Geometry-aware Generation of Adversarial and Cooperative Point Clouds
Authors: Yuxin Wen
Jiehong Lin
Ke Chen
Kui Jia
Venue:  (2020)
Keywords: Adversarial attack
Point cloud classification

Abstract: Recent studies show that machine learning models are vulnerable to adversarial examples. In 2D image domain, these examples are obtained by adding imperceptible noises to natural images. This paper studies adversarial generation of point clouds by learning to deform those approximating object surfaces of certain categories. As 2D manifolds embedded in the 3D Euclidean space, object surfaces enjoy the general properties of smoothness and fairness. We thus argue that in order to achieve imperceptible surface shape deformations, adversarial point clouds should have the same properties with similar degrees of smoothness/fairness to the benign ones, while being close to the benign ones as well when measured under certain distance metrics of point clouds. To this end, we propose a novel loss function to account for imperceptible, geometry-aware deformations of point clouds, and use the proposed loss in an adversarial objective to attack representative models of point set classifiers. Experiments show that our proposed method achieves stronger attacks than existing methods, without introduction of noticeable outliers and surface irregularities. In this work, we also investigate an opposite direction that learns to deform point clouds of object surfaces in the same geometry-aware, but cooperative manner. Cooperatively generated point clouds are more favored by machine learning models in terms of improved classification confidence or accuracy. We present experiments verifying that our proposed objective succeeds in learning cooperative shape deformations.

Under review as a conference paper at ICLR 2020
GEOMETRY-AWARE GENERATION OF ADVERSARIAL AND COOPERATIVE POINT CLOUDS
Anonymous authors
Paper under double-blind review
ABSTRACT
Recent studies show that machine learning models are vulnerable to adversarial examples. In 2D image domain, these examples are obtained by adding impercep- tible noises to natural images. This paper studies adversarial generation of point clouds by learning to deform those approximating object surfaces of certain cat- egories. As 2D manifolds embedded in the 3D Euclidean space, object surfaces enjoy the general properties of smoothness and fairness. We thus argue that in or- der to achieve imperceptible surface shape deformations, adversarial point clouds should have the same properties with similar degrees of smoothness/fairness to the benign ones, while being close the benign ones well when measured under certain distance metrics of point clouds. To this end, we propose a novel loss func- tion account for imperceptible, geometry-aware deformations of point clouds, and use the proposed loss in an adversarial objective to attack representative mod- els of point set classifiers. Experiments show that our proposed method achieves stronger attacks than existing methods, without introduction of noticeable outliers and surface irregularities. In this work, we also investigate an opposite direction that learns to deform point clouds of object surfaces in the same geometry-awer but cooperative manner. Cooperatively generated point clouds are more favored by machine learning models in terms of improved classification confidence or ac- curacy. We present experiments verifying that our proposed objective succeeds learning cooperative shape deformations.
INTRODUCTION
The existence of adversarial examples shows the vulnerability of machine learning models, and triggers a great amount research attention paid to either attacking and defense studies for safety- critical issues, or robustness analysis on machine learning models themselves. In existing literature, adversarial examples generally satisfy two key properties: visually imperceptible by humans and capable to mislead machine learning models. For 2D adversarial images (Szegedy al.) 2013 Carlini & Wagner| 2017; Madry et al.) 2017), their imperceptible nature indicates less sensitivity by humans the texture changes of the original images, which can be viewed noises with small magnitudes anchored on RGB values of pixels.
Different from texture changes in adversarial images, adversarial point clouds as approximate shape representations of object surface demand imperceptible shape deformations, Heuristic manners of existing several works are taken allow shape deformations in arbitrary directions for adversarial attack effects. Consequently. they produce adversarial examples that contain obvious point outliers (Xiang al. 2019 Liu et al. 2019a). which can thus be easily defended by simple outlier removal method such as SOR (Zhou et al. 2018).
In this work, we aim to adversarially perturbing benign point clouds with awareness of the underly- ing geometric properties, which can be generally described as some sort of approximate geometric smoothness, e.g., point-wist wiie normals (Wang et al. 2018), curvatures (Bae) 2006), or geodesics for pairs of points (He et al. 2019). in view of the nature of object surface as 2-manifold embedded in the 3D space. To this end, we propose a novel geometry-awan loss in combination with the attack one. Our proposed geometry-awe (CD) and Hausdorff Distance (HD) terms prevent geometric/topological changes of global shape via constraining point-wise perturbations, while the term encouraging consistency of local curvatures
loss is composed of three terms: the Chamfer Distance

