Unlearnable 3D Point Clouds: Class-wise Transformation Is All You Need
Authors: Xianlong Wang
Minghui Li
Wei Liu
Hangtao Zhang
Shengshan Hu
Yechao Zhang
Ziqi Zhou
Hai Jin
Venue: NeurIPS 2024 poster (2024)
Keywords: Unlearnable examples
3D point clouds
deep neural networks
Primary area: safety_in_machine_learning
TL;DR: A pioneering unlearnable scheme for effective 3D point cloud protection against unauthorized deep learning.

Abstract: Traditional unlearnable strategies have been proposed to prevent unauthorized users from training on the 2D image data. With more 3D point cloud data containing sensitivity information, unauthorized usage of this new type data has also become a serious concern. To address this, we propose the first integral unlearnable framework for 3D point clouds including two processes: (i) we propose an unlearnable data protection scheme, involving a class-wise setting established by a category-adaptive allocation strategy and multi-transformations assigned to samples; (ii) we propose a data restoration scheme that utilizes class-wise inverse matrix transformation, thus enabling authorized-only training for unlearnable data. This restoration process is a practical issue overlooked in most existing unlearnable literature, i.e., even authorized users struggle to gain knowledge from 3D unlearnable data. Both theoretical and empirical results (including 6 datasets, 16 models, and 2 tasks) demonstrate the effectiveness of our proposed unlearnable framework. Our code is available at https://github.com/CGCL-codes/UnlearnablePC.

Unlearnable 3D Point Clouds: Class-wise Transformation Is All You Need
Xianlong Wang 1.2,4,51, Minghui Li Wei 122454, Hangtao Zhang 4,51,
Shengshan Hu 1,2,4 Yechao Zhang 1,2,4,5 12,4,55 Ziqi Zhou 1,2,3 Hai Jin 1,2,35
National Engineering Research Center for Big Data Technology and System
Services Computing Technology and System Lab Cluster and Grid Computing Lab 4 Hubei Engineering Research Center Big Data Security
Hubei Key Laboratory of Distributed System Security
School of Cyher Science and Engineering. Huazhong University of Science and Technology & School of Software Engineering, Huazhong University of Science and Technology
School of Computer Science and Technology. Huazhong University of Science and Technology [xx19 mingmuinggiini 1i, weil weiliuu3,
hushengshan, yez, zhouz igii hjin e Bhust. edu.
Abstract
Traditional unlearnable strategies have been proposed to prevent unauthorized users from training the 2D image data. With more 3D point cloud data containing sensitivity information, unauthorized usage of this new type data has also become serious concern. To address this, propose the first integral unlearnable frame- work for 3D point clouds including two processes: (i) we propose an unlearnable data protection scheme, involving class-wise setting established by category- adaptive allocation strategy and multi-transformation assigned to samples; (ii) we propose data restoration scheme that utilizes class-wise inverse matrix transforma- training for unlearnable data. This restoration
tion, thus enabling authorized-one process a practical issue overlooked in most existing unlearnable literature, i.e., even authorized users struggle to gain knowledge from 3D unlearnable data. Both theoretical and empirical results (including 6 datasets, 16 models, and tasks) demonstrate the effectiveness of our proposed unlearnable framework. Our code is available https: //ggttuttbb////// con/ CCCCCGCCCC codes www.eoowweeeeeeeeeooeeeeeeeeeeee wtwee////eeeaaabbeeeeeeeee
1 Introduction
Recently, 3D point cloud deep learning has been making remarkable strides in various domains, e.g., self-driving [6] and virtual reality [1, 46). Specifically, numerous 3D sensors scan the surrounding environment and synthesize massive 3D point cloud data containing sensitive information such as pedestrian and vehicles [32] to the cloud server for deep learning analysis [12, 23]. However, the raw point cloud data can be exploited for point cloud unauthorized deep learning if data breach occurs, posing significant privacy threat. Fortunately, the privacy protection approaches for preventing unauthorized training have been extensively studied in the 2D image domain [9, 19, 28, 29, 39, 42). They apply elaborate perturbations low generalization, thus failing to learn knowledge from the protected data, known as "making data unlearnable.. Nonetheless, the stark disparity between 2D images and 3D point clouds poses significant challenges for drawing lessons from existing 2D solutions.
images such that trained networks over them exhibit extremely
Specifically, migrating 2D unlearnable schemes to 3D suffers from following challenges: (i) In- compatibility with 3D data. Numerous model-agnostic 2D image unlearnable schemes operate
Minghui Li the corresponding author.
38th Conference on Neural Information Processing Systems (NcurIPS 2024).

---

Transformations
None
Rotation"
Scolling
Shear
Twisting
Topering
Reffection'
Translation
Illustrations of point cloud samples
Desoriptions
sample
Changing ongles
Changing the
Stretching or comprrssing
Twisting shape
Norrowing shorteming
Creating o mirror objict
Chonging posttion
Is it reversible?
Quanity of possible transformation
Infinite
Infinite
Infinite
Infinite
Infinite
Infinite
Dimension of the multiplicative
3
B 33x3
3R33
transformation matrix
Figure I: An overview of existing types of 3D transtormations. "*" denotes rigid transformations that do not alter the shape of point cloud samples, while remaining transformations are non-rigid transformations.
in the pixel space, such as convolutional operations [39, 42], making them fail be directly trans- ferred to the 3D point space. (ii) Poor visual quality. Migrating model-dependent 2D) unlearnable methods [5. 9, 19, 28] to 3D point clouds requires perturbing substantial points, leading to irregular three-dimensional shifts which may significantly degrade visual quality. Hence, these challenges spur us to start directly from the characteristics of point clouds for proposing 3D unlearnable solutions.
Recent works observe that 3D transformations can alter test-time results of models [7, 17, 44]. To explore this, we conduct an in-depth investigation into the properties of seven 3D transformations as shown in Fig. 1 and reveal the mechanisms by which transformations employed in a certain pattern serve as unlearnable schemes (Sec. 3.2). In light of this, we propose the first unlearnable approach in 3D point clouds via multi class wise transformation (UMT), transforming samples to various forms for privacy protection. Concretely, we newly propose a category-adaptivy allocation strategy by leveraging uniform distribution sampling and category constraints to establish class- wise setting, thereby multiplying mulli-traasformmtiion to samples based on categories. To theoretically analyze UMT, we define binary classification setup similar to that used in [20, 33, 39]. Meanwhile, we employ Gaussian Mixture Model (GMM) [38] to model the clean training set and use the Bayesian optimal decision boundary to model the point cloud classifier. Theoretically, we prove that there exists a UMT training set follows a GMM distribution and the classification accuracy of UMT dataset lower than that of the clean dataset in a Bayesian classifier.
Moreover, an incompatible issue in existing unlearnable works [9, 19, 28, 29, 39, 43] identified [54], Le., these approaches prevent unauthorized learning to protected data, but they also impede authorized users from effectively learning from unlearnable data. To address this, we propose a data restora- tion scheme that applies class-wise inverse transformations, determined by a lightweight message received from the protector. Our proposed unlearnable framework including UMT approach and data restoration scheme is depicted in Fig. 3.
Extensive experiments on benchmark datasets (including synthetic and real-world datasets) using 16 point cloud models across CNN, MLP, Graph- bashh Network, and Transformer on two tasks (classification and semantic segmentation), verified the effectiveness of our proposed unlearnable scheme. We summarize our main contributions as follows:
The First Integral 3D Unlearnable Framework. To the best of our knowledge, propose the first integral unlearnable 3D point cloud framework, utilizing class-wise multi- transformation its unlearnable mechanism (effectively safeguarding point cloud data against unauthorized exploitation) and proposing a novel data restoration approach that leverages class- wise reversible 3D transformation matrices (addressing incompatible issue in most existing unlearnable works, where even authorized users cannot effectively learn knowledge from unlearnable data).
Theoretical Analysis. We theoretically indicate the existence of unlearnable situation that the classification accuracy the UMT dataset lower than that the clean dataset under the decision boundary of the Bayes classifier in Gaussian Mixture Model.
Experimental Evaluation. Extensive experiments on 3 synthetic datasets and real- world datasets using 16 widely used point cloud model architectures on classification and semantic segmentation tasks verify the superiority of our proposed schemes.

---

2 Preliminaries
Notation. Considering the raw point cloud data (X, Y) X' y sampled from clean distribution
D for training a point cloud network, the user's s goal is to obtain model F X - 3/ by minimizing the loss function (e.g., cross-entropy loss) (XF(X), Y). Let T E T be 3D transformation matrix that does not seriously damage the visual quality of point clouds. Note that X' E R , T E R3x3 and p represents the number of points. training dataset Da: to a Gaussian Mixture Model (GMM) [38] (yp,, I), where
theoretical analysis, following [20, 33J, we simplify
[ denotes the class labels, μt E Rd denotes the mean value, and I E I ddd denotes the identity matrix. Thus the Bayes optimal decision boundary for classifying Dj: is defined by P(x) p² x 0. The accuracy of the decision boundary P on D is equal to <( (|]| (2), where & denotes the Cumulative Distribution Function (CDF) of the standard normal distribution.
Data protector 9p- Gp aims to protect the knowledge from the clean training set (with size of n) D. (X,, Y: n point cloud data (X), Y resulting in extremely poor generalization on the clean test distribution De D. This objective be formalized as:
"D by compromising the unauthorized models who train the unlearnable
max
((F(X:8,), Y), s.t. 8n = arg min (X,Y)DD
E
E ((F Y,) (1)
(X,Y..)DD
where G2 assumes that training samples are all transformed into unlearnable ones while maintain- ing normal visual effects, in line with previous unlearnable works [19. 28, 39, 42]. By the way, solving Eq. (1) directly is infeasible for neural networks because it necessitates unrolling the entire training procedure within the inner objective and performing backpropagation through it execute single step of gradient descent on the outer objective [8].
Authorized user Ga- 9. aims to apply another transformation T E 'T on the unlearnable sample, making the protected data learnable. This is formally defined as:
min
L (F (X; Y), s.t. 0, arg min (x,))-De
E
Σ JED,
L(F (T Y,)
(2)
0
where Go assumes that, without access to any clean training samples, T can be constructed by utilizing a lightweight message M received from data protectors.
Our Proposed Unlearnable Schemes
3.1
Key Intuition
Several recent works [7, 13, 44] reveal employing 3D transformations can mislead the model's classification results. Such a phenomenon implies that there might be some defects in point cloud classifiers when processing transformed samples, leading us to infer that 3D transformations are probable candidates for data protection against unauthorized training. If the transformed point cloud data are used to train unauthorized DNNs, only simple linear features inherent in 3D transformations (at which transformations may act as shorteuts [14]) are captured by the DNNs, successfully protecting point cloud data privacy.
Applying class- wise transformations transformaane
DNN
Shortcut
"bed"
accuracy (5)
"chair"
50
40
"tilee"
30
Samplowise
Dutasot-wi wis
Cass-bbe
Original samples
Trangfor motions
Establishing new mapping
Ground- lobel
Ratation
Scaling
Shear
Twiiting
Tapering Tranciation
(b)
Figure 2: (a) Training on the transformed ModelNet10 datasct (employing sample-wise, dataset- wisc, and class- wise patterns) using PointNet classifier; (b) The high-level overview of the class-wise setting
3

---

3.2 Exploring the Mechanism
We summarize existing 3D transformations in Fig. 1 and formally define them in Appendix A. To seek clarity on the application and selection of transformations, explore three aspects: (i) execution mechanism, (ii) exclusion mechanism, and (iii) working mechanism as follows.
(i) Which execution mechanism successfully satisfy Eq. (1)? The extensively employed execution patterns in 2D unlearnable approaches are sample-win -hipe--ssee//e [9, 19] and class-wise [19, 39] settings. We further complement the dataset-wise setting (using universal transformation) and implement the above execution mechanisms for training a PointNet classifier [35] on the transformed ModelNet10 [50], obtaining test accuracy results in Fig. 2 (a). We discover that model achieves considerably low test accuracy under the class wiie setting, satisfying Eq. (I). Sample-wise and dataset-wise settings do not obviously compromise model performance, which cannot serve promising unlearnable routes. Moreover, we note that sample-wise transformation is often considered as a data augmentation scheme improve generalization, which contradicts our aim of using class-wise transformation to lower model generalization.
(iii Which transformations need to be excluded? Not all transformations are suitable candidates. We exclude three transformations, tapering, reflection, and translation. (1) The tapering matrix may cause point cloud samples to become planar projection when 7/2 defined in Eq. (18) equals to -1, rendering the tapered samples meaningless; (2) The reflection matrix has only three distinct transformation matrices, rendering it incapable of assigning class-wit wise transformations when the number of categories exceeds three; (3) The translation transformation is a straightforward and simple additive transformation that is too easily defeated by point cloud data pre- processing approaches.
(iii) Why does class-wise transformation work? We conduct experiments using class-wise trans- formations (see Tab. 6). indicating that the model training on the olass-wise transformed training set achieves relatively high accuracy on the class-wise transformed test set (using the same trans- formation process as the training set). Besides, if we permute the class-wise transformation for the test set, we obtain a significant low accuracy on the test set. Therefore, we conclude that the reason why class-wir wise transformation works is that the model learns the mapping between class-wise transformations and corresponding category labels as shown in Fig. 2 (b), which results in the model being unable to predict the corresponding labels clean test set lacking transformations. This analytical process yields conclusions that are in agreement with prior research [39, 44].
3.3
Our Design for UMT
3.3.1
Category-Adaptive Allocation Strategy
We assign transformation parameters based on categories to realize class-wise setting. For rotation transformation R E R3333 we refer to a and / as slight angles imposed on the x and axes, 7 as the primary angle for axis. We generate random angles for AN times in three directions:
a, ~ -
AN [NN]
where L/ denotes uniform distribution, N denotes the number of categories, r, is small range that controls a and 3, while Tp is a large range that controls 7. AN is computed in such a way to ensure that the number of combinations of three angles is greater than or equal N. Concretely, in the rotation operation, each of the three directions has Ay distinct angles, which means that the final rotation matrix has A3, possible combinations. To satisfy the class wise setup. A4, must be least
N, requiring AN to be no less than N Finally, we randomly select N combinations of angles for the allocation. The scaling transformation S E _gax3 resizes the position of each point in the 3D point cloud sample by a certain scaling factor X, which is sampled N times from a uniform distribution 21
U(br, bw)
where by and by represent the lower bound and upper bound of the scaling factor, respectively. For shear H E 3x33 defined in Eq. (13), twisting W E R3x3 defined in Eq. (16), the process of generating parameters within ranges (wi, and (he, hu)) is consistent to scaling. The range of these parameters ensures the visual effect of the sample.

