ConcreTizer: Model Inversion Attack via Occupancy Classification and Dispersion Control for 3D Point Cloud Restoration

TL;DR

This work reveals a privacy vulnerability in voxel-based 3D point cloud features used in autonomous driving by performing model inversion to restore scenes. It introduces ConcreTizer, which uses Voxel Occupancy Classification to determine empty versus non-empty voxels and Dispersion-Controlled Supervision to limit VoI dispersion across feature-extractor layers. Empirical results on KITTI and Waymo show ConcreTizer outperforms traditional Point Regression and a generative model in restoring 3D scenes and preserving details relevant to downstream 3D object detection. The study underscores the need for defense strategies that balance privacy with utility in real-time 3D perception systems.

Abstract

The growing use of 3D point cloud data in autonomous vehicles (AVs) has raised serious privacy concerns, particularly due to the sensitive information that can be extracted from 3D data. While model inversion attacks have been widely studied in the context of 2D data, their application to 3D point clouds remains largely unexplored. To fill this gap, we present the first in-depth study of model inversion attacks aimed at restoring 3D point cloud scenes. Our analysis reveals the unique challenges, the inherent sparsity of 3D point clouds and the ambiguity between empty and non-empty voxels after voxelization, which are further exacerbated by the dispersion of non-empty voxels across feature extractor layers. To address these challenges, we introduce ConcreTizer, a simple yet effective model inversion attack designed specifically for voxel-based 3D point cloud data. ConcreTizer incorporates Voxel Occupancy Classification to distinguish between empty and non-empty voxels and Dispersion-Controlled Supervision to mitigate non-empty voxel dispersion. Extensive experiments on widely used 3D feature extractors and benchmark datasets, such as KITTI and Waymo, demonstrate that ConcreTizer concretely restores the original 3D point cloud scene from disrupted 3D feature data. Our findings highlight both the vulnerability of 3D data to inversion attacks and the urgent need for robust defense strategies.

Figures (23)

• Figure 1: Inversion attack results of a 3D point cloud. Feature data is extracted from original point cloud through a 3D feature extractor second2018sensors. ConcreTizer (right) enables restoration with simple modifications to conventional approach (left), and even achieves more concrete restoration than generative model approach (middle) ultralidar2023cvpr.
• Figure 1: Inversion attack result with KITTI and Waymo dataset. Average CD and HD values in centimeters, and F1 scores with 15 cm and 30 cm thresholds for KITTI and Waymo datasets. Metrics evaluate over each dataset with 3769 and 3999 scenes, respectively.
• Figure 2: Restoration through conventional inversion attack method. Voxelization introduces zero-padding to empty voxels. During downsampling and upsampling, non-empty voxels spread to neighboring areas, expanding the VoI (green region). Within the VoI, voxel-wise channel regression generates additional points in zero-padded regions, leading to clustering near the origin.
• Figure 3: (Left) The results of the conventional inversion attack: As the layer depth increases, the number of restored points increases rapidly, and the concentration of points near the origin becomes more noticeable. (Right) The VoI (Voxels-of-Interest) dispersion effect: The non-empty voxels spread as they pass through the feature extractor and inversion attack model.
• Figure 4: ConcreTizer framework. Original point cloud and features are denoted as $p$ and $f_i$, with restored versions as $p'$ and $f'_i$, respectively, where $i$ indicates the $i$-th downsampling layer. ConcreTizer restores data by classifying $f_0$'s occupancy and placing points at voxel centers. For deeper layers, it partitions at downsampling layers to restore $f_{i-1}$ from $f_i$.