# G&G Attack: General and Geometry-Aware Adversarial Attack on the Point Cloud
###### Abstract  
Deep neural networks have been shown to produce incorrect predictions when imperceptible perturbations are introduced into the clean input. This phenomenon has garnered significant attention and extensive research in 2D images. However, related work on point clouds is still in its infancy. Current methods suffer from issues such as generated point outliers and poor attack generalization. Consequently, it is not feasible to rely solely on overall or geometry-aware attacks to generate adversarial samples. In this paper, we integrate adversarial transfer networks with the geometry-aware method to introduce adversarial loss into the attack target. A state-of-the-art autoencoder is employed, and sensitivity maps are utilized. We use the autoencoder to generate a sufficiently deceptive mask that covers the original input, adjusting the critical subset through a geometry-aware trick to distort the point cloud gradient. Our proposed approach is quantitatively evaluated in terms of the attack success rate (ASR), imperceptibility, and transferability. Compared to other baselines on ModelNet40, our method demonstrates an approximately 38% improvement in ASR for black-box transferability query attacks, with an average query count of around 7.84. Comprehensive experimental results confirm the superiority of our method. 3D; point cloud classification; adversary; invisibility; transferability +
Footnote †: journal: Applied sciences  
0000-0002-4000-0000-0000-0000-0000-0000-0000-0000-0000-0000-0000-0000-00000-0000-0000-00000-00000-00000-00000-00000-00000-00000-00000-00000-00000-000000-00000-000  
achieve tasks. However, this results in excessively large steps for each point and makes the \"sharp\" [20] features of the surface easily perceivable. Introducing a simple Statistical Outlier Removal (SOR) [21] can easily defend against such attacks. The geometry-aware attack also exhibits limited generalization ability, moving points [22] at key positions to minimize attacks and successfully deceive classifiers. However, over-reliance on the distribution characteristics of point clouds hampers attack transferability [23]. Current methods [20] show that iteratively perturbing the top 30% of points results in a classification accuracy drop of over 40% across different models. Furthermore, the same point cloud sensitivity map [24] is employed in different networks, revealing that about 62% of critical points overlap within the top 30%, with an overlap of approximately 34% across three models. This enables the application of a critical points subset from a surrogate model in black-box query attacks, enhancing its generalization. This underscores the commonality of different networks in classifying the single point cloud, which affirms the feasibility of black-box transfer attacks. Moreover, existing 3D point cloud adversarial attack approaches mainly focus on white-box attacks [24; 25], resulting in unsatisfactory performance on well-defended or black-box models. In a white-box model, attackers have full knowledge of the architecture and parameters of the network, which makes it useful for testing and detecting vulnerabilities. However, this fails to reflect the actual robustness of the model in real-world applications [26; 27]. Due to intellectual property protection and product ecosystems, attackers rarely have access to a model's gradients, parameter weights, and structures [28; 29]. Consequently, launching backdoor attacks [30] by constructing poisoned samples based on targeted models becomes nearly impossible. Attackers can only make decisions based on the confidence scores of outputs, which poses greater challenges and has increased practical significance. To address these challenges, we propose a general and geometry-aware adversarial attack on point clouds (G&G attack), which allows us to balance the effectiveness and imperceptibility of point-cloud attacks from novel perspectives of global reconstruction and local perturbation.