[논문 리뷰] Adversarial Attack and Defense on Point Sets

Jiancheng Yang, Qiang Zhang외 4명|arXiv (Cornell University)|2019. 02. 28.

Adversarial Robustness in Machine Learning참고 문헌 54인용 수 71

한 줄 요약

이 논문은 3D 포인트 클라우드에 대한 adversarial attacks를 연구하고, 세 가지 attack methods (pointwise gradient, point-detach, point-attach)을 제안하며, perturbation-measurement defense framework를 도입하고, 포인트 클라우드 네트워크 간 및 grid CNN과의 transferability를 분석한다.

ABSTRACT

Emergence of the utility of 3D point cloud data in safety-critical vision tasks (e.g., ADAS) urges researchers to pay more attention to the robustness of 3D representations and deep networks. To this end, we develop an attack and defense scheme, dedicated to 3D point cloud data, for preventing 3D point clouds from manipulated as well as pursuing noise-tolerable 3D representation. A set of novel 3D point cloud attack operations are proposed via pointwise gradient perturbation and adversarial point attachment / detachment. We then develop a flexible perturbation-measurement scheme for 3D point cloud data to detect potential attack data or noisy sensing data. Notably, the proposed defense methods are even effective to detect the adversarial point clouds generated by a proof-of-concept attack directly targeting the defense. Transferability of adversarial attacks between several point cloud networks is addressed, and we propose an momentum-enhanced pointwise gradient to improve the attack transferability. We further analyze the transferability from adversarial point clouds to grid CNNs and the inverse. Extensive experimental results on common point cloud benchmarks demonstrate the validity of the proposed 3D attack and defense framework.

연구 동기 및 목표

• Safety-critical task에서 Point Cloud Networks (PC-Nets)의 adversarial point clouds에 대한 견고성 평가.
• 3D 공간에서 가능하도록 점 집합을 교란하는 세 가지 새로운 공격 방법 개발.
• perturbation과 통계적 측정을 통해 적대적 포인트 클라우드를 탐지하는 유연한 방어 프레임워크 제안.
• PC-Nets 간 및 포인트 클라우드와 grid CNN 간의 adversarial 포인트 클라우드 transferability 분석.
• ModelNet40에서의 실증 검증을 통해 공격 효율성과 방어 성능 제시.

제안 방법

• Pointwise Gradient (PG) attack: iterative, gradient-guided perturbations under Chamfer distance; uses l2-normalized gradients for stability.
• Momentum-Enhanced Pointwise Gradient (MPG) attack: accumulates gradient with momentum to improve transferability.
• Point-Detach attack: removes critical points identified via Taylor expansion of pre-pooling features; uses a greedy, per-iteration re-evaluation strategy.
• Point-Attach attack: attaches new points with a gradient-based objective and a small Lagrange multiplier to constrain movement on the surface; iterates until budget Nd is reached.
• Defense via perturbation-measurement: applies multiple perturbations P(X) (Gaussian noise, quantization, random sampling) to create X′m, then measures statistics over outputs f(X′i).
• Metrics: AUROC and Defense Detection Rate (DDR) to evaluate detection; sets of measurements include Set-Indiv Variance (SIV), Confi-dence Averages (CoA), and Confi-dence Variance (CoV).
• Attack over defenses: EoTPG (Expectation-over-Transformation Pointwise Gradient) attack to target defense strategies and test robustness.

실험 결과

연구 질문

• RQ1 How vulnerable are PC-Nets to adversarial point clouds generated by gradient-guided perturbations and point attachment/detachment?
• RQ2 Can a perturbation-measurement defense reliably detect adversarial point clouds across different attack formulations?
• RQ3 How transferable are adversarial point clouds between different PC-Nets (e.g., PointNet, PointNet++, DGCNN) and between point clouds and grid CNNs?
• RQ4 What is the impact of defense-aware (EoTPG) attacks on detection performance and defense robustness?

주요 결과

• Pointwise Gradient attacks can drastically reduce PointNet accuracy on ModelNet40 (e.g., down to 0% under certain budgets).
• Point-Detach and Point-Attach attacks are more physically feasible and can still substantially degrade accuracy, though typically less than PG.
• Momentum-enhanced gradients (MPG) improve attack transferability across PC-Nets.
• The proposed perturbation-measurement defense detects the majority of adversarial examples, with DDR values often exceeding 60–90% depending on settings and corruptions.
• Defense AUROC against vanilla PG and EoTPG attacks remains strong for several perturbation-measurement configurations, demonstrating robustness against defense-targeted attacks.
• Adversarial examples show notable transferability between PC-Nets, and there is analyzed transferability between point clouds and grid CNNs.