Adversarially Robust 3D Point Cloud Recognition Using Self-Supervisions

Abstract: 3D point cloud data is increasingly used in safety-critical applications such as autonomous driving. Thus, the robustness of 3D deep learning models against adversarial attacks becomes a major consideration. In this paper, we systematically study the impact of various self-supervised learning proxy tasks on different architectures and threat models for 3D point clouds with adversarial training. Specifically, we study MLP-based (PointNet), convolution-based (DGCNN), and transformer-based (PCT) 3D architectures. Through extensive experimentation, we demonstrate that appropriate applications of self-supervision can significantly enhance the robustness in 3D point cloud recognition, achieving considerable improvements compared to the standard adversarial training baseline. Our analysis reveals that local feature learning is desirable for adversarial robustness in point clouds since it limits the adversarial propagation between the point-level input perturbations and the model's final output. This insight also explains the success of DGCNN and the jigsaw proxy task in achieving stronger 3D adversarial robustness.


Reviews and author responses:

This paper presents a self-supervision based method for adversarially robust 3D point cloud recognition, in which three types of self-supervised tasks are dealt with to help learn 3D point features: 3D rotation, 3D jigsaw and autoencoder. Empirical results demonstrate the effectiveness of the proposed method. Besides, the paper is well-written and easy to follow.   1. It is great to see a thoughtful experimental setup: 4 datasets, 3 point-cloud threats, 3 network backbone architectures, 3 pretraining tasks and 2 supervised tasks. But it seems that generation network based adversarial attacks (e.g. LG-GAN [3]) and optimization based ones (e.g. 3D Carlini-Wagner attack) are not verified. I need to see more evaluation performances to justify the significance of self-supervised learning on this task. 

2. Novelty seems a little bit limited. The core idea is related to researches on 2D domain [1][2], and this paper is all about applying this key idea to 3D point recognition. Beyond that, I don’t see any insights of either new technical emergence or discoveries. 

3. I am confused about adversarial pretraining. During adversarial pretraining, only self-supervised tasks are implemented, without classification. How to implement adversarial attacks in this stage? My understanding is that adding adversarial disturbance during this stage to impact on the self-supervised loss.

4. Two strategies are proposed to integrate self-supervised learning and adversarial learning: adversarial pre-training for fine-tuning (APF) and adversarial joint training (AJT). In Table 3, only two SSL tasks are shown for AJT, yet there’s a lack of autoencoder task for APF in Table 2. It’s clearly better to have a comprehensive comparison between two strategies. 

5. Detailed annotation should be provided: RA means robust accuracy. 

6. Spelling error: l117 The I seobjective

[1] Dan Hendrycks, Mantas Mazeika, Saurav Kadavath, and Dawn Song. Using self-supervised learning can improve model robustness and uncertainty. https://arxiv.org/pdf/1906.12340.pdf
[2] Tianlong Chen, Sijia Liu, Shiyu Chang, Yu Cheng, Lisa Amini, and Zhangyang Wang. Adversarial robustness: From self-supervised pre-training to fine-tuning. https://arxiv.org/pdf/2003.12862.pdf
[3] Hang Zhou, Dongdong Chen, Jing Liao, Kejiang Chen, Xiaoyi Dong, Kunlin Liu, Weiming Zhang, Gang Hua, Nenghai Yu. LG-GAN: Label Guided Adversarial Network for Flexible Targeted Attack of Point Cloud-based Deep Networks. https://arxiv.org/pdf/2011.00566.pdf
 The limitations are not clear to me. 

 I thank the authors for their thorough responses to my review. Further, I read the responses to the other reviewers, and they are just as thorough.

Your responses have adequately addressed my concerns/misunderstandings and, from what I see, also those of other reviewers. 

As the response mentions, I think some clarifications can be made in the paper to avoid some misunderstandings but, otherwise, I think the writing is overall of good quality, and that the main results hold.

Thus, I will keep my rating for accepting this paper. 

 Dear Reviewer,

Since the deadline of the rolling discussion is approaching, we would like to double-check whether you still have further questions for us or not. 
We also would like to kindly remind you that your updated score has not been reflected in the OpenReview system.  

Thanks again for your valuable comments!

