PointDP: Diffusion-driven Purification against 3D Adversarial Point Clouds
Authors: Jiachen Sun
Jiongxiao Wang
Weili Nie
Zhiding Yu
Zhuoqing Mao
Chaowei Xiao
Venue: Submitted to ICLR 2023 (2023)
Keywords: Adversarial Robustness
Point Cloud Classification
Diffusion Model

Abstract: 3D Point cloud is a critical data representation in many real-world applications, such as autonomous driving, robotics, and medical imaging. Although the success of deep learning further accelerates the adoption of 3D point clouds in the physical world, deep learning is notoriously vulnerable to adversarial attacks. Various defense solutions have been proposed to build robust models against adversarial attacks. In this work, we identify that the state-of-the-art empirical defense, adversarial training, has a major limitation in 3D point cloud models due to gradient obfuscation, resulting in significant degradation of robustness against strong attacks. To bridge the gap, we propose PointDP, a purification strategy that leverages diffusion models to defend against 3D adversarial attacks. Since PointDP does not rely on predefined adversarial examples for training, it can defend against diverse threats. We extensively evaluate PointDP on six representative 3D point cloud architectures and leverage sixteen strong and adaptive attacks to demonstrate its lower-bound robustness. Our evaluation shows that PointDP achieves significantly better (i.e., 12.6\%-40.3\%) adversarial robustness than state-of-the-art methods under strong attacks bounded by different $\ell_p$ norms. 

Under review as a conference paper at ICLR 2023
PointDP: DiFFUSION-DRIVEN PURIFICATION AGAINST 3D ADVERSARIAL POINT CLOUDS
Anonymous authors Paper under double-blind review
ABSTRACT
3D Point cloud is a critical data representation in many real-world applications. such as autonomous driving, robotics, and medical imaging. Although the success of deep learning further accelerates the adoption of 3D point clouds in the physi- cal world, deep learning is notoriously vulnerable to adversarial attacks. Various defense solutions have been proposed to build robust models against adversarial attacks. In this work, we identify that the state-of-the-art empirical defense, ad- versarial training, has major limitation in 31) point cloud models due gradient obfuscation, resulting in significant degradation of robustness against strong at- tacks. To bridge the gap, we propose PoinDD, a purification strategy that leverages diffusion models to defend against 3D adversarial attacks. Since PointDP does not rely on predefined adversarial examples for training, it can defend against diverse threats. We extensively evaluate PointD on six representative 3D point cloud architectures and leverage sixteen strong and adaptive attacks to demonstrate its lower-bound robustness. Our evaluation shows that Poin/DP achieves significantly better (i.e., 12.6%-40.3%% adversarial robustness than sfate-of-the-rt methods under strong attacks bounded by different Ep norms.
INTRODUCTION
Point cloud data is emerging as one of the most broadly used representations in 3D computer vision. It is versatile data format available from various sensors like LiDAR and stereo cameras and computer-aided design (CAD) models, which depict physical objects by many coordinates in the 3D space. Many deep learning-based 3D perception models have been proposed [59
34
43
60
41 9
and thus realized several safety-critical applications (e.g., autonomous driving) 81
46
45 Although
deep learning models [41 42 have exhibited performance boost many challenging tasks, extensive
studies show that they are notoriously vulnerable to adversarial attacks 5
49
68
where attackers
manipulate the input in imperceptible manner, which will lead incorrect predictions of the target model. Because of the broad applications of 3D point clouds in safety-critical fields, it is imperative to study the adversarial robustness of point cloud recognition models.
The manipulation space for 2D adversarial attacks is change pixel-level numeric values of the input images. Unlike adversarial examples in 2D applications, the flexible representation of 3D point clouds results in an arguably larger attack surface. For example, adversaries could shift and detach existing points [88), add new points into the pristine point cloud [50], or even generate totally new point clouds [89] to launch attacks. Different strategies, including limits on the number of altered points and constraints on the maximal magnitude of shifted points [30) were proposed to make attacks less perceptible. The flexibility of 3D point cloud data formats enables diverse attacks, thus hindering a practical and universal defense design.
Given the safety-criticn property involved in 3D point cloud applications, various studies have been devoted to advancing the robustness of 3D point cloud recognition models. DUP-Net [90] and GvG-PointNetse [14] pioneered to add statistical outlier removal (SOR) modules as pre-processing and in-network blocks, respectively, as mitigation strategies. More lately, Sun et al. [51] broke the robustness of DUP-Net and GvG-PointNet++ by specific adaptive attacks. Adversarial training has been acknowledged as the most potent defense to deliver strong empirical robustness on PointNet, DGCNN, and PCT [50]. Meanwhile, advanced purification strategies like IF-Defense [66] and LPC 225 leverage more complex modules to cleanse the adversarial point clouds. However, given that point cloud is sparse and unstructured data format, it motivates re-think that whether

---

Under review as a conference paper at ICLR 2023
the current adversarial training and purification-bass based methods robust enough against stronger adversarial attacks?
In this work, our journey starts with revisiting the prior arts and exploring their truly adversarial robustness. By designing various types of strong adaptive attacks, for the first time, demonstrate that standard adversarial training [33] suffers from gradient obfuscation in the point cloud recognition models as the unstructured point cloud data format requires unique architectural designs to digest. We also extensively evaluate IF-Defense and LPC to show that their purification strategies are actually vulnerable to stronger attacks (4.))
Furthermore, propose PoinDDP, adversarial purification method that leverages a diffussio model as pre- pre-procsssing module to defend against 3D adversaries. As shown in Figure PointDP consists of two components (1) off- fef-the-shelf 3D point cloud diffusion model and (2) classifier. Given an input point cloud, PoinDD take two steps: (i) adding noise to the input data gradually via the diffusion process of the diffusion model, (ii) purifying the noised data step by step get the reversed sample via the reverse process of a diffusion model ($ B.J]) and (iii) feeding the reversed sample to the final classifier. Since PointDP does not rely on any types of pre-defined adversarial examples for training. it can defend against diverse unseen threats.
We rigorously evaluate PointDP with six representative point cloud models and sixteen attacks, including PGD [50] 33], C&W 668 8. and point cloud-specific attacks [88 21] with Lo. lg. and foo norms. PointDP on average achieves 75.9% robust accuracy while maintaining similar clean accuracy to the original models, outperforming existing studies by a significant margin. In a nutshell, our contributions are summarized as two-fold:
We are the first to demonstrate that standard adversarial training B3 50]. the most longstanding defense in the 2D image recognition task, has major limitation in its application in 3D point cloud models due to architecture designs. We launch black-box attacks to validate our claim that degrades adversarially trained models' robust accuracy to merely 100, which is longer useful for 3D> point cloud recognition.
We propose PoinDD that leverages diffusion models purify adversarial 3D point clouds. PointDP is general framework that is independent of the diffusion model used. We also formulate rigorous adaptive attacks on PointDP. We conduct extensive evaluation on six representative models with numerous attacks to comprehensively understand the robustness of PointDP. Our evaluation shows that PointDP outperforms previous state-of-the-an purification methods, IF-Defense [66 and LPC [25). by 12.6% and 40.3% average, respectively. We also set up rigorous protocol for 3D robustness evaluation to benefit future research.
RELATED WORK
In this section, we review the current progress of deep learning, adversarial attacks, and defenses for 3D point cloud recognition tasks.
2.1 DEEP LEARNING ON 3D POINT CLOUD RECOGNITION
2D computer vision has achieved stellar progress on architectural designs of convolutional neural networks [22] followed by vision transformers [15). However, there is currently consensus on the architecture of 3D perception models since there is no standard data format for 3D perception (53) As raw data from both 3D scanners and triangular meshes can be efficiently transformed into point clouds, they are becoming the most often utilized data format in 3D perception. 3D networks at the early stage which discretize point cloud to voxel cells for classification, segmentation, and object detection. PointNet pioneered to leverage global pooling help achieve memory-efficient permutation invariance in an end-to-end manner. PointNet++ (42 and DGCNN [61] followed up to add sophisticated local clustering operations to advance the performance. Sparse tensors are the other direction in 3D network designs [19 to use 3D convolutions to improve 3D perception performance. PointCNN and RSCNN reformed the classic pyramid CNN to improve the local feature generation 26 29. PointConv and KPConv designed new convolution operation for point cloud learning [65] (55. PrinsTrrasfrrmer and PCT advanced self-attention blocks in the 3D) space and achieved good performance [87 (0) Various novel local clustering operations (69 (32
use dense voxel grids for perception (59
also show enhancements on the clean performance. In this work, we focus on PointNet, PointNet++,, DGCNN, PCT, CurveNet, and PointMLP as our evaluation backbones since they are representative and widely used and achieve fftte-o-the---eee results in point cloud recognition [[]
2

