Frequency-Aware GAN for Imperceptible Transfer Attack on 3D Point Clouds

Venue: acmmm_org_ACMMM_2024_Conference
Published: 2024-04-06 10:34:04

Abstract: With the development of depth sensors and 3D vision, the vulnerability of 3D point cloud models has garnered heightened concern. Almost all existing 3D attackers are deployed in the white-box setting, where they access the model details and directly optimize coordinate-wise noises to perturb 3D objects. However, realistic 3D applications would not share any model information (model parameters, gradients, etc.) with users. Although a few recent works try to explore the black-box attack, they still achieve limited attack success rates (ASR) and fail to generate high-quality adversarial samples. In this paper, we focus on designing a transfer-based black-box attack method, called Transferable Frequency-aware 3D GAN, to delve into achieving a high black-box ASR by improving the adversarial transferability while making the adversarial samples more imperceptible. Considering that the 3D imperceptibility depends on whether the shape of the object is distorted, we utilize the spectral tool with the GAN design to explicitly perceive and preserve the 3D geometric structures. Specifically, we design the Graph Fourier Transform (GFT) encoding layer in the GAN generator to extract the geometries as guidance, and develop a corresponding Inverse-GFT decoding layer to decode latent features with this guidance to reconstruct high-quality adversarial samples. To further improve the transferability, we develop a dual learning scheme of discriminator from both frequency and feature perspectives to constrain the generator via adversarial learning. Finally, imperceptible and transferable perturbations are rapidly generated by our proposed attack. Experimental results demonstrate that our attack method achieves the highest transfer ASR while exhibiting stronger imperceptibility.

Main paper: 
 introduction: 
 Deep Neural Networks (DNNs) are known to be vulnerable to adversarial examples [9, 40] , which are indistinguishable from legitimate ones by adding trivial perturbations but often lead to incorrect model prediction. Many efforts have been made into attacks on the 2D image field [6, 22, 30, 44] , which often add imperceptible pixelwise noise on images to deceive the DNNs. However, in addition to image-based 2D attacks, 3D point cloud attacks are also crucial in various safety-critical applications such as autonomous driving [4, 14, 55] , robotic grasping [46, 62] , medical data analysis [38] , and face challenges in realistic scenarios. Mainstream 3D point cloud attack methods can be roughly divided into two categories: gradient search-based and gradient optimization-based approaches. The gradient search-based works [50, 52, 53, 61] identify critical points from point clouds and modify (add or delete) them to distort the most representative features for misclassification. While the gradient optimization-based works [2, 11, 26, 29, 43, 49, 58] follow the C&W framework [9] to learn to perturb xyz coordinates of each point and generate adversarial samples in an end-to-end manner. Although the above works have achieved high attack success rates, most of them are simply deployed in the white-box setting where the attackers have the full knowledge of victim models including network structure and weights. This setting makes the attacks less practical since most real-world 3D applications will not share their model details with users. Recently, a few works [11, 18, 63] propose to tackle 3D attacks in the black-box setting without using prior model knowledge. However, these works simply utilize geometric distance losses or additional shape knowledge to implicitly constrain the perturbations, failing to properly keep the original 3D object shape and resulting in irregular surfaces or outliers. Therefore, their generated adversarial point clouds are often easily perceivable by humans. Moreover, these attacks tend to overfit the target network and hardly remain malicious once they are transferred to attack a different victim model.To this end, in this paper, we focus on addressing the challenging black-box 3D attack from two aspects: improving the adversarial robustness and the imperceptibility of the attack method. Firstly, to improve the adversarial robustness, we aim to force the adversarial point clouds to successfully attack different unknown 3D models. This inspires us to develop a transfer-based attack method, which learns to generate the most harmful noise and make them resist against unknown distortions in unseen models. In this manner, the attack method can achieve high black-box attack success rates. Secondly, to improve the imperceptibility, instead of relying on implicit geometric constraints, we follow the existing generative models, e.g., generative adversarial network (GAN), to explicitly perceive the 3D shape-aware latent characteristics and construct natural/stealthy 3D objects. By carefully guiding the generative model to encode and decode the 3D geometries, it can well generate realistic 3D object shapes. With further adversarial learning design, the generated point cloud can be adversarial to the targets.Based on the above considerations, we propose a novel Transferable Frequency-aware 3D GAN Attack method, which utilizes spectral tools to explicitly perceive the 3D geometries and encode them in the GAN structure for preserving