 We sincerely thank the reviewer again for her/his constructive comments and for raising the score. We will revise our paper to include valuable suggestions from all the reviewers.


This paper profoundly analyzes the robustness of 3D models for point clouds. The analyses are insightful. Some of the observations are indeed interesting, which differs from previous observations. Still, I have some concerns about this paper.
  
(Positive) Previous works show local features in CNN could hurt robustness. This paper offers an opposite observation. The analysis in this paper reveals that local feature learning is desirable for adversarial robustness since it limits the adversarial propagation between the point-level input perturbations and the model's final output. 

Is this difference because point data is different from image data? In Line 221, the authors have provided insightful comments for this. I really like these comments. The authors find that DGCNN outstands to be the most robust architecture, consistently achieving ∼15% stronger robustness than the other two models on both ModelNet40 and ScanObjectNN.

(Negative) Although the authors have provided good explanations, I still have some concerns. Is the transformer not correctly used? For example, for transformer, is an adjacent matrix used to restrict the attention maps? Besides, is MLP not correctly applied to point cloud? Can we use appreciation of global/shape features can help improve model robustness for point cloud similar to that in the 2D domain?

(Positive) The authors understand that a label-free strategy is preferred due to the cost and difficulty of 3D point cloud data annotation. This idea is clear and promising.

(Neutral) The authors show that pre-training on SSL tasks improves the adversarial robustness of the fine-tuned models. But it is unclear why this can improve the robustness. Could the authors provide some theoretical analyses?
 
(Neutral) Similarly, the authors find that only APF consistently achieves robustness improvements in 3D. AJT does not always help since the distributional gap between data for SSL and recognition tasks will distract each other in AJT. It would be better if the authors could provide some theoretical analyses.

(Positive) The authors have an insightful observation that adversarial examples generated by attacking them do not transfer well among each other. I am delighted that the authors use this property to improve the robustness point could neural networks.

(Negative) The architecture description part lacks details. For example, for transformer, is an adjacent matrix used to restrict the attention maps? What is the overall Point cloud transformer like? What is the MLP like? What is the GCN like?

(Negative) Line 87: what is the \circ "F = M ◦ H"?

(Negative) This paper lacks too many critical details. A rewriting is necessary. For example, the definitions of \Pi, saliency() are crucial; please give a full definition.
Line 93: \Pi is the projection function to project the adversarial example to the pre-defined perturbation space S 
Line 97:  where saliency() calculates the importance scores of the input points and / denotes the dropping operation

(Negative) I am very familiar with self-supervised learning. In the 2D image, currently, we usually use contrastive learning or metric learning (e.g., MoCos, BYOL, and SwAV) or masking (BEiT); In NLP, we typically use masking (e.g., BERT). 3D Rotation, 3D Jigsaw, and Autoencoder are outdated methods for self-supervised learning methods. Even for 2D adversarial training with self-supervised learning, many state-of-the-art methods use contrastive learning rather than the outdated technique. It is strange that the author does not adopt the new techniques. Could the authors provide analysis/results on these new techniques? 

MoCo: Improved Baselines with Momentum Contrastive Learning;
Momentum Contrast for Unsupervised Visual Representation Learning
BYOL: Bootstrap your own latent: A new approach to self-supervised learning
BEiT: BERT Pre-Training of Image Transformers
BERT: BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding

(Negative) Why the second term \mathcal{L}_t in Eqn. (5) are not adversarially trained? If \mathcal{L}_t is not adversarially trained, I do not think this is a proper Adversarial Joint Training (AJT). Hence, all the claimed observation about Adversarial Joint Training (AJT) does not convince me. One important baseline, i.e., the true Adversarial Joint Training (AJT), in which both terms are adversarially trained, should be included.

(Negative) Since the AJT is not a true AJT, I am not convinced by the following analysis.
 Line 252: it is still a separate learning task. Rotated and disassembled images still preserve similar local features to the original images since the RGB values do not change, so that the auxiliary optimization in AJT will not distract AT, but help models learn robust global features [24]. 

(Negative) This paper lacks sufficient ablation studies to provide component analysis for the proposed method.

(Positive) I am happy to see the cross-task examination of the adversarial examples and am happy to see the use of cross-task ensembling to improve the robustness. The authors found that different fine-tuned models preserve different vulnerabilities, and there is at least ∼10% gain of RA when transferring attacks on models fine-tuned from different tasks on ModelNet40. They thus combine the models and further test the ensemble model's robustness.

