On The Adversarial Robustness of 3D Point Cloud Classification
Authors: Jiachen Sun
Karl Koenig
Yulong Cao
Qi Alfred Chen
Zhuoqing Mao
Venue:  (2021)
Keywords: Adversarial Machine Learning
Point Cloud Classification
Adversarial Training

Abstract: 3D point clouds play pivotal roles in various safety-critical fields, such as autonomous driving, which desires the corresponding deep neural networks to be robust to adversarial perturbations. Though a few defenses against adversarial point cloud classification have been proposed, it remains unknown whether they can provide real robustness. To this end, we perform the first security analysis of state-of-the-art defenses and design adaptive attacks on them. Our 100% adaptive attack success rates demonstrate that current defense designs are still vulnerable. Since adversarial training (AT) is believed to be the most effective defense, we present the first in-depth study showing how AT behaves in point cloud classification and identify that the required symmetric function (pooling operation) is paramount to the model's robustness under AT. Through our systematic analysis, we find that the default used fixed pooling operations (e.g., MAX pooling) generally weaken AT's performance in point cloud classification. Still, sorting-based parametric pooling operations can significantly improve the models' robustness. Based on the above insights, we further propose DeepSym, a deep symmetric pooling operation, to architecturally advance the adversarial robustness under AT to 47.01% without sacrificing nominal accuracy, outperforming the original design and a strong baseline by 28.5% ($\sim 2.6 \times$) and 6.5%, respectively, in PointNet. 

Under review as a conference paper at ICLR 2021
ON THE ADVERSARIAL ROBUSTNESS OF 3D POINT CLOUD CLASSIFICATION
Anonymous authors
Paper under double-blind review
ABSTRACT
3D point clouds play pivotal roles various safety-critical fields, such as au- tonomous driving, which desires the corresoondngg deep neural networks to be robust to adversarial perturbations. Though a few defenses against adversarial point cloud classification have been proposed, it remains unknown whether they can provide real robustness. To this end, we perform the first security analysis state-of-the-art defenses and design adaptive attacks them. Our 100% adaptive attack success rates demonstrate that current defense designs are still vulnerable. Since adversarial training (AT) is believed to be the most effective defense, we present the first in-depth study showing how AT behaves in point cloud classi- fication and identify that the required symmetric function (pooling operation) is paramount to the model's robustness under AT. Through our systematic analysis, we find that the default used fixed pooling operations (e.g., MAX pooling) gener- ally weaken AT's performance in point cloud classification. Still, sorting- -based parametric pooling operations can significantly improve the models' robustness. Based on the above insights, further propose DeepSym, deep symmetric pooling operation, to architecturally advance the adversarial robustness under AT to 47.0% without sacrificing nominal accuracy, outperforming the original design and a strong baseline by 28.5% (~~ 2.6x) and 6.5%, respectively, in PointNet.
INTRODUCTION
Despite the prominent achievements that deep neural networks (DNN) have reached in the past decade, adversarial attacks (Szegedy et al., (2013) are becoming the Achilles' heel in modern deep learning deployments, where adversaries generate imperceptible perturbations mislead the DNN models. Numerous attacks have been deployed various 2D vision tasks, such as classifica- tion (Calinni & Wagner (017). object detection (Song et al.) 2018), and segmentation (Xie et al.) 2017 Since adversarial robustness is critical feature, tremendous efforts have been devoted to de- fending against 2D ad versarial images (Guo et al. 2017; Papernot et al. 2016 Madry et al. 2018). However, AAhhlly et al. 2018) suggest that most of the current countermeasures essentially try to obfuscate gradients, which give false sense of security. Besides, certified methods (Zhang al.) 2019) often provide a lower bound of robustness, which are not helpful in practice. Therefore, adversarial training is widely believed the most and only effective defense solution.
The emergence of 3D point cloud applications in safety-critical areas like autonomous driving raises public concerns about their security of DNN pipelines. A few studies (Xiang et al., [011 Cao al. 2019 Sun et al. 2220) have demonstrated that various deep learning tasks on point clouds are indeed vulnerable adversarial examples. Among them, point cloud classification models have laid solid foundations upon which other complex models are built (Lang et al. 2019: Yu et al. 2018a). While seems intuitive to extend convolutional neural networks (CNN) from 2D 3D for point cloud classification, it is actually not trivial task. The difficulty mainly inherits from that point cloud is an unordered set structure that CNN cannot handle. Modern point cloud classification models (Qi ct al. 2017a Zaheer et al., 2017) address this problem by leveraging symmetric function, which is permutation-inaariie
to the order of points, to aggregate local features, as shown in Figure
Recently, a number of countermeasures have been proposed to defend against 3D adversarial point clouds. However, the failure of gradient obfuscation based defenses in the 2D space motivates us to re-think whether current defense designs provide real robustness for 3D point cloud classification. Especially, DUP-Net (Zhou et al. 2019) and PoiGtteetttt+ (Dong et al. 2020a) claim to improve the adyersarial robustness significantly. However, find that both defenses belong gradient

---

Under review as a conference paper at ICLR 2021
obfuscation through our analysis, hence further design white-box adaptive attacks to break their robustness. Unfortunately, our 100% attack success rates demonstrate that current defense designs are still vulnerable.
As mentioned above, adversarial training (AT) is considered the most effective defense strategy: we thus perform the first rigorous study of how AT behaves in point cloud classification by exploiting projected gradient descent (PGD) attacks (Madry et al.] 2018). We identify that the default used symmetric function weakens the effectiveness of AT. Specifically, popular models (e.g., PointNet) utilize fixed pooling operations like MAX and SUM pooling as their symmetric functions to aggregate features. Different from CNN-based models that usually apply pooling operations with small slid- ing window (e.g. 2 x 2), point cloud classification models leverage such fixed pooling operations to aggregate features from a large number of candidates (e.g, 1024). We find that those fixed pooling operations inherently lack flexibility and learnability, which are not appreciated by AT. Moreover, recent research has also presented parametric pooling operations in set learning (Wang et al. 2020) Zhang et al. 2020). which also preserve permutation-innaaiaane atically anal yze point cloud classification models' robustness with parametric pooling operations under AT. Experimental results show that the sorting porting-based pooling design benefits AT well, which vastly outperforms MAX pooling, for instance, in adversarial accuracy by 7.3% without hurting the nominal accuracy
We take step further to system-
Lastly, based on our experimental insights, we propose DeepSym, a sorting-based pooling opera- tion that employs deep learnable layers, to architecturally advance the adversarial robustness of point cloud classification models under AT. Experimental results show that DeepSym reaches the best ad- versarial accuracy in all chosen backbones, which on average, a 10.8% improvement compared to the default architectures. We also explore the limits of DeepSym based on PointNet due to its broad adoption (Guo et al., 2020). We obtain the best robustness on ModelNet40, which achieves the ad- versarial accuracy of 47.0%, significantly outperforming the default MAX pooling design by 28.5% (~ 2.6x). In addition, we demonstrate that PointNet with DeepSym also reaches the best adversar- ial accuracy of 45.2% under the most efficient AT on ModelNer10 (Wu et al. 2015), exceeding MAX pooling by 17.9% (~ 1.7x).
2 BACKGROUND AND RELATED WORK
3D point cloud classification. Early works attempt to classify point clouds by adapting deep learn- ing models in the 2D space (Su et al. 2015: Yu et al. 2018b). DeepSets (Zaheer al. 2017) and PointNet (Qi et al.] (017a) are the first to achieve end-to-end learning on point cloud classification and formulate general specification (Figure 2 for point cloud learning. PointNet++ (Qi et al. 2017b) and DGCNN (Wang et al., (211)) build upon PointNet set abstraction to better learn local Teatures. Lately, DSS (Maron al. 2020) generalizes DeepSets enable complex functions in set learning. Besides, ModelNet40 (Wu et al. 2015) is the most popular dataset for benchmarking point cloud classification, which consists of 12.3II CAD models belonging to 40 categories. The numerical range of the point cloud data is normalized to [-1, 1] in ModelNet40.
Adversarial attacks and defenses on point clouds. Xiang et al. (2019) perform the first study to extend C&W attack (Carlini & Wagner (017) to point cloud classification, |Wen et al. (2019)
improve the loss function in C&W attack to realize attacks with smaller perturbations and Hamdi let al. (2019) present black-box attacks
point cloud classification. Recently, Zhou et al. (2019)
and Dong et al. 2020a) propose to defend against adversarial point clouds by input transformation and adversarial detection. Besides, [iu et al. (2019) conduct a preliminary investigation extending countermeasures in the 2D space to defend against simple attacks like FGSM (Goodfellow et al.) 2014) point cloud data. In this work, first design adaptive attacks to break existing defenses and analyze the adversarial robustness of point cloud classification under adversarial training.
3 BREAKING THE ROBUSTNESS OF EXISTING DEFENSES
3.1 ADAPTIVE ATTACKS ON DUP-NET
DUP-Net (ICCV'19) presents a denoiser layer and upsampler network structure to defend against adversarial point cloud classification. The denoiser layer g X + X' leverages kNN (k-nearest
In this paper, we nominal and adversarial accuracy denote the model's accuracy on clean and adver- sarially perturbed data, respectively.
2

