# G&G Attack: General and Geometry-Aware Adversarial Attack on the Point Cloud
## 4 Experiments Settings and Results
### Main Results
\begin{table}
\begin{tabular}{c l c c c c c} \hline \hline
**Target Model** & **Attack** & **ASR** & **CD** & **HD** & **L2** & **AT** \\ \hline \multirow{9}{*}{**PointNet++**} & PGD & 42.75\% & 0.00512 & 0.02053 & 2.56925 & 2.00264 \\  & I-FGSM & 12.36\% & 0.00009 & 0.00836 & 0.20470 & 1.94486 \\  & SIADV & 19.17\% & 0.00180 & 0.06930 & 1.85480 & 3.96888 \\  & Saliency Map & 19.17\% & 0.00496 & 0.11553 & None & 2.15756 \\  & Add & 13.82\% & 0.00186 & 0.00902 & 1.46693 & 5.04174 \\  & AOF & 55.68\% & 0.00668 & 0.02939 & 2.99472 & 25.12229 \\  & I3A-attack & 19.73\% & 0.00076 & 0.01834 & 0.70428 & 3.01929 \\  & **G&G Attack** & **60.53\%** & 0.00182 & 0.00450 & 1.60559 & 7.46479 \\ \hline \multirow{9}{*}{**DGCNN**} & PGD & 83.47\% & 0.00512 & 0.02054 & 2.56925 & 1.52712 \\  & I-FGSM & 67.59\% & 0.00009 & 0.00836 & 0.20467 & 1.50940 \\  & SIADV & 52.15\% & 0.00180 & 0.06930 & 1.85480 & 3.86802 \\  & Saliency Map & 19.17\% & 0.00496 & 0.11553 & None & 2.50356 \\  & Add & 74.07\% & 0.00186 & 0.00901 & 1.46488 & 4.28733 \\  & AOF & 65.68\% & 0.00668 & 0.02393 & 2.99472 & 25.12229 \\  & I3A-attack & 71.88\% & 0.00076 & 0.01834 & 0.70428 & 3.97484 \\  & **G&G Attack** & **83.83\%** & 0.00139 & 0.00356 & 1.45443 & 12.97936 \\ \hline \multirow{9}{*}{**PointCNN**} & PGD & 33.35\% & 0.00512 & 0.02053 & 2.56925 & 2.34982 \\  & I-FGSM & 14.75\% & 0.00009 & 0.00835 & 0.20467 & 1.29222 \\  & SIADV & 18.88\% & 0.00180 & 0.06930 & 1.85480 & 5.03818 \\  & Saliency Map & 26.13\% & 0.00497 & 0.11533 & None & 3.34793 \\  & Add & 14.87\% & 0.00186 & 0.00902 & 1.46667 & 6.76772 \\  & **AG** & **63.21\%** & 0.00669 & 0.02393 & 2.99106 & 31.26717 \\  & IA3-attack & 20.46\% & 0.00076 & 0.01834 & 0.70428 & 4.01711 \\  & G&G Attack & 39.38\% & 0.00153 & 0.00377 & 1.51820 & 30.13737 \\ \hline \multirow{9}{*}{**PointNet++**} & PGD & 82.94\% & 0.00512 & 0.02053 & 2.56925 & 2.14265 \\  & I-From the table, we can see that AOF outperforms the G&G Attack when targeting CurveNet. One of the key reasons for this is that AOF applies the Graph Fourier Transform (GFT) to the point cloud, focusing specifically on its low-frequency components. During the upsampling phase of the DupNet defense, AOF is able to more effectively capture the fundamental shape of the point cloud. By perturbing the low-frequency components, AOF disrupts the internal relational structures that CurveNet relies on. As a result, AOF achieves a higher attack success rate. However, due to the sharp increase in perturbation frequency, AOF is less imperceptible than the G&G Attack. In contrast, X-conv, which leverages spatial local correlations, operates only on representative points that contain rich information. PointCNN, built with dual-layer X-conv, is highly sensitive to the number of key points. Meanwhile, the Saliency Map effectively reduces the classification accuracy of PointCNN by removing critical subsets of points. The generated samples are compared with other methods using the CD, HD, and \(L_{2}\)-norm, and the G&G attack generates smaller disturbances. Although some methods, like I-FGSM [11], may outperform our method in specific metrics, their low ASR makes them impractical for deployment and application. Another advantage of our method is that it requires fewer queries. Compared to commonly used black-box query attacks (SimBA++ [29], SimBA [28], SI-Adv [20]), our method has an average query count of 7.84, which is lower than that of mainstream methods. Therefore, we conclude that our method is difficult to detect, given the premise of ASR, as shown in Table 4.