Generating Adversarial Point Clouds Using Diffusion Model

TL;DR

This paper introduces a novel black-box adversarial attack method for 3D point cloud classification using a diffusion model, significantly improving attack success and imperceptibility without needing internal model details.

Contribution

It proposes a diffusion model-based approach for black-box adversarial attacks on point clouds, enhancing effectiveness and practicality over existing methods.

Findings

Improved attack success rate in black-box settings

Enhanced imperceptibility of adversarial point clouds

Effective transferability across different models

Abstract

Adversarial attack methods for 3D point cloud classification reveal the vulnerabilities of point cloud recognition models. This vulnerability could lead to safety risks in critical applications that use deep learning models, such as autonomous vehicles. To uncover the deficiencies of these models, researchers can evaluate their security through adversarial attacks. However, most existing adversarial attack methods are based on white-box attacks. While these methods achieve high attack success rates and imperceptibility, their applicability in real-world scenarios is limited. Black-box attacks, which are more meaningful in real-world scenarios, often yield poor results. This paper proposes a novel black-box adversarial example generation method that utilizes a diffusion model to improve the attack success rate and imperceptibility in the black-box setting, without relying on the internal information of the point cloud classification model to generate adversarial samples. We use a 3D diffusion model to use the compressed features of the point cloud as prior knowledge to guide the reverse diffusion process to add adversarial points to clean examples. Subsequently, its reverse process is employed to transform the distribution of other categories into adversarial points, which are then added to the point cloud.