Improving Robustness of 3D Point Cloud Recognition from a Fourier Perspective

Authors: yibo  miao
yinpeng  dong
jinlai  zhang
lijia  yu
xiao  yang
xiao-shan  gao
Venue: NeurIPS_cc_2024_Conference
Published: 2024-05-12 06:38:14

Abstract: Although 3D point cloud recognition has achieved substantial progress on standard benchmarks, the typical models are vulnerable to point cloud corruptions, leading to security threats in real-world applications. To improve the corruption robustness, various data augmentation methods have been studied, but they are mainly limited to the spatial domain. As the point cloud has low information density and significant spatial redundancy, it is challenging to analyze the effects of corruptions. In this paper, we focus on the frequency domain to observe the underlying structure of point clouds and their corruptions. Through graph Fourier transform (GFT), we observe a correlation between the corruption robustness of point cloud recognition models and their sensitivity to different frequency bands, which is measured by the GFT spectrum of the model’s Jacobian matrix. To reduce the sensitivity and improve the corruption robustness, we propose Frequency Adversarial Training (FAT) that adopts frequency-domain adversarial examples as data augmentation to train robust point cloud recognition models against corruptions. Theoretically, we provide a guarantee of FAT on its out-of-distribution generalization performance. Empirically, we conduct extensive experiments with various network architectures to validate the effectiveness of FAT, which achieves the new state-of-the-art results.