---

Under review as a conference paper at ICLR 2020
between the adversarial and benign point clouds achieves smooth local surface deformations. Ex- tensive experiments on the ModelNet40 dataset (Wu et al. 2015) can verify the imperceptibility and effectiveness of geometry aware adversaries.
Our success in generating less noticeable point clouds inspires us to think of an opposite direction: is it possible perturb raw point clouds in cooperative, geometry- aware manner such that the resulting imperceptible perturbations of point clouds can improve classification performance with existing machine learning models? To the best of our knowledge, very few existing works are pursuing this direction, at least in the domain of 3D shape analysis. Technically, the objective of cooperative generation on point clouds is achieved by learning point perturbations either improved classification confidence or corrected class predictions. In view of their geometry- aware nature, our cooperative point clouds could be practically meaningful terms of guiding design of certain objects such that they can be better perceived by in-built machine learning systems in physical world. Experiments on the ModelNet40 again verify our motivation on cooperative generation of point clouds.
favor of
RELATED WORKS
A number of adversarial attack algorithms have been proposed on 3D semantic analysis (Xiao
20.9] Liu et al.. 2019a| Xiang et al. 2019 Yang et al. 2019 Zheng et al.) 2018 Wicker & Kwiatkowska 2019 Liu et al. (019b)). Beyond (Xiao et al. 2019) manipulating both texture and shape on the mesh level to attack image classifiers and detectors, most of adversarial algorithms on point clouds attack 3D classifiers via points attachment (Xiang et al. (019 Yang et al. 2019), point detachment (Yang et al., 2019 Zheng et al.] 2018: Wicker & Kwiatkowska 2019) or point-wise perturbation (Xiang et al. 2019 Liu et al. 2019a Yang al. 9011 Liu et al. 2019b). Existing methods fail to exploit geometric properties during adversarial example generation, and thus have evident outliers and can be easily defended by SOR defense (Zhou et al. 2018), which encourage
our adversaries (see Figure and T..le
A number of deep models have been proposed for point-based surface reconstruction such Point Set Generation (PSG) (Fan et al. (017), the AtlasNet (Groueix et al., 2018b). and Deep Cascade Generation (DCG) (Wang et al.) 2019a) from 2D images. These methods exploiting local mesh structure into point clouds generation have inspired our geometry-aware concept, but they are di- rectly regressing from the latent vector encoded from images rather than point-wise deformations in the proposed method.
Data argumentation on point clouds such as jittering, rotation and random scale firstly introduced in (Qi et al., (017a) shares similar concept as our cooperative deformations, both of which generate new data boost classification. However, the key differences between our cooperative learning and data argumentation lie in two folds: 1) optimization based vs. simple physical processing: and 2) deformations on the underlying shape vs. point density changes. Simply put, the proposed cooperative deformation can be promising learning paradigm, while data argumentation is an effective pre- pre-prceessing step to mitigate sparse sample distributions.
3 METHODOLOGY
Our problem setting assumes the availability of collection of point clouds in the input space X, which are approximate shape representations of object surfaces of certain categories. Each point cloud P E X' contains an orderless set of n points {pr)"_ with the corresponding label y E y of object category, where any denotes the coordinates (v, y, 2) in the 3D Euclidean space. In this work, we focus on machine learning models of 3D point set classification (Qi et al. 2017a (b] Wang ct al. 2019b), which Iearn classifier X + y and expect f(P) y for any input P with the true label y.
P is a discrete approximation of an object surface that satisfies the general properties of smooth- ness and fairness (Botsch et al. 2010). which concern with the continuity and variation of (partial) derivatives of parametric surface function; in more intuitive way, the properties concern with the curvatures of local surface patches. Our objective in this work is to obtain from a deformed point cloud P via learning to perturb individual points {p.) of P. Since the deformation is
2

---

Under review as a conference paper at ICLR 2020
expected to be imperceptible by humans, argue that P' should have the aforementioned surface properties with similar degrees of smoothness/faimess to local surface patches of P. while being globally close to P well. measured by certain distance metrics of point sets; otherwise, humans would notice either the global, possibly topological changes of part configuration of the object sur- face, those of local surface details. We present shortly in section[3.]] our technical solutions the above objective of geometry-aware point perturbations, and discuss how such solutions can be used generate either adversarial cooperative point clouds in sections 3.2 and 3.3 respectively.
3.1 GEOMETRY-AWARE POINT PERTURBATIONS
In 2D image domain, pixel-wise 1--norms are usually used to constrain the noise magnitudes of adversarial examples (Carlini & Wagner 2017 Madry al.] 2017). Due the sharply different data nature of point clouds, we consider the following learning criteria to perturb points {p:) of P in a geometry-aware manner. These criteria are to constrain the deformation magnitudes of the resulting P', while taking into account prevention of point outliers and smooth regularization of local point neighborhoods. Combined use of these criteria leads to point cloud deformations that are less noticeable by humans, as verified in the comparative experiments in section 4
Chamfer Distance Given two point sets P and P', the Chamfer distance computes
Craanter (P',
Σ
min p''
pll
min Σ
--- -pp'112.
D'EP! PEP
T
D'EP' pEP
which shows that Chamfer distance is symmetric w.r.t. Pand P', Although the Chamfer distance ( not a strict distance function, since the triangle inequality does not hold, is popularly used in the recent literature of learning based 3D shape generation (Yang et al.] 2018 Groueix et al.) [2018a] Fan al., 2017). measures the distance between the two point sets by averaging over the individual deviation of any p E 'P from P' and that of any p' E ''' from P. However, Chamfer distance is less effective in prevention of outlier points in P', since small portion of outliers in P increases the distance ① negligibly - one can intuitively think of outliers of point cloud those away from the object surface, represented by the point cloud, with relatively large distances. This shortcoming of Chamfer distance motivates us additionally use the Hausdorff distance as introduced below.
Hausdorff Distance In this work, we use a mom-yymmetric Hausdorff distance between the two point sets P and Pl that computes
CBausdorte (P', (P'P)) P)
max min Ip' -pll2- p' p'EP" pEP
since only the deformation of P' is concerned. As largest one among the smallest distances of individual p' E P' from P. It is thus sensitive to generation of outliers in the resulting P'.
( indicates, the Hausdorff distance finds the
Distances computed by the functions [ and 2 rely on those between the individual points {p() )=1 and {pr which does not involve geometries of local surface patches associated with these indi- vidual points; consequently, the resulting P' could be close P when measured by (T) and/or ( but changes of geometric details at certain local patches could be clearly visible, causing failure to achieve the objective of imperceptible deformation.
Consistency of Local Curvatures Our way of achieving geometry-aware imperceptibility is to constrain the point cloud deformation such that local patches of the surface approximated by the resulting '' have curvatures whose magnitudes are similar to those of the corresponding patches of the surface approximated by P. Since computations in this work are conducted on the discrete surface approximation of point clouds, we propose discrete notions that approximately characterize curvatures of local surface patches.
More specifically, for any point p' P', find its closest point p E P by p= arg minpep ||p'
pll2- There exist local point neighborhoods No. C C'' and Np C P respectively associated with p' and p, which are obtained in this work by searching l nearest neighbors, suggesting W = W = k. To capture the local geometry of Nr, we rely on the following discrete notion
1 Σ
<(p; P)
1((g p)/llq p12a. pp)):
(3)
T
geA,
3

