[论文解读] Extending Adversarial Attacks and Defenses to Deep 3D Point Cloud Classifiers

Daniel Liu, Ronald Yu+1 more|arXiv (Cornell University)|Jan 10, 2019

Adversarial Robustness in Machine Learning参考文献 28被引用 18

一句话总结

本文研究了3D点云分类器的对抗鲁棒性，将2D图像中的对抗攻击方法（如FGSM和迭代梯度法）扩展至3D点云，采用PointNet和PointNet++模型。结果表明，这些模型对难以察觉的扰动具有脆弱性，但通过结构感知防御方法（如异常点移除和显著点过滤）可更易实现防御，这些方法利用点云的几何与拓扑特性来增强鲁棒性。

ABSTRACT

3D object classification and segmentation using deep neural networks has been extremely successful. As the problem of identifying 3D objects has many safety-critical applications, the neural networks have to be robust against adversarial changes to the input data set. There is a growing body of research on generating human-imperceptible adversarial attacks and defenses against them in the 2D image classification domain. However, 3D objects have various differences with 2D images, and this specific domain has not been rigorously studied so far. We present a preliminary evaluation of adversarial attacks on deep 3D point cloud classifiers, namely PointNet and PointNet++, by evaluating both white-box and black-box adversarial attacks that were proposed for 2D images and extending those attacks to reduce the perceptibility of the perturbations in 3D space. We also show the high effectiveness of simple defenses against those attacks by proposing new defenses that exploit the unique structure of 3D point clouds. Finally, we attempt to explain the effectiveness of the defenses through the intrinsic structures of both the point clouds and the neural network architectures. Overall, we find that networks that process 3D point cloud data are weak to adversarial attacks, but they are also more easily defensible compared to 2D image classifiers. Our investigation will provide the groundwork for future studies on improving the robustness of deep neural networks that handle 3D data.

研究动机与目标

• 研究PointNet和PointNet++等3D点云分类器对对抗攻击的脆弱性。
• 将现有的2D对抗攻击方法（如FGSM和迭代梯度攻击）扩展至3D点云数据。
• 评估跨不同3D点云模型的黑箱迁移攻击的有效性。
• 提出并分析利用3D点云几何与拓扑特性的简单、结构感知防御方法。
• 理解3D点云分类器为何可能在对抗样本方面天然比2D图像分类器更具鲁棒性。

提出的方法

• 通过计算相对于点坐标梯度，并在$L_2$或$L_``\infty$范数下应用扰动，将白盒对抗攻击（如FGSM、迭代梯度法）适配至3D点云。
• 通过在一种模型上生成对抗样本并在另一模型上测试其成功率，扩展黑箱迁移攻击，利用不同架构间的可迁移性。
• 提出包括异常点移除、显著点过滤和对抗训练在内的防御方法，以提升鲁棒性。
• 利用PointNet和PointNet++中的最大池化操作，使某些点对基于梯度的攻击‘不可见’，从而降低其扰动有效性。
• 通过测量在干净点云与预处理点云上攻击的成功率，评估感知度与鲁棒性，来评估防御效果。
• 分析点云的内在几何结构以及最大池化在增强防御能力中的作用。

实验结果

研究问题

• RQ1 3D点云分类器（如PointNet和PointNet++）在从2D图像设置中适配的对抗攻击下，其脆弱性程度如何？
• RQ2 当攻击者无法访问模型参数时，黑箱迁移攻击在欺骗3D点云分类器方面的有效性如何？
• RQ3 简单的、结构感知的防御方法（如移除异常点或显著点）是否能显著提升对对抗扰动的鲁棒性？
• RQ4 尽管对基于梯度的攻击具有相似的脆弱性，为何3D点云分类器比2D图像分类器更容易防御？
• RQ5 PointNet中的最大池化等架构组件如何促进对抗鲁棒性？

主要发现

• 白盒对抗攻击（如FGSM和迭代梯度法）可对3D点云施加极小的、难以察觉的扰动，从而成功误导分类。
• 黑箱迁移攻击表明，在一种3D模型（如PointNet）上生成的对抗样本可成功欺骗另一模型（如PointNet++），证实了3D空间中存在可迁移性。
• 对抗训练显著提升了鲁棒性，经对抗训练的PointNet可抵御来自正常训练模型的攻击。
• 异常点移除和显著点过滤通过将输入数据移离决策边界并恢复局部点云结构，降低了对抗攻击的成功率。
• PointNet和PointNet++中的最大池化操作使某些点对基于梯度的攻击‘不可见’，因为这些点接收零梯度，无法被直接扰动。
• 干净点云中的几何先验、最大池化以及点过滤的结合，使得3D点云分类器即使在对攻击具有相似脆弱性的情况下，仍比2D图像分类器更具可防御性。