Main paper: 
 introduction: 
 3D point cloud recognition based on deep neural networks (DNNs) [35, 36, 65] has achieved unprecedented performance on typical benchmarks [5, 67] , which assume that the data are independently and identically distributed. However, in practical scenarios, point clouds suffer from severe corruptions (e.g., noise, density change, transformation) due to sensor imprecision and scene complexity [66, 76] . When the testing distribution is different from the training distribution caused by corruption, point cloud recognition models have significant performance degradation [41, 51] , indicating that they lack the robustness of human visual system [40] , while also raising concerns about safety and reliability of these models. As deep 3D point cloud recognition has been increasingly deployed in safety-critical applications, such as autonomous driving [6, 84] , robotics [60, 92] , and medical image processing [54] , it is of crucial importance to improve the robustness of 3D point cloud recognition models to out-of-distribution (OOD) point cloud data induced by corruptions [10] . The graph frequency-domain representations of "Jitter" and "Rotate" in ModelNet-C [41] . "Jitter" has higher power in the high-frequency region, while "Rotate" has higher power in the low-frequency region. (b): The relationship between the corruption robustness (measured by mean overall accuracy (mOA) [41] ) of various models and the sensitivity to high/low frequency bands. Our proposed high/low frequency sensitivity metric is negatively correlated with the model's robustness under high/low frequency corruptions.To improve the corruption robustness, the most effective approaches to date are based on carefully designed data augmentation techniques [41, 51] . Inspired by 2D image augmentations [85, 89] , some methods blend two point clouds for data augmentation using shortest-path interpolation (e.g., Point-Mixup [7] ), random blending (e.g., PointCutMix-R [90] ), and rigid transformation (e.g., RSMix [24] , PointCutMix-K [90] ). PointWOLF [22] enriches data diversity by applying non-rigid deformation to object parts. WOLFMix [41] deforms objects first and then rigidly blends two deformed objects. Although these data augmentation techniques improve the corruption robustness to some extent, they are all based on spatial-domain transformations. Raw point clouds in the spatial domain have low information density and heavy spatial redundancy [8] , making it challenging to analyze which specific information is corrupted. To address this challenge, we shift our attention from the spatial domain to the frequency domain to analyze the underlying structure of point clouds that is not easily observable from the raw point clouds. In the frequency domain, point clouds are compactly represented, facilitating a better understanding of low-level distortions that are free of high-level semantics.To design robust models, the first step is to understand how corruption is represented in the frequency domain. We achieve this by transforming the raw point clouds and the corresponding corruptions into compact representations in the frequency domain using the graph Fourier transform (GFT) [43] . By visualizing the transformed signals, we observe that different corruptions affect varying frequency bands, as shown in Fig. 1(a) . Motivated by the differences, we investigate the relationship between the corruption robustness of various point cloud recognition models and their sensitivity to different frequency bands [81] . To measure the sensitivity, we design a novel metric based on GFT spectrum of the Jacobian matrix of the model, as shown in Fig. 3 . Our key insight is that our proposed high/low frequency sensitivity metric is negatively correlated with the model's robustness under high/low frequency corruptions, as shown in Fig. 1(b) . This correlation emphasizes the importance of the model's sensitivity to high and low frequencies for corruption robustness. However, it is still challenging to simultaneously reduce the sensitivity of point cloud recognition models to both high and low frequencies.To address this issue, we propose Frequency Adversarial Training (FAT) to improve the corruption robustness of 3D point cloud recognition models. FAT trains a model with adversarial examples that add perturbations to the frequency-domain representations of point clouds. Intuitively, a model robust to worst-case perturbations should be more resistant to real-world corruptions [72, 80] . We provide a theoretical analysis that demonstrates the effectiveness of FAT in ensuring OOD generalization of the model, as shown in Theorem 1. To eliminate potential performance degradation due to mutual interference between high and low frequency signals, we utilize the AdvProp training framework [72] , based on which we use three separate batch normalization (BN) statistics for clean samples, highfrequency adversarial samples, and low-frequency adversarial samples, respectively. We conducted extensive experiments to validate the effectiveness of our approach in improving the robustness of point cloud recognition models under common corruptions [41, 51] . With various network architectures, our method improves the corruption robustness by a large margin. By integrating our approach with previous data augmentation techniques, we achieve the new state-of-the-art performance. 
related work: 
 Deep learning on 3D point clouds. Deep 3D point cloud recognition [16, 35, 38, 55, 70, 73, 79] has emerged in recent years as a prominent research area with diverse applications in several fields such as 3D object classification [46, 83, 86] , 3D scene segmentation [20, 64, 75] , and 3D object detection in autonomous driving [77, 95] . One of the pioneering works is PointNet [35] , which employs a multilayer perceptron to learn point features and utilizes a max-pool module to aggregate them efficiently. Many subsequent works [13, 30, 36, 78] improve upon PointNet. Several approaches focus on designing special convolutions on 3D domains [26, 31, 56] or developing graph neural networks [14, 44, 65] to improve point cloud recognition, such as DGCNN [65] which builds a dynamic graph for point cloud data. Recently, drawing inspiration from research in the frequency domain [4, 49, 61, 81] , GDANet [74] introduces a geometry-disentangle module to dynamically separate point clouds into the contour and flat parts of 3D objects, thereby capturing complementary 3D geometric semantics. PCT [17] uses Transformer to improve point cloud learning. Additionally, there is a growing discussion on point cloud augmentation, including mix-based augmentations [7, 90] , deformation-based augmentations [22] , and auto-augmentations [25] .Robustness in 3D point cloud recognition. Following the previous studies on robustness in the 2D image domain [53, 3, 15, 19, 32, 42, 59, 9, 82] , several works [18, 50, 52, 63, 69, 34, 97] have explored the robustness of 3D point cloud classifiers. Concerning adversarial robustness, Xiang et al. [69] first demonstrate that point cloud recognition is vulnerable to adversarial point generation attacks. Further research [21, 28, 29, 57, 91, 2] has employed gradient-based point perturbation attacks. Some defensive techniques are proposed, such as input randomization [12, 93] and geometryaware framework [68] to defend against such vulnerabilities. Sun et al. [47, 48] have studied the effectiveness of adversarial training and pre-training on self-supervised tasks in enhancing robustness. In terms of corruption robustness, some works have studied the problem using invariant feature extraction [71] , and adaptive sampling [76] . Recently, two benchmarks [41, 51] are developed for the robustness of 3D point cloud recognition under corruptions and demonstrate the effectiveness of data augmentation. However, unlike the existing spatial-domain data augmentation techniques [22, 25] , in this paper, we focus on the frequency domain and propose Frequency Adversarial Training (FAT) to improve the model's out-of-distribution generalization ability.Question: Does the paper discuss the limitations of the work performed by the authors?Answer: [Yes]Justification: We have discussed limitations in Section 5.Guidelines:• The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper. • The authors are encouraged to create a separate "Limitations" section in their paper.• The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be. • The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on a few datasets or with a few runs. In general, empirical results often depend on implicit assumptions, which should be articulated. • The authors should reflect on the factors that influence the performance of the approach.For example, a facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or a speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon. • The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size. • If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness. • While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an important role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations. 
methodology: 
 The existing 3D point cloud recognition models exhibit significant performance degradation under point cloud corruptions [41, 51] . Although data augmentation techniques have shown the effectiveness in improving robustness, they are typically based on spatial-domain transformations, which suffer from low information density and heavy spatial redundancy of the raw point clouds. Consequently, it is difficult to analyze which specific information has been lost due to corruptions within the spatial domain. To address this challenge, we shift our focus to the frequency domain, which enables us to analyze the underlying structure of point clouds.In the following, we first provide the background knowledge of graph Fourier transform (GFT) in Sec. 3.1, then analyze the point cloud corruptions in the frequency domain in Sec. 3.2, and investigate the relationship between the model's corruption robustness and sensitivity to frequency changes in Sec. 3.3. Based on the analyses, we propose a Frequency Adversarial Training (FAT) method detailed in Sec. 3.4 with a theoretical analysis to guarantee its effectiveness in Sec. 3.5.Images are typically transformed and recovered in the frequency domain with the 2D discrete Fourier transform (DFT) and inverse DFT [39] . Unlike images, although 3D point clouds are highly structured, they reside on irregular domains without an ordering of points, hindering the deployment of traditional Fourier transforms. However, graphs provide a natural and accurate representation of The frequencies are arranged from left to right in ascending order. The other seven images display the graph frequency-domain representations of each corruption in ModelNet-C [41] . The raw point clouds exhibit higher power in the low-frequency region. The corruption "Jitter" has much higher power in the high-frequency region.The power of corruptions such as "Rotate" and "Scale" is concentrated on the low-frequency components.irregular point clouds. Once a graph is constructed to represent the point cloud, the graph Fourier transform (GFT) [43] can compactly transform it into the frequency domain.Given a point cloud P := {p i } n i=1 ∈ R n×3 of n points, where p i denotes the xyz coordinates of a point, we construct a directed graph G = {P, E, W } to represent it. The graph consists of a vertex set P, an edge set E connecting the vertices, and an adjacency matrix W . The entry w i,j in the adjacency matrix represents the weight of the edge from vertices i to j, which is used to capture the