---

Under review as a conference paper at ICLR 2020
where np denotes the unit normal vector of the surface at p. The term (3) intuitively measures the averaged angles between the normal vector and the vector defined by pointing p towards each of its neighboring points. Indeed, since the normal vector np is orthogonal to the tangent plane of the surface at p. each inner product in (3) characterizes how the normals vary directionally in the local neighborhood Np. thus approximately measuring the local, directional eurvature, and an average of NN inner products in (3) approximately measures the local, mean curvature. Note that unit normal vector T&p in (3) can be computed from Np via eigen-decomposition of the set ((p)) (Hoppe et al. 1992). We compute (p':P) in the same way as (3) with subtle difference that instead of computing n from Ng.. we directly use np, i.e., the unit normal vector of the point in P that is closest to p', as surrogate of niz.. since normal vectors of P can be pre-computed and efficiently retrieved during the deformation
leaaniin learning.
Given K¹ P'' P) and k(p; P), we use the following criterion to encourage the consistency of local geometries between any p' E p' and its closest point
P
Courvatura (P'P)
Σ P'EP'
[w'd': k(p; P)p s.1. p arg min Ipp' p122- pEP
(4)
where we write n' P''
,',P) P) since the normal vector involved in its computation is from the corre-
sponding one of P. Note that terms similar to (3) are also used in (Wang al.) [018 Tang et al.]
2019) for single-view surface reconstruction. Our use of the term (3) in (4) is to encourage the consistency local surface geometries between P' and P. rather than to directly minimize 3 as in [Wang et al. 2018 Tang et al. 2019).
The Combined Geometry-aware Objective We use the following combined objective to learn the deformed P' by either adversarial or cooperative perturbations of individual points of P
Geometrr (P', P) Cchantor (P', PP) + a CHausdorft (P', Cearvature (P', ,P,P), (5)
where a and B3 are the weighting parameters.
3.2 GENERATION OF ADVERSARIAL POINT CLOUDS
Assume point cloud classification model f X + V. An adversarial example of a point cloud P is a crafted malicious input P' to the model f(.), with imperceptible deformation, such that P' is misclassified by the model. Let the true label of P be y E V. it means that f(P)) * y- Adversarial examples can be generated either by untargeted or targeted attacks. Similar to (Xiang al. 2019), we focus in this work on the more difficult task of targeted attack for point cloud data, which generates P' such that it is classified as specified class y/ + y. i.e., ʃ(P") -V.
Among various attack models proposed for 2D image classification (Madry et al. 2017 Carlini & Wagner (017), we adopt the state-of-the-an thertrr framework of C& W attack (Carlini & Wagner 2017
Its objective can be generally written as
min (xd) + A ||æ0 - x01pp
(6)
where x is the benign signal (e.g., an image) and x' is the adversarial example to be optimized. The misclassification loss (ad+( is regularized by a X weighted, (n-norm based term that con- strains the noise magnitude of adversarial æ'. To specify Cado(x'). we assume a classification model f(-) be implemented as a deep network, and denote as g(-) the function that outputs the network logits, i.c., 9(-) includes all layers of the network except the final softmax. Let the targeted label attacking x as yf C&W attack commonly uses a margin based loss function as Cada((=) max (maxiTy' Di (x.) gy (a'),))
In this work, we adopt the C&W attack framework, and propose to replace the term of np-ro in (6) with our geometry- aware objective (5). in order to generate adversarial point clouds with imperceptible shape deformations, giving
min CAdo (P') + X (P',(P) pr
)P)(a in C&W attack ceases pursuing more adversarial The original choice of margin based C CAd)
examples once maxizy' (P)))) Dy (P') S 0, assuming that further optimization would reduce
4

---

Under review as a conference paper at ICLR 2020
the imperceptibility of the resulting P', Our proposed coometry-awane (5) allows to take more aggressive strategy, and we propose to use the following term as our misclassification loss
Cado - -log explgy (P'))/ Σ exp(o
(8)
Our proposed objective 7
with term (8) continues to pursue more adversarial, arguably less defend-
able, point clouds without introducing noticeable shape deformations, as empirically verified by our experiments in section 4
3.3 GENERATION OF COOPERATIVE POINT CLOUDS
The adversarial objective 7 motivates to think of opposite direction of geometry-awan point cloud deformations that are less noticable by humans. Specifically. is it possible to perturb points manner such that the resulting P' is more favored by
of any P in cooperative, geometry machine learning models in terms of improved classification confidenceeaccuracy". Technically, for given classifier [-), this seems to be achieved trivially by optimizing
min CCoop (P') + X (Geo
(9)
with the cooperative loss term as
Cooop (P') - (P'() Σ expla((P)))
(10)
where we simply use the true label y of P replace the targeted attack label y/ * y in
Given knowledge of the true label of P. the objective (9) seems only learn a deformed P' that overfits the classifier f()), which could be practically less meaningful. In this work, we present the following interesting, but less explored investigation based (9). which suggests that subtle deformations of shape instances common object categories (c.g., those in ShapeNet (Chang et al., 2015 could lead practical meanings in terms of being better perceived by existing 3D point set classification models (Qi et al. 2017a Wang et al. 2019b).
Assume given set of point clouds (P.) ym of different object categories. We take the following procedure on {P.)
1. We divide (P, ) evenly into subsets, with consideration of class balance.
2. We use the first 8 - subsets as training data to train a classifier (*(.), and use the objective
99) to cooperatively deform point clouds in the sth subset (the validation set) w.r.t. f*).).
3. We perform s times of step 2 by using each of the subsets as the validation set, obtaining f(()), I,..., s, and the aggregated collection of deformed {P
The above procedure can optionally be conducted for multiple times to further increase the degree of deformations, with awareness of geometric imperceptibility. We use the obtained {Pi) in standard training-and-ter setting of point set classification. That is, we split (P() as training and test data, whose indices are the same those of the original (Pe 1m and train new classifier f()) to evaluate f()) on the split test data.
The obtained (P are indeed cooperative when performance of f(.) is improved over that of
the original classifier (()). In fact, we have further conducted cross-model experiments by learning
(P via the above procedure with PointNet (Qi et al. 2017a). and train and evaluate f(.) of other representative point set classifiers (e.g., PointNet++ QQ et al. 2017b) and DGCNN (Wang al. 2019b)). We have also conducted experiments by converting the obtained /= to their mesh representations (Edelsbrunner et al. 1983), and uniformly re-sample points from the meshes
to form )P') classification performance again improves by training and testing on {P',)m confirming that we are indeed cooperatively deforming the underlying object surfaces.
While our above investigations remain in the digital space, cooperative deformations of point clouds could be physically achieved either by changes of shape design for common rigid objects, or by de- signing special devices that actively control the reflections of laser pulses from LiDAR (Cao al.
5

