Robust Unsupervised Domain Adaptation for 3D Point Cloud Segmentation Under Source Adversarial Attacks

TL;DR

Addresses robustness of unsupervised domain adaptation for 3D point cloud semantic segmentation when the source domain is adversarially perturbed. Proposes AdvSynLiDAR to simulate stealthy source attacks and the Adversarial Adaptation Framework (AAF) with a Robust Long-Tail Loss and a probability decoder branch to restore structure and improve pseudo-labeling during adaptation. Key contributions include (i) first study of cross-domain robustness under source attacks, (ii) a long-tail–focused pre-training objective and a decoder-based adaptation pathway that mitigate degradation, and (iii) substantial $mIoU$ gains on SemanticKITTI and SemanticPOSS under adversarial conditions. The work demonstrates practical improvements for robust 3D perception in autonomous systems facing contaminated data.

Abstract

Unsupervised domain adaptation (UDA) frameworks have shown good generalization capabilities for 3D point cloud semantic segmentation models on clean data. However, existing works overlook adversarial robustness when the source domain itself is compromised. To comprehensively explore the robustness of the UDA frameworks, we first design a stealthy adversarial point cloud generation attack that can significantly contaminate datasets with only minor perturbations to the point cloud surface. Based on that, we propose a novel dataset, AdvSynLiDAR, comprising synthesized contaminated LiDAR point clouds. With the generated corrupted data, we further develop the Adversarial Adaptation Framework (AAF) as the countermeasure. Specifically, by extending the key point sensitive (KPS) loss towards the Robust Long-Tail loss (RLT loss) and utilizing a decoder branch, our approach enables the model to focus on long-tail classes during the pre-training phase and leverages high-confidence decoded point cloud information to restore point cloud structures during the adaptation phase. We evaluated our AAF method on the AdvSynLiDAR dataset, where the results demonstrate that our AAF method can mitigate performance degradation under source adversarial perturbations for UDA in the 3D point cloud segmentation application.

Figures (5)

• Figure 1: Illustration of the distribution of various classes within the 3D point cloud data before and after adversarial attacks of SemanticKITTI. The long-tail classes exhibit relatively stable distribution, with minimal changes observed across the pre-attack and post-attack states.
• Figure 2: Generating adversarial source domain coordinates, $\gamma^{(i)}$ controls the intensity of perturbations based on the distance to the viewpoint center.
• Figure 3: The figure illustrates the pre-training process of the decoder, where the symmetric Chamfer Distance $\mathcal{L}_\mathbf{CD}$ quantifies the discrepancy between the reconstructed and original point clouds. Additionally, the Kullback-Leibler divergence loss $\mathcal{L}_\mathbf{KL}$ aligns the probability distribution from prior and posterior inference, promoting consistency in the latent space.
• Figure 4: Illustration of cross-domain adaptation with the AAF framework. The probability decoder branch dynamically adjusts input distributions while HNPU enhances pseudo generation throughout the adaptation process.
• Figure 5: Visualization of cross-domain adaptation semantic segmentation results on SynLiDAR $\rightarrow$ SemanticPOSS. From left to right: point clouds with the ground truth labels, adaptation with clean SynLiDAR, adaptation with adversarial SynLiDAR, and Ours (adaptation with adversarial SynLiDAR + AAF)