Transferable 3D Adversarial Shape Completion using Diffusion Models

TL;DR

This paper introduces a novel method for generating realistic, transferable 3D adversarial point clouds using diffusion models and shape completion, significantly improving attack success across different models and defenses.

Contribution

It proposes a new adversarial attack framework leveraging diffusion models and shape completion for realistic, transferable 3D adversarial examples, enhancing robustness evaluation.

Findings

Outperforms state-of-the-art attacks on black-box models

Achieves higher transferability across different architectures

Establishes a new baseline for 3D model robustness testing

Abstract

Recent studies that incorporate geometric features and transformers into 3D point cloud feature learning have significantly improved the performance of 3D deep-learning models. However, their robustness against adversarial attacks has not been thoroughly explored. Existing attack methods primarily focus on white-box scenarios and struggle to transfer to recently proposed 3D deep-learning models. Even worse, these attacks introduce perturbations to 3D coordinates, generating unrealistic adversarial examples and resulting in poor performance against 3D adversarial defenses. In this paper, we generate high-quality adversarial point clouds using diffusion models. By using partial points as prior knowledge, we generate realistic adversarial examples through shape completion with adversarial guidance. The proposed adversarial shape completion allows for a more reliable generation of adversarial point clouds. To enhance attack transferability, we delve into the characteristics of 3D point clouds and employ model uncertainty for better inference of model classification through random down-sampling of point clouds. We adopt ensemble adversarial guidance for improved transferability across different network architectures. To maintain the generation quality, we limit our adversarial guidance solely to the critical points of the point clouds by calculating saliency scores. Extensive experiments demonstrate that our proposed attacks outperform state-of-the-art adversarial attack methods against both black-box models and defenses. Our black-box attack establishes a new baseline for evaluating the robustness of various 3D point cloud classification models.