# ShapeAdv: Generating Shape-Aware Adversarial 3D Point Clouds

arXiv: https://arxiv.org/abs/2005.11626 · HTML: https://mlsanity.com/paper/2005.11626/

## Key facts

- Cited by 20 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 24 May 2020.

## Built on by (most cited first, 20 of 20)

- [Invisible for both Camera and LiDAR: Security of Multi-Sensor Fusion based Perception in Autonomous Driving Under Physical-World Attacks](https://mlsanity.com/paper/2106.09249/) (2021)
- [Imperceptible Transfer Attack and Defense on 3D Point Cloud Classification](https://mlsanity.com/paper/2111.10990/) (2021)
- [Isometric 3D Adversarial Examples in the Physical World](https://mlsanity.com/paper/2210.15291/) (2022)
- [Distributionally Robust Policy Learning via Adversarial Environment Generation](https://mlsanity.com/paper/2107.06353/) (2021)
- [Robustness Certification for Point Cloud Models](https://mlsanity.com/paper/2103.16652/) (2021)
- [LPF-Defense: 3D Adversarial Defense based on Frequency Analysis](https://mlsanity.com/paper/2202.11287/) (2022)
- [3DHacker: Spectrum-based Decision Boundary Generation for Hard-label 3D Point Cloud Attack](https://mlsanity.com/paper/2308.07546/) (2023)
- [Explainability-Aware One Point Attack for Point Cloud Neural Networks](https://mlsanity.com/paper/2110.04158/) (2021)
- [Invariance-Aware Randomized Smoothing Certificates](https://mlsanity.com/paper/2211.14207/) (2022)
- [3DVerifier: Efficient Robustness Verification for 3D Point Cloud Models](https://mlsanity.com/paper/2207.07539/) (2022)
- [Adversarial Attacks and Defenses on 3D Point Cloud Classification: A Survey](https://mlsanity.com/paper/2307.00309/) (2023)
- [Robustifying Point Cloud Networks by Refocusing](https://mlsanity.com/paper/2308.05525/) (2023)
- [LiDAttack: Robust Black-box Attack on LiDAR-based Object Detection](https://mlsanity.com/paper/2411.01889/) (2024)
- [Hard-Label Black-Box Attacks on 3D Point Clouds](https://mlsanity.com/paper/2412.00404/) (2024)
- [Texture- and Shape-based Adversarial Attacks for Overhead Image Vehicle Detection](https://mlsanity.com/paper/2412.16358/) (2024)
- [KNN-Defense: Defense against 3D Adversarial Point Clouds using Nearest-Neighbor Search](https://mlsanity.com/paper/2506.06906/) (2025)
- [Cage-Based Deformation for Transferable and Undefendable Point Cloud Attack](https://mlsanity.com/paper/2507.00690/) (2025)
- [OBJVanish: Physically Realizable Text-to-3D Adv. Generation of LiDAR-Invisible Objects](https://mlsanity.com/paper/2510.06952/) (2025)
- [On the Adversarial Robustness of 3D Large Vision-Language Models](https://mlsanity.com/paper/2601.06464/) (2026)
- [Rethinking Transferable Adversarial Attacks on Point Clouds from a Compact Subspace Perspective](https://mlsanity.com/paper/2601.23102/) (2026)

## Abstract (arXiv)

We introduce ShapeAdv, a novel framework to study shape-aware adversarial perturbations that reflect the underlying shape variations (e.g., geometric deformations and structural differences) in the 3D point cloud space. We develop shape-aware adversarial 3D point cloud attacks by leveraging the learned latent space of a point cloud auto-encoder where the adversarial noise is applied in the latent space. Specifically, we propose three different variants including an exemplar-based one by guiding the shape deformation with auxiliary data, such that the generated point cloud resembles the shape morphing between objects in the same category. Different from prior works, the resulting adversarial 3D point clouds reflect the shape variations in the 3D point cloud space while still being close to the original one. In addition, experimental evaluations on the ModelNet40 benchmark demonstrate that our adversaries are more difficult to defend with existing point cloud defense methods and exhibit a higher attack transferability across classifiers. Our shape-aware adversarial attacks are orthogonal to existing point cloud based attacks and shed light on the vulnerability of 3D deep neural networks.