mlsanityData to 7 Oct 2026

PointGuard: Provably Robust 3D Point Cloud Classification

arXiv 2103.03046 ↗First posted 4 Mar 2021cs.CR cs.CV cs.LGcited by 49

Not on the map. Why?

Abstract (arXiv)

3D point cloud classification has many safety-critical applications such as autonomous driving and robotic grasping. However, several studies showed that it is vulnerable to adversarial attacks. In particular, an attacker can make a classifier predict an incorrect label for a 3D point cloud via carefully modifying, adding, and/or deleting a small number of its points. Randomized smoothing is state-of-the-art technique to build certifiably robust 2D image classifiers. However, when applied to 3D point cloud classification, randomized smoothing can only certify robustness against adversarially modified points. In this work, we propose PointGuard, the first defense that has provable robustness guarantees against adversarially modified, added, and/or deleted points. Specifically, given a 3D point cloud and an arbitrary point cloud classifier, our PointGuard first creates multiple subsampled point clouds, each of which contains a random subset of the points in the original point cloud; then our PointGuard predicts the label of the original point cloud as the majority vote among the labels of the subsampled point clouds predicted by the point cloud classifier. Our first major theoretical contribution is that we show PointGuard provably predicts the same label for a 3D point cloud when the number of adversarially modified, added, and/or deleted points is bounded. Our second major theoretical contribution is that we prove the tightness of our derived bound when no assumptions on the point cloud classifier are made. Moreover, we design an efficient algorithm to compute our certified robustness guarantees. We also empirically evaluate PointGuard on ModelNet40 and ScanNet benchmark datasets.

Key facts. Cited by 49 papers in the map (data through 7 Oct 2026). Builds on 33 of its 42 references that are in the map. First posted on arXiv 4 Mar 2021.

Builds on

33 of 42 references.

References · 33

  1. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  2. 2016PointNet: Deep Learning on Point Sets for 3D Classification and Segmentationcited by 5,223
  3. 2017PointNet++: Deep Hierarchical Feature Learning on Point Sets in a Metric Spacecited by 4,384
  4. 2017ScanNet: Richly-annotated 3D Reconstructions of Indoor Scenescited by 3,088
  5. 2018Dynamic Graph CNN for Learning on Point Cloudscited by 2,220
  6. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
  7. 2018PointCNN: Convolution On X-Transformed Pointscited by 764
  8. 2016Multi-View 3D Object Detection Network for Autonomous Drivingcited by 721
  9. 2018Certified Robustness to Adversarial Examples with Differential Privacycited by 462
  10. 2019Provably Robust Deep Learning via Adversarially Trained Smoothed Classifierscited by 328
  11. 2018Certified Adversarial Robustness with Additive Noisecited by 178
  12. 2017Towards Robust Neural Networks via Random Self-ensemblecited by 158
21 more
  1. 2018Generating 3D Adversarial Point Cloudscited by 144
  2. 2018PointCloud Saliency Mapscited by 112
  3. 2019Extending Adversarial Attacks and Defenses to Deep 3D Point Cloud Classifierscited by 92
  4. 2020Intrinsic Certified Robustness of Bagging against Data Poisoning Attackscited by 90
  5. 2019AdvPC: Transferable Adversarial Perturbations on 3D Point Cloudscited by 84
  6. 2016Shape Completion Enabled Robotic Graspingcited by 79
  7. 2020On Certifying Robustness against Backdoor Attacks via Randomized Smoothingcited by 74
  8. 2019Tight Certificates of Adversarial Robustness for Randomly Smoothed Classifierscited by 65
  9. 2019Adversarial Attack and Defense on Point Setscited by 63
  10. 2019Robustness Certificates for Sparse Adversarial Attacks by Randomized Ablationcited by 59
  11. 2017Mitigating Evasion Attacks to Deep Neural Networks via Region-based Classificationcited by 56
  12. 2019Robustness of 3D Deep Learning in an Adversarial Settingcited by 55
  13. 2020LG-GAN: Label Guided Adversarial Network for Flexible Targeted Attack of Point Cloud-based Deep Networkscited by 55
  14. 2018A LiDAR Point Cloud Generator: from a Virtual World to Autonomous Drivingcited by 54
  15. 2019Certified Robustness for Top-k Predictions against Adversarial Perturbations via Randomized Smoothingcited by 54
  16. 2020On Isometry Robustness of Deep 3D Point Cloud Models under Adversarial Attackscited by 46
  17. 2020IF-Defense: 3D Adversarial Point Cloud Defense via Implicit Function based Restorationcited by 46
  18. 2020Minimal Adversarial Examples for Deep Learning on 3D Point Cloudscited by 41
  19. 2019Theoretical evidence for adversarial robustness through randomizationcited by 33
  20. 2020Certified Robustness of Community Detection against Adversarial Structural Perturbation via Randomized Smoothingcited by 29
  21. 2020On Adversarial Robustness of 3D Point Cloud Classification under Adaptive Attackscited by 10

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 3; 2022: 18; 2023: 14; 2024: 6; 2025: 6; 2026: 2.

49 papers.