---

Cotegory-Adophe Allocation Strategy
Data Restoration Scheme
TotAn
Number of categories
Laidorm distrbutiion U
Parameter lists io Aoe
Revere tromformation
Training
K.T.Ty bu My
Authorized user
Traising
Unauthorized user
High eccenesy
Usw meceney
Employing Class-wise
Transforattions
Motrix multiplication
Legally accessed,
Miggolly accessed
Data protector
Assigning wloss-wie parometers
B.
Input row J0 point cloud data tw/o any protection)
Class scoling tronsformation
Unlearnable point cloud data
Row point cloud data
transfarmation.K Rt.
transformation H
Figure 3: An overview of our proposed integral unlcarnable pipeline
Since rotation matrices Rao Rg, and R., around three directions are all orthogonal matrices, is also an orthogonal matrix, which can be defined as:
Property 1.
WA (Ra, R3, R.,, R}, s.t. MM =
(5)
where can determine the orthogonality by matrix multiplication through the definitions of Eq. (11). Since R = RR Rg and RRT RRR RT RR.R" R = I, so R is also an orthogonal matrix.
Property 2. All four transformation matrices we employ, R, S, W, and H. and the multiplicatiie combinations of any these matrices are all invertible matrices, which can be formally defined as:
VJ E ((
f(x) E (x,1)} DI S.L. JK= =
(6)
where the inverse matrices of R, S, W, and H given in Appendix A. This property allows the authorized users to normally train on the protected data due to that multiplying a matrix by its inverse results in the identity matrix, leading us propose data restoration scheme in Sec. 3.4.
3.3.2 Employing Class-wise Transformations
Assuming the point cloud training set DD defined as {(X.1, Y.). (X,2, Y.). ( YJ) where 11, 72..--,,11 represent the number of samples in the 1st, 2nd, .... N-th category, respectively. We formally define the spectrum of transformations as & to indicate the number of transformations involved. Thus the ultimate unlearnable transformation matrix Ta defined as:
Te -I V.,
Vi j,
s.t. V. E (R, W, H), V: ソソ
Once employ the proposed iilegory--daaptiin allocation strategy T&. the unlearnable point cloud dataset D, is constructed as:
D, (XTT(Xaa) Y.). (TA, (Xx),, (,),,,)),... (X.n.) Y
Our proposed UMT scheme is described in Algorithm 1. We enumerate possible transformations in Eq. (7) to obtain the unlearnability in Tab. 7 and select one type class wise transformation for each & for more comprehensive experiments in Tab. 1. To facilitate the theoretical study of UMT?, opt for RS as the transformation matrix T, which achieves the best unlearnable effect as suggested in Tabs. and 7. Thus, in the GMM scenario, the class-wise transformation matrix is defined as Ty = S, = X,, E Bdxd where X, E is the scaling factor.
Lemma 3. The untearnable dataset D., generated using UMT D. can also be represented using GMM, i.e., D. ~ No (NTT I2.).
Proof: See Appendix D.I. Lemma 3 demonstrates that the unlcarnable dataset D, can also be represented as GMM, which is derived from Property
Lemma 4. The Bayes optimal decision boundary for classifying Du is given by P.(x) = Ar
[22,
BT x + 0, where A= == x
2 2(A_iT + x TT) and C -
In the subsequent theoretical descriptions, UMT refers to UMT with k=2 using transformation matrix RS.
5

---

Proof: See Appendix D.2. Lemma 4 reveals that the Bayesian decision boundary for classifying Du. a quadratic surface based on the GMM expression of D...
Lemma 5. Let ~ (0, I). Z = + b = where = B vectors. For any t and y IR, employ Chernoff bound to have:
A c= 2. and I1-112 denote 2-norm of
exp
201 201-213 11b12
t(7 +(7+ + d]}
P(Z E +7}
(1 21)
Proof: See Appendix D.3. Lemma 5 enables us establish upper bound on the accuracy of the unlcarnable decision boundary Pa applied to the clean dataset D., denoted as TD. (P)), as presented in Theorem 6 below.
Theorem 6. For any constant 1 and to satisfying S 1 and 0 S t2 < 2. the accuracy of the unlearnable decision boundary Pa on De can be upper-bounded as:
b1b + 2 + t1 1 +o} cxp 2(1 - 2t,)
TD. (P.) 5
2 - 2
1 2(1-21x))
||b 224113 t2(n p - bT + c 2d)}
exp
2/(1 21 1
P1 + P2
b7 + b c d < O and -p 4 + uu+b-u-a - O, we have TD. (Pa) < 1. Moreover, for any μ # 0, 3 matrixx T, such that TD. (Pw) TD. (P), where P is the Bayes optimal decision boundary for classifying De.
Furthermore, if 1
Proof: See Appendix D.4. The unlearnable effect takes place when TD. (Pu) < TD. (P). To achieve this, we elaborately choose Ty, which is formalized as 1u" T - T. / < Therefore, -
Theorem theoretically explains why UMT is effective in generating unlearnable point cloud data.
3.4 Data Restoration Scheme
To ensure that authorized users can achieve better generalization after training on unlearnable data, i.e., satisfying Eq. (2), we exploit the inverse properties of 3D transformations, presented in Property
2, to calculate the inverse matrix of Tr as:
Ta -I---
V j, s.t. V: (
(9)
In particular, we note that R lightweight message M containing class-wise parameters from the data protector through secure channel, thereby assigning M to the inverse transformation matrix in Eq. (9) for multiplying the unlearnable samples. Our proposed integral unlearnable process is illustrated in Fig. 3.
S-1 = L1. Afterwards, the authorized user receives a
4 Experiments
4.1 Experimental Details
Datasets and Models. Three synthetic 3D point cloud datasets. ModelNet40 [50], ModelNet10 [50].
ShapeNetPart [4], and three real-world datasets including autonomous driving dataset KITTI [32]
and indoor datasets ScanObjectNN [41], S3DIS [2] are used. We choose 16 widely used 3D
point cloud models PointNet [35]. PointNet++ [36], DGCNN [45], PointCNN [25], PCT [16].
PointConv [48], CurveNet [51], Simple View View [15], 3DGCN [26], LGR-Net [59]. RIConv [57].
RIConV++ [58], PointMLP [31]. PointNN [56]. PointTransformerVe [49]. and SegNN [62] for
evaluation of classification and semantic segmentation tasks.
Experimental Setup. The training process involves Adam optimizer [22], CosineAnnealingLA. scheduler [30], initial learning rate of 0.001, weight decay 0.0001. We empirically set Tp- by, ba,
Wi, Was hú, and h, to 15 120" 0.6, 0.8, 02, 20 O. and 0.4 respectively. The main results of different

---

Table I: Main results: The average test accuracy (%) results with standard deviations from three runs (random seeds are
23, 1023, and 2023) of classification models trained on the UMT datasets
Daissos
Schemes
PoistNei
PrintNette
DGCNN
PonCNN
PCT
PrintCune
Caroehai
Simplehiew
RiCume
SDOCN
PainNN
PrereMEPP
AVG
Clean
80355
87:50um
11.36.
80.5tem
87:00
85.3t..
R3.22am
0:07eax
UMI
4064.100
38
27.4
32.82270
3878asa
25.31am1
20
54.4
31.8523r
3K Nizi
ModeINei0
UMTT>-
18.34ma
2197aa
19.7
20
25/4c
22.75as
1853
32.70.
51.942211
25
13.61.00
UMT
22.4..7
29.66a3
27.08am:
20.3a.
25:3
32.12a33
19
36.19
30.54.13
32.21a33
27.27
UMT
28.2..
20
23.00u
11922a
2906
33,29290
26
26.30.10
28.57,08
29.254135
31,17
ModelNos40
U
8.3
18
11:00as
10.55n
923
12
12.77
12,05a
1048
17
2500500
1050
UM
7.4
17
18
9.43um
9.3
11.38
11.25
11.3
10
25.3
24.53am
8,34
1922
7.83azs
15
10.56a5
866622
9,68
10.3em
18.9
14.3aa
18.0
17.16am
2433
12.36a21
Cltan
10 10
38
10
W6 s
55
19
UMT
6385-11
90
m0
11.05aam
54 Wor
19
Saa
71 Nen
46.2
54
4) 1.
56 M
ShopeNetPurt
UMTs
1841.4
45.6
25.9923
25.97335
37.72n33
15.0
26,4833
38.86.
505250
32
34.19246
30, MULLO
UM
32.50
27.29u1:3
46.77.99
43.5mm
11,3
37.27
41,51,24
47
50385.on
47.00
38. 17
UMT
23.72anss
34.52mx
45.07mmm
10
29.70u
4000um
32
3300
51.0lmm
Clean
08.44.2
09.33am
09:3am
08.0aa
09.00m
92.6
09 10.0
95-72a
UMTTs
KITTI
19,33
31,262.
55.0ute
54.55001
42.54.1
32.62.1
58,44sm1
UM
2634-19
61 NM
20.50wm::
54.3wmm
6421-am
$1.30.
91.36n
S4.5
96 90.44
7233
70.4-ox
$6.50m
57 MWee
Claan
R
17.35rm
7288c:
6538mc
30,5500
15
1532m
31.93am
6874
73865
7133
UMT
56.55am
63.0ezm
57.0km
51.97ew
47.5miz
65.46.n
38.6ha
6233mm
$4.5man
62.66..
SeanDbiscNN
UMT
1885:m
49 40
1361er
18:00:3
21.35:
2073a4
1876.
52.37.
6425
16:33-
25 Matu
UMT
10.92am
41.96.
14622ss
1862aas
22
18.0an
2143asi
11,79a
1180a
56.320
489
23,55ma3
24 44424
UMT
5.77220
34.6533
12.36us
987.2
17.6.1a3
12.7940
15.28a
20,05
31,83a2
4606.141
45.27uu
8,76am1
21.70
Table 2: Robustness results: The test accuracy (%) results on UMT-ModelNeraO against pre-process schemes
Pro- processe sehormes
PointNet
PaimNet-+
DOCNN
PsinCCNN
CurveNet
SimpleView
RICan+++
3DGCN
PoinNNN
PoinMMI
AVG
Clean baseline
86,10
91.13
B9:12
73.73
$7.76
$3.39
83.32
11.30
75.010
37.65
$1.36
SRS Sti
3.35
19.17
9.3
10.45
T1237
1421
0,26
-5..0
25512
11.22
14.73
9.24
22.20
10.25
7.78
12.66
14,04
11.32
24.72
26.01
12.18
15.04
Random
10..4
26.74
11.59
12.13
12.09
20.37
19.65
Kandom scaling
22.33
22:45
30.15
20.22
25.61
23.25
73.02
27.48
24.39
29.00
Runken jihter
9.64
21.72
10.05
16.68
Rindom eocation Scalling
6349
39.14
30.3
37.36
51.02
7509
65.00
78.04
5679
l on unlearnability is shown in Tab. 1. Specifically, k = 1 uses R. k: = 2 uses RSS, k = 3 uses RSW, and k = 4 uses RSWH. More results for different combinations of class-wise transformations are provided in Tab. 7. The table values covered by gray denote the best unlearnable effect.
Evaluation Metrics. For classification, we report the lest accuracy (in %) derived from the classification accuracy on clean test set, which aligns with the metrics used in the 2D unlearnable schemes [19, 28, 391. For semantic segmentation, we use eval accuracy and mean Intersection over Union (mloU) as evaluation metrics (in %), where eval accuracy is the ratio of the number of points classified correctly to the total number of points in the point cloud, mIoU calculates the IoU for each class between the ground truth and the predicted segmentation J, and then takes the average of these ratios. The lower these metrics are, the better the effect of the unlearnable scheme.
4.2 Evaluation of Proposed Unlearnable Schemes
Effectiveness. As shown in Tab. 1, UMT results significant decrease in test accuracy compared to clean baseline, indicating the unlearnable ef- fectiveness of UMT. Moreover, all values of k achieve good unlearnable results. The average per- formance of RS the best, which is employed as the default in the remaining experiments. We note that rigid transformations are easily defeated by invariance networks [10, 26, 58). Therefore, in practical settings, we will include non non-rigid trans- formations, using combined transformations to enhance the robustness of the UMT scheme.
Oce deane Interatinnattoo
One eatect
drowr
Peinhel Asstietis
SROWY
Figure 4: The test accuracy (%) results obtained after training on the clean, UMT, and restoration datasets
Robustness. (i) Data augmentations. Similar to [18, 24], we employ data augmentations like random scaling, random jätter, random rotation, Statistic Outlier Removal (SOR) [60], and Simple Random Sampling (SRS) [53] against UMT. Tab. 2 suggests UMT is robust to random data augmentations. SOR detects and removes outliers or noisy points but is ineffective in countering UMT because UMT does not introduce irregular perturbations or add outliers. SRS randomly selects a small subset from the entire set of points with equal probability. UMT is robust to SRS as it alters the coordinates of all points. Even if an arbitrary subset is chosen, all points within the subset have already undergone the unlearnable transformations. (ii) Adaptive attack. We assume the unauthorized user gains
7

---

Table 3: Semantic segmentation: Evaluation of UMT semantic segmentation task using S3DIS dataset
Evaluation midrics
Exil sccurny (38)
udll! (15)
Segmestttion models
Poimtett-- [36]
Point Transfommer v3 (49)
SegNN (62)
AVG
PoimNet- [36]
Point Trarsfommr v3 (49)
SegNN [62)
AVG
Clean houcline
24.3 76
74.72
78.00
76. 16
4006
40.57
50.27
4169
UMITist
1539
25.61
66.41
35.99
7.45
18.32
46.30
24,02
Table 4: Ablation study: The test accuracy (%) results derived from unlearnable data with different modules
Modules
PointNer
PointNers
DGCNS
PowrUNN
CurveNet
30GEN
FoierNN
PoieMLP
Mesale
27.10
20.02
26.61
21.54
36.87
25.32
65.25
-00.24
24.59
25.77
27.72
33.34
ModeeNest
Moduee 8
9.30
48.70
15.07
7.41
13:1
20.35
32.35
13.50
05.73
05:32
15.79
30:23
UMi
0.29
18.33
13.86
9.06
13.90
7.58
24.39
9.85
25.56
25.12
7.31
15.04
Mrani
7933
0131
1511
11
0725
35-10
97.18
4177
00.30
11.38
10.77
Module
30.36
32.60
knowledge about the G use of RS. Thus propose random rotation & scaling an adaptive scheme. In Tab. 2, the adaptive scheme exhibits a higher accuracy than other schemes, confirming its effectiveness. Nonetheless, it remains 28.67% lower than clean baseline, revealing the robustness of UMT against adaptive attack. More results of adaptive attacks are provided in Appendix C.3.
Visual Effect. We visualize UMT samples in Figs. 7 to 10, indicating that the unlearnable point cloud samples still retain their normal feature structure with visual rationality.
Evaluation of Semantic Segmentation. We evaluate UMT using common metrics for point cloud semantic segmentation tasks Tab. 3. As can be seen, the performance of semantic segmentation of data protected by UMT significantly decreases. The underlying reason is that the DNNs learn the features of class-wise transformations and establish a new mapping, which leads to the inability of test samples without transformations to be correctly segmented by the segmentation model.
Evaluation of Data Restoration. We multiply UMT samples by the transformation matrix in Eq. (9). The data becomes learnable after the restoration process, with test accuracy reaching a level compara- ble the clean baseline shown in Fig. 4. This strongly validates the effectiveness of the proposed data restoration scheme.
Xec
200
10
OGCMM
0.55
0.30
4.15
Figure 5: Hyper-parameter sensitivity analysis: The impact of hyperparametens To, Tp. by, and b, on the test accuracy results (%) the UMT (using RSS) ModelNet10 dataset
4.3 Ablation Study and Hyper- Sensitivity Analysis
Ablation Rotation Module. As shown in Tab. 4, the average accuracy increases by 15.18% and 21.65%, respectively, when only using S. This suggests the importance class-wise rotation module. The high test accuracy demonstrated by 3DGCN [26] can be attributed to its scaling invariance, which endows it with robustness against scaling transformation.
Ablation on Scaling Module. As also shown in Tab. 4, the average accuracy increases by 18.80% and 16.88% when only using the rotation module, respectively. The high test accuracy achieved thus
on RIConv [57] and LGR-Net [59] is due to the fact that both networks are providing resistance against rotation transformations. These ablation results furthermore emphasize the importance of incorporating more non-rigid transformations.
Hyper-Parammetr Analysis. We analyze four hyperparameters r., Tp. by and by in Fig. The influence of r. and Tp on the accuracy remains relatively small, exhibiting their best unlearnable effect when set to 15 and 120", respectively. We attribute this to the crucial role played by the class-wise setting, while it is not highly sensitive to the size of specific values. The unlearnable effect the best when by and by are set to 0.6 and 0.8, respectively. Similarly, the variations in by and b, do not significantly alter the effect due to the class-wise setting.