the 3D structure during the object construction. Specifically, as shown in Figure 1 , our GAN-based architecture consists of two components: a frequencyaware generator and a frequency-aware discriminator. We first convert the encoded point-level coordinate/spatial features into the spectral frequencies via graph fourier transform (GFT), then fuse them for feature processing in the frequency-aware generator. This GFT will lead to a compact representation of the geometric data in the spectral domain [15, 16, 34] , which is effective in comprehending the shape information of the whole point cloud. During latent feature encoding and decoding in the generator, we perform skip connections of high-frequency features from GFT-based encoder to the IGFT-based decoder of the generator to preserve the detailed geometric contexts of point cloud for making it imperceptible. By using the discriminator to prompt the generator to produce realistic adversarial point clouds, we can improve the imperceptibility of the generated adversarial samples. To further improve the transferability, we extend the traditional discriminator into a dual-branch scheme, which not only utilizes the spatial features to distinguish the point clouds, but also utilizes low-frequency and high-frequency spectral filters to provide additional spectral feature types for adversarial learning. This can train the perturbations to resist possible distortions when transferred to attack unknown models. An additional frozen feature discriminator is also introduced to extract intermediate layer features to maximize feature similarity. In this manner, our proposed attack is able to generate imperceptible 3D adversarial objects with high transferability.Our main contributions are summarized as follows:• We make the attempt to improve both the transferability and imperceptibility of black-box attacks on 3D point clouds. To perceive and preserve the geometric characteristics of 3D objects, we develop a frequency-aware GAN model to construct stealthy adversarial point clouds.• In the GAN-based architecture, we carefully construct a frequency-aware generator with GFT and IGFT designs to perceive and preserve the 3D geometrics for improving the imperceptibility. We also design a dual scheme of discriminator in both spectral and feature contexts to adversarially train the generator for improving the transferability.• Extensive experiments demonstrate that our attack method achieves the highest transfer attack success rate while exhibiting stronger imperceptibility. 
related work: 
 3D point cloud attacks. Following previous studies on the 2D image field, many works [43, 50, 52, 53, 60, 61, 63] adapt adversarial attacks into the 3D vision community [3, 10, 31, 32, 45, 47, 51, 54, 56, 59 ]. [52] proposes point generation attacks by adding a limited number of synthesized points/clusters/objects to a point cloud. [53] utilizes gradient-guided attack methods to explore point modification, addition, and deletion attacks. Their goal is to add or delete key points, which can be identified by calculating the label-dependent importance score referring to the calculated gradient. Recently, more works [26, 43, 58] adopt point-wise perturbation by changing their xyz coordinates, which are more effective and efficient. [26] modifies the FGSM strategy to iteratively search the desired pixel-wise perturbation. [43] adapts the C&W strategy to generate adversarial examples on point clouds and proposes a perturbation-constrained regularization. Besides, [18, 42] propose the query-based black-box attack approach to generate imperceptible perturbations. Several works [7, 20, 23, 35] attack point clouds in the feature space and target at perturbing less points with lighter distortions for an imperceptible adversarial attack. However, the generated adversarial point clouds of all above methods often result in messy distribution or outliers, which are easily perceivable by humans. Meanwhile, these methods tend to overfit the target network, resulting in poor transferability when attacking the victim models.Generative models. Mainstream generative models mainly include generative adversarial networks (GAN) and diffusion models, which have been widely applied in various point cloud fields, including point cloud generation [1, 28, 36, 41] , upsampling [27, 33] , adversarial attack [11, 63] , adversarial defense [39, 57] , etc. The GAN models consist of a generator and a discriminator, and the two networks are updated alternatively in an adversarial manner. Unlike GANs, diffusion models gradually introduce noise into the data and then learn how to reverse diffusion process to generate examples. [1] is the first to construct GAN based on a pre-trained auto-encoder to synthesize point clouds indistinguishable from real data. [28] proposes a probabilistic generative model for point clouds by exploiting the reverse diffusion Markov chain to model the distribution of points. [11, 63] train the generator to learn the adversarial distribution and produce adversarial examples by optimizing target loss and GAN loss. [39, 57] utilize diffusion models to restore the perturbed point clouds under various distortions to a clean distribution. Although both models can achieve better performance in terms of generation quality, diffusion models generate datas more slowly than GANs because they require a multi-step iterative process to gradually reduce noise. Adv.Adv.Adv.Adv.  
