PointBA: Towards Backdoor Attacks in 3D Point Cloud

TL;DR

PointBA investigates backdoor attacks in 3D point clouds, introducing a unified trigger framework parameterized by $\mathcal{G}(\mathbf{X})=(\mathbf{I}-\operatorname{Diag}(\boldsymbol{\delta}))\mathbf{X}\mathbf{A}+\operatorname{Diag}(\boldsymbol{\delta})\mathbf{B}$ and two concrete triggers. It then implements two attack paradigms: PointPBA, a poison-label backdoor with high ASR, and PointCBA, a stealthier clean-label backdoor using rotation-based feature disentanglement and Bayesian optimization to craft effective triggers. Across ModelNet10/ModelNet40/ShapeNetPart and models such as PointNet, PointNet++, PointCNN, and DGCNN, PointPBA consistently achieves ASR above $93\%$ with minimal clean accuracy loss, while PointCBA yields around $50\%$ ASR and greater resilience to label inspections. The results reveal a notable vulnerability of common 3D architectures to spatially transformed triggers and provide a practical baseline for evaluating and improving robustness in 3D deep learning systems.

Abstract

3D deep learning has been increasingly more popular for a variety of tasks including many safety-critical applications. However, recently several works raise the security issues of 3D deep models. Although most of them consider adversarial attacks, we identify that backdoor attack is indeed a more serious threat to 3D deep learning systems but remains unexplored. We present the backdoor attacks in 3D point cloud with a unified framework that exploits the unique properties of 3D data and networks. In particular, we design two attack approaches on point cloud: the poison-label backdoor attack (PointPBA) and the clean-label backdoor attack (PointCBA). The first one is straightforward and effective in practice, while the latter is more sophisticated assuming there are certain data inspections. The attack algorithms are mainly motivated and developed by 1) the recent discovery of 3D adversarial samples suggesting the vulnerability of deep models under spatial transformation; 2) the proposed feature disentanglement technique that manipulates the feature of the data through optimization methods and its potential to embed a new task. Extensive experiments show the efficacy of the PointPBA with over 95% success rate across various 3D datasets and models, and the more stealthy PointCBA with around 50% success rate. Our proposed backdoor attack in 3D point cloud is expected to perform as a baseline for improving the robustness of 3D deep models.

Figures (5)

• Figure 1: Activation of backdoored models with the interaction trigger and orientation trigger. Original point cloud data will be classified correctly, however, with a certain trigger like an interaction object (e.g., a small ball) nearby or a small change of orientation (rotation perpendicular to the horizontal plane), the point cloud data will be classified as the target label.
• Figure 2: Attack Pipeline of Proposed 3D Backdoor Attack.
• Figure 3: ASR (%) and ACC (%) against the varying injection rate on PointPBA-I, PointPBA-O, and PointCBA.
• Figure 4: ASR(%) of PointPBA-I & PointCBA against scale randomness factor $\lambda_{\alpha}$ and shift randomness factor $\lambda_{\boldsymbol{\beta}}$ of the interaction trigger.
• Figure 5: PCA-based visualization of disentangled features with different rotation angle searching bounds $\omega_{max}$. The features are derived from 'Table' label data from ModelNet10. The feature disentanglement is to move the features of the rotated data (blue) away from the other same labeled data (red) by rotation. Larger feature separation may better enhance the correlation between the implanted trigger and the label.