How to Defend 3D Point Clouds from Invisible Attacks?

3D point clouds are collections of points that model real objects, used by robots, self‑driving cars, and video games. Like any neural network, they can be fooled by adversarial perturbations: tiny, almost invisible changes that make the model misclassify. Universal Adversarial Perturbations (UAP) are especially dangerous because they work on any input. Traditional purification methods treat these errors point‑by‑point, ignoring that UAPs often form structured segments, like small curved shapes inserted into the cloud.

The new approach leverages model interpretability to spot the most influential regions. First, it identifies suspicious curvature segments using graph wavelet transforms. Then it transplants those segments onto clean clouds: if the transplant consistently triggers misclassification, the segment is flagged as adversarial. Finally, the flagged pieces are removed, preserving the genuine geometry.

Tests on two public datasets and four state‑of‑the‑art classifiers show a remarkable accuracy recovery, outperforming simpler methods. The system keeps real details intact, so models stay precise on clean data while resisting attacks. This strategy proves that accounting for the structure of UAPs and using model interpretability is the key to defending geometric networks from future threats.

The outcome is a smarter defense, ready to evolve with new attack types and protect applications that rely on 3D point clouds.

Universal Adversarial Perturbations (UAP) are noise vectors that, when added to an input, alter a classifier's decision regardless of the original content. In the point‑cloud domain, UAPs are not randomly scattered: they tend to form continuous segments with high curvature, exploiting geometric networks' sensitivity to local topological changes.\n\nThe proposed framework starts with an interpretability phase based on class gradients (e.g., Grad‑CAM for point clouds) to generate an importance map for each point. Then, the Graph Wavelet Transform (GWT) decomposes the cloud into spatial frequency bands, allowing isolation of regions with high curvature energy. These regions become candidates for containing UAPs.\n\nThe transplantation test involves moving each suspicious region onto a clean sample and evaluating the impact on prediction. If the transplant consistently triggers a misclassification, the region is labeled adversarial. This mechanism leverages the transferability property of UAPs: an adversarial segment retains its ability to fool the model across different geometric contexts.\n\nOnce identified, adversarial regions are removed or locally interpolated, preserving surface continuity. The entire pipeline runs in near‑linear time relative to the number of points, thanks to GWT efficiency and the limited number of candidate regions.\n\nExperiments assessed robustness using standard metrics (accuracy, F1‑score) and geometric preservation measures (Chamfer Distance, Earth Mover’s Distance). Results show an accuracy recovery exceeding 80% compared to point‑wise methods, with minimal degradation of clean cloud geometry.\n\nFuture work could extend the approach to more complex representations such as meshes or voxels and incorporate adaptive defense strategies that dynamically update segmentation criteria in response to emerging attack types.