method 3.1 problem definition: 
 Generally, a point cloud consists of an unordered set of points 𝑷 = {𝒑 𝑖 } 𝑛 𝑖=1 ∈ R 𝑛×3 sampled from the surface of a 3D object or scene, where each point 𝒑 𝑖 ∈ R 3 is a vector that contains the coordinates (𝑥, 𝑦, 𝑧) of point 𝑖, and 𝑛 is the number of points. In this paper, we mainly focus on attacking the basic point cloud classification task. Given a point cloud 𝑷 as input, a learned classifier 𝑓 (•) predicts a vector of confidence scores 𝑓 (𝑷 ) ∈ R 𝐶 . The final predicted label is 𝑦 = 𝐹 (𝑷 ) = 𝑎𝑟𝑔𝑚𝑎𝑥 𝑖 ∈ [𝐶 ] 𝑓 (𝑷 ) 𝑖 ∈ 𝑌, 𝑌 = {1, 2, 3, ..., 𝐶} that represents the class of the source 3D object underlying the point cloud, where 𝐶 is the number of classes. To attack such classification model, the general objective is to find a perturbation 𝚫 ∈ R 𝑛×3 that generates an adversarial example as 𝑷 , which misguides the predicted result from the ground truth label 𝑦 to the other label. We use the 𝑙 𝑝 norm to regularize the perturbation 𝚫 to the range 𝜖 and formulate the adversarial attack with misclassification loss 𝐿 𝑚𝑖𝑠 as the following optimization problem: max 𝚫 𝐿 𝑚𝑖𝑠 (𝐹 ( 𝑷 ), 𝑦), 𝑠.𝑡 .||𝚫|| 𝑝 ≤ 𝜖.(1) perceiving the 3D geometric characteristic, which can be divided into low-frequency (LF) and high-frequency (HF) components. We then use these frequency features to preserve the geometric topology by utilizing high-frequency components skip-connections to the decoder to provide more fine-grained geometric guidance for perturbation. To further improve the transferability, we propose a dual discriminator consisting of a frequency-aware discriminator and a feature discriminator. The frequency-aware discriminator is trained to distinguish samples via the low-frequency features and high-frequency features, so that adversarial samples can be trained to be no longer over-fitting to models that solely rely on single spatial features. The feature discriminator directly uses an encoding model to extract features of the intermediate layer for sample distinguishing. By forcing the generator against both two discriminators from different aspects, the generated adversarial samples can achieve high robustness and attack success rate to unknown 3D models.The role of the generator is to learn to produce an adversarial point cloud that is as similar as possible to the source point cloud distribution. On this basis, we hope that the generator can further improve the imperceptibility of adversarial point clouds, allowing them to have more fine-grained details of class-related geometric characteristics and not be deformed. To address this issue, we propose a new frequency-aware generator 𝐺, breaking the limitation of previous generators only being set in the data domain. In particular, during the generator learning, we additionally extract the spectral frequencies of the source point cloud to explicitly explore and capture its geometric structure. Specifically, the spectral domain explicitly reveals the geometric structures from basic shapes to fine details via different frequency bands [13] : the low-frequency components in the frequency domain represent basic shapes, while the highfrequency components encode find-grained details. Therefore, by combining both spatial and frequency features in 𝐺 with skip connections of the high-frequency components, we are able to guide the generator to comprehend both the semantics and geometrics of the original 3D object for generating imperceptible adversarial samples. The architecture of the frequency-aware generator is shown in the upper of Figure 2 .Encoder with GFT-based design. We first introduce the designed GFT-based encoder that encodes both spatial and spectral representations for perceiving the object geometrics. Specifically, to extract high-level representations of point clouds, this encoder utilizes four feature extraction layers (FE), each of which consists of an EdgeConv layer of DGCNN [47] and a graph fourier transform (GFT) [17] layer. We employ the EdgeConv layer to extract the spatial features of point cloud 𝑷 = {𝒑 𝑖 } 𝑛 𝑖=1 . In the i-th layer, Edge-Conv uses local structure information to calculate the edge feature set 𝑆 of each point, and aggregates the features in each set into a new representation of the point. The final spatial representation 𝑷 𝑖 𝑠𝑝𝑎 ∈ R 𝑛×𝑚 of points is obtained by:EQUATIONwhere 𝑚 is the feature dimension of the output, 𝜽 𝑚 and 𝝋 𝑚 are the weight of filters.In addition to extracting the spatial features, we also design spectral neural modules to encode frequency features for perceiving the geometric characteristics. Given a point cloud 𝑷 , we construct a K-nearest-neighbor (KNN) graph for 𝑷 , and calculate Laplacian matrix [37] as 𝑳. 