---

Under review as a conference paper at ICLR 2023
Adversarial Point Cloud
Random Noise
Purification
(Diffusion Process)
(Reverse Process)
"Chair" "Toilet"
Purified Point Cloud
Adversarial Point Cloud
Encoder
Latent Feature z
PointDP
3D Point Cloud Recognition Model
Figure I:
Illustration of PointDP, where PointDP serve as a purification module. We leverage 3 as the diffusion model in our study. The adversarial point cloud will be incorrectly classified as "toilet" by recognition model not purified by our PointDP.
2.2 ADVERSARIAL ATTACKS AND DEFENSES
Adversarial attacks have become the main obstacle that hinder deep learning models from real-world deployments, especially in safety-critical applications [16 49
86
85 There are a lot of adversarial
attacks proposed in the 2D space break the various vision models 8 72
79 75 23
24
73
52]
To fill this gap between standard and robust accuracies, many mitigation solutions have been studied and presented to improve the robustness against adversarial attacks [80 78
4 38
B51
83
70). However, most of them including adding randomization
28
13
14 model distillation 38
have been compromised by 44J, in contrast, delivered a more longstanding mitigation strategy 774 76 84). However, the robust accuracy achieved by AT still not satisfactory enough be used in practice. Most recently, Nie al. proposed DiffPure [36] that leverages diffusion models to defend against adversarial attacks, and following up studies to extend to certified defenses 77].
adversarial detection 33 and input transformation
80
78
37
adaptive attacks (56 2). Adversarial training (AT)
33
64
Adversarial attacks and defenses also extend to 3D point clouds. Xiang et al. [72] first demonstrated that point cloud recogmition models are vulnerable to adversarial attacks. They also introduced different threat models like point shifting and point adding attacks. Wen et al. [62] enhanced the loss
function in C&W W attack to achieve attacks with smaller perturbations and Hamdi et al. [21] presented
transferable black-box attacks point cloud recognition. (3) pioneered study the point dropping
attack under both withe- and black-box settings. Zhou et al. [90] and Dong et al. [14] proposed purify the adversarial point clouds by input transformation and adversarial detection. However, these methods have been successfully by (5T) through adaptive attacks. Moreover, Liu et al. [28] made a preliminary investigation on extending countermeasures in the 2D space defend against simple attacks like FGSM [18] on point cloud data. Sun et al. [50) conducted more thorough study on the application of self-supervised learning in adversarial training for 3D point clodu recognition. Besides ad adversarial training, advanced purification methods IF-Defense [66) and LPC (55 were proposed transform the adversarial examples to the clean manifold. Certified defenses for point clouds have been focusing the adversarial transformations and deformations (30 10 40). In this work, we present PointDP, that utilizes 3D diffusion models to purify adversarial point clouds that delivers both state-of-fe of-thh--rt (SOTA) empirical and certified robustness. We also demonstrate that standard adversarial training suffer from strong black-box attacks and SOTA purification methods (i.e., [F-Defense and LPC) are vulnerable to PGD-styled adversaries
4.3)
PointDP: DIFFUSION-DRIVE
PURIFICATION AGAINST 3D ADVERSARIES
We first introduce the preliminaries of diffusion models and then propose PointDP that first introduces noise to the adversarial 3D point clouds, followed by the forward process of diffusion models to get diffused point clouds. Purified point clouds are recovered through the reverse process (S-3.2) Next, we follow [36] to apply the adjoint method to backward propagate through SDE for efficient gradient evaluation with strong adaptive attacks ($ 3.3
3.1 PRELIMINARIES
In this section, we briefly review the background of conditional diffusion models in 3D vision tasks. Following 31|, use the discrete-time formulation of the forward and reverse processes.
3

---

Under review as a conference paper at ICLR 2023
Given a clean point cloud sampled from the unknown data distribution Eo q(x), the forward process of the diffusion model leverages a fixed Markov chain to gradually add Gaussian noise to the clean point cloud 2n pre-defined N time steps, resulting in number of noisy point clouds { 022 : . Mathematically, the forward process is defined as:
N
((11:N(20)) = II (2nm)))
(1)
n=1
q(2n (( xn-1) == -- (ann /1 Bn 1,
where Bn a scheduling function of the added Gaussian noise, satisfying < ",, ,,N < 1.
The reverse process, in contrast, trained recover the diffused point cloud an iterative manner. 3D Point clouds have less semantics than 2D images due to the lack of texture information. Therefore, point cloud diffusion models leverage separate encoder e to as latent feature 2ạ c(x) condition to help recover the clean point cloud:
pe (2) p(øN) II
pe [ xnn-1 x),
n=1
Po Po 2) := (2 (0 n, 2,, P,,
where ji denotes the approximated mean value parameterized by a neural network. The training objective is to learn the variational bound of the negative log- ligelikelihood (31]. In practice, jointy train the encoder with the noise predictor eø (In, nI, z). Similar to the DDPM model [12]. we can conduct the sampling by reparameterizing μg as
1 VI
(0 _ T2, On
3n
In
B
VI-
where Tn = I1- 3). is worth noting that point cloud diffusion models have recently achieved SOTA performance generating and autoencoding 3D point clouds, which provides us with opportunities for adversarial point cloud purification.
3.2 DESIGN OF PointDP
Overview. Figure I fillustrates the pipeline of PointDP. Different from Nie et al. [36] use uncon- ditional diffusion model to remove the adversarial effect for 2D images, we use the conditional diffusion models as mentioned in $ 3.1 Specifically, PointDP first adds pre-quantified Gaussian noise to the input data and then leverage well-trained diffusion model to purify the noisy point cloud step by step to recover the clean point cloud. The reversed point cloud will be finally fed into the recognition model for the classification task. Note that we do not aim at designing new point cloud diffusion models, but instead propose novel purification pipeline with rigorous evaluations as main contributions.
Following [36), order backpropagate through the forward and reverse processes for computing gradients, we first convert the discrete-time formulation defined in Eqs. ①[ and 2 to its continuous- time counterpart, i.e., the forward and reverse stochastic differential equations (SDEs) [48]. Let initialize the input of the forward N = In,, 3 ((+) == 3,,, a xt == a,,, and
Ta be adversarial example w.r.t the pristine classifier diffusion process as Ta, i.e., Vo = H,, Also, let æ( a t e {0, ...,, 1,.., N-13. The forward diffusion process from t = 0 to = to E (0, can be solved by:
x (tt)) / Va(t")aa + VI-a(( a(t)E
(4)
where e ~ (o00, I). We leverage Eq. 2 to recover the clean point clouds. Equivalently, the truncated reverse process can be also solved by the SDE solver in [36] (denoted as sdeint):
2 = sdcint(x(t"), frev Irev, w, t",
(5)
where the six inputs are initial value, drift coefficient, diffusion coefficient, Wiener process, initial time, and end time (36), with the definitions:
feev fee t2 - [t)[ [ (,o(x,t,2)) (ee((t) = 3(t)
(6)
4