similarity between adjacent vertices. Here, we construct a weighted k-nearest neighbor graph (i.e., each vertex is only connected to its k-nearest neighbors) using the Euclidean distance d ij = ∥p i -p j ∥ 2 between vertices i and j, and the weight of the edge is w i,j = e -d 2 ij .After constructing the graph representation of the point cloud, we focus on the combinatorial graph Laplacian [45] , defined as L := D -W , where D is a diagonal matrix with the i-th diagonal entry d i,i = n j=1 w i,j representing the degree of the i-th node. L is symmetric and positive semidefinite, and can be eigen-decomposed as L = U ΛU ⊤ , where U = [u 1 , ..., u n ] is an orthogonal matrix containing the eigenvectors u i , and Λ = diag(λ 1 , ..., λ n ) is a diagonal matrix containing the eigenvalues. The eigenvalues are sorted in ascending order, representing frequencies from low to high. For a point cloud P, the graph Fourier transform (GFT) can be applied to transform it into a compact representation in the frequency domain: P = GF(P) := U ⊤ P. The low-frequency components represent the coarse shape of the point cloud, while the high-frequency components represent the fine details. The inverse graph Fourier transform (IGFT) can be used to recover the point cloud in the spatial domain as P = GF -1 ( P) := U P.We employ GFT to transform point clouds and their corruptions into compact representations in the frequency domain, allowing us to analyze the underlying structures of these low-level distortions that are hardly observable in the spatial domain. For raw point clouds, we transform them to the frequencydomain representations and calculate E P [|GF(P)|] by averaging over all validation point clouds in ModelNet40 [67] . For each corruption type in ModelNet-C [41] , we calculate E P [|GF(C(P) -P)|] similarly, where C denotes the corruption function. As the input point clouds have three spatial axes (x, y, z), we take the average over these channels. In Fig. 2 , we visualize the graph frequency-domain representations of raw point clouds and the corruptions in ModelNet-C. We can see that the raw point clouds have higher power in the low-frequency region, while the corruption "Jitter" leads to higher power in the high-frequency region. For corruptions such as "Rotate" and "Scale", the corrupted power is concentrated more on the low-frequency components. The results demonstrate that different corruptions of point clouds affect different frequency bands.Motivated by the different effects of corruptions on varying frequency bands observed in the graph frequency-domain representations, we investigate the relationship between the corruption robustness of 3D point cloud recognition models and their sensitivity to different frequency bands. To measure the sensitivity of a model on different frequency bands, we propose to perform graph Fourier transform (GFT) on the Jacobian matrix of the model's output loss with respect to its input point cloud. Intuitively, the Jacobian matrix represents how the model's output changes with small variations in its input point cloud, revealing its sensitivity to different points in the spatial domain [1] .With GFT, we can obtain the frequency-domain representation of the Jacobian matrix, which reveals the model's sensitivity to different frequency bands of input. If a model's Jacobian matrix has a high proportion of low/high frequency components, it will be sensitive to low/high frequency bands.Fig. 3 illustrates the computation of the frequency-domain Jacobian matrix for a single point cloud. Specifically, given an input point cloud P, a classification model h, and a standard cross-entropy loss function L h for the classification task, the Jacobian matrix J (P) := ∇ P L h of the loss with respect to the input point cloud can be calculated. We then perform GFT on J (P) to obtain its frequency-domain representation, denoted as J (P) = U ⊤ J (P) in a compact form, using the original point cloud's neighborhood relations and feature vector matrix. Since the input point cloud has three axis channels (x, y, z), we take the average of these channels and normalize the result. We measure the model's sensitivity to input perturbations in the low-frequency band by summing the squares of the amplitudes of the first λ frequencies of the Jacobian matrix's graph Fourier spectrum. The sensitivity to high-frequency perturbations is measured by summing the squares of the amplitudes of the remaining 1024 -λ frequencies. A higher value of the metric indicates greater sensitivity to perturbations in that frequency band.We can now measure the importance of the sensitivity to different frequency bands of point cloud recognition models on their corruption robustness. First, we measure and establish the relationship between sensitivity to high/low frequency bands of different point cloud models and their accuracy under high/low frequency corruptions. As illustrated in Fig. 1 (b), our proposed frequency sensitivity metrics are negatively correlated with the corruption robustness. Therefore, point cloud models that are less sensitive to high/low frequency bands exhibit better robustness to high/low frequency corruptions. This correlation indicates that the sensitivity of models to different frequency bands affects their corruption robustness, providing insights for further improving the robustness of point cloud recognition models.The above analyses highlight the importance of the sensitivity of point cloud recognition models to high and low frequencies on their corruption robustness. However, reducing the sensitivity of point cloud models to both high and low frequencies is still challenging. To address this problem, we propose Frequency Adversarial Training (FAT) to improve the corruption robustness of point cloud recognition models using adversarial examples in the frequency domain. Intuitively, a model trained to be robust to worst-case adversarial perturbations should be naturally robust to real-world corruptions [72, 80] , as also theoretically demonstrated in Sec. where clean samples, high-frequency adversarial samples, and low-frequency adversarial samples are separately processed using three batch normalizations during adversarial training. Specifically, for an input point cloud P with the ground-truth label y, our optimization objective isEQUATIONwhere D is the underlying data distribution, L h is the loss function, θ is the network parameter, ϵ h and ϵ l are high-frequency and low-frequency adversarial perturbations, and S h and S l are the high-frequency and low-frequency perturbation ranges, respectively.To verify the claim that a model robust to frequency-domain worst-case perturbations should be more resistant to real-world corruptions, we provide a theoretical analysis that demonstrates the effectiveness of FAT in ensuring OOD generalization of the model.Suppose (x, y) is a pair of training sample x and its label y. The loss on (x, y) with model parameter θ is L(θ, (x, y)), where L(θ, (x, y)) is continuous and differentiable for both θ and (x, y). We let f (x) := L(θ, (x, y)) for simplicity. Let F and F -1 denote the Fourier transform and inverse Fourier transform, respectively. The norm ∥ • ∥ p denotes the ℓ p -norm. We have the following theorem:Theorem 1. If f satisfies that: f (x) ∈ [0, M ] for all x, |f (F -1 (F(x) + α)) -f (x)| ≤ ϵfor all x and ∥α∥ p ≤ δ, then for any distribution P o and P a satisfying that W asp (P o , P a ) := (inf u∈Π(Po,Pa) E (x,z)∼u [∥F(x) -F(z)∥ p p ]) 1/p ≤ η,where η < δ, then, with probability 1 -γ, we have:EQUATIONwhere {x i } m i=1 are i.i.d. samples from P a . Remark 1. Intuitively, OOD corresponds to the shifted distribution P o that approaches the training distribution P a . Thus W as p (P o , P a ) defines OOD from the perspective of measuring the distance between distributions.E z∼Po [f (z)] -1 m m i=1 f (x i ) represents the OOD generalization error of the model. |f (F -1 (F(x) + α)) -f (x)| ≤ ϵ and ∥α∥ p ≤ δ indicatethat the model is robust under frequency-domain perturbations. The bound (2) implies that models that are adversarially robust in the frequency-domain have smaller generalization bounds on OOD data.The proof of Theorem 1 is deferred to Appendix A. Thus, the frequency-domain adversarial robustness of the model guarantees the generalization on OOD data. We have the following observations:• The right-hand side of Eq. ( 2) implies that models that are more robust to frequency domain adversarial samples (i.e., larger δ and smaller ϵ) have smaller OOD generalization bounds and thus perform better on OOD data.• For Eq. ( 2), a larger number of training samples m leads to a smaller OOD generalization bound. This indicates that more training samples can compensate for the degradation of generalization performance.Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof?Answer: [Yes]Answer: [Yes] Justification: We have provided our codes in the supplemental matrial. Guidelines:• The answer NA means that paper does not include experiments requiring code. Guidelines:• The answer NA means that the paper does not include experiments.• The experimental setting should be presented in the core of the paper to a level of detail that is necessary to appreciate the results and make sense of them. • The full details can be provided either with the code, in appendix, or as supplemental material. 
experiments: 
 In this section, we first detail the experimental settings in Sec. 4.1, then present the main results in Sec. 4.2 to show the effectiveness of our method. We further integrate our method with other data augmentation techniques in Sec. 4.3 and perform ablation studies in Sec. 4.4. Dataset. To validate the effectiveness of our FAT method in enhancing the corruption robustness of 3D point cloud recognition models, we train all models on the standard ModelNet40 training set [67] .In addition to reporting the performance of the models on the original ModelNet40 validation set, we also evaluate the corruption robustness on ModelNet-C [41] in the main paper and ModelNet40-C [51] in Appendix B. The ModelNet40 dataset [67] contains 12,311 CAD models with 40 common object categories in the real world. We use the official split [35] , where 9,843 examples are used for training and the remaining 2,468 examples are used for testing. The ModelNet-C dataset [41] is designed for measuring the network robustness to common point cloud corruptions. It consists of 7 different corruption types, including "Scale", "Jitter", "Rotate", "Drop Global", "Drop Local", "Add Global", and "Add Local". Each type of corruption has five severity levels. ModelNet40-C [51] is a similar dataset with 15 corruptions, which will be detailed in Appendix B.Model architectures. Following [41, 51] , we select four representative model architectures: Point-Net [35] , DGCNN [65] , PCT [17] , and GDANet [74] . These models represent different architectural designs and have been widely applied in 3D visual tasks.Evaluation metrics. To measure the corruption robustness of different methods, we follow [41] and use the mean corruption error (mCE) as the main evaluation metric. We adopt the official baseline DGCNN and first compute the corruption error (CE) for a given corruption type i by averaging over 5 severity levels:CE i = 5 l=1 (1-OA i,l ) 5 l=1 (1-OA DGCNN i,l) , where OA i,l is the overall accuracy on a corruption test set i at severity level l, and OA DGCNN i,l is the overall accuracy of the baseline. Then, we average over the 7 corruption types to compute the mean corruption error: mCE = 1 N N i=1 CE i . In addition, we also report the clean overall accuracy (OA), the corruption overall accuracy (mOA), and the relative