𝑳 admits an eigen-decomposition 𝑳 = 𝑼 𝚲𝑼 𝑇 , where 𝑼 = [𝒖 1 , ..., 𝒖 𝑛 ] is an orthonormal matrix containing the eigenvectors 𝒖 𝑖 which is called the graph fourier basis, and 𝚲 = 𝑑𝑖𝑎𝑔(𝜆 1 , ..., 𝜆 𝑛 ) consists of eigenvalues (i.e. frequencies) {𝜆 1 = 0 ≤ 𝜆 2 ≤ ... ≤ 𝜆 𝑛 }. The coordinates of points in 𝑷 are treated as graph signals, and its GFT coefficient vector P is defined as [12] :EQUATIONIn the i-th layer, we utilize the GFT layer to convert the output 𝑷 𝑖 𝑠𝑝𝑎 of the EdgeConv layer into frequency features asP𝑖 𝑓 𝑟𝑒 = 𝜙 𝐺𝐹𝑇 (𝑷 𝑖 𝑠𝑝𝑎 ).We then perform tenor addition on the spatial features and frequency features to preserve the geometric topology and semantics as 𝑷 𝑖+1 𝑠𝑝𝑎 = 𝑷 𝑖 𝑠𝑝𝑎 + P𝑖 𝑓 𝑟𝑒 . Finally, the features of each FE layer are concatenated to obtain the high-level global features as:EQUATIONDecoder with IGFT-based design. To generate adversarial point clouds with fine-grained details of class-related geometric characteristics and less noise, we put the high-frequency components of the GFT-based encoder into the decoder via skip connections, thus making the adversarial samples less distinguishable by human eyes. This IGFT-based decoder also mainly contains four feature reconstruction layers (FR), each of which consists of the conv layer and the IGFT layer. Specifically, in the i-th FR layer, the global features generated by the encoder are reconstructed using conv layer to obtain features as 𝑨 = 𝑐𝑜𝑛𝑣 𝑖 (𝒇 𝒆𝒂𝒕𝒖𝒓 𝒆𝒔). The IGFT layer performs the high-frequency components from the 4 -𝑖 + 1 layer of the encoder to obtain features as 𝑩 = 𝜙 𝐼𝐺𝐹𝑇 (( P 4-𝑖+1 𝑓 𝑟𝑒 ) 𝐻 𝐹 ). The IGFT is defined as:EQUATIONThese two features are combined as 𝑨 + 𝑩 and sent to the FR layer. Finally, the fully connected layer is utilized to generate perturbation for the point cloud.To improve the transferability of adversarial samples, we aim to build a powerful discriminator. Through alternate training of the generator and the discriminator, GAN finally reaches a balance, which is that the generator generates sufficiently realistic adversarial point clouds, while the discriminator has difficulty distinguishing the adversarial point clouds from the source point clouds. The insight is that, if the generated adversarial point clouds can fool a powerful discriminator model, they can also fool other unknown 3D classification models. Therefore, in this section, we propose a dual discriminator consisting of a frequency-aware discriminator 𝐷 𝜓 and a feature discriminator 𝐷 𝛾 , to push the whole GAN generating transferable adversarial samples. This discriminator will assist in improvement from two aspects: (1) enriching the feature types in spectral frequency representations instead of only relying on spatial features; (2) learning to distinguish the feature similarity from the intermediate layer. The architecture of the dual discriminator is shown in the bottom of Figure 2 .Frequency-aware discriminator. We propose a novel frequencyaware discriminator that can learn not only spatial features, but also low-frequency and high-frequency spectrum domain representations to better distinguish point clouds, and enrich the feature types to improve transferability. This discriminator consists of three modules with a similar architecture but different inputs. The modules contain multi-layer perceptrons (MLPs) and two GFT layers. The MLPs module 𝑓 𝑝𝑐 (•) takes point cloud as input to extract spatial features. The low-pass GFT module 𝑓 𝑙 𝑓 (•) first utilizes a low-pass filter to obtain low-frequency (LF) points, which are then used as input to extract the low spectral frequency representations. Similarly, the high-pass GFT module 𝑓 ℎ𝑓 (•) utilizes a high-pass filter to obtain high-frequency (HF) points, and extracts high spectral frequency features. We first define the graph filter as follows to allow or suppress the passage of frequency components:EQUATIONwhere ℎ(𝜆 𝑖 (𝑖 = 1, 2, ..., 𝑛)) denote the frequency response of a graph filter. The low-pass filter ℎ(𝜆 𝑖 ) is as follows:EQUATIONIn contrast, the high-pass filter ℎ(𝜆 𝑖 ) is as follows:EQUATIONHere, 𝑏 is the dividing point between low-frequency band and highfrequency band. Referring to the previous work [25] , we set 𝑏 = 100 in the experiments. Specifically, the source point cloud 𝑷 and adversarial point cloud 𝑷 are respectively input into the low-pass filter and high-pass filter to get LF points (𝑷 ′ ) 𝐿 ,( 𝑷 ′ ) 𝐿 and HF points (𝑷 ′ ) 𝐻 , ( 𝑷 ′ ) 𝐻 . Then the point clouds, LF points and HF points are input into the corresponding modules to get their respective spatial and spectral features. Finally, all types of features are concatenated to form the input fed into the final discriminant vector, and the corresponding confidence values are generated through three FC layers as:EQUATIONEQUATION) Feature discriminator. Further, we construct a feature discriminator to make a distinction between source point clouds and adversarial point clouds from the perspective of feature similarity. The intermediate features extracted by different models during classification show strong similarities. This inspires us to utilize a frozen discriminator as the feature extractor to guide the frequencyaware generator to produce transferable adversarial point clouds via a feature distance loss. Specifically, the feature discriminator is a pre-trained classifier. We respectively input the point cloud 𝑷 and 𝑷 into the 𝐷 𝛾 , extract the corresponding features 𝒓 𝑜𝑟𝑖 and 𝒓 𝑎𝑑𝑣 from intermediate layer outputs of 𝐷 𝛾 , calculate the distance between 𝒓 𝑜𝑟𝑖 and 𝒓 𝑎𝑑𝑣 , and optimize the generator by maximizing the distance to destroy feature similarity.Adversarial Loss. The goal of the 𝐷 𝜓 is to correctly differentiate between the source point cloud 𝑷 and the adversarial point cloud 𝑷 , while the goal of the 𝐺 is to fool 𝐷 𝜓 . That is, adversarial loss 𝐿 𝑑𝑖𝑠 of 𝐷 𝜓 is to maximize the probability that the 𝐷 𝜓 identifies 𝑷 as true and 𝑷 as false. On the contrary, adversarial loss 𝐿 𝑔𝑒𝑛 of the 𝐺 is to maximize the probability that the 𝐷 𝜓 identifies 𝑷 as true. Based on this and previous work [41] , we adopt the following adversarial loss:EQUATIONEQUATIONwhere P 𝑷 is the distribution of 𝑷 and P 𝑷 is the distribution of 𝑃. Reconstruction Loss. As with the adversarial loss objective, to make 𝑷 similar to 𝑷 , we adopt the L2-norm distance as reconstruction loss 𝐿 𝑟𝑒𝑐 [63] :EQUATION)Feature Loss. We introduce feature loss 𝐿 𝑓 𝑒𝑎 by maximizing the distance between features 𝒓 𝑜𝑟𝑖 and 𝒓 𝑎𝑑𝑣 from intermediate layer outputs of 𝐷 𝛾 to optimize the 𝐺. This makes the adversarial features far away from the clean features, and the final classification is biased towards another category. Mathematically, the 𝐿 𝑓 𝑒𝑎 is defined as follows:EQUATION)In summary, both generator 𝐺 and discriminator 𝐷 𝜓 are optimized during training using the above losses as:EQUATIONEQUATIONwhere 𝑤 𝑟𝑒𝑐 and 𝑤 𝑓 𝑒𝑎 are the weight factors.In our attack method, the frequency-aware generator and the dualdiscriminator utilize the adversarial learning process to improve their respective performance, prompting the generation of adversarial samples. Specifically, by minimizing the loss functions, we iteratively update the parameters 𝜼 of the frequency-aware generator 𝐺 and the parameters 𝜻 of the frequency-aware discriminator 𝐷 𝜓 via gradient descent. Prior to this, we use random mask proposed by [48] to screen out meaningless perturbation points. This mask 𝑀 is the same size as the perturbation and consists of 0 or 1. We perform matrix multiplication of the mask with the perturbation to randomly discard the perturbation points. The overall training procedure of our model is summarized in Algorithm 1.During the inference, we directly utilize the generator 𝐺 to quickly create imperceptible and transferable adversarial point cloud. [30] 0.1322 0.1329 0.7384 0.1623 0.1138 0.7596 0.1546 0.1421 0.7756 0.1625 0.1388 0.7541 AdvPC [11] 0.0343 0.0697 0.6509 0.0429 0.0685 0.6750 0.0148 0.0623 0.6304 0.0369 0.0625 0.6806 3D-ADV [52] 0.0105 0.0003 0.5506 0.0381 0.0005 0.5699 0.0475 0.0005 0.5767 0.0237 0.0007 0.6011 LG-GAN [63] Dataset. We use ModelNet40 [51] in our experiments to evaluate the attack performance. ModelNet40 consists of 12,311 CAD models from 40 object categories, in which 9,843 models are intended for training and the other 2,468 for testing. Following the settings of previous work [13, 24, 49] , we uniformly sample 1024 points from the surface of each object and scale them into a unit ball. 3D Models. Following previous works, we select four commonly used point cloud classification networks in 3D computer vision community as the feature discriminator and the victim models, i.e., PointNet [31] , PointNet++ [32] , DGCNN [47] and PCT [10] . We generate the adversarial point clouds over each of them, and further evaluate the transferability of our proposed attack among them. 𝐿 𝐷 = -E 𝑷 ∼P 𝑷 [𝐷 𝜓 (𝑷 )] + E 𝑷 ∼P 𝑷 [𝐷 𝜓 ( 𝑷 )] 