---

With clean training data
With clean training data
6
0
0:
bz
Cyram
6" model weight
With UMT training data
Low Eerain
model weight
With UMT training data
02)
8
0% High C.
Low
(a)
(b)
Figure 6: UMT in weight space. The blue anrow represents the clean training trajectory of the weights O, at step i, while the red arrows denote the UMT training trajectory. The values for plotting this figure provided Appendix C.6. (a) Testing on clean test set (blue and red ellipses); (b) Testing on UMT test set (green ellipse)
4.4 Insightful Analysis Into UMT
We formalize L(D) E D 8), Y)), where Le the cross-entropy loss, X, Y is the point cloud data sampled from dataset D. We define Drr. D.., and Dr as the training set, unlearnable test set (i.e., test set transformed by UMT), and clean test set, respectively. Thus we have the training loss Ltrain = ((Drr), unlearnable test loss f. L(D..), and clean test loss L. = L(D.).
The models trained on both clean and UMT training sets exhibit low Lirain as shown in Fig. (yellow ellipses), indicating the models converge well during training. Furthermore, when tested on D. as shown in Fig. 6 (a), the clean model (trained with clean training set) achieves low L. (blue ellipse), while the UMT model (trained with UMT training set) exhibits a high Le (red ellipse), also supporting the unlearnable effectiveness of UMT. Fig. 6 (b) reveals that the clean model and UMT model both exhibit low Lu (green ellipse), suggesting that they can classify UMT samples. But the mechanisms underlying the two cases of low L. differ. The clean one due to that the semanties of samples can be remained by UMT and thus normally classified. The UMT one is that the UMT model learns the mapping between transformations and labels, thereby correctly predicting the samples containing the same transformations. We conclude that the clean model effectively classifies both clean and UMT samples, while the UMT model successfully classifies UMT samples (the UMT process is the same for both training and test samples) but fails to classify clean samples.
Related Work
5.1 2D Unlearnable Schemes
The development of 2D unlearnable schemes [19, 29, 39, 42, 55) has been booming. Specifically, model-dependent methods are initially proposed in abundance [9, 19, 29]. Afterwards, numerous model-agnostic methods that significantly improve the generation efficiency have surfaced [39, 42, 47]. However, due to the structural disparities between 3D point cloud data and 2D images, applying unlearnable methods directly from 2D to 3D reveals significant challenges.
5.2 Protecting 3D Point Cloud Data Privacy
Some works proposed an encryption scheme based on chaotic mapping [21] or optical chaotic encryption [27], and 3D object reconstruction technique was introduced [34], both achieving privacy protection for individual 3D point cloud data. Nevertheless, no crivacy-preservigg solution has been proposed specifically for the scenario of unauthorized DNN learning on abundant raw 3D point cloud data. It is worth mentioning that both parallel works [44, 63] study availability poisoning attacks against 3D point cloud networks, which largely reduce model accuracy, and both have the potential to be applied as unlearnable schemes. However, the feature collision error- error-mining minimization poisoning scheme proposed by Zhu el al. [63] overlooks the problem of effective training for authorized users, which limits its practical use in real-world applications. The rotation- based poisoning approach proposed by Wang el al. [44] easily defeated by rotation-invariat networks [57, 58, 59], as revealed in Tabs. and 4.

---

6 Conclusion, Limitation, and Broader Impacts
In this research, we propose the first integral unlearnable framework in 3D point clouds, which utilizes class-wise multi transformations, preventing unauthorized deep learning while allowing authorized training. Extensive experiments the superiority of our framework. The transformations include rotation, scaling, twisting, and shear, which are all common 3D transformation operations. If unauthorized users design network that is invariant to all these transformations, they could potentially defeat our proposed UMT. So far, only networks invariant to rigid transformations like rotation and scaling have been proposed, while networks invariant to non-rigid transformations like twisting and shear, have not yet been introduced. Therefore, our research also contributes the design of more transformation-invarrr
synthetic and real-world datasets and theoretical evidence verify
networks.
Our research calls for the design of more robust point cloud networks, which helps improve the robustness and security of 3ID point cloud processing systems. On the other hand, if our proposed UMT scheme is maliciously exploited, it may have negative impacts on society, such as causing sharp decline in the performance of models trained on it, affecting the security and reliability of technologies based on 3D point cloud networks. More transfornationninvaaiant 3D point cloud networks need to be proposed in the future avoid potential negative impacts.
Acknowledgements
Shengshan's 's work is supported by the National Natural Science Foundation of China (Grant Nos. U20A20177, 62372196). Minghui Li is the corresponding author.
References
[1] Evangelos Alexiou, Nanyang Yang, and Touradj Ebrahimi. Pointxr: A toolbox for visualiza- tion and subjective evaluation of point clouds in virtual reality. In Proceedings of the 12th International Conference on Quality of Multimedia Experience (QoMEX'20), pages 1-6, 2020.
[2] Iro Armeni, Ozan Sener, Amir R Zamir, Helen Jiang, Ioannis Brilakis, Martin Fischer, and Silvio Savarese. 3D semantic parsing of large-scale indoor spaces. In Proceedings of the 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR'16) pages 1534-154..
2016. 6. 18
[3] Jens Behley, Martin Garbade, Andres Milioto, Jan Quenzel. Sven Behnke, Cyrill Stachniss, and Jurgen Gall. SemanticKITTI: A dataset for semantic scene understanding of lidar sequences. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV' (9), pages 9297-9307, 2019. 19
[4] Anell X. Chang, Thomas Funkhouser, Leonidas Guibas, Pat Hanrahan, Qixing Huang, Zimo Li, Silvio Savarese, Manolis Savva, Shuran Song, Hao Su, Jianxiong Xiao, Li Yi, and Fisher Yu. Shapenet: An information-rich 3D model repository. arXiv preprint 1512.005 2015. 6,
18, 21,22
[5] Sizhe Chen, Geng Yuan, Xinwen Cheng, Yifan Gong, Minghai Qin, Yanzhi Wang, and Xiaolin Huang. Self-ensemble protection: Training checkpoints are good data protectors. In Proceedings
of the 11th International Conference on Learning Representations (ICLR' 23), 2023. 2
[6] Xiaozhi Chen, Huimin Ma, Ji Wan, Bo Li, and Tian Xia. Multi-view 3D object detection network for autonomous driving. In Proceedings of the 2017 IEEE Conference on Computer Vision and Pattern Recognition (CVPR' 17), pages 1907-1915, 2017. 1
[7] Wenda Chu, Linyi Li, and Bo Li. Tpe: TTannformatioonspecifee smoothing for point cloud models. In Proceedings of the 39th International Conference on Machine Learning (ICML '2),
pages 4035-4056. 2022. 2, 15, 16
[8] Liam Fowl, Micah Goldblum, Ping-yeh Chiang, Jonas Geiping, Wojeiech Czaja, and Tom Goldstein. Adversarial examples make strong poisons. In Proceedings of the 35th Neural Information Processing Systems (NeurIPS'21) pages 30339-30351 2021. 3
[9] Shaopeng Fu, Fengxiang He, Yang Liu, Li Shen, and Dacheng Tao. Robust unlearnable examples: Protecting data against adversarial learning. In Proceedings of the 10th International Conference on Learning Representations (ICLR'22) 2022. 1, 4,
[10] Fabian Fuchs, Daniel Worrall, Volker Fischer, and Max Welling. SE (3)-taansformers: 3D roto-translation equivariant attention networks. In Proceedings of the 34th Neural Information Processing Systems (NeurIPS'20) 20), volume 33, pages 1970-1981, 2020. 7
10

---

[11] Fabian Fuchs. Daniel Worrall, Volker Fischer, and Max Welling. SE(3) trensstransfoomrs:: 3D
roto noto-translation equivariant attention networks. In Proceedings of the 34th Neural Information Processing Systems (NeurIPS"20) volume 33, pages 1970-1981, 2020. 20
[12] Cong Gao, Geng Wang, Weisong Shi, Zhongmin Wang. and Yanping Chen. Autonomous driving security: State of the art and challenges. IEEE Internet of Things Journal, 9 910))7572-7555
2021.
[13] Kuofeng Gao, Jiawang Bai, Baoyuan Wu, Mengxi Ya, and Shu-Tao Xia. Imperceptible and robust backdoor attack in 3D point cloud. IEEE Transactions on Information Forensics and Security (3), 19:1267-1282 2023.
[14) Robert Geirhos, Jörn-Henrik Jacobsen, Claudio Michaelis, Richard Zemel, Wieland Brendel, Matthias Bethge, and Felix A Wichmann. Shorteut learning in deep neural networks. Nature
Machine Intelligene, pages 665-673, 2020. 3
[15] Ankit Goyal, Hei Law, Bowei Liu, Alejandro Newell, and Jia Deng. Revisiting point cloud shape classification with a simple and effective baseline. In Proceedings of the 38th International
Conference on Machine Learning (ICML'21), pages -8809-380. PMLR, 2021. 6
[16] Meng-Hao Guo, Jun-Xiong Cai, Zheng-Ning Liu, Tai-Jiang Mu, Ralph R. Martin, and Shi-Min Hu. Pct: Point cloud transformer. Computational Visual Media, 7:187-199, 2021. 6, 17
[17] Shengshan Hu, Wei Liu, Minghui Li, Yechao Zhang. Xiaogeng Liu, Xianlong Wang, Leo Yu Zhang, and Junhui Hou. Pointert: Detecting backdoor in 3D point cloud via corruption robustness, In Proceedings of the 31st ACM International Conference on Multimedia (MM 23),
pages 666-675, 2023. 2, 17
[18] Shengshan Hu, Junwei Zhang, Wei Liu, Junhui Hou, Minghui Li, Leo Yu Zhang, Hai Jin, and Lichao Sun. Pointea: Evaluating the robustness of 3D point cloud completion models against adversarial examples. In Proceedings of the 37th AAAI Conference on Artificial Intelligence (A)AI'23), pages 872-880, 2023. 7
[19] Hanxun Huang, Xingjun Ma, Sarah Monazam Erfani, James Bailey, and Yisen Wang. Unlearn- able examples: Making personal data unexploitable. In Proceedings of the 9th International
Conference on Learning Representations (ICLR 2021. 1, 2, 3, 4, 7,9
[20] Adel Javanmard and Mahdi Soltanolkotabi. Precise statistical analysis of classification accura- cies for adversarial training. The Annals of Statistics, (0(4):2127-2156 2022. 2,3
[21] Xin Jin, Zhaoxing Wu, Chenggen Song, Chunwei Zhang, and Xiaodong Li. 3D point cloud encryption through chaotic mapping. In Proceedings of the 17th Pacific Rim Conference on Multimedia (PCM' 16), pages 119-129 2016. 9
[22] Diederik P. Kingma and Jimmy Ba. Adam: A method for stochastic optimization. arXiv preprint
14Xiv:141..69800 2014. 6, 17
[23] Peiliang Li, Siqi Liu, and Shaojie Shen. Multi-sensor 3D object box refinement for autonomous
driving. arXiv preprint arXiv: /909. 044442, 2019. 1
[24] Xinke Li, Zhirui Chen, Yue Zhao, Zekun Tong. Yabang Zhao, Andrew Lim, and Jocy Tianyi
Zhou. Pointba: Towards backdoor attacks in 3D point cloud. In Proceedings of the 18th
IEEE/CVF International Conference on Computer Vision (ICCV'21), pages
2021.
7
[25] Yangyan Li, Rui Bu, Mingchao Sun, Wei Wu, Xinhan Di, and Baoquan Chen. Pointenn: Convolution on x-transformed points. In Proceedings the 32nd Neural Information Processing Systems (NeurIPS' 18), pages 828-88 838, 2018. 6
[26] Zhi-Hao Lin, Sheng- Yu Huang, and Yu- Yu-Chiang Frank Wang. Convolution in the cloud: Learning deformable kernels in 3D graph convolution networks for point cloud analysis. In Proceedings the 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR 20), pages 1800-1809, 2020. 6, 7, 1.19
[27] Bocheng Liu, Yongxiang Liu. Yiyuan Xie, Xiao Jiang, Yichen Ye, Tingting Song, Junxiong Chai, Meng Liu, Manying Feng, and Haodong Yuan. Privacy protection for 3D point cloud classification based on an optical chaotic encryption scheme. Optics Express, (3)58888008884
2023.
(28) Shuang Liu, Yihan Wang, and Xiao-Shan Gao. Game-theoretic unlearnable example generator. In Proceedings of the AAAI Conference on Artificial Intelligence (AAA/'24), 2024. 1, 2, 3, 7 [29] Yixin Liu, Kaidi Xu, Xun Chen, and Lichao Sun. Stable unlearnable example: Enhancing the robustness of unlearnable examples via stable mrnimminn noise. In Proceedings of the AAAI Conference on Artificial Intelligence (AAAI'24), pages 3783-3791, 2024. 1,
[30] Ilya Loshchilov and Frank Hutter. Sgdr: Stochastic gradient descent with warm restarts. arXiv
preprint arXiv: 1608 03983, 2016. 6, 17
[31] Xu Ma, Can Qin, Haoxuan You, Haoxi Ran, and Yun Fu. Rethinking network design and local
geometry in point cloud: A simple residual mlp framework. arXiv preprint arXiv:2202.07122
11

