Understanding Key Point Cloud Features for Development Three-dimensional Adversarial Attacks

TL;DR

This work investigates how intrinsic geometric features of point clouds influence adversarial susceptibility in 3D DNNs. By defining $14$ graph signal processing–based features and using multiple linear regression, the authors demonstrate that these features can predict adversarial drop points across several architectures, enabling a model-agnostic drop attack that is faster and more transferable than gradient-based baselines. The results show strong predictive power (roughly $R^2 \approx 0.94$) and indicate that attack vulnerability is rooted in data geometry, with practical implications for enhancing robustness against point cloud attacks. The proposed attack offers a favorable balance between effectiveness, transferability, and computational efficiency, informing both attacker strategies and defense design in robotics and autonomous systems.

Abstract

Adversarial attacks pose serious challenges for deep neural network (DNN)-based analysis of various input signals. In the case of three-dimensional point clouds, methods have been developed to identify points that play a key role in network decision, and these become crucial in generating existing adversarial attacks. For example, a saliency map approach is a popular method for identifying adversarial drop points, whose removal would significantly impact the network decision. This paper seeks to enhance the understanding of three-dimensional adversarial attacks by exploring which point cloud features are most important for predicting adversarial points. Specifically, Fourteen key point cloud features such as edge intensity and distance from the centroid are defined, and multiple linear regression is employed to assess their predictive power for adversarial points. Based on critical feature selection insights, a new attack method has been developed to evaluate whether the selected features can generate an attack successfully. Unlike traditional attack methods that rely on model-specific vulnerabilities, this approach focuses on the intrinsic characteristics of the point clouds themselves. It is demonstrated that these features can predict adversarial points across four different DNN architectures, Point Network (PointNet), PointNet++, Dynamic Graph Convolutional Neural Networks (DGCNN), and Point Convolutional Network (PointConv) outperforming random guessing and achieving results comparable to saliency map-based attacks. This study has important engineering applications, such as enhancing the security and robustness of three-dimensional point cloud-based systems in fields like robotics and autonomous driving.

Figures (6)

• Figure 1: An overview of multiple linear regression analysis. Fourteen features are computed for each point in the point cloud. In the figure, feature values are represented with different colors, with black corresponding to high values and light yellow corresponding to low values. At each point, features are linearly combined using the coefficients estimated on the training data, whose significance is determined using statistical testing. In the final experiment, the $N$ points with the highest predicted score are compared against the $N$ points with the highest true adversarial score.
• Figure 2: Visualization of Fourteen features. Points are colorized by the feature value at each point, according to the shown color map.
• Figure 3: Illustration of adversarial points on the airplane object (a); sub-figures (b), (c), and (d) show the 100 points with the highest adversarial score obtained using the corresponding network.
• Figure 4: Predicted vs. true adversarial scores for four point clouds. A perfect prediction would correspond to the straight red line, actual predictions give blue scatter plots.
• Figure 5: Percentage overlap between top-$N$ points with predicted and true adversarial scores generated by (a) PointNet, (b) PointNet++, and (c) DGCNN. Overlap with randomly chosen points is also shown.