Rethinking Gradient-based Adversarial Attacks on Point Cloud Classification

TL;DR

This work identifies the shortcomings of uniform gradient updates in gradient-based adversarial attacks on 3D point clouds and proposes two complementary strategies: WAAttack, which assigns per-point gradient weights and uses a min-first adaptive step size, and SubAttack, which partitions a point cloud into sub-clouds and concentrates perturbations on structurally critical regions. Together, they achieve high attack success rates with significantly smaller perceptual perturbations across mainstream models on ModelNet40, and maintain effectiveness under defenses. The approach provides a principled, easily integrable framework that improves imperceptibility without sacrificing attack strength, offering a more realistic assessment of model robustness in 3D sensing. Limitations include the computational cost of step-size search and sub-cloud combinatorics, suggesting directions for more efficient optimization and selection strategies.

Abstract

Gradient-based adversarial attacks have become a dominant approach for evaluating the robustness of point cloud classification models. However, existing methods often rely on uniform update rules that fail to consider the heterogeneous nature of point clouds, resulting in excessive and perceptible perturbations. In this paper, we rethink the design of gradient-based attacks by analyzing the limitations of conventional gradient update mechanisms and propose two new strategies to improve both attack effectiveness and imperceptibility. First, we introduce WAAttack, a novel framework that incorporates weighted gradients and an adaptive step-size strategy to account for the non-uniform contribution of points during optimization. This approach enables more targeted and subtle perturbations by dynamically adjusting updates according to the local structure and sensitivity of each point. Second, we propose SubAttack, a complementary strategy that decomposes the point cloud into subsets and focuses perturbation efforts on structurally critical regions. Together, these methods represent a principled rethinking of gradient-based adversarial attacks for 3D point cloud classification. Extensive experiments demonstrate that our approach outperforms state-of-the-art baselines in generating highly imperceptible adversarial examples. Code will be released upon paper acceptance.

Figures (11)

• Figure 1: Left: Existing methods (e.g., SI-Adv) suffer from both local and global over-perturbation due to the neglect of uneven gradient contributions across points and the use of a fixed step size ($\eta = 0.007$). Adjusting either the perturbed points (by replacing randomly selected $n$ points with original ones) or $\eta$ can improve imperceptibility. Right: Our proposed WAAttack (WA) and Subattack (Sub) combined with existing methods significantly improve imperceptibility.
• Figure 2: Demonstration of the framework of WAAttack and SubAttack. Given an input point cloud, we first partition it into sub-point clouds using a hash function. Adversarial examples are then generated via a weighted iterative attack on both the original and sub-point clouds, and the best one is selected based on a comprehensive distance metric.
• Figure 3: Visualization of original and adversarial point clouds generated by different adversarial attack methods for attacking DGCNN
• Figure 4: Visualization of comparison on the ASR(%) of different attack methods under perturbation constraints
• Figure 5: The Impact of Different Denominator Designs in the Weighting Term on Attack Performance. Victim model: PointNet.