On Isometry Robustness of Deep 3D Point Cloud Models under Adversarial Attacks

TL;DR

This paper demonstrates that state-of-the-art deep 3D point cloud models are highly vulnerable to isometry-based adversarial attacks, proposing novel black-box and white-box attack methods with high success rates and transferability.

Contribution

The work introduces the first comprehensive study of isometry robustness in 3D models and develops new attack frameworks leveraging Thompson Sampling and spectral norm perturbations.

Findings

Black-box attack success rate over 95% on ModelNet40

White-box attack success rates from 98.88% to 100%

Effective even within a small rotation range of ±2.81°

Abstract

While deep learning in 3D domain has achieved revolutionary performance in many tasks, the robustness of these models has not been sufficiently studied or explored. Regarding the 3D adversarial samples, most existing works focus on manipulation of local points, which may fail to invoke the global geometry properties, like robustness under linear projection that preserves the Euclidean distance, i.e., isometry. In this work, we show that existing state-of-the-art deep 3D models are extremely vulnerable to isometry transformations. Armed with the Thompson Sampling, we develop a black-box attack with success rate over 95% on ModelNet40 data set. Incorporating with the Restricted Isometry Property, we propose a novel framework of white-box attack on top of spectral norm based perturbation. In contrast to previous works, our adversarial samples are experimentally shown to be strongly transferable. Evaluated on a sequence of prevailing 3D models, our white-box attack achieves success rates from 98.88% to 100%. It maintains a successful attack rate over 95% even within an imperceptible rotation range $[\pm 2.81^{\circ}]$.