Generating Unrestricted 3D Adversarial Point Clouds

TL;DR

This paper introduces AdvGCGAN, a novel generative adversarial network that creates realistic, unrestricted 3D adversarial point clouds capable of fooling AI models, surpassing existing methods in success rate and transferability.

Contribution

The paper presents a new GAN-based approach for generating unrestricted, realistic 3D adversarial point clouds, improving attack success and transferability over prior techniques.

Findings

Higher attack success rate than state-of-the-art methods

Produces more visually realistic adversarial point clouds

Demonstrates better transferability against defense models

Abstract

Utilizing 3D point cloud data has become an urgent need for the deployment of artificial intelligence in many areas like facial recognition and self-driving. However, deep learning for 3D point clouds is still vulnerable to adversarial attacks, e.g., iterative attacks, point transformation attacks, and generative attacks. These attacks need to restrict perturbations of adversarial examples within a strict bound, leading to the unrealistic adversarial 3D point clouds. In this paper, we propose an Adversarial Graph-Convolutional Generative Adversarial Network (AdvGCGAN) to generate visually realistic adversarial 3D point clouds from scratch. Specifically, we use a graph convolutional generator and a discriminator with an auxiliary classifier to generate realistic point clouds, which learn the latent distribution from the real 3D data. The unrestricted adversarial attack loss is incorporated in the special adversarial training of GAN, which enables the generator to generate the adversarial examples to spoof the target network. Compared with the existing state-of-art attack methods, the experiment results demonstrate the effectiveness of our unrestricted adversarial attack methods with a higher attack success rate and visual quality. Additionally, the proposed AdvGCGAN can achieve better performance against defense models and better transferability than existing attack methods with strong camouflage.