---

Under review as a conference paper at ICLR 2023
and the score function Se is derived from cØ E0(xn: in Eq. (3) by following:
so so az, 1,
a()) co co(=((t,
(7)
Note that the hyper-parameter t' and N trades off the denoising performance and efficiency. We empirically choose 1" = 0.15 and N = 200 in our study, which has shown satisfactory results in our evaluation ($ We also conduct ablation studies on é 4.2
3.3 ADPATIVE ATTACKS ON PoinDDP
PointDP a pre-processing module that purifies the adversarial perturbations. 2 have shown that input transformation-baset methods can be broken by specifically designed attacks. Therefore, it essential to model the adaptive attacks on PointDP to demonstrate its lower-bound adversarial robustness. We thus formulate two types of adaptive attacks on PointDP.
Attack on Latent Feature. As PointDP utilizes conditional diffusion models for adversarial purífica- tion, the latent feature z a good candidate for adversaries to launch attacks. Concretely, adversaries can set the goal to maximize some distance metrie D between the latent feature of the optimized adversarial examples and the oracle latent feature of clean inputs Zoracle Without loss of generality, the adaptive attacks can be formulated as:
(8) where x. denotes the adversarial examples from the s-th step, Proj is the function to project the adversarial examples to the pre-defined space S, and is the attack step size. We choose two distance metrics in our study, where the first one is the KL divergence [17] and the other is the the f norm distance. In our evaluation ($ distance metrics.
1s++ = Proje+s (z, + a norm Va, x. D(e(a:s), Romicle)),
we report the lowest accuracy achieved under attacks with two
Adaptive Attack. We follow 33 to formulate the adaptive attack as an augmented SDE process. We re-state the attack formulation as below. For the SDE in Equation [ the augmented SDE that computes the gradient 02 of backward propagating through it is given by:
Bm((e)
xxt") ac )
((0))
sdeint
ffgg900,00
dc 00
where
8c is the gradient of the objective L w.r.t. the output (0) of the SDE in Equatrion and (a(0)
fiev(x, 0. (we1)
g(t) = (-Sher(1)1) w
- w(1 -ww(1
- 1)
f([x;
8x
where and denote the vectors of all ones and all zeros, respectively. Nie al. (36) have demonstrated that such approximation aligns well with the true gradient value. Therefore, we leverage this adaptive attack formulation for our evaluation.
EXPERIMENTS AND RESULTS
In this section, we first introduce our experimental setups ($ 4.1 We then present the standard robustness evaluation of PointDP($ 4.2) We next show that how the SOTA adversarial training and adversarial purification methods fail under various strong attacks ($ 4.3). We finally conduct stress test PointDP to show its actual robustness under various stronger adaptive attacks ($ 4.4).
4.1 EXPERIMENTAL SETUPS
Datasets and Network Architectures. We conduct all the experiments on the widely used Model- Net40 point cloud classification benchmark (67), consisting of 12,311 CAD models from 40 artificial object categories. We adopt the official split with 9,843 samples for training and 2,468 for testing. We also uniformly sample 1024 points from the surface of each object and normalize them into edge- length-2 cube, following most of the prior arts [1]] As mentioned before, there are various backbones for 3D point cloud recognition in the literature. To demonstrate the universality of PointDP, select six representative model architectures including PointNet [4]] PointNet++ [42), DGCNN [61], PCT 20 CurveNet (69), and PointMI.P 32 These backbones either have representative designs
5

---

Under review as a conference paper at ICLR 2023
Table I: Evaluation Results Plain Model on PA and PD (Aceuracy % mostly have 0% % accuracy, and put the detailed results in Appendix A
Models under other attacks
PointNer
PointNet++
DGCNN
PCT
CurveNet
PointMT.P
None
90.1
92.8
92.5
92.8
93.2
93.5
PA
44.1
19.9
35.1
20.8
48.9
7.2
PD
33.3
69.8
64.5
53.0
72.6
71.1
(e.g., Transformer and MLP) achieve SOTA performance on the ModelNet40 benchmark (e.g.. CurveNet and PointMLP).
Adversarial Attacks. As briefly described in $ $2.2 adversarial attacks could be roughly categorized into C&W- W- and PGD-styled attacks. C& W attacks involves the perturbation magnitude into the objective term of the optimization procedure by Lagrange multiplier, while PGD attacks set the firm constraint in the optimization procedure. Moreover, adversarial attacks by l norm as the distance metric for the perturbation. Although a number of attacks measure Chamfer and Handoff "distances" in 3D point cloud [68]. they not formal distance metrics as they do not satisfy the triangular inequality. Therefore, we still leverage E and &o norm, following most defense studies both 2D and 3D vision tasks B 50) We also have designed adaptive attacks our proposed method $ 3.3 Besides naive C&W and PGD attacks, we leverage specific attacks designed break the robustness of point cloud recognition such KNN (57) and AdvPC [21]. We also apply strong adaptive AutoAttack [MT] (i.e., APGD) in our evaluation. Moreover, we use SPSA (58) and Nattack [27 as black-box adversaries, followed by the suggestion of Carlini et al. [6] We also leverage Attckk.tttttcck Point adding (PA) and dropping/dropping (PD) attacks are also evaluated our study, followed by the setups in [50]. We set the attack steps to 200 to maximize the adversarial capability and follow the settings in 150 for other attack parameters by default.
perturbation magnitude
Evaluation Metrics. We leverage two main metrics to evaluate the performance of our defense proposal, which are standard and robust accuracy. The standard accuracy measures the performance of the defense method on clean data, which is evaluated the whole test set from ModelNer40, The robust accuracy measures the performance on adversarial examples generated by different attacks. Because of the high computational cost of applying adaptive and black-box attacks to method, we evaluate robust accuracy for our defense on a fixed subset 128 point clouds randomly sampled from the test set. Notably, robust accuracies of most baselines do not change much the sampled subset, compared to the whole test set. We evaluate the robust accuracy on the whole test set for other adversarial attacks with acceptable overhead (e.g., C&W and PGD attacks).
Table Evaluation Results (Aceuracy) of Adversarial Attacks on PoinIDP (%). Colored rows are corresponded to rows in Table for clear comparisons with IF-Defense results.
PointNet
PointNet++
DGCNN
PCT
CurveNet
PointML.P
None
86.8
87.9
86.9
87.0
88.0
88.2
C&W
77.9
78.6
78.9
76.8
73.1
76.2
to0
PGD
78.1
80.6
80.3
77.2
74.8
79.8
0.05
AdvPC
69.7
76.6
79.1
79.4
72.6
75.2
PA
82.1
84.8
85.5
86.3
85,8
C&W
82.4
82,9
81.9
80.9
81.5
82.6
l
PGD
80.1
75.0
74.6
72.0
71.7
76,4
1.25
AdvPC
69.1
76.3
79.0
74.2
74.1
75.6
KNN
83.5
82.9
83.3
82.3
81.5
83.1
Eo
200
PD
68.9
74.1
77.3
76.3
76.8
77.4
Baseline. Without any defense applied to the original recognition models, the robust accuracy is mostly 0% for all models under εg and foc based attacks (see Appendix A DGGNN exceptionally achieves 64% on ba-baeed PGD, AutoAttack, respectively, due to its dynamic clustering design, which adaptively discards outlier points. PA and PD are two weaker attacks and Table presents the robust accuracy against these two attacks.
4.2 EXPERIMENT RESULTS OF PointDP
In this section, we first present the evaluation results PointDP under attacks on the plain models. We train the diffusion and 3D point cloud recognition models in sequential order. Table 2 presents the detailed results of PointDP against attacks on six models. We find that PointDP overall achieves satisfactory results across all models and attacks. The average robust accuracy against adversarial