---

2022. 6
[32]
Moritz Menze and Andreas Geiger. Object scene flow for autonomous vehicles. In Proceedings of the 2015 IEEE Conference on Computer Vision and Pattern Recognition (CVPR' 15), pages
3061-3070, 2015. 1,6
[33] Yifei Min, Lin Chen, and Amin Karbasi. The curious case of adversarially robust models; More data can help, double descend, or hurt generalization. In Uncertainty in Artificial Intelligence,
pages 129-139. PMLR, 2021, 2, 3
[34] Arpit Nama, Amaya Dharmasiri, Kanchana Thilakarathna, Albert Zomaya, and Jaybie Agullo de Guzman. User configurable 3D object regeneration for spatial privacy. arXiv preprint
arXiv:2108. 08273, 2021. 9
[35] Charles Ruizhongtai Qi, Hao Su. Kaichun Mo, and Leonidas J. Guibas. Pointnet: Deep learning on point sets for 3D classification and segmentation. In Proceedings the 2017 IEEE Conference on Computer Vision and Puttern Recognition (CVPR' 17), pages 652-660, 2017. 4,
[36] Charles Ruizhongtai Qi, Li Yi, Hao Su, and Leonidas J. Guibas. Pointnet++: Deep hierarchical feature learning on point sets in metric space. In Proceedings of the 3 Neural Information Processing Systems (NeurIPS' 17), pages 5099-5108, 2017. 6,8
[37] Jie Ren, Han Xu, Yuxuan Wan, Xingjun Ma, Lichao Sun, and Jiliang Tang. Transferable unlearnable examples. In Proceedings of the 11th International Conference on Learning
Representations (ICLR'23) 22), 2023. 9
[38] Douglas A. Reynolds. Gaussian mixture models. Encyclopedia of Biometrics, 741(659-663),
2009. 2, 3
[39] Vinu Sankar Sadasivan, Mahdi Soltanolkotabi, and Soheil Feizi CUDA: Convolution- unlearnable datasets. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR'23), 233), pages 3862-3871, 2023. 1, 2, 3, 4, 7,9
[40] StubbornAoom. Distributions of quadratic form of normal random variable. Cross Validated,
2020.
sttackeeccangge.oom/447776666663 com///478682.. 24
[41] Mikaela Angelina Uy. Quang Queng-Hieu Pham. Binh-Son Hua, Duc Thanh Nguyen, and Sai-Kit new benchmark dataset and classification model on real-world data. In Proceedings of the 17th IEEE/CVF International Conference on Computer Vision (ICCV"19), 2019. 6, 18, 21
Yeung. Revisiting point cloud classification:
[42] Xianlong Wang. Shengshan Hu, Minghui Li, Zhifei Yu, Ziqi Zhou, and Leo Yu Zhang. Cor- rupting convolution- based unlearnable datascts with pixel-based image transformations. arXiv preprint 2311v:2311./84000
2023. 1, 2, 3.9
[43] Xianlong Wang. Shengshan Hu, Yechao Zhang, Ziqi Zhou, Leo Yu Zhang, Peng Xu, Wei Wan, and Hai Jin. ECLIPSE: Expunging clean-label indiseriminate poisons via sparse diffusion purification. In Proceedings of the 29th European Symposium on Research in Computer Security (ESORICS'24) 24), pages 146-166, 2024. 2
[44] Xianlong Wang, Minghui Li, Peng Xu, Wei Liu, Leo Yu Zhang, Shengshan Hu, and Yanjun Zhang. PointAPA: Towards availability poisoning attacks in 3D point clouds. In Proceedings of the 29th European Symposium on Research in Computer Security (ESORICS' 24), pages
125-145, 2024. 2, 4, 9
[45] Yue Wang, Yongbin Sun, Ziwei Liu, Sanjay E. Sarma, Michael M. Bronstein, and Justin M. Solomon. Dynamic graph enn for learning on point clouds. ACM Transactions On Graphics
(TOG'19), pages 1-12, 2019. 6
[46] Florian Wirth, Jannik Quehl. Jeffrey Ota, and Christoph Stiller. Pointatme: efficient 3D point cloud labeling in virtual reality. In Proceedings of the 2019 IEEE Intelligent Vehicles Symposium (IV'19), pages 1693-1698, 2019. 1
[47] Shutong Wu, Sizhe Chen, Cihang Xie, and Xiaolin Huang. One-pixel shortcut: on the learning preference of deep neural networks. In Proceedings of the 1ith International Conference on Learning Representations (/CIR'23), 2023. 9
[48] Wenxuan Wu, Zhongang Qi, and Fuxin Li. Pointconv: Deep convolutional networks on 3D) point clouds. In Proceedings of the 2019 IEEE/CVE Conference on Computer Vision and Pattern Recognition (CVPR' 19), pages 9621-9630, 2019. 6
[49] Xiaoyang Wu, Li Jiang, Peng-Shuai Wang, Zhijian Liu, Xihui Liu, Yu Qiao, Wanli Ouyang, Tong He, and Hengshuang Zhao. Point transformer v3: Simpler, faster, stronger. arXiv preprint
arXiv:2312. 12. /0035. 2023. 6, 8
[50] Zhirong Wu, Shuran Song, Aditya Khosla, Fisher Yu, Linguang Zhang, Xiaoou Tang, and Jianxiong Xiao. 3D shapenets: A deep representation for volumetric shapes. In Proceedings of the 2015 IEEE Conference on Computer Vision and Pattern Recognition (CVPR' 15), pages
1912-1920, 2015. 4, 6, 18, 21, 23
12

---

[51]
Tiange Xiang, Chaoyi Zhang, Yang Song, Jianhui Yu, and Weidong Cai. Walk in the cloud: Learning curves for point clouds shape analysis. In Proceedings of the 18th IEEE/CVF Interna-
lional Conference on Computer Vision (ICCV'21), pages 915-924, 2021. 6
[52] Zhen Xiang, David J. Miller, Siheng Chen, Xi Li, and George Kesidis. A backdoor attack against 31) point cloud classifiers. In Proceedings of the 18th IEEF/CVE International Conference on
Computer Vision (ICCV'2), pages 7597-7607, 2021. 17
[53] Jiancheng Yang. Qiang Zhang. Rongyao Fang. Bingbing Ni, Jinxian Liu, and Qi Tian. Adver-
sarial attack and defense on point sets. arXiv preprint arXiv: /902. 10899, 2019. 7
[54] Jingwen Ye and Xinchao Wang. Ungeneralizable examples. In Proceedings of the 2024 IEEE
Conference on Computer Vision and Pattern Recognition (CVPR 24), 2024. 2
[55] Jiaming Zhang, Xingjun Ma. Qi Yi, Jitao Sang. Yugang Jiang, Yaowei Wang. and Changsheng
Xu. Unlearnable clusters: Towards label-agnostic unlearnable examples. In Proceedings of the
2023 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR"23), 2023. 9 [56] Renrui Zhang, Liuhui Wang, Yali Wang, Peng Gao, Hongsheng Li, and Jianbo Shi. Parameter not all you need: Starting from non- con-parametric networks for 3D point cloud analysis. arXiv
preprint arXiv:2300.000 00300000....00 34, 2023. 6
[57] Zhiyuan Zhang, Binh-Son Hua, David W. Rosen, and Sai-Kit Yeung. Rotation invariant convolutions for 3D point clouds deep learning. In Proceedings of the 2019 International Conference on 3D Vision (3DV'19), pages 204-215 IEEE, 2019. 6, 9. 19
[58] Zhiyuan Zhang, Binh-Son Hua, and Kit Yeung. Riconv++: Effective rotation invariant convolutions for 3D point clouds deep learning. International Journal of Computer Vision
(IJCV'22,, 12085):1228 1243, 2022. 6, 7, 9, 19
[59] Chen Zhao, Jiaqi Yang, Xin Xiong, Angfan Zhu, Zhiguo Cao, and Xin Li. Rotation invari- ant point cloud classification: Where local geometry meets global topology. arXiv preprint
1ttp::99110009 2019. 6, 9. 19
[60] Hang Zhou, Kejiang Chen, Weiming Zhang, Han Fang, Wenbo Zhou, and Nenghai Yu. Dup-net: Denoiser and upsampler network for 3D adversarial point clouds defense. In Proceedings of the 17th IEEE/CVF International Conference Computer Vision (ICCV'19) pages 1961-1970,
2019.
[61] Ziqi Zhou, Yufci Song, Minghui Li, Shengshan Hu, Xianlong Wang, Leo Yu Zhang, Dezhong Yao, and Hai Jin. Darksam: Fooling segment anything model to segment nothing, arXiv preprint
arXiv:2409. 17874, 2024.7 7
[62] Xiangyang Zhu, Renrui Zhang, Bowei He, Ziyu Guo, Jiaming Liu, Han Xiao, Chaoyou Fu, Hao Dong, and Peng Gao. No time to train: Empowering non-parametric networks for few-shot 3D scene segmentation. In Proceedings of the 2024 IEEE Conference Computer Vision and Pattern Recognition (CVPR'24), 2024. 6, 8
[63] Yifan Zhu, Yibo Miao, Yinpeng Dong, and Xiao-Shan Gao. Toward availability attacks in 3D point clouds, arXiv preprint 240. 1 2024.
13

---

Appendix: Unlearnable 3D Point Clouds: Class-wise Transformation Is All You Need
A Definitions of 3D Transformations
Existing 3D transformations are summarized in Fig. and formally defined in this section. The 3D transformations are mathematical operations applied to three-dimensional objects to change their position, orientation, and scale in space, which often represented using transformation matrices. formally define the transformed point cloud sample with transformation matrix T RR3x3 as:
X, = T
(10)
where X E R3xp the clean point cloud sample, X, E RR3 is the transformed point cloud sample.
A.1 Rotation Transformation
The rotation transformation that alters the orientation and angle of 3D point clouds is controlled by three angles a, B, and y. The rotation matrices three directions can be formally defined as:
0
cos B
sin /
cos y sin 7 cos Y 0 1
sin 7
R₂
COS
sin
R2
0
0 R2
sin a COs a
sin
COs
(11)
Thus we have = R. while employing rotation transformation. Besides, we have R. R., R₂ = RT. and R. = RRT.
A.2 Scaling Transformation
The scaling matrix S can be represented as:
X 0
s = 0
0
=
x
0
0
(12)
where the scaling factor À used perform proportional scaling of the coordinates of each point in the point cloud.
A.3 Shear Transformation
In the dineesiimensionll space, shearing is represented by different matrices, and the specific form depends on the type of shear being performed. Specifically, the shear transformation matrix Hay (employed in UMT) of shifting x and y by the other coordinate z, and its corresponding inverse matrix can be expressed as:
1
0 8
Hay
H ay
0
-1
(13)
1
0
0
The shear transformation matrix Haz of shifting x and by the other coordinate y, and its corre- sponding inverse matrix can be expressed as:
Har
1 0
0
0
H
0
1 0
(14)
-t
The shear transformation matrix Hys of shifting y and z by the other coordinate x, and its corre- sponding inverse matrix can be expressed as:
[
0
07
1
0 0
Hyz =
H
yz
=
-8 0
(15)
1
- 0
'nttps://wwe hhttps//ww..muricoppgre. http::/pp.p....oo///////oorrraaa
canssorrattionmatiiin wwt.aaate...eeeeeigg////////
14

---

Algorithm Our proposed UMT scheme
Clean 3D point cloud dataset D. (X,, Ye) number of categories N; slight range rai primary range rpi scaling lower bound by; scaling upper bound bu; twisting lower bound wy; twisting upper bound Wy; shear lower bound hy, shear upper bound hys spectrum of transformations k; matrix set T. = {R. S. S. W
Input:
Output: Unlearnable 3D point cloud dataset D. {(X.: Y,)
Initialize the slight angle lists L.= J. - J, the primary angle list [. the rotation list LR= J.
the scaling list Ls=(], the twisting list Cw=[], ], the shear list Cx=[] ]. and AN = V/N
for to A do Randomly sample transformation matrix Ve E Ts: Remove transformation matrix Ve from Ts:
if V. R. then for i to AN do
for j - An do
for k = 10 AN do
LR LR U C.l.
end
end
end
Get the LR rwwdda..smmlllleeeee N);
end
else if V. S then
for i = 1 to N do
Randomly sample X (ibi bu): Add to the list Ls < Ls {}i);
end
end
else if V2 = W then
for i to N do
Randomly sample wi ~ U(w, wy): Add to the list Lw t Lw U {wi};
end
end
else if V2 = H then
for i = to N do
Randomly sample h; Uhi hw); Add to the list LH + Cu (hits
end
end
end for
do
Get the transformation matrix T₁ = II i= V/ by the parameter lists above; Get the transformed data X.; Tk; X,;
end
Return: Unlearnable 3D point cloud dataset D.,.
A.4 Twisting Transformation
The 3D twisting transformation [7] involves rotational deformation applied to object in three- dimensional space, creating a twisted or spiraled effect. Unlike simple rotations around fixed axes, a twisting transformation introduces a variable rotation that may change based on the spatial coordinates of the object. For instance, considering twisting transformation along the z-axis, where the rotation angle is function related to the z-coordinate, can be expressed as:
Toos (0z) sin (0z)
sin sin(Oz) (2))
(0z)
0
(16)
15

---

where 0 is the parameter of the twisting transformation, and 2 is the z-coordinate of the object. The inverse matrix of (0, 2) is:
cos(
sin (z) cos 82)
0
W (0,=)=
sin(
(17)
1
A.5 Tapering Transformation
The tapering transformation [7] is linear transformation used to alter the shape of object, causing to gradually become pointed or shortened. In three-dimensional space, tapering transformation can adjust the dimensions of object along matrix representation of tapering transformation depends on the chosen axis and the design of the transformation. Generally, tapering transformation can be represented by matrix that is multiplied by the coordinates of the object to achieve the shape adjustment, which is defined as:
axes, creating tapering effect. The specific
1 + 1/2
0
07
2n, =
+ 1/2
(18)
0
1
where is the z-coordinate of the object. Considering that 172 could indeed equal -1, in such a case, the 3D point cloud samples would be projected onto the z-plane, losing their practical significance and the tapering matrix is also irreversible.
A.6 Reflection Transformation
Reflection transformation is a linear transformation that inverts an object along a certain plane. This plane is commonly referred to as reflection plane mirror. For reflection transformations in three- dimensional space, we can represent them through a matrix. Regarding the reflection transformation matrices of the ay plane, y2 plane, and æz plane, have:
Ray
0
0
Rys
0
Rus
0
-1
0
(19)
0
1
1
A.7 Translation Transformation
The 3D translation transformation' refers to the process of moving an object three-dimensional space. This transformation involves moving the object along the x, y, and z axes, respectively, smoothly transitioning it from one position to another, which is defined as:
0
t
0
tv
(20)
0 0
t. 1
where tus by. and to represents the translation along the x, y, and axes, respectively. This x matrix a homogeneous coordinate matrix that describes the translation in three-dimensional space. Additionally, the translation matrix also can be represented Iy E 3x3 which can defined as:
additive matrix to original point
la
1.
C
by
by
ty
(21)
t
t
B Supplementary Experimental Settings
B.1 Experimental Platform
Our experiments are conducted on server running a 64-bit Ubuntu 20.04.1 system with an Intel Xeon Silver 4210R CPU 2.40GHz processor, 125GB memory, and four Nvidia GeForee RTX 3090 GPUs, each with 24GB memory. The experiments are performed using the Python language, version 3.8.19, 19, and PyTorch library version 1.12.1.
'nttps: pestts://weee ://www javatpoint www/cc///////eeeeee wwt.////ptteeeeeeeeeeeeeee htt.pppppppp....ttttaattooaatoi.
16