---

Under review as a conference paper at ICLR 2020
2019).
Physical world adversarial attacks (Athalye al. 2017 Eykholt al.) 2018) actively
pursued recently in the 2D image domain. Deformations of geometry-award imperceptibility make sense here since we not to change the geometrie and/or topoloical surface structures of the ob- jects; otherwise the deformations would have influence on human perception or functional attributes of the objects.
4 EXPERIMENTS
Dataset We use point clouds of object instances from ModelNet40 (Wu al. 2015) to evaluate our proposed algorithms. The dataset consists of 12, 311 CAD models belonging to 40 semantic cate- gories. For each CAD model, 1, 024 points are uniformly sampled from its surface the working point clouds, which are re-scaled into a unit ball following (Qi ct al. 20176).
We evaluate the adversarial and cooperative generation of point clouds based on three representative classifiers, namely PointNet (Qi et al. (017a), PointNet++ (Qi et al. 2017b), and DGCNN (Wang al., 2019b). More details of the networks please refer A.6 versarial setting, we follow the official data split for 3D classification (Qi et al. 201 7 b) and use 9, 8843 samples of point clouds for training classifiers that are to be attacked, and for testing, we fol- low (Xiang et al.] 2019) and randomly select 25 samples from each testing set of the top-10 object classes (ordered by sample sizes of these classes, giving rise to airplane, bed, bookshelf, bottle, chair, monitor, sofa, table, toilet, vase); all adversarial attack algorithms evaluated with white-box, targeted attack protocol. In our cooperative setting, we set the subset number as $ = 5.
Models and Protocols
our ad-
Evaluation Metrics We respectively
the attack success rate (i.e., misclassification rate) and classification accuracy to evaluate the algorithmic effectiveness in our adversarial and cooperative settings. For both metries, the higher, the better.
Implementation Details We set k = 16 to define local point neighborhoods for computation of 0.1 and | 1.0 for our proposed geometry- aware loss (5), and the trade-off parameter À in 7 and (9) is optimized via 10-step binary search.
normals and approximate curvatures in (3). We fix
We use Adam optimizer (Kingma & Ba 2014) train networks, and set its learning rate as 0.01.
4.1 EVALUATION ON GENERATION OF ADVERSARIAL POINT CLOUDS
In this section, we evaluate the efficacy of our proposed geometry-awan objective 7 for generation of adversarial point clouds. We dub our method as Geoeware and compare with the method (Xiang et al. 2019), which is among the only few existing works (Liu et al.) 2019a b) addressing adversarial point clouds and takes the same white-box, targeted attack as our method does. Objec- tive of (Xiang et al. 2019) strictly follows the C&W attack (6) (Carlini & Wagner| 2017), with margin-based misclassification loss regularized by Iz-norm constraining magnitude of point pertur- bations. We also compare with degenerate version of our method, dubbed DeoeegenerateAAl, which replaces the geometry-aware term (5) with a similar lg-norm as in (Xiang et al. 2019). These experiments are conducted using PointNet (Qi et al. 201 7a) as the model of classifier.
Ablation Studies To investigate how different terms in our proposed geometry-aware loss (5) we conduct ablation studies by removing each of them from (5). and use the remaining ones into the adversarial objective (7) for point cloud generation. Figure I shows that these terms all together contribute smooth and outlier-free results. Without using CD, the shape deformations go to unex- pected twists. The use of HD and curvature terms largely removes generation of outliers, with the later one further improving the surface smoothness.
Comparative Results We report comparative results of our GeoAwareAdv, GeoDegenerate and the method (Xiang et al. 2019) in Table and Figure 2 Table comparre the attack success rates under two defense methods of SOR (Zhou et al. 2018) and Random Romoval (RR). SOR is the current state-of- -fete-artt- method to defend attacking of point clouds, which works by dropping certain points from a point cloud based on statistical analysis. RR simply drops points from a point cloud randomly. Based on our stronger adversarial term (). both of our methods achieve better success rates than those of (Xiang al. 2019) under different dropping settings of the defenses SOR and RR. More significantly, the stronger attacking effects of our GeoAware are achieved without introduction of noticeable outliers and surface irregularities, as shown in Figure 2 in contrast, the

---

Under review as a conference paper at ICLR 2020
bookshelf
monitor
sofa
toilet
GeoAware loss
w/o CD
term
w/o Curvature term
Figure 1: Ablation studies on the effectiveness different terms our geometry- aware loss (5) for generation of adversarial point clouds. See the main text for experiment settings of these results. More quantitative results please refer to A.44
bed
bookshelf
monitor
sofa
toilet
The method
(Xiang et al., 2018)
Degeeeeeee Adv (our vairant)
Geo-AwrreAdy (our method)
Figure 2: Comparative quality results of different methods successfully attacking the classifier of PointNet QQi et al. 2017a).
use of simple 12 norm in (Xiang et al. 2019 produces its adversarial results with clear outliers. Advantages of our Ged are essentially due to the use of HD and curvature terms in our geometry-aware loss (5).
Table Success rates (%) different methods attacking the classifier PointNet (Qi et al. 2017 7a) under defenses of SOR (Zhou et al.) 2018) and Random Romoval (RR). We report results with different numbers of dropping points for the two defense methods. For all methods, attack success 100% without defense. More details of RR and SOR please refer to A.7
Attack success rate (S)
Defense
by dropping different
points
1
16
32
G1
128
2316
method Xiung
2019
16.00
GeoDegenerttAAd tour Vairant)
RR
98.17
96.63
91.61
90.06
84.89
76.65
61.32
38.64
17.38
GcoAwareAdv methed)
The method Xiung et al. 2019
12.71
7.29
3.69
1.96
1.51
1.24
0.71
0.67
1.56
GeoDogeneratAAu
Gev-wareAds (our method)
98.84
97.
96.08
92.74
87.62
77.06
61.29
41.38
28.20

