# G&G Attack: General and Geometry-Aware Adversarial Attack on the Point Cloud
## 5 Discussion
### Visualization of Adversarial Samples  
We further visualize the adversarial point clouds and validate the effectiveness of the G&G attack. We selected the seven most challenging class attack samples and compared our method with four baseline methods in the visualization field. As shown in Figure 8, significant outliers are produced for all samples, which severely disrupt the local semantic information of the objects (e.g., tables, chairs, airplanes, and so on). The adversarial point clouds generated by our method maintain geometry-aware structures similar to their corresponding benign point clouds. It is worth noting that our adversarial samples do not exhibit many outliers or uneven local point distributions.  
Figure 8: \(Cont\).  
Figure 7: In our comparison with AdvPC regarding imperceptibility using different criteria, such as \(L_{2}\), CD, and HD, we found that our method outperforms AdvPC between 200 and 500 iterations. Although our approach requires slightly more queries than AdvPC, this number gradually decreases as the iteration rounds increase. Considering both ASR and imperceptibility, we conclude that around 300 iterations are optimal.  
Our method integrates gradients, normal vectors, and other relevant surface point information from the point cloud to determine the attack direction. Curvature, acting as an adaptive hyperparameter, plays a pivotal role in weighting these components and effectively guiding the attack direction. To investigate the impact of noise on local curvature, we conducted comparative experiments. In these experiments, we introduced various types of noise, including Gaussian and random noise, into the clean point clouds and observed their effects on the attack success rates and imperceptibility metrics. The results are presented in Table 6.  
To evaluate the attack success rate (ASR) and imperceptibility of our method under different noise conditions, we added Gaussian noise and random noise to the clean point clouds. The Gaussian noise had a mean of \(\mu=0\), with standard deviations of \(\sigma=0.01\) and \(\sigma=0.1\), while the random noise coefficients were set to \(\eta=0.5\) and \(\eta=0.8\). In each iteration, the specified noise was applied to the point clouds for testing.  
In the case of PointNet++ [36], the attack success rate (ASR) experienced a significant reduction, while in DGCNN, the decline in ASR was more modest. The persistent weakening effect of different types and intensities of noise on attack performance is noteworthy. PointNet++ [36] extracts features using multi-layer perceptrons (MLPs) from each local point cloud through a grouping technique, whereas DGCNN determines node attributes based on a neighborhood defined in feature space using a graph neural network. This  
Figure 8: Visual comparisons of different methods. \(\times\) represents attack failure, indicating the classification model correctly identifies the point cloud; \(\checkmark\) indicates attack success, indicating that the classification model fails the point cloud.  
makes PointNet++ more sensitive to small local disturbances, leading to a sharp decrease in ASR. In contrast, our attack method relies more heavily on the global structure of the point cloud, so introducing noise causes shifts in key points and changes in local curvature, thereby reducing the attack's effectiveness.  
Additionally, we observed that as the noise coefficient increases, the attack time decreases. This can be attributed, in part, to the fact that the noise disrupts the point cloud, introducing sufficiently strong disturbances that hinder the model's ability to classify accurately. We plan to conduct further research to explore these phenomena in greater depth, with the goal of gaining a more comprehensive understanding of their impact and underlying mechanisms.