mCE (RmCE) following [41] . Due to space constraints, we provide the definition of RmCE and report mOA and RmCE in Appendix B.Implementation details. For each method, we train 250 epochs using the smooth cross-entropy loss [65] and Adam optimizer [23] , and select the best performant model for further evaluation. We follow the DGCNN protocol [16] . For our method, we set k = 30 for the k-nearest neighbor graph and λ = 100 for dividing high-frequency and low-frequency [29] . We use PGD [33] and AOF [27] to generate high-frequency adversarial examples and low-frequency adversarial examples, respectively. We constrain S h and S l by 0.3 and 0.5, respectively. For more detailed training settings, please refer to Appendix B. In this section, following [41, 51] 1 , the two methods are complementary and synergistic, leading to improved model robustness. We report the performance of different methods in terms of overall corruption accuracy (mOA) and relative mCE (RmCE) in Appendix B, where the improvement in robustness of FAT is also significant under these metrics. The comparisons in Table 1 and Appendix B confirm that our proposed FAT enhances the OOD generalization ability of the model.To further validate the effectiveness of our proposed Frequency Adversarial Training (FAT), following [41] , we investigate the performance of FAT in combination with different data augmentation strategies, including RSMix [24] , PointWOLF [22] , and WOLFMix [41] . In Table 2 , we show the performance of FAT when integrated with different data augmentation strategies in terms of mean corruption error (mCE), clean overall accuracy (OA), and corruption error (CE) for each corruption type. Compared with a single data augmentation strategy, the combination of FAT and data augmentation strategies achieves a better mCE, which is attributed to the complementary and compatible information from both the spatial and frequency domains. The improvement in corruption robustness under three different data augmentation strategies demonstrates the generalization capability of our proposed method. As shown in Table 2 , training GDANet with the combination of our proposed FAT with WOLFMix achieves a new state-of-the-art performance, with an impressive 0.537 mCE.  
conclusion: 
 In this paper, we study the robustness of 3D point cloud recognition models under common corruptions. We focus on the frequency domain to analyze the underlying structure of point clouds and common corruptions. Through graph Fourier transform (GFT), we identify a correlation between the corruption robustness and the model sensitivity to different frequency bands. Motivated by the analysis, we propose Frequency Adversarial Training (FAT), an adversarial training method based on frequency-domain adversarial examples to improve the corruption robustness of 3D point cloud recognition models. Extensive experiments demonstrate that the proposed method significantly improves the corruption robustness of various point cloud models, and can be integrated with other data augmentation techniques to achieve the state-of-the-art performance.Limitation and broader impact. A limitation of our proposed method is that it reduces the clean accuracy a bit, e.g., FAT reduces the clean accuracy of DGCNN by 0.1%, PointNet by 0.5%, PCT by 1.0%, and GDANet by 0.6%. This may be caused by the inherent trade-off between accuracy and robustness [88] . Additionally, despite the complexity in implementation, FAT does not affect the efficiency of model inference, ensuring unhindered deployment of well-trained models in practical applications. The robustness of 3D point cloud recognition under corruptions is a severe problem towards safe and reliable 3D perception. Our work proposes an effective method to solve this issue, which does not have any negative social impact.A Proof Theorem 1. If f satisfies that: f (x) ∈ [0, M ] for all x, |f (F -1 (F(x) + α)) -f (x)| ≤ ϵ for all x and ∥α∥ p ≤ δ, then for any distribution P o and P a satisfying that W as p (P o , P a ) := (inf u∈Π(Po,Pa) E (x,z)∼u [∥F(x) -F(z)∥ p p ]) 1/p ≤ η, where η < δ, then, with probability 1 -γ, we have:E z∼Po [f (z)] - 1 m m i=1 f (x i ) ≤ ϵ 1 - η p δ p - ln(4/γ) 2m + η p δ p M + 4M ln(4/γ) 2m , (A.1)where {x i } m i=1 are i.i.d. samples from P a .Proof. Assume u is a joint distribution of P o and P a , such that (E (x,z)∼u [∥F(x) -F(z)∥ p p ]) 1/p ≤ η. Firstly, by Markov inequality, we have that:P (x,z)∼u (∥F(x) -F(z)∥ p ≥ δ) = P (x,z)∼u (∥F(x) -F(z)∥ p p ≥ δ p ) ≤ E (x,z)∼u [∥F (x)-F (z)∥ p p ] δ p ≤ η p δ p . (A.2)Then, we have that:E (x,z)∼u [I(∥F(x) -F(z)∥ p ≤ δ)] = P (x,z)∼u (∥F(x) -F(z)∥ p ≤ δ) ≥ 1 - η p δ p . (A.3)Now, let {(x u i , z u i )} m i=1 be i.i.d. sampled from distribution u. Then, by Hoeffding inequality, we have that:(1): with probability 1 -γ/4, there are1 m m i=1 I(∥F(x u i ) -F(z u i )∥ p ≤ δ) ≥ E (x,z)∼u [I(∥F(x) -F(z)∥ p ≤ δ)] -ln(4/γ) 2m ≥ 1 -η p δ p -ln(4/γ) 2m , (A.4)which indicates that there are at least m(1EQUATION: with probability 1 -γ/4, there are- 1 m m i=1 f (z u i ) + E z∼Po [f (z)] = - 1 m m i=1 f (z u i ) + E (x,z)∼u [f (z)] ≤ M ln(4/γ) 2m ; (A.5)(3): with probability 1 -γ/4, there are1 m m i=1 f (x u i ) -E x∼Pa [f (x)] = 1 m m i=1 f (x u i ) -E (x,z)∼u [f (x)] ≤ M ln(4/γ) 2m ; (A.6)Let {x i } m i=1 are i.i.d. samples from distribution P a , then, by Hoeffding inequality, we have that: (4): with probability 1 -γ/4, there are- 1 m m i=1 f (x i ) + E x∼Pa [f (x)] ≤ M ln(4/γ) 2m ; (A.7)So, with probability 1 -γ makes that (1), ( 2), ( 3) and ( 4) stand, at this times, we can estimate theE z∼Po [f (z)] -1 m m i=1 f (x i ), there are: E z∼Po [f (z)] ≤ 1 m m i=1 f (z u i ) + M ln(4/γ) 2m ≤ 1 m m i=1 f (x u i ) + |f (x u i ) -f (z u i )| + M ln(4/γ) 2m ≤ 1 m m i=1 f (x u i ) + ϵI(∥F(x u i ) -F(z u i )∥ p ≤ δ) + M I(∥F(x u i ) -F(z u i )∥ p > δ) + M ln(4/γ) 2m ≤ 1 m m i=1 f (x u i ) + ϵ(1 -η p δ p -ln(4/γ) 2m ) + ( η p δ p + ln(4/γ) 2m )M + M ln(4/γ) 2m ≤ E x∼Pa [f (x)] + ϵ(1 -η p δ p -ln(4/γ) 2m ) + ( η p δ p + ln(4/γ) 2m )M + 2M ln(4/γ) 2m ≤ 1 m m i=1 f (x i ) + ϵ(1 -η p δ p -ln(4/γ) 2m ) + ( η p δ p + ln(4/γ) 2m )M + 3M ln(4/γ) 2m = 1 m m i=1 f (x i ) + ϵ(1 -η p δ p -ln(4/γ) 2m ) + M η p δ p + 4M ln(4/γ) 2m .(A.8) We get our conclusion.Our generalization bound can also be extended to Lipschitz neural networks, which are a class of networks with global Lipschitz constants [11, 87] .Corollary A.1. If f satisfies that: f (x) ∈ [0, M ] for all x ∈ [0, 1] n , |f (F -1 (F(x) + α)) -f (x)| ≤ ϵ∥α∥ p for all x ∈ [0, 1] nand α, then for any distribution P o and P a in [0, 1] n satisfying that W as p (P o , P a ) := (inf u∈Π(Po,Pa) E (x,z)∼u [∥F(x) -F(z)∥ p p ]) 1/p ≤ η, then, with probability 1 -γ, we have:E z∼Po [f (z)] - 1 m m i=1 f (x i ) ≤ ϵ(η + vη ln(4/γ) 2m ) + M v p + 3M ln(4/γ) 2m , (A.9)where {x i } m i=1 are i.i.d. samples from P a , v is any real number greater than 1.Proof. Assuming u is a joint distribution of P o and P a , and makes that (E (F (x),F (z))∼u [∥x -z∥ p p ]) 1/p ≤ η. Firstly, by Markov inequality, we have that:P (x,z)∼u (∥F(x) -F(z)∥ p ≥ vη) = P (x,z)∼u (∥F(x) -F(z)∥ p p ≥ (vη) p ) ≤ E (x,z)∼u [∥F (x)-F (z)∥ p p ] (vη) p ≤ η p (vη) p = (1/v) p . (A.10)Then, we have that:E (x,z)∼u (I(∥F(x) -F(z)∥ p ≤ vη)) = P (x,z)∼u (∥F(x) -F(z)∥ p ≤ vη) ≥ 1 - 1 v p . (A.11) Now, let {(x i , z i )} mi=1 are i.i.d. samples from distribution u. Then, by Hoeffding inequality, we have that:(1): with probability 1 -γ/4, there are1 m m i=1 I(∥F(x u i ) -F(z u i )∥ p ≤ vη)∥F(x u i ) -F(z u i )∥ p ≤ E (x,z)∼u [I(∥F(x u i ) -F(z u i )∥ p ≤ vη)∥F(x) -F(z)∥ p ] + vη ln(4/γ) 2m ≤ (E (x,z)∼u [∥F(x) -F(z)∥ p p ]) 1/p + vη ln(4/γ) 2m = η + vη ln(4/γ) 2m ;(A.12)(2): with probability 1 -γ/4, there are- 1 m m i=1 f (z u i ) + E z∼Po [f (z)]| = - 1 m m i=1 f (z u i ) + E (x,z)∼u [f (z)] ≤ M ln(4/γ) 2m ; (A.13)(3): with probability 1 -γ/4, there are1 m m i=1 f (x u i ) -E x∼Pa [f (x)] = 1 m m i=1 f (x u i ) -E (x,z)∼u [f (x)] ≤ M ln(4/γ) 2m ; (A.14)Let {x i } m i=1 are i.i.d. samples from distribution P a , then, by Hoeffding inequality, we have that: (4): with probability 1 -γ/4, there are- 1 m m i=1 f (x i ) + E x∼Pa [f (x)] ≤ M ln(4/γ) 2m ; (A.15)So, with probability 1 -γ makes that ( 1), ( 2), ( 3) and ( 4) stand, at this times, we can estimate theE z∼Po [f (z)] -1 m m i=1 f (x i), there are:E z∼Po [f (z)] ≤ 1 m m i=1 f (z u i ) + M ln(4/γ) 2m ≤ 1 m m i=1 f (x u i ) + |f (x u i ) -f (z u i )| + M ln(4/γ) 2m ≤ 1 m m i=1 f (x u i ) + ϵ∥F(x u i ) -F(z u i )∥ p I(∥F(x u i ) -F(z u i )∥ p ≤ vη) +M I(∥F(x u i ) -F(z u i )∥ p > vη) + M ln(4/γ) 2m ≤ 1 m m i=1 f (x u i ) + ϵ(η + vη ln(4/γ) 2m ) + M v p + M ln(4/γ) 2m ≤ E x∼Pa [f (x)] + ϵ(η + vη ln(4/γ) 2m ) + M v p + 2M ln(4/γ) 2m ≤ 1 m m i=1 f (x i ) + ϵ(η + vη ln(4/γ) 2m ) + M v p + 3M ln(4/γ) 2m .(A.16)We get our conclusion. 
experiment statistical significance: 
 Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?Answer: [No] Justification: For fair comparison, we do not provide error bars because there are many baseline methods, it is computationally expensive to reproduce all of these methods.Guidelines:• The answer NA means that the paper does not include experiments.• The authors should answer "Yes" if the results are accompanied by error bars, confidence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper. • The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions). • The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.) • The assumptions made should be given (e.g., Normally distributed errors).• It should be clear whether the error bar is the standard deviation or the standard error of the mean. • It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have a 96% CI, if the hypothesis of Normality of errors is not verified. • For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out of range (e.g. negative error rates). • If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text. 
broader impacts: 
 Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?Answer: [Yes]Justification: We have discussed them in Appendix 5.Guidelines:• The answer NA means that there is no societal impact of the work performed.• If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact. • Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.• The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster. • The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology. • If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML). 
safeguards: 
 Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?Answer: [NA] Justification: Our paper poses no such risks.Guidelines:• The answer NA means that the paper poses no such risks.• Released models that have a high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters. • Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images. • We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make a best faith effort.12. Licenses for existing assets Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?Answer: [Yes] Justification: We use open-source dataset and models in our paper, and have cited the original paper of these dataset and models.Guidelines:• The answer NA means that the paper does not use existing assets.• The authors should cite the original paper that produced the code package or dataset.• The authors should state which version of the asset is used and, if possible, include a URL. • The name of the license (e.g., CC-BY 4.0) should be included for each asset.• For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided. • If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswithcode.com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of a dataset. • For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided. 
 
