Improving Robustness of 3D Point Cloud Recognition from a Fourier Perspective
Authors: Yibo Miao
Yinpeng Dong
Jinlai Zhang
Lijia Yu
Xiao Yang
Xiao-Shan Gao
Venue: NeurIPS 2024 poster (2024)
Keywords: 3D point cloud recognition
corruption robustness
Frequency Adversarial Training
Primary area: safety_in_machine_learning
TL;DR: We propose Frequency Adversarial Training (FAT), a novel method to improve corruption robustness of 3D point cloud recognition, which achieves the state-of-the-art results.

Abstract: Although 3D point cloud recognition has achieved substantial progress on standard benchmarks, the typical models are vulnerable to point cloud corruptions, leading to security threats in real-world applications. To improve the corruption robustness, various data augmentation methods have been studied, but they are mainly limited to the spatial domain. As the point cloud has low information density and significant spatial redundancy, it is challenging to analyze the effects of corruptions. In this paper, we focus on the frequency domain to observe the underlying structure of point clouds and their corruptions. Through graph Fourier transform (GFT), we observe a correlation between the corruption robustness of point cloud recognition models and their sensitivity to different frequency bands, which is measured by the GFT spectrum of the model’s Jacobian matrix. To reduce the sensitivity and improve the corruption robustness, we propose Frequency Adversarial Training (FAT) that adopts frequency-domain adversarial examples as data augmentation to train robust point cloud recognition models against corruptions. Theoretically, we provide a guarantee of FAT on its out-of-distribution generalization performance. Empirically, we conduct extensive experiments with various network architectures to validate the effectiveness of FAT, which achieves the new state-of-the-art results.

Improving Robustness of 3D Point Cloud Recognition from a Fourier Perspective
Yibo Miao 1,2 Yinpeng Dongă.6t, JJilai Zhang", Lijia Yu", Xiao Yang', Xiao-Shan Gao -.2
KLMM, Academy of Mathematics and Systems Science,
Chinese Academy of Sciences, Beijing 100190, China
University of Chinese Academy of Sciences, Beijing 100049, China Tsinghua University, Beijing 100084, China
Changsha University of Science and Technology, Changsha 410114, China Institute of Software, Chinese Academy of Sciences, Beijing 100190, China RealAl miaoyibo@amss ac. cn, dongyinpeng@tsinnn
edu. en, xgao@mmrc. iesiisss.... ac.
Abstract
Although 3D point cloud recognition has achieved substantial progress standard benchmarks, the typical models are vulnerable to point cloud corruptions, leading security threats in real-world applications. To improve the corruption robustness, various data augmentation methods have been studied, but they are mainly limited to the spatial domain. As the point cloud has low information density and signifi- cant spatial redundancy, it is challenging to analyze the effects of corruptions. In this paper, focus the frequency domain to observe the underlying structure of point clouds and their corruptions. Through graph Fourier transform (GFT), we observe correlation between the corruption robustness of point cloud recognition models and their sensitivity to different frequency bands, which is measured by the GFT spectrum of the model's 's Jacobian matrix. To reduce the sensitivity and improve the corruption robustness, we propose Frequency Adversarial Training (FAT) that adopts frequency-dou -oomnnn adversarial examples as data augmentation train robust point cloud recognition models against corruptions. Theoretically, we provide guarantee of FAT on its -ut-of-distribution generalization performance. Empirically, we conducted extensive experiments with various network architec- tures to validate the effectiveness of FAT, which achieves the new state-of-the-art results.
Introduction
3D point cloud recognition based on deep neural networks (DNNs) [35, 36, 65] has achieved unprece- dented performance on typical benchmarks [5, 67], which assume that the data are independently and identically distributed. However, in practical scenarios, point clouds suffer from severe corruptions (e.g., noise, density change, transformation) due to sensor imprecision and scene complexity [66, 76]. When the testing distribution is different from the training distribution caused by corruption, point cloud recognition models have significant performance degradation [41, 51], indicating that they lack the robustness of human visual system [40], while also raising concerns about safety and reliability of these models. As deep 3D point cloud recognition has been increasingly deployed in safety-critical applications, such as autonomous driving [6, 84], robotics [60, 92], and medical image processing [54], it is of crucial importance to improve the robustness of 3D point cloud recognition models to -ut-of-diittibutiin (OOD) point cloud data induced by corruptions [10].
Corresponniig authors.
38th Conference on Neural Information Processing Systems (NcurIPS 2024).

---

Canali
=OA Low-fuuuue Cerruptins
CDANa
book
Cpypl:
"now
GF
Inge-trqumn Band Seadiiitt
Low-froqueng Band Seasiivity
Robustness vs. Sensitivity High-frequency Bands
Robustness vs. Sensitivity in Low-frequency Bands
Jitter
Rotate
(b)
Figure 1: (a): The graph frequency-domain representations of "Jitter" and "Rotate" in ModelNet-C [41]. "Jitter" has higher power in the high-frequency region, while "Rotate" has higher power in the low-frequency region. (b): The relationship between the corruption robustness (measured by mean overall accuracy (mOA) [41]) of various models and the sensitivity to high/low frequency bands. Our proposed high/low frequency sensitivity metric is negatively correlated with the model's robustness under high/low frequency corruptions.
To improve the corruption robustness, the most effective approaches date are based on carefully designed data augmentation techniques [41, 51]. Inspired by 2D image augmentations [85, 89], some methods blend two point clouds for data augmentation using shortest-path interpolation (e.g.. Point- Mixup [7]), random blending (e.g.. PointCutMix-R [90]), and rigid transformation (e.g., RSMix [24], PointCutMix-- [90]. PointWOLF [22] enriches data diversity by applying non-rigid deformation to object parts. WOLFMix [41] deforms objects first and then rigidly blends two deformed objects. Although these data augmentation techniques improve the corruption robustness to some extent, they are all based on spatial-domain transformations. Raw point clouds in the spatial domain have low information density and heavy spatial redundancy [8], making challenging to analyze which specific information is corrupted. To address this challenge, we shift our attention from the spatial domain to the frequency domain to analyze the underlying structure of point clouds that is not casily observable from the raw point clouds. In the frequency domain, point clouds are compactly represented, facilitating a better understanding of low-level distortions that are free of high-level semantics.
To design robust models, the first step is to understand how corruption is represented in the frequency domain. We achieve this by transforming the raw point clouds and the corresponding corruptions into compact representations the frequency domain using the graph Fourier transform (GFT) [43]. By visualizing the transformed signals, we observe that different corruptions affect varying frequency bands, as shown Fig. (a). Motivated by the differences, we investigate the relationship between the corupttio robustness of various point cloud recognition models and their sensitivity to different frequency bands [81]. To measure the sensitivity, we design a novel metric based on GFT spectrum of the Jacobian matrix of the model, shown in Fig. 3. Our key insight is that our proposed high/low frequency sensitivity metric is negatively correlated with the model's robustness under high/low frequency corruptions, as shown in Fig. 1(b). This correlation emphasizes the importance of the model's sensitivity to high and low frequencies for corruption robustness. However, it is still challenging to simultaneously reduce the sensitivity of point cloud recognition models to both high and low frequencies.
To address this issue, we propose Frequency Adversarial Training (FAT) to improve the corruption robustness of 3D point cloud recognition models. FAT trains a model with adversarial examples that add perturbations to the Trequency-domall representations of point clouds. Intuitively, model robust to worst-case perturbations should be more resistant to real-world corruptions [72, 80J. We provide a theoretical analysis that demonstrates the effectiveness of FAT in ensuring OOD generalization of the model, as shown in Theorem 1. To eliminate potential performance degradation due to mutual interference between high and low frequency signals, we utilize the AdvProp training framework [72], based on which we use three separate batch normalization (BN) statistics for clean samples, high- frequency adversarial samples, and low-frequency adversarial samples, respectively.
We conducted extensive experiments to validate the effectiveness of our approach in improving the robustness of point cloud recognition models under common corruptions [41, 51]. With various

---

network architectures, our method improves the corruption robustness by large margin. By integrat- ing our approach with previous data augmentation techniques, we achieve the new state-of-the-an performance.
2 Related work
Deep learning on 3D point clouds. Deep 3D point cloud recognition [16, 35, 38, 55, 70, 73, 79] has emerged in recent years as a prominent research area with diverse applications in several fields such as 3D object classification [46, 83, 86], 3D scene segmentation [20, 64, 75], and 3D object detection in autonomous driving [77. 95]. One of the pioneering works is PointNet [35], which employs a multilayer perceptron to learn point features and utilizes a max-pool module to aggregate them efficiently. Many subsequent works [13, 30, 36, 78] improve upon PointNet. Several approaches focus on designing special convolutions on 3D domains [26, 31, 56] or developing graph neural networks [14, 44, 65] improve point cloud recognition, such as DGCNN [65] which builds a dynamic graph for point cloud data. Recently, drawing inspiration from research in the frequency domain module to dynamically separate point clouds into the contour and flat parts of 3D objects, thereby capturing complementary 3D geometric semantics. PCT [17] uses Transformer to improve point cloud learning. Additionally, there growing discussion point cloud augmentation, including
[4, 49,9, 61, 81), GDANet [74] introduces a
augmentations [7, 90],
deformation-best based augmentations [22], and auto autlo-aummetationns [25].
Robustness in 3D point cloud recognition. Following the previous studies on robustness in the 2D image domain (53, 3, 15, 19, 32, 42, 59, 9, 82], several works [18, 50, 52, 63, 69, 34, 97] have explored the robustness of 3D point cloud classifiers. Concerning adversarial robustness, Xiang al. [69] first demonstrate that point cloud recognition is vulnerable to adversarial point generation attacks. Further research [21, 28, 29, 57, 91, 2] has employed gradient-based point perturbation attacks. Some defensive techniques are proposed, such as input randomization [12, 93] and geometry- aware framework [68] to defend against such vulnerabilities. Sun et al. [47, 48] have studied the effectiveness of adversarial training and pre- pre-training on supervupe tasks in enhancing robustness. In terms of corruption robustness, some works have studied the problem using invariant feature extraction [71]. and adaptive sampling [76]. Recently, two benchmarks [41, 51] are developed for the robustness of 3D point cloud recognition under corruptions and demonstrate the effectiveness of data augmentation. However, unlike the existing spatial- domain data augmentation techniques [22, 25], in this paper, focus the frequency domain and propose Frequency Adversarial Training (FAT) to improve the model's ' out-of diitriidittiittionnn generalization ability.
Methodology
The existing 3D point cloud recognition models exhibit significant performance degradation under point cloud corruptions [41,51], 51J. Although data augmentation techniques have shown the effectiveness in improving robustness, they are typically based on spatial-domain transformations, which suffer from low information density and heavy spatial redundancy of the raw point clouds. Consequently, it is difficult to analyze which specific information has been lost due to corruptions within the spatial domain. To address this challenge, we shift our focus to the frequency domain, which enables to analyze the underlying structure of point clouds.
In the following, we first provide the background knowledge of graph Fourier transform (GFT) in Sec. 3. then analyze the point cloud corruptions the frequency domain in See. 3.2, and investigate the relationship between the model's corruption robustness and sensitivity to frequency changes in Sec. 3.3, Based on the analyses, we propose a Frequency Adversarial Training (FAT) method detailed in Sec. 3.4 with theoretical analysis to guarantee its effectiveness in Sec. 3.5.
3.1 Graph Fourier transform
Images are typically transformed and recovered the frequency domain with the 2D discrete Fourier transform (DFT) and inverse DFT [39]. Unlike images, although 3D point clouds are highly structured, they reside on irregular domains without an ordering of points, hindering the deployment of traditional Fourier transforms. However, graphs provide a natural and accurate representation of
3

---

Clean
Rotate
Jitter
Scale
Drop Global
Drop Local
Add Global
Add Local
Figure 2: The leftmost image displays the graph seqquunncy-dmmalle representation of the point clouds. To estimate the expected value (p|(G.(P))] we average over validation point clouds in ModelNer40 [67]. The frequencies are arranged from left to right in ascending order. The other seven images display the graph
frequency-domant representations of each corruption in ModelNet-C. [41]. The raw point clouds exhibit higher
power in the low-frequency region. The corruption "Jitter" has much higher power in the high-frequee high-frequency region. The power of corruptions such "Rotate" and "Scale" is concentrated the low-frequency components.
irregular point clouds. Once graph is constructed to represent the point cloud, the graph Fourier transform (GFT) [43] can compactly transform it into the frequency domain.
Given a point cloud p == {p.} E g=xx of nt points, where P; denotes the xyz coordinates of point, we construct a directed graph G {P. E, W} to represent The graph consists of a vertex set P. an edge set & connecting the vertices, and an adjacency matrix W. The entry Wij in the adjacency matrix represents the weight of the edge from vertices to j. which is used to capture the similarity between adjacent vertices. Here, we construct weighted k-nearest neighbor graph (i.e., each vertex only connected its k-nearest neighhors) using the Euclidean distance dij = PP Pj ll2 between vertices i and j. and the weight of the edge is wi, = E =d.
After constructing the graph representation of the point cloud, we focus on the combinatorial graph Laplacian [45], defined as L := D W, where D is diagonal matrix with the i-th diagonal entry d,, Σラ=
j=1 W4, representing the degree of the i-th node. L is symmetric and positive semi-
definite, and can be eigen-decomposed as L = U T where U = [[u...., Un) is an orthogonal matrix containing the eigenvectors u, and A diag (A1 ..., A₂) is a diagonal matrix containing the cigenvalues. The eigenvalues are sorted in ascending order. representing frequencies from low to high. For point cloud P. the graph Fourier transform (GFT) can be applied to transform it into a compact representation in the frequency domain: P = GF((P) == U.P. The low-frequenc, components represent the coarse shape of the point cloud, while the high-frequency components represent the fine details. The inverse graph Fourier transform (IGFT) can be used to recover the point cloud in the spatial domain as P = GF (P) = UP.
3.2 Analyzing point cloud corruptions in the frequency domain
We employ GFT to transform point clouds and their corruptions into compact representations in the frequency domain, allowing us analyze the underlying structures of these low-level distortions that are hardly observable in the spatial domain. For raw point clouds, we transform them to the frequency- domain representations and calculate (p[ by averaging over all validation point clouds in ModelNet40 [67]. For each corruption type in ModelNet-C [41], we calculate Ep [IGFFC(P)) P)]] similarly, where C denotes the corruption function. As the input point clouds have three spatial axes (zr, y, 2). we take the average over these channels. In Fig. 2, we visualize the graph frequency-doman representations of raw point clouds and the corruptions in ModelNet-C. We can see that the raw point clouds have higher power in the low-frequency region, while the corruption "Jitter" leads to higher power in the tigh-frequency region. For corruptions such as "Rotate" and "Scale", the corrupted power is concentrated more on the low-frequency components. The results demonstrate that different corruptions of point clouds affect different frequency bands.
3.3 Relationship between corruption robustness and sensitivity to frequency bands
Motivated by the different effects of corruptions on varying frequency bands observed in the graph frequency-domain representations, we investigate the relationship between the corruption robustness of 3D point cloud recognition models and their sensitivity to different frrequency bands.

