Generating Adversarial Events: A Motion-Aware Point Cloud Framework

TL;DR

This work tackles adversarial vulnerabilities in event-camera systems by introducing MA-ADV, a motion-aware adversarial framework that generates perturbations on point-cloud representations of raw events. It combines a diffusion-based perturbation mechanism across spatial and temporal neighborhoods with a per-sample learning-rate optimizer to stabilize gradient-based attacks in the presence of high-frequency event noise. The approach achieves a 100% attack success rate with minimal distortion across multiple datasets and backbones, and demonstrates robustness against common defenses. The results highlight critical security challenges for future event-based perception systems and offer a practical method for evaluating and stressing model robustness.

Abstract

Event cameras have been widely adopted in safety-critical domains such as autonomous driving, robotics, and human-computer interaction. A pressing challenge arises from the vulnerability of deep neural networks to adversarial examples, which poses a significant threat to the reliability of event-based systems. Nevertheless, research into adversarial attacks on events is scarce. This is primarily due to the non-differentiable nature of mainstream event representations, which hinders the extension of gradient-based attack methods. In this paper, we propose MA-ADV, a novel \textbf{M}otion-\textbf{A}ware \textbf{Adv}ersarial framework. To the best of our knowledge, this is the first work to generate adversarial events by leveraging point cloud representations. MA-ADV accounts for high-frequency noise in events and employs a diffusion-based approach to smooth perturbations, while fully leveraging the spatial and temporal relationships among events. Finally, MA-ADV identifies the minimal-cost perturbation through a combination of sample-wise Adam optimization, iterative refinement, and binary search. Extensive experimental results validate that MA-ADV ensures a 100\% attack success rate with minimal perturbation cost, and also demonstrate enhanced robustness against defenses, underscoring the critical security challenges facing future event-based perception systems.

Figures (3)

• Figure 1: A representative adversarial example from the N-MNIST dataset. After the attack method adds perturbations to events, the network misclassifies the handwritten digit 6 as 4.
• Figure 2: Overview of the MA-ADV adversarial attack framework. The method generates spatially and temporally consistent adversarial events by diffusing perturbations through spatial and temporal neighbors, which is optimized by a sample-wise Adam optimizer. The adversarial events are fed into point-based networks for classification, with the loss function balancing Chamfer Distance and an untargeted classification loss. Binary search dynamically adjusts the loss weight $\lambda$ to optimize attack success rate and perturbation cost.
• Figure 3: Visualization of adversarial event samples across different attack methods on three datasets. Zoom in find details.