---

Under review as a conference paper at ICLR 2020
(6)
Visualization of cooperative point clouds generated based on PointNet. (a) Vanilla point clouds, (b) Cooperative point clouds, and (c) Uniformly re-sampling the mesh surface of (b).
Figure 3:
4.2 EVALUATION ON GENERATING GEOMETRY-AWARD COOPERATIVE POINT CLOUDS
Classification accuracy (%) of different networks trained on different source of data, cluding vanilla point clouds, cooperative point clouds and its variant generated based PointNet. The state-of-the-ar Geo-CNN (Lan et al. 2019) achieves the classification accuracy of 93.90%.
Table 2:
Classification accuracy
PointNer
Poin:Net++ DGCNN
Vanilla point clouds
87.96
89.50
90.64
Cooperative point clouds (ours)
96.88
94.32
96.27
Re-sampling variant
94.81
91.12
Comparative Evaluation Cooperative point clouds are generated based on the PointNet via opti- mizing objective function ( and variant can be re-sampled point clouds from its mesh surface. A number of recent classifiers are trained and evaluated on vanilla and cooperative point clouds re- spectively, whose results are reported in Figure and T can be observed from Table both cooperative point clouds significantly outperform the vanilla ones by a large margin, i.e. increase at least 6% on classification accuracy. Moreover, performance gap between two types of cooperative point clouds can be explained by both approximation errors of mesh reconstruction and the changes on point distribution, which encourage us to consider adversarial shape deformations on the mesh level.
Cross-model experiments We conduct one more cross-model experiment to test transferable char- acteristics of cooperative point clouds across classifiers, i.e., generating cooperative examples PointNet, while train and evaluate other classifiers. Results in Table consistent improvement on classification accuracy achieved for different neural classifiers, which reveal that cooperative shape deformations on point clouds can capture discriminative geometric patterns favor for seman- tic object classification, which are independent on neural models.
5 CONCLUSIONS
In this paper, we propose compact geometry-aware loss to constrain point-wise imperceptible perturbations to achieve similar geometric smoothness and fairness local patches and their global topological configuration in deformed point clouds as the original ones. Experiment results reveal the rationale of three components in the proposed geometry- aware loss for generating adversaries without evident outliers and shape irregularities, which thus achieve adversarial effects confronting the SOR defense. Moreover, cooperative generation on point clouds also demonstrates its positive effects on improving classification with aware of geometric properties.
8

---

Under review as a conference paper at ICLR 2020
REFERENCES
Anish Athalye, Logan Engstrom, Andrew Ilyas, and Kevin Kwok. Synthesizing robust ad adversarial examples. arXiv preprint 0rXiv:1707.07397 2017.
Kwang-Ho Bae. Automated registrution of unorganised point clouds from terrestrial laser scanners. PhD thesis, Curtin University, 2006.
Mario Botsch, Leif Kobbelt, Mark Pauly, Pierre Alliez, and Bruno Lévy. Polygon mesh processing. AK Peters/CRC Press, 2010.
Yulong Cao, Chaowei Xiao, Benjamin Cyr, Yimeng Zhou, Won Park, Sara Rampazzi, Qi Alfred Chen, Kevin Fu, and Z Morley Mao. Adversarial sensor attack on lidar-based perception in 2019.
autonomous driving. arXiv preprint
Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017
IEEE Symposium on Security and Privacy (SP), pp. 39-57. IEEE, 2017.
Angel X. Chang, Thomas Funkhouser, Leonidas Guibas, Pat Hanrahan, Qixing Huang, Zimo Li, Silvio Savarese, Manolis Savva, Shuran Song. Hao Su, Jianxiong Xiao, Li Yi, and Fisher Yu. ShapeNet: An Information-Ries 3D Model Repository. Technical Report #rXiv:1512.0301 [cs.GR], Stanford University - Princeton University - Toyota Technological Institute at Chicago, 2015.
Herbert Edelsbrunner, David Kirkpatrick, and Raimund Seidel. On the shape of set of points in the plane. IEEE Transactions on information theory, 29(4)5551-55, 1983.
Kevin Eykholt, Ivan Evtimov, Earlence Fernandes, Bo Li, Amir Rahmati, Chaowei Xiao, Atul Prakash, Tadayoshi Kohno, and Dawn Song. Robust physical-world attacks on deep learning visual classification. June 2018.
Haoqiang Fan, Hao Su, and Leonidas J Guibas. A point generation network for 3d object recon- struction from a single image. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 605-613, 2017.
Thibault Groueix, Matthew Fisher, Vladimir G. Kim, Bryan Russell, and Mathieu Aubry. AtlasNet: A Papier-Mäché Approach to Learning 3D Surface Generation. 2018a. 8a.
Thibault Groueix, Matthew Fisher, Vladimir G. Kim. Bryan C. Russell, and Mathieu Aubry. A papier-mache approach to learning 3d surface generation. 2018 IEEE/CVF Conference on Computer Vision and Pattern Recognition, Jun 2018b. doi: 10.1109/0vp:20188.0003 200000000.. URL http::/ doi. /ttg//...1i0 evpr 2018. 00030
Tong He, Haibin Huang, Li Yi, Yugian Zhou, Chihao Wu, Jue Wang, and Stefano Soatto. Geonet:
Deep geodesic networks for point cloud analysis. pp. 6888-6897, 2019.
Hugues Hoppe, Tony DeRose, Tom Duchamp. John McDonald, and Werner Stuetzle. Surface re- construction from unorganized points. ACM, 1992.
Diederik P Kingma and Jimmy Ba. Adam: A method for stochastic optimization. arXiv preprint arXiv:1412.6988, 2014.
Shiyi Lan, Ruichi Yu, Gang Yu, and Larry S Davis. Modeling local geometric structure of 3d point clouds using geo-cnn. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 998-1008. 2019.
Daniel Liu, Ronald Yu, and Hao Su. Extending adversarial attacks and defenses to deep 3d point cloud classifiers. pp. 2279-2283, 09 2019a. doi: 11100/11..0119888337777
Daniel Liu, Ronald Yu, and Hao Su. Adversarial point perturbations on 3d objects, 2019b.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. arXiv preprint 17X1::7706.06833 2017.