---

Frogassy
Leweraeee bue becieey
Input
Jacobian Matrix
Jacobian GFT Spectrum
Robusiness vs. Sensitivity
Low-frequency Bands
An illustration of computing the Fourier spectrum of the Jacobian matrix for single input point cloud. First, the Jacobian matrix for the input point cloud is computed. The gradient value of the output loss visualized for each point. A higher gradient value (skewed to red) indicates that the model more sensitive to changes at that point. Next, we utilize Graph Fourier Transform (GFT) on the Jacobian matrix to obtain compact representation and measure its sensitivity in the Fourier domain. Finally, by examining the sensitivity mcasurement of different point cloud models different frequency bands, we construct relationship diagram with natural robustness.
Figure 3:
To measure the sensitivity of a model on different frequency bands, we propose perform graph Fourier transform (GFT) on the Jacobian matrix of the model's output loss with respect to its input point cloud. Intuitively, the Jacobian matrix represents how the model's 's output changes with small variations in its input point cloud, revealing its sensitivity to different points in the spatial domain [1]. With GFT, the model's sensitivity to different frequency bands of input. a model's Jacobian matrix has a high proportion of low/high frequency components, it will be sensitive to low/high frequency bands.
obtain the frequency-domaii representation of the Jacobian matrix, which reveals
Fig. 3 illustrates the computation of the frequency-domate Jacobian matrix for single point cloud. Specifically, given an input point cloud P, a classification model h, and a standard cross-entropy loss function LA for the classification task, the Jacobian matrix ((P) := V of the loss with respect to the input point cloud can be calculated. We then perform GFT on ((P) to obtain its
frequency-domain representation, denoted as J(P) U (PP) in compact form, using the original point cloud's 's neighborhood relations and feature vector matrix. Since the imput point cloud has three axis channels (z, 2),, we take the average of these channels and normalize the result. We measure the model's sensitivity to input perturbations in the www-frequeccy band by summing the squares of the amplitudes of the first À frequencies of the Jacobian matrix's 's graph Fourier spectrum. The sensitivity to high-frequency perturbations is measured by summing the squares of the amplitudes of the remaining 1024 - X frequencies. A higher value of the metric indicates greater sensitivity to perturbations in that frequency band.
We can now measure the importance of the sensitivity to different frequency bands of point cloud recognition models on their corruption robustness. First, measure and establish the relationship between sensitivity to high/low frequency bands of different point cloud models and their accuracy under high/low frequency corruptions. As illustrated Fig. 1(b), our proposed frequency sensitivity metrics are negatively correlated with the corruption robustness. Therefore, point cloud models that are less sensitive to high/low frequency bands exhibit better robustness to high/low frequency corruptions. This correlation indicates that the sensitivity of models to different frequency bands affects their corruption robustness, providing insights for further improving the robustness of point cloud recognition models.
3.4 Frequency adversarial training
The above analyses highlight the importance of the sensitivity of point cloud recognition models to high and low frequencies on their corruption robustness. However, reducing the sensitivity of point cloud models to both high and low frequencies still challenging. To address this problem, propose Frequency Adversarial Training (FAT) to improve the corruption robustness of point cloud recognition models using adversarial examples in the frequency domain. Intuitively, a model trained be robust worst-case adversarial perturbations should be naturally robust to real-world corruptions [72, 80], as also theoretically demonstrated Sec. 3.5.
To simultaneously reduce the sensitivity of point cloud recognition models to high and low frequencies, we generate high-frequency adversarial examples and low-frequency adversarial examples, which are added to the training set. We generate high- freuffryy adversarial examples that alter the details of
5

---

the point clouds, and low-frequency adversarial examples that change the rough shapes of the point clouds. To prevent the mutual interference of High-frequency and low-frequency adversarial examples that may lead to decrease in model performance, we adopt the AdvProp training framework [72], where clean samples, high-frequency adversarial samples, and low-frequency adversarial samples are separately processed using three batch normalizations during adversarial training. Specifically, for an input point cloud with the ground-truth label y, our optimization objective is
arg min ((P.))) (on-mnoCChs (0, P.y) + max (0, (F +c). v) en ESI
+ max (0, (GF(() crE3:
where D is the underlying data distribution, LA is the loss function, 0 is the network parameter, G and G are high-fie high-frequency and low-frequency adversarial perturbations, and Sn, and S are the high-frequency and low-frequency perturbation ranges, respectively.
3.5 Theoretical analysis
To verify the claim that model robust to frequency-domate worst-case perturbations should be more resistant to real-world corruptions, we provide a theoretical analysis that demonstrates the effectiveness of FAT in ensuring OOD generalization of the model.
Suppose (x, y) is a pair of training sample æ and its label y,. The loss on (æ, y) with model parameter / is C(0, (z, v)), where C(0, (I, y)) is continuous and differentiable for both 0 and (x, y). We let f(x) == C(A, (æ, y)) for simplicity. Let F and F-1 denote the Fourier transform and inverse Fourier transform, respectively. The norm || ||p denotes the f--nomm We have the following theorem:
Theorem 1. If f satisfies that: f(x) E MO] for all x. If(F=1(F(x) + a)) - f(x) < c for all and |allp 5, then for any distribution Po and Po satisfying that Was Pa) (infuemtPP.P.). (((,)))alllFF F(( F(=)1lB)) S n, where ni 8, then, with probability 7 have:
BSNPI
m Σ f(x,) I 1-
17t
In(4/7) 2m
" M + 4M
In In(4/7)
(2)
8P
5p
2m
where {mi)
ya are i.i.d. samples from Pa-
Remark 1. Intuitively, OOD corresponds to the shifted distribution Po that approaches the training distribution Pa- Thus Was as WasP(Pa (Po. Pa) defines OOD from the perspective of measuring the distance between distributions. Ez-P, (2)] m Ex= (z,) represents the OOD generalization ervor of the model. (f(F=1(F(s) + o:) [())
S 6 and ||a[|p S 5 indicate that the model is robust under frequency domain perturbations. The bound (2) implies that models that are adversarially robust in the frequency-domen have smaller generalization bounds on OOD data.
The proof of Theorem is deferred to Appendix Thus, the frequency- -omman adversarial robustness of the model guarantees the generalization on OOD data. We have the following observations:
The right-hand side of Eq. (2) implies that models that are more robust to frequency domain adversarial samples (i.e., larger 8 and smaller e) have smaller OOD generalization bounds and thus perform better on OOD data.
For Eq. (2), larger number of training samples leads smaller OOD generalization bound. This indicates that more training samples can compensate for the degradation of generalization performance.
4 Experiments
In this section, we first detail the experimental settings in Sec. 4.1, then present the main results in Sec. 4.2 to show the effectiveness of our method. We further integrate our method with other data augmentation techniques in Sec. 4.3 and perform ablation studies in Sec, 4.4.

---

Table 1: Quantitative results of vanilla training, adversarial training, DUP Defense and our proposed Frequency Adversarial Training (FAT) on the ModelNet-C test set. Our proposed FAT outperforms all other methods in terms of mean corruption error (mCE), which demonstrates the effectiveness of FAT for improving corruption robustness.
Method
OA t
mCE. L
Rotate
Jitter
Scale
Drop-G
Drop-I.
Add-G
Add-L
Vanilla Training
0.926
L.000
1,000
1.000
1,000
1,000
1.000
1,000
1,000
DGCNN
Adv Training
0.925
0.926
1,019
0.582
1,043
0.996
1.101
0,871
0,869
Defense
1.112
0.902
1.181
1.048
1.483
0.285
0.327
FAT (Ours)
0.925
0.825
0.898
0.453
0.989
0.931
0.971
0.773
0.760
Vanilla Training
0.907
1.422
1,902
0.642
1.266
0,500
1.072
2,980
1,593
PointNet
Adv Training
0.904
1.372
1.851
0.563
1.287
0,448
1.077
2,888
1.487
Defense
0.668
1.649
0.802
1.396
0.966
1.153
FAT (Ours)
0.902
1.237
1,583
0.370
1.606
0.448
1.097
2,583
1,004
Vanilla Training
0.930
0.925
1,042
0.870
0.872
0,528
1,000
0.780
1,385
PCT
Adv Training
0.919
0.976
1,042
0.389
1.074
0.911
1.193
1.108
1.116
Defense
1.112
0.699
1,043
0.738
1.261
0.410
1.215
FAT (Ours)
0.920
0.907
1,009
0.345
1.085
0.843
1.237
0.912
0.920
Vanilla Training
0.934
0.892
0
0.839
0.830
0.794
0,894
0,871
1,036
GDANet
Adv Training
0.926
0.960
1.112
0.506
1.032
0.927
1.140
1.064
0.938
Defense
1.140
0.788
1.064
0.698
1.179
0.427
0.985
FAT (Ours)
0.928
0.850
1.167
0.408
0.926
0.794
1.111
0.654
0,887
4.1 Experimental setup
Dataset. To validate the effectiveness of our FAT method in enhancing the corruption robustness of 3D point cloud recognition models, we train all models on the standard ModelNet40 training set [67]. In addition to reporting the performance of the models on the original ModelNet40 validation set, we also evaluate the corruption robustness on ModelNet-C [41] in the main paper and ModelNet40-C [51] in Appendix B. The ModelNet40 dataset [67] contains 12,3 11 CAD models with 40 common object categories in the real world. We use the official split [35], where 9,843 examples are used for training and the remaining 2,468 examples are used for testing. The ModelNet-C dataset [41] is designed for measuring the network robustness to common point cloud corruptions. It consists of 7 different corruption types, including "Scale", "Jitter", "Rotate". "Drop Global", "Drop Local", "Add Global", and "Add Local". Each type of corruption has five severity levels. ModelNer4O-C [51] is similar dataset with 15 corruptions, which will be detailed in Appendix B.
Model architectures. Following [41, 51], we select four representative model architectures: Point- Net [35], DGCNN [65], PCT [17], and GDANet [74]. These models represent different architectural designs and have been widely applied in 3D visual tasks.
Evaluation metrics. To measure the corruption robustness of different methods, we follow [41] and use the mean corruption error (mCE) as the main evaluation metric. We adopt the official baseline DGCNN and first compute the corruption error (CE) for a given corruption type i by averaging over
5 severity levels: CE,- Ei (1-0Ar,)
(1- OAPGONYy. where OA,,1 is the overall accuracy on a corruption test set at severity level I, and OA
DGCNN the overall accuracy of the baseline. Then, we average over
the 7 corruption types to compute the mean corruption emor: mCF = N Σ CE, In addition, we also report the clean overall accuracy (OA), the corruption overall accuracy (mOA), and the relative mCE (RmCE) following [41]. Due to space constraints, we provide the definition of RmCE and report mOA and RmCE in Appendix B.
Implementation details. For each method, we train 250 epochs using the smooth cross-entropy loss [65] and Adam optimizer [23], and select the best performant model for further evaluation. We follow the DGCNN protocol [16]. For our method, we set & = 30 for the k-nearest neighbor graph and À = 100 for dividing high-frequency and low-frequency [29]. We use PGD [33] and AOF [27] to generate high-frequency adversarial examples and low-frequency adversarial examples, respectively. We constrain S₁, and S by 0.3 and 0.5, respectively. For more detailed training settings, please refer to Appendix B.
7

---

1.5-
Seachety
Suedliitty
1.50
1644
(4) DGCNN
(6) PointNet
PC)
(d) GDANet
Figure 4: Visualization of the sensitivity maps based on Jacobian matrices of Frequency Adversarial Training
(FAT) and vanilla training under four different model architectures. FAT reduces the model sensitivity to different
frequency bands, therehy enhancing their robustness to corruptions.
4.2
Main results
In this section, following [41, 51]. we compare our proposed Frequency Adversarial Training (FAT) method with vanilla training, adversarial training and DUP Defense [93] on the ModelNet-C test set, demonstrating the effectiveness of FAT in enhancing corruption robustness. Table I presents a comparative analysis of different methods based on mean corruption error (mCE), clean overall accuracy (OA), and corruption error (CE) for each corruption type.
As shown in Table 1, our proposed Frequency Adversarial Training (FAT) outperforms all other methods in terms of mean corruption error (mCE), while exhibiting comparable performance in terms of overall accuracy (OA). The improvement in corruption robustness across the four different model architectures demonstrates the amneralizabliityyiivversiii of our method across different architectures. In Fig. we visualize the sensitivity maps based on Jacobian matrices of Frequency Adversarial Training (FAT) and vanilla training under four different model architectures. FAT reduces the sensitivity of the model across different frequency bands.
It is noteworthy that GDANet introduces a -disettadd module to dynamically disentangle point clouds into the contour and flat part of 3D objects. capturing complementary 3D geometric semantics. In contrast, FAT does not modify the network architecture to focus on the frequency domain but instead employs adversarial training the frequency domain. As shown in Table the two methods are complementary and synergistic, leading to improved model robustness. We report the performance of different methods in terms of overall corruption accuracy (mOA) and relative mCE (RmCH) in Appendix B, where the improvement in robustness of FAT is also significant under these metrics. The comparisons in Table and Appendix B confirm that our proposed FAT enhances the OOD generalization ability of the model.
4.3 Data augmentation
To further validate the effectiveness of our proposed Frequency Adversarial Training (FAT), follow- ing [41], we investigate the performance of FAT in combination with different data augmentation strategies, including RSMix [24], PointWOLF [22], and WOLFMix [41]. These strategies respec- tively represent mix-based augmentation, deformation-based augmentation, and a combination of both mix-based and deformation- based augmentation. RSMix involves rigidly blending two point clouds using a transformation. PointWOLF enriches data diversity by applying non-rigid deformations to object parts. WOLFMix. designed based on PointWOLF and RSMix, first deforms the objects and then rigidly blends two deformed objects. When combining the data augmentation strategies, we first perform data augmentation on the input point cloud and then generate adversarial examples. For mix-based augmentation, we perform untargeted adversarial attacks on both labels being mixed to generate the adversarial examples.
In Table 2, we show the performance of FAT when integrated with different data augmentation strategies in terms of mean corruption error (mCE), clean overall accuracy (OA), and corruption error (CE) for each corruption type. Compared with single data augmentation strategy. the com- bination of FAT and data augmentation strategies achieves a better mCE, which is attributed to the complementary and compatible information from both the spatial and frequency domains. The improvement in corruption robustness under three different data augmentation strategies demonstrates the generalization capability of our proposed method. As shown in Table 2, training GDANet with the combination of our proposed FAT with WOLFMix achieves a new sfate-of-the-art performance, with impressive 0.537 mCE.
8

