Boosting 3D Adversarial Attacks with Attacking On Frequency

TL;DR

This paper introduces AOF, a novel 3D adversarial attack focusing on low-frequency components of point clouds, significantly enhancing transferability and robustness against defenses compared to previous methods.

Contribution

AOF is the first attack to emphasize low-frequency components in 3D point clouds, improving transferability and robustness over existing adversarial attack techniques.

Findings

AOF outperforms state-of-the-art attacks in transferability.

AOF is more resistant to current 3D defense methods.

Adversarial point clouds by AOF exhibit more deformation than outliers.

Abstract

Deep neural networks (DNNs) have been shown to be vulnerable to adversarial attacks. Recently, 3D adversarial attacks, especially adversarial attacks on point clouds, have elicited mounting interest. However, adversarial point clouds obtained by previous methods show weak transferability and are easy to defend. To address these problems, in this paper we propose a novel point cloud attack (dubbed AOF) that pays more attention on the low-frequency component of point clouds. We combine the losses from point cloud and its low-frequency component to craft adversarial samples. Extensive experiments validate that AOF can improve the transferability significantly compared to state-of-the-art (SOTA) attacks, and is more robust to SOTA 3D defense methods. Otherwise, compared to clean point clouds, adversarial point clouds obtained by AOF contain more deformation than outlier.