---

Under review as a conference paper at ICLR 2021
neighbour) for outlier removal. Specifically, the kNN of each point z; in point cloud X is defined as knn( k) so that the average distance d, of each point æ; to its kNN is denoted as:
di
Σ
I - 2zl12, i == {1, .
(1)
(k)
where n is the number of points. The mean P E de and standard deviation
V Ei=((: n12 of all these distances computed to determine distance threshold as po-t-roo to trim the point clouds, where a is a parameeer As a result, the denoised point cloud is rep- resented X'
[v. d; < 1 a }). The denoised point cloud X' will be further fed into PU-Net (Yu et al. 2018a), defined as p X' - x", to upsample X' to a fixed number of points. Combined with the classifier f. the integrated DUP-Net can be noted as (f p o (X)) The hypoth- esis is that the denoiser layer will eliminate the adversarial perturbations and the upsampler network will re-project the denoised off-manifold point cloud to the natural manifold.
Analysis. The upsampler network p (i.e., PU-Net) is differentiable and can be integrated with the classification network f. Therefore, f o p is clearly vulnerable to gradient-based adaptive at- tacks. Although the denoiser layer is not differentiable, it can be treated as deterministic masking: M(x;)) 1a; <uttov so that the gradients can still flow through the masked points. By involving M(r,) ) into the iterative optimization process: Ve (X) la.= R Va,
similar to BPDA (Athalye et al. 2018), attackers may still find adversarial examples.
Experimentation. We leverage the open-sourced codebase of DUP-Net for experimentation. Specifically, a PointNet (Qi et al. 2017a) trained on ModelNet40 is used as the target classifier f. For the PU-Net, the upsampled number of points is 2048, and the upsampling ratio is 2. For the adaptive attacks, we exploit targeted L norm-based C&W attack and untargeted - norm- nase- PGD attack with 200 iterations (PGD-200). Detailed setups are elaborated in Appendix A.
Table 1: Adversarial accuracy under adaptive attacks on PU-Net and DUP-Net. For the denoiser layer g. k = 2
and a = 1.1 are set the same as Zhou et al. (2019) i denotes the attack in the original paper.
Adversarial Accuracy
Mean L Norm Distance
Attack Method
PU-Net (f p)
DUP-Net (f o o g)
PointNet (f)
Clean point cloud
88.3%
87.5%
86.3%
0.0
C&W attack on f C&W attack fop
0.0%
23.9%
84.5%
0.77
2.3%
0.0%
74.7%
0.71
Adaptive attack on f pop g
1.1%
0.8%
0.0%
1.62
PGD attack (e = 0.01)
7.1%
5.9%
5.4%
PGD attack (e = 0.025)
3.5%
2.8%
2.1%
PGD attack (e = -0.55)
1.3%
1.0%
0.8%
PGD attack (c 0.075)
0.0%
0.0%
0.0%
Discussion. As shown in Table D adaptive C&W attacks achieve 100% success rates on DUP-Net.
Though the mean distance of adversarial examples targeting DUP-Net is larger than those targeting PU-Net, they are almost indistinguishable by human perception, visualized in Appendix A.2 We find that naive PGD attacks are also effective since the upsampler network is sensitive to T norm-based perturbations. The design of DUP-Net is similar to ME-Net (Yang al., 2019) in the 2D space, which recently has been shown vulnerable to adaptive attacks (Tramer et al. 2020). We hereby demonstrate that such input transformation-baat defenses cannot offer real robustness to point cloud classification, either.
3.2 ADAPTIVE ATTACKS ON GYG-POINTNET++
GyG-PointNet++ (CVPR' 20) introduces gather vectors in the 3D point clouds as an adversarial indicator. The original PointNet++ aggregates local features f. hierarchically to make final classifi- cation. Gather vectors v, are learned from local features f, to indicate the global center c; of a point cloud sample. If the indicated global center c; is far away from the ground-truth global center Cg. the corresponding local feature f. will be masked out:
C, Tgi + v.
M; 1 llc, i
Ff -M)
(2)
3

---

Under review as a conference paper at ICLR 2021
(a) L' n'noom-basee adaptive C&W attack DUP-Net
(c) L' norm-bssed adaptive PGD attack on GvG-PointNer++
norn-based adaptive PGD attack DUP-Net
(d) 1." 1."norn-bsed aduptive PGD attack on MuG-PooimNet-
Figure I: Sampled visualizations of adversarial examples generated by adaptive attacks both defenses (E 0.05 and 6 0.16). More visualizations can be found in Appendix A.2
where Tei is the geometry center of the local point set, r is the distance threshold to mask the local feature, and F, is the cleaned feature set for final classification. To train GvG-PointNet++, it is necessary to optimize a surrogate loss to correctly learn the gather vectors besides the cross-entropy (xent) loss:
Liotal Lzent + X Lgather Lyather
Elle ll -
where n'' is the number of local features and À is hyper-parameteer Thus. GvG-PointNet++ essen- tially applies self-attention to the local features and relies on it for robustness enhancement.
Analysis. Dong al. (200aa) evaluate white-box adversaries GvG-PointNet++ with naïve L norm-based PGD attacks. Specifically, only Lzent is utilized in the adversarial optimization process so that the masking M, will hinder the gradient propagation. However, since M, is learned from the network itself, it is highly possible to further break this obfuscation with Lgather considered. The adaptive attack be then formulated as optimization problem with the loss function:
Lado Lzent gatther
where 3 is strive enlarge the adversarial effect but also minimize the perturbations on gather vectors. We also find that GvG-PointNet++ is by design vulnerable to PGD attacks on Lgather such perturbations will potentially affect most gather vector predictions to make gi masked out so that insufficient for final classification.
By maximizing Lade with I norm-based PGD attacks, adversaries
Experimentation. We train GvG-PointNet++ based on single-scale grouped PointNet++ (Qi et al, 2017b) on ModelNet40 and set 0.08 and À suggested by Dong et al. (2020a). The model is trained by Adam (Kingma & Ba 2014) optimizer with 250 epochs using batch size 16, and the initial learning rate is 0.01. For the adaptive attack,
10-step binary search to find appropriate 3. The setup of L norm-based PGD attacks is identical to Dong et al. (2020a), and we also leverage 0 norm-based PGD-200 the evaluation. Detailed setups are elaborated in Appendix A.I
Table 2:
Adversarial accuracy under L norm-based adaptive attacks GvG-PointNett+. and are the perturbation boundaries. denotes the attack in the original paper.
Adversarial Accuracy (I,²)
Adversarial Accuracy (I.2)
Target Loss
0.01
= 0.025
<= 0.05
0.075
8 0.08
= 0.16
0 = 0.32
Exenti 30.6%
21,4%
5,4%
1.8%
25.2%
16.9%
15.4%
Lado 20.1%
12.6%
2.2%
0.0 %
7.5%
4.4%
2.1
Lgather 17.9%
8.1 1
0.0%
0.0 %
8.5%
4.1%
2.7%
Discussion. As shown in Table 2 both adaptive PGD attacks achieve high success rates on GyG- PointNtt++. we also observe that the - norm-based PGD attack is more effective on Cgather since L norm perturbations assign the same adversarial budget to each point, which can easily impact a large number of gather vector predictions. However, it is hard for the I norm-based PGD attack to influence so many gather vector predictions because it prefers to perturb key points rather than the whole point set. GvG-PointNet+++ leverages DNN to detect adversarial perturbations, which similar to NagNet (Meng & Chen 2017) in the 2D space. We validate that adversarial detection also fails to provide real robustness under adaptive white-box adversaries in point cloud classification.
ADVERSARIAL TRAINING WITH DIFFERENT SYMMETRIC FUNCTIONS
We have so far demonstrated that state-of-the- art defenses against 3D adversarial point clouds are still vulnerable to adaptive attacks. While gradient obfuscation cannot offer real adversarial robust-
4