---

Under review as a conference paper at ICLR 2023
Robust
8
Point Adding
Partce
Point Dropping
PGD
PGD
fa AdVPC
AdvPC
Point Shifting
Figure 2: Compare among SOTA Adversarial Purification Strate- gies (i.e., IF-Defense [66]. LPC (25], and PointDP). The results of IF-Defense and PoinDDP are averaged from six models.
50
Number of Diffusion Steps
Figure 3: Ablation on Discrete Diffusion Steps in PointDP.
attacks above 75%. We observe a drop on the clean accuracy for the chosen models due to the imperfect reconstruction of diffusion models. As mentioned before, diffusion models for 3D point cloud a more difficult task than 2D image diffusion, which may lead to partial semantic loss. The average drop of standard accuracy is 4.9%. We find that DGCNN still achieves the best robustness combined with PoinDD, which has 79.9% of robust accuracy. We further compare the performance of PointDP with adversarial training, De-Defense, and LPC in the next section.
We also ablate the effect of diffuuson steps in PointDP. Figure 3 shows the averaged evalua- tion results of point shifting, adding, and drop- ping attacks with PGD adversary over the se- lected models. Point shifting attack much stronger than point adding and dropping attacks. It is, thus, more sensitive to the diffusion steps in PointDP. We find that the robust accuracy converges after the number of diffusion steps 2 30 (or equivalently & 2 0.15). Therefore, we choose to use 1" = 0.15 in the main evaluation of our study. Adversarial purification inevitably introduces overhead during model inference, we benchmark the computation of PointDP and other baselines using an RTX3080 GPU and batch size of 32. Table presents the results, where PoinDD achieves the most negligible cost than existing SOTA methods, which is 27 speed-up than IF-Defense.
Table 3: Ablation Study Overhead Introduced by Adversarial Purification Methods.
DeP-Net
De-eenesse
PointDP
Time
(8)
1.33
2.60
0.097
4.3 FAILURE OF STATE-OF-THE-ARR DEFENSES
In this section, we demonstrate how lately proposed defense solutions fail when encountered with stronger (adaptive) adversarial attacks on 3D point cloud recognition models.
Adversarial training (AT) has been applied to PointNet, DGCNN, and and PCT with the help of self-supervised learning (50) that achieves satisfactory robustness. Such observations are consistent with the performance of AT for 2D perception models. However, we find that AT is, fact, weak defense so- lution in 3D perception models. First, as acknowledged by (50), point cloud models (e.g., PointNet++ and CurveNet) often lever- age different sampling strategies to select anchor points, like furthest point sampling (FPS). Such sampling involves high random- ness. AT either cannot converge with differ- ent random seeds in each iteration or overfits single random seed. Therefore, AT can- not fit these models. Moreover, we discover that the ANN layers will cause severe gra- dient obfuscation in point cloud models as well. Different from standard training pro- cess that only needs the gradient of model parameters w.r.t. the loss function #c AT Tw additionally requires the gradient flow the imput aæ kNN essentially applies top-k for point se- lection. Top-k is a general case for max pooling that does not have trainable model parameters. Therefore, will not affect the standard training. However, top-k not differentiable w.r.f. the input
knn (x, k]
inner -2ttorrh..attt.... matmul (x.transpose (2, "), xI
xx torch. 2 dim=1, keepdin=True) weirwise_distance (2, 11
inner txassonee
idx wwwppisseeddaeeee siiiiwise_distenceeee distance Lep. (k-k, dim- (1] (batch_siza, nun_pcints, k) return
def get_graph (x, kl:
10
ix's shape is ibatch_size, pasieenuum_ddae dims, pom_toints)
11
idx = knn k=k) è (botch_aie size, pum_points,, ...... shape transformation here
12
13
feature x.view
-1) Lax is used as Index to select features
idx, :]
14
15
16
return fecture
17
18
forward function EdgeConv
19
daf forward (self, x):
20
21
Bee__gragh__eattueeeee (eature k=aelf.k)
22
convl (x). it convolucion
Figure 4: PyTorch 39 -Style Code Snippet of Edge- Conv [61] in Point Cloud Recognition Models. Ad- versarial training fails since the kNN layers leverage the top-k function where the gradient propagate to the index, resulting in gradient obfuscation.
0c As shown in Line 5 from Figure 4
7

---

Under review as a conference paper at ICLR 2023
Table 5: Evaluation Results (Aceuracy) of Adversarial Attacks on IF-Defense (%). Colored rows are corresponded to rows in Table 2 for clear comparisons with PointD) results.
PointNet
PointNet++
DGCNN
PCT
CurveNet
PointMI.P
ONet
None
90.0
92.8
92.4
92.8
93.1
93.5
1so
PGD
69.9
74.0
61.0
54.1
51.9
61.6
6 0.05
AdvPC
69.4
72.8
61.6
53.9
53.6
62.5
f
PGD
74.2
77.5
70.5
67.2
68.7
70.5
1.25
AdvPC
69.0
72.9
63.0
64.5
55.4
67.9
ConvONet
None
90.1
92.8
92.5
92.8
93.2
93.5
Eno
PGD
66.4
73.2
52,9
46.8
45.3
55.7
= 0.05
AdvPC
63.7
71.2
55.5
47.2
46.7
55.0
fg
PGD
72.2
76.7
69.8
65.6
62.7
71.4
1.25
AdvPC
63.4
74.3
56.6
47.2
71.0
2. Therefore, the implementation simplifies the gradient backward propagation through the top-k function an indexing function to make the chain propagation smooth:
Dy [1 if i arg ((x))(
{ top-)(((=)))))
(10)
dz. 0 otherwise
However, such simplification still cannot resolve the differentibility issue of the top-k function [77
Different from 2D model usually at most use one layer of max pooling, the heavy usage of ANN layers in DGCNN and PCT will drastically hinder the actual gradient flow. As mentioned in $4..] we exploit black-box SPSA and Nattack to validate our findings. Table 4 presents the results of AT. SPSA and Nattack can greatly lower the average robust accuracy (7.8%) than white-box attacks (55.6%) on DGCNN and PCT. This phenomenon exactly reveals gradient obfuscation as white-box attacks rely on the backward propagated gradient to succeed. The results demonstrated that the upproximated gradients from black-box attacks are more accurate than the propagated ones. PointNet, however, achieves better robustness under black-box attacks because only has one max pooling layer and does not employ ANN layers.
Existing purification-based defenses against 3D adversarial point clouds mainly leverage C& C-syylleed attacks in their evaluation. C&W attacks utilize the method Lagrange multipli- to find tractable adversarial examples while minimizing the magnitudes of the perturbation. From the perspective of adversary, such attacks are desirable due to their stealthiness, while this does not hold from defensive view. Defense
Table 4: Evaluation Results (Accuracy) of Standard Adversarial Training (%) with &oo norm e = 0.05.
PointNet
DGCNN
PCT
None
87.8
90.6
89.7
PGD
52.1
67.4
51.3
AutoAttack
40.5
56.4
47.2
SPSA
56.7
7.8
11.4
Nattack
55.1
5.4
6.5
methods should be evaluated against strong adaptive attacks 6 DUP-Net (90] is a pioneer study
that uses statistical outlier removal and a upsampler network for purification, but was adaptively attacked by [5.. We thus present the evaluation results of DUP-Net in Appendix A IF-Defense and LPC are the SOTA adversarial purification methods for 3D point cloud models. We leverage PGD and AdvPC attacks, which assign constant adversarial budget in the adversarial optimization stage. We follow the original setups De-Deeense and LPC our study. Such evaluation is stronger than C&W attacks, while we note that they are not strict adaptive attacks since the adversarial target is still the classifier itself. Similar to PoinDDP IF-Defense can be pre-pended to any point cloud classifier, but LPC uses specific backbone. Table presents the detailed evaluation results of [F-Defense under various settings and attacks. We find that PointDP achieves much better robustness than De-Defense, which is average 12.6% improvements. However, IF-Defense achieves slightly higher clean accuracy (4.9%). This is because IF-Defense leverages SOR to smooth the point cloud [90). However, such operation has been demonstrated to be vulnerable (5I]. With specific adaptive attacks, there will be a even larger drop of robust accuracy for IF-Defesse.
Figure 2 shows the comparison among PoinIDP and existing methods. PoinDDP overall achieves the best performance than prior arts, which are 12.6% and 40.3% improvements than IF-Defense and LPC, respectively. We find that even without adaptive attacks, adversaries with constant budgets can already hurt the robust accuracy by a significant gap. This suggests that IF-Defense and LPC fail to deliver strong robustness to 3D point cloud recognition models. Especially, LPC appears in the proceedings of CVPR 2022, but actually achieves trivial robustness, indicating that a rigorous evaluation protocol is highly required in this community.
8