---

Table 2: Quantitative results of combining FAT with different data augmentation strategies the ModelNet-- test set. Compared with a single data augmentation stralegy, the combination of FAT and different data augmentation strategies achieves a better mCE. Training GDANet with the combination of our proposed FAT
with WOLFMix achieves the new state-of of the-ar art performance, with an impressive 0,537 mCE.
Method
OA f
mCE
Rotate
Jitter
Scale
Drop-G
Drop-L.
Add-G
Add-L
Vanilla Training
0.907
1.422
1.902
0.642
1.266
0.500
1,072
2,980
1.593
RSMix
0.902
1.276
1.372
0.532
2.234
0,593
1.145
2.241
0.815
RSMix+FAT (Ours)
1.084
1.340
0.389
1.670
PointNet
PointWOLF
0.902
1.311
0.912
0.633
2.128
0.754
1,575
2,210
0.964
PointWOLF-EXT (Ours)
0.902
0.993
0.558
0.487
1.372
0.589
1.411
1.759
0.775
WOL FMix
0.880
1.149
0.986
0.566
2,096
0.605
1.155
1,854
0.789
WOLFMix+FAT (Ours)
0.882
0.945
0.726
0.491
1,691
0,520
1.048
1.498
0.644
Vanilla Training
0.930
0.925
1.042
0.870
0.872
0,528
1,000
0,780
1,385
RSMix
0.925
0.660
1.116
0.614
1.106
0.488
0.522
0.302
0.473
RSMix+FAT (Ours)
0.925
0.604
1.093
0.354
1,106
0.427
0.531
0.308
0.411
PCT
PointWOLF
0.923
0.846
0.428
0.788
0.979
0.504
1,130
1.040
1.05
PointWOLF-FXT (Ours)
0.923
0.785
0.465
0.415
1.217
0,953
WOLFMix WOLFMix-FAT (Ours)
0.922
0,585
0.442
0.788
0.989
0.444
0.546
0,319
0.564
0.570
0.572
0.326
Vanilla Training
0.934
0.892
0.981
0.839
0.830
0.794
0.894
0.871
1.036
RSMix
0.927
0.680
1.205
0.873
1,000
0.484
0.531
0.281
0.385
RSMix+BAT (Ours)
0.929
0.617
1.153
0.:427
1,021
0.504
0.531
0.285
0.396
GDANe
Poin
0.870
0,915
1.121
0,688
PoinWOLL F-FA (Ours)
0.925
0.807
0.428
0.522
0,915
0.831
1.159
1,058
0.735
WOLFMix
0.920
0.601
0.428
0.937
0,968
0.540
0.589
0.298
0.444
WOL FMT (Ours)
0.930
0.537
0.530
0.418
1,138
0.460
0.527
0,281
0.404
Table 3: Quantitative results of FAT and its variants. FAT w/o low-frequency has lower mCE for high-frequue -requeeyy corruptions such as "Jitter",, while FAT w/o high-frequency has lower mCE for low-frequency corruption such as "scale". FAT w/o Advprop has higher mCE but much worse OA. Compared with these methods, FAT
achieves the lowest mCE.
Mothod
OA 1
mCE |
Rotate
Jitter
Scale
Drop-G
Drop-L
Add-G
Add-L
Vanilla Training
0.907
1.422
1.902
0.642
1.266
0.500
1.072
2.980
1.593
FAT w/o low-frqueency
0.890
1.306
1.614
0.373
1.734
0.504
1.193
2.627
1,098
PointNet
FAT w/o high-frequency
0.906
1.317
1.702
0.519
1.234
0.452
1.043
2.851
1.415
FAT w/o frsquency-division
0.904
1331
1.679
0.516
1.351
0.444
1.106
2.817
1.255
FAT Advprop
1.926
1.164
2.461
FAT
0.902
1.237
1.553
0.370
1.606
0.448
1.097
2.583
1.004
4.4 Ablation study
In this section, we conduct ablation study among proposed Frequency Adversarial Training (FAT), as well as FAT variants: FAT w/o low-frequency, FAT w/o fighffreuency, FAT w/o frequency- division, and FAT w/o Advprop. FAT w/o low- frequeneeyy generates only high-frequency adversarial samples, while FAT w/o high-frequency generates only low-frequenc adversarial samples. FAT w/o frequency-divistie randomly generates adversarial samples within a certain frequency range, without dividing the high and low frequency bands. FAT w/o Advprop does not use the AdvProp training framework [72]. We compare these methods in Table based mean corruption error (mCE), clean overall accuracy (OA), and corruption error (CE) measurements for each corruption type.
Compared with other methods, FAT w/o low-frequency has lower mCE for fighefrreueeccy corrup- tions such as "Jitter", while FAT w/o such as "scale". As discussed in Sec. 3.3, this is because adversarial training high/low frequencies reduces the high/low frequency sensitivity, thus improving robustness to fweeuuunnyyyyyy corrup- tions. The performance of FAT w/o frequency-division falls between FAT w/o low-frequency and FAT w/o high-frequency. Although FAT w/o Adyprop has better mCF, its clean overall accuracy (OA) is worse than the other methods due to mutual interference between samples from different distributions, which may cause potential performance degradation. Compared with these methods, FAT achieves the lowest mCE, showing the effectiveness of our algorithm. More experimental results can be found in Appendix B.
has lower mCE for low-frequency corruptions

---

5 Conclusion
In this paper, we study the robustness of 3D point cloud recognition models under common corrup- tions. We focus the frequency domain to analyze the underlying structure of point clouds and common corruptions. Through graph Fourier transform (GFT), we identify a correlation between the corruption robustness and the model sensitivity to different frequency bands. Motivated by the analysis, we propose Frequency Adversarial Training (FAT), an adversarial training method based on frequency-domain adversarial examples to improve the corruption robustness of 3D point cloud recognition models. Extensive experiments demonstrate that the proposed method significantly improves the corruption robustness of various point cloud models, and can be integrated with other data augmentation techniques to achieve the state-of of of-the-aateeee art performance.
Limitation and broader impact. A limitation of our proposed method is that it reduces the clean accuracy a bit, e.g., FAT reduces the clean accuracy of DGCNN by 0.1%, PointNet by 0.5%, PCT by 1.0%, and GDt by 0.6%. This may he caused by the inherent trade-off between accuracy and robustness [88]. Additionally, despite the complexity in implementation, FAT does not affect the efficiency of model inference, ensuring unhindered deployment of well-trained models in practical applications. The robustness of 3D point cloud recognition under corruptions is a severe problem towards safe and reliable 3D perception. Our work proposes an effective method solve this issue, which does not have any negative social impact.
Acknowledgments
This work is supported by NKRDP grant No.2018YFA0704705. NSFC grants No. No.62276149 and No. 1228801, and grant GJ0090202. Y. Dong is supported by the China National Postdoctoral Program for Innovative Talents. The authors thank anonymous referees for their valuable comments. L. Yu is supported by CAS Project for Young Scientists in Basic Research, Grant No. SSBB-B0--40, ISCAS New Cultivation Project ISCAS-PYFX-202200 and ISCAS Basic Research ISCAS-JCZD- 202302.
References
[1] Julius Adebayo, Justin Gilmer, Michael Muelly, Ian Goodfellow, Moritz Hardt, and Been Kim. Sanity checks for saliency maps. Advances neural information processing systems, 31, 2018.
[2] Yulong Cao, Chaowei Xiao, Dawei Yang, Jing Fang, Ruigang Yang, Mingyan Liu, and Bo Li. Adversarial objects against lidar-based autonomous driving systems. arXiv preprint arXiv:1907.05418, 2019.
[3] Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 ieee symposium on security and privacy (sp), pages 39-57. IEEE, 2017.
[4] Alvin Chan, Yew-Soon Ong, and Clement Tan. How does frequency bias affect the robustness of neural image classifiers against common corruption and adversarial perturbations? arXiv preprint arXiv:2205. 04533, 2022.
[5] Angel X Chang, Thomas Funkhouser, Leonidas Guibas, Pat Hanrahan, Qixing Huang, Zimo Li, Silvio Savarese, Manolis Savva, Shuran Song, Hao Su, et al. Shapenet: An information-rich 3d model repository. arXiv preprint arXiv: 1512.030,,2 2015.
[6] Xiaozii Chen, Huimin Ma, Ji Wan, Bo Li, and Tian Xia. Multi-view 3d object detection network for autonomous driving. In Proceedings of the IEEE conference on Computer Vision and Pattern Recognition, pages 1907-1915, 2017.
[7] Yunlu Chen, Vincent Tao Hu. Efstratios Gavves, Thomas Mensink, Pascal Mettes, Pengwan Yang, and Cees GM Snock. Pointmixup: Augmentation for point clouds. Computer Vision- ECCV 2020: 16th European Conference, Glasgow, UK, August 23-28, 2020, Proceedings, Part III 16, pages 330-345. Springer, 2020.
[8] Yunpeng Chen, Haoqi Fan, Bing Xu, Zhicheng Yan, Yannis Kalantidis, Mareus Rohrbach, Shuicheng Yan, and Jiashi Feng. Drop octave: Reducing spatial redundancy in convolutional
10

---

neural networks with octave convolution. In Proceedings of the IEEE/CVF international conference on computer vision, pages 3435-3444 2019.
[9] Shuyu Cheng, Yibo Miao, Yinpeng Dong, Xiao Yang, Xiao-Shan Gao, and Jun Zhu. Efficient black-box adversarial attacks via bayesian optimization guided by function prior. In Forty-first International Conference on Machine Learning, 2024.
[10] Wenda Chu, Linyi Li, and Bo Li. Tpe: Transformation-speciin smoothing for point cloud models. arXiv preprint arXi::2201.12733, 2022.
[11] Moustapha Cisse, Piotr Bojanowski, Edouard Grave, Yann Dauphin, and Nicolas Usunier. Parseval networks: Improving robustness to adversarial examples. In International Conference on Machine Learning, pages 854-863. PMLR, 2017.
[12] Xiaoyi Dong, Dongdong Chen, Hang Zhou, Gang Hua, Weiming Zhang, and Nenghai Yu. Self-robust 3d point recognition via gather-vector guidance. In 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 11513-11521. IEEE, 2020.
[13] Yueqi Duan, Yu Zheng, Jiwen Lu, Jie Zhou, and Qi Tian. Structural relational reasoning of point clouds. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 949-958,200 2019.
[14] Xiang Gao, Wei Hu, and Guo-Jun Qi. Graphter: Unsupervised learning of graph transformation equivariant representations via auto-encoding node-wise transformations. In Pruceedings of the IEEE/CVE Conference on Computer Vision and Pattern Recognition, pages 7163-7172, 2020.
[15] Robert Geirhos, Patricia Rubisch, Claudio Michaelis, Matthias Bethge, Felix Wichmann, and Wieland Brendel. Imagenet-trainee trained cnns are biased towards texture; increasing shape bias improves accuracy and robustness. arXiv preprint 181 12231, 2018.
[16] Ankit Goyal, Hei Law, Bowei Liu, Alejandro Newell, and Jia Deng. Revisiting point cloud shape classification with simple and effective baseline. In International Conference Machine Learning, pages 3809-3820. PMLR, 2021.
[17] Meng-Hao Guo, Jun-Xiong Cai, Zheng-Ning Liu, Tai-Jiang Mu, Ralph R Martin, and Shi-Min Hu. Pet: Point cloud transformer. Computatioonal Visual Media, 7:187-199, 2021.
[18] Abdullah Hamdi, Sara Rojas, Ali Thabet, and Bernard Ghanem. Advpe: Transferable adversarial perturbations on 3d point clouds. In Computer Vision-ECCV 2020: 16th European Conference, Glasgow, UK, August 23-28, 2020, Proceedings, Part XII 16, pages 241-257. Springer, 2020.
[19] Dan Hendrycks, Norman Mu, Ekin Cubuk, Barret Zoph, Justin Gilmer, and Balaji Lakshmi- narayanan. Augmix: A simple data processing method to improve robustness and uncertainty. arXiv preprint arXiv: 1912.02781 2019.
[20] Qingyong Hu, Bo Yang, Linhai Xie, Stefano Rosa, Yulan Guo, Zhihua Wang, Niki Trigoni, and Andrew Markham. Learning semantic segmentation of large-scale point clouds with random sampling. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2021.
[21] Qidong Huang, Xiaoyi Dong, Dongdong Chen, Hang Zhou, Weiming Zhang, and Nenghai Yu. Shape-invariant 3d adversarial point clouds. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pages 15335-15344, 2022.
[22] Sihyeon Kim, Sanghyeok Lee, Dasol Hwang, Jaewon Lee, Scong Jae Hwang, and Hyunwoo J Kim. Point cloud augmentation with weighted local transformations. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 548-557, 2021.
[23] Diederik P Kingma and Jimmy Ba. Adam: A method for stochastic optimization. arXiv preprint arXiv: 1412.6:412.69900 2014.
[24] Dogyoon Lee, Jaeha Lee, Junhyeop Lee, Hyeongmin Lee, Minhyeok Lee, Sungmin Woo, and Sangyoun Lee. Regularization strategy for point cloud via rigidly mixed sample. In Proceedings of the IEEF/CVF Conference on Computer Vision and Pattern Recognition, pages 15900-15909, 2021.
11