---

Under review as a conference paper at ICLR 2021
din
d
global features
20
SUM Pooling
Xent Loos Valuer
16
MEDIAN Paoling
Rooling
G+
12
78
05
classification scores
12 16
Stop Attack (e 0.055
Figure The general specification of point cloud classification (ar
Figure 3: Xent loss of PGD attack on PointNet with three fixed poot- ing operations (each value is aver- aged over 100 runs from random starting points).
o o (x), where is the number of points, d, is the number
of hidden dimensions in the i-th feature map, Φ(-) represents the commutation-cquivrriin layers, p(-) denotes the column- symmetric (permutationiinvaiian)) function, and (-) is the fully connected layer.
ness, ad adversarial training (AT) is widely believed to be the most effective method. In this section, we conduct the first thorough study showing how AT performs in point cloud classification.
4.1 ADVERSARIAL TRAINING PRELIMINARIES
Madry et al. 2018) formulate AT as a paddle point problem in Equation 5 where D is the under- lying data distribution, L(..,-) is the loss function, is the training data with its label y. is the adversarial perturbation, and S denotes the boundary of such perturbations.
arg min E(eyy)D max L(x + e, y. 0) eES
(5)
0
Adversarial training setups.
We choose PointNet (Qi et al. (017a), DeepSets (Zaheer et al. 2017),
and DSS MMaron al. 2020) as the backbone networks. As shown in Section and demonstrated
by Madry et al. (2018). L norm-based PGD attack tends to be a universal first-order ad adversary.
Thus, we select PGD-7 into the training recipe, and empirically set the maximum per-point per- turbation = 0.05 out of the point cloud range [-1, 1J. We follow the default PointNet training setting to train models on the ModelNet40 training set. In the evaluation, we utilize PGD-200 to assess their robustness
the ModelNet40 validation set with the same ad adversarial budget e 0.05. Meanwhile, we also report the nominal accuracy on the clean validation set. Each PGD attack starts from random point in the allowed perturbation space. More details can be found in Appendix
4.2 ADVERSARIAL TRAINING WITH FIXED POOLING OPERATIONS
As shown in Figure modern models fundamentally follow a general specification (a o p 4 (X) for point cloud classification. ((-) represents set of permutation-eqiivrraat layers to learn lo- cal features from each point. p(-) column-wise symmetric (permutation-invanl invarrinn)) function to aggregate the learned local features into global feature, and (r-) are fully connected layers for final classification. PointNet, DeepSets, and DSS leverage different (--) for local feature learning, but all depend on fixed pooling operations as their p(-). Specifically, MAX pooling is by default used in DeepSets (for point cloud classification) and PointNet (Zaheer et al.) 2017 Qi et al. 2017a), while DSS utilizes SUM pooling (Maron et al. 2020). We also additionally select MEDIAN pooling due to its robust statistic feature (Huber) 2004). Though models with fixed pooling operations have achieved satisfactory accuracy under standard training, they face various difficulties under AT. As shown in Table models with MED IADIAN pooling achieve better nominal accuracy among fixed pool- ing operations, but much worse adversarial accuracy, while SUM pooling performs contrarily. Most importantly, none of them reach a decent balance of nominal and adversarial accuracy.
Table 3: Adversarial robustness of models with fixed pooling operations under PGD-200 at 0.05.
Nominal Accuracy DeepSets
Adversarial Accuracy DeepSets
Pooling Operation
PointNet
DSS
PointNet
DSS
MAX
80.5%
71.1%
78.8%
16. 16.1%
21.8%
21.5%
SUM MED LAN
76.3%
54.1%
73.3%
25.1 %
24.8% %
25.3%
84.6%
72.7%
82.4%
7.5%
11.0%
9.3%
Analysis. AT consists of two stages: 1) inner maximization to find the worst adversarial examples and 2) outer minimization update model parameters. Fixed pooling operations essentially leverage
5

---

Under review as a conference paper at ICLR 2021
dm
dm
Altamco
Column-wo wii--iiis Sorting
7
(a) Attention- pooling operations apply self-attention to cach point-level feature vector f.. The Icarned weight o, is multiplied with each element in fi, and the aggregated
(b) Sorting- baanngg-baeeddd pooling operations sort cach di- feature set into an or- dered matrix F to which complex operations (e.g.,
mension to re-organize
feature is computed by column-wise summation.
CNN) can be applied aggregate fcatures.
Figure 4: Design philosophy of attention-based and sorting-hased pooling operations.
a single statistic to represent the distribution of a feature dimension (Murray & Perronnin] 2014). Although MEDIAN pooling, as a robust statistic, intuitively should enhance the robustness. we find it actually hinders the inner maximization stage from making progress. We utilize L norm-based PGD attack maximize the xent loss of standard trained model with three fixed pooling operations. Figure 3 validates that MEDIAN pooling takes many more steps maximize the loss. Therefore, MEDIAN pooling fails to find the worst adversarial examples in the first stage with limited steps. Though MAX and SUM pooling
able to achieve higher loss value, they encounter challenges in the second stage. MAX pooling backward propagates gradients to a single point at each dimension so that the rest n-1 features do not contribute to model learning. Since n is oftentimes a large number (e.g., 1024), the huge information loss and non-smoothness will fail AT (Xie et al.) 2020). While SUM pooling realizes a smoother backward propagation, it lacks discriminability because by applying the same weight to each element, the resulting representations are strongly biased by the adversarial perturbations. Thus, with SUM pooling, the models cannot generalize well clean data.
4.3
ADVERSARIAL TRAINING WITH PARAMETRIC POOLING OPERATIONS
Recent studies have also presented trainable parametric pooling operations for different tasks in set learning, e.g., multiple instance learning, which are also qualified to be the symmetric function p(-) in point cloud classification models. Thus, we first group them into two classes: 1) attention- based and 2) sorting-based pooling, and further benchmark their robustness under AT in point cloud classification. It is worth noting that none of those parametric pooling operations are proposed to improve the adversarial robustness, and we are the first to conduct such an in-depth analysis of how they behave as the symmetric function under AT in point cloud classification.
4.3.1 ATTENTION-BASE BASED POOLING OPERATIONS
An attention module can be abstracted as mapping a query and set of key-value pairs an output, making the models learn and focus on the critical information (Bahdanau et al. 2014). Figure 4(a) shows the design principle of attention-based pooling, which leverages compatibility function to learn point-level importance. The aggregated global feature is computed as a column- -iss weighted sum of the local features. Two attention- based pooling operations, ATT and ATT-GATE, are first proposed for multiple instance learning (Ilse et al. 2018). Let IF {f1, f2, ..., fn} be set of features, ATT aggregates the global feature by:
exp(w tanh(V D
a. f: g
(6)
Σド exp(w tanh(V f)
where E BX and V E R 1.xdm are learnable parameters. ATT-GATE improves the expressive- ness of ATT by introducing another non-linear activation sigmoid(-) and more trainable parameters into weight learning. Furthermore, PMA (Lee et al. 2019) is proposed for general set learning, which leverages multi-head attention (Vaswani et al. 2017) for pooling. We detail the design and our im- plementation of ATT, models with these attention based pooling operations.
and PMA in Appendix B.3] and adversarially train the backbone
4.3.2 SORTING- BASED POOLING OPERATIONS
Sorting has been recently considered in the set learning literature due to its permutation-ine invariann characteristic, shown in Figure 4(b) Let F E Raxdd be the matrix version of the feature set IF,

---

Under review as a conference paper at ICLR 2021
FSPool (hhang et al. 2020) aggregates F by deature-wise sorting in descending order:
Fi, = (F.)): 95 Σ W F.
where W E Raxdm are learnable parameters. Therefore, the pooled representation is column-wise weighted sum of F. SoftPool WWng et al. 2020) re-organizes F so that its j-th dimension is sorted in descending order, and picks the top k point-level embeddings Fj E _ to further form F Fi. ...... F. F Then, SoftPool applies CNN to each Fj + gj so that the pooled Implementation details of SoftPool are elaborated in
representation is g 99 "2.............................. .a.............................. It... Appendix B.3 We also adversarially train the backbone models with FSPool and SoftPool.
Table 4: Adversarial robustness of models with parametric pooling operations under PGD-200 at e 0.05.
Nominal Accuracy
Adversarial Accuracy
Pooling Operation
PointNet
DeepSets
DSS
PointNet
DeepSets
DSS
ATT
73.5%
52.3%
72.8%
22. 22.1%
23.2%
23.9%
ATT-GATE
75.1%
63.9%
73.3%
23.2%
24.8%
26.1%
PMA
73.9%
51.9%
72.5%
25.4%
20.9%
23.9%
FSPool
82.8% %
73.8%
81.5%
29.8%
25.3%
26. 1%
SoftPool
79.8%
72.1%
80.2%
30.1%
24.9%
26.5%
DeepSyn (ours)
82.7%
74.2%
81.6%
33.6%
26.9%
31.4%
4.3.3 EXPERIMENTAL ANALYSIS
Table shows the results of AT with different parametric pooling operations. To meet the require- ment of permutation-invarian
attention-based pooling is restricted to learn point-level importance. For example, ATT applies the same weight to all dimensions of a point embedding. As result, at- tention barely improves the pooling operation's expressiveness as essentially re-projects the point cloud to single dimension (e.g., f. significantly limits their discriminability. Therefore, little useful information can be learned from the attention module, explaining why they perform similarly to SUM pooling that applies the same weight to each point under AT, as shown Table Sorting-based pooling operations naturally maintain permutation-invariance as sorl4()) re-organizes the unordered feature set IF to an ordered
in ATT) and differentiates them based on it, which
feature map F. Thus, FSPool and SoftPool are able further apply feature linear trans- formation and CNN. The insight is that feature dimensions are mostly independent of each other, and each point expresses to a different extent in every dimension. By employing feature-wise learn- able parameters, the gradients also flow smoother through sorting-based pooling operations. Table validates that sorting-basd pooling operations achieve much better adversarial accuracy, e.g., on average, 7.3% better than MAX pooling while maintaining comparable nominal accuracy.
IMPROVING THE ADVERSARIAL ROBUSTNESS WITH DEEPSYM
In the above analysis, we have shed light on that sorting-based pooling operations can benefit AT in point cloud classification. We hereby explore to further improve the sorting-basee pooling design in- spired by existing arts. First, we notice that both F ooool and SoftPool Pool apply sorty(-) (-) right after a ReLU function (air & Hinton 2010). However, ReLU leads to some neurons being zero (Good- fellow et al.) 2016), which makes sort (-) unstable. Second, recent studies have shown that AT appreciates deeper neural networks (Xie Yuille, 2019). Nevertheless, FSPool only employs one linear layer to aggregate features, and SoftP requires dm to be small number. The reason is that scaling up the depth these existing sorting- -based pooling designs requires exponential growth of parameters, which will make the end-to-end learning intractable.
To address the above limitations, we propose a simple yet effective pooling operation, DeepSym, that embraces the benefits of sorting-based pooling and also applies deep learnable layers to the pooling process. Given feature set after ReLU activation F R, nxdm DeepSym first applies another linear transformation to re-map F into Radd that f W. fi where W E Rd xdm. and F' {f fí.... ..). Let F' be the matrix version of F', DeepSym also sorts F' a descending order (Equation get F'. Afterwards, we apply column shared MLP on F":
9j (FP((F...)) == =1,22 ...
7