 Appendix: In this section, we provide more experimental results. All of the experiments are conducted on NVIDIA Tesla V100 GPUs.In this section, we present full results for corruption overall accuracy (mOA) and relative mCE (RmCE) [41] . The mOA is computed as the average OA over all corruptions. The RmCE quantifies the performance drop compared to a clean test set. We adopt the official baseline DGCNN and ) , where OA clean is the overall accuracy on the clean test set. Subsequently, we compute the relative mean corruption error (RmCE) by averaging over the 7 corruption types: RmCE = 1 N N i=1 RCE i . In Tables B.1 and B.2, we compare different methods based on the mOA and RmCE metrics, confirming that our proposed FAT enhances the model's out-of-distribution generalization ability.In this section, we evaluate the corruption robustness on ModelNet40-C [51] . The ModelNet40-C dataset is specifically designed to assess the network robustness against prevalent point cloud corruptions. It consists of 15 different corruption types, including "Uniform", "Gaussian", "Impulse", "Upsampling", "Background", "Occlusion", "LiDAR", "Local Density Inc", "Local Density Dec", "Cutout", "Rotation", "Shear", "FFD", "RBF", and "Inv RBF". Each type of corruption has 5 severity Table B .4: Quantitative results of the performance of FAT when integrated with data augmentation strategy in terms of mCE and ERcor on the ModelNet40-C test set. In previous studies [51] , PCT with CutMix-R achieves the best robustness with the 0.635 mCE and 0.163 ERcor. However, training GDANet with the combination of our proposed FAT with WOLFMix achieves the new state-of-the-art performance, with the impressive 0.555 mCE and 0.147 ERcor. Justification: Our paper supports the claims made in the abstract and introduction.Guidelines:• The answer NA means that the abstract and introduction do not include the claims made in the paper. • The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers. • The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings. • It is fine to include aspirational goals as motivation as long as it is clear that these goals are not attained by the paper.Question: For each experiment, does the paper provide sufficient information on the computer resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?Answer: [Yes] Justification: Justification: We have provided them in Appendix B.Guidelines:• The answer NA means that the paper does not include experiments.• The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage. • The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute. • The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make it into the paper). Guidelines:• The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.• If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics. • The authors should make sure to preserve anonymity (e.g., if there is a special consideration due to laws or regulations in their jurisdiction). 