---

Table 5: The test accuracy (%) results diverse types of transformations on ModelNet10 training using PointNet classifier
Transformations
Rotation
Scaling
Shear
Twisting
Tapering
Translation
AVG
wio
89.32
89.32
89.32
89.32
89.32
89.32
89,32
Sample-wise
91.52
87.78
89.10
92.62
90.31
90.31
89.80
Datasct-wise
87.89
79.41
85.79
92.18
88,22
88.22
83.45
Class-wise
29.85
20.81
67.84
63.22
52.42
36.67
45.14
Table Accuracy results obtained with different test sets when training the PointNet classifier using class-wise transformed training sets
Test sets J. Transformations
Rotation
Scaling
Shear
Twisting
Tapering
Translation
Class-wise test set
99.67
93.80
97.91
94.05
96.04
98.24
Permuted class-wise test set
10.68
38.22
58.37
60.68
42.51
31.94
Clean test set
29.85
20.81
67.84
63.22
52.42
36.67
B.2 Hlyper-Paramede Settings
The model training process on the unlearnable dataset and the clean dataset remains consistent, using the Adam optimizer [22]. CosineAmeealinlLA. scheduler [30], initial learning rate of 0.001, weight decay of 0.0001, batch size of 16 (due to insufficient GPU memory, training 3DGCN on ModelNet40 dataset), and training for 80 epochs. Due to the longer training process required by PCT [16], the training epochs for PCT in Tab. on ModeINet10, ModelNet40, and ScanObjectNN datasets are all set 240.
batch size is set to when
B.3 Settings of Exploring Experiments
We initially investigate which approach yields the best unlearnable effect among sample-wise, dataset- wise, and class-wise settings in Fig. 2 (a). Specific experimental settings are as follows:
In the dataset-wise setting, the same parameter values are applied to the entire dataset. Specifically, set to 0.8, both shearing factors and are set to 0.2. The angle 9 in twisting is 25". The tapering angle r is set to 25", and the parameters in translation transformation tg. ty. and t2 are set to 0.15.
we have a = B = 10 the rotation transformation, the scaling factor
In the sample-wise setting, each sample has its independent set of parameters, meaning the parameter values for each sample are randomly generated within a certain range. In the rotation transformation, a, B3, 7 are uniformly sampled from the range of ( to 20". The scaling factor À is uniformly sampled from 0.6 to 0.8, shearing factors s and f are uniformly sampled from the range of 0.4. Both the twist angle 0 and tapering angle 1) sampled from 0 to 50%, and the parameters in translation transformation ly by. and lg are sampled from 0 to 0.3.
In the class-wise setting, the parameters for transformations are associated with the point cloud's class. The selection of parameters for each class is also obtained by random sampling within fixed range. The chosen ranges are generally consistent with those described for the sample-wise setting above. However, difference lies in the consideration slight angle range and primary angle range in the case of rotation transformations, where these ranges are 20 and 120", respectively.
The specific results of test accuracy under different transformation modes, including sample-wise (random), clsss-wise, and dataset-wise (universal), are provided in Tab. 5. It can be seen that under the class-wise setting, the final unlearnable effect the best.
B.4 Benchmark Datasets
Dataset Introduction. The ModelNet40 dataset is point cloud dataset containing 40 categories, comprising 9843 training and 2468 test point cloud data. ModelNet10 is subset of ModelNet40 dataset with 10 categories. ShapeNetPart that includes 16 categories a subset of ShapeNet, comprising 12137 training and 2874 test point cloud samples. ScanObjectNN is real-world point cloud dataset with 15 categories, comprising 2309 training samples and 581 test samples. Similar to [17, 52], we split KITTI object clouds into class "vehicle" and "human" containing 1000 training
17

---

data and 662 test data. The input point cloud objects for the models encompass 256 points for the KITTI dataset and 1024 points for other datasets. The Stanford 3D Indoor Scene Dataser (S3DIS) dataset contains 6 large-scale indoor areas with 271 rooms. Each point in the scene point cloud is annotated with one of the 13 semantic categories.
Dataset Licenses. The dataset license information is listed as:
ModelNet10, ModelNet40 [50]: All CAD models are downloaded from the Internet and the original authors hold the copyright of the CAD models. The label of the data is obtained by us via Amazon Mechanical Turk service and it is provided freely. This dataset is provided for the convenience of academic research only. Link is https:/ tttps::/mmoees /mode lnet. cs ww..eoottoe////........o...
ShapeNetPart [4]: We use the ShapeNet database (the "Database") at Princeton University and Stanford University. Link is https / www. shapenet. org/.
ScanObjectNN [41]: The license is MIT License: Copyright (c) 2019 Vision & Graphics Group, HKUST. Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions the Software. Link is https: /tww/ttttttt/////eeee wwkust-ydd........ gi writhub... io/ scanob fectnn/.
S3DIS [2]: The copyright is from Stanford University, Patent Pending, copyright 2016. stwnetrrtafrrroooor edu/ dataset..e.....c .aw.la.tttttt...........
Link is
B.5 Settings of Robustness Experiments
The scaling factor in random scaling augmentation is to minimum of 0.8 and maximum of 1.25. In the random rotation operation, the three directional rotation angles are identical and uniformly sampled from [0, 2T.). The perturbations in the random jitter sampled from normal distribution with a standard deviation of 0.05, and the perturbation magnitude constrained within 0.1. The parameters & and in SOR are to 2 and 1.1, respectively. The number of dropped points in SRS is 500.
C Supplementary Experimental Results
C.1 Results for Execution Mechanism
We present the specific experimental results of Fig. (a) in Tab. 5. It can be observed that under the class-wise setting, the average test accuracy is the lowest, while the unlcarnable condition yields the best performance. Furthermore, class-wise transformed training sets (ModelNet10 dataset), analyzing accuracy results across different test sets, as shown in Tab. 6. It is noteworthy that the accuracy class-wise test sets (using consistent transformation parameters with class-wise transformed training set) is consistently above 90%, indicating that the model has learned the mapping between transformations and labels. This leads to correct classification on test samples with the same transformations. However, when the class-wise test undergoes permutation, the accuracy drops to level similar to that of the clean test set. This clearly demonstrates that the model can correctly classify samples only when they have corresponding transformations, and samples without transformations or with mismatched transformations cannot be correctly classified. This further validates that the model learns one-to one-to-one mapping between class transformations and labels.
conduct investigations into training the PointNet classifier with
C.2 Results of Diverse Combinations of Transforrmatioss
We investigate combinations of four transformations, i.e., rotation, scaling, shear, and twisting, and create unlearnable datasets using the class-wise setting. The test accuracy results across five point cloud models are presented in Tab. 7. It can be observed that the combination of rotation and scaling,
18

---

Table 7: The test accuracy (%) results obtained from training the point cloud classifiers PointNet, PointNet++,
DGCNN, PointCNN, PCT using ModelNett dataset generated with diverse combinations transformations
under a class-wise setting, where R. S, H. and W correspond to rolation, scaling, shear, and twisting respectively
Transformations
PointNet
PointNet++
DGCNN
PoinICNN
PCT
AVG
R
46.70
38.99
49.67
64.87
27.33
45.55
S
34,80
57.05
42.62
33.81
29.63
39.58
H
64.10
66.41
71.15
60.68
60.13
64.49
W
76.98
54.19
78.63
86.69
38.55
67.05
RS
22.25
14.10
21.48
19.56
30.51
45.93
36.23
33.81
37.29
RW
34.91
44.27
29.52
46.92
32.16
37.56
SH
20.26
44,93
38,66
43.50
34.80
36,43
SW
18.28
44.27
31.39
34.25
19.93
29 29.62
HW
63.33
62.56
61.89
64.76
51.43
60.79
RSH
15.97
29.19
36.56
21.81
31.28
26.96
RSW
25.22
31.50
23.57
31.83
38.55
30.13
SHW
21.70
46.37
55.29
37.11
38.77
39.85
RSKO
16.52
33.37
30.51
30.73
32.49
28.72
Table 8: The test accuracy (%) results with standard deviations from three runs (random seeds are set 23, 1023, 2023) obtained from training the point cloud classifiers PointNet, PointNet++, DGCNN, and PointCNN using a ModelNet10 dataset generated with diverse two class- wise transformations
ModelNet10 dataset
PointNet
PointNet++
DGCNN
PointCNN
AVG
RS
15. 12.12a0.0
26.62a5.11
25.22+10.00
17.26:3.6
21.05+073
33.70211.00
30.65a17.12
36.67a1564
34.99213.33
34.00s13.66
RW
39.83a671
30.18
36.7148.10
43.47,9.20
37.55a507
SH
21.22=0.44
46. 15a..22
31.87a632
30.8721094
32.532481
SW
23,50a6.0
51 $1.2886.69
38.3326.10
28.2745.25
35,34 35.342288
HW
54.41=7.9
54.22a14.54
55.142942
$7.7526.9
55,3816.9
two types of rigid transformations, achieves the most effective unlearnable effect. The transformation parameters used in this section are consistent with Appendix B.3.
To ensure the reliability the experimental results, we combine two different transformations and obtain the results from three runs using random seeds with 23, 1023, and 2023, then average them. The results shown in Tab. 8. From the results four popular point cloud models, it can be seen that when all transformations are rigid, the test accuracy is still the lowest.
C.3 More Results of UMT Against Adaptive Attacks
To further explore the performance of UMT against adaptive attacks, supplement the experimental results using four types of random augmentations RSHW in Tab. 10, and find that the conclusion consistent with Tab. 2, i.., UMT exhibits certain degree of robustness against the adaptive attack random transformations.
C.4
More Results of UMT Against Semantic Segmentation
To further evaluate the UMT performance against semantic segmentation, we employ the semantic scene understanding dataset SemanticKITTI [3] in Tab. 11. It can be observed that UMT is still effective against this real-world segmentation dataset.
C.5 Results of UMT Against SE(3) Equivariant Models
In the main text, we have discussed the robustness of UMT against rotation/scaling invariant models. The results for RIConv+ [58] (rotation invariant) and 3DGCN [26] (scaling invariant) networks in Tab. 1, as well as RIConv [57], LGR-Net [59] (rotation invariant), and 3DGCN in Tab. 4, demon- strating that these invariant networks can indeed defend against class-wise rotation and scaling. is worth noting that these networks, which are invariant to single transformation, cannot defend against UMT formed by combination of multiple transformations. Thus, appears that networks like SE(3) equivariant model, which are invariant multiple transformations in space, poten-
19

---

Table 9: The accuracy (%) results clean and UMT ModelNeetO training and test set using four point cloud classifiers. Higher accuracy values correspond to lower cross-entropy loss values.
Training and test sets
PointNet
PointNet++
DGCNN
PointCNN
AVG
Clean training set, clean test
89.32
92.95
92.73
89.54
91.14
Clean training set, UMT test set
55.51
70.93
74.78
69.71
67.73
UMT training set, clean test set
22.25
28.08
14.10
21.48
21.48
UMT training set. UMT test set
98.79
99.23
99.01
96.26
98.32
Table 10: Test accuracy (%) results using UMT training data and UMT data employing random augmentations
ModelNet10
PointNet++ PointNet
DGCNN
PointCNN
AVG
Clean baseline
89.32
92.95
92.73
89.54
91.14
UMT(=4)
16.19
36.56
17.62
27.42
24.45
UMT random RSHW
25.99
61.78
61.89
44.16
48.46
tially overcome UMT. Therefore, we include experimental results for the SE(3) equivariant network
(E(3)-Transforme [11] in Tab. 12.
However, it can be seen that SEa3)-Tranfformer cannot defend against UMT (k=3, RSW) and UMT(k=4, RSWH). This is because existing transformation-invann networks, even including SE(3) invariant networks, are designed only for rigid transformations (rotation, scaling, reflection, and translation). There are currently invariant networks proposed for non-rigid transformations like shear and twisting. Therefore, if a data protector wants UMT to be more robust, they can include non-rigid class-wise transformations defeat existing rigid transformation-inwe invariinn networks.
C.6 Results of Insightful Analysis
We train on clean training set and test on clean test set, train on clean training set and test on UMT test set, train on UMT training set and test on clean test set, and train on UMT training set and test on UMT test set to obtain the test accuracy results in Tab. 9 (we ensure that the UMT parameters for the UMT test set and UMT training set are consistent). Higher accuracy values indicate lower cross-entropy loss values, while lower accuracy values represent higher cross-entropy loss values. can be observed that only when trained with the UMT training set, the loss after lesting with the clean test set is high (i.e., low accuracy).
C.7 Boarder Hyper- Parametr Analysis
Additionally, we investigate the unlearnable effects across a wider range of hype-parameters Tp.Tp: bi, bu in UMT (k 2 with RS), as shown in Tab. 13. It be observed that our UMT scheme still exhibits a good unlearnable effect, and its key lies in the crucial role played by the class-wing setting.
C.8 Supplementary Ablation Results
In this section, we conduct ablation experiments on the UMT scheme on the ShapeNetPart dataset (keeping experimental parameters consistent with the main experiments), shown in Tab. 14. can be observed that whether using only the rotation module or only the scaling module, the final unlearnable effect is not good as UMT. This clearly demonstrates that each module contributes to the overall UMT effectiveness.
C.9 Results of Mixture of Class-wise and Sample-wise Samples
In this section, we investigate the test accuracy results when using a mixture of different ratios of class- wise samples and sample-wise (random) samples in the dataset, as shown in Tab. 15 (experiments are conducted on the ModelNet10 dataset with 10 categories, where "2 class-wise sample-wist miieee denotes that samples from 2 categories undergo class-wise transformations, while the remaining 8 categories undergo random transformations, and so on). We can clearly observe from the experimental results that the proportion of class-wie wise transformations gradually increases, the test accuracy gradually
20

---

Table 11: Semantic segmentation: Evaluation of UMT semantic segmentation task using SemanticKITTI dataset
Evaluation metrics
Eval accuracy (%)
mloU((S)
Segmentation models
PointNet++
Point Transfurmer
PointNet++
Point Transformer V2
Clean bascline
29.89
72.92
14.16
54.78
UMT RS)
4.69
19.40
0.80
13.39
Table 12: Test accuracy (%)
results using UMT training data to train the SE(3)- Transffraafrr
Clean baseline
49.07
UMT(K=3, RSW)
17.51
UMT(k=4, RSWH)
13.55
decreases, indicating that the unlearnable effect becomes more pronounced. This strongly suggests that the class-wise setting is more effective than the sample-wise setting.
Clean samples
UMT |4.7.0..9
samples 97.3, o. 76]
UMT 36.1",3.1',
samples 60.7"008)
UMT 112.7.8.6 8.86"
samples 14.9.0.67
Figure 7: Clean and UMT samples from ModelNet10 dataset
Clean samples
UMT 10.9"66.2"
samples 04.
UMT [10.9",3.] 3.7"
samples 49.9",..6.
UMT 51..6",5.11 1.
samples
Figure Clean and UMT samples from ModelNet40 dataset
Clean samples
UMT 10.7",
samples 29.4
UMT 4.8'
samples 36. 0.61]
UMT [8.0",
samples 49.5' 0.74
Figure 9; Clean UMT samples from ScanObjeetNN dataset
C.10 Additional Visual Presentations for 3D Point Cloud Samples
We visualize clean point cloud samples and UMT (k: 2 using RS) point cloud samples on four benchmark datasets 1o [50], ModelNet40 [50], ScanObjectNN [41], and ShapeNetPart [4],
21

