Certified L2-Norm Robustness of 3D Point Cloud Recognition in the Frequency Domain

2025-11-10

AI Summary

3D point cloud classifiers are vulnerable to structured adversarial perturbations and global geometric distortions in safety-critical applications; existing certification methods only constrain point-wise perturbations, failing to guarantee holistic structural robustness. This paper introduces FreqCert—the first frequency-domain robustness certification framework for 3D point clouds. Leveraging graph Fourier transform to model spectral structure, FreqCert designs a frequency-aware subsampling strategy to generate stable sub-point clouds and derives an interpretable, tight closed-form lower bound on the L₂ robust radius via spectral similarity. The method requires no modification to the backbone classifier and is fully compatible with standard point cloud classifiers. Evaluated on ModelNet40 and ScanObjectNN, FreqCert significantly improves certified accuracy and empirical robustness. It is the first work to rigorously demonstrate the intrinsic advantage of frequency-domain representations for provable robustness in 3D point cloud classification.

Technology Category

• Computer Vision: Adversarial Attacks & Robustness
• Machine Learning: Adversarial Learning & Robustness
• Natural Language Processing: Safety and Robustness

Application Category

• Security and Privacy: Large-scale security measurements
• Graph Algorithms and Modeling for the Web: Efficient manipulation of static and dynamic Web-related graphs
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems

Abstract

3D point cloud classification is a fundamental task in safety-critical applications such as autonomous driving, robotics, and augmented reality. However, recent studies reveal that point cloud classifiers are vulnerable to structured adversarial perturbations and geometric corruptions, posing risks to their deployment in safety-critical scenarios. Existing certified defenses limit point-wise perturbations but overlook subtle geometric distortions that preserve individual points yet alter the overall structure, potentially leading to misclassification. In this work, we propose FreqCert, a novel certification framework that departs from conventional spatial domain defenses by shifting robustness analysis to the frequency domain, enabling structured certification against global L2-bounded perturbations. FreqCert first transforms the input point cloud via the graph Fourier transform (GFT), then applies structured frequency-aware subsampling to generate multiple sub-point clouds. Each sub-cloud is independently classified by a standard model, and the final prediction is obtained through majority voting, where sub-clouds are constructed based on spectral similarity rather than spatial proximity, making the partitioning more stable under L2 perturbations and better aligned with the object's intrinsic structure. We derive a closed-form lower bound on the certified L2 robustness radius and prove its tightness under minimal and interpretable assumptions, establishing a theoretical foundation for frequency domain certification. Extensive experiments on the ModelNet40 and ScanObjectNN datasets demonstrate that FreqCert consistently achieves higher certified accuracy and empirical accuracy under strong perturbations. Our results suggest that spectral representations provide an effective pathway toward certifiable robustness in 3D point cloud recognition.

Problem

• Certifying robustness of 3D point cloud recognition against structured adversarial perturbations
• Addressing geometric distortions overlooked by existing point-wise certified defenses
• Developing frequency-domain certification against global L2-bounded perturbations

Innovation

• Shifts robustness analysis from spatial to frequency domain
• Uses graph Fourier transform and spectral subsampling
• Derives tight certified L2 robustness bound theoretically