[Paper Review] On The Adversarial Robustness of 3D Point Cloud Classification

Jiachen Sun, Karl Koenig+3 more|arXiv (Cornell University)|May 4, 2021

Adversarial Robustness in Machine Learning21 references14 citations

TL;DR

This paper identifies critical vulnerabilities in existing defenses for 3D point cloud classification, demonstrating 100% attack success rates against state-of-the-art methods. It reveals that symmetric pooling operations—particularly a novel deep symmetric pooling layer (DeepSym)—significantly enhance adversarial robustness under adversarial training, achieving 47.01% robust accuracy on PointNet without sacrificing clean accuracy.

ABSTRACT

3D point clouds play pivotal roles in various safety-critical fields, such as autonomous driving, which desires the corresponding deep neural networks to be robust to adversarial perturbations. Though a few defenses against adversarial point cloud classification have been proposed, it remains unknown whether they can provide real robustness. To this end, we perform the first security analysis of state-of-the-art defenses and design adaptive attacks on them. Our 100% adaptive attack success rates demonstrate that current defense designs are still vulnerable. Since adversarial training (AT) is believed to be the most effective defense, we present the first in-depth study showing how AT behaves in point cloud classification and identify that the required symmetric function (pooling operation) is paramount to the model's robustness under AT. Through our systematic analysis, we find that the default used fixed pooling operations (e.g., MAX pooling) generally weaken AT's performance in point cloud classification. Still, sorting-based parametric pooling operations can significantly improve the models' robustness. Based on the above insights, we further propose DeepSym, a deep symmetric pooling operation, to architecturally advance the adversarial robustness under AT to 47.01% without sacrificing nominal accuracy, outperforming the original design and a strong baseline by 28.5% (∼2.6×) and 6.5%, respectively, in PointNet.

Motivation & Objective

• To evaluate the real robustness of existing defenses against adversarial attacks in 3D point cloud classification.
• To investigate why adversarial training (AT) performs suboptimally in 3D point cloud models.
• To identify the role of pooling operations in determining the effectiveness of AT in 3D classification.
• To design a new pooling mechanism that enhances adversarial robustness without degrading clean accuracy.
• To achieve state-of-the-art robust accuracy in 3D point cloud classification under adversarial training.

Proposed method

• Conducting a systematic security analysis of state-of-the-art defenses using adaptive adversarial attacks to evaluate their robustness.
• Analyzing the behavior of adversarial training in 3D point cloud networks and identifying the necessity of symmetric pooling operations for robustness.
• Comparing fixed pooling operations (e.g., MAX pooling) with sorting-based parametric pooling to assess their impact on adversarial robustness.
• Proposing DeepSym, a learnable, symmetric pooling layer that preserves spatial order and enhances robustness through structured feature aggregation.
• Integrating DeepSym into PointNet and training the model under adversarial training to evaluate robustness and nominal accuracy.
• Evaluating the model on standard benchmarks using both clean and adversarial examples to measure robust accuracy and generalization.

Experimental results

Research questions

• RQ1 Are current defenses for 3D point cloud classification truly robust against adaptive adversarial attacks?
• RQ2 Why does adversarial training fail to achieve strong robustness in 3D point cloud classification models?
• RQ3 How do different pooling operations affect the robustness of models trained with adversarial training?
• RQ4 Can a learnable, symmetric pooling mechanism improve adversarial robustness in 3D point cloud networks?
• RQ5 To what extent can a new pooling design like DeepSym enhance robust accuracy without degrading clean accuracy?

Key findings

• All evaluated state-of-the-art defenses were broken by adaptive attacks with 100% success rate, indicating they lack real robustness.
• Fixed pooling operations like MAX pooling weaken the effectiveness of adversarial training in 3D point cloud classification.
• Sorting-based parametric pooling operations significantly improve adversarial robustness compared to fixed pooling.
• The proposed DeepSym layer achieves 47.01% robust accuracy on PointNet under adversarial training, outperforming the original model by 28.5%.
• DeepSym improves robust accuracy by 6.5% compared to a strong baseline, while maintaining the same clean accuracy.
• The study confirms that symmetric function design—specifically through pooling—is paramount to achieving high robustness under adversarial training in 3D point cloud models.