---

Table 13: The test accuracy (%) results ModelNet10 dataset with boarder range of hype-parametters
Yax Tp. br, by
Ta. To by b
PointNet
PoinICNN
Fox Tg by
DGCNN
PoinICNN
120,
0.8,
24.78
23.35
28.19
25.44
15.
120,
0.15.
134
38.66
40.09
31.10
25. 0.6, 0.8.0.8 0.8
26.65
25.99
20.37
234
15. 120,
016, 0.7
20.59
27.53
23.68
23.93
15.
18.39
22.03
0.6, 0.8
22.25
14.10
21.48
19.28
15, 240,
0.6, 0.8
21.26
30.51
20.70
24.16
120,
0.6, 0.9
23.90
23.90
23.35
23.72
15.
120, 0.6, 1.2
31.50
28.63
36.78
32.30
15. 120,
0.6, 1.0
22.58
26.54
31.61
26.91
Table Ablation modules: The test accuracy (%) results achieved by training on unlearnahle data created by different modules on the ShapeNetPart dataset
Benchmark datasets
Modules,, Models
PointNet
PointNet++
DGCNN
PointCNN
PCT
AVG
Rotation module
53.51
44.05
$7.69
49,48
43.84
49.71
ShapeNetPart [4]
Scaling module
28.74
77.21
37.93
44.02
51.84
47.95
UMTa-2)
15.14
41.16
26.17
32.36
44.05
31.78
Clean samples
UMT s..
samples 14.9",0.62
UMT [6.6..4.77
samples 0..65)
UMT [7.1, 13.3"
samples 97.5
Figure 10: Clean and UMT samples from ShapeNetPart datasct
depicted in Figs. 7 to 10, respectively. The UMT parameters consist of rotation and scaling parameters [o,, 8, 7, A]. It can be observed that these unlearnable samples exhibit similar feature information normal samples, presenting good visual effects and making it difficult be detected as abnormalities.
D Proofs for Theories
D.1 Proof for Lemma 3
Lemma 3. The unlearnable dataset Du generated using UMT on De can also be represented using a GMM, i.e. D, NyTT, y,H, IT..
Proof: Assuming y = 1, then Da N(u, T), and we have
Rx 1z Te Tips
(z (T -2= - (T x TiP)
T (e n)(x -p) p1 TT) T T
-T,IT, T = >1 R2 TI = 2
Similarly, assuming 11, we can obtain
E(z,y)DD_, T- -T
E (xz,y)>D. (T T-1#) TT T = =
Thus have: D., NNTT 1311)
22

---

Table 15: Mixture results: The test accuracy (%) results achieved by training the mixture data consisting of
class-wise UMT samples and sample-wise UMT samples
Mo [50]
PointNet
PointNet++
DGCNN
PoinCCNN
AVG
100% sample-wise data
72.69
79.52
85.79
75.66
78.42
20% class-wisc data, 80% sample-wise data
65.64
69.05
78.19
58.04
67.73
40% class-wise data, 60% sample-wise data
58.04
59.91
60.57
58.59
59.28
60% class-wise dara, 80% sample-wise data
50.11
48.13
60.35
46.48
51.27
80% class-wise data, 20% sample-wise data
31.83
29.19
44.09
50.55
39.02
100% wass data
22.25
28.08
14.10
21.48
21.48
D.2 Proof for Lemma 4
Lemma 4. The Bayes optimal decision boundary for classifying Du is given by P,(x) = Ar 1A2
BT x + = O, where A = x XT 2 +1 1T) and C =In
Proof: At the optimal decision boundary the probabilities of any point æ E Rd belonging to class and -1 modeled by D, are the same. Similar to the optimal decision boundary of the
clean dataset De, we have:
eaple (1 T 110 TAE, 1 -111-1)
V (2
eapl (00 TIm)) (AATT) (1mm)
(2
+ (r T - -T---- [A_,1
= (r -T1/) T 2 ( I
1-- T-
T 11--1)
|22 I
- -"
-
+In
(A_3 11 12
-, T
|
-_ ATT /1 + in
=0
|
|X2 I 1 0
Pu(x) = Ar T x [A
In
= Pr(x) = Ar x + B x CC=
where A - B=
x- T )1, and In |
TXPT Besides, note that if (x)
is less than 0. the category of the Bayesian optimal classification is 11; otherwise, it is 1.
D.3 Proof for Lemma 5
Lemma 5. Let 2 ~ N(O,, - + c, and ||:112 denote 2-norm of vectors. For any t 2 0 and r R, Chernoff bound have:
|161 - t(r + d)
exp
2(1 27)
P(Z 2 E
-1
Proof: Since A is constant, we have:
B /
R(())=JI<
A =0
b
+
23

---

where b B - A. Let Z = ====+b' + 2 ~ .N(0,)) 1) C R.. Thus we have:
c
1 b
1
1 TTb
= ===+bb== 2 +
(=
(z
2) +
2
4
= + 2 b) (2 + 1 b) + c-
1
bTb
2
For any / 2 0 and x ~ (0, I), we write the moment generating function for a quadratic random
variable Y = x x :
1
/
exp { _ (x- u)) (o m)) dr (txTx)
Elexp(t\)]] (2T)d/2
exp
Jnd
exp 1-11 11/2]
2t
(2T)
JRd
exp
2
x
x + 4 x dx
exp { -1 1 n/2} (2
d/2
exp
2(1-25) p 14
(2/r)//2
I 21
exp 1- 11
2
exp 1(1-21) bTb b + t(c - 60
expl 8²
2xp(((1-1) 2(1- b tc}
Blexp(tZ)]
1(1 2)
1(1 21) 1
After that, we employ Chernoff bound, for some y we have:
E[exp([Z)]
P(Z 2 R[Z] + 7) v
cxp + E(Z)]}
,2
+ 1c)
exp
2(1 2(1-2t)
exp(!(>+ + 1|
2] + c)} - 26)
2 211--2) 6 b + tc
2
exp
expl((> + Tr([)
+ E(b 2) c)}l(1 2
e exp 2 211 b b
exp(t(> + d + ()) 2 1
12 exp 2(1-2r) |b
117 -
((1 - -
D.4
Proof for Theorem 6
Theorem 6. For any constant t and to satisfying 0 S t1 and 0 S t2 < }. the accuracy of the unlearnable decision boundary P. on the dataset D. can be upper-bounded as:
b + 2/112 + t t1 + b 4 + })
exp
2(1 26
TD. 5
21 2t, |
Ø1-2( ||b - -2ul13 12(1 T - bT + c + 2d)
13
exp=
2 11
P1 + P2
$140]
24

---

+b+++ Furthermore, if + +b" + c + 0 and - < 0, we have (P. < 1. Moreover. for any μ + 0 transformation matrix T; such that TD. (P.) TD. (P).
We note that if (.(x)) is less than O, the category of the Bayesian optimal classification -1; otherwise, it is 1. Here, yju + 2 where: = (0, I) and y {+1} since (Ir, y) De-
Proof:
TD. (Pw) B[ +bb 0)}
x
P(y(u' T 1 + ====+ 2 2yp + yb + b== 0) 0} = P(y = ())((("' ++= 2yju 2 + yb b+
+ > = - 4 =
+ +2y +b
> 0ly =-1
2 PP( 2 (b+ 2 ==+
n+ 6-666 + 0}
- x p + c 000] (6- 2p) (p- -
+ 2
= pı + P2
We can see that:
1 = E{2 + (bb+
24) 2 aTT - 6 b +cJ
=Tr(f) + 4
+ bT c
72 E3 - 2 (b 24) - 1 p + bT u - c}
-r((( -Tp=pppp + 6T c
Applying Lemma 5, with 71, t = t for the computation of p1, as well as = 72 and = t2 for the computation P2, where t and te are specific non- non-negative constants, we obtain:
exp
2(1 261
17
bbb
2p112
t1 μ + bT a a c
P1
21(1 7|
21, |b - 2n1 12(1 - bJ 1 2d)
exp
P2
21 2t2)
This provides us with the upper bound for Tp. (P.). Nonetheless, to ensure that this upper bound is less than 1, additional conditions need to be affirmed. As 7 and 722 increase, the values of p1 and Pa diminish (p1 > O. P2 > 0), and as " increases, 7/2 decreases (since 7/1 + Y22 = -2b p)) We let
|b+2ull2 equal to a 2 O. p bt μ (also equals to || + c 22 ) equal to 31, resulting 2
in:
dpi
1 d/expl
and 1-26
11411/(1 - 21
df,
2
dh
a.th
exp(
+Biti}
T-2r;
[(1 - (1-2(11) -
2
22n (1 t1)
+ +(1 11-2)) -+/))=((
+ B1)l
(1 22
a.t expl 1-26; + +3141]
20 (1-t())))))
-t1)
+ 31] (1 - 221)2
2(1 211
1 2t1
d
+ 20 1 (1 41)
= =PI( 2t
+ (1)
(1 22
2(23) a )t + 2(a1 - 2,1 - d)t1 + 31 + d
P1
2
25

---

Making [(1- (11-2t) 2t,) meaningful requires satisfying the following condition:
1 > 00000=
We note that (1 = 0) = (1 + 2 = +oc. When we set
dp de,
0, we obtain that:
2(23) - ai |1 2(x1 - 231 d)l, +
31 =
-4 231 on +d+ va 201 B1 + d2
2(281 - -11
of
-7-31 +
+0
d²
+ a?
201 + 01
d?
B1 S
201
2
d²
01
B1
S
201
+
2
min
d
Explanation of the Last Inequality. Assuming we define s(a1) 2an 2 of this function can be obtained using the Arithmetic Mean-Geomen Mean Inequality (AM-GM Inequality), which states that a + b 2 2/ for a, b 2 0. Thus, s(a1) 2 2/ 31 I s(a1), we can infer that B1 I s(a1) )min which means $1 S d.
d' + 21. The minimum value
d2
a1 Since
20: 2
The product of the roots of the equation is: t1it12 2(23 d+
(we assume that t1 < tz2). We let f(4) = 2(23: - a )() + 2(a1 23 - dd) + Thus we have f(0) - d+ 31, f f 2 0.
Situation (i): 31 -d. At this time, f(0) 0, f11t12 0, based the trend of quadratic functions and the distribution of roots, we can infer that 0 < t11 < 1.2 t12 > 1/4 and 23 < 01 Thus we
conclude that there exists &1 such that (t1 = f1) < 2-
Situation (ii): -d 31 0. At this time, f(0) > 0, f1112 < 0, based on the trend of quadratic
functions and the distribution of roots, we also can infer that (11 < O, b1 > 1.2 and 232 < <a Thus we have that 2 1-
Situation (iii): 0 < B1 < d. At this time, f(0) 0, the sign of t11f12 simultancously determines the direction of the opening of the quadratic function f(t)). When f1t412 < 0, t1 < 0, f1 > 1. thus we have 2 1: when 4n 12 > 0, 0 < i1 < 122 < 1. the minimum point of pı is at pt (412). However, it is challenging to compare Pı (f12) and 1 to determine which is greater or smaller.
Similarly for p2, we let |bb22uliž equal to 02 > 0. F1 1 + D - c e-22 2d equal to 82, resulting in:
dp2
2(232 02) 2(
282 (1 212)2
-d)12 82 d P2
dl2
Thus we have the similar situation, i.e., 32 < dd. At this time, f(0) < O, 121 > 0, based on the trend of quadratic functions and the distribution of roots, we can infer that 0 < l21 < 2. 122 3 and 282- < dzg- Thus conclude that there exists tu such that p2( =21) <
Taking into account the above situations, have that: when Bi < <d, B2 -d (i.e., n + bt μ c + d < 0 and = + b μ - c < 0), there exists tn and t2 respectively, making P1 <
P2 1 i.e. P1 + P2
where f1 = d- aa a/
-20
d /ag 200 32 dd
2(281-01)
2(23g (223--aa) 02)
We know that for μ + 0, TD. (P) x(x) > 2.2 Therefore, we need to introduce additional conditions to further ensure that p1 1 and p2 < 1, and consequently TD. (P.) P1 + P2 < (P).
26

---

The bold values represent To let P1 satisfy p1 < 1 (a1 > 0, $1 < -d, and 0 S f < 2)) that is,
0nl
- 2/1) (1-2(1)
exp( 1 - 21
+ 1111
2
0
d
+ 81t1
<
In(1 - -2f1) In2
- 2t1
2
att
+ 8161
1n(1 - 211) < -In2 -0.693
- 21
1-27 + - gln(1 - 21). Let assume 01 = 1/2 and d for 3D point cloud data, then 81 < 3. Upon analyzing the function g(t), we observe that as B1 decreases, the minimum value of (t) also decreases. We utilize various 31 values and their corresponding function
We assume that g() 2²
value to provide more intuitive understanding shown in Tab. 16.
Table 16:
Different values and corresponding g(t) with 0.3 and 0.4. cases where Pı < satisfied.
8 (0.3)
-4
-6
-8
-10
-12
-14
0.287
-0.313
-0.913
-1.513
-2.113
-2.713
g0.4)
1.214
0.414
-0.386
-1.186
-1.986
-2.786
As for p2, since a2 # 01 we need to reselect appropriate values to demonstrate the existence of
p2 1. Similarly, let p2 satisfy p2 1/4 (a2 0. B2 -d, and t2 {) that is,
0:22
(1 (1-2
exp
B2t2]
21z
2
a2t2
d
+ B2tz
In(1 - -2t2) -ln2 -0.693
21
We assume that h(t) = a=t²
1-2: + Bat 1n 2f). Let us assume 0: 1/ and = 3, similarly,
3
we utilize various 32 values and their corresponding function value to provide a more intuitive understanding as shown in Tab. 17.
Table 17:
Different values and corresponding h(t) with 0.3 and 0.4. cases where p2 < satisfied.
The bold values represent
B2
-4
-6
-8
-10
-12
-14
h(0.3)
0.249
-0.351
-0,951
-1.551
-2.151
-2.751 -2.919
h(0.4)
1.081
0.281
-0.519
-1.319
-2.119
Therefore, we conclude that there exist a B1, t such that P1 < 4. 0/2, 82, t2 such that P2 < 4. ie., +p2 < } At the same time, we observe that smaller value of B makes it casier to satisfy the above conditions, i.e., the more negative 31 and 33 are, the more likely is satisfy the above conditions.
-T
We formally combine and assert these conditions as, b μ < i.e., μ
- / < (we sufficiently support this condition in the empirical results from Tabs. 16 and 17). Thus we conclude for any μ * 0 transformation parameters T; such that TD. (P.) < (P).
27

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
The abstract and introduction accurately reflect the scope of the contributions made the paper regarding the first proposed unlearnable scheme UMT and the data restoration scheme, as well as the theoretical and experimental evaluations.
Justification:
2. Limitations
Question:
Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification: The paper discussed the limitations of the work in Sec. 6.
3. Theory Assumptions and Proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof?
Answer: [Yes]
Justification: The paper clearly and accurately provides the assumptions and proofs for each theory.
4. Experimental Result Reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results the paper to the extent that affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Answer: [es]]
Justification: The formulas in the methods section, the schematic diagrams of the schemes, Algorithm 1, as well as the details of the training process and descriptions of the datasets and models together support the reproducibility of the experimental results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described supplemental material?
Answer: [Yes]
Justification:
The paper has open-sourced code, which are sufficient to reproduce the experimental results.
6. Experimental Setting/Details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: The paper provides sufficient training and testing details, which are adequate for understanding the experimental results.
7. Experiment Statistical Significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer: [Yes]
Justification: The paper conducted experiments with three different random seeds, studying the results in terms of statistical significance.
8. Experiments Compute Resources
28