---

Under review as a conference paper at ICLR 2023
4.4 DEFENSE AGAINST ADAPTIVE THREATS
We have far illustrated that state-of-the-art defenses be easily broken by (adaptive) adversarial attacks and PoinDDP consistently achieves the best robustness. In this section, we further extensively evaluate the robustness of PoinDDP on even stronger adaptive attacks to demonstrate the actual robustness realized by PointDP. As mentions in $ 4.1 we leverage two types of adaptive attacks in our study, and Table O presents their results. We also leverage black-box SPSA and Nattack to validate our results. We find that BPDA-PGD the strongest adaptive attacks, which align well with previous study on 2D diffusion-drivee purification [36]. Even though with strong adaptive attacks, PoinDD still achieves much better robustness. Besides, black-box attacks are much less effective. Although we admit that PoinIDP still relies on gradient obfuscation, the extremely high randomness will hinder the black-box adversaries finding correct gradients. We also ablate the effectiveness of
PointDP with larger attack budgets in Appendix A
Table 6: Evaluation Results (Aceuracy) of Strong Adaptive Attacks PointDP (%).
PointNet
Pointcct+
DGCNN
PCT
CurveNet
PointMLP
None
86.8
87.9
86.9
87.0
88.0
BPDA-PGD
77.1
78.6
79.2
76.1
73.9
77.7
EOT-AutoAttack
78.0
79.9
79.1
76.5
75,9
78.9
PGD
80.8
80.7
82.9
82.5
80.8
79.9
8
AdvPC
69.9
76.8
79.4
79.8
72.9
75.4
= 0.05
SPSA
74.9
78.5
76.4
Nattack
75.2
77.9
74.4
78.0
76.1
78.9
PA
81.7
84.7
84.1
84.5
84,8
85.2
BPDA-PGI PGD
78.9
73.3
73.3
71,2
70.7
75.1
BOT-AutoAttack
79.6
71.3
fg
PGD
86.1
82.5
86.3
87.7
87.8
1.25
AdvPC
69.1
76.9
79.2
74.5
74.3
76.1
SPSA
76.1
77.0
74.4
74,5
77.0
78.9
Nattack
74.9
76.5
73.9
74.0
76.3
77.2
To
PD
61.3
72.1
73.5
75.9
74.1
74.4
200
DISCUSSION AND CONCLUSION
Adversarial robustness has been well-established 2D vision tasks, where Carlini er al. and many other researchers have devoted significant efforts to setting up rigorous evaluation protocol. In this study, we emphasize that this evaluation protocol should be strictly followed in the 3D point cloud robustness study as well. Counter-intuitieely, we have demonstrated that standard adversarial training (AT) is not a good candidate to deliver robustness against strong black-bor adversaries because gradient obfuscation in 3D point cloud architectures will hinder the inner maximization stage from making real progress in AT. We propose PointD) as an adversarial purification strategy to mitigate the robustness loss in the 3D space. We want clarify that almost all purification methods (including PointDP) still depend on gradient obfuscation to mislead adaptive attackers. However, argue that proper usage of gradient obfuscation could still serve as good defense, as long as the obfuscation is sophisticated enough. The multi-step purification in diffusion models adds extremely high-level randomness that EOT 3 and BPDA [2] attacks are hard model. Therefore, we believe our extensive evaluation reveals the actual robustness of PointDP. Our evaluation also unveils concerning fact that existing defenses in the 3D domain could easily broken by strong attacks. Therefore, we hope our evaluation protocol sets standard for robustness assessment in this community, i.e., a defense study should strictly follow a formal distance metric and leverage strong attacks including PGD, black-box, and adaptive attacks to evaluate its actual robustness.
I Limitation. Mitigation solutions to adversarial attacks are critical and essential for modern machine learning systems. Given that 3D point cloud is heavily adopted in safety-critical applications, we believe our study is valuable in demonstrating the vulnerabilities of existing SOTA defenses. PointDP also. On the other hand, diffusion models needs multiple steps the reverse process to recover the point cloud and hinder adaptive attacks, which will incur additional computational overhead. PoinDD also limits itself to empirical robustness without theoretical guarantees.
In this paper, we propose PointDP, an adversarial purification method against attacks on 3D point cloud recognition. We showed that adversarial training and prior purification methods vulnerable to strong attacks. We then performed extensive rigorous evaluations to validate that PointDP outper- forms existing SOTA methods by significant margin (12.6%-40.33 in robust accuracy.

---

Under review as a conference paper at ICLR 2023
ETHICS STATEMENT
As continuously mentioned in main paper and acknowledged in other studies 8 66, adversarial robustness is critical to the real-world deployment of machine learning models, especially for safety- related applications. Point cloud data is heavily used many such applications like autonomous driving, robotics, and medical imaging. Although various defenses were proposed in the literature, even in top-tier conferences like ICCV (90), CVPR 225. and NeurIPS [50], we find that they actually can be broken by aarefully-designed strong attacks. Therefore, the first contribution of study is very beneficial for the 3D point cloud community to illustrate how existing state-of-the-ar fail deliver have raised the attention for the 3D point cloud community to focus actual
real robustness, robustness under strongest adaptive attacks. PointDP is also beneficial since we have leveraged the most rigorous evaluation protocol to test its robustness. We follow the licenses of usage for all the public models and datasets in our study.
REPRODUCIBILITY STATEMENT
To ensure the reproducibility of our results, we have provided our codebase in the supplementary materials and all of our results are based on consistent random seed in our implementation.
REFERENCES
[I] 3D Point Cloud Classification Benchmark ModelNet40. http://ewo.ttttssppppessssiiiiee thcode com/ wotsootttaeee Stt.pppannsccladalllaaaaaaaaaaaa hww-hh-ooommmmeeetttte 2021.
[2] A. Athalye. N. Carlini, and D. Wagner. Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. In International Conference on Machine Learning, pages 274-283. PMLR, 2018.
[3] A. Athalye, L.. Engstrom, A. Ilyas, and K. Kwok. Synthesizing robust adversarial examples. In
J. Dy and Krause, editors, Proceedings of the 35th International Conference on Machine Learning, volume 80 of Proceedings of Machine Learning Research, pages 284-293. PMLR, 10-15 Jul 2018.
[4] M. Bafna, J. Murtagh, and N. Vyas. Thwarting ad examples: An L_Orrobustpparse fourier transform. arXiv preprint arXiv: 2018
[5] Y. Cao, C. Xiao, B. Cyr, Y. Zhou, W. Park, S. Rampazzi, Q A. Chen, K. Fu, and Z. M. Mao. Adversarial sensor attack on lidar-based perception in autonomous driving. In Proceedings of the 2019 ACM SIGSAC conference computer and communications security, pages 2267- 2267-2281, 2019.
[6] N. Carlini, A. Athalye, N. Papernot, W. Brendel, J. Rauber, D. Tsipras, I. Goodfellow, A. Madry, and A. Kurakin. On evaluating adversarial robustness. arXiv preprint arXiv:1902.06700 2019.
[7] N. Carlini, Tramer, J. Z. Kolter, et al. (certified!!) adversarial robustness for free! arXiv preprint arXiv:2206. 10550, 2022.
[8] N. Carlini and D. Wagner. Towards evaluating the robustness of neural networks. In 2017 ieee symposium on security and privacy (sp), pages 39-57. IEEE, 2017.
[9] C. Choy, J. Gwak, and Savarese. 4d spatio-temporal convnets: Minkowski convolutional neural networks. In Proceedings of the IEEE Conference on Computer Vision and Puttern Recognition, pages 3075-3084, 2019.
[10] W. Chu, L. Li, and B. Li. Tpe: Transformation-specffie smoothing for point cloud models. arXiv preprint 22XX::2201.127::3 2022.
2022.
[11] F. Croce and M. Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-fi free attacks. In International Conference on Machine Learning, pages 2206-220 PMLR, 2020.
10

---

Under review as a conference paper at ICLR 2023
[12] P. Dhariwal and A. Nichol. Diffusion models beat gans image synthesis. Advances in Neural Information Processing Systems, 34:8780- 34:8780-8794, 8794, 2021.
[13] G. S. Dhillon, K. Azizzadenesheli, Z. C. Lipton, J. Bernstein, Kossaifi, A. Khanna, and
A. Anandkumar. Stochastic activation pruning for robust adversarial defense. arXiv preprint arXiv 01442, 2018.
[14] X. Dong, D. Chen, Zhou, G. Hua, W. Zhang, and N. Yu. Self-robust. 3d point recognition via gather-vector guidance. In 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 11511.1121. IEEE, 2020.
[15] A. Dosovitskiy, L. Beyer, Kolesmikov, D. Weissenbom, X. Zhai, T. Unterthiner, M. Dehghani. M. Minderer, G. Heigold, S. Gelly, et al. An image is worth 1 16x 16 words: Transformers for image recognition at scale. arXiv preprint arXiv:2010. 1929, 2020.
[16] K. Eykholt, I. Evtimov, E. Fernandes, Li, A. Rahmati, C. Xiao, Prakash, T. Kohno, and D. Song. Robust physical-worde attacks on deep learning visual classification. In Proceedings of the IEEE Conference on Computer Vision and Patlern Recognition, pages 1625-1634, 2018.
[17] Goldberger, Gordon, H. Greenspan, al. An efficient image similarity measure based on approximations of kl-divergence between two gaussian mixtures. In ICCV, volume 3, pages 487-493 2003.
[18] I. J. Goodfellow, J. Shlens, and C. Szegedy. Explaining and harnessing adversarial examples. arXiv preprint 1412: 2014.
[19] B. Graham and L. van der Maaten. Submanifold sparse convolutional networks. arXiv preprint arXiv:1706.01 2017.
[20] M.-H. Guo, J.-X. Cai, Z.-N. Liu, T.-J. Mu, R. R. Martin, and S.-M. Hu. Pet: Point cloud transformer. arXiv preprint arXiv:2012.0966 2020.
[21] A. Hamdi, S. Rojas, A. Thabet, and B. Ghanem. Advpe: Transferable adversarial perturbations on 3d point clouds. In European Conference on Computer Vision, pages 241-257. Springer, 2020.
[22] K. He, X. Zhang, S. Ren, and J. Sun. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pallern recognition, pages 770- 778, 2016.
[23] L. Huang, C. Gao, Y. Zhou, C. Xie, Yuille, C. Zou, and Liu. Universal physical camouflage attacks on object detectors, 2019.
[24] L. Huang, C. Gao, Y. Zhou, C. Xie, A. L. Yuille, C. Zou, and N. Liu. Universal physical camouflage attacks on object detectors. In Proceedings of the IEEE/CVE Conference on Computer Vision and Pattern Recognition, pages 720-729, 2020.
[25] K. Li, Z. Zhang, C. Zhong, and G. Wang. Robust structured declarative classifiers for 3d point clouds: Defending adversarial attacks with implicit gradients. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pages 15394, 2022.
[26] Y. Li, R. Bu, M. Sun, W. Wu, X. Di, and B. Chen. Pointenn: Convolution on x-transformed points. Advances neural information processing systems, 31:820-830 2018
[27] Y. Li, L. Li, L. Wang. T. Zhang, and B. Gong. Nattack: Learning the distributions of adver- sarial examples for an improved black-box attack on deep neural networks. In International Conference on Machine Learning, pages 3866-3876. PMLR, 2019.
[28] D. Liu, R. Yu, and H. Su. Extending adversarial attacks and defenses deep 3d point cloud classifiers. In 2019 IEEE International Conference on Image Processing (ICIP), pages 2279- 2283. IEEE, 2019.
[29] Y. Liu, B. Fan, S. Xiang, and C. Pan. Relation-shape convolutional neural network for point cloud analysis. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 8895-8906 2019.

