Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

PCLD: Point Cloud Layerwise Diffusion for Adversarial Purification

Mert Gulsen, Batuhan Cengiz, Yusuf H. Sahin, Gozde Unal

TL;DR

This work tackles the vulnerability of 3D point cloud classifiers to adversarial attacks by introducing Point Cloud Layerwise Diffusion (PCLD), a diffusion-based purification strategy that operates on layerwise latent features rather than only on inputs. By training diffusion probabilistic models for each layer's latent representation and applying truncated forward/backward diffusion during inference, PCLD hierarchically purifies adversarial perturbations without retraining the base classifier. The method demonstrates strong robustness across multiple architectures (DGCNN, PCT, PointNet, PointNet++, CurveNet) and attacks on ModelNet40, often outperforming or matching state-of-the-art defenses such as PointDP, SRS, SOR, DUPNet, and IF-Defense, with notable gains in deeper layers. The results highlight the practical potential of layerwise diffusion as a plug-and-play defense for safety-critical 3D perception tasks, while acknowledging computational overhead and the need for further adaptation to evolving attack strategies.

Abstract

Point clouds are extensively employed in a variety of real-world applications such as robotics, autonomous driving and augmented reality. Despite the recent success of point cloud neural networks, especially for safety-critical tasks, it is essential to also ensure the robustness of the model. A typical way to assess a model's robustness is through adversarial attacks, where test-time examples are generated based on gradients to deceive the model. While many different defense mechanisms are studied in 2D, studies on 3D point clouds have been relatively limited in the academic field. Inspired from PointDP, which denoises the network inputs by diffusion, we propose Point Cloud Layerwise Diffusion (PCLD), a layerwise diffusion based 3D point cloud defense strategy. Unlike PointDP, we propagated the diffusion denoising after each layer to incrementally enhance the results. We apply our defense method to different types of commonly used point cloud models and adversarial attacks to evaluate its robustness. Our experiments demonstrate that the proposed defense method achieved results that are comparable to or surpass those of existing methodologies, establishing robustness through a novel technique. Code is available at https://github.com/batuceng/diffusion-layer-robustness-pc.

PCLD: Point Cloud Layerwise Diffusion for Adversarial Purification

TL;DR

This work tackles the vulnerability of 3D point cloud classifiers to adversarial attacks by introducing Point Cloud Layerwise Diffusion (PCLD), a diffusion-based purification strategy that operates on layerwise latent features rather than only on inputs. By training diffusion probabilistic models for each layer's latent representation and applying truncated forward/backward diffusion during inference, PCLD hierarchically purifies adversarial perturbations without retraining the base classifier. The method demonstrates strong robustness across multiple architectures (DGCNN, PCT, PointNet, PointNet++, CurveNet) and attacks on ModelNet40, often outperforming or matching state-of-the-art defenses such as PointDP, SRS, SOR, DUPNet, and IF-Defense, with notable gains in deeper layers. The results highlight the practical potential of layerwise diffusion as a plug-and-play defense for safety-critical 3D perception tasks, while acknowledging computational overhead and the need for further adaptation to evolving attack strategies.

Abstract

Point clouds are extensively employed in a variety of real-world applications such as robotics, autonomous driving and augmented reality. Despite the recent success of point cloud neural networks, especially for safety-critical tasks, it is essential to also ensure the robustness of the model. A typical way to assess a model's robustness is through adversarial attacks, where test-time examples are generated based on gradients to deceive the model. While many different defense mechanisms are studied in 2D, studies on 3D point clouds have been relatively limited in the academic field. Inspired from PointDP, which denoises the network inputs by diffusion, we propose Point Cloud Layerwise Diffusion (PCLD), a layerwise diffusion based 3D point cloud defense strategy. Unlike PointDP, we propagated the diffusion denoising after each layer to incrementally enhance the results. We apply our defense method to different types of commonly used point cloud models and adversarial attacks to evaluate its robustness. Our experiments demonstrate that the proposed defense method achieved results that are comparable to or surpass those of existing methodologies, establishing robustness through a novel technique. Code is available at https://github.com/batuceng/diffusion-layer-robustness-pc.
Paper Structure (7 sections, 10 equations, 2 figures, 2 tables)

This paper contains 7 sections, 10 equations, 2 figures, 2 tables.

Table of Contents

  1. Introduction
  2. Related Work
  3. Method
  4. Preliminaries
  5. Point Cloud Layerwise Diffusion (PCLD)
  6. Experiments
  7. Discussion & Conclusion

Figures (2)

  • Figure 1: Overview of PCLD. In PCLD, the main focus is denoising the adversarial layer features back into the clean layer features with a diffusion-based purification.
  • Figure 2: Overview of the Point Cloud Layerwise Diffusion method. The application of PCLD blocks in intermediate layers is illustrated in part (a), while the truncated diffusion process and details of the PCLD block are given in part (b).