---

For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed reproduce the experiments?
Question:
Answer: [Yes]
Justification: The paper clearly specifies the parameters of the server used for the experiment and the code execution environment.
9. Code Of Ethics
Question: Does the research conducted the paper conform, in every respect, with the NeurlPS Code of Ethics https: httrr//eurppppp wwtppbblcc/tttciccccccc caGuidel inne?
Answer: [Yes]
Justification: After thorough review of the paper, no violations of the NeurIPS Code of Ethics are found.
10. Broader Impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification: The paper discuss both potential positive societal impacts and negative societal impacts of the work Sec. 6.
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)? Answer: [Yes]
Question:
Justification: The paper described safeguards that have been put in place for responsible release of data in Sec. 6.
12. Licenses for existing assets
Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper. properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification: The data used in the paper are properly credited, and the license and terms of use are explicitly mentioned and properly respected.
13. New Assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Justification: The paper does not release new assets.
14. Crowdsourcing and Research with Human Subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification: The paper does not involve crowdsourcing research with human subjects. 15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human
Subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification:
The paper does not involve crowdsourcing research with human subjects.
29


Reviews:
[{"review_id": "9UIMoRS2Kw", "reviewer": "Reviewer_upBr", "summary": "The paper introduces a novel approach called Unlearnable Multi-Transformations (UMT) to make 3D point cloud data unlearnable by unauthorized users. This method employs a category-adaptive allocation strategy to apply class-wise transformations, thereby preventing unauthorized training on the data. Additionally, the authors propose a data restoration scheme that allows authorized users to learn from the unlearnable data effectively. The effectiveness of UMT is validated through theoretical analysis and extensive experiments on multiple datasets and models, demonstrating its potential in protecting sensitive 3D point cloud data from unauthorized exploitation while enabling authorized access.", "questions": "See the weakness", "limitations": "Yes, the authors mention some limitations of the proposed method, such as its vulnerability to rotation and scale transformations. However, they also note that other types of transformations are not easily compromised in the current context.", "rating": 7, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "+ A novel unlearnable scheme specifically designed for 3D point cloud data is proposed, and it addresses the issue of enabling authorized users to utilize the protected data effectively.\n+ The proposed method seems reasonable, and it has been theoretically demonstrated that the classification accuracy is lower than that of the clean dataset under the Bayes classifier's decision boundary in the Gaussian Mixture Model.\n+ Extensive experiments on three synthetic and three real-world datasets, using 16 widely adopted point cloud model architectures for classification and semantic segmentation tasks, verify the superiority of the proposed method.", "weaknesses": "- Are object categories sensitive to the combination of transformations? For instance, are there categories where using two different sets of transformations results in significant differences in outcomes? I'm not sure if I've missed something or not, but conducting multiple experiments to observe performance and its variance might be a more reasonable approach.\n- It's still not very clear how the point cloud segmentation experiments were conducted. Each object category would be in different regions of the point cloud, so would transformations be applied to the corresponding regions based on the GT? If so, would these transformations and the subsequent inverse transformations affect the segmentation results for authorized users?", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "> **Q1:** Are object categories sensitive to the combination of transformations? \n\n**Re:** Thank you for your thoughtful and valuable comment. In the original paper's Table 7, we have examined the effect of various combinations of transformations on the final performance. It can be seen that employing only rigid transformations like $\\mathcal{R}$, $\\mathcal{S}$, and $\\mathcal{R}\\mathcal{S}$ yields better results compared to using solely non-rigid transformations such as $\\mathcal{H}$, $\\mathcal{W}$, and $\\mathcal{H}\\mathcal{W}$. Nevertheless, regardless of the combination used, the final accuracy is significantly lower than the clean baseline, demonstrating excellent UMT effectiveness.\n\nFollowing your advice, we carried out further experiments with different random seeds (seed=2023,1023,23), and the outcomes are displayed in the Table R1 below. From the results, it can be observed that when k=2, the average performance across different combinations are not significantly different, all exhibiting good unlearnable effects of UMT. Additionally, the combination of only rigid transformations $\\mathcal{R}\\mathcal{S}$ outperforms that using only non-rigid transformations $\\mathcal{H}\\mathcal{W}$, with mixed combinations of both types of transformations yielding intermediate results, which aligns with the findings previously discussed and presented in Table 7. Thank you once again for your valuable advice. We will include a discussion section in our experiments to explore this intriguing phenomenon.\n\n\n\n**Table R1:** Average test accuracy (%) results (from three runs with random seeds 23, 1023, 2023) using diverse combinations of transformation for UMT.\n\n|        ModelNet10         |   PointNet    |  PointNet++   |     DGCNN     |   PointCNN    |      AVG      |\n| :-----------------------: | :-----------: | :-----------: | :-----------: | :-----------: | :-----------: |\n| $\\mathcal{R} \\mathcal{S}$ | 15.12 ± 6.20  | 26.62 ± 5.11  | 25.22 ± 10.20 | 17.26 ± 3.68  | 21.05 ± 0.73  |\n| $\\mathcal{R} \\mathcal{H}$ | 33.70 ± 11.09 | 30.65 ± 17.12 | 36.67 ± 15.64 | 34.99 ± 13.48 | 34.00 ± 13.66 |\n| $\\mathcal{R} \\mathcal{W}$ | 39.83 ± 6.71  | 30.18 ± 12.22 | 36.71 ± 8.10  | 43.47 ± 9.20  | 37.55 ± 5.07  |\n| $\\mathcal{S} \\mathcal{H}$ | 21.22 ± 0.84  | 46.15 ± 8.82  | 31.87 ± 6.52  | 30.87 ± 10.94 | 32.53 ± 4.81  |\n| $\\mathcal{S} \\mathcal{W}$ | 23.50 ± 6.08  | 51.28 ± 6.69  | 38.33 ± 6.10  | 28.27 ± 5.25  | 35.34 ± 2.88  |\n| $\\mathcal{H} \\mathcal{W}$ | 54.41 ± 7.99  | 54.22 ± 14.34 | 55.14 ± 9.42  | 57.75 ± 6.09  | 55.38 ± 6.98  |\n\n\n\n> **Q2:** How the point cloud segmentation experiments were conducted? \n\n**Re:** We appreciate your valuable comments regarding this issue. Yes, you are correct. In the semantic segmentation scenario, we use class-wise transformations based on the ground-truth labels of the corresponding regions. We will clarify this process in Sec. 3.3.1 (methodology part) and Sec. 4.2 (experimental part) in the updated version.\n\n \n\n> **Q3:** Would the transformations and the subsequent inverse transformations affect the segmentation results for authorized users?\n\n**Re:** We appreciate your pointing out this concern. The transformations and the subsequent inverse transformations do not negatively affect the final segmentation results for authorized users. After applying UMT and then adding the inverse transformation of the restoration scheme, the experimental results are shown in the Table R2 below (each result is the average of three runs to ensure reliability). It can be seen that the final results after applying UMT + Restoration scheme are marginally above the clean baseline results. The UMT+data restoration scheme did not affect the final segmentation results because the data restoration scheme is designed to break UMT's class-wise transformation patterns through class-wise inverse transformations of reversible matrices. The original matrix's effect is neutralized when the class-wise reversible matrix is multiplied by the corresponding class-wise inverse matrix, thus eliminating the unlearnable effects of UMT, allowing authorized users' point cloud DNNs to learn the features of samples, thereby achieving standard segmentation performance. This principle is consistent with its effectiveness in classification tasks.\n\n**Table R2: Semantic segmentation.** Test accuracy (%) and mIoU (%) results using standard training and UMT+data restoration scheme.\n\n|     Test accuracy  (%)     |    PointNet++    |   Point Transformer v3   |      SegNN       |       AVG        |\n| :------------------------: | :--------------: | :----------------------: | :--------------: | :--------------: |\n|       Clean baseline       |      74.76       |          74.72           |      79.00       |      76.16       |\n| **UMT+Restoration scheme** | **80.23 ± 2.42** |     **76.86 ± 1.29**     | **80.14 ± 0.31** | **79.08 ± 1.23** |\n|        **mIoU (%)**        |  **PointNet++**  | **Point Transformer v3** |    **SegNN**     |     **AVG**      |\n|       Clean baseline       |      40.06       |          40.57           |      50.27       |      43.63       |\n| **UMT+Restoration scheme** | **48.61 ± 3.24** |     **43.28 ± 1.35**     | **50.37 ± 0.06** | **47.42 ± 1.43** |", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "bbAqQIqYR9", "reviewer": "Reviewer_BhZK", "summary": "After reading the author’s response, I would like to increase my evaluation to borderline accept.\n\n—\n\nThis paper addresses a critical issue by extending unlearnable strategies to 3D point cloud data, introducing the Unlearnable Multi-Transformations (UMT) approach. The use of a category-adaptive allocation strategy and multiple transformations is innovative and well-conceived. Notably, the paper highlights a gap in existing literature by acknowledging the challenges even authorized users face in learning from unlearnable data, proposing a data restoration scheme to address this. The theoretical and empirical validation across six datasets, sixteen models, and two tasks convincingly demonstrates the framework's effectiveness.", "questions": "1. The title of this paper is somewhat overclaimed or exaggerated. It is not related to the research topic of this work, which is also less informative.\n2. In the introduction, the paper analyzes three issues and challenges of the research problem. However, there is no intuition about why the proposed method can handle the issues and challenges. There are just some technical details. Could the paper supplement more intuitions for a better understanding of reviewers?\n3. In the introduction, there is an understanding gap between the method descriptions and theoretical analysis. Some definitions such as the decision boundary of the Bayes classifier in the Gaussian Mixture Model, are very strange, and cannot describe the work principle of the proposed method.\n4. For the data protector and authorized user, do we need to add some noise to implement them with the minimax optimization? More details are needed. Besides, are they mutually reversible in practice?\n5. For Eq. (3), is there some evidence about the choice of $\\mathcal{A}_N$?\n6. As for Property 2, why do we need all four transformation matrices we employ and the multiplicative combinations of any of these matrices are all invertible matrices? I can understand the theoretical analysis. However, it seems that this does not work for the main conclusion of this paper.\n7. Similarly, the bounds in Lemma 5 and Theorem 6 are very loose. With them, it is hard to believe the proposed method can work well (although the experimental results are good). More discussions are needed.\n8. The proof of Lemma 3 is simple since the space of $y$ is limited to 2. When the components of GMMs are more than 2, will the claim still hold? Could the paper add some discussions about this?\n9. From Line 782 to Line 783, could the paper supplement some details to describe why the last line of inequalities holds?\n10. For Line 811, the paper assumes that $\\alpha_2=\\frac{1}{3}$ and $d=3$. Will the assumption make the theory less general? More discussions are also needed.", "limitations": "N/A", "rating": 5, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 2, "strengths": "1. This paper studies an interesting and important problem. The problem is realistic but not widely explored.\n2. The experiments of this work are comprehensive, which is admirable.", "weaknesses": "1. The presentation and writing need to be polished to reach the acceptance bar. For the current form, there are a series of unclear descriptions and explanations.\n2. The theoretical contributions are overall weak, which provides limited insights to the research community. Besides, some theoretical analysis needs to be justified.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Due to space limitation, we have divided our response into three parts (including one rebuttal part and two official comments). Thank you for your understanding.\n\n\n\n#### **Response to Reviewer BhZK [1/3]**\n\n> **Q1:** The title is exaggerated, less informative, and not related to the research topic.\n\n**Re:** Thank you for pointing out that the original title may have appeared exaggerated and less informative. We agree with your assessment and have decided to revise the title to: \"Unlearnable 3D Point Clouds: Class-wise Transformation Is All You Need\". This new title is intended to better convey the specific nature of our research.\n\n\n\n> **Q2:** There is no intuition about why the proposed method can handle the challenges.\n\n**Re:** Thank you for pointing out the need for a clearer intuition behind our proposed method. We appreciate your feedback and would like to provide additional context to address this concern. In the introduction, we identified three main challenges: (i) Incompatibility with 3D data; (ii) Poor visual quality; (iii) Expensive time expenditure. Our intuition is that 3D transformations are custom-designed for handling 3D point cloud data (solving Challenge 1). Many of these transformations, like rotation and scaling, only alter the geometric shape without impacting visual presentation (solving Challenge 2). They are achieved through matrix operations, which are computationally linear and thus less costly than methods involving complex model optimization (solving Challenge 3). In the revised version, we will include the intuition between Line 43 and Line 44 to facilitate better understanding for the readers.\n\n\n\n> **Q3:** Some definitions such as the decision boundary of the Bayes classifier in the Gaussian Mixture Model cannot describe the work principle of the proposed method.\n\n**Re:** Thank you for your insightful review. We acknowledge that our Introduction section lacks sufficient connection and explanation between the theoretical analysis and the proposed approach, and we apologize for any understanding gap this may have caused. Here is our explanation: \n\n> To theoretically analyze UMT, we define a binary classification setup similar to that used in [1-3]. Meanwhile, we employ a Gaussian Mixture Model (GMM) to model the clean training set and use the Bayesian optimal decision boundary to model the point cloud classifier. Theoretically, we prove that the UMT training set also follows a GMM distribution and indicate the existence of that the classification accuracy of UMT dataset to be lower than that of the clean dataset in a Bayesian classifier, verifying that the proposed UMT scheme can be effective.\n\nWe will insert this explanation between Lines 50 and 51 to bridge the understanding gap. We sincerely thank you once again for your valuable suggestions, which will significantly improve the quality of our paper!\n\n[1] *CUDA: Convolution-based unlearnable datasets*. CVPR'23\n\n[2] *Precise statistical analysis of classification accuracies for adversarial training.* The Annals of Statistics'22\n\n[3] *The curious case of adversarially robust models: More data can help, double descend, or hurt generalization.* Uncertainty in Artificial Intelligence'21\n\n\n\n> **Q4:** Do we need to add some noise to implement them with the minimax optimization?\n\n**Re:** Thank you for bringing this matter to our attention. We do not need to add noise for the minimax optimization. Here are our explanations: Solving the optimization problem in Eq. (1) directly is infeasible for neural networks because it necessitates unrolling the entire training procedure within the inner objective and performing backpropagation through it to execute a single step of gradient descent on the outer objective [1].  Therefore, existing unlearnable schemes to address this optimization process are generally divided into two strategies: *model-dependent noise-based optimization* [1, 2] and *model-agnostic shortcut-based operations* [3, 4]. Due to the increased computational complexity of noise-based optimization schemes for more complex point cloud data and the impact of irregular noise on sample quality, we opted for the model-agnostic shortcut-based scheme. This kind of approach usually does not involve the optimization process; however, it is necessary to activate DNN shortcuts to achieve the outcome specified in Eq. (1), like our proposed class-wise 3D transformations. The reason why our proposed model-agnostic operation can ultimately satisfy Eq. (1) is explained in Sec. 3.2 (iii). We will include a more detailed explanation of how we implement Eq. (1) at Line 89 in the revised version.\n\n[1] *Adversarial examples make strong poisons*. NeurIPS'21\n\n[2] *Unlearnable examples: Making personal data unexploitable.* ICLR'21\n\n[3] *Availability attacks create shortcuts.* KDD'22\n\n[4] *CUDA: Convolution-based unlearnable datasets*. CVPR'23\n\n \n\n \n\n> **Q5:** Are the data protector and authorized user mutually reversible in practice?\n\n**Re:** Thank you for bringing this matter to light. In practice, the optimization process between data protectors and authorized users does not necessarily need to be mutually reversible. It only requires that after the data protector releases the unlearnable data, the authorized user can use a certain method to train normally on the unlearnable data. Our proposed reversible class-wise transformation approach is just one way to achieve this goal. There are also studies that use irreversible methods to achieve this goal [1]. This paper is currently the only other work besides ours that considers authorized user access in the context of unlearnable examples. It proposes a tailored network for authorized users to learn from unlearnable image data, but this process does not involve reversible unlearnable noise. We will add more explanation about authorized users after Line 93 in the revised version.\n\n[1] *Ungeneralizable examples* CVPR'24", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "yTugCCc0L6", "reviewer": "Reviewer_Yqki", "summary": "This paper studies the protection scheme against unauthorized learning on 3D point cloud data. A simple class-wise transformation method is designed to mislead the model to learn the transformation patterns of points instead of categorical knowledge. The method is evaluated on popular used 3D datasets and models.", "questions": "- The title \"Class-wise Transformation Is All You Need\" is quite general, which may not be helpful for readers to understand the topic studied in the paper. I was a bit confused when I first read the title along with the abstract. \n\n\nOverall, this paper studies a new problem and proposes a simple approach against unauthorized learning on 3D point cloud data.  Extensive experiments and analyses are provided to evaluate the method. However, I still have concerns about the value of the settings considered in the paper and the robustness of the proposed method. I am not an expert on the topic (safety in machine learning), thus I would like to rate this paper as borderline and wait for further discussions.", "limitations": "The limitations and broader impacts of the method have been discussed in Section 6.", "rating": 5, "confidence": 2, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "- This paper studies a new problem and presents a reasonable and simple method to tackle the problem.\n\n- Extensive experiments are conducted. I appreciate the comprehensive ablation studies and analyses provided in the paper.", "weaknesses": "- I am concerned about the value of the settings studied in the paper. Most classification datasets considered in the paper are used to develop 3D modeling algorithms and are usually far from real-world 3D/point cloud applications that require high safety standards like 3D face recognition and scene-level point clouds for autonomous driving. These scenarios usually have much more categories (e.g., facial ids) or cannot be modeled as a classification problem (e.g., scene understanding for autonomous driving). Can the proposed method be easy to transfer to these settings? \n\n- How about the results if we randomly apply R, S, W, H when we train the model? Such strong data augmentation may lead to lower classification accuracy but the model may achieve >30% test accuracy on the UMT datasets.\n\n- Rotation/scale/SE(3) equivariant 3D modeling has been extensively studied in previous work [r1-r4].  Will the proposed method fail if we use these models for 3D modeling?\n\n[r1] SE(3)-Transformers: 3D Roto-Translation Equivariant Attention Networks, NeurIPS 2020\n\n[r2] Vector neurons: A general framework for so (3)-equivariant networks, ICCV 2021\n\n[r3] E2PN: Efficient SE(3)-Equivariant Point Network, CVPR 2023\n\n[r4] Scale-Equivariant Deep Learning for 3D Data", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "**Response to Reviewer Yqki [1/3]**\n\nDue to space limitation, we have divided our response into three parts. Thank you for your understanding.\n\n\n\n> **Q1:** Scene understanding for autonomous driving need to be considered.\n\n**Re:** We appreciate your thoughtful and constructive feedback and strongly agree with your point about conducting experiments in more practical scenarios. We present the UMT performance on semantic segmentation task using semantic scene understanding dataset SemanticKITTI [1] in the Table R3 below. It can be observed that UMT is still effective. \n\n**Table R3:** Evaluation of UMT on semantic segmentation task using semantic scene understanding dataset SemanticKITTI [1].\n\n|      Metrics       | Eval accuracy (%) |  Eval accuracy (%)   |  mIoU (%)  |       mIoU (%)       |\n| :----------------: | :---------------: | :------------------: | :--------: | :------------------: |\n| **Semantic KITTI** |    PointNet++     | Point Transformer V2 | PointNet++ | Point Transformer V2 |\n|   Clean baseline   |       29.89       |        72.92         |   14.16    |        54.78         |\n|   **UMT (k=2)**    |     **4.69**      |      **19.40**       |  **0.80**  |      **13.39**       |\n\nFurthermore, in our original paper, we performed classification tasks on real-world datasets, such as the autonomous driving dataset KITTI and the indoor dataset ScanObjectNN (Table 1). We also performed semantic segmentation tasks of scene understanding on the indoor dataset S3DIS (Table 3). These experimental results demonstrate the effectiveness of UMT and reflect its efficacy across different tasks in real-world datasets. The key reason UMT is effective for compromising deep learning tasks across different scenarios is that it creates an erroneous mapping between the class-wise transformation shortcuts and the ground-truth labels after applying UMT to the training data. This results in a significant drop in the model's generalization performance on clean test data without any transformation shortcut (a more detailed explanation with data support can be found in Lines 125-134 of the original paper). We will add the results of SemanticKITTI in our revised paper based on your insightful suggestions.\n\n[1] *SemanticKITTI: A dataset for semantic scene understanding of LiDAR sequences.* ICCV'19\n\n\n\n\n\n\n\n> **Q2:** How about the results if we randomly apply R, S, W, H when we train the model?\n\n**Re:** We appreciate your pointing out this concern. We fully agree with your point that random data augmentation might degrade the performance of UMT. In fact, we have already reported the experimental results of using random $\\mathcal{R}  \\mathcal{S}$ for UMT(\\mathcal{R}\\mathcal{S}) in Table 2 of the original manuscript. It can be seen that after data augmentation, the test accuracy indeed increased, indicating a decrease in UMT performance. However, we also observed that the final average accuracy is still 28.67% lower than the clean baseline, demonstrating that UMT still exhibits certain robustness (as discussed in Lines 238-249). To further explore this valuable insight you provided, we supplement the experimental results using four types of random augmentations according to your suggestion in the table below, and find that the conclusion is consistent with our manuscript.\n\n\n\n**Table R4:** Test accuracy (%) results using UMT training data and UMT+random augmentation training data.\n\n|                          ModelNet10                          | PointNet | PointNet++ | DGCNN | PointCNN |  AVG  |\n| :----------------------------------------------------------: | :------: | :--------: | :---: | :------: | :---: |\n|                        Clean baseline                        |  89.32   |   92.95    | 92.73 |  89.54   | 91.14 |\n|                           UMT(k=4)                           |  16.19   |   36.56    | 17.62 |  27.42   | 24.45 |\n| UMT(k=4) + random $\\mathcal{R}\\mathcal{S}\\mathcal{H}\\mathcal{W}$ |  25.99   |   61.78    | 61.89 |  44.16   | 48.46 |\n\n\n\nWhile we acknowledge that these random augmentations offer some defense against UMT, and even achieve an accuracy exceeding 30%, we still believe that this cannot be considered a qualified defense. According to the prevailing view in the current literature on defenses against unlearnable attacks [1-4], a defense is only considered successful if the accuracy after the defense reaches or exceeds the level of the clean baseline. As stated earlier, random augmentations have not yet achieved this, so UMT remains robust at present.\n\n[1] *What can we learn from unlearnable datasets?*  NeurIPS'23\n\n[2] *Image shortcut squeezing: Countering perturbative availability poisons with compression.* ICML'23\n\n[3] *ECLIPSE: Expunging clean-label indiscriminate poisons via sparse diffusion purification.* ESORICS'24\n\n[4] *Purify unlearnable examples via rate-constrained variational auto-encoders.* ICML'24", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "fl7Zji7b4m", "reviewer": "Reviewer_nf2f", "summary": "The paper introduces UMT (Unlearnable Multi-Transformations), the first approach designed to render 3D point cloud data unlearnable for unauthorized deep learning models, by applying class-wise transformations. It also presents a data restoration scheme to enable authorized users to effectively train on the unlearnable data. Theoretical analysis and extensive experiments on various datasets and models demonstrate the effectiveness of UMT in safeguarding sensitive 3D data while allowing authorized access for legitimate training purposes. The main contributions include the proposal of the first 3D unlearnable scheme, a novel data restoration approach, theoretical insights into the unlearnability mechanism, and empirical validation of UMT's superiority.", "questions": "The questions have been listed in the Weaknesses. Please check the weaknesses.", "limitations": "The authors have discussed the limitations and Broader Impacts in the last section.", "rating": 5, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "1. The paper is clearly written, making complex concepts easy to understand.\n2. Simple and Effective Unlearnable Scheme: The paper proposes a straightforward unlearnable scheme that leverages the characteristics of 3D data. By combining four types of 3D transformations, it effectively protects 3D point clouds data. Additionally, it allows authorized users to restore the transformed dataset using inverse transformations.\n3. The extensive experiments conducted in the paper demonstrate the effectiveness of the proposed method. The UMT dataset successfully prevents unauthorized users from achieving high performance on the target test set, thereby protecting the data.\n4. The method provides theoretical proof, which enhances the credibility and robustness of the approach.", "weaknesses": "1.\tThe experiments do not investigate the impact on UMT dataset performance when mixed with other datasets. Currently, transformations are applied to the entire training set, altering the distribution between the UMT training and test sets. If only part of the training set is UMT data, can the performance on the UMT test set still be maintained?\n2.\tThe experiments rely on randomness. Are the results averaged over multiple runs to ensure reliability? While the appendix provides experiments with different random seeds, it does not show the variance of results in other experiments.\n3.\tThe proposed transformation patterns, such as rotation and scaling, are easily detectable by comparing the UMT training set and test set. This predictability might allow unauthorized models to adapt to these transformations, potentially compromising the method's effectiveness.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "> **Q1:** If only part of the training set is UMT data, can the performance still be maintained?\n\n**Re:** We are thankful for your feedback on this matter. To provide a response to this concern, we performed experiments to evaluate the impact of two UMT schemes on final test accuracy using five different UMT proportions (20%, 40%, 60%, 80%, 100%). The results are presented in Table 1 of the attached PDF. \n\nFrom the results, we conclude that if only part of the training set is UMT data, the test accuracy will improve, which weakens the data protector's unlearnable performance. This is because the model can only learn incorrect shortcut information from the portion of data with UMT applied, while it can learn the true knowledge from the clean data without UMT. This allows the model to achieve a certain degree of generalization on the test set. Therefore, the higher the proportion of UMT data, the better the protection effect.\n\nWe appreciate the reviewer’s concern regarding the significance of different UMT data proportions. Therefore, in the revised version, we will add a section in the experimental part to discuss the effects of varying UMT data proportions.\n\n\n\n\n\n\n\n\n\n> **Q2:** Are the results averaged over multiple runs to ensure reliability?\n\n**Re:** We are deeply grateful for this valuable comment you have shared. We fully agree with the reviewer’s suggestion to perform multiple runs and average the results to improve reliability. In the main experiments presented in the paper, each result was obtained from a single run with the random seed set to 2023. To address your concerns, we conduct additional experiments on the KITTI and ScanObjectNN datasets using two more random seeds (23 and 1023). The average results with standard deviations from three runs are provided in the Table 2 and Table 3 of the attached PDF. It can be seen that UMT continues to demonstrate excellent performance. Due to space limitation, we will include the average results on remaining benchmark datasets in the revised paper. \n\n\n\n> **Q3:** Transformation patterns are easily detectable by comparing the UMT training set and test set. This predictability might allow unauthorized models to adapt to these transformations.\n\n**Re:** We greatly appreciate this valuable insight you have provided. We agree with the reviewer’s perspective that obvious transformation patterns, such as rotation and scaling, could allow unauthorized users to detect anomalies. To address this issue, our proposed *Category-Adaptive Allocation Strategy* restricts the extent of transformations to avoid excessive changes. For rotation, we limit  $\\alpha$ and $\\beta$ to a small range. Similarly, for scaling, shear, and twisting, we restrict the parameters controlling the transformation extent within a lower and upper bound that can be predefined by the data protector (In the revised version, we will provide a more detailed explanation of these settings and their significance). Furthermore, even if unauthorized users detect that the training data have been transformed, these UMT data may be perceived as regular augmented data because standard training procedures often use common transformations (e.g., rotation, scaling) to serve as data augmentation techniques to enhance model generalization. \n\nMoreover, let us assume that unauthorized users are aware of the UMT transformations and have designed adaptive attacks (as the reviewer has expressed concern). This situation is considered in Lines 245-249, where we discuss using random transformations as an adaptive attack against UMT, and the experimental results are presented in Table 2 (main text). The results in the last row of Table 2 demonstrate that although the effectiveness of the UMT is somewhat diminished, it still maintains a certain degree of robustness, with the test accuracy remaining 28.67% lower than the clean baseline.\n\nAs for unauthorized models using networks that are invariant to these transformations for adaptive attacks, we conducted experiments with RIConv++ (a rotation-invariant network) and 3DGCN (a scale-invariant network) in Table 1, showing that these networks can successfully neutralize the effects of the transformations. We totally agree with the reviewer and acknowledge that future networks, designed to be invariant to all these types of transformations, might overcome our UMT. However, as we discuss in Section 6 (Lines 322-327), networks invariant to non-rigid transformations like twisting and shear have not yet been developed. Thus, our research calls for the creation of more transformation-invariant networks, which is also a key contribution of our work.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:
## **Global Response**