---

Under review as a conference paper at ICLR 2023
[30] T. Lorenz, A. Ruoss, M. Balunović, G. Singh, and M. Vechev. Robustness certification for point cloud models. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 7608-7613 2021.
[31] S. Luo and W. Hu. Diffusion probabilistic models for 3d point cloud generation. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 2837-2845, 2021.
[32] X. Ma, C. Qin, H. You, H. Ran, and Y. Fu. Rethinking network design and local geometry in point cloud: A simple residual mlp framework. arXiv preprint arXiv:2202.071/ 2022.
[33] A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu. Towards deep learning models resistant to adversarial attacks. arXiv preprint 17X6v:1006.0683,, 2017.
[34] D. Maturana and S. Scherer. Voxnet: A 3d convolutional neural network for real-time object recognition. In 2015 JEEE/RSI International Conference Intelligent Robots and Systems (IROS), pages 922-928. IEEE, 2015.
[35] D. Meng and H. Chen. Magnet: a two-pronged defense against adversarial examples. In Proceedings of the 2017 ACM SIGSAC conference on computer and communications security, pages 135-147, 2017.
[36] W. Nie, B. Guo, Y. Huang, C. Xiao, A. Vahdat, and A. Anandkumar. Diffusion models for adversarial purification. arXiv preprint arXiv:2205.0744 074000 2022.
[37] N. Papernot and P. McDaniel. Extending defensive distillation. arXiv preprint arXiv:1705.0022 2017.
[38] N. Papernot, P. McDaniel, X. Wu, S. Jha, and A. Swami. Distillation defense adversarial perturbations against deep neural networks. In 2016 IEEE symposium on security and privacy (SP), pages 582-597. IEEE, 2016.
[39] A. Paszke, S. Gross, F. Massa, Lerer, J. Bradbury, G. Chanan, T. Killeen, Z. Lin, N. Gimelshein, L. Antiga, et al. Pytorch: An imperative style, high-performance deep learning library. Advances in neural information processing systems, 32, 2019.
[40] J. C. Pérez, M. Alfarra, S. Giancola, B. Ghanem, et al. 3deformrs: Certifying spatial deforma- tions point clouds. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 15169-15179, 2022.
[41] C. R. Qi, H. Su, K. Mo, and L. J. Guibas. Pointnet: Deep learning on point sets for 3d classification and segmentation. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 652-660, 2017.
[42] C. R. Qi, L. Yi, H. Su, and L. J. Guibas. Pointnet++: Deep hierarchical feature learning on point sets metrie space. arXiv preprint 170..041.. 2017.
[43] G. Riegler, O. Ulusoy, and A. Geiger. Octnet: Learning deep 3d representations at high reso- lutions. In Proceedings of the IEEE Conference Computer Vision and Pattern Recognition, 2017.
[44] A. Shafahi, M. Najibi, A. Ghiasi, Z. Xu, J. Dickerson, C. Studer, L. S. Davis, G. Taylor, and 2019.
T. Goldstein. Adversarial training for free! arXiv preprint
[45] Shi, C. Guo, L. Jiang, Z. Wang. J. Shi. X. Wang, and H. Li. Pv-renn: Point-voxel feature set abstraction for 3d object detection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 15529-10538. 2020.
[46] Shi, X. Wang, and H. Li. Pointrenn: 3d object proposal generation and detection from point cloud. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 770-779, 2019.
[47] S. Song and J. Xiao. Deep Sliding Shapes for amodal 3D object detection in RGB-D images. In CVPR, 2016.
12

---

Under review as a conference paper at ICLR 2023
[48] Y. Song, J. Sohl-Dickstein, D. P. Kingma, A. Kumar, S. Ermon, and B. Poole. Score- based generative modeling through stochastic differential equations. In International Conference on Learning Representations, 2021.
[49] Sun, Y. Cao, Q. A. Chen, and Z. M. Mao. Towards robust lidar-based perception in autonomous driving: General black-box adversarial sensor attack and countermeasures. In 29th USENIX Security Symposium (USENIX Security 20), pages 877-894. USENIX Association, Aug. 2020.
[50] J. Sun, Y. Cao, C. B. Choy, Z. Yu, A. Anandkumar, Z. M. Mao, and C. Xiao. Adversarially robust 3d point cloud recogmition using self-supervisions. Advances Neural Information Processing Systems, 34:15498-1555
2021.
[51] Sun, K. Koenig, Y. Cao, Q. A. Chen, and Z. M. Mao. On the adversarial robustness of 3d point cloud classification, 2020.
[52] J. Sun, A. Mehra, B. Kailkhura, P.-Y. Chen, D. Hendrycks, J. Hamm, and Z. M. Mao. Certified adversarial defenses meet out- -fiittriittittt corrpptions Benchmarking robustness and simple baselines. arXiv preprint arXiv: 22. 12..00699, 2021.
[53] Sun, Q. Zhang. Kailkhura, Z. Yu, C. Xiao, and Z. M. Mao. Benchmarking robustness of 3d point cloud recognition against common corruptions. arXiv preprint urXiv:2201.1222 2022.
[54] L. P. Tchapmi, C. B. Choy, I. Armeni, J. Gwak, and S. Savarese. Segcloud: Semantic segmenta- tion of 3d point clouds. In International Conference on 3D Vision (3DV), 2017.
[55] H. Thomas, C. R. Qi, J.-E. Deschaud, B. Marcotegui, F. Goulette, and L. J. Guibas. Kpconv: Flexible and deformable convolution for point clouds. In Proceedings of the IEEE/CVF International Conference Computer Vision, pages 641 141100, 2019.
[56] Tramer, N. Carlini, W. Brendel, and A. Madry. On adaptive attacks to adversarial example defenses. arXiv preprint arXiv:2002.083347 2020.
[57] T. Tsai, K. Yang, T.-Y. Ho, and Y. Jin. Robust adversarial objects against deep learning models. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 34, pages 954-962, 2020.
[58] J. Uesato, B. O'donoghue, P. Kohli, and A. Oord. Adversarial risk and the dangers of evaluating against weak attacks. In International Conference Machine Learning, pages 5025-5034. PMLR, 2018
[59] D. Z. Wang and I. Posner. Voting for voting in online point cloud object detection. In Robotics: Science and Systems, volume 1, pages 10-15607. Rome, Italy, 2015.
[60] P.-S. Wang, Y. Liu, Y.-X. Guo, C.-Y. Sun, and X. Tong. O-enn: Octree-based convolutional neural networks for 3d shape analysis. ACM Transactions on Graphics (TOG), 36(4):1-11, 2017.
[61] Y. Wang, Y. Sun, 7. Liu, S. F. Sarma, M. M. Bronstein, and J. M. Solomon. Dynamic graph cnn for learning on point clouds. Acm Transactions On Graphics (tog), 38(5):1-12, 2019.
[62] Y. Wen, J. Lin, K. Chen, and K. Jia. Geometry-aware generation of adversarial and cooperative point clouds. 2019.
[63] M. Wicker and M. Kwiatkowska. Robustness of 3d deep learning in an adversarial setting. In Proceedings of the IEEF/CVF Conference on Computer Vision and Pattern Recognition, pages 11767-11775, 2019.
[64] E. Wong. L. Rice, and J. Z. Kolter. Fast is better than free: Revisiting adversarial training. arXiv preprint arXiv:2001.0300 03994, 2020.
[65] W. Wu, Z. Qi, and L. Fuxin. Pointconv: Deep convolutional networks on 3d point clouds. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 9621-9630, 2019.
13

