Hide in Thicket: Generating Imperceptible and Rational Adversarial Perturbations on 3D Point Clouds

TL;DR

This work tackles the imperceptibility gap in 3D point-cloud adversarial attacks by introducing HiT-ADV, a shape-based method that hides perturbations in complex surface regions. It combines a Saliency and Imperceptibility score with a two-stage region search and Gaussian-kernel deformation, supplemented by three regularizers to preserve surface smoothness. The authors also address the simulated-to-physical transfer by applying benign resampling and benign rigid transformations, integrated into a MaxOT-based suppression of non-shape perturbation strength. Extensive experiments on ModelNet40 and ShapeNet Part demonstrate superior imperceptibility (e.g., favorable $\text{CSD}$ and $\text{Uniform}$) while maintaining high attack success rates, and they validate the feasibility of physical attacks. Overall, HiT-ADV reveals persistent vulnerabilities in current defenses against shape-based adversarial perturbations and provides a practical pathway for robust evaluation and defense development.

Abstract

Adversarial attack methods based on point manipulation for 3D point cloud classification have revealed the fragility of 3D models, yet the adversarial examples they produce are easily perceived or defended against. The trade-off between the imperceptibility and adversarial strength leads most point attack methods to inevitably introduce easily detectable outlier points upon a successful attack. Another promising strategy, shape-based attack, can effectively eliminate outliers, but existing methods often suffer significant reductions in imperceptibility due to irrational deformations. We find that concealing deformation perturbations in areas insensitive to human eyes can achieve a better trade-off between imperceptibility and adversarial strength, specifically in parts of the object surface that are complex and exhibit drastic curvature changes. Therefore, we propose a novel shape-based adversarial attack method, HiT-ADV, which initially conducts a two-stage search for attack regions based on saliency and imperceptibility scores, and then adds deformation perturbations in each attack region using Gaussian kernel functions. Additionally, HiT-ADV is extendable to physical attack. We propose that by employing benign resampling and benign rigid transformations, we can further enhance physical adversarial strength with little sacrifice to imperceptibility. Extensive experiments have validated the superiority of our method in terms of adversarial and imperceptible properties in both digital and physical spaces. Our code is avaliable at: https://github.com/TRLou/HiT-ADV.

Figures (4)

• Figure 1: Comparison of successful adversarial examples generated by point-based attack method liu2019extending and HiT-ADV. The orange points represent the central points of local shape deformations generated in HiT-ADV and the yellow points represent the outliers in point-based attack. HiT-ADV has no outlier points and exhibits a smooth surface. By concealing perturbations in complex areas, the deformation perturbations become difficult to perceive.
• Figure 2: Demonstration of the framework of HiT-ADV. For clean point cloud samples, HiT-ADV first calculates the SI score for each point, and we color them in this figure according to their ranking. Subsequently, we employ a two-stage attack region search to locate the global central points of imperceptible regions. Finally, we iteratively attack using multiple Gaussian kernel functions and propose a new distance loss for constraint.
• Figure 3: Visualization of original and adversarial point clouds generated by different adversarial attack methods for attacking PointNet.
• Figure 4: The visualization of the physical adversarial attack process using HiT-ADV, which incorporates benign resampling and benign rigid transformations, is shown in a sequence from left to right: the mesh reconstructed from the adversarial point cloud, the physical adversarial sample produced by 3D printing, the point cloud obtained from rescanning and classification results comparison.