---

Under review as a conference paper at ICLR 2021
90
85
+17.9%
Nominal Accuracy (9%
+28.5%
Nominal Accuracy
85
80
MEDIAN
ATT
80
4.0%%
75
ATT-GATE
PMA
75
70
FSPool
SoftPool
70
35 Adversarial Accuracy (96
15
20
40
DeepSym
Adversarial Accuracy 1%)
(a) PGD-1 adversarial training on ModeINet10.
(b) PGD-20 adversarial training on ModelNet4O.
Figure 5: Adversarial robustness of PointNet with various pooling operations under PGD-200 at 0.05.
learn the global feature representation g. Each layer of the MLP composes of a linear transforma- tion, a batch normalization module (Toffe & Szegedy 2015), and a ReL.U activation function. Com- pared to FSPool that applies different linear transformations to different dimensions, DeepSym employs a shared MLP to different dimensions. By doing so, DeepSym deepens the pooling pro- cess to be more capable of digesting the adversarial perturbations. DeepSym can also address the problem of SoftPool that is only achievable with limited d,, because the MLP is shared by all the feature channels so that it can scale up to large number of d.m. with little complexity increases. Moreover, DeepSym generalizes MAX and SUM pooling by specific weight vectors. Therefore, it can also theoretically achieve universality with dm 2 n (Wagstaff et al. 2019) while being more expressive in its representation and smoother in gradients propagation. To deal with the variable-size point clouds, DeepSym adopts column-wise linear interpolation F' to form a continuous feature map and then re-samples it to be compatible with the trained MLP (Jaderberg et al. 2015). Last but not least, DeepSym is by design flexible with the number of pooled features from each dimension. In the paper, only allow DeepSym to output single feature for a fair comparison with others. However, it is hard for other pooling operations to have this ability. For example, it requires a linear complexity increase for FSPcol to enable this capability.
5.1 EVALUATIONS
We implement a 5-layer DeepSym. with [512, 128, 32, 8, 1] hidden neurons on three backbone net- works and adversarially train them on ModelNet40 the same way introduced in Section 4.1 Table shows that almost all models with DeepSym reach the best results in both nominal and adversarial accuracy, outperforming the default architecture by 10.8%, on average. Taking PointNet as an ex- ample, DeepSym (33.6%) improves the adversarial accuracy by 17.5% (~ 2.1 compared to the original MAX pooling architecture. Besides, DeepSym also achieves a 3.5% improvement in adver- sarial accuracy compared to FSPool and Soot.ool. Overall, we demonstrate that DeepSym can benefit AT significantly in point cloud classification.
We further leverage various white- and black-box adversarial attacks to cross validate the robustness improvements of DeepSym on PointNet. Specifically, we exploit well-known FGSM (Szegedy ett al., 2013), BIM (Kurakin et al., 2016), and MIM (Dong al. 2018) as the white-box attack methods. We set the adversarial budget e = 0.05, and leverage 200 steps for the iterative attacks, well. For the black-box attacks, we choose two score-based methods: SPSA (Uesato et al.) 2018) and NES (Ilyas et al.] 2018), and a decision-based evolution attack (Dong et al., 2020b). We still select e 0.05 and allow 2000 queries find each adversarial example. The detailed setups are elaborated in Appendix C.I As shown in Table PointNet with DeepSym consistently achieves the best adversarial accuracy under white-box attacks, except for FGSM. The reason is that FGSM is single-step method that has limited ability to find adversarial examples. Besides, we find the black-box attacks are not as effective as the white-box attacks, which also demonstrate that adversarial training with DeepSym is able to improve the robustness of point cloud classification without gradient obfuscation (Carlini et al. 2019).
Since DeepSym brings deep trainable layers into the original backbones, it is necessary to report its overhead. We leverage TensorFlow (Abadi et al., 2016) and NVIDIA profilers to measure the infer- ence time, the number of trainable parameters, and GPU memory usage PointNet. Specifically, the inference time is averaged from 2468 objects in the validation set, and the GPU memory is mea- sured on RTX 2080 with batch size 8. As shown in Table 6 DeepSym indeed introduces more computation overhead by leveraging the shared MLP. However, we believe the overhead is relatively small and acceptable, compared to its massive improvements the adversarial robustness. To fur-
8

---

Under review as a conference paper at ICLR 2021
Table Adversarial robustness PointNet with different pooling operations under attacks e 0.05.
White-box Attack
Black-box Attack
Pooling Operation
FGSM
BIM
MIM
SPSA
NES
Evolution
MAX 72.8%
24.3%
23.5%
69.2%
67.1%
53,4%
77.6%
23.3%
14.5%
71.1%
65.2%
57.8%
SUM
44.4%
33.5%
37.5%
65.3%
62.3%
52.7%
ATT
43.1%
33.1%
35.0%
68.1%
64.8%
55.9%
ACT-GATE
43.9%
34.2%
33.9%
70.2%
65.9%
55.8%
PMA
47.2%
31.9%
30.1%
67.2%
64.1%
53,4%
FSPool
61.3%
45.4%
48.0%
72.8%
71.9%
69.9%
SoftPool
62.1%
47.6%
45.1%
69.2%
68.5%
70.0%
DeepSym (ours)
61.4%
52.5%
55.4%
72.4%
72.1 %
73.1 %
ther have lateral comparison, point cloud classification backbones are much more light-weight than image classification models. For example, ResNet-50 (He et al. 2016) and VGG-16 (Simonyan & Zisserman 2014) have 23 and 138 million trainable parameters, respectively. and take much longer time to do the inference. The reason that models with Soft Pool and PMA have fewer trainable parameters that they limit the number of dimensions in the global feature by design.
Table 6: Overhead measurement PointNet with different pooling operations.
Inference Time (ms)
# Trainable Parameters
GPU Memory (MB)
MAX MEDIAN
2.21
815,336
989
2.44
815,336
989
2.23
815,336
989
ATT
2.71
1,340,649
1980
ATT-GATE
3.07
1,865,963 962
2013
PMA
2.10
632,
981
FSPool
2.89
1,863,912
1005
SoftPool
2.85
355,328
DeepSym (ours)
3.10
1,411,563
2013
5.2 EXPLORING THE LIMITS OF DEEPSYM
There a trade-off between training cost and adversarial robustness in AT. Increasing the number of PGD attack steps create harder adversarial examples (Madry et al. [0118). which could further improve the model's robustness. However, the training time also iecreases linearly with the number of attack iterations increasing. Due PointNet's broad adoption (Guo et al. 2020). here analyze how it performs under various AT settings. Specifically, we exploit the most efficient AT with PGD- 1 ModelNet10 (Wu et al., 2015), dataset consisting of 10 categories with 4899 objects, and relatively expensive AT with PGD-20 on ModelNet40 to demonstrate the effectiveness of DeepSym.
Other training setups identical to Section
Figure 5 shows the results of the robustness of adversarially trained PointNet with various pooling operations under PGD-200. We demonstrate that PointNet with DeepSym still reaches the best ad- versarial accuracy of 45.2% under AT with PGD-1 on ModelNet10, which outperforms the original MAX pooling by 17.9% (~ 1.7x) and Pool by 4.0%. Surprisingly. PointNet with SeepSym also achieves the best nominal accuracy of 88.5%. Moreover, DeepSym further advances itself un- der AT with PGD-20 on ModelNet40. Figure (bb) shows that PointNet with DeepSym reaches the best 47.0% adversarial accuracy, which are 28.5% (~ 2.6x) and 6.5% improvements compared to MAX pooling and SoftPool, respectively while maintaining competent nominal accuracy. We also report detailed evaluations using different PGD attack steps and budgets in Appendix C.I
CONCLUSION
In this work, we perform the first rigorous study on the adversarial robustness of point cloud classifi cation. We design adaptive attacks and demonstrate that tite--of-th-arr defenses against adversarial point clouds cannot provide real robustness. Furthermore, we conduct a thorough analysis of how the required symmetric function affects the AT performance of point cloud classification models. We are the first to identify that the fixed pooling generally weakens the models' robustness under AT, and on the other hand, corting-based parametric pooling benefits AT well. Lastly, propose DeepSym that further architecturally advances the adversarial accuracy PointNet to 47.0% under AT, outperforming the original design and strong baseline by 28.5% (~ 2.6x) and 6.5%.