Decision: This paper proposes a novel approach to improving the robustness of 3D point cloud recognition against corruptions by operating in the frequency domain. The method leverages the Graph Fourier Transform (GFT) to analyze and modify frequency components, enhancing corruption robustness. Extensive experiments demonstrate FAT's effectiveness across various network architectures and datasets, achieving state-of-the-art performance. The method is particularly relevant for safety-critical applications like autonomous driving.

The proposed method and the perspective to tackle 3D point cloud robustness is novel. The work offers strong theoretical grounding and empirical results, demonstrating the effectiveness on multiple architectures and datasets. Comprehensive experiments across various network architectures, including newer ones, and additional datasets such as KITTI and ScanObjectNN, are conducted. Although there were concerns regarding the limited real-world dataset usage (initially) and other ones such as complexity of implementation, impact on clean accuracy, and lack of comparison with specific attack methods, the value of the work outweighs its limitations. The authors have also effectively addressed concerns raised by reviewers, including adding real-world dataset experiments. These factors collectively justify an acceptance.

Reviews: review: paper_summary: paper_summary: This paper introduces a novel approach to improving the robustness of 3D point cloud recognition models by introducing Frequency Adversarial Training (FAT). By analyzing the frequency space of point clouds through the graph Fourier transform, the authors found that models are sensitive against different frequency bands of corruptions. To reduce the effect of both low and high frequency corruptions, the authors propose FAT, which introduces adversarial examples during training that were generated by perturbing the point cloud’s frequency space and taking the inverse graph Fourier transform. From the authors’ experiments, FAT significantly improved the robustness of point cloud recognition models and was able to achieve a new state-of-the-art performance.
strength_weakness: strength_weakness: While the paper mentions the importance of robust models for real-world applications, it exclusively evaluates models trained with FAT on synthetic datasets like ModelNet-C and ModelNet40-C. Evaluating FAT using data from sensors such as LiDAR would further show FAT’s applicability under real-world conditions (such as KITTI dataset, if possible). Additionally, the paper does not discuss the complexity and efficiency of FAT, which are important factors for real-world applications.
questions: questions: It will be great to see some results on real-world datasets such as KITTI.
limitations: limitations: N/A
paper_summary: paper_summary: This paper studies how to enhance the robustness of 3D point cloud recognition. The authors propose Frequency Adversarial Training (FAT) to improve the corruption robustness of 3D point cloud recognition models. FAT trains a model with adversarial examples that add perturbations to the frequency-domain representations of point clouds.
strength_weakness: strength_weakness: - This paper considers limited real-world applications. 3D point cloud recognition often fails due to LiDAR sensor inaccuracies and changes in the physical environment. However, this paper only utilizes one dataset, ModelNet40, where points are generated via 3D modeling techniques instead of being collected from real-world sensors, which is not convincing. If the paper aims to address real-world problems, it would be more convincing to include more real-world datasets, such as the KITTI dataset, where point clouds are collected from LiDAR sensors. 

