# Boosting 3D Adversarial Attacks with Attacking On Frequency

arXiv: https://arxiv.org/abs/2201.10937 · HTML: https://mlsanity.com/paper/2201.10937/

## Key facts

- Cited by 18 papers in the map (data through 14 Oct 2026).
- Builds on 28 of its 43 references that are in the map.
- First posted on arXiv 26 Jan 2022.

## Builds on (most cited first, 28 of 28)

- [Adam: A Method for Stochastic Optimization](https://mlsanity.com/paper/1412.6980/) (2014)
- [Explaining and Harnessing Adversarial Examples](https://mlsanity.com/paper/1412.6572/) (2014)
- [PointNet: Deep Learning on Point Sets for 3D Classification and Segmentation](https://mlsanity.com/paper/1612.00593/) (2016)
- [PointNet++: Deep Hierarchical Feature Learning on Point Sets in a Metric Space](https://mlsanity.com/paper/1706.02413/) (2017)
- [Towards Evaluating the Robustness of Neural Networks](https://mlsanity.com/paper/1608.04644/) (2016)
- [CutMix: Regularization Strategy to Train Strong Classifiers with Localizable Features](https://mlsanity.com/paper/1905.04899/) (2019)
- [Dynamic Graph CNN for Learning on Point Clouds](https://mlsanity.com/paper/1801.07829/) (2018)
- [Occupancy Networks: Learning 3D Reconstruction in Function Space](https://mlsanity.com/paper/1812.03828/) (2018)
- [Adversarial Examples Are Not Bugs, They Are Features](https://mlsanity.com/paper/1905.02175/) (2019)
- [Adversarial Machine Learning at Scale](https://mlsanity.com/paper/1611.01236/) (2016)
- [Convolutional Occupancy Networks](https://mlsanity.com/paper/2003.04618/) (2020)
- [Square Attack: a query-efficient black-box adversarial attack via random search](https://mlsanity.com/paper/1912.00049/) (2019)
- [PointConv: Deep Convolutional Networks on 3D Point Clouds](https://mlsanity.com/paper/1811.07246/) (2018)
- [High Frequency Component Helps Explain the Generalization of Convolutional Neural Networks](https://mlsanity.com/paper/1905.13545/) (2019)
- [Simple Black-box Adversarial Attacks](https://mlsanity.com/paper/1905.07121/) (2019)
- [PU-Net: Point Cloud Upsampling Network](https://mlsanity.com/paper/1801.06761/) (2018)
- [Generating 3D Adversarial Point Clouds](https://mlsanity.com/paper/1809.07016/) (2018)
- [AdvPC: Transferable Adversarial Perturbations on 3D Point Clouds](https://mlsanity.com/paper/1912.00461/) (2019)
- [PointCutMix: Regularization Strategy for Point Cloud Classification](https://mlsanity.com/paper/2101.01461/) (2021)
- [Adversarial Attack and Defense on Point Sets](https://mlsanity.com/paper/1902.10899/) (2019)
- [AdvDrop: Adversarial Attack to DNNs by Dropping Information](https://mlsanity.com/paper/2108.09034/) (2021)
- [LG-GAN: Label Guided Adversarial Network for Flexible Targeted Attack of Point Cloud-based Deep Networks](https://mlsanity.com/paper/2011.00566/) (2020)
- [3D Point Cloud Denoising using Graph Laplacian Regularization of a Low Dimensional Manifold Model](https://mlsanity.com/paper/1803.07252/) (2018)
- [IF-Defense: 3D Adversarial Point Cloud Defense via Implicit Function based Restoration](https://mlsanity.com/paper/2010.05272/) (2020)
- [Universal Adversarial Attack on Attention and the Resulting Dataset DAmageNet](https://mlsanity.com/paper/2001.06325/) (2020)
- [3D Adversarial Attacks Beyond Point Cloud](https://mlsanity.com/paper/2104.12146/) (2021)
- [Hybrid Point Cloud Attribute Compression Using Slice-based Layered Structure and Block-based Intra Prediction](https://mlsanity.com/paper/1804.10783/) (2018)
- [Frequency-Tuned Universal Adversarial Attacks](https://mlsanity.com/paper/2003.05549/) (2020)