---

[25] Ruihui Li, Xianzhi Li, Pheng-Am Ann Heng, and Chi- Wing Fu. Pointaugment: an auto- augmentation framework for point cloud classification. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pages 6378 6387, 2020.
[26] Yangyan Li, Rui Bu, Mingchao Sun, Wei Wu, Xinhan Di, and Baoquan Chen. pointenn: Convolution on x-transformed points. Advances in neural information processing systems, 31, 2018.
[27] Binbin Liu, Jinlai Zhang, and Jihong Zhu. Boosting 3d adversarial attacks with attacking on frequency. IEEE Access, 10:50974-50988 2022.
[28] Daizong Liu and Wei Hu. Imperceptible transfer attack and defense on 3d point cloud classifi- cation. IEEE Transactions on Puttern Analysis and Machine Intelligence, 2022.
[29] Daizong Liu, Wei Hu, and Xin Li. Point cloud attacks in graph spectral domain: When 3d geometry meets graph signal processing. arXiv preprint arXiv:2207. 13326, 2022.
[30] Yongcheng Liu, Bin Fan, Gaofeng Meng, Jiwen Lu, Shiming Xiang, and Chunhong Pan. Densepoint: Learning densely contextual representation for efficient point cloud processing. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 5239-5248, 2019.
[31] Yongcheng Liu, Bin Fan, Shiming Xiang, and Chunhong Pan. Relation-shape convolutional neural network for point cloud analysis. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattrnn Recognition, pages 8895-8904 2019.
[32] Raphael Gontijo Lopes, Dong Yin, Ben Poole, Justin Gilmer, and Ekin D Cubuk. Improving robustness without sacrificing accuracy with patch gaussian augmentation. arXiv preprint arXiv:1906.02611, 2019.
[33] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. arXiv preprint (tt:::7000000.. 2017.
[34] Yibo Miao, Yinpeng Dong, Jun Zhu, and Xiao-Shan Gao. Isometric 3d adversarial examples in the physical world. Advances in Neural Information Processing Systems, volume 35, pages 1971611971,, 2022.
[35] Charles R Qi, Hao Su, Kaichun Mo, and Leonidas Guibas. Pointnet: Deep learning on point sets for 3d classification and segmentation. In Proceedings of the IEEE conference on compuler vision and pattern recognition, pages 652-660, 2017.
[36] Charles Ruizhongtai Qi, Li Yi, Hao Su, and Leonidas J Guibas. Pointnet++: Deep hierarchical feature learning point sets in a metric space. Advances in neural information processing systems, 30, 2017.
[37] Guocheng Qian, Yuchen Li, Houwen Peng, Jinjie Mai, Hasan Hammoud, Mohamed Elhoseiny, and Bernard Ghanem. Pointnext: Revisiting pointnet++ with improved training and scaling strategies. Advances in neural information processing systems, 111-2319--22044 2022.
[38] Yongming Rao, Jiwen Lu, and Jie Zhou. Global-local bidirectional reasoning for unsupervised representation learning of 3d point clouds. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 3375-5385, 2020.
[39] Mohammed H Rasheed, Omar M Salih, Mohammed M Siddeq, and Marcos A Rodrigues. Image compression based on 2d discrete fourier transform and matrix minimization algorithm. Array, 6: 10004, 2020.
[40] Benjamin Recht, Rebecca Roelofs, Ludwig Schmidt, and Vaishaal Shankar. Do imagenet classifiers generalize to imagenet? In International conference on machine learning, pages 5389-5400. PMLR, 2019.
[41] Jiawei Ren, Liang Pan, and Ziwei Liu. Benchmarking and analyzing point cloud classification under corruptions. International Conference on Machine Learning, pages 18559-18575. PMLR, 2022.
12

---

[42] Evgenia Rusak. Lukas Schott, Roland S Zimmermann, Julian Bitterwolf, Oliver Bringmann, Matthias Bethge, and Wieland Brendel. simple way to make neural networks robust against diverse image corruptions. In Computer Vision-ECCV 2020: 16th European Conference, Glasgow, UK, August 23-28, 2020, Proceedings, Part III 16, pages 53-69. Springer, 2020.
[43] Aliaksei Sandryhaila and José MF Moura. Discrete signal processing on graphs: Graph fourier transform. In 2013 IEFE International Conference on Acoustics, Speech and Signal Processing, pages 6167-6170. IEEE, 2013.
[44] Yiru Shen, Chen Feng, Yaoqing Yang, and Dong Tian. Mining point cloud local structures by kernel correlation and graph pooling. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages
2018
[45] David Shuman, Sunil K Narang, Pascal Frossard, Antonio Ortega, and Pierre Vandergheynst. The emerging field of signal processing on graphs: Extending high-dimensional data analysis to networks and other irregular domains. IEEE signal processing magazine, 30(3):83-98, 2013.
[46] Hang Su, Subhransu Maji, Evangelos Kalogerakis, and Erik Learned-Milles Multi-view convo- lutional neural networks for 3d shape recognition. In Proceedings of the IEEE international conference on computer vision, pages 945-953, 2015.
[47] Jiachen Sun, Karl Koenig, Yulong Cao, Qi Alfred Chen, and Z Morley Mao. On adver- sarial robustness of 3d point cloud classification under adaptive attacks. arXiv preprint arXiv:2011.11922 2020.
[48] Jiachen Sun, Yulong Cao, Christopher B Choy, Zhiding Yu, Anima Anandkumar, Zhuoqing Mor- ley Mao, and Chaowei Xiao. Adversarially robust 3d point cloud recognition using self- supervisions. Advances in Neural Information Processing Systems, 34:15498-15512, 2021.
[49] Jiachen Sun, Akshay Mehra, Bhavya Kailkhura, Pin-Yu Yu Chen, Dan Hendrycks, Jihun Hamm, and Z Morley Mao. A spectral view of randomized smoothing under common corruptions: Benchmarking and improving certified robustness. In Computer Vision-ECCV 2022: 17th European Conference, Tel Aviv, Israel, October 23-27, 2022, Proceedings, Part IV, pages 654-671. Springer, 2022.
[50] Jiachen Sun, Weili Nie, Zhiding Yu, Z Morley Mao, and Chaowei Xiao. Pointdp: Diffusion- driven purification against adversarial attacks on 3d point cloud recognition. arXiv preprint arXiv:2208.081 09801, 2022.
[51] Jiachen Sun, Qingzhao Zhang, Bhavya Kailkhura, Zhiding Yu, Chaowei Xiao, and Z Morley Mao. Benchmarking robustness of 3d point cloud recognition against common corruptions. arXiv preprini arXiv:2201. 1229, 2022.
[52] Jiachen Sun Sun, Yulong Cao Cao, Qi Alfred Chen, and Z Morley Mao. Towards robust lidar-based perception in autonomous driving: General black-box adversarial sensor attack and countermeasures. In USENIX Security Symposium (Usenix Security 20), 2020.
[53] Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfel- low, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint 112.:933 2013.
[54] Abdel Aziz Taha and Allan Hanbury. Metrics for evaluating 3d medical image segmentation: analysis, selection, and tool. BMC medical imaging. 15(1):1-28, 2015.
[55] Gusi Te, Wei Hu, Amin Zheng, and Zongming Guo. Rgenn: Regularized graph can for point cloud segmentation. In Proceedings of the 26th ACM international conference on Multimedia, pages 746-754, 2018.
[56) Hugues Thomas, Charles R Qi, Jean-EEmanuel Deschaud, Beatriz Marcotegui, François Goulette, and Leonidas J Guibas. Kpconv: Flexible and deformable convolution for point clouds. In Proceedings of the IEFF/CVF international conference on computer vision, pages 6411-6420, 2019.
13

---

[57] Tzungyu Tsai, Kaichen Yang. Tsung- Yi Ho, and Yier Jin. Robust adversarial objects against deep learning models. In Proceedings of the AAAI Conference on Artificial Intelligence. volume 34, pages 962, 2020.
[58] James Tu, Mengye Ren, Sivabalan Manivasagam, Ming Liang, Bin Yang. Richard Du, Frank Cheng, and Raquel Urtasun. Physically realizable adversarial examples for lidar object detection. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 13716-13725 2020.
[59] Puru Vaish, Shunxin Wang, and Nicola Strisciuglio. Fourier-basis functions to bridge aug- mentation gap: Rethinking frequency augmentation in image classification. arXiv preprint arXiv:2403.01944 2024.
[60] Jacob Varley, Chad DeChant, Adam Richardson, Joaquín Ruales, and Peter Allen. Shape completion enabled robotic grasping. In 2017 IEEE/RSJ international conference on intelligent robots and systems (IROS), pages 2442-2447 IEEE, 2017.
[61] Haohan Wang, Xindi Wu, Zeyi Huang, and Eric Xing. High-frequency component helps explain the generalization of convolutional neural networks. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 8684-8694, 2020.
[62] Jie Wang, Lihe Ding, Tingfa Xu, Shaocong Dong, Xinli Xu, Long Bai, and Jianan Li. Sample- adaptive augmentation for point cloud recognition against real-world corruptions. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 14330-14339, 2023.
[63] Ruibin Wang, Yibo Yang, and Dacheng Tao. Art-point: Improving rotation robustness of point cloud classifiers via adversarial rotation. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 14371-14380, 2022.
[64] Weiyue Wang, Ronald Yu, Qiangui Huang, and Ulrich Neumann. Sgpn: Similarity group proposal network for 3d point cloud instance segmentation. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 2569-2578, 2018
[65] Yue Wang, Yongbin Sun, Ziwei Liu, Sanjay E Sarma, Michael M Bronstein, and Justin M Solomon. Dynamic graph enn for learning on point clouds. Acm Transactions On Graphics (1og), 38(5): 2019.
[66] Bichen WU, Xuanyu Zhou, Sicheng Zhao, Xiangyu Yue, and Kurt Keutzer. Squeezesegv2: Improved model structure and unsupervised domain adaptation for road-object segmentation from a lidar point cloud. In 2019 International Conference on Robotics and Automation (ICRA), pages 4376 2376.4382. IEFE, 2019.
[67] Zhirong Wu, Shuran Song, Aditya Khosla, Fisher Yu, Linguang Zhang, Xiaoou Tang, and Jianxiong Xiao. 3d shapenets: A deep representation for volumetric shapes. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 1912-1920, 2015.
[68] Ziyi Wu, Yueqi Duan, He Wang, Qingnan Fan, and Leonidas J Guibas. If-defense: 3d adversarial point cloud defense via implicit function based restoration. arXiv preprint arXiv:2010.05272. 2020.
[69] Chong Xiang, Charles R Qi, and Bo Li. Generating 3d adversarial point clouds. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pages 9136-9144, 2019.
[70] Tiange Xiang. Chaoyi Zhang, Yang Song, Jianhui Yu, and Weidong Cai. Walk in the cloud: Learning curves for point clouds shape analysis. In Proceedings of the IEEE/CVE International Conference on Computer Vision, pages 015-924, 2021.
[71] Chenxi Xiao and Juan Wachs. Triangle-net: Towards robustness in point cloud learning. In Proceedings of the IEEF/CVF Winter Conference on Applications of Computer Vision, pages 826-835, 2021.
14

---

[72] Cihang Xie, Mingxing Tan, Boqing Gong, Jiang Wang, Alan L Yuille, and Quoe V Le. Adver- sarial examples improve image recognition. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 819-828, 2020.
[73] Mutian Xu, Runyu Ding, Hengshuang Zhao, and Xiaojuan Qi. Paconv: Position adaptive convolution with dynamic kernel assembling on point clouds. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 3173-3182, 2021.
[74] Mutian Xu, Junhao Zhang, Zhipeng Zhou, Mingye Xu, Xiaojuan Qi. and Yu Qiao. Learning geometry-ddieentanlled representation for complementary understanding of 3d object point cloud. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 35, pages 3056-3064 2021.
[75] Qiangeng Xu, Xudong Sun, Cho- Ying Wu, Panqu Wang, and Ulrich Neumann. Grid-gen for fast and scalable point cloud learning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 5661-5670, 2020.
[76] Xu Yan, Chaoda Zheng, Zhen Li, Sheng Wang, and Shuguang Cui. Pointasnl: Robust point clouds processing using nonlocal neural networks with adaptive sampling. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 5589-5598, 2020.
[77] Bo Yang, Jianan Wang, Ronald Clark, Qingyong Hu, Sen Wang, Andrew Markham, and Niki Trigoni. Learning object bounding boxes for 3d instance segmentation on point clouds. Advances in neural information processing systems, 32, 2019.
[78] Jiancheng Yang. Qiang Zhang, Bingbing Ni, Linguo Li, Jinxian Liu, Mengdie Zhou, and Qi Tian. Modeling point clouds with self-attention and gumbel subset sampling. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 3323-3332, 2019,
[79] Yaoqing Yang. Chen Feng, Yiru Shen, and Dong Tian. Foldingnet: Point cloud auto-encoder via deep grid deformation. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 206-215, 2018
[80] Mingyang Yi, Lu Hou, Jiacheng Sun, Lifeng Shang, Xin Jiang, Qun Liu, and Zhiming Ma. Improved ood generalization via adversarial training and pretraing. In International Conference on Machine Learning, pages 1 11987-11997, 2021.
[81] Dong Yin, Raphael Gontijo Lopes, Jon Shlens, Ekin Dogus Cubuk, and Justin Gilmer. A fourier perspective on model robustness in computer vision. Advances in Neural Information Processing Systems, 32, 2019.
[82] Lijia Yu, Shuang Liu, Yibo Miao, Xiao-Shan Gao, and Lijun Zhang. Generalization bound and algorithm for clean-labe backdoor attack. In Forty-first International Conference Machine Learning, 2024.
[83] Tan Yu, Jingjing Meng, and Junsong Yuan. Multi-view harmonized bilinear network for 3d object recognition. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pages 186-194, 2018
[84] Xiangyu Yue, Bichen Wu, Sanjit A Seshia, Kurt Keutzer, and Alberto L Sangiovaami-Vinceetllli lidar point cloud generator: from a virtual world to autonomous driving. In Proceedings of the 2018 ACM International Conference on Multimedia Retrieval, pages 458 2018.
[85] Sangdoo Yun, Dongyoon Han, Seong Joon Oh, Sanghyuk Chun, Junsuk Choe, and Youngjoon Yoo. Cutmix: Regularization strategy train strong classifiers with localizable features. In Proceedings of the IEEE/CVE international conference on computer vision, pages 6023-6032, 2019.
[86] Manzil Zaheer, Satwik Kottur, Siamak Ravanbakhsh, Barnabas Poczos, Russ R Salakhutdinov, and Alexander Smola. Deep sets. Advances in neural information processing systems, 30,
2017.
15

