[Paper Review] On Adversarial Robustness of 3D Point Cloud Classification under Adaptive Attacks

Jiachen Sun, Karl Koenig+3 more|arXiv (Cornell University)|Nov 24, 2020

Adversarial Robustness in Machine Learning54 references5 citations

TL;DR

This paper identifies that fixed pooling operations like MAX pooling undermine adversarial training (AT) in 3D point cloud classification, and proposes DeepSym—a learnable, sorting-based symmetric pooling layer that enhances robustness. DeepSym boosts adversarial accuracy to 47.0% under AT, outperforming standard PointNet by 28.5% and a strong baseline by 6.5%.

ABSTRACT

3D point clouds play pivotal roles in various safety-critical applications, such as autonomous driving, which desires the underlying deep neural networks to be robust to adversarial perturbations. Though a few defenses against adversarial point cloud classification have been proposed, it remains unknown whether they are truly robust to adaptive attacks. To this end, we perform the first security analysis of state-of-the-art defenses and design adaptive evaluations on them. Our 100% adaptive attack success rates show that current countermeasures are still vulnerable. Since adversarial training (AT) is believed as the most robust defense, we present the first in-depth study showing how AT behaves in point cloud classification and identify that the required symmetric function (pooling operation) is paramount to the 3D model's robustness under AT. Through our systematic analysis, we find that the default-used fixed pooling (e.g., MAX pooling) generally weakens AT's effectiveness in point cloud classification. Interestingly, we further discover that sorting-based parametric pooling can significantly improve the models' robustness. Based on above insights, we propose DeepSym, a deep symmetric pooling operation, to architecturally advance the robustness to 47.0% under AT without sacrificing nominal accuracy, outperforming the original design and a strong baseline by 28.5% ($\sim 2.6 imes$) and 6.5%, respectively, in PointNet.

Motivation & Objective

• To evaluate the true robustness of state-of-the-art defenses against adaptive attacks in 3D point cloud classification.
• To investigate how symmetric functions—specifically pooling operations—affect the effectiveness of adversarial training (AT) in 3D models.
• To identify limitations of fixed pooling (e.g., MAX, SUM) in AT and explore the benefits of parametric, learnable pooling mechanisms.
• To design and evaluate DeepSym, a novel symmetric pooling operation that improves adversarial robustness without sacrificing nominal accuracy.

Proposed method

• Design and execute 100% adaptive white-box attacks using projected gradient descent (PGD) to test the robustness of existing defenses.
• Perform systematic ablation studies comparing fixed pooling (MAX, SUM, MEDIAN) and parametric pooling (ATT, PMA, SoftPool, FSPool) under adversarial training.
• Propose DeepSym, a learnable, sorting-based pooling mechanism that integrates deep neural networks into the symmetric function to enhance feature aggregation.
• Integrate DeepSym into PointNet and other backbones, replacing standard pooling layers while maintaining permutation invariance.
• Train models using PGD-based adversarial training with varying attack steps (PGD-1, PGD-20, PGD-200) and evaluate on ModelNet10 and ModelNet40.
• Measure inference time, parameter count, and GPU memory usage to assess computational overhead of DeepSym.

Experimental results

Research questions

• RQ1 Are current defenses for 3D point cloud classification truly robust against adaptive attacks, or do they rely on gradient obfuscation?
• RQ2 How do fixed pooling operations (e.g., MAX, SUM) impact the effectiveness of adversarial training in 3D point cloud models?
• RQ3 Can parametric, learnable pooling mechanisms improve adversarial robustness under adversarial training?
• RQ4 What is the impact of sorting-based pooling on the robustness and accuracy of 3D point cloud classifiers?
• RQ5 Can a novel symmetric pooling layer be designed to enhance adversarial robustness without degrading nominal performance?

Key findings

• All evaluated state-of-the-art defenses, including DUP-Net and GvG-PointNet++, fail under adaptive attacks with 100% success rates, indicating they rely on gradient obfuscation.
• Fixed pooling operations such as MAX and SUM pooling inherently limit the effectiveness of adversarial training due to their lack of learnability and flexibility.
• Sorting-based parametric pooling operations, such as SoftPool and PMA, significantly improve adversarial accuracy by 7.3% over MAX pooling without harming nominal accuracy.
• DeepSym achieves 47.0% adversarial accuracy under PGD-200 on ModelNet40, representing a 28.5% improvement over standard MAX pooling and a 6.5% improvement over SoftPool.
• DeepSym maintains strong nominal accuracy (88.5%) on ModelNet10 and shows consistent robustness gains across multiple PGD attack settings and datasets.
• The computational overhead of DeepSym is modest—3.10ms inference time and 1.4M parameters—making it practical despite the added complexity.