mlsanityData to 7 Oct 2026

Shape-invariant 3D Adversarial Point Clouds

arXiv 2203.04041 ↗First posted 8 Mar 2022cs.CVcited by 49

Not on the map. Why?

Abstract (arXiv)

Adversary and invisibility are two fundamental but conflict characters of adversarial perturbations. Previous adversarial attacks on 3D point cloud recognition have often been criticized for their noticeable point outliers, since they just involve an "implicit constrain" like global distance loss in the time-consuming optimization to limit the generated noise. While point cloud is a highly structured data format, it is hard to constrain its perturbation with a simple loss or metric properly. In this paper, we propose a novel Point-Cloud Sensitivity Map to boost both the efficiency and imperceptibility of point perturbations. This map reveals the vulnerability of point cloud recognition models when encountering shape-invariant adversarial noises. These noises are designed along the shape surface with an "explicit constrain" instead of extra distance loss. Specifically, we first apply a reversible coordinate transformation on each point of the point cloud input, to reduce one degree of point freedom and limit its movement on the tangent plane. Then we calculate the best attacking direction with the gradients of the transformed point cloud obtained on the white-box model. Finally we assign each point with a non-negative score to construct the sensitivity map, which benefits both white-box adversarial invisibility and black-box query-efficiency extended in our work. Extensive evaluations prove that our method can achieve the superior performance on various point cloud recognition models, with its satisfying adversarial imperceptibility and strong resistance to different point cloud defense settings. Our code is available at: https://github.com/shikiw/SI-Adv.

Key facts. Cited by 49 papers in the map (data through 7 Oct 2026). Builds on 32 of its 41 references that are in the map. First posted on arXiv 8 Mar 2022.

Builds on

32 of 41 references.

References · 32

  1. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  2. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  3. 2016PointNet: Deep Learning on Point Sets for 3D Classification and Segmentationcited by 5,223
  4. 2013Intriguing properties of neural networkscited by 5,114
  5. 2017PointNet++: Deep Hierarchical Feature Learning on Point Sets in a Metric Spacecited by 4,384
  6. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  7. 2018Dynamic Graph CNN for Learning on Point Cloudscited by 2,220
  8. 2017VoxelNet: End-to-End Learning for Point Cloud Based 3D Object Detectioncited by 1,323
  9. 2016A Point Set Generation Network for 3D Object Reconstruction from a Single Imagecited by 972
  10. 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 682
  11. 2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 656
  12. 2017Frustum PointNets for 3D Object Detection from RGB-D Datacited by 640
20 more
  1. 2017Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Modelscited by 459
  2. 2019Simple Black-box Adversarial Attackscited by 249
  3. 2021PAConv: Position Adaptive Convolution with Dynamic Kernel Assembling on Point Cloudscited by 211
  4. 2019Efficient Decision-based Black-box Adversarial Attacks on Face Recognitioncited by 173
  5. 2021Walk in the Cloud: Learning Curves for Point Clouds Shape Analysiscited by 172
  6. 2019Adversarial Sensor Attack on LiDAR-based Perception in Autonomous Drivingcited by 151
  7. 2014Towards Deep Neural Network Architectures Robust to Adversarial Examplescited by 146
  8. 2021Revisiting Point Cloud Shape Classification with a Simple and Effective Baselinecited by 145
  9. 2018Generating 3D Adversarial Point Cloudscited by 144
  10. 2018AutoZOOM: Autoencoder-based Zeroth Order Optimization Method for Attacking Black-box Neural Networkscited by 137
  11. 2020Physically Realizable Adversarial Examples for LiDAR Object Detectioncited by 137
  12. 2018PointCloud Saliency Mapscited by 112
  13. 2021Invisible for both Camera and LiDAR: Security of Multi-Sensor Fusion based Perception in Autonomous Driving Under Physical-World Attackscited by 101
  14. 2020Towards Robust LiDAR-based Perception in Autonomous Driving: General Black-box Adversarial Sensor Attack and Countermeasurescited by 95
  15. 2019Extending Adversarial Attacks and Defenses to Deep 3D Point Cloud Classifierscited by 92
  16. 2019AdvPC: Transferable Adversarial Perturbations on 3D Point Cloudscited by 84
  17. 2020LG-GAN: Label Guided Adversarial Network for Flexible Targeted Attack of Point Cloud-based Deep Networkscited by 55
  18. 2021PointGuard: Provably Robust 3D Point Cloud Classificationcited by 49
  19. 2020Learning Black-Box Attackers with Transferable Priors and Query Feedbackcited by 32
  20. 2020On Adversarial Robustness of 3D Point Cloud Classification under Adaptive Attackscited by 10

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2022: 8; 2023: 14; 2024: 11; 2025: 11; 2026: 5.

49 papers.