---

Under review as a conference paper at ICLR 2023
[66] Z. Wu, Y. Duan, H. Wang, Q. Fan, and J. Guibas. If-defense: 3d adversarial point cloud defense via implicit function based restoration. arXiv preprint arXi::2010.0527,, 2020.
[67] Z. Wu, S. Song. A. Khosla, F. Yu, L. Zhang, X. Tang, and J. Xiao. 3d shapenets: A deep representation for volumetric shapes. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 1912-1920, 2015.
[68] C. Xiang, C. R. Qi, and B. Li. Generating 3d adversarial point clouds. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pages 9136-9144, 2019.
[69] T. Xiang, C. Zhang, Y. Song, J. Yu, and W. Cai. Walk in the cloud: Learning curves for point clouds shape analysis. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 915-924, 2021.
[70] C. Xiao, R. Deng, B. Li, T. Lee, B. Edwards, J. Yi, D. Song, M. Liu, and I. Molloy. Advit: Adversarial frames identifier based on temporal consistency in videos. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 3968-3977, 2019.
[71] C. Xiao, R. Deng, B. Li, Yu, M. Liu, and D. Song. Characterizing adversarial examples based on spatial consistency information for semantic segmentation. In Proceedings of the European Conference on Computer Vision (ECCV), pages 217-234, 2018.
[72] C. Xiao, B. Li, J.-Y. Zhu, W. He, M. Liu, and D. Song. Generating adversarial examples with adversarial networks. arXiv preprint arXiv: //0///0010020... 2018.
[73] C. Xiao, J.-Y. Zhu, B. Li, W. He, M. Liu, and D. Song. Spatially transformed adversarial examples. arXiv preprint arXiv: 1801 02611, 12, 2018.
[74] C. Xie, M. Tan, B. Gong, A. Yuille, and Q V. Le. Smooth adversarial training. arXiv preprint arXiv:2006. 14536, 2020.
[75] C. Xic, J. Wang, Z. Zhang. Y. Zhou, L. Xie, and A. Yuille. Adversarial examples for semantic segmentation and object detection. In International Conference Computer Vision. IEEE, 2017.
[76] C. Xie and A. Yuille. Intriguing properties of adversarial training at scale. In International Conference Learning Representations, 2020.
[77] Y. Xie, H. Dai, M. Chen, B. Dai, T. Zhao, H. Zha, W. Wei, and T. Pfister. Differentiable top-k with optimal transport. Advances in Neural Information Processing Systems, 33:20520-20533 2020.
[78] W. Xu, D. Evans, and Y. Qi. Feature squeezing: Detecting adversarial examples in deep neural networks. arXiv preprint 17Xiv:1004.01155 2017.
[79] C. Yang, A. Kortylewski, C. Xic, Y. Cao, and A. Yuille. Patchattack: A black-box texture- based attack with reinforcement learning. In European Conference Computer Vision, pages 681-698. Springer, 2020.
[80] Y. Yang, G. Zhang, D. Katabi, and Z. Xu. Me-net: Towards effective adversarial robustness with matrix estimation. arXiv preprint arXiv: 1905. 1971, 2019.
[81] T. Yin, X. Zhou, and P. Krähenbühl. baster-based 3d object detection and tracking. CVPR, 2021.
[82] H. Zhang, H. Chen, C. Xiao, S. Gowal, R. Stanforth, B. Li, D. Boning, and C.-J. Hsich. Towards stable and efficient training of verifiably robust neural networks. arXiv preprint 1906::900600616 2019.
[83] H. Zhang, H. Chen, C. Xiao, B. Li, D. S. Boning, and C.-J. Hsich. Robust deep reinforcement learning against adversarial perturbations on observations. 2020.
[84] H. Zhang, Y. Yu, J. Jiao, E. Xing, L. El Ghaoui, and M. Jordan. Theoretically principled trade-off between robustness and accuracy. In International Conference on Machine Learning, pages 7472-7482, PMLR, 2019.
14

---

Under review as a conference paper at ICLR 2023
[85] Q. Zhang, S. Hu, J. Sun, Q. A. Chen, and Z. M. Mao. On adversarial robustness of trajectory prediction for autonomous vehicles. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 15159-15168, June 2022.
[86] X. Zhang, A. Zhang, J. Sun, X. Zhu, Y. E. Guo, F. Qian, and Z. M. Mao. Emp: Edge-assisted multi-vehicle perception. In Proceedings of the 27th Annual International Conference on Mobile Computing and Networking, pages 545-558, 2021.
[87] H. Zhao, L. Jiang. J. Jia, H. Torr, and V. Koltun. Point transformer. Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 16259-16268, 2021.
[88] T. Zheng, C. Chen, J. Yuan, B. Li, and K. Ren. Pointeloud saliency maps. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 1598-1606, 2019.
[89] H. Zhou, D. Chen, J. Liao, K. Chen, X. Dong, K. Liu, W. Zhang, G. Hua, and N. Yu. Lg-gan Label guided adversarial network for flexible targeted attack of point cloud based deep networks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 10356-10880 10365, 2020.
[90] H. Zhou, K. Chen, Zhang, Fang, Zhou, and N. Yu. Dup-net: Denoiser and upsampler network for 3d adversarial point clouds defense. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 1961-1970, 2019.
15

---

Under review as a conference paper at ICLR 2023
A EVALUATION DETAILS
As mentioned in 41 the robust accuracies of the unprotected base models mostly 0%. Table presents the detailed results.
Table 7: Evaluation Results (Accuracy) of Adversarial Attacks on Base Models(%)
PointNet
PointNet++
DGCNN
PCT
CurveNet
PointMLP
None
90.1
92.8
92.5
92.8
93.2
93.5
C&W
0.0
0.0
PGD
0.4
0.2
0.3
c= 0.05
AdvPC
0.4
0.3
0.0
0.2
0.6
0.3
PA
44.1
19.9
35.1
20.8
48.9
7.2
C&W
0.0
0.0
0.0
0.0
f2
PGD
0.1
0.3
64.5
0.5
0.5
0.5
é 1.25
AdvPC
0.0
0.5
62.7
0.4
0.3
0.5
Eo
33.3
69.8
64.5
53.0
72.6
71.1
200
our evaluation. 63 proposed ISO attack that iteratively drops the most salient points. This setting is very similar to our point-dropping (PD)
We also include [63]
Table Robust Accuracy (%) of Different Purification Methods under ISO Attack.
adversary evaluated in $ 4.2 The difference that [63]
IF-Defense
PointD
leverages a heuristic way to determine critical points, but PD uses the gradient that backward propagates to
ISO 66
67.3
70.1
PD
66.1
68.9
each point to select the critical points. 63 only works
for PointNet because i) both [63] and PointNet are very first explorations the area 3D point cloud recognition and ii) PointNet utilizes global max pooling so that only the critical points will affect the prediction results. We evaluate ISO under PointNet with an attack budget 200 points; the results are shown in the Table
We find that ISO is weaker attack than PD as it by design restricts its attack capability, which is good for an attack paper. However, cannot show the worst-case robustness of a defense proposal.
We also evaluate DUP-Net with IF-Defense and PoinDDP under foo norm PGD attacks using different attack budgets. As Table presents, DUP-Net is vulnerable to such attacks due to sensitivity of the upsampler network &o norm noises [51] The robust accuracy for LPC 27. 27.8% and 19.1 for 0.075 and 0.1, respectively. Even with these extremely large distortions, PoinIDP achieves strongest robustness, outperforming existing SOTA by very large margin.
Table Evaluation Results (Accuracy) Adversarial Attacks on Base Models(%)
PointNet
PointNet++
DGCNN
PCT
CurveNet
PointMLP
DUP-Net
0.0
1.3
0.9
0.9
0.6
foo = 0.05
IF-Defense
66.4
73.2
52.9
45.3
55.7
PointDP
80.8
80.7
82.9
82.5
80,8
79.9
DUP-Net
0.5
0.2
l. 0.075
IF-Defense
60.7
67.3
47.2
40.9
39.8
50.9
PaintDP
73,9
73.6
74,2
70.2
67.9
72.5
DUP-Net
0.0
0.0
0.0
0.2
0.3
IF-Defense
53,9
57.1
42.0
35.1
33.3
44.7
0.1
PointDP
67.3
62.4
64.2
59.2
58.3
63.1
16


