# G&G Attack: General and Geometry-Aware Adversarial Attack on the Point Cloud
## 2 Related Work
### 3D Point Cloud Adversarial Attacks  
The current adversarial attack methods on point clouds can be classified into point-add, point-drop, and point-move. Point-add [19, 26, 27] and point-drop [24] aim to mislead classification models by altering the number of critical points. For instance, point-add utilizes the \(L_{2}\)-norm to generate adversarial points around benign points, subsequently clustering adversarial points iteratively. Conversely, [24] constructs a Saliency Map [24] to evaluate the confidence of each critical point and removes those with higher scores. Intuitively, the effectiveness of adversarial attacks depends on the number of points that can be optimized during generation and the attack distance. Therefore, point-move often outperforms the methods mentioned above [15].  
Point-move [15, 16, 20, 22, 40, 41] often constructs subsets of critical points using gradients in white-box models, limiting the dimensions, distances, and attack frequencies within these subsets. For example, SI-Adv [20] adopts the C&W [42] to achieve shape invariance through coordinate transformations. In contrast, GeoA3 [15] enhances the imperceptibility of point cloud attacks by projecting noise onto the lower surface of the input, thereby implementing geometry-aware constraints. These methods perform admirably in white-box scenarios. However, they tend to perform poorly in black-box transfer attacks and defensive classification models, partly due to their lack of gradient information [43] and local semantic understanding [44]. While most existing attack methods aim to disrupt points away from the surface to preserve local geometric features, they still induce perceptible irregularities on the local surfaces [45,46].  
Compared to white-box attacks, most black-box attack strategies have stronger generalization capabilities. Black-box attacks typically perform a limited number of queries on a classifier with unknown internal structures to obtain partial information. They are mainly divided into two categories: score-based [20,28,29,47,48] and decision-based [49,50]. The difference lies in the output of the target model: the former outputs confidence scores, while the latter directly provides the label.  
Deep neural networks are vulnerable to data leakage and backdoor attacks, raising significant concerns about their deployment in critical applications. In the context of point clouds, for instance, attackers can manipulate LiDAR sensors by introducing adversarial objects with specific shapes and textures, causing the target vehicle to 'disappear' from the sensor data. This can lead the autonomous driving system to make incorrect decisions, such as initiating emergency braking or making erratic lane changes. As a result, adversarial attacks on point clouds can deepen our understanding of how deep neural networks behave under adversarial conditions, facilitating the evaluation and improvement of robustness in black-box attack models. Furthermore, such attacks can contribute to the development of more robust models for critical infrastructure applications, including autonomous vehicles and predictive maintenance.