Rethinking Transferable Adversarial Attacks on Point Clouds from a Compact Subspace Perspective

TL;DR

This work addresses the difficulty of generating transferable adversarial attacks for 3D point clouds across diverse architectures. It introduces CoSA, a compact subspace attack that encodes each point cloud as a sparse combination of class prototypes (base subspace) and constrains perturbations within a low-rank, shared subspace (perturbation subspace). The method yields stronger cross-model transferability while maintaining competitive imperceptibility and robustness under defenses, demonstrated across multiple datasets and models. The results provide a principled framework for evaluating and understanding cross-model vulnerabilities in point-cloud perception and offer guidance for designing more robust defenses.

Abstract

Transferable adversarial attacks on point clouds remain challenging, as existing methods often rely on model-specific gradients or heuristics that limit generalization to unseen architectures. In this paper, we rethink adversarial transferability from a compact subspace perspective and propose CoSA, a transferable attack framework that operates within a shared low-dimensional semantic space. Specifically, each point cloud is represented as a compact combination of class-specific prototypes that capture shared semantic structure, while adversarial perturbations are optimized within a low-rank subspace to induce coherent and architecture-agnostic variations. This design suppresses model-dependent noise and constrains perturbations to semantically meaningful directions, thereby improving cross-model transferability without relying on surrogate-specific artifacts. Extensive experiments on multiple datasets and network architectures demonstrate that CoSA consistently outperforms state-of-the-art transferable attacks, while maintaining competitive imperceptibility and robustness under common defense strategies. Codes will be made public upon paper acceptance.

Figures (7)

• Figure 1: CoSA constrains adversarial perturbations from the ambient input space $\mathcal{X}$ to a compact subspace $\mathcal{B}$ that captures shared semantic representations, thereby achieving stronger and more consistent transferability across models.
• Figure 2: Overview of the proposed CoSA framework. The encoder embeds the input point cloud into a prototype-guided base subspace $\mathcal{B}$ capturing class-level semantics, while a low-rank perturbation subspace $\mathcal{S}$ models coherent variations. Joint optimization yields a perturbed latent representation decoded into an adversarial point cloud with improved transferability.
• Figure 3: Visualization of original and adversarial point clouds generated by various attack methods targeting PointNet on ModelNet40. Ground-truth and predicted labels are shown below each example in black and red, respectively.
• Figure 4: Effect of the perceptual weight $\lambda_{\mathrm{per}}$, the rank regularization weight $\lambda_{\mathrm{rank}}$, and the orthogonality weight $\lambda_{\mathrm{ort}}$ on the ASR of CoSA under $\epsilon = 0.18$. The plot reports white-box ASR on PointNet and transfer ASR on DGCNN, PCT, and PointMamba.
• Figure 5: Parameter analysis of prototype number $m_y$ in the base subspace. Performance is measured using ASR on PointNet and its transfer to other models under two $\ell_\infty$ budgets on ModelNet40.