---

Under review as a conference paper at ICLR 2020
Charles R Qi, Hao Su, Kaichun Mo, and Leonidas J Guibas. Pointnet: Deep learning on point sets for classification and segmentation. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 652-660, 2017a.
Charles Ruizhongtai Qi, Li Yi, Hao Su, and Leonidas J Guibas. Pointnet++: Deep hierarchical feature learning on point sets in a metric space. In Advances in Neural Information Processing Systems, pp. 5099-5108, 2017b.
Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199 2013.
Jiapeng Tang, Xiaoguang Han, Junyi Pan, Kui Jia, and Xin Tong. A skeleton-bridged deep learning approach for generating meshes complex topologies from single rgb images. In Proceedings of the IEEE Conference Computer Vision and Pattern Recognition, pp. 4541-4550 2019.
Kaiqi Wang. Ke Chen, and Kui Jia. Deep cascade generation on point sets. In Proceedings of the Twenty-Eighth International Joint Conference on Artificial Intelligence, IJCAI-19, pp. 3726- 3732. International Joint Conferences on Artificial Intelligence Organization, 7 2019a. doi: 10. 2011 URL
/ow::///o..... org/ 10..100000
2019/517
Nanyang Wang, Yinda Zhang, Zhuwen Li, Yanwei Fu, Wei Liu, and Yu-Gang Jiang. Pixel2mesh: Generating 3d mesh models from single rgb images. In Proceedings of the European Conference Computer Vision (ECCV), pp. 52 2018.
Yue Wang, Yongbin Sun, Ziwei Liu, Sanjay E. Sarma, Michael M. Bronstein, and Justin M. Solomon. Dynamic graph enn for learning on point clouds. ACM Transactions on Graphics (TOG), 2019b.
Matthew Wicker and Marta Kwiatkowska. Robustness of deep learning in an adversarial setting. In Proceedings of the IEEE Conference Computer Vision and Pattern Recognition, pp. 11767- 11775, 2019.
Zhirong Wu, Shuran Song, Aditya Khosla, Fisher Yu, Linguang Zhang, Xiaoou Tang. and Jianxiong Xiao. 3d shapenets: A deep representation for volumetric shapes. In CVPR, 2015.
Chong Xiang, Charles R Qi, and Bo Li. Generating 3d adversarial point clouds. pp. 9136-9144, 2019.
Chaowei Xiao, Dawei Yang. Bo Li, Jia Deng, and Mingyan Liu. Meshadv: Adversarial meshes for visual recognition. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 6898-6907, 2019.
Jiancheng Yang, Qiang Zhang, Rongyao Fang, Bingbing Ni, Jinxian Liu, and Qi Tian. Adversarial attack and defense on point sets. arXiv preprint 192. 2019.
Yaoqing Yang, Chen Feng. Yiru Shen, and Dong Tian. Foldingnet: Point cloud auto-encoder via deep grid deformation. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 206-20 225, 2018.
Tianhang Zheng, Changyou Chen, Junsong Yuan, Bo Li, and Kui Ren. Pointcloud saliency maps. 2018.
Hang Zhou, Kejiang Chen, Weiming Zhang, Han Fang, Wenbo Zhou, and Nenghai Yu. Dup-net: Denoiser and upsampler network for 3d adversarial point clouds defense. 2018.
10

---

Under review as a conference paper at ICLR 2020
A APPENDIX
A.1
VISUALIZATION OF MORE GEOMETRY-AWARE ADVERSARIAL EXAMPLES.
airplane
bed
bookshelf
bottle
chair
monitor
sofa
table
toilet
airplane
bed
bookshelf
boutle
chair
monitor
sofa
table
toilet
Figure 4: Visualization of proposed geometry aware adversarial examples based PointNet. We show all kinds of our selected categories here targeted on all the other classes. The diagonal examples corresponding benign ones.

---

Under review as a conference paper at ICLR 2020
A.2 VISUALIZATION MORE COOMETRY-AWARE COOPERATIVE EXAMPLES.
airplane
bathtub
bed
bench
bookshelf
bottle
bowl
car
chair
cone
cup
curtain
desk
door
dresser flower pot
glass box
guitar keyboard
lamp
laptop
monitor night stand
piano
plant
radio
range hood
sink
sofa
stair
stool
table
tent
toilct
TV stand
vase
wardrobe
xbox
Figure 5: Visualization of our proposed geometry-aware cooperative examples based on PointNet. We show all kinds of categories in the dataset.
aimplane
bathtub
bed
bench
bookshelf
bottle
bowl
car
chair
cone
cup
curtain desk
door
dresser flower pot
glass box
guitar keyboard
lamp
laptop
mantel monitor night stand
person
piano
plant
radio
range hood
sink
sofa
stair
stool
table
tent
toilet
TV stand
vase
wardrobe
xbox
Figure 6: Visualization of proposed resampling after-rfteaeee reconstructioo geometry-aware coop- erative examples based on PointNet. We show all kinds of categories in the dataset.
12