experimental settings: 
 Evaluation Metrics. To quantitatively evaluate the effectiveness of our proposed attack, we measure the generated adversarial examples by the attack success rate (ASR), L2-norm distance 𝐷 𝑛𝑜𝑟𝑚 [5] , Chamfer distance 𝐷 𝑐 [8] and Hausdorff distance 𝐷 ℎ [19] . Implementation Details. We train the model for 100 epochs using the Adam [21] optimizer with a batch size of 32, and the learning rate of 𝐺 and 𝐷 𝜓 are both 0.0001. We set K = 10 to build a KNN graph and set the perturbation threshold as 𝜖 = 0.16. The weight of reconstruction loss 𝑤 𝑟𝑒𝑐 is set to 1. The weight of the feature loss 𝑤 𝑓 𝑒𝑎 and the intermediate layer are different due to the different models used by the feature discriminator. In PointNet, PointNet++, DGCNN, and PCT, 𝑤 𝑓 𝑒𝑎 is set to 9, 10, 4, 15 respectively, and intermediate layer is set to 6th, 5th, 8th, 9th. All experiments are implemented on a single NVIDIA RTX 5000 GPU.Comparison with existing methods. To investigate the imperceptibility of our attack, we measure the perturbation sizes of different adversarial point clouds required to achieve 100% of attack success rate with three evaluation metrics. As shown in Table 1 , our attack achieves smaller perturbation sizes than the black-box model and achieves very competitive results with white-box models. Compared with methods such as 3D-ADV [52] that modify a few points, our method has a slightly higher 𝐷 𝑛𝑜𝑟𝑚 because we use GAN to conduct global perturbations. Perturbing each point can alter the distance to the original point, thereby increasing the 𝐷 𝑛𝑜𝑟𝑚 value for precise point-to-point distance measurement as the number of perturbed points increases. However, our attack performs better in 𝐷 𝑐 and 𝐷 ℎ since we utilize the spectral tool to capture and preserve the geometric structures of the point cloud.Visualization results. We provide visualization on adversarial samples generated by our attack, LG-GAN [63] and SI-Adv [18] in Figure 3 . Compared to LG-GAN, our adversarial samples have less shape distortion. Besides, our method also mitigates detail loss and the outlier points, thereby generating imperceptible adversarial samples. More visualizations are in the supplementary.To investigate the transferability of our attack, we first utilize the feature discriminator as the white-box model. Then we craft adversarial samples on different feature discriminator and test them Attack Methods FGSM LG-GAN SI-Adv Ours Runtime 0.082s 0.04s 0.58s 0.006s our attack achieves higher ASRs than other methods. The main reason is that, the proposed dual-branch discriminator from both frequency and feature perspectives through adversarial learning encourages the genarator to produce the most harmful perturbations, which can resist possible distortions when transferred to attack unknown models.To evaluate the robustness of our attack against different adversarial defenses, we conduct the experiments on two widely used defense methods: Simple Random Sampling (SRS) [53] and Statistical Outlier Removal (SOR) [64] . As shown in Table 3 , (1) the ASRs on clean data is equal or close to 0 perhaps due to the modification of point clouds by the defense methods. (2) The FGSM attack has lower ASRs since it shifts points along xyz directions without any constraint of the length. This easily results in uneven local distribution and outliers.(3) Our method achieves better ASRs than other attacks under the defenses. This is because the adversarial sample we generate is highly similar to the original one in both geometric topology and point distributions. Meanwhile, our attack alleviates the outlier point problems.We assess the average runtime required to generate an adversarial point cloud in the inference phase across various attack methods.As shown in Table 4 , our method demonstrates a quicker execution compared to others. The FGSM attack accesses the target model for one forward-propagation and one back-propagation processes. The generator architecture of LG-GAN based on PointNet++ is more GANs and diffusion models are both generative models designed to learn from training data and generate new data samples. Currently, there is no research