Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Certified L2-Norm Robustness of 3D Point Cloud Recognition in the Frequency Domain

Liang Zhou, Qiming Wang, Tianze Chen

TL;DR

The paper addresses the lack of certifiable robustness for 3D point cloud classification under structured, $\ell_2$-bounded perturbations. It introduces FreqCert, a framework that projects point clouds into the frequency domain via a graph Fourier transform, constructs multiple frequency-aware slices with dense-overlapping spectral windows, and aggregates predictions through majority voting. Two closed-form robustness radii, $R_{\text{slice}}$ and $R^\star$, are derived and proven tight, linking spectral margins and the Laplacian eigengap to classifier stability under perturbations. Experiments on ModelNet40 and ScanObjectNN demonstrate superior certified and empirical robustness over baselines and empirical defenses, highlighting the practical value of spectral representations for provable robustness in 3D recognition.

Abstract

3D point cloud classification is a fundamental task in safety-critical applications such as autonomous driving, robotics, and augmented reality. However, recent studies reveal that point cloud classifiers are vulnerable to structured adversarial perturbations and geometric corruptions, posing risks to their deployment in safety-critical scenarios. Existing certified defenses limit point-wise perturbations but overlook subtle geometric distortions that preserve individual points yet alter the overall structure, potentially leading to misclassification. In this work, we propose FreqCert, a novel certification framework that departs from conventional spatial domain defenses by shifting robustness analysis to the frequency domain, enabling structured certification against global L2-bounded perturbations. FreqCert first transforms the input point cloud via the graph Fourier transform (GFT), then applies structured frequency-aware subsampling to generate multiple sub-point clouds. Each sub-cloud is independently classified by a standard model, and the final prediction is obtained through majority voting, where sub-clouds are constructed based on spectral similarity rather than spatial proximity, making the partitioning more stable under L2 perturbations and better aligned with the object's intrinsic structure. We derive a closed-form lower bound on the certified L2 robustness radius and prove its tightness under minimal and interpretable assumptions, establishing a theoretical foundation for frequency domain certification. Extensive experiments on the ModelNet40 and ScanObjectNN datasets demonstrate that FreqCert consistently achieves higher certified accuracy and empirical accuracy under strong perturbations. Our results suggest that spectral representations provide an effective pathway toward certifiable robustness in 3D point cloud recognition.

Certified L2-Norm Robustness of 3D Point Cloud Recognition in the Frequency Domain

TL;DR

The paper addresses the lack of certifiable robustness for 3D point cloud classification under structured, -bounded perturbations. It introduces FreqCert, a framework that projects point clouds into the frequency domain via a graph Fourier transform, constructs multiple frequency-aware slices with dense-overlapping spectral windows, and aggregates predictions through majority voting. Two closed-form robustness radii, and , are derived and proven tight, linking spectral margins and the Laplacian eigengap to classifier stability under perturbations. Experiments on ModelNet40 and ScanObjectNN demonstrate superior certified and empirical robustness over baselines and empirical defenses, highlighting the practical value of spectral representations for provable robustness in 3D recognition.

Abstract

3D point cloud classification is a fundamental task in safety-critical applications such as autonomous driving, robotics, and augmented reality. However, recent studies reveal that point cloud classifiers are vulnerable to structured adversarial perturbations and geometric corruptions, posing risks to their deployment in safety-critical scenarios. Existing certified defenses limit point-wise perturbations but overlook subtle geometric distortions that preserve individual points yet alter the overall structure, potentially leading to misclassification. In this work, we propose FreqCert, a novel certification framework that departs from conventional spatial domain defenses by shifting robustness analysis to the frequency domain, enabling structured certification against global L2-bounded perturbations. FreqCert first transforms the input point cloud via the graph Fourier transform (GFT), then applies structured frequency-aware subsampling to generate multiple sub-point clouds. Each sub-cloud is independently classified by a standard model, and the final prediction is obtained through majority voting, where sub-clouds are constructed based on spectral similarity rather than spatial proximity, making the partitioning more stable under L2 perturbations and better aligned with the object's intrinsic structure. We derive a closed-form lower bound on the certified L2 robustness radius and prove its tightness under minimal and interpretable assumptions, establishing a theoretical foundation for frequency domain certification. Extensive experiments on the ModelNet40 and ScanObjectNN datasets demonstrate that FreqCert consistently achieves higher certified accuracy and empirical accuracy under strong perturbations. Our results suggest that spectral representations provide an effective pathway toward certifiable robustness in 3D point cloud recognition.

Paper Structure

This paper contains 34 sections, 2 theorems, 31 equations, 5 figures, 1 table, 1 algorithm.

Table of Contents

  1. Introduction
  2. Related Work
  3. Deep Learning on 3D Point Clouds.
  4. Adversarial Attacks & Defense on 3D Point Clouds.
  5. Method
  6. Graph Fourier transform
  7. Spectral Subsampling
  8. Certified Robustness
  9. Experiments
  10. Experimental Setup
  11. Datasets and moudles
  12. Compared methods
  13. Evaluation Metrics
  14. Parameter setting
  15. Experimental Results
  16. ...and 19 more sections

Key Result

Theorem 1

Let $P$ be an input point cloud, and suppose the Frobenius norm of the perturbation satisfies where $g_{\min}$ is the minimum spectral margin across all points, $\Delta\lambda$ is the Laplacian eigengap at index $K$, and $K$ is the number of retained frequencies. Then no slice changes its prediction, and the overall classification remains unaffected. Moreover, the bound is tight: any perturb

Figures (5)

  • Figure 1: Illustration of our framework. The input point cloud is processed into spectral slices via graph Fourier transform (GFT), each of which is independently classified. The final prediction is obtained by majority voting.
  • Figure 2: An intuitive visualization of our spectral transformation pipeline. A raw point cloud (left) is first transformed into a $k$-nearest neighbor graph (middle), followed by a graph Fourier transform (right) to derive frequency domain representations.
  • Figure 3: Certified accuracy (a) and empirical accuracy (b) on the ModelNet40 dataset under increasing $\ell_2$ perturbation strength $\epsilon$. FreqCert consistently achieves higher robustness than randomized smoothing across all tested perturbation levels. Results on the ScanObjectNN dataset are provided in the appendix.
  • Figure 4: Impact of key factors on certified accuracy. (a) Impact of $m$ on FreqCert. (b) Impact of $n$ on FreqCert. (c) Comparing certified accuracy of FreqCert across different backbone architectures
  • Figure 5: Robustness comparison on the Robustness comparison on the ScanObjectNN-OBJ_Only dataset. (a) Certified accuracy under different $\ell_2$ perturbation strengths. (b) Empirical accuracy against PGD attacks with increasing $\ell_2$ strength.

Theorems & Definitions (3)

  • Theorem 1: Certified Perturbation Size for Slice Stability
  • Theorem 2: Certified Perturbation Size for $\ell_2$ Robustness
  • proof