[論文レビュー] Adversarial Attack and Defense on Point Sets

Jiancheng Yang, Qiang Zhang+4 more|arXiv (Cornell University)|Feb 28, 2019

Adversarial Robustness in Machine Learning参考文献 54被引用数 71

ひとこと要約

本論文は3D点群に対する敵対的攻撃を研究し、3つの攻撃手法（pointwise gradient、point-detach、point-attach）を提案し、perturbation-measurement defense frameworkを導入し、点群ネットワーク間およびgrid CNNsとの転移性を分析する。

ABSTRACT

Emergence of the utility of 3D point cloud data in safety-critical vision tasks (e.g., ADAS) urges researchers to pay more attention to the robustness of 3D representations and deep networks. To this end, we develop an attack and defense scheme, dedicated to 3D point cloud data, for preventing 3D point clouds from manipulated as well as pursuing noise-tolerable 3D representation. A set of novel 3D point cloud attack operations are proposed via pointwise gradient perturbation and adversarial point attachment / detachment. We then develop a flexible perturbation-measurement scheme for 3D point cloud data to detect potential attack data or noisy sensing data. Notably, the proposed defense methods are even effective to detect the adversarial point clouds generated by a proof-of-concept attack directly targeting the defense. Transferability of adversarial attacks between several point cloud networks is addressed, and we propose an momentum-enhanced pointwise gradient to improve the attack transferability. We further analyze the transferability from adversarial point clouds to grid CNNs and the inverse. Extensive experimental results on common point cloud benchmarks demonstrate the validity of the proposed 3D attack and defense framework.

研究の動機と目的

• 安全クリティカルなタスクにおける敵対的な点群に対する Point Cloud Networks (PC-Nets) の頑健性を評価する。
• 3D空間で実現可能なまま点集合を撹乱する3つの新規攻撃手法を開発する。
• 摂動と統計的測定を通じて敵対的点群を検出する柔軟な防御フレームワークを提案する。
• PC-Nets間および点群とgrid CNNs間での敵対的点群の転移性を分析する。
• ModelNet40上で攻撃の有効性と防御性能を示す実証的検証を提供する。

提案手法

• Pointwise Gradient (PG) attack: Chamfer距離の下で反復的に勾配ガイド perturbations; 安定性のためにl2正規化された勾配を使用。
• Momentum-Enhanced Pointwise Gradient (MPG) attack: 勾配にモーメントを付けて蓄積し転移性を向上。
• Point-Detach attack: 事前プーリング特徴の泰勒展開によって同定された重要点を削除する; 貪欲法的な、反復ごとの再評価戦略を用いる。
• Point-Attach attack: 勾配ベースの目的と表面上の移動を制約する小さなLagrange乗数を用いて新しい点を追加する; Ndの予算に達するまで反復。
• Defense via perturbation-measurement: applies multiple perturbations P(X) (Gaussian noise, quantization, random sampling) to create X′m, then measures statistics over outputs f(X′i).
• Metrics: AUROC and Defense Detection Rate (DDR) to evaluate detection; sets of measurements include Set-Indiv Variance (SIV), Confi-dence Averages (CoA), and Confi-dence Variance (CoV).
• Attack over defenses: EoTPG (Expectation-over-Transformation Pointwise Gradient) attack to target defense strategies and test robustness.

実験結果

リサーチクエスチョン

• RQ1 PC-Netsは勾配ガイド perturbationsとpoint attachment/detachmentによって生成された敵対的点群に対してどれほど脆弱か？
• RQ2 perturbation-measurement defenseは異なる攻撃形式にわたって敵対的点群を信頼性高く検出できるか？
• RQ3 敵対的点群は異なるPC-Nets（例：PointNet、PointNet++、DGCNN）間および点群とgrid CNNs間でどの程度転移可能か？
• RQ4 defense-aware (EoTPG) 攻撃が検出性能と防御の頑健性に与える影響は？

主な発見

• Pointwise Gradient attacks can drastically reduce PointNet accuracy on ModelNet40 (e.g., down to 0% under certain budgets).
• Point-Detach and Point-Attach attacks are more physically feasible and can still substantially degrade accuracy, though typically less than PG.
• Momentum-enhanced gradients (MPG) improve attack transferability across PC-Nets.
• The proposed perturbation-measurement defense detects the majority of adversarial examples, with DDR values often exceeding 60–90% depending on settings and corruptions.
• Defense AUROC against vanilla PG and EoTPG attacks remains strong for several perturbation-measurement configurations, demonstrating robustness against defense-targeted attacks.
• Adversarial examples show notable transferability between PC-Nets, and there is analyzed transferability between point clouds and grid CNNs.