Sort:

  1. 2022Benchmarking Robustness of 3D Point Cloud Recognition Against Common Corruptionscited by 78
  2. 2022Benchmarking and Analyzing Point Cloud Classification under Corruptionscited by 70
  3. 2022Shape-invariant 3D Adversarial Point Cloudscited by 49
  4. 2021Boosting Randomized Smoothing with Variance Reduced Classifierscited by 47
  5. 2021Imperceptible Transfer Attack and Defense on 3D Point Cloud Classificationcited by 36
  6. 2023Text-CRS: A Generalized Certified Robustness Framework against Textual Adversarial Attackscited by 32
  7. 2022A Comprehensive Study of the Robustness for LiDAR-based 3D Object Detectors against Adversarial Attackscited by 22
  8. 2023Benchmarking the Robustness of LiDAR Semantic Segmentation Modelscited by 18
  9. 2022Robust Structured Declarative Classifiers for 3D Point Clouds: Defending Adversarial Attacks with Implicit Gradientscited by 17
  10. 2023RS-Del: Edit Distance Robustness Certificates for Sequence Classifiers via Randomized Deletioncited by 17
  11. 2021Robustness Certification for Point Cloud Modelscited by 16
  12. 2022Point Cloud Attacks in Graph Spectral Domain: When 3D Geometry Meets Graph Signal Processingcited by 16
37 more
  1. 2022RetrievalGuard: Provably Robust 1-Nearest Neighbor Image Retrievalcited by 15
  2. 2022ART-Point: Improving Rotation Robustness of Point Cloud Classifiers via Adversarial Rotationcited by 12
  3. 2023Incremental Randomized Smoothing Certificationcited by 12
  4. 2022On the Robustness of Quality Measures for GANscited by 11
  5. 2022TPC: Transformation-Specific Smoothing for Point Cloud Modelscited by 10
  6. 2022LPF-Defense: 3D Adversarial Defense based on Frequency Analysiscited by 10
  7. 20223DeformRS: Certifying Spatial Deformations on Point Cloudscited by 10
  8. 2023Randomized Message-Interception Smoothing: Gray-box Certificates for Graph Neural Networkscited by 10
  9. 2022PointCA: Evaluating the Robustness of 3D Point Cloud Completion Models Against Adversarial Examplescited by 9
  10. 2023Hierarchical Randomized Smoothingcited by 9
  11. 2022Invariance-Aware Randomized Smoothing Certificatescited by 7
  12. 2022Towards 3D Scene Understanding by Referring Synthetic Modelscited by 6
  13. 2023PointCert: Point Cloud Classification with Deterministic Certified Robustness Guaranteescited by 6
  14. 2023Risk-optimized Outlier Removal for Robust 3D Point Cloud Classificationcited by 6
  15. 2024Fast and Simple Explainability for Point Cloud Networkscited by 6
  16. 2023EPiC: Ensemble of Partial Point Clouds for Robust Classificationcited by 5
  17. 2023Adversarial Attacks and Defenses on 3D Point Cloud Classification: A Surveycited by 5
  18. 2023Robustifying Point Cloud Networks by Refocusingcited by 2
  19. 2024Robust 3D Point Clouds Classification based on Declarative Defenderscited by 2
  20. 2025Reconcile Certified Robustness and Accuracy for DNN-based Smoothed Majority Vote Classifiercited by 2
  21. 2022Isomorphic mesh generation from point clouds with multilayer perceptronscited by 1
  22. 2023Interpreting Hidden Semantics in the Intermediate Layers of 3D Point Cloud Classification Neural Networkcited by 1
  23. 2023CSI: Enhancing the Robustness of 3D Point Cloud Recognition against Corruptioncited by 1
  24. 2024CloudFort: Enhancing Robustness of 3D Point Cloud Classification Against Backdoor Attacks via Spatial Partitioning and Ensemble Predictioncited by 1
  25. 2025Adversarial Examples in Environment Perception for Automated Driving (Review)cited by 1
  26. 2026Certified vs. Empirical Adversarial Robust-ness via Hybrid Convolutions with Attention Stochasticitycited by 1
  27. 20223D-VFD: A Victim-free Detector against 3D Adversarial Point Cloudscited by 0
  28. 2022AS-PD: An Arbitrary-Size Downsampling Framework for Point Cloudscited by 0
  29. 2023Adaptive Local Adversarial Attacks on 3D Point Clouds for Augmented Realitycited by 0
  30. 2024Enhancing Robustness to Noise Corruption for Point Cloud Recognition via Spatial Sorting and Set-Mixing Aggregation Modulecited by 0
  31. 2024Enhancing Sampling Protocol for Point Cloud Classification Against Corruptionscited by 0
  32. 2024Improving Adversarial Robustness for 3D Point Cloud Recognition at Test-Time through Purified Self-Trainingcited by 0
  33. 2025Principal Eigenvalue Regularization for Improved Worst-Class Certified Robustness of Smoothed Classifierscited by 0
  34. 2025Robust Unsupervised Domain Adaptation for 3D Point Cloud Segmentation Under Source Adversarial Attackscited by 0
  35. 2025Certified L2-Norm Robustness of 3D Point Cloud Recognition in the Frequency Domaincited by 0
  36. 2025AdaptDel: Adaptable Deletion Rate Randomized Smoothing for Certified Robustnesscited by 0
  37. 2026Point-Selection Fine-Tuning Framework for Robust Point Cloud Classificationcited by 0