(Negative) As far as I am concern, not only different fine-tuned models preserve different vulnerabilities, but different architectures also preserve different vulnerabilities. Please provide cross-architecture examination and proved cross-architecture ensembling.

(Positive) I am happy to see part segmentation is a more robust task than classification. I am so glad to see the author's insightful comments on this observation.
 
Please refer to and respond to the "negative" items in the above main review.



 
I have read all reviewers' comments and the authors' responses. The author has answered almost all my questions. The reply is in-depth, especially on the following points.

(Positive) In the authors' response, the authors successfully address my concern about the absence of contrastive learning. Especially, the authors find that although contrastive pre-training shows improvements compared to the adversarial training (AT) baseline, it cannot beat the jigsaw-based pre-training strategy. This finding is fascinating and insightful. Moreover, the authors also provide some explanation to the finding, which is also very insightful.

(Positive) In the authors' response, the authors successfully address my concern about ensembling. Especially, the authors' following explanation is reasonable -- since the gap between the robust accuracy of different architectures is large, the attacker could find the most vulnerable model to affect the overall ensemble model through adversarial optimization.

(Positive and Neutral) The authors have addressed my concerns about why they did not apply the adversarial loss to the self-supervised learning (SSL) task in AJT. The experiments in the response are sufficient. But the word "Adversarial Joint Training" might still be debatable/misleading.

I also read other reviewers' comments. I agree with Reviewer #tgUE that analysis about contrastive learning should be included, and the authors have added this analysis. I appreciate the reviewers' concern about the recent adversarial perturbation methods and the authors' response.  Although there have been many other methods proposed over the years that have been shown to work better than adversarial training, such as denoising layers, I believe adversarial training is still the most robust/practical/universal according to my experience and plenty of experiments. I really thank Reviewer #Vmom for his/her careful reading and valuable comments in improving the paper. Especially, the reviewer also has a concern about the AJT. I thank Reviewer #wEE7 for his hard work in improving this paper. Actually, Reviewer #wEE7 share some concerns with #tgUE, e.g., the novelty and the recent adversarial perturbation, and I appreciate the author's concerns.

Because the author has answered almost all my questions, I would like to raise my rating from 6 to 7. Also, I would like to note the author that the suggestions from the other reviewers will undoubtedly benefit the paper's improvement and make the paper attract a wide range of audiences.


 We thank the reviewer again for providing constructive comments. All the suggestions are valuable for us to improve our work!

 The authors have addressed most of my comments. Though addition of point-cloud specific attack strategies would have been more inline with existing literature, the experiments and method presented in this paper does provide interesting insights. This work should prove to be a great addition to the community. I will keep my original score and decision to accept this work.

 We sincerely thank the reviewer for carefully reviewing our paper and rebuttal! It is our pleasure to address all your questions and your comments are essential for us to improve the content.

 My raised problems are well-addressed by the authors. They have added the experimental comparisons with some missing references, and have convinced me according to their analysis. The novelty is still limited to me somehow, but based on a more thorough experimental analysis and potential contribution to the community of 3D point cloud classification robustness, I will raise my score. 

 > Q: Questions about how adversarial pre-training is conducted.

A: The reviewer has the correct understanding of our adversarial pre-training strategy. In the inner maximization stage of adversarial pre-training, the adversarial optimization tries to maximize the loss of the corresponding self-supervised task. For instance, in the rotation pre-text task, adversarial optimization tries to maximize the loss to mislead the model to predict the correct rotation angle. We will revise our manuscript to make it more clear.

Q: It is better to evaluate the autoencoder in adversarial joint training (AJT).

