PWAVEP: Purifying Imperceptible Adversarial Perturbations in 3D Point Clouds via Spectral Graph Wavelets

TL;DR

This paper tackles the vulnerability of 3D point-cloud classifiers to imperceptible adversarial perturbations in Web-based contexts. It introduces PWAVEP, a non-invasive purification framework that operates in the spectral domain via Graph Wavelet Transforms, guided by a hybrid spectral-spatial saliency to hierarchically purge adversarial noise. The method combines theoretical insights showing high-frequency perturbations are the primary adversarial carriers with a practical purification pipeline that attenuates moderately perturbed points and removes severe outliers, all without modifying the target model. Empirical results across ModelNet40 and ShapeNet with multiple attacks and models show PWAVEP significantly boosts robustness (often from near 0% to ~97% accuracy on adversarial samples) while preserving geometry on clean data, and code is publicly available. This work advances practical defenses for 3D web services by delivering a scalable, plug-and-play purification technique grounded in spectral graph wavelets.

Abstract

Recent progress in adversarial attacks on 3D point clouds, particularly in achieving spatial imperceptibility and high attack performance, presents significant challenges for defenders. Current defensive approaches remain cumbersome, often requiring invasive model modifications, expensive training procedures or auxiliary data access. To address these threats, in this paper, we propose a plug-and-play and non-invasive defense mechanism in the spectral domain, grounded in a theoretical and empirical analysis of the relationship between imperceptible perturbations and high-frequency spectral components. Building upon these insights, we introduce a novel purification framework, termed PWAVEP, which begins by computing a spectral graph wavelet domain saliency score and local sparsity score for each point. Guided by these values, PWAVEP adopts a hierarchical strategy, it eliminates the most salient points, which are identified as hardly recoverable adversarial outliers. Simultaneously, it applies a spectral filtering process to a broader set of moderately salient points. This process leverages a graph wavelet transform to attenuate high-frequency coefficients associated with the targeted points, thereby effectively suppressing adversarial noise. Extensive evaluations demonstrate that the proposed PWAVEP achieves superior accuracy and robustness compared to existing approaches, advancing the state-of-the-art in 3D point cloud purification. Code and datasets are available at https://github.com/a772316182/pwavep

Figures (11)

• Figure 1: The pipeline of our Point Cloud Wavelet Purification (PWaveP). (1) The method first applies the Graph Wavelet Transform (GWT) to the PC's KNN graph. (2) A hybrid spectral-spatial analysis then identifies and partitions points into high- and mid-risk sets based on a composite saliency score. (3) Finally, a hierarchical purification module filters mid-risk points and removes high-risk points through an inverse GWT (IGWT) process to restore a clean PC.
• Figure 2: Impact of attack frequency on distance metrics. Under a fixed perturbation energy ($\|\Delta\|_F=2$), the CD are basically stable, while EMD decreases significantly as the attack frequency increases, match our theoretical analysis.
• Figure 3: Qualitative comparison of perturbations. The high-frequency attack results in less visual distortion and a lower EMD than the low-frequency attack.
• Figure 4: Side-effect Study of PWaveP on Clean Data: The left bar in each group is the accuracy ($\uparrow$,%) on clean samples; the right bar is the accuracy after "purification".
• Figure 5: Comparing the performance of PWaveP using the Meyer wavelet versus the Mexican Hat wavelet on ModelNet40 (MN) and ShapeNet (SN) datasets. The Mexican Hat consistently achieves superior or comparable performance.