---

Under review as a conference paper at ICLR 2020
A.3
ABLATION STUDY OF DIFFERENT AND 3.
0.001
1.0
10.0
Different term
0.001
10.0
Different Curvature term
Figure 7: Qualitative results of adopting different and 3. All the adversarial examples are gen- erated via targeted attacked method to the same target. We fix all the other hyperparameters when tuning one. The default parameters leads to more obvious outliers; and larger a leads to the deformation of the point cloud, due to the overwhelming focus the outliers while ignoring the whole shape. On the other hand, smaller leads to high frequency outliers near the surface; and again, larger / leads to the deformation of the whole point cloud.
0.1 and 3 = 1.0. As can be seen in the figure, smaller
A.4 QUANTITATIVE RESULTS FOR FIGURE
It's hard define metric evaluating geometrical smoothness of point cloud directly due to its irregularity and lacking of geometric topological connection. Hence, we introduce an approximation metric mainly focuses on measuring the strength of isolated noisy points and the roughness of local patches, which can be defined as:
S(P) max Σ TNp) QEN,
(11)
where estimated tangent plane the & nearest neighbors No p is denoted by TN and D denotes the distance function between the points and the tangent plane, where use l norm in our
settings. Intuitively, we are calculating the residual of first-order Taylor expansion of the points we estimate the first-order approximation of point p, i.e. the tangent plane TNp, and then measures how far its neighbor points Np are to this plane. Note that we set the N = k to be small to reduce approximation error, where in the following settings k 16.
We evaluate S(P) on the experiments of Figure 1 and the quantitative results are shown in the following Table 3 As can be seen in the table, with all the losses, the geometry-aware adversarial point clouds achieve the lowest S(P), where the point clouds are smoothest. And with many outliers, the adversarial point clouds without Hausdorff Distance get the highest S(P). The quantitative results of the point clouds without Chamfer Distance are a little higher than the point clouds without Consistency of Local Curvatures, which is consistent with our perception the point clouds without Consistency of Local Curvatures are also very smooth expect for some high frequency outliers near their surfaces.
13

---

Under review as a conference paper at ICLR 2020
Table 3: Quantitative results of the ablation study Figure | with and without individual components. We take average over all the samples. Lower value means smoother point clouds.
We evaluate smoothness metric S(P)
Methods
Smoothness avg.
Whole geometry-aware loss
0.1047
Without Chamfer Distance
0.1214
Without Hausdorff Distance
0.1895
Without Consistency of Local Curvatures
0.1210
A.5 USER STUDY ON AMAZON MECHANICAL TURK (AMT).
We conducted a user study on Amazon Mechanical Turk (AMT) in order to verify the impercep- tible quality of our adversarial examples. We upload the snapshots of three kinds of point clouds including the benign point clouds, the adversarial point clouds generated via the method of [iaang al. (2019) and our geometry-aware adversarial ones. All the adversarial point clouds cessfully mislead PointNet. Participants were asked to compare which one of the adversarial point clouds
geometrically similar to the original one. The order of two kinds of adversarial point clouds was randomized and all the images appeared in the middle of the screen on each trial. Each participant could conduct most 30 trials and each adversarial images can be shown to 50 different participant at most. In total, we conduct 1500 trials among 128 participants. And our geometry-aware adversarial point cloud are considered to be closer to the original ones in 82.06% of the trials, which indicates that our geometry-awan point clouds are more imperceptible. We think this experiment can further support our opinion that our geometry-aware adversarial examples are more imperceptible to humans. And will attach this experiments to the appendix of our revised paper.
A.6 INTRODUCTION OF OUR POINT CLOUD CLASSIFIER.
The PointNet (Qi al. 2017a and Pointnet++ (Qi et 2017b) are the first attempts to explore deep point cloud classification, with the permutation invariance of points in multi-layer perceptrons (MLPs) and a symmetric function for aggregating features. Both methods can only implicitly model global semantic patterns from 3D geometry. Another groups of algorithms design graph based convolution operation on irregular distributed structure of points such as DGCNN (Wang et al. 2019b). In DGCNN, an edge convolution operation is proposed on dynamic graph to discover local geometric manifolds.
We mainly focus on PointNet Qi et al. (2017a) baseline due to its simple structure and good performance. The classier f can be formulated as S(P) = (maxx. (h(p:))) where and h are two learnable parameters of the neural network.
A.7 INTRODUCTION OF DEFENSIVE ALGORITHM
We adopt kinds of defense method including random removal method (RR for short) and statistic outlier removal method (SOR for short ZZho et al. (001)) as the defensive method.
In RR, randomly select subset of points from the point cloud and drop it. And in SOR, calculate the average distance dp of a point to its k-nearest neighbors, which can be denoted by
1 Σ g/i2 dp T
(12)
qEN,
And then we calculate the mean d and standard deviation aa all the distance dp of points in the point cloud p P. We remove all the points that fall outside d + X da, where is set to be 1.1 in Zhou et al, (0118). According to our experiments, around 100 points will be dropped out of 1024 points when set to be 1.1.
14

---

Under review as a conference paper at ICLR 2020
However, in our settings, we drop fix number points with m-largest dp for fairer comparison between different methods. We drop k = 1, 4, 8, 16, 32, 64, 128, 256 respectively Table
15


