 2025 · Imperceptible 3D Point Cloud Attacks on Lattice-based Barycentric Coordinates (AAAI 2025 · 7 citations)
- 2026 · Multimodal Robust Prompt Distillation for 3D Point Cloud Models (AAAI 2026 · 2 citations)
Earliest papers here
- Generating 3D Adversarial Point Clouds (CVPR 2019 · 340 citations)
- Robust Adversarial Objects against Deep Learning Models (AAAI 2020 · 131 citations)
- LG-GAN: Label Guided Adversarial Network for Flexible Targeted Attack of Point Cloud Based Deep Networks (CVPR 2020 · 105 citations)
Benchmark records
The best number each year that beat every earlier one, among papers of this approach reporting their own method. Numbers are extracted by AI from each paper's text; check the paper before citing.
ModelNet40, DGCNN · ASR (higher is better)
4 papers, 2022–2024 · not reported since 2024
| Year | Best so far | Set by |
|---|---|---|
| 2022 | 99.9 | Shape-Invariant 3D Adversarial Point Clouds (CVPR 2022 · 95 citations) |
| 2024 | 100 | Explicitly Perceiving and Preserving the Local Geometric Structures for 3D Point Cloud Attack (AAAI 2024 · 14 citations) |
ModelNet40, PointNet · ASR (%) (higher is better)
4 papers, 2022–2024 · not reported since 2024
| Year | Best so far | Set by |
|---|---|---|
| 2022 | 99.8 | Shape-Invariant 3D Adversarial Point Clouds (CVPR 2022 · 95 citations) |
| 2024 | 100 | Explicitly Perceiving and Preserving the Local Geometric Structures for 3D Point Cloud Attack (AAAI 2024 · 14 citations) |
What has been tried
30 papers here report 325 measured changes (a component added, removed or swapped, compared with a baseline): helped 70%, no clear effect 5%, hurt 19%, mixed 5%. Papers mostly publish changes that helped, so "helped" is over-represented.
Ablations in recent papers
| What was changed | Measured on | Result | Effect | Paper |
|---|---|---|---|---|
| Remove Lker | ModelNet40 · CSD | 0.4709 -> 0.6145 | Hurt | Hide in Thicket: Generating Imperceptible and Rational Adversarial Perturbations on 3D Point Clouds (CVPR 2024 · 26 citations) |
| Use sphere instead of square plate as the parameter shape | ModelNet40, PointNet · CD | 0.40 -> 0.37 | Helped | Manifold Constraints for Imperceptible Adversarial Attacks on Point Clouds (AAAI 2024 · 18 citations) |
| Replace Diffusion Wavelet with Monic Cubic Wavelet | ModelNet40 · CD | 0.0001 -> 0.0008 | Hurt | Explicitly Perceiving and Preserving the Local Geometric Structures for 3D Point Cloud Attack (AAAI 2024 · 14 citations) |
| Add the geometric score (λ=1.0) | ModelNet40, global random outliers · accuracy (%) | 59.5 -> 82.4 | Helped | PointCVaR: Risk-Optimized Outlier Removal for Robust 3D Point Cloud Classification (AAAI 2024 · 13 citations) |
| implant the trigger in graph spectral space instead of directly perturbing point positions | ModelNet40 · ASR | 49.62% -> 94.50% | Helped | Invisible Backdoor Attack against 3D Point Cloud Classifier in Graph Spectral Domain (AAAI 2024 · 11 citations) |
| Add the joint attention module | ModelNet40, untargeted attacks (Avg.) · accuracy | 70.1 -> 72.0 | Helped | CausalPC: Improving the Robustness of Point Cloud Classification by Causal Effect Identification (CVPR 2024 · 11 citations) |
| Add tangent-plane and normal-direction gradient regularization | ModelNet40, PointNet · DH (10−2) | 3.65 -> 3.29 | Helped | Curvature-Invariant Adversarial Attacks for 3D Point Clouds (AAAI 2024 · 8 citations) |
| Remove lattice subdivision and refinement | ModelNet40 · CD | 0.895 -> 0.920 | Hurt | Imperceptible 3D Point Cloud Attacks on Lattice-based Barycentric Coordinates (AAAI 2025 · 7 citations) |
| Add low-frequency adversarial samples | ModelNet-C · mCE | 1.306 -> 1.237 | Helped | Improving Robustness of 3D Point Cloud Recognition from a Fourier Perspective (NeurIPS 2024 · 2 citations) |
| reduce batch size from 128 to 32 | ModelNet40 · accuracy | 27.67% -> 29.01% | Hurt | Toward Availability Attacks in 3D Point Clouds (ICML 2024 · 0 citations) |
| add adversarial dropping and auxiliary token identification | ModelNet-C · mCE | 76.2 -> 72.2 | Helped | Target-Guided Adversarial Point Cloud Transformer Towards Recognition Against Real-world Corruptions (NeurIPS 2024 · 0 citations) |
| Use voxel occupancy classification instead of point regression | KITTI and Waymo · restoration performance | Helped | ConcreTizer: Model Inversion Attack via Occupancy Classification and Dispersion Control for 3D Point Cloud Restoration (ICLR 2025) |
What reviewers will expect
Datasets and baselines named in the 13 papers of this approach from 2024–2026 that have a full-text summary. Leaving out the common ones is a frequent review question.
Datasets
- ModelNet40 · 11 of 13 papers
- ShapeNet Part · 5 of 13 papers
- ShapeNet · 3 of 13 papers
- ScanObjectNN · 2 of 13 papers
- KITTI · 2 of 13 papers
Baselines
- IFGM · 4 of 13 papers
- SI-Adv · 4 of 13 papers
- 3d-ADV · 3 of 13 papers
- PGD · 3 of 13 papers
- GeoA3 · 3 of 13 papers
- AdvPC · 2 of 13 papers
- LG-GAN · 2 of 13 papers
- ITA · 2 of 13 papers
Recent preprints
Loading recent arXiv preprints…
Who publishes on it
Institutions on the most papers of this approach since 2023 (of 23 papers; from OpenAlex and the papers' affiliations).
- Guangzhou University · 3 papers
- Tsinghua University · 3 papers
- Sun Yat-sen University · 3 papers
- Peking University · 3 papers
- Texas A&M University · 2 papers
- Huazhong University of Science and Technology · 2 papers
- The Chinese University of Hong Kong · 2 papers
- Nanyang Technological University · 2 papers
- National University of Singapore · 2 papers
- Chinese Academy of Sciences · 2 papers
Use it
Download BibTeX of 33 key papersOpen the topic in the interactive map
Get alerts. Describe your idea in scime atlas and save it (free scime account): you get a weekly email when new preprints land close to it.
Related approaches
Same keyword cluster
- Local feature aggregation networks (158 papers)
- Equivariant point cloud networks (84 papers)
- Efficient point sampling architectures (45 papers)
Elsewhere in the topic
- Point-language and open-vocabulary 3D (107 papers)
- Scene flow and dynamic point clouds (89 papers)
- Self-supervised point cloud pretraining (73 papers)
- LiDAR point cloud compression and completion (60 papers)
- Point cloud detection and tracking (56 papers)
- Masked point autoencoders (22 papers)
Benchmark numbers, ablations and baseline numbers are extracted by AI from each paper's full text and can be wrong; the paper is the authority. Data: results index of 2026-11-02, citation counts from OpenAlex (2026-10-09).