---

Under review as a conference paper at ICLR 2021
REFERENCES
Martín Abadi, Paul Barham, Jianmin Chen, Zhifeng Chen, Andy Davis, Jeffrey Dean, Matthieu Devin, Sanjay Ghemawat, Geoffrey Irving, Michael Isard, et al. Tensorflow: system for large- scale machine learning. In 12th {USENIX] symposium operating systems design and imple- mentation ((OSDI) 16), pp. 265-283, 2016.
Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give false sense of secu- rity: Circumventing defenses to adversarial examples. In Jennifer Dy and Andreas Krause (eds.), Proceedings of the 35th International Conference Machine Learning, volume 80 of Proceed- ings of Machine Learning Research, pp. 274 Stockholmsmässan Stockholm Sweden, 10-15 Jul 2018. PMLR. URL
ngs ml press/v80 atha 1 yel 8a html
Dzmitry Bahdanau, Kyunghyun Cho, and Yoshua Bengio. Neural machine translation by jointly learning align and translate. arXiv preprini urXiv:/409) 1409.0473, 2014.
Yulong Cao, Chaowei Xiao, Benjamin Cyr, Yimeng Zhou, Won Park, Sara Rampazzi, Qi Alfred Chen, Kevin Fu, and Z Morley Mao. Adversarial sensor attack on lidar-based perception in autonomous driving. In Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, pp. 2267-2281, 2019.
Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. 2017 IEEE Symposium on Security and Privacy (SP), May 2017. doi: 10.1 109/sp.2017.499 URL
http:/ www.ddo...ooo.g.. wtt.///................. 1109/SP
2017.49
Nicholas Carlini, Anish Athalye, Nicolas Papernot, Wieland Brendel, Jonas Rauber, Dimitris Tsipras, Ian Goodfellow, Aleksander Madry, and Alexey Kurakin. On evaluating adversarial robustness. arXiv preprint arXiv:1902.06705. 2019.
Xiaoyi Dong. Dongdong Chen, Hang Zhou, Gang Hua, Weiming Zhang, and Nenghai Yu. Self- robust 3d point recognition via gather-vector guidance. In Proceedings of the IEEE/CVF Confer- on Computer Vision and Pattern Recognition (CVPR), June 2020a.
Yinpeng Dong, Fangzhou Liao, Tianyu Pang. Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. Boost- ing adversarial attacks with momentum. In Proceedings of the IEEE conference computer vision and pattern recognition, pp. 9185-9193, 2018.
Yinpeng Dong, Qi-An Fu, Xiao Yang, Tianyu Pang, Hang Su, Zihao Xiao, and Jun Zhu. Benchmark- ing adversarial robustness on image classification. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 321-331, 2020b.
Ian Goodfellow, Yoshua Bengio, Aaron Courville, and Yoshua Bengio. Deep learning, volume 1. MIT press Cambridge, 2016.
Ian J Goodfellow, Jonathon Shlens. and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint drXiv:1412.6572, 2014.
Chuan Guo, Mayank Rana, Moustapha Cisse, and Laurens Van Der Maaten. Countering adversarial images using input transformations, arXiv preprint 17X 17, 2017.
Yulan Guo, Hanyun Wang. Qingyong Hu, Hao Liu, Li Liu, and Mohammed Bennamoun. Deep learning for 3d point clouds: survey. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2020.
Abdullah Hamdi, Sara Rojas, Ali Thabet, and Bernard Ghanem. Advpe Transferable adversarial perturbations on 3d point clouds. arXiv preprint 1rXiv:1912.00441,, 2019.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. In Proceedings of the IEEE conference computer vision and pattern recognition, pp- 770-778, 2016.
Peter Huber. Robust statistics, volume 523. John Wiley & Sons, 2004.
10

---

Under review as a conference paper at ICLR 2021
Maximilian llse, Jakub Tomezak, and Max Welling. Attention-basee deep multiple instance learn- ing. In Jennifer Dy and Andreas Krause (eds.), Proceedings of the 35th International Con- ference on Machine Learning, volume 80 of Proceedings of Machine Learning Research, pp- 2127-2136, Stockholmsmässan, Stockholm Sweden, 10-15 Jul 2018. PMLR. URI. http: //proceeding mlr prwss parress/v80/11ss
ht.l
Andrew Ilyas, Logan Engstrom, Anish Athalye, and Jessy Lin. Black-box adversarial attacks with limited queries and information. arXiv preprint arXiv:1804.08598, 2018.
Sergey loffe and Christian Szegedy. Batch normalization: Accelerating deep network training by reducing internal covariate shift. arXiv preprint arXiv:1502.03117, 2015.
Max Jaderberg, Karen Simonyan, Andrew Zisserman, et al. Spatial transformer networks. In Ad- vances in neural information processing systems, pp. 2017-2025, 2015.
Diederik P. Kingma and Jimmy Ba. Adam: A method for stochastic optimization, 2014.
Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial examples in the physical world. arXiv preprint arXiv:1607.0255.0 2016.
Alex H Lang, Sourabh Vora, Holger Caesar, Lubing Zhou, Jiong Yang, and Oscar Beijbom. Pointpil- lars: Fast encoders for object detection from point clouds. Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 12697-12705, 2019.
Juho Lee, Yoonho Lee, Jungtack Kim, Adam Kosiorek, Seungjin Choi, and Yee Whye Teh. Set transformer: A framework for attention-based permutation-invaariat neural networks. In Interna- tional Conference on Machine Learning, pp.
2019.
Daniel Liu, Ronald Yu, and Hao Su. Extending adversarial attacks and defenses to deep 3d point cloud classifiers. 2019 IEEE International Conference on Image Processing (ICIP), pp. 2279- 2283. IEEE, 2019.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu, To- wards deep learning models resistant to adversarial attacks, In International Conference on Learn- ing Representations, 2018. URL WRLhttps. https: /ttp://///e/eeeeeeeeeeeee www.riiwweeee.eeeemmm mett/oorumidddieeee Fo
Haggai Maron, Or Litany, Gal Chechik, and Ethan Fetaya. On learning sets of symmetric elements. arXiv preprint ar arXiv22022.08599 2020.
Dongyu Meng and Hao Chen. Magnet: a two-pronged defense against adversarial examples. In Proceedings of the 2017 ACM SIGSAC conference computer and communications security, pp. 147, 2017.
Naila Murray and Florent Perronnin. Generalized max pooling. In Proceedings of the IEEE confer- ence on computer vision and pattern recognition, pp. 2473-2480, 2014.
Vinod Nair and Geoffrey E Hinton. Rectified linear units improve restricted boltzmann machines. In ICMI,, 2010.
Nicolas Papernot, Patrick McDaniel, Xi Wu, Somesh Jha, and Ananthram Swami. Distillation as a defense to adversarial perturbations against deep neural networks. In 2016 IEEE Symposium Security and Privacy (SP), pp. 582-597. IEEE, 2016.
Charles R Qi, Hao Su, Kaichun Mo, and Leonidas J Guibas. Pointnet: Deep learning on point sets for 3d classification and segmentation. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 652-660, 2017a.
Charles Ruizhongtai Qi, Li Yi, Hao Su, and Leonidas J Guibas. Pointnet++:: Deep hierarchical feature learning on point sets in metric space. In Advances in neural information processing systems, pp. 5099-5108. 2017b.
Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. arXiv preprint arXiv: 1409. 1556, 2014.