Reviews:
[{"review_id": "ryle0T519r", "reviewer": "AnonReviewer2", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "This paper looks at the task of (adversarially or cooperatively) perturbing a point cloud in context of a classification task. It follows the prevailing paradigm of changing the original input in the direction of a high positive/negative gradient while staying ‘close’ to the original input, and the key contribution here is to define a different notion of ‘closeness’.\n\nWhile previous work (Xiang et. al., at least for ‘point addition attack’) used a combination of chamfer and Hausdorff distance as the notion of closeness, this paper additionally includes change in curvature (which is an intuitive term to include) when computing the adversarial/cooperative updates to the point cloud. The obtained results do visually look less perturbed compared to the previous approach, and the obtained adversarial shapes are more robust against two defenses studied.\n\nConcerns/Questions:\n\n1) If a point cloud P’ is only a (small) perturbation of a point cloud P, then the Chamfer distance / Hausdorff distance is essentially the  L_2 / L_infinity norm of their difference. While the use of curvature terms is different, I feel the claims of importance of using ‘distance metric of point clouds’ is not very well justified (as I’d expect essentially same results if these two terms were replaced by L2 and L_infinity norms instead). I think the use of these terms was more necessary in the work of Xiang et. al., as they allowed point addition, so the ‘norm of difference of point clouds’ is not well defined.\n\n2) This paper uses a different (more aggressive) adversarial term (in Eqn. 8) compared to Xiang et. al., so it is not surprising that the results in Table 1 indicate more robustness to defenses.\n\n3) In addition to the above comments about specifics, I feel this work’s contribution over prior work is not significant. While Xiang et. al. did use L2 norm for their perturbation case, they did investigate the Chamfer/Hausdorff distances for another scenario, and therefore the main contribution here is an additional loss term.\n\n4) This is perhaps a hard concern to address, but simply showing some qualitative results to highlight that the changes are ‘imperceptible’ is not sufficient. Ideally, one should report a curve on ‘change perceptibility’ vs ‘attack success rate’ (though this would require some notion of perceptibility that was not used in optimization). Alternately, one could compare methods via A/B testing on mechanical turk, asking ‘Which are these two shapes are closer to the original one?’, and ablate for a certain level of confidence on the wrong class, which approach led to less changes. The current results simply show some examples, but provide no empirical way of judging which approach actually leads to more imperceptible changes.\n\nOverall, though the results are perceptually encouraging, I have slight concerns the empirical results reported. However, the primary issue is that the contribution regarding the additional term, while intuitive, is not a significant one in its own right.\n\nWhile the rating here only allows me to give a ‘3’ as a weak reject, I am perhaps a bit more towards borderline (though leaning towards reject) than that indicates.\n", "extra_scores": {"experience_assessment": "I have read many papers in this area.", "review_assessment:_thoroughness_in_paper_reading": "I read the paper thoroughly.", "review_assessment:_checking_correctness_of_experiments": "I carefully checked the experiments.", "review_assessment:_checking_correctness_of_derivations_and_theory": "I assessed the sensibility of the derivations and theory."}, "extra_text": {}}, {"review_id": "SJxzT10hYH", "reviewer": "AnonReviewer3", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "This paper proposes a novel loss function to account for imperceptible, geometry-aware deformations of point clouds. The loss is used in two cases: generating adversarial point clouds to attack representative models of point set classifiers, and generating cooperative point clouds to improve classification confidence or accuracy. The combined geometry-aware objective is well-introduced, which mainly contains Chamfer distance term, Hausdorff distance term and local curvatures consistency term. The authors apply the geometry-aware objective to generate adversarial point clouds by adopting the framework of C&W attack. For generating cooperative point clouds, the authors introduced a training procedure to reduce the overfitting of the deformed point clouds. Most of the experiments are well-conducted, and demonstrate the effectiveness of the proposed loss function. \n\nOverall, the paper is a well-written and could be an interesting contribution. However, I would like it better if it does not contain the part about the cooperative point clouds, which are not very motivated and the experiment settings are not very convincing. The algorithm in page 5 inherently used testing labels (suppose some testing data is in the training split of one of those cross-validation folds, training for the P_i' for the rest of the training data). I don't know why experiment results generated by this method would be of any meaning. I would be OK to accept this paper if the cooperative point cloud part is dropped.\n\n- In page 5, the authors introduce a procedure to train the model. The first step would require take the “consideration of class balance”. It would be better to give some details on how the class balance is considered.\n\n- In ablation study, the authors give some visualization results in Figure 1. However, it would be more interesting if the authors could give some quantitative results. \n\n- It would be interesting to show some ablation study on how to choose the  α, β and λ .\n", "extra_scores": {"experience_assessment": "I have published one or two papers in this area.", "review_assessment:_thoroughness_in_paper_reading": "I read the paper thoroughly.", "review_assessment:_checking_correctness_of_experiments": "I carefully checked the experiments.", "review_assessment:_checking_correctness_of_derivations_and_theory": "I assessed the sensibility of the derivations and theory."}, "extra_text": {}}, {"review_id": "H1e7frzf9H", "reviewer": "AnonReviewer1", "summary": "", "questions": "", "limitations": "", "rating": 8, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "This paper describes a new targeted adversarial attack against 3D point cloud object classifiers that is robust to several countermeasures. The attack finds a point of the target class that is close to the original point cloud in terms of a more complicated metric that combines the Hausdorff distance, the Chamfer distance, and a curvature distance measure. The proposed attack is 100% successful against several different state of the art classifiers on a dataset of 1024-point clouds sampled from 25 instances of CAD models of each of 10 common objects without any countermeasures.  When the Random Removal countermeasure is used, the attack is still successful almost 50% of the time even when 256 points are removed as compared to two other attacks that are only ~17% successful. When the SOR countermeasure is used, the attack is 60% successful when 64 points are removed as compared to <1% for the comparison attacks. The attack can also be used in reverse for data augmentation in training and can cut error rates almost in half.\n\nOverall, this seems like a large improvement over current approaches. The paper does a good job of explaining its approach and motivation and does an excellent job of situating its contributions within the existing literature. The experiments show that the improvements in success are large over competing attacks, that they are robust to current countermeasures. They also show that when used \"cooperatively\" they can improve performance substantially.\n\nOne issue that could be easily addressed is that Table 2 is mentioned on page 5, but doesn't appear until the end of page 7. It is also mentioned before Table 1. So I would recommend changing it to Table 1 and introducing it before it is mentioned.\n\nIt would also be nice to have some basic descriptions of the point cloud classifiers and the SOR countermeasure. Space for this could be regained from some of the figures, which are informative, but over-represented.", "extra_scores": {"experience_assessment": "I have read many papers in this area.", "review_assessment:_thoroughness_in_paper_reading": "I read the paper at least twice and used my best judgement in assessing the paper.", "review_assessment:_checking_correctness_of_experiments": "I assessed the sensibility of the experiments.", "review_assessment:_checking_correctness_of_derivations_and_theory": "I assessed the sensibility of the derivations and theory."}, "extra_text": {}}]

Author rebuttal:

Meta-review: This paper offers an improved attack on 3-D point clouds. Unfortunately the clarity of the contribution is unclear and on balance insufficient for acceptance.
Decision: Reject