[Paper Review] IF-Defense: 3D Adversarial Point Cloud Defense via Implicit Function based Restoration

Ziyi Wu, Yueqi Duan+3 more|arXiv (Cornell University)|Oct 11, 2020

Adversarial Robustness in Machine Learning42 references32 citations

TL;DR

IF-Defense restores clean 3D point clouds from attacked ones by optimizing point coordinates under geometry-aware and distribution-aware constraints via implicit function surfaces, achieving state-of-the-art defense across multiple point-cloud networks.

ABSTRACT

Point cloud is an important 3D data representation widely used in many essential applications. Leveraging deep neural networks, recent works have shown great success in processing 3D point clouds. However, those deep neural networks are vulnerable to various 3D adversarial attacks, which can be summarized as two primary types: point perturbation that affects local point distribution, and surface distortion that causes dramatic changes in geometry. In this paper, we simultaneously address both the aforementioned attacks by learning to restore the clean point clouds from the attacked ones. More specifically, we propose an IF-Defense framework to directly optimize the coordinates of input points with geometry-aware and distribution-aware constraints. The former aims to recover the surface of point cloud through implicit function, while the latter encourages evenly-distributed points. Our experimental results show that IF-Defense achieves the state-of-the-art defense performance against existing 3D adversarial attacks on PointNet, PointNet++, DGCNN, PointConv and RS-CNN. For example, compared with previous methods, IF-Defense presents 20.02% improvement in classification accuracy against salient point dropping attack and 16.29% against LG-GAN attack on PointNet. Our code is available at https://github.com/Wuziyi616/IF-Defense.

Motivation & Objective

• Address vulnerability of 3D point cloud networks to adversarial attacks that perturb geometry and surface

Proposed method

• Pre-process input with Statistical Outlier Removal (SOR) to mitigate extreme perturbations
• Train an implicit function network on clean data to estimate object surfaces and guide restoration
• Optimize input point coordinates by minimizing a geometry-aware loss that aligns points to the inferred surface
• Apply a distribution-aware loss that maximizes distances among k-nearest neighbors to promote uniform point distribution
• Two implementation variants: re-meshing based IF-Defense (via marching cubes and mesh sampling) and optimization based IF-Defense (direct point-coordinate optimization)
• Evaluate across multiple backbones (PointNet, PointNet++, DGCNN, PointConv, RS-CNN) and attacks (perturbation, addition, k-NN, dropping, LG-GAN, AdvPC)
• Use ConvONet (and ONet as alternatives) for implicit surface representation and reconstruction

Experimental results

Research questions

• RQ1 How can adversarial perturbations that alter local geometry and surface be mitigated for 3D point clouds?
• RQ2 Can implicit-function based surface restoration improve robustness across diverse 3D architectures and attacks?
• RQ3 What is the relative effectiveness of re-meshing versus direct optimization for restoring clean point clouds under attack?
• RQ4 How does IF-Defense perform against strong adaptive and black-box adversaries?

Key findings

• IF-Defense consistently outperforms existing defenses against diverse 3D attacks across PointNet, PointNet++, DGCNN, PointConv, and RS-CNN
• Optimization-based IF-Defense with ConvONet often yields the best performance, outperforming re-meshing based variants
• ConvONet generally provides equal or superior results compared with ONet for implicit surface representation
• Adaptive attacks reduce defense efficacy, but Ours-Opt with ConvONet still maintains over 60% accuracy across tested models
• DUP-Net can be less effective on certain backbones due to sensitivity to local point distributions, whereas IF-Defense promotes uniform point distributions and robust graphs
• The abstract reports concrete gains, including 20.02% improvement against salient point dropping and 16.29% against LG-GAN on PointNet compared to prior methods