# SAGA: Spectral Adversarial Geometric Attack on 3D Meshes

arXiv: https://arxiv.org/abs/2211.13775 · HTML: https://mlsanity.com/paper/2211.13775/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- Builds on 21 of its 38 references that are in the map.
- First posted on arXiv 24 Nov 2022.

## Builds on (most cited first, 21 of 21)

- [Explaining and Harnessing Adversarial Examples](https://mlsanity.com/paper/1412.6572/) (2014)
- [PointNet: Deep Learning on Point Sets for 3D Classification and Segmentation](https://mlsanity.com/paper/1612.00593/) (2016)
- [Towards Evaluating the Robustness of Neural Networks](https://mlsanity.com/paper/1608.04644/) (2016)
- [The Limitations of Deep Learning in Adversarial Settings](https://mlsanity.com/paper/1511.07528/) (2015)
- [3D Menagerie: Modeling the 3D shape and pose of animals](https://mlsanity.com/paper/1611.07700/) (2016)
- [Generating 3D faces using Convolutional Mesh Autoencoders](https://mlsanity.com/paper/1807.10267/) (2018)
- [3D-CODED : 3D Correspondences by Deep Deformation](https://mlsanity.com/paper/1806.05228/) (2018)
- [Generating 3D Adversarial Point Clouds](https://mlsanity.com/paper/1809.07016/) (2018)
- [SDM-NET: Deep Generative Network for Structured Deformable Mesh](https://mlsanity.com/paper/1908.04520/) (2019)
- [Neural 3D Morphable Models: Spiral Convolutional Networks for 3D Shape Representation Learning and Generation](https://mlsanity.com/paper/1905.02876/) (2019)
- [AdvPC: Transferable Adversarial Perturbations on 3D Point Clouds](https://mlsanity.com/paper/1912.00461/) (2019)
- [Fully Convolutional Mesh Autoencoder using Efficient Spatially Varying Kernels](https://mlsanity.com/paper/2006.04325/) (2020)
- [Shape-invariant 3D Adversarial Point Clouds](https://mlsanity.com/paper/2203.04041/) (2022)
- [Universal Spectral Adversarial Attacks for Deformable Shapes](https://mlsanity.com/paper/2104.03356/) (2021)
- [Instant recovery of shape from spectrum via latent space connections](https://mlsanity.com/paper/2003.06523/) (2020)
- [Geometric Adversarial Attacks and Defenses on 3D Point Clouds](https://mlsanity.com/paper/2012.05657/) (2020)
- [LPF-Defense: 3D Adversarial Defense based on Frequency Analysis](https://mlsanity.com/paper/2202.11287/) (2022)
- [Learning Mesh Representations via Binary Space Partitioning Tree Networks](https://mlsanity.com/paper/2106.14274/) (2021)
- [3D Mesh Segmentation via Multi-branch 1D Convolutional Neural Networks](https://mlsanity.com/paper/1705.11050/) (2017)
- [Random Walks for Adversarial Meshes](https://mlsanity.com/paper/2202.07453/) (2022)
- [Fast mesh denoising with data driven normal filtering using deep variational autoencoders](https://mlsanity.com/paper/2111.12782/) (2021)

## Built on by (most cited first, 2 of 2)

- [Rigid Body Adversarial Attacks](https://mlsanity.com/paper/2502.05669/) (2025)
- [AegisRF: Adversarial Perturbations Guided with Sensitivity for Protecting Intellectual Property of Neural Radiance Fields](https://mlsanity.com/paper/2510.19371/) (2025)

## Abstract (arXiv)

A triangular mesh is one of the most popular 3D data representations. As such, the deployment of deep neural networks for mesh processing is widely spread and is increasingly attracting more attention. However, neural networks are prone to adversarial attacks, where carefully crafted inputs impair the model's functionality. The need to explore these vulnerabilities is a fundamental factor in the future development of 3D-based applications. Recently, mesh attacks were studied on the semantic level, where classifiers are misled to produce wrong predictions. Nevertheless, mesh surfaces possess complex geometric attributes beyond their semantic meaning, and their analysis often includes the need to encode and reconstruct the geometry of the shape. We propose a novel framework for a geometric adversarial attack on a 3D mesh autoencoder. In this setting, an adversarial input mesh deceives the autoencoder by forcing it to reconstruct a different geometric shape at its output. The malicious input is produced by perturbing a clean shape in the spectral domain. Our method leverages the spectral decomposition of the mesh along with additional mesh-related properties to obtain visually credible results that consider the delicacy of surface distortions. Our code is publicly available at https://github.com/StolikTomer/SAGA.