A: We follow the reviewer’s suggestions to add autoencoder experiments in our AJT sections. 

|                |     | ModelNet40  |                 | |       ScanObjectNN         |      | |   ModelNet10     |      |
|    :----:   |:----:   |:----:   |:----:   |:----:   |:----:   |:----:   |:----:   |:----:   |:----:   |
| CA/RA (%) | PointNet   | DGCNN     | PCT       | PointNet     | DGCNN     | PCT       | PointNet   | DGCNN     | PCT       |
|   sphere  | 87.5/44.4  | 90.9/62.1 | 89.6/49.2 | 68.9/24.2    | 75.5/36.5 | 72.5/20.5 | 96.7/79.8  | 98.2/86.3 | 97.5/80.3 |
|   plane   | 87.4/42.1  | 90.7/61.9 | 89.3/48.7 | 68.5/23.9    | 75.6/34.7 | 72.8/20.6 | 96.7/79.7  | 98.1/86.2 | 97.4/79.9 |
|  gaussian | 86.9/43.9  | 90.9/61.9 | 88.9/49.2 | 68.7/24.4    | 76.3/35.1 | 72.1/20.5 | 96.6/79.7  | 98.3/86.9 | 97.5/80.0 |

We find that the results of AJT using the autoencoder task are more stable than the other two tasks. We believe it is because the input for the autoencoder is the same as the recognition task so that the distributional gap is small. However, it is still worse than the pre-training scheme. We will add this experiment to our manuscript and discuss the results. Thanks again for this valuable suggestion.

We will address the typos and have more clear notations in our manuscript. Thanks again for the careful review. 

We believe that we have addressed all the raised concerns, and we are happy to answer any follow-up questions. We hope the reviewer might reconsider the rating based on our response.


 We thank the reviewer for her/his constructive comments and agreeing that our study has conducted thoughtful experiments with insights. Below we respond to each question of the reviewer:

> Q: Evaluations on generative network-based and C&W attacks

A: We adapt and implement LG-GAN [2] and C&W attacks to our problem setting, respectively.  
The following table shows the robustness of our best fine-tuned model against LG-GAN attack and compares it with two baselines, including standard training (ST) baseline and adversarial training (AT) baseline. The numbers here are the robust accuracy (the higher, the more robust). From the result, we could observe that our method achieves consistently higher robustness than the other two baseline methods.


|      LGGAN           | ModelNet40 |       |      | ScanObjectNN |       |      | ModelNet10 |       |      |
|----------------|------------|-------|------|--------------|-------|------|------------|-------|------|
|      RA(%)     | PointNet   | DGCNN | PCT  | PointNet     | DGCNN | PCT  | PointNet   | DGCNN | PCT  |
| ST Baseline    |    35.2    |  48.1 | 37.9 |       0      |  11.9 |  7.6 |    55.6    |  65.7 | 57.2 |
| AT Baseline    |    63.3    |  73.2 | 67.8 |     33.8     |  40.7 | 33.5 |    81.9    |  85.1 | 82.1 |
| Best Finetuned |     71     |  78.8 | 73.3 |     35.9     |  49.9 | 35.2 |    84.1    |  87.1 | 84.7 |

In the following table, we show the robustness of our best fine-tuned model against the C&W target attack. For each test sample, we randomly select a class as the attacking target. We also compare it with two baselines, including standard training (ST) baseline and adversarial training (AT) baseline. Note that the numbers here are the attack success rate (ASR) because we leverage target attacks (the lower, the more robust). We could observe that our method achieves consistently higher robustness than the other two baseline methods from the result.

|      C&W        |     | ModelNet40  |                 | |       ScanObjectNN         |      | |   ModelNet10     |      |
|    :----:   |:----:   |:----:   |:----:   |:----:   |:----:   |:----:   |:----:   |:----:   |:----:   |
| ASR(%)         | PointNet   | DGCNN | PCT  | PointNet     | DGCNN | PCT  | PointNet   | DGCNN | PCT  |
| ST Baseline    | 98.3       | 98.1  | 99   | 100          | 100   | 100  | 95.3       | 96.2  | 95.1 |
| AT Baseline    | 11.2       | 7.6   | 9.8  | 35.9         | 24.4  | 39.7 | 5.9        | 5.5   | 6    |
| Best Finetuned | 6.93       | 5.21  | 5.68 | 30.1         | 20    | 30.4 | 5.5        | 4.2   | 5.5  |

These results further justify the significance of self-supervised learning for 3D point cloud robustness. Thanks for the suggestion; we will add these results in our revised version. 

[1] Xiang, Chong, Charles R. Qi, and Bo Li. "Generating 3d adversarial point clouds." Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2019.
[2] Zhou, Hang, et al. "Lg-gan: Label guided adversarial network for flexible targeted attack of point cloud based deep networks." Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2020.

