PointCA : Evaluating the Robustness of 3D Point Cloud Completion Models against Adversarial Examples

Research output: Chapters, Conference Papers, Creative and Literary Works (RGC: 12, 32, 41, 45)32_Refereed conference paper (with host publication)peer-review

View graph of relations

Author(s)

  • Junwei Zhang
  • Wei Liu
  • Minghui Li
  • Leo Yu Zhang
  • Hai Jin
  • Lichao Sun

Related Research Unit(s)

Detail(s)

Original languageEnglish
Title of host publicationProceedings of the 37th AAAI Conference on Artificial Intelligence
PublisherAAAI press
Pages872-880
Number of pages9
Volume37
Edition1
ISBN (Print)978-1-57735-880-0
Publication statusPublished - 2023

Publication series

NameProceedings of the AAAI Conference on Artificial Intelligence
ISSN (Print)2159-5399

Conference

Title37th Association for the Advancement of Artificial Intelligence Conference on Artificial Intelligence (AAAI-23)
LocationWalter E. Washington Convention Center
PlaceUnited States
CityWashington
Period7 - 14 February 2023

Abstract

Point cloud completion, as the upstream procedure of 3D recognition and segmentation, has become an essential part of many tasks such as navigation and scene understanding. While various point cloud completion models have demonstrated their powerful capabilities, their robustness against adversarial attacks, which have been proven to be fatally malicious towards deep neural networks, remains unknown. In addition, existing attack approaches towards point cloud classifiers cannot be applied to the completion models due to different output forms and attack purposes. In order to evaluate the robustness of the completion models, we propose PointCA, the first adversarial attack against 3D point cloud completion models. PointCA can generate adversarial point clouds that maintain high similarity with the original ones, while being completed as another object with totally different semantic information. Specifically, we minimize the representation discrepancy between the adversarial example and the target point set to jointly explore the adversarial point clouds in the geometry space and the feature space. Furthermore, to launch a stealthier attack, we innovatively employ the neighbourhood density information to tailor the perturbation constraint, leading to geometry-aware and distribution-adaptive modifications for each point. Extensive experiments against different premier point cloud completion networks show that PointCA can cause the performance degradation from 77.9% to 16.7%, with the structure chamfer distance kept below 0.01. We conclude that existing completion models are severely vulnerable to adversarial examples, and state-of-the-art defenses for point cloud classification will be partially invalid when applied to incomplete and uneven point cloud data.

© 2023, Association for the Advancement of ArtificialIntelligence (www.aaai.org). 

Citation Format(s)

PointCA: Evaluating the Robustness of 3D Point Cloud Completion Models against Adversarial Examples. / Hu, Shengshan; Zhang, Junwei; Liu, Wei et al.
Proceedings of the 37th AAAI Conference on Artificial Intelligence. Vol. 37 1. ed. AAAI press, 2023. p. 872-880 (Proceedings of the AAAI Conference on Artificial Intelligence).

Research output: Chapters, Conference Papers, Creative and Literary Works (RGC: 12, 32, 41, 45)32_Refereed conference paper (with host publication)peer-review