- The defense performance does not significantly outperform baseline methods. As shown in Table 1, FAT only outperforms baseline methods by a few points. Moreover, the proposed method appears to be effective only when combined with other data augmentation techniques. Could the authors provide more details and an explanation of the phenomenon of the ‘surprising results’ mentioned in the paper? For example, why does mixing methods result in much better defense?

- This paper does not analyze the relationship between the frequency and spatial domains in the context of the 3D point cloud. The two domains are mutually transformable, but the paper does not provide insights into their relationships or general observations.

- The paper only studies the defense effects against general 3D data corruptions without considering specific attack methods. It remains unclear if this approach can also defend against specific attack methods targeting 3D perception, such as attacks using adversarial points with specific shapes, locations, and rotation angles. The following are a few works about attacks against LiDAR object detection in autonomous driving scenarios [1-4] for reference.

[1] Yulong Cao, Chaowei Xiao, Dawei Yang, Jing Fang, Ruigang Yang, Mingyan Liu, and Bo Li. 2019. Adversarial objects against lidar-based autonomous driving systems. arXiv preprint arXiv:1907.05418 (2019).
[2] James Tu, Mengye Ren, Sivabalan Manivasagam, Ming Liang, Bin Yang, Richard Du, Frank Cheng, and Raquel Urtasun. 2020. Physically realizable adversarial examples for lidar object detection. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition.
[3] Yi Zhu, Chenglin Miao, Tianhang Zheng, Foad Hajiaghajani, Lu Su, and Chunming Qiao. 2021. Can we use arbitrary objects to attack lidar perception in autonomous driving?. In Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security.
[4] Shenchen Zhu, Yue Zhao, Kai Chen, Bo Wang, Hualong Ma, and Cheng’an Wei. 2024. AE-Morpher: Improve Physical Robustness of Adversarial Objects against LiDAR-based Detectors via Object Reconstruction. In Proceedings of the 33rd USENIX Security Symposium.
questions: questions: Q1: As mentioned earlier in your paper, the corruption of 3D point clouds often occurs in real-world applications due to environmental noise and reflections. For instance, in autonomous driving scenarios, the LiDAR sensor may only capture partial points of the target vehicle because of occlusion and distance effects. However, this paper does not study those real-world data. I am curious whether your method would be effective on real-world datasets, such as the KITTI and Waymo driving datasets. Solely using ModelNet40 is not convincing.

Q2: Can the proposed approach maintain good performance when considering specific attack methods, such as those using adversarial points with specific shapes, locations, and rotation angles?

Q3: Modifications in the frequency domain can sometimes result in physically unrealizable transformations in the spatial domain. Will this limit the application of your work in real-world scenarios?

Q4: Can the authors provide more details on the reasons for using GFT rather than DCT or other frequency transformation methods?

Q5: What would be the outcome if medium frequency bands were modified? The proposed methods seem to only consider high and low frequencies.
limitations: limitations: Yes.
paper_summary: paper_summary: This paper introduces Frequency Adversarial Training (FAT), leveraging Graph Fourier Transform (GFT) to enhance robustness against point cloud corruptions by training models with frequency-domain adversarial examples, demonstrating significant improvements in robustness across various architectures through extensive experiments.
strength_weakness: strength_weakness: 1.	Complexity of Implementation: The proposed FAT method involves several complex steps, including the generation of high-frequency and low-frequency adversarial examples and the use of multiple batch normalizations. This complexity might hinder the adoption of the method in practical scenarios.
2.	Limited Impact on Clean Accuracy: The paper mentions a slight reduction in clean accuracy when using FAT, which might be a concern for applications where both robustness and accuracy are critical.
3.	Generality of Results: While the experiments demonstrate the effectiveness of FAT on several models and datasets, additional experiments on more diverse datasets and real-world scenarios could further validate the generalizability of the approach, e.g.ShapeNet-C[1] and ScanObjectNN-C[2] 
4.	Lack of Updated Baselines in Experiments: In Table 1, the paper lacks experiments comparing some updated point cloud baselines, like RPC[3] and PointNeXt[4], which could provide a more comprehensive evaluation of the proposed method.
5.	Missing Comparison with Updated Augmentation Methods: In Table 2, the paper lacks comparison with updated augmentation methods such as AdaptPoint[2], which could highlight the relative performance of FAT against newer augmentation techniques.

[1]: PointCloud-C: Benchmarking and Analyzing Point Cloud Perception Robustness under Corruptions
[2]: Sample-adaptive Augmentation for Point Cloud Recognition Against Real-world Corruptions
[3]: Benchmarking and Analyzing Point Cloud Classification under Corruptions
[4]: PointNeXt: Revisiting PointNet++ with Improved Training and Scaling Strategies
questions: questions: Refer to the Weakness. I will improve my rates when the weaknesses are solved.
limitations: limitations: Refer to the Weakness.
paper_summary: paper_summary: This work introduces a method called Frequency Adversarial Training (FAT) to improve the robustness of 3D point cloud recognition models and examines the robustness of models under 3D point cloud corruptions, including analysis on the power of different corruption effects in the frequency domain.  FAT generates adversarial samples by adding perturbations to the frequency representations of point cloud data. The authors also provide a theoretical analysis demonstrating the effectiveness of FAT in improving  OOD generalization performance of models.
strength_weakness: strength_weakness: 1. There is confusion in the caption of Figure 3, which suggests the Jacobian matrix for an input point cloud. According to the context, it should be the Jacobian matrix of the model regarding the input point cloud.
2.  As FAT is based on adversarial training, it is expected to have comparisons with other adversarial training techniques rather than only mixing- and deformation-based approaches. 
3. Minors: 
*The figures are hard to read as the font size is too small.
*Missing space before the fourth sentence in the caption of Figure 3.
questions: questions: 1. Adversarial augmentation approaches may require substantial computational resources, leading to inefficiency. How much computational resources does FAT require regarding computational time, memory usage, etc., and how does it compare with other augmentation approaches.
limitations: limitations: The authors address the limitation of their approach in term of the degraded standard accuracy. There might be a trade-off between corruption robustness and standard performance, left for future investigation.