on point cloud adversarial attack based on diffusion model. Therefore, we conduct a comparative analysis with the baseline diffusion model. As show in Table 5 , our attack employs the GAN-based approach, which not only achieves superior ASRs but also accelerates the generation of adversarial examples.The influence of frequency features and skip connections in frequency-aware generator. To verify the effect of these factors in making the adversarial samples imperceptible, we evaluate five ablations in frequency-aware generator: (1) our method; (2) replacing high-frequency (HF) skip connections with low-frequency (LF) skip connections; (3) using HF and LF skip connections; (4) removing HF skip connections; (5) removing the GFT and HF skip connections. As show in Table 6 , our method achieves the smallest perturbations than other strategies in all metrics. This is because the frequency features perceive the geometric topology and their high-frequency components can encode find-grained details well.The influence of dual discriminator. To verify the impact that the feature discriminator and the frequency-aware discriminator work together to improve the transferability, we design four ablations in dual discriminator: (1) discriminator to adversarially train the generator from frequency and feature perspectives. The influence of intermediate layer selection in feature discriminator. Using features of different depths to optimize the generator produces adversarial samples that have different ASRs when attacking the black-box victim models. Based on the experimental results in Figure 5 , we select the optimal intermediate layer for each feature discriminator to extract the features. Sensitivity on hyper-parameter 𝑏. The hyper-parameter 𝑏 represents the dividing point between the low-frequency band and the high-frequency band. First, it is used in frequency-aware generator to improve imperceptibility and we verify its impact in Table 7 . When 𝑏 is set to 100, our attack achieves the smallest perturbations. Futhermore, 𝑏 is also used in frequency discriminator, so we perform ablation to test its impact on transferability. The results are in the supplementary. 
conclusions: 
 In this paper, we propose a novel Transferable Frequency-aware 3D GAN method, to attack the 3D models in a challenging transferable black-box setting. Specifically, we utilize the spectral tool in the GAN architecture with GFT and IGFT layer designs to perceive and preserve the geometric structures of the 3D point cloud to improve imperceptibility. Besides, we also develop a dual learning scheme of discriminator from both frequency and feature perspectives to constrain the generator via adversarial learning. In this manner, our proposed attack method is able to generate imperceptible 3D adversarial objects with high transferability. Experiments demonstrate the effectiveness of the proposed attack. 
: 
 We propose to design a generative model to generate high-quality 3D adversarial objects by perceiving the 3D geometric characteristics with spectral information. We also design an adversarial learning scheme to improve the transferability of adversarial samples. 
 
 Appendix:  


Decision: This paper incorporates frequency-domain perception to point cloud GANs, which is interesting and effective. All the reviewers agree to accept this paper. I recommend a decision of acceptance. In the final version, the authors should further explain the motivation of the paper as well as including some key experiments in the rebuttal.

Reviews: review: paper_summary: paper_summary: The paper proposes a novel method for generating adversarial point clouds that are both imperceptible and highly transferable. The GAN model presented in this paper enhances the imperceptibility of the generated adversarial samples through frequency-domain perception and improves the transferability of the adversarial samples through dual discrimination in both frequency domain and feature space. The authors demonstrate the effectiveness of the proposed method through experiments.
strength_weakness: strength_weakness: (1)	By incorporating frequency-domain perception, the generator preserves the geometric features of 3D point clouds, resulting in adversarial samples that are difficult to detect.
(2)	With dual discrimination in both frequency domain and feature space, the generator produces adversarial samples that effectively attack different models.
