CloudFort: Enhancing Robustness of 3D Point Cloud Classification Against Backdoor Attacks via Spatial Partitioning and Ensemble Prediction

TL;DR

This work addresses backdoor vulnerabilities in 3D point cloud classification, notably the PCBA threat, by introducing CloudFort, a lightweight defense that combines spatial partitioning with ensemble prediction to neutralize triggers. The method leverages trigger-backdoor mismatch and trigger elimination principles, implementing eight-region spatial partitioning with four rotated variants and aggregating predictions across sub-clouds to infer the true label. A two-step decision framework analyzes prediction consistency and dichotomy across partitions to detect triggers and recover the correct class, with a rule-based mechanism guiding true-label selection. Experiments on ModelNet40 with PointNet, PointNet++, and DGCNN show CloudFort markedly reduces attack success rates while maintaining clean-data accuracy and achieving high source-inference accuracy, though highly similar source-target class pairs (e.g., P7) remain challenging. Overall, CloudFort advances practical 3D backdoor defenses by balancing robustness, efficiency, and applicability to real-world point-cloud systems, while highlighting areas for improvement in handling similar-class scenarios.

Abstract

The increasing adoption of 3D point cloud data in various applications, such as autonomous vehicles, robotics, and virtual reality, has brought about significant advancements in object recognition and scene understanding. However, this progress is accompanied by new security challenges, particularly in the form of backdoor attacks. These attacks involve inserting malicious information into the training data of machine learning models, potentially compromising the model's behavior. In this paper, we propose CloudFort, a novel defense mechanism designed to enhance the robustness of 3D point cloud classifiers against backdoor attacks. CloudFort leverages spatial partitioning and ensemble prediction techniques to effectively mitigate the impact of backdoor triggers while preserving the model's performance on clean data. We evaluate the effectiveness of CloudFort through extensive experiments, demonstrating its strong resilience against the Point Cloud Backdoor Attack (PCBA). Our results show that CloudFort significantly enhances the security of 3D point cloud classification models without compromising their accuracy on benign samples. Furthermore, we explore the limitations of CloudFort and discuss potential avenues for future research in the field of 3D point cloud security. The proposed defense mechanism represents a significant step towards ensuring the trustworthiness and reliability of point-cloud-based systems in real-world applications.

Figures (9)

• Figure 1: Overview of the proposed CloudFort defense mechanism.
• Figure 2: Schematic representation of the CloudFort defense mechanism detailing the sequential Process of Spatial Partitioning (Sec. \ref{['subsec:spatial partitioning']}) and Ensemble Prediction (Sec. \ref{['subsec:ensemble prediction']}) for robust backdoor attack mitigation in 3D point cloud classification, illustrated with an example attack scenario where the source class is 'person' and the target class is 'car'. The input point cloud, potentially containing a backdoor trigger, undergoes spatial partitioning ($\Sigma_{CloudFort}$), generating multiple sub-point clouds by systematically excluding different regions. These sub-point clouds are then processed by the compromised classifier ($\mathcal{F}_v$), yielding a set of predictions. The trigger presence determination module ($\mathcal{T}$) analyzes the prediction patterns to infer the existence of a backdoor. Finally, the true label determination module ($\mathcal{DF}$) leverages the trigger presence information and the prediction statistics to deduce the correct classification label ($y_{true}$), effectively mitigating the impact of the backdoor attack and correctly classifying the input as 'person' instead of the attacker's target class 'car'.
• Figure 3: Comparative Analysis of CloudFort and PCBA on PointNet
• Figure 4: Comparative Analysis of CloudFort and PCBA on PointNet++
• Figure 5: Comparative Analysis of CloudFort and PCBA on DGCNN