Rethinking Gradient-based Adversarial Attacks on Point Cloud Classification

Gradient-based adversarial attacks are widely used to evaluate the robustness of 3D point cloud classifiers, yet they often rely on uniform update rules that neglect point-wise heterogeneity, leading to perceptible perturbations. We propose two complementary strategies to improve both the effectiveness and imperceptibility of the attack. WAAttack employs weighted gradients to dynamically adjust per-point perturbation magnitudes and uses an adaptive step size strategy to regulate the global perturbation scale. SubAttack partitions the point cloud into subsets and, at each iteration, perturbs only those combinations with high adversarial efficacy and low perceptual saliency. Together, these methods offer a principled refinement of gradient-based attacks for 3D point clouds. Extensive experiments show that our approach consistently outperforms state-of-the-art methods in generating highly imperceptible adversarial examples. The code is available at https://github.com/chenjun0326/WASubAttack.