---

[87] Bohang Zhang, Tianle Cai, Zhou Lu, Di He. and Liwei Wang. Towards certifying l-infinity robustness using neural networks with l-inf-dist neurons. In International Conference on Machine Learning, pages 12368-12379, 2021.
[88] Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. In Interaationall conference on machine learning, pages 7472-7482, 2019.
[89] Hongyi Zhang, Moustapha Cisse, Yann N Dauphin, and David Lopez-Paz. mixup: Beyond empirical risk minimization. arXiv preprint urXiv:1710.0900 2017.
[90] Jinlai Zhang, Lyujie Chen, Bo Ouyang, Binbin Liu, Jihong Zhu, Yujin Chen, Yanmei Meng, and Danfeng Wu. Pointcutmix: Regularization strategy for point cloud classification. Neuro- computing, 505:58-640 67, 2022.
[91] Tianhang Zheng, Changyou Chen, Junsong Yuan, Bo Li, and Kui Ren. Pointcloud saliency maps. Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 1598-1606, 2019.
[92] Boxuan Zhong, He Huang, and Edgar Lobaton. Reliable iision-based grasping target recognition for upper limb prostheses. IEEE Transactions on Cybernetics, 2020.
[93] Hang Zhou, Kejiang Chen, Weiming Zhang, Han Fang, Wenbo Zhou, and Nenghai Yu. Dup-net: Denoiser and upsampler network for 3d adversarial point clouds defense. In Proceedings of the IEEF/CVF International Conference on Computer Vision, pages 1961-1970, 2019.
[94] Shenchen Zhu, Yue Zhao, Kai Chen, Bo Wang, Hualong Ma, et al. a {AE-Morpher): Improve physical robustness of adversarial objects against (LiDAR-based) detectors via object recon- struction. In 33rd USENIX Security Symposium (USENIX Security 24), pages 7339-7356, 2024.
[95] Xinge Zhu, Hui Zhou, Tai Wang, Fangzhou Hong. Wei Li, Yuexin Ma, Hongsheng Li, Ruigang Yang, and Dahua Lin. Cylindrical and asymmetrical 3d convolution networks for lidar- based perception. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2021.
[96] Yi Zhu, Chenglin Miao, Tianhang Zheng, Foad Hajiaghajani, Lu Su, and Chumming Qiao. Can we use arbitrary objects attack lidar perception autonomous driving? In Proceedings the 2021 ACM SIGSAC Conference on Computer and Communications Security, pages 1945-1960, 2021.
[97] Yifan Zhu, Yibo Miao, Yinpeng Dong, and point clouds. In International Conference on Machine Learning, 2024.
Gao. Toward availability attacks in 3d
16

---

A Proof
Theorem 1. If f satisfies that: [(x) M) for all (F(x) + a)) [(x) -()] S for all x and |a]|p S d, then for any distribution Po and Pa satisfying that Was Pa) ==
(infwen(PP.PP.) (() - ==>))l)) S 7, where nj < then, with probability 7, we have:
Σ (1)) Se
m
V
In(4/2) 2m
T 4M
M
In(4/7) 2m
(A.1)
80
where {a are i.i.d. samples from Pa.
Proof. Assume a joint distribution of Po and Pa. such that (E(ss)))u(l(((a) F(=) ((()F()))))(())) Sn.
Firstly, by Markov inequality, we have that:
P(a,z)mul ( [())) F(2]
P P(r,a)mul( [(xx) F(=)) 8c)
B (( Flx))
(A.2)
"
Then, we have that:
P(..)) - F(z)llp 8) 2 "
E ((x.))=a(((1FF())) F(2))lp 5)]
(A.3)
Now, let (1)) be i.i.d. sampled from distribution u. Then, by Hoeffding inequality, we have that:
(I): with probability - 7/4, there are
1 E I(IF((a))) - F(2"")) 5)
(a - S 60] -v
In(4/7)
(A.4)
2m
In(1/>)
which indicates that there are at least m(1 [[F(z²)) =(> S 5;
In(4/7) 2m
number of E [m]] makes that
(2): with probability 7/4, there are
Im(4/7), 2m
((H)) + 1,))) Σ [(x!) + [[()]] < MV
(A.5)
(3): with probability 1 - 4/4, there are
1 m
Im(4/7))
m Σ f(x!)) Epprs [f(x)] =
m Σ f(x)) [( s My
(A.6)
2m
Let { are i...d samples from distribution Pa, then, by Hoeffding inequality, we have that: (4): with probability - 7/4, there are
m
In(4/7).
(ax) + EppP [s(x)] S M
(A.7)
m
2m
17

---

So, with probability - y makes that (1), (2), (3) and (4) stand, at this times, we can estimate the Ex [z=2)[((2) m 2i=1 f (z;). there are:
Ex~Po [f()]
Σ [(,))) My / /m(a//)
(f(x)) f(22) + M In(4/r)
-= f(4) + c(())(a))) - F2 11
S 6) + MI(II (1 - F > 8)
+ M
in(4/1
2m
- f(2)) + =(11 - -
An(4/T))
+ +(#
in(4/>)
)M + M
Inta/n1
2m
2m
2m
(f(p,(((x)) + +e(1 - dº
In(4/n1
+ (4"
+
In(1/T)
) + 2M V
In(4/T)
2m
2m
2Tm
4 - ((:) + c(1 - yf
[m(4/>))
+
+
In(4/n)
M +3M
Im(4/>)
2m
6
2m
2m
= 1 f(;) + c(1
/In(4/7) 2m
+ M
n
+
4M
im(4/>).
50
60
2m
(A.8)
We get our conclusion.
Our generalization bound can also be extended to Lipschitz neural networks, which are a class of networks with global Lipschitz constants [11, 87].
Corollary A.1. If f satisfies that: f(x) E [0, M)for all a E [0. (f(==
f(x)] <
<lla|lp for all E [0, and a, then for any distribution Po and P. in 10, satisfying that - F(=) S y, then, with probability % Wa "sss (Por Pa) = (infaeI(PP.PP)) (
we have:
1 m
Im(4/7) 2m
M
In(4/7)
E E P. [f(2)]
f(a) + vnn
up + +MM
(A.9)
m
2m
where { are i.i.d. samples from P.. v is any real number greater than 1.
Proof. Assuming is joint distribution of P. and Pa. and makes that (10) =|g)) 1/p & 17. Firstly, by Markov inequality, we have that:
Pl. ([) F(=)llp vn)
P P( [[xx) - F (v7)))
(( [F()))
(A.10)
(1973
(wn)a (1/u)P.
Then, we have that:
- F()))lp S en) 21-1 1
E F(.,))a(T([ (T[[F((x) F(>)llp S vn)) =
(A.11)
Now, let ((r,, pm are i.i.d. samples from distribution u. Then, by Hoeffding inequality, we have that:
(I): with probability
- 7/4, 4, there are
1 Σm [(1=(( F(2))) S (n)(((()))) F(2
(2,5)aul F(())) F(2
(x)) - F(2)]lp] + u In(4/>)
wnv
2m
(A.12)
< (E(e,s)mul [[x()) - F(z) [()) 1/2 + um
In(4/7)
2m
[m(1/7)
= + /
2m
(2): with probability 7/4 there are
1 m m
1 m m
Im(4/7).
(f Σ [(x)) + Ex-P Pe-))==)
Σ [(x() + ((e.))][[[(()] S M
(A.13)
2m
18

---

(3): with probability - 4/4, there are
m
In(4/7)
m Σ f(x))) BoNp. [f(x)] Σ f(x)) B ((,,)))=((l(( & M
(A.14)
2m
Let {ai) are i..d. samples from distribution Pa then, by Hoeffding inequality, we have that:
(4): with probability - 4/4, there are
1
+ E + E [f(x)) S M
m2
In(4/7)
(A.15)
m
2m
So, with probability - y makes that (1), (2), (3) and (4) stand, at this times, we can estimate the [x
m Di=1 fz;). there are:
E If
MM - f(2))) + M in(4/>)
2m
IA IA
m ((x)) 1f(x))))-)-)))))))){()))))))[[ f(+")1 + +M,
In(4/>)
2m
m f((t) - <[]F(())) - FF F(()))
F(2 S un)
- 20) M
(n(d/T)
(A.16)
2m
-E - + wwn Im(4//7
+
M
M
Im(4/>]
2m
2m
[f(,) + c(n 1/n /In(4/7))
+ M 2M
In(4/7)
2m
2m
1 E f(z)) + <(n mn
in(4/7)
M
+ 3M
In(4/x1
We get conclusion.
B Supplementary experimental results
In this section, we provide more experimental results. All of the experiments are conducted on NVIDIA Tesla V100 GPUs.
B.1 The performance in terms of mOA and RmCE
In this section, we present full results for corruption overall accuracy (mOA) and relative mCE (RmCE) [41]. The mOA is computed the average OA over all corruptions. The RmCE quantifies the performance drop compared to a clean test set. We adopt the official baseline DGCNN and
Table B.1: Quantitative results of vanilla training, adversarial training and proposed Frequency Adversarial Training (FAT) the ModelNet-C C test set. Our proposed FAT outperforms all other methods in terms of corrupiion overall accuracy (mOA), which demonstrates effectiveness FAT improving corruption robustness.
Method
OA f
m0A
Rotate
Jitter
Scale
Drop-G
Drop-L
Add-G
Add-L
Vanilla Training
0.926
0.764
0.785
0.684
0.752
0.705
0.725
DOCNN
Ads Training (Ours)
0.925
0.790
0.781
0.816
0.902
0.753
0.772
0.743
0.761
0.925
0.807
Vanilla Training
0.907
0.658
0.591
0.797
0.881
0.876
0.778
0.121
0.562
PointNet
Adv Training
0.904
0.673
0.602
0.889
0.777
0.148
0.591
FAT (Ours)
0.902
0.717
0.666
0.883
0.849
0.889
0.773
0.258
0.724
Vanilla Training
0.930
0.781
0.776
0.725
0.918
0.869
0.793
0.770
0.619
PCT
Adv Training
0.919
0.778
0.776
0.877
0.899
0.774
0.753
0.673
0.693
FAT (Ours)
0.920
0.798
0.783
0.891
0.791
0.744
0.731
0.747
Vanilla Training
0.789
0.789
GDANet
Adv Training
0.926
0.781
0.761
0.840
0.903
0.770
0.764
0.686
0.742
FAT (Qurs)
0.928
0.810
0.749
0.871
0.913
0.803
0.770
0.807
0.756
19

---

Table B.2: Quantitative results of vanilla training, adversarial training and our proposed Frequency Adversarial Training (FAT) the ModelNet-C. test Our proposed FAT outperforms all other methods in terms of relative mCE (RmCE), which demonstrates the effectiveness FAT improving corruption robustness.
Method
OA
RmCE
Roiate
Jitter
Scale
Drop-Gi
Drop-L.
Add-G
Add-L
Vanilla Training
0.926
L,000
1.000
1.000
1,000
1.000
1,000
1,000
1,000
DGCNN
Adv Training
0.925
0.914
1.021
0.450
1.150
0.989
1.150
0.824
0.816
FAT (Ours)
0.925
0.746
0.837
0.281
0.899
0.897
0.947
0.692
0.667
Vanilla Trinning
1.488
0.455
0.178
0.970
3.557
1.716
PointNet
Adv Training
0.904
1.393
2.142
0.339
1.250
0.086
0.955
3.421
1.557
FAT (Ours)
0.902
1.334
1.674
0.079
2.650
0.075
0.970
3.005
0.886
Vanilla Truining
0.930
0.884
1,92
0.847
0.600
0.351
1,030
0.724
1.547
Training
0.919
1.144
1,000
0.833
1.248
1.124
FAT (Ours)
0.920
0.853
0.972
0.120
1.098
0.741
1,323
0.855
0. 0.861
Vanilla Training
0.934
0.865
0.753
0.822
0.600
0.895
0.864
1.090
1.028
GDANet
Ady Training
0.926
0.970
1.170
0.355
1.150
0,897
1,218
1,0866
0.915
(Ours) 0.928
1.270
0.750
0.718
1.188
0.548
0.856
Table B.3: Quantitative results of vanilla training and our proposed Frequency Adversarial Training (FAT) on the ModelNer40-C test set. Our proposed FAT outperforms other methods in terms of mCE, which demonstrates the effectiveness of FAT for improving corruption robustness.
Method
mCE
Uni.
Gouss,
Impluse
Upsamp.
Back.
Ocelu.
LIDAR
Den.inc.
Den. Dec.
Cutout
Rotate
Shear
FTD
RBF
Inv In.RBF
IXICNN
VT
FAT
0.926
0.955
1.000
1,000
1,000
1,000
1.000
1,000
0.952
1.000
1.000
1,000
1,000
1.000
L,000
1,000
1,000
1.000
1,000
PointNet
VT
FXT
0,007
0.902
1.009
1.157
0.850
0.763
0.871
0.731
0.833
0.631
1,763
1.689
0.883
0.904
0.677
0.694
0,710
0.633
0.730
0.778
1,688
1.807
1.308
1.277
1.012
0.979
1,274
PCT
PAT
0.920
0.699
0.584
0.535
0.519
0.908
0.553
0.604
1.091
0.953
0.947
0.759
0.653
0.757
0.753
0.872
0.858
01814
0.647
0.644
GDANer
VT
1.954
0.869
0.950
0.995
0.912
0.864
0.801
0.987
0.829
0.698
0.690
0.777
0.947
0.914
0,883
0.900
0.885
EXT
0.923
0.764
0.645
0,604
0,502
0.579
0,508
0.998
0.817
0.776
0.805
0.819
L.029
0.979
0.858
0.758
0.753
initially calculate the relative corruption error (RCE) for a given corruption type by averaging over Eim (OAciean OA.,)
5 severity levels: RCE, Σm (OA (OA BUCNN -OA where OAclean is the overall accuracy on the clean
clean test set. Subsequently, we compute the relative mean corruption error (RmCH) by averaging over the 7 corruption types: RmCE
N' Σ RCE, In Tables B. I and B.2, we compare different methods based on the mOA and RmCE metrics, confirming that our proposed FAT enhances the model's 's out-of-distribution generalization ability.
B.2 The performance on the ModelNet40-CC
In this section, we evaluate the corruption robustness on ModelNet4O-C [51]. The ModelNet4O- dataset is specifically designed to assess the network robustness against prevalent point cloud corruptions. It consists of 15 different corruption types, including "Uniform", "Gaussian", "Impulse", "Upsampling". "Background", "Occlusion" " "LiDAR", "Local Density Inc", "Local Density Dec". "Cutout", "Rotation", "Shear", "FFD", "RBF", and "Inv RBF". Each type of corruption has 5 severity
Table B.4: Quantitative results of the performance of FAT when integrated with data augmentation strategy in terms of mCE and FR the ModelNerãO-C test set. In previous studies [51], PCT with CutMix-R achieves the best robustness with the 0.635 mCE and 0. 0.163 ER... However, training GDANet with the combination of our proposed FAT with WOLFMix achieves the new of performance, with the impressive 0.555 mCE and 0.147 ER
Metbod
OA
mCE.
Noise
Density
Trans.
ER
Noise
Density
Trans.
PCT+CuIMEx-R
0.469
0.669
0.766
0.105
0.112
PCT+WOLFFME
0.922
0.627
0.580
0.673
0.629
0.158
0.118
0.267
0.090
PCT+WOI. FMI (Ours)
0.454
0.636
0.097
0.094
GDANet-WOLFSS GDANet+ WOL FMI (Ours)
0.920
0.669
0.709
0.685
0.612
0.171
0.137
0.289
0.087
0.930
0.555
0.450
0.627
0.588
0.147
0.094
0.263
0.084
20