> Q: The novelty of the proposed strategy is limited.

A: We believe that our study is novel due to the following reasons.

1. From the problem definition side, we are the first to study the relationship between self-supervised learning and adversarial robustness in the 3D space, which was largely unexplored. This is a new and important research problem. It contains essential differences in studying the relationship between 3D adversarial robustness and 3D SSL compared to the 2D domain. For instance, different from prior work in adversarial robustness in 2D vision that either leverages a single SSL task [1] or targets a single backbone model [2], 3D point cloud recognition using deep learning is a relatively nascent field, where finding proper universal “3D backbones” is still an active research direction. Understanding which 3d backbone is more robust in the early stage could help guide the community towards the right direction. Therefore, it is necessary to consider different types of learning architectures to study their robustness. Moreover, given the intrinsic sparsity and set property of 3D point cloud data, various 3D point cloud domain-specific attack threat models (e.g. point shifting, point adding and point dropping) should be investigated. Therefore, in this paper, we conduct a much more comprehensive study along multiple 3D domain-specific dimensions to study its robustness including three 3D SSL tasks, three different types of attack threats, and three backbone architectures based on the properties of point cloud data. It is also worth noting that we, for the first time, formulate point adding (PA) and dropping (PD) adversaries into a general AT analysis framework. As also mentioned by the reviewer, we believe such a study could be useful to the community and future research in this domain (acknowledged by multiple reviewers).

2. From the technical perspective, improving the adversarial robustness of 3D point clouds with self-supervised learning tasks is a non-trivial problem. We find that while some designs in 3D point cloud models work well in standard training, but they fail to provide robustness in adversarial training. The reason is that these designs introduce **randomness** in the inner maximization stage of adversarial training, causing the overall training intractable. For example, as illustrated in Section 3.2, we find that several components in PointNet and PCT (e.g., T-Net and farthest point sampling (FPS)) cannot work well by directly applying adversarial training. T-Net applies an overall transformation matrix to the point clouds and middle layer features, where a small perturbation in the matrix could affect all the features. Therefore, T-Net will introduce a high variance of performance in adversarial training. PCT originally leverages farthest point sampling (FPS) to sample anchors to do local clustering. Since the point cloud is dynamically changing in adversarial training, the sampled anchors are totally different in each PGD iteration, which will make models confusing. Therefore, the trained model is still not robust. We apply multiple modifications, including replacing the FPS operation with EdgeConv to stabilize the adversarial training (detailed in Section 3.2 and Appendix B). The capacity of EdgeConv is a superset of FPS operation since it views every point as an anchor and performs clustering so that it removes the randomness introduced by FPS. **Such a change does not modify the usage of the transformer in PCT, as shown in Appendix B, and will improve both clean and robust accuracy for the baseline** (acknowledged by Reviewer Vmom).

3. From the experimental analysis side, our analysis unveils multiple insights which are unique in 3D point cloud learning. For example, [2] shows that jigsaw SSL does not perform as well as rotation in 2D vision for robustness enhancement. However, 3D jigsaw helps connect the global and local feature learning, which improves a lot in 3D adversarial training. We also take the first step to analyze the robustness in the part segmentation task and provide valuable insights (acknowledged by multiple reviewers).  

We believe a systematic study with insights should be considered a more critical factor, especially in the adversarial machine learning community, since fancier solutions may give a false sense of security that would be adaptively broken [3]. Our study further motivates future research on designing more robust operations, architectures, and SSL tasks in 3D vision.


[1] Hendrycks, Dan, et al. "Using Self-Supervised Learning Can Improve Model Robustness and Uncertainty." Advances in Neural Information Processing Systems 32 (2019): 15663-15674.

[2] Chen, Tianlong, et al. "Adversarial robustness: From self-supervised pre-training to fine-tuning." Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2020.

[3] Athalye, Anish, Nicholas Carlini, and David Wagner. "Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples." International conference on machine learning. PMLR, 2018.





 > Q: How do the authors determine the robustness of DGCNN come from the usage of EgdeConv?

A: The main difference between DGCNN and PointNet architectures comes from the usage of EdgeConv [1]. Therefore, we can conclude that the robustness enhancements are from EdgeConv. 