Sort:

By area:

  1. 2023OPERA: Alleviating Hallucination in Multi-Modal Large Language Models via Over-Trust Penalty and Retrospection-Allocationcited by 468
  2. 2023SimAC: A Simple Anti-Customization Method for Protecting Face Privacy against Text-to-Image Synthesis of Diffusion Modelscited by 34
  3. 2023Deep Learning-based 3D Point Cloud Classification: A Systematic Survey and Outlookcited by 24
  4. 2024Hide in Thicket: Generating Imperceptible and Rational Adversarial Perturbations on 3D Point Cloudscited by 24
  5. 2022Physical-World Optical Adversarial Attacks on 3D Face Recognitioncited by 23
  6. 2023A Survey of Robustness and Safety of 2D and 3D Deep Learning Models Against Adversarial Attackscited by 19
  7. 2022Point Cloud Attacks in Graph Spectral Domain: When 3D Geometry Meets Graph Signal Processingcited by 16
  8. 2023Improving Adversarial Robustness of Masked Autoencoders via Test-time Frequency-domain Promptingcited by 12
  9. 2022PointCAT: Contrastive Adversarial Training for Robust Point Cloud Recognitioncited by 10
  10. 2022PointCA: Evaluating the Robustness of 3D Point Cloud Completion Models Against Adversarial Examplescited by 9
  11. 20233DHacker: Spectrum-based Decision Boundary Generation for Hard-label 3D Point Cloud Attackcited by 9
  12. 2022Ada3Diff: Defending against 3D Adversarial Point Clouds via Adaptive Diffusioncited by 8
37 more
  1. 2022Invariance-Aware Randomized Smoothing Certificatescited by 7
  2. 2024Toward Availability Attacks in 3D Point Cloudscited by 7
  3. 2023Risk-optimized Outlier Removal for Robust 3D Point Cloud Classificationcited by 6
  4. 2023Adversarial Attacks and Defenses on 3D Point Cloud Classification: A Surveycited by 5
  5. 2023Benchmarking and Analyzing Robust Point Cloud Recognition: Bag of Tricks for Defending Adversarial Examplescited by 4
  6. 2022SAGA: Spectral Adversarial Geometric Attack on 3D Meshescited by 2
  7. 2023Robustifying Point Cloud Networks by Refocusingcited by 2
  8. 2025NoPain: No-box Point Cloud Attack via Optimal Transport Singular Boundarycited by 2
  9. 2025InfoCons: Identifying Interpretable Critical Concepts in Point Clouds via Information Theorycited by 2
  10. 2025Towards a 3D Transfer-based Black-box Attack via Critical Feature Guidancecited by 2
  11. 2023Interpreting Hidden Semantics in the Intermediate Layers of 3D Point Cloud Classification Neural Networkcited by 1
  12. 2023Advancing Perception in Artificial Intelligence through Principles of Cognitive Sciencecited by 1
  13. 2024Fooling Neural Networks for Motion Forecasting via Adversarial Attackscited by 1
  14. 2024Eidos: Efficient, Imperceptible Adversarial 3D Point Cloudscited by 1
  15. 2024Enhancing 3D Robotic Vision Robustness by Minimizing Adversarial Mutual Information through a Curriculum Training Approachcited by 1
  16. 2025Transferable and Undefendable Point Cloud Attacks via Medial Axis Transformcited by 1
  17. 2025Generating Adversarial Point Clouds Using Diffusion Modelcited by 1
  18. 20223D-VFD: A Victim-free Detector against 3D Adversarial Point Cloudscited by 0
  19. 2023Adaptive Local Adversarial Attacks on 3D Point Clouds for Augmented Realitycited by 0
  20. 2023Trainwreck: A damaging adversarial attack on image classifierscited by 0
  21. 2024epsilon-Mesh Attack: A Surface-based Adversarial Point Cloud Attack for Facial Expression Recognitioncited by 0
  22. 2024Transferable 3D Adversarial Shape Completion using Diffusion Modelscited by 0
  23. 2024Enhancing Sampling Protocol for Point Cloud Classification Against Corruptionscited by 0
  24. 2024Improving Adversarial Robustness for 3D Point Cloud Recognition at Test-Time through Purified Self-Trainingcited by 0
  25. 2024Hard-Label Black-Box Attacks on 3D Point Cloudscited by 0
  26. 2024Imperceptible Adversarial Attacks on Point Clouds Guided by Point-to-Surface Fieldcited by 0
  27. 2025VVRec: Reconstruction Attacks on DL-based Volumetric Video Upstreaming via Latent Diffusion Model with Gamma Distributioncited by 0
  28. 2025Rethinking Gradient-based Adversarial Attacks on Point Cloud Classificationcited by 0
  29. 2025Cage-Based Deformation for Transferable and Undefendable Point Cloud Attackcited by 0
  30. 2025Revisiting Physically Realizable Adversarial Object Attack against LiDAR-based Detection: Clarifying Problem Formulation and Experimental Protocolscited by 0
  31. 2025AegisRF: Adversarial Perturbations Guided with Sensitivity for Protecting Intellectual Property of Neural Radiance Fieldscited by 0
  32. 20253D-ANC: Adaptive Neural Collapse for Robust 3D Point Cloud Recognitioncited by 0
  33. 2026Rethinking Transferable Adversarial Attacks on Point Clouds from a Compact Subspace Perspectivecited by 0
  34. 2026PWAVEP: Purifying Imperceptible Adversarial Perturbations in 3D Point Clouds via Spectral Graph Waveletscited by 0
  35. 2026Generating Adversarial Events: A Motion-Aware Point Cloud Frameworkcited by 0
  36. 2026Topo-ADV: Generating Topology-Driven Imperceptible Adversarial Point Cloudscited by 0
  37. 2026APC: Transferable and Efficient Adversarial Point Counterattack for Robust 3D Point Cloud Recognitioncited by 0