3D-ANC: Adaptive Neural Collapse for Robust 3D Point Cloud Recognition

TL;DR

This work tackles adversarial vulnerability in 3D point cloud recognition by enforcing a Neural Collapse–driven feature structure. It replaces the standard classifier with a simplex equiangular tight frame (ETF) head and couples it with an adaptive training framework, Representation-Balanced Learning and Dynamic Feature Direction Loss, to cope with class imbalance and geometrically similar object categories. Through extensive experiments across PointNet, DGCNN, and PCT on ModelNet40 and ShapeNet, 3D-ANC achieves state-of-the-art robustness with minimal computational overhead while maintaining clean accuracy. The approach demonstrates that cultivating a well-disentangled feature space inherently strengthens defenses against a wide range of adversarial attacks, including shape-invariant perturbations. Overall, 3D-ANC offers a practical, model-agnostic pathway to robust 3D recognition in real-world deployments.

Abstract

Deep neural networks have recently achieved notable progress in 3D point cloud recognition, yet their vulnerability to adversarial perturbations poses critical security challenges in practical deployments. Conventional defense mechanisms struggle to address the evolving landscape of multifaceted attack patterns. Through systematic analysis of existing defenses, we identify that their unsatisfactory performance primarily originates from an entangled feature space, where adversarial attacks can be performed easily. To this end, we present 3D-ANC, a novel approach that capitalizes on the Neural Collapse (NC) mechanism to orchestrate discriminative feature learning. In particular, NC depicts where last-layer features and classifier weights jointly evolve into a simplex equiangular tight frame (ETF) arrangement, establishing maximally separable class prototypes. However, leveraging this advantage in 3D recognition confronts two substantial challenges: (1) prevalent class imbalance in point cloud datasets, and (2) complex geometric similarities between object categories. To tackle these obstacles, our solution combines an ETF-aligned classification module with an adaptive training framework consisting of representation-balanced learning (RBL) and dynamic feature direction loss (FDL). 3D-ANC seamlessly empowers existing models to develop disentangled feature spaces despite the complexity in 3D data distribution. Comprehensive evaluations state that 3D-ANC significantly improves the robustness of models with various structures on two datasets. For instance, DGCNN's classification accuracy is elevated from 27.2% to 80.9% on ModelNet40 -- a 53.7% absolute gain that surpasses leading baselines by 34.0%.

Figures (10)

• Figure 1: Adversarial robustness highly correlates with feature space quality. However, current models and self-robust defenses have poor feature disentanglement ability. 3D-ANC significantly improves robustness with superior feature separability. Experiments are conducted on ModelNet40, PointNet. Detailed setting is described in Sec. \ref{['sec:feat_qlty']}.
• Figure 2: The t-SNE visualization of PointNet features on ModelNet40 test set under various defense schemes. For input preprocessing defense (DUP-Net and Diffusion), we use the feature of the preprocessed samples for visualization. The entangled feature space leaves room for adversarial attacks, i.e., samples can be perturbed to overlapped classes easily.
• Figure 3: Overview of the proposed 3D-ANC.(Left): Key challenges in point cloud recognition to form a well-separated feature space: (1) class imbalance and (2) geometric similarity between certain classes. (Right): (a) Our 3D-ANC enforces feature disentanglement via ETF classifier $g$. To perform fine-grained refinement towards feature separation for robust point cloud recognition, we further propose an adaptive training framework comprising (b) Representation-Balanced Learning and (c) dynamic Feature Direction Loss, which progressively adapts the training with ETF classifier.
• Figure 4: Case study for highly similar classes.
• Figure 5: The demonstration of adversarial point clouds generated by various adversarial attacks.

Theorems & Definitions (1)

• Definition 1: Simplex Equiangular Tight Frame