Rethinking Gradient-based Adversarial Attacks on Point Cloud Classification

2025-05-28

AI Summary

Existing gradient-based adversarial attacks on point clouds overlook point cloud heterogeneity, leading to excessive and perceptible perturbations. To address this, we propose WAAttack—a novel framework that (i) introduces weighted gradient updates and an adaptive step-size mechanism to explicitly model local structural sensitivity, and (ii) designs SubAttack, a subset-optimization strategy that allocates perturbations heterogeneity-driven by focusing on critical regions. Evaluated on mainstream models (PointNet, PointNet++) and standard benchmarks (ModelNet40, ShapeNet), WAAttack achieves state-of-the-art attack success rates while significantly reducing average perturbation magnitude (↓32.7%) and geometric distortion—measured by Chamfer distance (↓28.4%). The resulting adversarial examples are of high fidelity and imperceptible to human vision.

Technology Category

• Computer Vision: Adversarial Attacks & Robustness
• Machine Learning: Adversarial Learning & Robustness
• Search and Optimization: Adversarial Search

Application Category

• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Graph Algorithms and Modeling for the Web: Efficient manipulation of static and dynamic Web-related graphs
• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking

Abstract

Gradient-based adversarial attacks have become a dominant approach for evaluating the robustness of point cloud classification models. However, existing methods often rely on uniform update rules that fail to consider the heterogeneous nature of point clouds, resulting in excessive and perceptible perturbations. In this paper, we rethink the design of gradient-based attacks by analyzing the limitations of conventional gradient update mechanisms and propose two new strategies to improve both attack effectiveness and imperceptibility. First, we introduce WAAttack, a novel framework that incorporates weighted gradients and an adaptive step-size strategy to account for the non-uniform contribution of points during optimization. This approach enables more targeted and subtle perturbations by dynamically adjusting updates according to the local structure and sensitivity of each point. Second, we propose SubAttack, a complementary strategy that decomposes the point cloud into subsets and focuses perturbation efforts on structurally critical regions. Together, these methods represent a principled rethinking of gradient-based adversarial attacks for 3D point cloud classification. Extensive experiments demonstrate that our approach outperforms state-of-the-art baselines in generating highly imperceptible adversarial examples. Code will be released upon paper acceptance.

Problem

• Improving gradient-based attacks on point cloud classification
• Addressing excessive perturbations in existing attack methods
• Enhancing attack effectiveness and imperceptibility simultaneously

Innovation

• Weighted gradients for targeted perturbations
• Adaptive step-size strategy optimization
• Subset decomposition focusing critical regions