# Adversarial Attack and Defense on Point Sets

arXiv: https://arxiv.org/abs/1902.10899 · HTML: https://mlsanity.com/paper/1902.10899/

## Key facts

- Cited by 63 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 28 Feb 2019.

## Built on by (most cited first, 30 of 63)

- [PointCutMix: Regularization Strategy for Point Cloud Classification](https://mlsanity.com/paper/2101.01461/) (2021)
- [PointGuard: Provably Robust 3D Point Cloud Classification](https://mlsanity.com/paper/2103.03046/) (2021)
- [Exploring Adversarial Robustness of Multi-Sensor Perception Systems in Self Driving](https://mlsanity.com/paper/2101.06784/) (2021)
- [3D-VField: Adversarial Augmentation of Point Clouds for Domain Generalization in 3D Object Detection](https://mlsanity.com/paper/2112.04764/) (2021)
- [Imperceptible Transfer Attack and Defense on 3D Point Cloud Classification](https://mlsanity.com/paper/2111.10990/) (2021)
- [Fooling LiDAR Perception via Adversarial Trajectory Perturbation](https://mlsanity.com/paper/2103.15326/) (2021)
- [Imperceptible and Robust Backdoor Attack in 3D Point Cloud](https://mlsanity.com/paper/2208.08052/) (2022)
- [Isometric 3D Adversarial Examples in the Physical World](https://mlsanity.com/paper/2210.15291/) (2022)
- [Exploring the Devil in Graph Spectral Domain for 3D Point Cloud Attacks](https://mlsanity.com/paper/2202.07261/) (2022)
- [Boosting 3D Adversarial Attacks with Attacking On Frequency](https://mlsanity.com/paper/2201.10937/) (2022)
- [Robust Structured Declarative Classifiers for 3D Point Clouds: Defending Adversarial Attacks with Implicit Gradients](https://mlsanity.com/paper/2203.15245/) (2022)
- [Adversarial Attacks on Camera-LiDAR Models for 3D Car Detection](https://mlsanity.com/paper/2103.09448/) (2021)
- [Robustness Certification for Point Cloud Models](https://mlsanity.com/paper/2103.16652/) (2021)
- [Point Cloud Attacks in Graph Spectral Domain: When 3D Geometry Meets Graph Signal Processing](https://mlsanity.com/paper/2207.13326/) (2022)
- [Unlearnable 3D Point Clouds: Class-wise Transformation Is All You Need](https://mlsanity.com/paper/2410.03644/) (2024)
- [Towards Universal Physical Attacks On Cascaded Camera-Lidar 3D Object Detection Models](https://mlsanity.com/paper/2101.10747/) (2021)
- [OccAM's Laser: Occlusion-based Attribution Maps for 3D Object Detectors on LiDAR Data](https://mlsanity.com/paper/2204.06577/) (2022)
- [ART-Point: Improving Rotation Robustness of Point Cloud Classifiers via Adversarial Rotation](https://mlsanity.com/paper/2203.03888/) (2022)
- [LPF-Defense: 3D Adversarial Defense based on Frequency Analysis](https://mlsanity.com/paper/2202.11287/) (2022)
- [PointCA: Evaluating the Robustness of 3D Point Cloud Completion Models Against Adversarial Examples](https://mlsanity.com/paper/2211.12294/) (2022)
- [3DHacker: Spectrum-based Decision Boundary Generation for Hard-label 3D Point Cloud Attack](https://mlsanity.com/paper/2308.07546/) (2023)
- [Ada3Diff: Defending against 3D Adversarial Point Clouds via Adaptive Diffusion](https://mlsanity.com/paper/2211.16247/) (2022)
- [Poisoning MorphNet for Clean-Label Backdoor Attack to Point Clouds](https://mlsanity.com/paper/2105.04839/) (2021)
- [Local Aggressive Adversarial Attacks on 3D Point Cloud](https://mlsanity.com/paper/2105.09090/) (2021)
- [Explainability-Aware One Point Attack for Point Cloud Neural Networks](https://mlsanity.com/paper/2110.04158/) (2021)
- [Invariance-Aware Randomized Smoothing Certificates](https://mlsanity.com/paper/2211.14207/) (2022)
- [The art of defense: letting networks fool the attacker](https://mlsanity.com/paper/2104.02963/) (2021)
- [Adversarial Attack by Limited Point Cloud Surface Modifications](https://mlsanity.com/paper/2110.03745/) (2021)
- [PointCert: Point Cloud Classification with Deterministic Certified Robustness Guarantees](https://mlsanity.com/paper/2303.01959/) (2023)
- [Risk-optimized Outlier Removal for Robust 3D Point Cloud Classification](https://mlsanity.com/paper/2307.10875/) (2023)

## Abstract (arXiv)

Emergence of the utility of 3D point cloud data in safety-critical vision tasks (e.g., ADAS) urges researchers to pay more attention to the robustness of 3D representations and deep networks. To this end, we develop an attack and defense scheme, dedicated to 3D point cloud data, for preventing 3D point clouds from manipulated as well as pursuing noise-tolerable 3D representation. A set of novel 3D point cloud attack operations are proposed via pointwise gradient perturbation and adversarial point attachment / detachment. We then develop a flexible perturbation-measurement scheme for 3D point cloud data to detect potential attack data or noisy sensing data. Notably, the proposed defense methods are even effective to detect the adversarial point clouds generated by a proof-of-concept attack directly targeting the defense. Transferability of adversarial attacks between several point cloud networks is addressed, and we propose an momentum-enhanced pointwise gradient to improve the attack transferability. We further analyze the transferability from adversarial point clouds to grid CNNs and the inverse. Extensive experimental results on common point cloud benchmarks demonstrate the validity of the proposed 3D attack and defense framework.