Comments: title: Summary of Rebuttal
Thank you for increasing the score
Thank you for increasing the score
Official Comment by Reviewer WzcS
Thank you for increasing the score
Thank you for the appreciation of our contributions
comment: Dear Reviewers, AC, and SAC:

We deeply thank the work done by AC and SAC such as distributing the paper to reviewers, guiding the reviewing process, and further supervising the discussion. We also sincerely appreciate the reviewers for taking the time to read our paper, providing constructive comments, and getting involved in our discussion. Without your elaborative help and support, our paper could not have been further polished.

Here we summarize our rebuttal to present a general perspective which could hopefully help grasp our contribution and modification quickly.

Through interactive discussion, all four reviewers have **found our response satisfactory**, with three of them **increasing their scores**. 

The final scores given by the reviewers are as follows:
- **Soundness**: 4, 3, 3, 3
- **Presentation**: 4, 3, 3, 3
- **Contribution**: 3, 3, 3, 3
- **Rating**: 6, 6, 5, 5

Additionally, several consensuses have been achieved:
- **The presentation of our paper is polished, well-structured, and easy to understand.** (Reviewers kjym, wa2k, ELyT)
- **The problem studied in our paper is important and has significant impact** for safety-critical applications such as autonomous driving and robotics. (Reviewers kjym, WzcS, wa2k)
- **Our idea is novel, interesting, and well-motivated.** (Reviewers kjym, WzcS, wa2k, ELyT)
- **The performance of our approach is well-justified, promising, and effective.** (Reviewers kjym, wa2k, ELyT)
- **The theoretical analysis of our paper offers valuable insights** for analyzing model robustness. (Reviewers kjym, wa2k, ELyT)

Based on all the comments from the reviewers, we summarize the primary concerns and our responses as follows:

- ***Question 1: The paper would be more convincing by additional experiments conducted on real-world LiDAR sensor datasets.***

  In rebuttal, we further conduct experiments on the KITTI and ScanObjectNN datasets, both collected by LiDAR sensors. The results on these two real-world datasets further validate the superiority and practicality of our FAT.

- ***Question 2: The paper would be more comprehensive by additional experiments compared with updated network architectures/augmentation methods, and more ablation studies.***

  To address this, we further conduct experiments for PointNeXt (an advanced network architecture) and AdaptPoint (a recent augmentation method), along with additional ablation studies. These experiments offer a more thorough evaluation of our proposed FAT method.

- ***Question 3: The paper needs further explanation of the frequency and spatial domain aspects and the complexity and efficiency of FAT.***

  We have expanded our discussion on the relationship and impact of frequency and spatial domains, and provided a detailed analysis of the complexity and efficiency of FAT. We will incorporate the additional discussions and improve the paper in the final version.

In the past few weeks, we have tried our best to improve the quality of this paper and address each concern from all reviewers. We sincerely hope our effort can contribute to the community. Thanks again for your kind help and constructive opinions, we are truly grateful to have advice from you.

Sincerely,

Authors.
Dear Reviewer ELyT,

Thank you very much for increasing the score! We are glad to know that our response has addressed your concerns. We really appreciate your valuable comments and appreciation of our contributions. We will further improve the paper in the final.

Best regards, Authors
Dear Reviewer WzcS,

Thank you very much for increasing the score! We are glad to know that our response has addressed your concerns. We really appreciate you for spending considerable time on our paper. We will further improve the paper in the final.

Best regards, Authors
Thank you for the responses. I've updated the rating.
Thanks for the rebuttal. I have updated the rating.
Dear Reviewer wa2k,

Thank you very much for increasing the score! We are glad to know that our response has addressed your concerns. We really appreciate your valuable feedback. We will further improve the paper in the final.

Best regards, Authors
Dear Reviewer kjym,

We are pleased to know that you find our response satisfactory. We really appreciate your valuable comments. We will incorporate the additional experiments and improve the paper in the final version.

Best regards, Authors
I am satisfied with the rebuttal and thus keep my rate unchanged.
Thanks, updated my ratings! Good luck !
***Question 7: What would be the outcome if medium frequency bands were modified?***

Thanks for the suggestion. We further conduct more ablation studies among FAT, as well as FAT variants: FAT with only medium-frequency modified, FAT with only low-frequency modified, and FAT with only high-frequency modified. The results are shown below.

|ModelNet-C|Method|OA|mCE|Rotate|Jitter|Scale|Drop-G|Drop-L|Add-G|Add-L
|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|
|PointNet|Vanilla Training|0.907|1.422|1.902|0.642|1.266|0.500|1.072|2.980|1.593|
||FAT with only low-frequency modified|0.906|1.317|1.702|0.519|1.234|0.452|1.043|2.851|1.415|
||FAT with only medium-frequency modified|0.905|1.342|1.729|0.439|1.468|0.500|1.144|2.757|1.354|
||FAT with only high-frequency modified|0.890|1.306|1.614|0.373|1.734|0.504|1.193|2.627|1.098|
||FAT|0.902|1.237|1.553|0.370|1.606|0.448|1.097|2.583|1.004|

Compared with other methods, FAT with only high-frequency modified has a lower mCE for high-frequency corruptions such as “Jitter”, while FAT with only low-frequency modified has a lower mCE for low-frequency corruptions such as “scale”. As discussed in Sec. 3.3, this is because adversarial training on high/low frequencies reduces the high/low frequency sensitivity, thus improving robustness to high/low-frequency corruptions. The performance of FAT with only medium-frequency modified falls between FAT with only high-frequency modified and FAT with only low-frequency modified. Compared with these methods, FAT achieves the lowest mCE, showing the effectiveness of our algorithm. We will incorporate these additional experiments into the revision.

[1] Sample-adaptive Augmentation for Point Cloud Recognition Against Real-world Corruptions, ICCV 2023

[2] Benchmarking Robustness of 3D Object Detection to Common Corruptions in Autonomous Driving, CVPR 2023

[3] Physically Realizable Adversarial Examples for Lidar Object Detection, CVPR 2020

[4] Can We Use Arbitrary Objects to Attack Lidar Perception in Autonomous Driving? CCS 2021

[5] Adversarial objects against lidar-based autonomous driving systems, arXiv

[6] AE-Morpher: Improve Physical Robustness of Adversarial Objects against LiDAR-based Detectors via Object Reconstruction, USENIX 2024