# Geometry-Aware Generation of Adversarial Point Clouds

arXiv: https://arxiv.org/abs/1912.11171 · HTML: https://mlsanity.com/paper/1912.11171/

## Key facts

- Cited by 6 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 24 Dec 2019.

## Built on by (most cited first, 6 of 6)

- [AdvDO: Realistic Adversarial Attacks for Trajectory Prediction](https://mlsanity.com/paper/2209.08744/) (2022)
- [PointBA: Towards Backdoor Attacks in 3D Point Cloud](https://mlsanity.com/paper/2103.16074/) (2021)
- [Robustness Certification for Point Cloud Models](https://mlsanity.com/paper/2103.16652/) (2021)
- [PointDP: Diffusion-driven Purification against Adversarial Attacks on 3D Point Cloud Recognition](https://mlsanity.com/paper/2208.09801/) (2022)
- [Universal Spectral Adversarial Attacks for Deformable Shapes](https://mlsanity.com/paper/2104.03356/) (2021)
- [Sensor Adversarial Traits: Analyzing Robustness of 3D Object Detection Sensor Fusion Models](https://mlsanity.com/paper/2109.06363/) (2021)

## Abstract (arXiv)

Machine learning models have been shown to be vulnerable to adversarial examples. While most of the existing methods for adversarial attack and defense work on the 2D image domain, a few recent attempts have been made to extend them to 3D point cloud data. However, adversarial results obtained by these methods typically contain point outliers, which are both noticeable and easy to defend against using the simple techniques of outlier removal. Motivated by the different mechanisms by which humans perceive 2D images and 3D shapes, in this paper we propose the new design of geometry-aware objectives, whose solutions favor (the discrete versions of) the desired surface properties of smoothness and fairness. To generate adversarial point clouds, we use a targeted attack misclassification loss that supports continuous pursuit of increasingly malicious signals. Regularizing the targeted attack loss with our proposed geometry-aware objectives results in our proposed method, Geometry-Aware Adversarial Attack (GeoA3). The results of GeoA3 tend to be more harmful, arguably harder to defend against, and of the key adversarial characterization of being imperceptible to humans. While the main focus of this paper is to learn to generate adversarial point clouds, we also present a simple but effective algorithm termed Geo+A3-IterNormPro, with Iterative Normal Projection (IterNorPro) that solves a new objective function Geo+A3, towards surface-level adversarial attacks via generation of adversarial point clouds. We quantitatively evaluate our methods on both synthetic and physical objects in terms of attack success rate and geometric regularity. For a qualitative evaluation, we conduct subjective studies by collecting human preferences from Amazon Mechanical Turk. Comparative results in comprehensive experiments confirm the advantages of our proposed methods.