---

Under review as a conference paper at ICLR 2021
Dawn Song, Kevin Eykholt, Ivan Evtimov, Earlence Fernandes, Bo Li, Amir Rahmati, Florian Tramer, Atul Prakash, and Tadayoshi Kohno. Physical adversarial examples for object detectors. In 12th {USENIX} Workshop on Offensive Technologies ((WOOT) 18), 2018.
Hang Su, Subhransu Maji, Evangelos Kalogerakis, and Erik Liilned-Miller. Multi-view convo- lutional neural networks for 3d shape recognition. In Proceedings of the IEEE international conference on computer vision, pp. 945-953, 2015.
Jiachen Sun, Yulong Cao, Qi Alfred Chen, and Z. Morley Mao. Towards robust basar-based per- ception autonomous driving: General black-box adversarial sensor attack and countermea- sures. In 29th USENIX Security Symposium (USENIX Security 20), pp. 877-894 USENIX Association, August 2020. ISBN 978-1-939133--1-55 URL https: //t:://wwwwww www. www.ix.eexxx.ommm
Sornferrencceusen11 iearrennce/usennxsccrrrtt... wwscuurity200 tsseuurrtty20pppeeeetttttt pet.esentaaioon//ee sunn
Christian Szegedy, Wojciech Zaremba, Ily Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199 2013.
Florian Tramer, Nicholas Carlini, Wieland Brendel, and Aleksander Madry. On adaptive attacks to adversarial example defenses. arXiv preprint arXiv:2002. 0000000...37..2220 2020.
Jonathan Uesato, Brendan O' o'Donoghue, Aaron van den Oord, and Pushmeet Kohli. Adversarial risk and the dangers of evaluating against weak attacks. arXiv preprint arXiv: 1802.056666 2018.
Mikaela Angelina Uy Quang-Hieu Pham, Binh-Son Hua, Duc Thanh Nguyen, and Sai-Kit Yeung. Revisiting point cloud classification: A new benchmark dataset and classification model on real- world data. In International Conference on Computer Vision (ICCV), 2019.
Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Łukasz Kaiser, and Illia Polosukhin. Attention is all you need. In Advances in neural information processing systems, pp. 5998-6008, 2017.
Edward Wagstaff, Fabian B Fuchs, Martin Engelcke, Ingmar Posner, and Michael Osborne. On the limitations of representing functions sets. arXiv preprint arXiv:1901.09006 2019.
Yida Wang, David Joseph Tan, Nassir Navab, and Federico Tombari. Softpoolnet: Shape descriptor for point cloud completion and classification. arXiv preprint arXiv:2008.0755 2020.
Yue Wang, Yongbin Sun, Ziwei Liu, Sanjay E. Sarma, Michael M. Bronstein, and Justin M. Solomon. Dynamic graph cnn for learning on point clouds. ACM Transactions on Graphics (TOG), 2019.
Yuxin Wen, Jichong Lin, Ke Chen, and Kui Jia. Geometry-aware generation of adversarial and cooperative point clouds. arXiv preprint arXiv: 1 2019.
Zhirong Wu, Shuran Song, Aditya Khosla, Fisher Yu, Linguang Zhang, Xiaoou Tang, and Jianxiong Xiao. 3d shapenets: A deep representation for volumetric shapes. In Proceedings of the IEEE Conference on Computer Vision and Puttern Recognition (CVPR), June 2015.
Chong Xiang, Charles R Qi, and Bo Li. Generating 3d adversarial point clouds. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 9136-9144, 2019.
Cihang Xie and Alan Yuille. Intriguing properties of adversarial training at scale. arXiv preprint arXiv: 1900.0377.77777 2019.
Cihang Xie, Jianyu Wang, Zhishuai Zhang, Yuyin Zhou, Lingxi Xie, and Alan Yuille. Adversarial examples for semantic segmentation and object detection. In Proceedings of the IEEE Interna- tional Conference on Computer Vision, pp. 1369-1378, 2017.
Cihang Xie, Mingxing Tan, Boqing Gong. Alan Yuille, and Quoc V Le. Smooth adversarial training. arXiv preprint arXiv:2006. 202220006.1556, 2020.
Yuzhe Yang, Guo Zhang, Dina Katabi, and Zhi Xu. Me-net: Towards effective adversarial robustness with matrix estimation. arXiv preprint arXiv: 1905. 1971, 2019.
12

---

Under review as a conference paper at ICLR 2021
Lequan Yu, Xianzhi Li, Chi- Chi-Wing Fu, Daniel Cohen-Or, and Pheng-Ann Heng. Pu-net: Point cloud upsampling network. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 2790-2799, 2018a.
Tan Yu, Jingjing Meng, and Junsong Yuan. Multi-view harmonized bilinear network for 3d object recognition. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 1886-194, 2018b.
Manzil Zaheer, Satwik Kottur, Siamak Ravanbakhsh, Barnabas Poczos, Russ R Salakhutdinov, and Alexander J Smola. Deep sets. In I. Guyon, U. V. Luxburg, S. Bengio, H. Wallach, R. Fergus, S. Vishwanathan, and R. Garnett (eds.), Advances in Neural Information Processing Systems 30, pp. 3391-3401. Curran Associates, Inc., 2017. URL http: http::/pppprr. nips CC/ cappaper/ 6931 - sets
Huan Zhang, Hongge Chen, Chaowei Xiao, Sven Gowal, Robert Stanforth, Bo Li, Duane Boning, and Cho-Jui Hsich. Towards stable and efficient training of verifiably robust neural networks. arXiv preprint wxXiv:196.006316 2019.
Yan Zhang, Jonathon Hare, and Adam Prügel-Bennett. Espool: Learning set representations with featurewise sort pooling. International Conference on Learning Representations, 2020. URL
net http://eeeeeeeeeeeeeoooooooooooa
Hang Zhou, Kejiang Chen, Weiming Zhang, Han Fang, Wenbo Zhou, and Nenghai Yu. Dup-net:
Denoiser and upsampler network for 3d adversarial point clouds defense. In Proceedings of the IEEE/CVF International Conference Computer Vision (ICCV), October 2019.
13

---

Under review as a conference paper at ICLR 2021
A ADAPTIVE ATTACK EXPERIMENTAL SETUP AND VISUALIZATIONS
A.1 EXPERIMENTAL SETUPS
Since DUP--Net is open-sourced, we target the publicly released PointNet and PU-Net models. For the T,2 norm-based C&W W attack, we set the loss function as:
(max(2(X')) ##
2(X'), )+)
X 121
where X RR*3 3 is the matrix version of point cloud X, X' the optimized adversarial example, ((X); is the i-th element of the output logits, and t' is the target class. We leverage 10-step binary search to find the appropriate hyper- parameter from [10, 80]. As suggested by Xiang et al. (2019). we choose 10 distinct classes and pick 25 objects in each class from the ModelNet40 validation set for evaluation. The step size of the adversarial optimization is 0.01 and we allow at most 500
iterations of optimization in each binary search to find the adversarial examples.
For the L norm-based PGD attack, we adopt the formulation in Madry et al. (2018):
X xx++s(X,
sign(V x. (X,; y)))
(10)
where X, is the adversarial example in the 1-th attack iteration, II is the projection function to project the adversarial example to the pre-defined perturbation space S, which is the L norm ball in our setup, and is the step size. We select the boundary of allowed perturbations e = {0.01, 0.025, 0.05, 0.075] out of the point cloud data range [-1,1] Since point cloud data continuous, we the step size
fo-
For GyG-PointNet++, we train it based on the single scale grouping SSsnt-ooitNee+++ backbone. The backbone network has three PointNet set abstraction module to hierarchically aggregate local features, and we enable gather vectors in the last module, which contains 128 local features (i.e, n' = 128 in Section 3.2) with 256 dimensions. To learn the gather vectors, we apply three fully connected layers with 640, 640, and 3 hidden neurons respectively, as suggested by Dong et al. (2200)). Since the data from ModelNet40 is normalized to [-1,1], the global object center Cg U,.
For the - norm-based PGD attack, we leverage the same setup as the attack on DUP-Net. For the 2 norm- based PGD attack, we follow the settings in Dong et al. (2020a) to set the L norm threshold e = 8yn din, where 8 is selected in {0.08, 0.16, 0.32]. n is the number of points, and din is the dimension of input point cloud (i.e. 3). The attack iteration is set to 50, and the step size 50
A.2 VISUALIZATIONS
We visualize some adversarial examples generated by adaptive attacks on PU-Net and DUP-Net in Figure [ and Figure 7 It is expected that adversarial examples targeting DUP-Net are noisier than the ones targeting PU-Net the former needs to break the denoiser layer. However, mentioned in Section 3.I they are barely distinguishable from human perception. We also visualize some adversarial examples generated by untargeted adaptive PGD attacks on GvG-PointNet++ in Figure with different perturbation budgets c.
B ADVERSARIAL TRAINING SETUP
B. PGD ATTACK IN ADVERSARIAL TRAINING
We also follow the formulation in Equation 18 to find the worst adversarial examples. Specifically, we empirically select = 0.05 into the training recipe as there no quantitative study on how much humans can bear the point cloud perturbations. Figure g shows that adversarial examples with e = 0.05 are still recognizable by human perception. Moreover, because point cloud data is continuous, we set the step size of PGD attacks as:
step < 10
step
(11)
step 2 10
10
14

