Rethinking Gradient-based Adversarial Attacks on Point Cloud Classification

TL;DR

This paper introduces two novel gradient-based attack methods, WAAttack and SubAttack, that enhance the effectiveness and imperceptibility of adversarial attacks on 3D point cloud classifiers by considering point-wise heterogeneity and saliency.

Contribution

It proposes two new strategies, WAAttack and SubAttack, to improve gradient-based adversarial attacks on point clouds by making them more effective and less perceptible.

Findings

Outperforms state-of-the-art methods in imperceptibility

Effectively reduces perceptual saliency of perturbations

Enhances attack success rate on 3D classifiers

Abstract

Gradient-based adversarial attacks are widely used to evaluate the robustness of 3D point cloud classifiers, yet they often rely on uniform update rules that neglect point-wise heterogeneity, leading to perceptible perturbations. We propose two complementary strategies to improve both the effectiveness and imperceptibility of the attack. \textbf{WAAttack} employs weighted gradients to dynamically adjust per-point perturbation magnitudes and uses an adaptive step size strategy to regulate the global perturbation scale. \textbf{SubAttack} partitions the point cloud into subsets and, at each iteration, perturbs only those combinations with high adversarial efficacy and low perceptual saliency. Together, these methods offer a principled refinement of gradient-based attacks for 3D point clouds. Extensive experiments show that our approach consistently outperforms state-of-the-art methods in generating highly imperceptible adversarial examples. The code is available at https://github.com/chenjun0326/WA_SubAttack.