---

Table B.5: Quantitative results of vanilla training. adversarial training. DUP Defense and our proposed Frequency Adversarial Training (FAT) on the ScanOhjectNN-C terms mean corruption error (mCE), which demonstrates effectiveness FAT improving corruption robustness.
Our proposed FAT outperforms all other methods
Method
OA f
mCE
Rotate
Jitter
Scale
Drop-G
Drop-1.
Add-G
Add-L
Vanilla Training
0.858
1.000
1,000
1.000
1.000
DOCNN
Ady Training
0.843
1.062
1.146
0.778
1.097
0.873
0.960
1.185
1.396
DUP Defense
FAT (Ours)
0.856
0.933
0.968
0.815
0.959
0.852
0.950
0.959
1.026
Vanilla Training
0.739
1354
1,610
0.884
1.427
0.786
1,264
1.487
2.022
PointNet
Adv Training
0.725
1.334
1.532
0.844
1.403
0.873
1.333
1.474
1888
DUP Defense
FAT (Our)
0.734
1,254
1,393
0.796
1.465
0.844
1,264
1,259
1,759
Vanilla Training
0.873
0.921
0.995
L,099
0.803
0.807
0.942
0.944
0.875
PointNext
Adv Training
0,870
0.901
0.991
1.027
0.803
0.833
0.929
0.912
0.809
DUP Defense
FAT (Our)) 0.875
0.877
0.998
0.916
0.791
0.786
0.867
0.938
0.840
Table B.6: Quantitative results of vanilla training. adversarial training. DUP Defense and our proposed Frequency Adversarial Training (FAT) the PointNeXt ModelNet-C. Our proposed FAT outperforms all other methods terms mean corruption error (mCF), which demonstrates effectiveness FAT improving comruption robustness.
Method
OA
mCE L
Rotale
Jitler
Scale
Drop G
Drup-L.
Add-G
Add-L
Vanilla Training
0.932
0.856
1.297
0.276
PointNeXt
Adv Training
0.924
0.834
1.593
0.716
1.025
0.876
1.144
0.230
0.25
Defense
0.919
0.840
1.461
0.838
1.192
0.715
1.188
0.224
0.262
FAT (Ours) 0.930
0.781
1.412
0.692
0.986
0.827
1.082
0.230
0.241
levels. In Table B.3, we compare different methods on the ModelNer4O-C test set, confirming that proposed FAT enhances the OOD generalization ability of the model.
In Table B.4, we show the performance of FAT when integrated with data augmentation strategy in terms of mCE and ER In previous studies [51], PCT with CutMix-R achieves the best robustness with the 0.635 mCE and 0.163 ER However, training GDANet with the combination of our proposed FAT with WOLFMix achieves new state-of-the-art performance, with the impressive 0.555 mCE and 0. 1.147PB ER
B.3 The performance the ScanObjectNN-C
We further conduct experiments on the ScanObjectNN dataset, which is collected by LiDAR sensors and represents more realistic conditions under real-world scenarios [2, 58, 96, 94]. The experimental settings and evaluation metrics on ScanObjectNN-C [62] are consistent with those on ModelNet-C The results are shown in Table B.5. It can be seen that our FAT generally leads to lower mCE on ScanOhjectNN-C. The experimental results on ScanObjectNN-C further validate the generalizability and applicability of our FAT under real-world conditions.
B.4 The performance on the PointNeXt
We further conduct experiments for the updated point cloud model PointNeXt [37]. The results in Table B.5 and Table B.6 demonstrate that FAT achieves consistent performance the advanced network architecture PointNeXt, similar to observations on PointNet and more. Our FAT outperforms all other methods in terms of mCE. This indicates that FAT's performance largely independent of the underlying model architecture, making it applicable to both traditional and modern networks.
B.5
The performance in combination with AdaptPoint
We further conduct experiments for comparison with AdaptPoint [62] on ScanObjectNN-C. Adapt- Point follows the official experimental settings. The results are shown Table B.7. It evident that incorporating FAT achieves lower mCE, indicating its superiority.
21

---

Table B.7: Quantitative results of combining FAT with AdaptPoint on ScanObjectNN-C. Compared with single AdaptPoint, the combination of FAT and AdaptPoint achieves better mCF.
Method
OA
mCE
Rotate
Jitter
Scale
Drop-G
Drop-L
Add-G
Add-L
PoiniNet
AdapiPoint
0.743
1,256
1.359
0.875
1.519
0.676
1.112
1.448
1.804
AdapiPointsFAT (Ours)
1.196
1.125
PointNext
AdaptPoint
0.885
0.783
0.767
1,030
0.810
0.508
0.628
0.911
0.824
AdapUPoint=FAI (Ours)
0.748
0.648
22

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification:
Our paper supports the claims made in the abstract and introduction.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results
be expected to generalize other settings.
is fine to include aspirational goals as motivation as long is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification:
We have discussed limitations in Section 5.
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification. asymptotic approximations only holding locally). The authors should reflect how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low images are taken in low lighting. Or speech-to-text system might be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach address problems of privacy and faimess.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't 't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory Assumptions and Proofs
Question:
For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [Yes]
23

---

We have provided the full set of assumptions in every theorem and made complete proof in Appendix A.
Justification:
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced in the statement of any theorems.
The proof's can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should properly referenced.
4. Experimental Result Reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Question:
Answer: [Yes]
Justification:
We have provided reproductive details in Section 4.1 and Appendix B.
Guidelines:
The answer NA means that the paper does include experiments. If the paper includes experiments, No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g.. in the case of large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make it clear how reproduce that algorithm. (b) If the contribution is primarily
model architecture, the paper should describe the architecture clearly and fully.
(c) If the contribution is a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome deseribe the particular way they provide for reproducibility, In the case of closed-source models, it may be that access to the model is limited in some way (e.g., registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
24

---

Answer: [Yes]
Justification:
We have provided our codes in the supplemental matrial.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (https://nips) cc/
for more details.
While we encourage the release of code and data, we understand that this might not be possible, "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (c.g., for a new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https: /Codeeuomiisseeeeeeee
/nips. wwtpccccpppcccaecccccccccccccclt Sondei/eeideeeeeeeuuiiiiiiii ssisssslicyyy for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible supplemental material (appended the paper) is recommended, but including URLs to data and code is permitted.
6. Experimental Setting/Details
Does the paper specify all the training and test details (c.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary understand the results?
Question:
Answer: [Yes]
Justification:
We have provided experimental details Section 4.1 and Appendix B.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core the paper to a level of detail that is necessary appreciate the results and make sense of them.
The full details can be provided either with the code, appendix, as supplemental material.
7. Experiment Statistical Significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer: [No]
Justification: For fair comparison, do not provide error bars because there many baseline methods, it computationally expensive to reproduce all of these methods.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, statistical significance tests, least for the experiments that support the main claims of the paper.
The factors of variability that the enror bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
25

---

It should be clear whether the error bar is the standard deviation or the standard error of the mean.
is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables figures symmetric error bars that would yield results that are out range (e.g. negative error rates).
If error bars are reported in tables or plots, The authors should explain the text how they were calculated and reference the corresponding figures tables in the text.
8. Experiments Compute Resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification: Justification: We have provided them in Appendix B.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make it into the paper).
9. Code Of Ethics
Question: Does the research conducted in the paper conform, in every respect, with the cscuidel NeurIPS Code of Ethics https: : http///eerrrp..eee http:p////errpp..ppppubii/////// ie ines?
Answer: [Yes]
Justification: Our paper conforms with the NeurIPS Code of Ethics.
Guidelines:
The answer NA means that the authors have reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., there a special consid- eration due to laws or regulations in their jurisdiction).
10. Broader Impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification:
We have discussed them in Appendix 5.
Guidelines:
The answer NA means that there no societal impact of the work performed.
If the authors answer NA or No. they should explain why their work has no socictal impact why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
26

---

The conference expects that many papers will be foundational research and not tied particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, scraped datasets)?
Question:
Answer: [NA]
Justification: Our paper poses no such risks.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Question: Are the creators or original owners of assets (e.g.. code, data, models), used in the paper. properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification: We use open-source dataset and models our paper, and have cited the original paper of these dataset and models.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (c.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswi thcode. com datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
27

---

If this information is not available online, the authors are encouraged to reach out to the asset's 's creators.
13. New Assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Justification: Our paper does not release new assets.
Guidelines:
The answer NA means that the paper does not release new assets,
Researchers should communicate the details of the dataset/code/moodl as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and Research with Human Subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification: Our paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsoureing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According the NeurIPS Code of Ethies, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: Our paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing research with human subjects.
Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurlPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
28