(3)	The method quickly generates adversarial point clouds with only one forward propagation process, significantly reducing the generation time.
limitations: limitations: (1)	Unconvincing Motivation: The paper suggests that frequency-domain information and generative models can simultaneously enhance both the transferability and imperceptibility of adversarial samples. However, these two goals have long been considered a trade-off, making it difficult to achieve both simultaneously. The motivation in the paper is not convincingly presented, and the writing needs refinement as the logical flow is not smooth.
(2)	High-Frequency Information Skip Connection: The paper mentions using skip connections of high-frequency information to enhance the imperceptibility of adversarial samples, but it lacks detailed theoretical or intuitive explanation. It is unclear why this operation can effectively improve imperceptibility. The human visual system is more sensitive to low-frequency information, and the paper's focus on high-frequency information might overlook this important factor, leading to adversarial samples that are still easily detectable in some cases?
(3)	Too Many Model Components and Insufficient Ablation Studies: The paper's model includes multiple components, but the ablation studies are not sufficient. Specifically, the lack of ablation experiments for the dual discriminator does not show the specific contribution of each component to the overall performance.
(4)	Insufficient Comparison with Typical Point Cloud Transfer Attack Methods: The paper does not sufficiently compare with some typical point cloud transfer attack methods (such as advPC, AOF, SS-attack), making it difficult to comprehensively demonstrate the advantages and disadvantages of the proposed method.
paper_summary: paper_summary: This article introduces a novel method for enhancing the security of 3D point cloud models. Specifically, this method aims to explore the inherent vulnerabilities of 3D models under more practical scenarios by significantly improving black-box attack success rates (ASR) while ensuring the adversarial samples remain imperceptible. To achieve this, the authors integrate a Graph Fourier Transform (GFT) encoding layer within the GAN generator to precisely capture and retain the 3D geometric structures of objects. An Inverse-GFT decoding layer complements this by reconstructing high-quality adversarial samples guided by the extracted geometries. Additionally, the study introduces a dual learning scheme for the discriminator, optimizing it from both frequency and feature perspectives to refine the generative adversarial network's output. This results in the creation of imperceptible, yet highly transferable, perturbations.
strength_weakness: strength_weakness: 1. This article is well written and clearly organized.
2. The article's ingenious design of the GAN network to balance black-box attack performance with the idea of imperceptibility is interesting and holds greater practical value.
3. The experiments presented in this article are comprehensive, particularly the comparison with diffusion models, which effectively alleviates my concerns about the efficacy of generating results using GAN methods.
limitations: limitations: 1. [More Verification on Defense Methods] The current validation methods assessing the efficacy of FAGAN against defense mechanisms seem to be somewhat limited. It might be better to include additional defense methods, such as DUP-Net defense and IF-Defense.
2. [Extend to the Physical World] The experiments described in this article are exclusively conducted within a digital framework. It would be compelling if the authors could extend their validations to include physical world scenarios. Doing so could potentially strengthen the effectiveness of your method and enhance FAGAN's practical applicability.
paper_summary: paper_summary: The paper presents a novel method called Frequency-Aware GAN for imperceptible transfer attacks on 3D point clouds. This approach leverages the Graph Fourier Transform (GFT) to manipulate point cloud data imperceptibly and ensure the perturbations are transferable across different models. By integrating both frequency and spatial features, the method aims to generate adversarial point clouds that are both effective in attacks and less detectable by human observers or automated systems.
strength_weakness: strength_weakness: 1. Utilizing frequency components in the GAN framework helps maintain the geometric integrity of the point clouds, making the adversarial examples hard to detect visually.
2.The dual learning approach with a frequency-aware discriminator enhances the ability of adversarial examples to perform across various unknown 3D models, making it robust in black-box scenarios.
limitations: limitations: The method proposed in this paper is intriguing; however, I have the following concerns:

Firstly, the computational cost introduced by the proposed method should be considered in the experiments, and further comparisons are needed.

Secondly, compared to other methods, the proposed approach does not seem to make significant advancements. Are there additional experiments that could demonstrate the effectiveness of the method?

Lastly, it would be beneficial to include more visual results that intuitively demonstrate the advantages of the method. If these cannot be provided in the response, I hope the authors can incorporate them into the article. Currently, it is challenging to understand the effective work done from the article, and I suggest that the authors enhance the readability of the paper.

If my concerns are addressed, I would consider raising the score.