# G&G Attack: General and Geometry-Aware Adversarial Attack on the Point Cloud
## 5 Discussion
### Transferability  
Adversarial examples are generated from the surrogate network gradients to the black-box network across different networks. Figure 5 illustrates the adversarial transferability on PointNet, PointNet++ [36], and DGCNN [56]. The diagonal elements of the transferability matrix represent the ASR on the same network, while the off-diagonal elements serve as metrics for multiple transferabilities, indicating the average transferability between different networks.  
\begin{table}
\begin{tabular}{c c c c c c c c c c c c} \hline \hline \multirow{2}{*}{**Attack**} & \multicolumn{3}{c}{**PointNet++**} & \multicolumn{3}{c}{**CurveNet**} & \multicolumn{3}{c}{**PointCNN**} \\ \cline{2-11}  & **ASR** & **Q** & **CD** & **HD** & **ASR** & **Q** & **CD** & **HD** & **ASR** & **Q** & **CD** & **HD** \\ \hline
**SimBA** & 8.2\% & 50.74 & \(1.95\times 10^{-7}\) & \(2.59\times 10^{-5}\) & 16.73\% & 73.73 & \(1.11\times 10^{-5}\) & \(2.26\times 10^{-4}\) & 59.3\% & 1558.16 & \(1.03\times 10^{-5}\) & \(1.78\times 10^{-3}\) \\
**SimBA++** & 8.1\% & 50.74 & \(4.62\times 10^{-7}\) & \(1.73\times 10^{-5}\) & 16.33\% & 48.53 & \(4.04\times 10^{-6}\) & \(6.92\times 10^{-5}\) & 58.27\% & 1599.68 & \(2.08\times 10^{-5}\) & 1.65 \(10^{-3}\) \\
**SI-ADV** & 8.3\% & **4.24** & \(1.26\times 10^{-7}\) & \(0.29\times 10^{-5}\) & 16.29\% & **2.94** & \(5.91\times 10^{-7}\) & 3.87\(\times 10^{-5}\) & 58.95\% & 146.47 & \(7.59\times 10^{-6}\) & \(1.62\times 10^{-3}\) \\
**G\&G Attack** & **78.97\%** & 34.41 & \(1.27\times 10^{-3}\) & \(9.42\times 10^{-3}\) & **95.30**\% & 9.66 & \(1.41\times 10^{-3}\) & \(4.10\times 10^{-3}\) & **81.36\%** & **8.28** & \(1.49\times 10^{-3}\) & \(4.09\times 10^{-3}\) \\ \hline \hline \end{tabular}
\end{table}
Table 4: Query of black-box transfer attacks for each method.  
Since point clouds are unordered and irregular, traditional metrics such as the Manhattan Distance and Chebyshev Distance are not suitable. Therefore, this paper makes use of the Chamfer Distance (CD) [33], Hausdorff Distance (HD) [52], and Euclidean Distance (\(L_{2}\)) to measure the imperceptibility of adversarial samples by computing the distance between each point in \(\mathcal{P}\) and its nearest point in \(\mathcal{P}^{\prime}\). The formulas are as follows:  
Bidirectional Chamfer Distance  
\[\frac{1}{|N|}\sum_{\begin{subarray}{c}p_{1}\in\mathcal{P}\\ p_{2}\in\mathcal{P}^{\prime}\end{subarray}}min\|p_{1}-p_{2}\|_{2}+\frac{1}{|N| }\sum_{\begin{subarray}{c}p_{2}\in\mathcal{P}^{\prime}\\ p_{1}\in\mathcal{P}\end{subarray}}min\|p_{1}-p_{2}\|_{2} \tag{17}\]  
Bidirectional Hausdorff Distance  
\[\max_{p\in\mathcal{P}}\biggl{\{}\min_{p^{\prime}\in\mathcal{P}^{\prime}}\|p-p ^{\prime}\|\biggr{\}}+\max_{p^{\prime}\in\mathcal{P}^{\prime}}\biggl{\{}\min_ {p\in\mathcal{P}}\|p^{\prime}-p\|\biggr{\}} \tag{18}\]  
The distance between each point in \(\mathcal{P}\) and the nearest point in \(\mathcal{P}^{\prime}\) can reflect the similarity between the two points. The Attack Success Rate (ASR) means the proportion of misclassified samples among test samples. Additionally, the Query counts \(Q\) and Attack Time \(AT\) are also important.