Improving transferability of 3D adversarial attacks with scale and shear transformations

TL;DR

This paper introduces the Scale and Shear (SS) Attack, a novel method to generate 3D adversarial examples with significantly improved transferability for black-box classifiers by applying random geometric transformations.

Contribution

The paper proposes the SS attack that enhances transferability of 3D adversarial examples through random scaling and shearing, outperforming existing methods.

Findings

SS attack improves transferability over 3.6 times compared to baseline.

SS attack can be combined with state-of-the-art 3D attack methods.

SS attack achieves state-of-the-art transferability under various defenses.

Abstract

Previous work has shown that 3D point cloud classifiers can be vulnerable to adversarial examples. However, most of the existing methods are aimed at white-box attacks, where the parameters and other information of the classifiers are known in the attack, which is unrealistic for real-world applications. In order to improve the attack performance of the black-box classifiers, the research community generally uses the transfer-based black-box attack. However, the transferability of current 3D attacks is still relatively low. To this end, this paper proposes Scale and Shear (SS) Attack to generate 3D adversarial examples with strong transferability. Specifically, we randomly scale or shear the input point cloud, so that the attack will not overfit the white-box model, thereby improving the transferability of the attack. Extensive experiments show that the SS attack proposed in this paper can be seamlessly combined with the existing state-of-the-art (SOTA) 3D point cloud attack methods to form more powerful attack methods, and the SS attack improves the transferability over 3.6 times compare to the baseline. Moreover, while substantially outperforming the baseline methods, the SS attack achieves SOTA transferability under various defenses. Our code will be available online at https://github.com/cuge1995/SS-attack