---

Under review as a conference paper at ICLR 2021
airplane
bed
bookshelf
bottle
chnir
monitor
sofa
table
toilet
vase
airplane
bookshelf
montor
sofa
rable
mnile
Vinse
Figure 6: Visualizations of adversarial examples (2048 points) generated by norm-based C&W adaptive attacks on PU-Net.
in both training and evaluation phases to make sure PGD attacks reach the allowed maximum per- turbations.
B.2 POINT CLOUD CLASSIFICATION MODEL ARCHITECTURE DETAILS
PointNet, DeepSets, and DSS are the fundamental architectures in point cloud classification. Other models, such PointNet++ and DGCNN, are built upon PointNet and DeepSets. Moreover, com- plex models oftentimes apply con-differentiale layers like knn(-) into end-to-end learning, which will make the adversarial training ineffective. In this work, we aim at exploring how the symmetric (permutation-invarian)
function can benefit adversarial training. To this end, we choose PointNet, DeepSets, and DSS as the backbone networks. For the ModelNet40 dataset, follow the default setting to split into 9,843 objects for training and 2,468 objects for validation (Wu et al.) 2015). We randomly sample 1024 points from each object to form its point cloud, if not otherwise stated.
PointNet. We leverage the default architecture in PointNet codebase and exclude the transfor- mation nets (i.e., T-Net) and dropout layers for simplicity and reproducibility. PointNet leverages shared fully connected (FC) layers as the coamutatioo-equivaraaa layer Φi FC,((F..) - F and MAX pooling as the symmetric function p(.).
httpps://giitubb.com//hh
15

---

Under review as a conference paper at ICLR 2021
airplane
bed
bookshelf
bottle
chnir
monitor
sofa
table
toilet
vase
airplae
bookshelf
mon
sofa
rable
Figure 7: Visualizations of adversarial examples (2048 points) generated by norm-based C&W adaptive attacks on DUP-Nct.
DeepSets. We leverage the default architecture in DeepSets codebase Different from PointNet, DeepSets first applies symmetric function each feature map and aggregate it with the origi- nal feature map. Afterwards, DeepSets also leverages FC layers to further process the features: Φi FC.(F..; <(F)) Fi+1,; where ((-) is column-wise MAX pooling in the original imple- mentation. Similarly, MAX pooling is still used as p(-) DeepSets.
DSS. DSS generalizes DeepSets architecture and applies another FC layer to ((Fi) in DeepSets so that di FC,, (Fi..)) FCIz(C(F))) F++1,-- Different from other two achitectures, DSS utilizes SUM pooling as p(-). Since there is no available codebase at the time writing, we implement DSS by ourselves.
We visualize the differences of Φ(-) in Figure and summarize the layer information in Table
B.3 PARAMETRIC POOLING DESIGN AND IMPLEMENTATION
We have introduced ATT in Section 4.3.) In our implementation, we choose 512 so that
V 5 1024 to train the backbone models.
https://git thw.. wwt.aa...........i../mo http://aaaniizhherer/ee
zaheer /
16

---

Under review as a conference paper at ICLR 2021
0.0.
8-0.01
0-0.2
0.055
8-0.075
airplane
bed
bookshelf
bottle
chair
montor
table
toilet
vasc
Figure 8: Visualizations of adversarial examples (1024 points) generated by _ norm norm-based PGD adaptive attacks on Gyt.PointNett+.
ATT-GATE is variant of ATT with more learnable parameters:
n = a. fi
a; exp(w" T (tanh(V f.T) sigm ( ))
(12)
1= exp(w (tanh(V (V f, o sigm(U f)
where U, V R sigm(-) is the sigmoid activation function, and an element-wise multi- plication. We also choose = 512 in ATT-GATE train the backbone models.
17

---

Under review as a conference paper at ICLR 2021
Table 7: Layer information of PointNet, DeepSets, and DSS, BN represents batch normalization layer.
PointNet
DeepSets
DSS
01 72
④1
256
01 n +
BN + ReLU
BN + ELU
BN ReLU
42 n x 64 - 1 x 64
@2 v x 256 + n. x 256
2 n x 64 - 71 X 256
BN ReLU
BN ELU
BN ReLUU
128
p: 256 - 256
256
256
+ ReLU
01 - 256
BN ReLU
@4 Y x 128 + X 1024
BN + Tanh
P T. X 256 - 256
BN + ReLU
256 + 40
256 - 256
0 X 1024 1024
BN ReLU
01 1024 - 512
02. 256
BN + ReLU
02 : 512 - 256
BN ReLU
73 256
d++1
d
FC
FC
FC
EC
FC
FC
FC
FC
(a) <(-) in PointNet.
(b) Φ( )) in DeepSets. di
dh
d+1
FC
FCM
FC
FC
FC:
FC-4
FC
RCM
(c) s(-) in DSS.
(d) The aggregated feature in (b) and (c).
Figure 9: Different architectures of <(-) in PointNet, DeepSets, and DSS.
PMA (Lee et 2019) adopts multi-heal attention into pooling on learnable set of k seed vectors
S E dm Let F E IR d be the matrix version of the set of features.
PMA, MMB((S,C(FF)
(13)
MAB(X, Y) H + FC(H)
(14)
where H X Multihead (X, X,Y Y, Y;w)
(15)
where FC(-) is the fully connected layer and Multihead(() is the multi-head attention mod- ule (Vaswani et al. 2017). We follow the implementation in the released codebase choose k = 1, the number of head = 4, and the hidden neurons in FC(.) 128 to train the backbone models.
Since SoftPool (Wang et al.) 2020) sorts the feature set in each dimension, it requires the number of dimensions dm to be relatively small. We follow the description their paper to choose d,,. = and l: 32 that each F 32x8 We apply convolutional layer aggregate each F' into gi [g x322 that the final g E R 1x256 Therefore, for all backbone networks with SoftPool, we apply the last equivariant layer as Φ d - n x and n x 256.
https://github/
18

---

Under review as a conference paper at ICLR 2021
C DEEF ABLATIONS
is worth noting that DeepSym does not require the final layer to have only one neuron. However, to have fair comparison with other pooling operations that aggregate into one feature from each dimension, our implementation of DeepSym also aggregates into one feature from each dimension.
C.I EVALUATION DETAILS
We also perform extensive evaluations using different PGD attack steps and budgets on PGD- 20 trained PointNet. Figure shows that PointNet with DeepSym consistently achieves the best adversarial accuracy. We also validate MEDIAN pooling indeed hinders the gradient backward prop- agation. The adversarial accuracy of PointNet with MEDIAN pooling consistently drops even after PGD-1000. However, the adversarial accuracy of PointNet with other pooling operations usually converges after PGD-200. Figure [1 shows that DeepSym also outperforms other pooling opera- tions under different adversarial budgets
Adversarial Accuracy (%)
90
MAX
75
SUM
60
MEDIAN
ATT
45
ATT-GATE
30
PMA
FSPool
SoftPool
%
500
1000
1500
2000
DeepSym
Step of PGD Attack (E 0.05)
Figure 10: Adversarial accuracy of PGD-20 trained PointNet with different pooling operations. We leverage the PGD attack with different steps to evaluate the model's robustness.
Adversarial Accuracy (%)
90
MAX
SUM
60
MEDIAN
ATT
45
ATT-GATE
PMA
FSPool
15
SoftPool
0.0
0.01
0.025
0.05
0.075
DeepSym
Adversarial Budget & (PGD-200)
Figure 1I: Adversarial accuracy of PGD-20 trained PointNet with different pooling operations. We leverage the PGD attack with different budgets to evaluate the model's robustness.
We leverage the default setup in FGSM, BIM, and MIM in our evaluation. FGSM is a single-step attack method, which can be represented as:
Xadv
X + sign( V L(X, 0, y))
(16)
The BIM attack is similar to PGD attacks described in Appendix A.I The differences are 1) the attack starts from the original point cloud X and 2) the step size e/T, where T is the number of attack steps. The MIM attack introduces momentum terms into the adversarial optimization:
Vx, XX,, 0.
9:+1 g:
(17)
VV C(,,, 11
X X, + a sign(g(+1)
(18)
19