We express our heartfelt thanks to all the reviewers for their valuable time and are encouraged that they found the paper to be:

1. **Clearly written, making complex concepts easy to understand** *(nf2f)*.
2. The studied problem is **interesting** *(BhZK)*, **important** *(BhZK)*, **realistic** *(BhZK)*, and **new** *(Yqki)*.
3. The proposed scheme is **novel** *(upBr)*, **reasonable** *(upBr, Yqki)*, **simple** *(Yqki, nf2f)*, and **effective** *(nf2f)*.
4. **Theoretical proofs** enhance the **reasonableness** *(upBr)*, **credibility** *(nf2f)*, and **robustness** *(nf2f)* of the scheme.
5. **Extensive experiments** verify the effectiveness of the proposed method *(upBr, BhZK, Yqki, nf2f)*.

We have answered the reviewers' concerns and questions in response to their official reviews and are open to discussing any additional issues that may arise. We would greatly appreciate any further feedback on our detailed rebuttal. Due to the space limitation of each rebuttal, we include tables of some experimental results addressing your concerns in the **attached PDF file**.

Meta-review: This paper was reviewed by four experts in the field. The recommendations are (Accept, Borderline Accept x 3). Based on the reviewers' feedback, the decision is to recommend the acceptance of the paper. The reviewers did raise some valuable concerns (especially the **overclaimed and exaggerated** paper title by Reviewers BhZK and Yqki, missed detailed and convincing experimental evaluations by Reviewers Yqki and nf2f) that should be addressed in the final camera-ready version of the paper. The authors are encouraged to make the necessary changes to the best of their ability.
Decision: Accept (poster)