Reviews:
[{"review_id": "vDGBnxrCTPc", "reviewer": "Reviewer_TVXV", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "The authors propose a simple but effective model, named PointDP, which leverages diffusion models to defend against 3D adversarial attacks. The experimental results show that PointDP achieves significantly better adversarial robustness than state-of-the-art methods.", "summary_of_the_review": "The authors propose a simple but effective method to defend against 3D adversarial attacks. But the technical contributions are not clear. I will change my rating if the authors compare the diffusion model more closely.", "strength_and_weaknesses": "**Strengths**\n- The paper is clearly written.\n- The proposed method is simple and effective.\n\n\n**Weaknesses**\n- The technical contributions of PointDP over the diffusion model should be clearly demonstrated. Otherwise, the proposed method could be regarded as an application of the diffusion model in denoising.\n- The differences between the diffusion model in PointDP and [31] should be discussed.", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "PTnnAr9w8G", "reviewer": "Reviewer_TFZv", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "In this work, the authors propose a pretraining diffusion model for defending against 3D adversarial point clouds. They also shows the limitation of robust training for defense due to gradient obfuscation. The results have shown better qualitative performance than SOTA methods. ", "summary_of_the_review": "The paper has shown potential of deploying diffusion model for 3D adversarial point cloud defense. The major problem is the lack of novely on designing their diffusion models, as well as experiments on the recent works. Therefore, it is difficult to justify their performance improvements.", "strength_and_weaknesses": "Pros: \n+) The idea is clear and easy to follow. They show that adversarial training does not work well on 3D point cloud recognition task. \n+) They deploy diffusion model for recovering/purifying 3D point clouds, which further increase the correct detection ability. \n\nCons:\n-) The methodology is straightford with limited technical contributions.\n-) Diffusion model itself is a powerful generative model, capable of denoising. Limited novelty on technical contribution on purifying adversarial 3D point clouds. The authors are suggested to clarify their contributions. \n-) A lot of missing experiments, e.g. [1, 2]. It is suggested to clarify the advantage of the method with more experimental results. \n-) Missing evaluations on larger distortions, e.g. perturbation is 0.1. \n-) typo error: P3: Donget al.->Dong et al.\n\n[1] Kaidong Li et al, Robust Structured Declarative Classifiers for 3D Point Clouds: Defending Adversarial Attacks with Implicit Gradients, CVPR22\n[2] Hang Zhou et al, DUP-Net: Denoiser and upsampler network for 3d adversarial point clouds defense, ICCV19", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "N4hlTm-FI8K", "reviewer": "Reviewer_PNfK", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 2, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "This paper proposes PointDP, an adversarial purification method that leverages a diffusion model as a pre-processing module to defend against 3D adversary attacks for point clouds.  PointDP consists of two components (1) an off-the-shelf 3D point cloud diffusion model and (2) a classifier. Given an input point cloud, PointDP takes the following steps: (i) adding noise to the input data gradually via the diffusion process of the diffusion model, (ii) purifying the noised data step by step to get the reversed sample via the reverse process of a diffusion model, and (iii) feeding the reversed sample to the final classifier. Since PointDP does not rely on any types of pre-defined adversarial examples for training, it can defend against diverse unseen threats.\n\nThis paper also revisits the existing works via designing various types of strong adaptive attacks. It demonstrates that standard adversarial training suffers from gradient obfuscation in the point cloud recognition models as the unstructured point cloud data format requires unique architectural designs to digest.\n\nThe authors evaluate PointDP with multiple representative point cloud models and sixteen attacks and show significant improvement over existing state-of-the-art methods.", "summary_of_the_review": "Overall the paper has shown good results using the diffusion method for adversial attack defense for 3D point clouds. I am not an expert in this area but do believe this should be considered novel.", "strength_and_weaknesses": "+: The paper demonstrates that standard adversarial training has a major limitation in its application in 3D point cloud models due to architecture designs.\n+: The proposed PointDP method leverages diffusion models to purify adversarial 3D point clouds. \n+: Experiments on six representative models show that PointDP outperforms previous state-of-the-art purification methods by a large margin.\n\n", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.", "empirical_novelty_and_significance": "2: The contributions are only marginally significant or novel."}, "extra_text": {}}, {"review_id": "LKEu_Oc5Xf", "reviewer": "Reviewer_gbYk", "summary": "", "questions": "", "limitations": "", "rating": 8, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "In this work the authors propose to use denoting diffusion models in order to aid in robustness against adversarial examples for neural networks trained on point-cloud data. The paper is very similar to what has recently been produced for 2D images in [7, 36] (using the paper’s citation numbering). The underlying principle of the work is sound and the primary contribution of this paper appears to be applying the same framework to 3D point cloud inputs. As a secondary contribution, the authors discuss how gradient obfuscation makes standard adversarial training less effective due to the intractability of computing strong white-box adversarial examples for point cloud networks. Thus, the authors argue (and empirically show) that their diffusion-driven purification is a better alternative. One question that could be interesting for future study is if one can design an adversarial example such that the purification method fails (due to poor performance of the diffusion model) but this is outside of the scope of the current work. Modulo some errors and omissions in presentation I found this paper nicely written and think it has an interesting contribution.", "summary_of_the_review": "Overall, though the technical contribution is not wholly novel, I find the experimental analysis convincing and think it makes a strong empirical contribution that is of interest. There are omissions that need to be corrected and the authors should add in their rebuttal exactly what will be made open source. ", "strength_and_weaknesses": "Strengths:\n\nThe paper is well-written. Specifically the exposition on denoising diffusion models is clear and concise. Another primary strength of this paper is the experimental evaluation which is comprehensive. Hopefully the authors release their code as I am sure open implementation of 16 different attacks on point clouds would serve as a good resource to the community. \n\nWeaknesses:\n\nOne odd weakness of this work is the incorrect recounting of related work for attacks on point cloud models. The first attacks on point cloud models dates to roughly 3 years prior to the work the authors claim is the first. It is my understanding that [1A] was the first to demonstrate the vulnerability of neural networks on 3D data. This ought to be corrected in the related works of this paper. In addition the method of [1A], though very simplistic, has been shown to work very well in a black-box setting and even the white-box attack does not require gradients so this would be interesting to see how this plays into the gradient obfuscation argument given in this paper. \n\nAnother odd weakness of this work is the lack of reporting on the computational cost of training the denoising delusion model. Though I am not an expert, this seems like a very costly training that must be done. In addition, ablations on the quality of the purification would be interesting. The authors provide Figure 3 which I find very interesting and think that a better understanding of what makes a good purification model and what leads to a poor purification model would strengthen the contribution of the paper. That being said, the experiments of this paper are extensive and comprehensive so such ablations are not required for a convincing study. In addition, the authors state in table 1 that models mostly have 0% robustness and while I understand that these are not reported in the main text, they ought to be fully reported in the appendix on submission for completion. \n\nAnother place I think the paper could have been strengthened, and I am curious about why the authors choose not to perform this step, is that in [7] the authors show that diffusion-driven purification can easily be used to get certifications of model robustness. Is such an approach not computationally feasible in this setting or was it just not explored?\n\n\n[1A] - https://openaccess.thecvf.com/content_CVPR_2019/papers/Wicker_Robustness_of_3D_Deep_Learning_in_an_Adversarial_Setting_CVPR_2019_paper.pdf", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"correctness": "4: All of the claims and statements are well-supported and correct.", "technical_novelty_and_significance": "2: The contributions are only marginally significant or novel.", "empirical_novelty_and_significance": "3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work."}, "extra_text": {}}]

Author rebuttal:

Decision: Reject