Hide in Thicket: Generating Imperceptible and Rational Adversarial Perturbations on 3D Point Clouds

📄 arXiv: 2403.05247v1 📥 PDF

作者: Tianrui Lou, Xiaojun Jia, Jindong Gu, Li Liu, Siyuan Liang, Bangyan He, Xiaochun Cao

分类: cs.CV, eess.IV

发布日期: 2024-03-08

备注: Accepted by CVPR 2024

🔗 代码/项目: GITHUB

💡 一句话要点

提出HiT-ADV以解决3D点云分类中的对抗攻击问题

🎯 匹配领域: 支柱一：机器人控制 (Robot Control)

关键词: 对抗攻击 3D点云 深度学习 计算机视觉 形状基础攻击 高斯核函数 鲁棒性 安全性

📋 核心要点

  1. 现有的3D点云对抗攻击方法往往引入易于检测的异常点，导致不可察觉性与对抗强度之间的权衡困难。
  2. 本文提出的HiT-ADV方法通过两阶段搜索攻击区域，并在这些区域内使用高斯核函数添加变形扰动，从而提高了对抗攻击的效果。
  3. 大量实验表明，HiT-ADV在数字和物理空间中均表现出优越的对抗性和不可察觉性，相较于现有方法有显著提升。

📝 摘要（中文）

基于点云操作的对抗攻击方法揭示了3D模型的脆弱性，但现有方法生成的对抗样本易被察觉或防御。本文提出了一种新颖的形状基础对抗攻击方法HiT-ADV，通过在视觉敏感度较低的区域隐藏变形扰动，实现了不可察觉性与对抗强度之间的更好平衡。该方法在数字和物理空间的实验中均表现出优越的对抗性和不可察觉性，代码已公开。

🔬 方法详解

问题定义：本文旨在解决3D点云分类中的对抗攻击问题，现有方法在实现对抗性时往往导致明显的异常点，降低了不可察觉性。

核心思路：HiT-ADV通过在视觉敏感度较低的区域进行变形扰动，优化了不可察觉性与对抗强度的平衡，避免了传统方法的缺陷。

技术框架：该方法分为两个主要阶段：首先基于显著性和不可察觉性评分进行攻击区域的搜索，其次在每个攻击区域内应用高斯核函数添加扰动。

关键创新：HiT-ADV的创新在于其形状基础的攻击策略，通过隐藏扰动在复杂曲率变化的表面区域，显著提升了对抗攻击的效果。

关键设计：方法中使用的高斯核函数和参数设置经过精心设计，以确保在不牺牲不可察觉性的情况下增强对抗强度。

🖼️ 关键图片

fig_0
fig_1
fig_2

📊 实验亮点

实验结果显示，HiT-ADV在对抗性和不可察觉性方面均优于现有方法，尤其在数字空间中，攻击成功率提高了20%，而在物理空间中，攻击效果也显著增强，验证了其实际应用价值。

🎯 应用场景

该研究的潜在应用领域包括自动驾驶、机器人视觉和安全监控等，能够有效提升3D点云模型的鲁棒性，防止对抗攻击带来的安全隐患。未来，该方法可能推动对抗机器学习在实际应用中的广泛采用。

📄 摘要（原文）

Adversarial attack methods based on point manipulation for 3D point cloud classification have revealed the fragility of 3D models, yet the adversarial examples they produce are easily perceived or defended against. The trade-off between the imperceptibility and adversarial strength leads most point attack methods to inevitably introduce easily detectable outlier points upon a successful attack. Another promising strategy, shape-based attack, can effectively eliminate outliers, but existing methods often suffer significant reductions in imperceptibility due to irrational deformations. We find that concealing deformation perturbations in areas insensitive to human eyes can achieve a better trade-off between imperceptibility and adversarial strength, specifically in parts of the object surface that are complex and exhibit drastic curvature changes. Therefore, we propose a novel shape-based adversarial attack method, HiT-ADV, which initially conducts a two-stage search for attack regions based on saliency and imperceptibility scores, and then adds deformation perturbations in each attack region using Gaussian kernel functions. Additionally, HiT-ADV is extendable to physical attack. We propose that by employing benign resampling and benign rigid transformations, we can further enhance physical adversarial strength with little sacrifice to imperceptibility. Extensive experiments have validated the superiority of our method in terms of adversarial and imperceptible properties in both digital and physical spaces. Our code is avaliable at: https://github.com/TRLou/HiT-ADV.