---

Under review as a conference paper at ICLR 2021
Similar to BIM, the attack starts from the original point cloud X and the step size c/T. We set f4
following the original setup (Dong et al. 2018).
Duc to the computational resource constraints, set the sample size 32 and allow 2000 quires to find each adversarial example in the score-based black-bon attack (Uesato et al., 2018 llyas et al, 2018). For the evolution attack, of perturbations from a Gaussian distribution (00, 1). 4 sets of perturbations with top fitness scores will remain for the next iteration, while others will be discarded. We also allow 2000 generations of evolution to find the adversarial example.
the default loss L as the fitness score, and initialize 32 sets
C.2 EVALUATION ON SCANOBJECTNN
We also evaluate the adversarial robustness of different pooling operations on a new point cloud dataset, ScanObjectNN (Uy et al. 2019), which contains 2902 objects belonging to 15 categories. We leverage the same adversarial training setup as ModelNet1O (i.e., PGD-1). Table shows the re- sults. We find that PointNet with DeepSym still achieves the best adversarial robustness. Since the point clouds from ScanObjectNN are collected from real-world scenes, which suffers from occlusion and imperfection, both nominal and adversarial accuracy drops compared to the results ModeINer40. We find that even some clean point clouds cannot be correctly recognized by human perception. Therefore, the performance degradation also expected and believe the results not as representative as ones on ModelNet40.
Table 8: Adversarial robustness of PointNet with different pooling operations under PGD-200 at 0.05.
Pooling Operation
Nominal Accuracy
Adversarial Accuracy
MAX MEDIAN SUM
75.2%
16.8%
68.4%
8.2%
63.5%
18.3%
AIT
62.7%
17.9%
ATT-GATE
59.8%
17.1%
PMA
61.2%
16.2%
FSPool
76.8%
20.1%
SoftPool
73.2%
17.2%
DeepSym (ours)
76.7%
22.8%
C.3 T-SNE VISUALIZZATIONS
We visualize the global feature embeddings of adversarially trained PointNet under PGD-20 with different pooling operations in Figure [2 and their logits in Figure 13 Since it is hard pick 40 distinct colors, though we put all data from 40 classes into the T-SNE process, we only choose 10 categories from ModelNet40 realize the visualizations.
20

---

Under review as a conference paper at ICLR 2021
(a) MAX pooling on training data, validation data, and PGD-200 adversarial validation data.
(b) ESPool on training data, validation data, and WGD-200 adversarial validation data.
(c) SoftPool training data, validation data, and PGD-200 adversarial validation data.
(d) DeepSym on training data, validation data, and PGD-200 adversarial validation data.
Figure 12: T-SNE visualizations of PointNet feature embeddings with MAX, FSPooL, SoftPool, and DeepSym pooling operations. Three columns correspond training data, validation data, and PGD-200 ad- versarial validation data, from left right.
21

---

Under review as a conference paper at ICLR 2021
(a) MAX pooling on training data, validation data, and PGD-200 adversarial validation data.
(b) ESPool on training data, validation data, and PGD-200 adversarial validation data.
(c) SoftPool training data, validation data, and PGD-200 adversarial validation data.
(d) DeepSym on training data, validation data, PGD-200 adversarial validation data.
Figure 13: T-SNE visualizations of PointNet logits with MAX. FSPooL. SoftPoeL, and DeepSym pooling operations. Three columns correspond to training data, validation data, and PGD-200 adversarial validation data, from left right.
22


Reviews:
[{"review_id": "ZoHnbQGidTk", "reviewer": "AnonReviewer3", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 2, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "Pros:\n1. The paper performs the first security analysis of defenses and designs adaptive attacks, which demonstrate current defense designs are vulnerable.\n2. The paper proves that sorting-based parametric pooling operations can improve the model’s robustness. \n3. Based on the existing problems, a deep symmetric pooling operation, DeepSym, is proposed.\n\nCons:\n1. DeepSym seems to be simple and slightly lacking in novelty.\n2. Unlike existing methods, DeepSym applies deeper neural networks. Therefore, the computational cost (both time and space consuming) of the DeepSym should be discussed in the paper.\n", "extra_scores": {}, "extra_text": {}}, {"review_id": "SrvWHuk5pdA", "reviewer": "AnonReviewer2", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "This paper first points out the drawback of state-of-the-art defenses for 3D point cloud classification, via designing adaptive attack. And then the author analyzes the effect of adversarial training on this task. Based on such analysis, the authors propose a deep symmetric pooling operation which can enhance the adversarial robustness for adversarial training.\n\nThe presentation of the paper is clear and easy to follow. And there are extensive experiments and sufficient experimental analysis to support the claim of this paper. However, there are still some concerns that need to be solved.\n\n1. The authors utilize the white-box attack to analyze the robustness of different pooling operations, while they should also compare the defense effect of various pooling operations under black-box attack.\n2. In table 2, although the adaptive PGD attack has high success rates, the attack with L_{gather} has higher performance in some cases. What is the intrinsic reason for its superiority?\n3. In the experiments of adversarial training, the authors propose to select PGD for the training. However, the authors evaluate the performance of trained models with PGD only, e.g. the results in Tables 3 and 4.  It is necessary for the authors to evaluate the results under various attack types.\n", "extra_scores": {}, "extra_text": {}}, {"review_id": "LJvZn87FViD", "reviewer": "AnonReviewer1", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "This paper studies adversarial robustness of point cloud classification models. In particular, this paper analyzes the effects of pooling layers and conducts extensive ablation studies. In addition, this paper proposes a DeepSym operation, which is built on top of both the sorting-based pooling and the parameterized pooling. The paper shows empirical improvements under different types of attacks. I summarize the pros and cons as follows.\n\nPros:\n1.  Robustness of point cloud classification is an important problem to study. Compared to existing works on robustness, point cloud models have unique architectures, e.g, the pooling operation, which could be an important factor to the final performance. This paper studies an important problem. \n2. This paper conducts multiple experiments of different pooling layers under different types of attacks. \n3. Empirically, this paper shows improvements under different attacks. \n\nCons:\n1. My biggest concern of this paper is its novelty. The sorting-based pooling and parameterized pooling layers are not new and have been studied extensively in existing papers.  FSPool proposed the sorting-based pooling while the parameterized pool layers have been proposed in multiple papers (e.g, PMA). Can the authors state the novelty/difference between this proposed method and existing ones?\n2. The proposed pooling layers introduce additional parameters compared to sorting-based pooling layers, this makes the comparison less fair. Can the author talk about the number of parameters introduced by the proposed pooling layers. In particular, I'd like to see how much computational overhead introduced by the additional parameters? Is it possible to measure the inference time and compare to existing sorting-based methods (e.g, FSPool)? \n3. The proposed pooling layers shows performance decrease when there is no adversarial attack. I'd like to see more discussion regarding this. Is this method specific to adversarial defense? Or this paper is proposing a general pooling layer? ", "extra_scores": {}, "extra_text": {}}, {"review_id": "CxwKSjpfype", "reviewer": "AnonReviewer4", "summary": "", "questions": "", "limitations": "", "rating": 7, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "The paper addresses the problem of adversarial robustness in 3D point cloud representations. It claims that two of the previous defense designs do not prevent adaptive attacks. The authors then propose to use adversarial training (AT) to improve the robustness. It claims that the standard MAX pooling operation within PointNet-derivates contribute to the weaknesses. It then proposes a new pooling operation that improves the robustness under AT.\n\nThe paper claims contributions in:\n\n-- Demonstration that current defenses do not provide real robustness.\n\n-- MAX and SUM pooling strategies weaken models trained under AT.\n\n-- A new sorting-based pooling operation, DeepSym, that works the best with AT against adaptive attacks.\n\nI agree with the authors' assessment of the paper.\n\nStrengths:\n\n-- Interesting insights: As promised, the authors applied adaptive attacks against recent works that aimed to improve robustness. The experiments are clear and discussions make sense. The discovery that sorting-based pooling layers are more robust under AT is also insightful.\n\n-- Strong experimental results: On the one task of ModelNet40, the authors showed significant improvement using three methods when using AT, and further improvements when using the proposed DeepSym layer.\n\nNeutral:\n\n-- Novelty: The majority of claimed novelties are straightforward applications: 1) application of AT on points, 2) usage of attention or sorting-based layer to improve robustness. The proposal of DeepSym is somewhat novel, but not sure if sufficient for a publication in this venue.\n\nWeaknesses:\n\n-- There is only one task: All experiments were done on ModelNet40. Having a second dataset would be nice. Or even some toy examples.\n\nClarification:\n\n-- I imagine that the adaptive attacks are white box attacks? I couldn't find in the paper if white or black attack....\n\nConclusion:\nThe paper provides interesting insights and strong experimental results. Although the novelty is slightly lackluster, I would be happy to see this paper at the conference.\n\n", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: The authors develop novel adaptive adversarial attacks for 3D Point Cloud Classification tasks. They show that many existing defenses are broken by develop a novel pooling operation, DeepSym, and demonstrate that using this they can achieve significant improvements in adversarial robustness of 3D Point Cloud Classification. 

All reviewers agreed that the paper makes interesting contributions and that the setting of 3D point cloud classification is interesting from a security perspective. The shared concern of the reviewers was around novelty. This was addressed in the rebuttal to some extent, but there remained some lingering questions that made this paper borderline and unfortunately, the program committee had to decide to reject it.

I would urge the authors to revise their manuscript to clarify the novelty relative to prior work (particular those that use similar pooling operations) and resubmit to a future venue. 
Decision: Reject