Reviews:
[{"review_id": "fnJX37cbTN", "reviewer": "Reviewer_kjym", "summary": "This paper introduces a novel approach to improving the robustness of 3D point cloud recognition models by introducing Frequency Adversarial Training (FAT). By analyzing the frequency space of point clouds through the graph Fourier transform, the authors found that models are sensitive against different frequency bands of corruptions. To reduce the effect of both low and high frequency corruptions, the authors propose FAT, which introduces adversarial examples during training that were generated by perturbing the point cloud’s frequency space and taking the inverse graph Fourier transform. From the authors’ experiments, FAT significantly improved the robustness of point cloud recognition models and was able to achieve a new state-of-the-art performance.", "questions": "It will be great to see some results on real-world datasets such as KITTI.", "limitations": "N/A", "rating": 6, "confidence": 4, "soundness": 4, "presentation": 4, "contribution": 3, "strengths": "The authors introduce an original analysis of point cloud recognition models by quantifying the sensitivity of these models against low-frequency disruptions, such as rotations, and high-frequency disruptions, such as jittering. Frequency adversarial training is also an innovative approach to improving the robustness of these models against these disruptions, utilizing the graph Fourier transform to adversarially train against low and high-frequency distortions within the frequency space. The writing, extensive experiments, and theoretical analysis provided by the authors effectively and clearly show the positive impact FAT has on the robustness of point cloud recognition models. The use of a point cloud’s frequency space and application of FAT have the capacity to have significant impacts on future research in point cloud models beyond 3D recognition models.", "weaknesses": "While the paper mentions the importance of robust models for real-world applications, it exclusively evaluates models trained with FAT on synthetic datasets like ModelNet-C and ModelNet40-C. Evaluating FAT using data from sensors such as LiDAR would further show FAT’s applicability under real-world conditions (such as KITTI dataset, if possible). Additionally, the paper does not discuss the complexity and efficiency of FAT, which are important factors for real-world applications.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for appreciating our new contributions as well as providing the valuable feedback. Below we address the detailed comments, and hope that you can find our response satisfactory.\n\n***Question 1: The paper would be more convincing by using real-world data from LiDAR sensors, such as KITTI dataset.***\n\nThanks for the valuable suggestion. We further conduct experiments on the KITTI and ScanObjectNN datasets, both collected by LiDAR sensors. \nExperiments on these two real-world datasets further validate the superiority and practicality of our FAT.\nThe experimental settings and evaluation metrics on ScanObjectNN-C [1] are consistent with those on ModelNet-C.\nThe KITTI-C dataset [2] includes four major types of corruptions: Weather-level (e.g., Strong Sunlight), Sensor-level (e.g., Density Decrease), Motion-level (e.g., Moving Object), and Object-level (e.g., Local Gaussian Noise). Following [2], we use $AP_{cor}$ (corruption average precision) at moderate difficulty as the evaluation metric on KITTI-C, where higher values indicate better performance. We employ the representative 3D object detection model PointPillars. The results are shown below.\n\n\n|KITTI-C|Method|$AP_{clean}$|mean $AP_{cor}$|Weather-level $AP_{cor}$|Sensor-level $AP_{cor}$|Motion-level $AP_{cor}$|Object-level $AP_{cor}$|\n|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|\n|PointPillars|Vanilla Training|78.34|65.35|63.39|75.33|49.61|73.05|\n||Adv Training|74.86|62.96|51.97|78.68|51.43|69.77|\n||DUP Defense|72.02|63.98|58.19|78.05|48.21|71.46|\n||FAT (Ours)|78.06|**67.02**|60.81|79.19|54.71|73.39|\n\n\n|ScanObjectNN-C|Method|OA|mCE|Rotate|Jitter|Scale|Drop-G|Drop-L|Add-G|Add-L\n|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|\n|DGCNN|Vanilla Training|0.858|1.000|1.000|1.000|1.000|1.000|1.000|1.000|1.000| \n||Adv Training|0.843|1.062|1.146|0.778|1.097|0.873|0.960|1.185|1.396|\n||DUP Defense|0.832|1.029|1.195|0.833|1.157|1.197|1.214|0.773|0.834|\n||FAT (Ours)|0.856|**0.933**|0.968|0.815|0.959|0.852|0.950|0.959|1.026|\n|PointNet|Vanilla Training|0.739|1.354|1.610|0.884|1.427|0.786|1.264|1.487|2.022|\n||Adv Training|0.725|1.334|1.532|0.844|1.403|0.873|1.333|1.474|1.881|\n||DUP Defense|0.712|1.348|1.717|0.825|1.555|1.157|1.480|0.829|1.875|\n||FAT (Ours)|0.734|**1.254**|1.393|0.796|1.465|0.844|1.264|1.259|1.759|\n|PointNext|Vanilla Training|0.873|0.921|0.995|1.079|0.803|0.807|0.942|0.944|0.875|\n||Adv Training|0.870|0.901|0.991|1.027|0.803|0.833|0.929|0.912|0.809|\n||DUP Defense|0.859|0.901|0.980|1.046|0.826|0.748|0.973|0.923|0.809|\n||FAT (Ours)|0.875|**0.877**|0.998|0.916|0.791|0.786|0.867|0.938|0.840|\n\nIt can be seen that our FAT generally leads to lower mCE (mean corruption error) on ScanObjectNN-C and higher $AP_{cor}$ (average precision) on KITTI-C. The experimental results on both KITTI and ScanObjectNN datasets further validate the generalizability and applicability of our FAT under real-world conditions. We will add the results in the revision.\n\n***Question 2: The paper does not discuss the complexity and efficiency of FAT.***\n\nThanks for the suggestion.\nThe complexity of FAT implementation primarily involves generating high-frequency and low-frequency adversarial examples. \nCompared to standard adversarial training and other data augmentations, FAT incurs approximately $1.7 \\sim 3.2$ times higher computational costs.\nDespite this limitation, such an increase in computational overhead is deemed acceptable for offline training scenarios. \nMoreover, our approach would not affect the efficiency of model inference, ensuring unhindered deployment of well-trained models in practical applications.\nWe will add the discussion in the revision.\n\n\n[1] Sample-adaptive Augmentation for Point Cloud Recognition Against Real-world Corruptions, ICCV 2023\n\n[2] Benchmarking Robustness of 3D Object Detection to Common Corruptions in Autonomous Driving, CVPR 2023", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "IefXMt08no", "reviewer": "Reviewer_WzcS", "summary": "This paper studies how to enhance the robustness of 3D point cloud recognition. The authors propose Frequency Adversarial Training (FAT) to improve the corruption robustness of 3D point cloud recognition models. FAT trains a model with adversarial examples that add perturbations to the frequency-domain representations of point clouds.", "questions": "Q1: As mentioned earlier in your paper, the corruption of 3D point clouds often occurs in real-world applications due to environmental noise and reflections. For instance, in autonomous driving scenarios, the LiDAR sensor may only capture partial points of the target vehicle because of occlusion and distance effects. However, this paper does not study those real-world data. I am curious whether your method would be effective on real-world datasets, such as the KITTI and Waymo driving datasets. Solely using ModelNet40 is not convincing.\n\nQ2: Can the proposed approach maintain good performance when considering specific attack methods, such as those using adversarial points with specific shapes, locations, and rotation angles?\n\nQ3: Modifications in the frequency domain can sometimes result in physically unrealizable transformations in the spatial domain. Will this limit the application of your work in real-world scenarios?\n\nQ4: Can the authors provide more details on the reasons for using GFT rather than DCT or other frequency transformation methods?\n\nQ5: What would be the outcome if medium frequency bands were modified? The proposed methods seem to only consider high and low frequencies.", "limitations": "Yes.", "rating": 5, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "- The problem studied in this paper is important. \n\n- The authors propose generating the adversarial sample in the frequency domain, which is interesting.\n\n- This paper considers several baseline methods.", "weaknesses": "- This paper considers limited real-world applications. 3D point cloud recognition often fails due to LiDAR sensor inaccuracies and changes in the physical environment. However, this paper only utilizes one dataset, ModelNet40, where points are generated via 3D modeling techniques instead of being collected from real-world sensors, which is not convincing. If the paper aims to address real-world problems, it would be more convincing to include more real-world datasets, such as the KITTI dataset, where point clouds are collected from LiDAR sensors. \n\n- The defense performance does not significantly outperform baseline methods. As shown in Table 1, FAT only outperforms baseline methods by a few points. Moreover, the proposed method appears to be effective only when combined with other data augmentation techniques. Could the authors provide more details and an explanation of the phenomenon of the ‘surprising results’ mentioned in the paper? For example, why does mixing methods result in much better defense?\n\n- This paper does not analyze the relationship between the frequency and spatial domains in the context of the 3D point cloud. The two domains are mutually transformable, but the paper does not provide insights into their relationships or general observations.\n\n- The paper only studies the defense effects against general 3D data corruptions without considering specific attack methods. It remains unclear if this approach can also defend against specific attack methods targeting 3D perception, such as attacks using adversarial points with specific shapes, locations, and rotation angles. The following are a few works about attacks against LiDAR object detection in autonomous driving scenarios [1-4] for reference.\n\n[1] Yulong Cao, Chaowei Xiao, Dawei Yang, Jing Fang, Ruigang Yang, Mingyan Liu, and Bo Li. 2019. Adversarial objects against lidar-based autonomous driving systems. arXiv preprint arXiv:1907.05418 (2019).\n[2] James Tu, Mengye Ren, Sivabalan Manivasagam, Ming Liang, Bin Yang, Richard Du, Frank Cheng, and Raquel Urtasun. 2020. Physically realizable adversarial examples for lidar object detection. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition.\n[3] Yi Zhu, Chenglin Miao, Tianhang Zheng, Foad Hajiaghajani, Lu Su, and Chunming Qiao. 2021. Can we use arbitrary objects to attack lidar perception in autonomous driving?. In Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security.\n[4] Shenchen Zhu, Yue Zhao, Kai Chen, Bo Wang, Hualong Ma, and Cheng’an Wei. 2024. AE-Morpher: Improve Physical Robustness of Adversarial Objects against LiDAR-based Detectors via Object Reconstruction. In Proceedings of the 33rd USENIX Security Symposium.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for appreciating our new contributions as well as providing the valuable feedback. Below we address the detailed comments, and hope that you can find our response satisfactory.\n\n***Question 1: The paper would be more convincing by using real-world data from LiDAR sensors, such as KITTI dataset.***\n\nThanks for the valuable suggestion. We further conduct experiments on the KITTI and ScanObjectNN datasets, both collected by LiDAR sensors. \n***Due to space constraints, detailed experimental results and analysis are presented in the Global Rebuttal.***\nExperiments on these two real-world datasets [1][2] further validate the superiority and practicality of our FAT.\n\n***Question 2: Why does the proposed method appear to be significantly more effective when combined with other data augmentation techniques?***\n\nFAT operates in the frequency domain and considers the underlying structure of compactly represented 3D point clouds, while traditional data augmentation methods focus on spatial transformations within the 3D data itself. \nTherefore, attributed to the complementary and compatible information from both the spatial and frequency domains, mixing methods result in much better defense.\n\n***Question 3: The paper does not analyze the relationship between the frequency and spatial domains in the context of the 3D point cloud.***\n\nThanks for the suggestion.\nSimilar to 2D images, the rough shape in point clouds’ spatial domain is represented by transformed low-frequency components while the fine details of objects are encoded in transformed high-frequency components.\nFurthermore, the frequency characteristics of point clouds represent higher level and global information than point-to-point relations in spatial domain. That is, the frequency representation encodes more abstract and essential contexts for recognizing the point cloud.\nThis implies that in the frequency domain, point clouds are compactly represented, facilitating a better understanding of low-level distortions that are free of high-level semantics.\nWe will incorporate this analysis in the revision.\n\n***Question 4: The paper only studies the defense effects against general 3D data corruptions without considering specific attack methods.***\n\nThanks for the suggestion.\nActually, FAT can enhance the models’ robustness against adversarial attacks to some extent. \nThe enhanced PointNet model on ModelNet40 achieves the adversarial accuracy of 31.2\\% under PGD-20 at $\\epsilon$ = 0.05, compared to 0\\% for the standard trained PointNet.\nThe enhanced PointPillars model on KITTI achieves a defense accuracy of 65.5\\% with IoU greater than 0.7 against Tu's attack method [3], and 56.8\\% against Zhu's attack method [4], compared to 42.5\\% and 26.0\\% for the standard trained PointPillars model.\nWe will include more comprehensive experimental results and discussions on defending against adversarial attacks in the revision, including references and analyses of specific attack methods [3][4][5][6].\n\n***Question 5: Modifications in the frequency domain can sometimes result in physically unrealizable transformations in the spatial domain. Will this limit the application of your work in real-world scenarios?***\n\nNo, it does not limit applicability. As a training method, FAT only needs to consider transformations in the digital world, which is always feasible regardless of the scenario, unlike attack methods that must consider physical implementation.\n\n***Question 6: Can the authors provide more details on the reasons for using GFT rather than DCT or other frequency transformation methods?***\n\nImages are typically transformed in the frequency domain with the 2D discrete Fourier transform (DFT) or discrete cosine transform (DCT). Different from images supported on regular grids, although 3D point clouds are highly structured, they reside on irregular domains without an ordering of points, hindering the deployment of traditional Fourier transforms. \nSpecifically, an image represented as $\\mathbb{R}^{n \\times n}$ is regularly sampled on a grid, ensuring that pixels $(i, j)$ and $(i+1, j)$ are adjacent. In contrast, a point cloud represented as $\\mathbb{R}^{n \\times 3}$ lacks such ordering of points, where the Euclidean distance between the $i$-th and $(i+1)$-th points can be substantial. Traditional Fourier transforms cannot be directly applied to point clouds due to their unordered nature and loss of relative positional information.\nHowever, graphs provide a natural and accurate representation of irregular point clouds. \nEach point in a point cloud is treated as a vertex, connected to its $K$ nearest neighbors, with each point's coordinates serving as graph signals.\nOnce a graph is constructed to represent the point cloud, the graph Fourier transform (GFT) can compactly transform it into the frequency domain by leveraging the edges of the graph to encode relative positional information.\n\n***Question 7: What would be the outcome if medium frequency bands were modified?***\n\nThanks for the suggestion. We further conduct more ablation studies among FAT, as well as FAT variants: FAT with only medium-frequency modified, FAT with only low-frequency modified, and FAT with only high-frequency modified.\n***Due to space constraints, detailed experimental results and analysis are presented in the subsequent comments.***\nWe will incorporate these additional experiments into the revision.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "XCYN2DlN1H", "reviewer": "Reviewer_wa2k", "summary": "This paper introduces Frequency Adversarial Training (FAT), leveraging Graph Fourier Transform (GFT) to enhance robustness against point cloud corruptions by training models with frequency-domain adversarial examples, demonstrating significant improvements in robustness across various architectures through extensive experiments.", "questions": "Refer to the Weakness. I will improve my rates when the weaknesses are solved.", "limitations": "Refer to the Weakness.", "rating": 5, "confidence": 5, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1.\tInnovative Approach: The use of the frequency domain for analyzing and improving the robustness of point cloud recognition models is novel and well-motivated. The application of GFT to understand the impact of corruptions on different frequency bands is a significant contribution.\n2.\tComprehensive Evaluation: The paper provides a thorough evaluation of the proposed method, comparing it with existing approaches and demonstrating its effectiveness across multiple models and datasets.\n3.\tTheoretical and Empirical Validation: The authors provide both theoretical analysis and empirical evidence to support the effectiveness of FAT, strengthening the credibility of their claims.\n4.\tPractical Relevance: Improving the robustness of 3D point cloud recognition models is highly relevant for safety-critical applications such as autonomous driving and robotics.\n5.\tWriting quality: This paper is written and organized well", "weaknesses": "1.\tComplexity of Implementation: The proposed FAT method involves several complex steps, including the generation of high-frequency and low-frequency adversarial examples and the use of multiple batch normalizations. This complexity might hinder the adoption of the method in practical scenarios.\n2.\tLimited Impact on Clean Accuracy: The paper mentions a slight reduction in clean accuracy when using FAT, which might be a concern for applications where both robustness and accuracy are critical.\n3.\tGenerality of Results: While the experiments demonstrate the effectiveness of FAT on several models and datasets, additional experiments on more diverse datasets and real-world scenarios could further validate the generalizability of the approach, e.g.ShapeNet-C[1] and ScanObjectNN-C[2] \n4.\tLack of Updated Baselines in Experiments: In Table 1, the paper lacks experiments comparing some updated point cloud baselines, like RPC[3] and PointNeXt[4], which could provide a more comprehensive evaluation of the proposed method.\n5.\tMissing Comparison with Updated Augmentation Methods: In Table 2, the paper lacks comparison with updated augmentation methods such as AdaptPoint[2], which could highlight the relative performance of FAT against newer augmentation techniques.\n\n[1]: PointCloud-C: Benchmarking and Analyzing Point Cloud Perception Robustness under Corruptions\n[2]: Sample-adaptive Augmentation for Point Cloud Recognition Against Real-world Corruptions\n[3]: Benchmarking and Analyzing Point Cloud Classification under Corruptions\n[4]: PointNeXt: Revisiting PointNet++ with Improved Training and Scaling Strategies", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for acknowledging the novelty of our paper as well as providing the valuable feedback. Below we address the detailed comments, and hope that you can find our response satisfactory.\n\n***Question 1: Complexity of Implementation might hinder the adoption of the method in practical scenarios.***\n\nThe computational cost of our FAT implementation primarily involves generating high-frequency and low-frequency adversarial examples. \nCompared to standard adversarial training and other data augmentations, FAT incurs approximately $1.7 \\sim 3.2$ times higher computational costs.\nDespite this limitation, such an increase in computational overhead is deemed acceptable for offline training scenarios. \nMoreover, our approach would not affect the efficiency of model inference, ensuring unhindered deployment of well-trained models in practical applications.\nWe will add the discussion in the revision.\n\n***Question 2: The paper mentions a slight reduction in clean accuracy when using FAT, which might be a concern for applications.***\n\nIn our limitations section, we have already noted that while FAT slightly reduces clean accuracy, the magnitude of this reduction is minimal and deemed acceptable. This could be attributed to the inherent trade-off between accuracy and robustness [1]. \nMoreover, as shown in Table 2, existing data augmentation methods decrease clean accuracy by an average of 1.03\\%, whereas our FAT exhibits a smaller average reduction of 0.55\\% in clean accuracy. \nAdditionally, Table 2 demonstrates that incorporating FAT results in an average improvement of 0.33\\% in clean accuracy, indicating that FAT's impact on clean accuracy is not universally negative.\n\n***Question 3: The paper would be more convincing by additional experiments on more diverse datasets and real-world scenarios.***\n\nThanks for the valuable suggestion. We further conduct experiments on the KITTI and ScanObjectNN datasets, both collected by LiDAR sensors. \n***Due to space constraints, detailed experimental results and analysis are presented in the Global Rebuttal.***\n(See more results on ScanObjectNN-C in response to Question 5). \nExperiments on these two real-world datasets [2][3] further validate the superiority and practicality of our FAT.\n\n***Question 4: The paper lacks experiments comparing some updated point cloud baselines, which could provide a more comprehensive evaluation of the proposed method.***\n\nThanks for the valuable suggestion. We further conduct experiments for PointNeXt [4] on ModelNet-C and ScanObjectNN-C below. (See more results on PointNeXt in response to Question 5.)\n\n|ModelNet-C|Method|OA|mCE|Rotate|Jitter|Scale|Drop-G|Drop-L|Add-G|Add-L\n|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|\n|PointNext|Vanilla Training|0.932|0.856|1.460|1.297|0.904|0.847|0.957|0.251|0.276|\n||Adv Training|0.924|0.834|1.593|0.716|1.025|0.876|1.144|0.230|0.251|\n||DUP Defense|0.919|0.840|1.461|0.838|1.192|0.715|1.188|0.224|0.262|\n||FAT (Ours)|0.930|**0.781**|1.412|0.692|0.986|0.827|1.082|0.230|0.241|\n\n|ScanObjectNN-C|Method|OA|mCE|Rotate|Jitter|Scale|Drop-G|Drop-L|Add-G|Add-L\n|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|\n|PointNext|Vanilla Training|0.873|0.921|0.995|1.079|0.803|0.807|0.942|0.944|0.875|\n||Adv Training|0.870|0.901|0.991|1.027|0.803|0.833|0.929|0.912|0.809|\n||DUP Defense|0.859|0.901|0.980|1.046|0.826|0.748|0.973|0.923|0.809|\n||FAT (Ours)|0.875|**0.877**|0.998|0.916|0.791|0.786|0.867|0.938|0.840|\n\nThe results demonstrate that FAT achieves consistent performance on the advanced network architecture PointNeXt, similar to observations on PointNet and more.\nOur FAT outperforms all other methods in terms of mCE.\nThis indicates that FAT's performance is largely independent of the underlying model architecture, making it applicable to both traditional and modern networks. We will incorporate these additional experiments into the revision.\n\n***Question 5: The paper lacks comparison with updated augmentation methods such as AdaptPoint, which could highlight the relative performance of FAT against newer augmentation techniques.***\n\nThanks for the valuable suggestion. We further conduct experiments for comparison with AdaptPoint [2] on ScanObjectNN-C. AdaptPoint follows the official experimental settings [2]. The results are shown below.\n\n|ScanObjectNN-C|Method|OA|mCE|Rotate|Jitter|Scale|Drop-G|Drop-L|Add-G|Add-L\n|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|\n|PointNet|AdaptPoint|0.743|1.256|1.359|0.875|1.519|0.676|1.112|1.448|1.804|\n||+ FAT|0.744|**1.196**|1.370|0.823|1.446|0.690|1.125|1.220|1.701|\n|PointNext|AdaptPoint|0.885|0.783|0.767|1.030|0.810|0.508|0.628|0.911|0.824|\n||+ FAT|0.885|**0.761**|0.748|0.948|0.833|0.521|0.648|0.829|0.802|\n\nIt is evident that incorporating FAT achieves a lower mCE, indicating its superiority. We will integrate these results into Table 2 and continue to include more comprehensive experiments as per your recommendations in the revised version.\n\n[1] Theoretically Principled Trade-off between Robustness and Accuracy, ICML 2019\n\n[2] Sample-adaptive Augmentation for Point Cloud Recognition Against Real-world Corruptions, ICCV 2023\n\n[3] Benchmarking Robustness of 3D Object Detection to Common Corruptions in Autonomous Driving, CVPR 2023\n\n[4] PointNeXt: Revisiting PointNet++ with Improved Training and Scaling Strategies, NeurIPS 2022", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "dbzihBbrwJ", "reviewer": "Reviewer_ELyT", "summary": "This work introduces a method called Frequency Adversarial Training (FAT) to improve the robustness of 3D point cloud recognition models and examines the robustness of models under 3D point cloud corruptions, including analysis on the power of different corruption effects in the frequency domain.  FAT generates adversarial samples by adding perturbations to the frequency representations of point cloud data. The authors also provide a theoretical analysis demonstrating the effectiveness of FAT in improving  OOD generalization performance of models.", "questions": "1. Adversarial augmentation approaches may require substantial computational resources, leading to inefficiency. How much computational resources does FAT require regarding computational time, memory usage, etc., and how does it compare with other augmentation approaches.", "limitations": "The authors address the limitation of their approach in term of the degraded standard accuracy. There might be a trade-off between corruption robustness and standard performance, left for future investigation.", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The paper is well-structured and organized, making it easy to understand and follow. \n2. Introduces a novel concept of frequency augmentation for 3D point cloud data, while previous works  are mainly mix-based and deformation-based on original point cloud data rather than their frequency representation.\n3. The proposed method considers distribution shifts caused by adversarial perturbations and thus uses separate batch normalization layers,    improving model robustness against both low-frequency and high-frequency corruptions. The authors also provide an ablation study demonstrating the effectiveness of each component in improving robustness.\n4. The authors provide theoretical analysis showing that adversarial robustness in the frequency domain enhances real-world corruption robustness, and a frequency sensitivity measurement which offers valuable insights for analyzing model robustness from a frequency perspective.", "weaknesses": "1. There is confusion in the caption of Figure 3, which suggests the Jacobian matrix for an input point cloud. According to the context, it should be the Jacobian matrix of the model regarding the input point cloud.\n2.  As FAT is based on adversarial training, it is expected to have comparisons with other adversarial training techniques rather than only mixing- and deformation-based approaches. \n3. Minors: \n*The figures are hard to read as the font size is too small.\n*Missing space before the fourth sentence in the caption of Figure 3.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for appreciating our new contributions as well as providing the valuable feedback. Below we address the detailed comments, and hope that you can find our response satisfactory.\n\n***Question 1: There is confusion in the caption of Figure 3, which suggests the Jacobian matrix for an input point cloud. According to the context, it should be the Jacobian matrix of the model regarding the input point cloud.***\n\nThanks for pointing out this issue. We will clarify this in the revision.\n\n***Question 2: As FAT is based on adversarial training, it is expected to have comparisons with other adversarial training techniques rather than only mixing- and deformation-based approaches.***\n\nWe have already compared our proposed FAT with adversarial training technique on the ModelNet-C test set in Table 1 in Sec. 4.2. Our FAT outperforms all other methods in terms of mCE (mean corruption error).\n\n***Question 3: Minors: The figures are hard to read as the font size is too small. Missing space before the fourth sentence in the caption of Figure 3.***\n\nThanks for pointing out these issues. We will correct them in the revision.\n\n***Question 4: How much computational resources does FAT require regarding computational time, memory usage, etc., and how does it compare with other augmentation approaches.***\n\nThe computational cost of our FAT implementation primarily involves generating high-frequency and low-frequency adversarial examples. \nCompared to standard adversarial training and other data augmentations, FAT incurs approximately $1.7 \\sim 3.2$ times higher computational costs and about 3 times more memory usage.\nDespite this limitation, such an increase in computational overhead is deemed acceptable for offline training scenarios. \nMoreover, our approach would not affect the efficiency of model inference, ensuring unhindered deployment of well-trained models in practical applications.\nWe will add the discussion in the revision.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:
We deeply appreciate all the reviewers for their insightful and constructive reviews of our manuscript. Delightfully, we are glad that the reviewers found that:

- ***The presentation of our paper is polished and easy to understand.*** (Reviewers kjym, wa2k, ELyT)

- ***The problem studied in our paper is important*** for safety-critical applications such as autonomous driving and robotics. (Reviewers kjym, WzcS, wa2k)

- ***Our idea is novel, interesting, and well-motivated.*** (Reviewers kjym, WzcS, wa2k, ELyT)

- ***The performance of our apporach is well-justified, promising, and effective.*** (Reviewers kjym, wa2k, ELyT)

- ***The theoretical analysis of our paper offers valuable insights*** for analyzing model robustness. (Reviewers kjym, wa2k, ELyT)



Below we address a common concern raised by reviewers kjym, WzcS, and wa2k regarding the need for additional experiments on real-world LiDAR sensor datasets to enhance our paper's persuasiveness.

***Common Concern 1: The paper would be more convincing by additional experiments conducted on real-world LiDAR sensor datasets.***

Thanks for the valuable suggestion. We further conduct experiments on the KITTI and ScanObjectNN datasets, both collected by LiDAR sensors. 
Experiments on these two real-world datasets further validate the superiority and practicality of our FAT.
The experimental settings and evaluation metrics on ScanObjectNN-C [1] are consistent with those on ModelNet-C.
The KITTI-C dataset [2] includes four major types of corruptions: Weather-level (e.g., Strong Sunlight), Sensor-level (e.g., Density Decrease), Motion-level (e.g., Moving Object), and Object-level (e.g., Local Gaussian Noise). Following [2], we use $AP_{cor}$ (corruption average precision) at moderate difficulty as the evaluation metric on KITTI-C, where higher values indicate better performance. We employ the representative 3D object detection model PointPillars. The results are shown below.

|KITTI-C|Method|$AP_{clean}$|mean $AP_{cor}$|Weather-level $AP_{cor}$|Sensor-level $AP_{cor}$|Motion-level $AP_{cor}$|Object-level $AP_{cor}$|
|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|
|PointPillars|Vanilla Training|78.34|65.35|63.39|75.33|49.61|73.05|
||Adv Training|74.86|62.96|51.97|78.68|51.43|69.77|
||DUP Defense|72.02|63.98|58.19|78.05|48.21|71.46|
||FAT (Ours)|78.06|**67.02**|60.81|79.19|54.71|73.39|

|ScanObjectNN-C|Method|OA|mCE|Rotate|Jitter|Scale|Drop-G|Drop-L|Add-G|Add-L
|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|
|DGCNN|Vanilla Training|0.858|1.000|1.000|1.000|1.000|1.000|1.000|1.000|1.000| 
||Adv Training|0.843|1.062|1.146|0.778|1.097|0.873|0.960|1.185|1.396|
||DUP Defense|0.832|1.029|1.195|0.833|1.157|1.197|1.214|0.773|0.834|
||FAT (Ours)|0.856|**0.933**|0.968|0.815|0.959|0.852|0.950|0.959|1.026|
|PointNet|Vanilla Training|0.739|1.354|1.610|0.884|1.427|0.786|1.264|1.487|2.022|
||Adv Training|0.725|1.334|1.532|0.844|1.403|0.873|1.333|1.474|1.881|
||DUP Defense|0.712|1.348|1.717|0.825|1.555|1.157|1.480|0.829|1.875|
||FAT (Ours)|0.734|**1.254**|1.393|0.796|1.465|0.844|1.264|1.259|1.759|
|PointNext|Vanilla Training|0.873|0.921|0.995|1.079|0.803|0.807|0.942|0.944|0.875|
||Adv Training|0.870|0.901|0.991|1.027|0.803|0.833|0.929|0.912|0.809|
||DUP Defense|0.859|0.901|0.980|1.046|0.826|0.748|0.973|0.923|0.809|
||FAT (Ours)|0.875|**0.877**|0.998|0.916|0.791|0.786|0.867|0.938|0.840|

It can be seen that our FAT generally leads to lower mCE (mean corruption error) on ScanObjectNN-C and higher $AP_{cor}$ (average precision) on KITTI-C. The experimental results on both KITTI and ScanObjectNN datasets further validate the generalizability and applicability of our FAT under real-world conditions. We will add the results in the revision.

Meta-review: This paper proposes a novel approach to improving the robustness of 3D point cloud recognition against corruptions by operating in the frequency domain. The method leverages the Graph Fourier Transform (GFT) to analyze and modify frequency components, enhancing corruption robustness. Extensive experiments demonstrate FAT's effectiveness across various network architectures and datasets, achieving state-of-the-art performance. The method is particularly relevant for safety-critical applications like autonomous driving.

The proposed method and the perspective to tackle 3D point cloud robustness is novel. The work offers strong theoretical grounding and empirical results, demonstrating the effectiveness on multiple architectures and datasets. Comprehensive experiments across various network architectures, including newer ones, and additional datasets such as KITTI and ScanObjectNN, are conducted. Although there were concerns regarding the limited real-world dataset usage (initially) and other ones such as complexity of implementation, impact on clean accuracy, and lack of comparison with specific attack methods, the value of the work outweighs its limitations. The authors have also effectively addressed concerns raised by reviewers, including adding real-world dataset experiments. These factors collectively justify an acceptance.
Decision: Accept (poster)