## Built on by (most cited first, 18 of 18)

- [Hide in Thicket: Generating Imperceptible and Rational Adversarial Perturbations on 3D Point Clouds](https://mlsanity.com/paper/2403.05247/) (2024)
- [A Survey of Robustness and Safety of 2D and 3D Deep Learning Models Against Adversarial Attacks](https://mlsanity.com/paper/2310.00633/) (2023)
- [Point Cloud Attacks in Graph Spectral Domain: When 3D Geometry Meets Graph Signal Processing](https://mlsanity.com/paper/2207.13326/) (2022)
- [LPF-Defense: 3D Adversarial Defense based on Frequency Analysis](https://mlsanity.com/paper/2202.11287/) (2022)
- [Ada3Diff: Defending against 3D Adversarial Point Clouds via Adaptive Diffusion](https://mlsanity.com/paper/2211.16247/) (2022)
- [Improving transferability of 3D adversarial attacks with scale and shear transformations](https://mlsanity.com/paper/2211.01093/) (2022)
- [Adversarial Attacks and Defenses on 3D Point Cloud Classification: A Survey](https://mlsanity.com/paper/2307.00309/) (2023)
- [Benchmarking and Analyzing Robust Point Cloud Recognition: Bag of Tricks for Defending Adversarial Examples](https://mlsanity.com/paper/2307.16361/) (2023)
- [NoPain: No-box Point Cloud Attack via Optimal Transport Singular Boundary](https://mlsanity.com/paper/2503.00063/) (2025)
- [Towards a 3D Transfer-based Black-box Attack via Critical Feature Guidance](https://mlsanity.com/paper/2508.15650/) (2025)
- [Adversarial samples for deep monocular 6D object pose estimation](https://mlsanity.com/paper/2203.00302/) (2022)
- [Enhancing 3D Robotic Vision Robustness by Minimizing Adversarial Mutual Information through a Curriculum Training Approach](https://mlsanity.com/paper/2409.12379/) (2024)
- [Transferable and Undefendable Point Cloud Attacks via Medial Axis Transform](https://mlsanity.com/paper/2507.18870/) (2025)
- [Detecting and Recovering Adversarial Examples from Extracting Non-robust and Highly Predictive Adversarial Perturbations](https://mlsanity.com/paper/2206.15128/) (2022)
- [Rethinking Gradient-based Adversarial Attacks on Point Cloud Classification](https://mlsanity.com/paper/2505.21854/) (2025)
- [KNN-Defense: Defense against 3D Adversarial Point Clouds using Nearest-Neighbor Search](https://mlsanity.com/paper/2506.06906/) (2025)
- [Rethinking Transferable Adversarial Attacks on Point Clouds from a Compact Subspace Perspective](https://mlsanity.com/paper/2601.23102/) (2026)
- [Topo-ADV: Generating Topology-Driven Imperceptible Adversarial Point Clouds](https://mlsanity.com/paper/2604.09879/) (2026)

## Abstract (arXiv)

Deep neural networks (DNNs) have been shown to be vulnerable to adversarial attacks. Recently, 3D adversarial attacks, especially adversarial attacks on point clouds, have elicited mounting interest. However, adversarial point clouds obtained by previous methods show weak transferability and are easy to defend. To address these problems, in this paper we propose a novel point cloud attack (dubbed AOF) that pays more attention on the low-frequency component of point clouds. We combine the losses from point cloud and its low-frequency component to craft adversarial samples. Extensive experiments validate that AOF can improve the transferability significantly compared to state-of-the-art (SOTA) attacks, and is more robust to SOTA 3D defense methods. Otherwise, compared to clean point clouds, adversarial point clouds obtained by AOF contain more deformation than outlier.