Random Walks for Adversarial Meshes

TL;DR

This paper introduces a black-box adversarial attack on 3D mesh classifiers using random walks to identify and modify critical mesh regions, effectively causing misclassification with minimal visual changes.

Contribution

It presents a novel, unified adversarial attack method for 3D meshes that leverages random walks to identify important regions, advancing the field of adversarial attacks in 3D computer graphics.

Findings

Successfully misclassified state-of-the-art mesh classifiers

The attack is effective with only access to network predictions

Modifications are barely visible to the naked eye

Abstract

A polygonal mesh is the most-commonly used representation of surfaces in computer graphics. Therefore, it is not surprising that a number of mesh classification networks have recently been proposed. However, while adversarial attacks are wildly researched in 2D, the field of adversarial meshes is under explored. This paper proposes a novel, unified, and general adversarial attack, which leads to misclassification of several state-of-the-art mesh classification neural networks. Our attack approach is black-box, i.e. it has access only to the network's predictions, but not to the network's full architecture or gradients. The key idea is to train a network to imitate a given classification network. This is done by utilizing random walks along the mesh surface, which gather geometric information. These walks provide insight onto the regions of the mesh that are important for the correct prediction of the given classification network. These mesh regions are then modified more than other regions in order to attack the network in a manner that is barely visible to the naked eye.