[1] Wang, Yue, et al. "Dynamic graph CNN for learning on point clouds." Acm Transactions On Graphics (tog) 38.5 (2019): 1-12.

> Q: Are different backbones utilized as encoders in the autoencoder task?

A: Yes we did use different backbones as the encoder, and use the same decoder (i.e., FoldingNet [1]). The different backbones mean PointNet, DGCNN, and PCT. Only if we use different backbones as the encoder, we can reuse the pre-trained encoder in our adversarial fine-tuning stage. We will revise our manuscript to make it more clear.

[1] Yang, Yaoqing, et al. "Foldingnet: Point cloud auto-encoder via deep grid deformation." Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition. 2018.

> Q: Are there experiments for this "detection" or on what grounds is this statement based of the point adding and dropping threats?

A: Here we refer to an anomaly detection module that examines the number of input points before feeding it to the model. For example, current state-of-the-art models usually take 1024 points as input. A defender may use a detection module to refuse any inputs beyond the range of [1000, 1050] points. In this case, the adversarial examples generated by point adding and dropping 100 points will be refused. However, it is non-trivial to directly detect the adversarial examples generated by the point shifting attack using the number of points. We will revise our manuscript to make this argument more clear.

> Q: What does “k = 14,5” means in Line 177

A: We apologize for this confusing notation. The reviewer is correct that we leverage k = 14 in the training phase and k = 5 in the testing phase. The rationale is that we would like to leverage a more severe attacker in the testing phase to evaluate the true robust accuracy. With k = 5, we will have N / k = 100 / 5 = 20 iterations to perturb a point cloud, which is more fine-grained than 7 iterations in the training time; this will give us robust accuracy closer to the lower bound.

We again thank the reviewer a lot for pointing out the typos and formatting errors, and we will revise our manuscript to address these issues.


 We thank the reviewer for her/his constructive comments and agreeing that our work with insights is valuable for both 3D vision and adversarial robustness communities.  Below we respond to each question of the reviewer:

> Q: The usage of max ensemble may contribute noise to the evaluation.

A:  The max ensemble will not introduce any noises to the gradient backward propagation but indeed introduces a very little non-smoothness.  The reason is that the max ensemble performs column-wise max pooling on the stacked logits so that its gradient is 1 for the chosen max value and 0 for others. However, we believe this is not a problem since the is window size 3 (since we have 3 models) is even smaller than commonly used max pooling window size 2*2 = 4 in convolutional networks. Furthermore, we choose the strong 200-step PGD to evaluate the robust accuracy, which can also compensate for the potential non-smoothness. Therefore, we believe that the results of the max ensemble are accurate. 


> Q: The usage of dual batch normalization may contribute noises to adversarial training.

A: Dual batch normalization will not introduce noises to our evaluation. In the training time, one batch normalization tracks the statistics of the supervised classification task, and the other tracks the statistics of the self-supervised learning task. In the test time, we utilize the first batch normalization since we only care about the robustness of the supervised classification task. During our experiments, we find that dual batch normalization in AJT consistently outperforms a single batch normalization. Therefore, we present the results of dual batch normalization in our manuscript. As we mentioned in Section 3.2.2, the reasons could be attributed to the distributional gap. Transformed 2D images still preserve local texture and the same RGB values. However, transformed (i.e., rotated, displaced) point clouds have totally different numeric values from the original data because the model directly takes their positions as input, which is largely changed by the transformations.

> Q: How to interpret the results of Table 2.

A: There are indeed some misunderstandings. There are two types of adversarial training in our adversarial pre-training for fine-tuning (APF) study: (1) **adversarial pre-training** for the SSL task and (2) **adversarial fine-tuning** for the downstream classification task. “Adversarial X” means that we additionally use **adversarially pre-training** for the self-supervised learning (SSL) task X, and “X” means that we only use **clean pre-training** for SSL task X. All the results in Table 2 are applied with  **adversarial fine-tuning** for the ultimate classification task. In fact,  all of our results, including “Adversarial X”  and “X” in Table 2, actually reflect the performance of SSL + adversarial training. Both “Adversarial X”  and “X” show better performance than baseline (adversarial training) so that our observations and insights that SSL is essential to the robustness improvements still hold.


By adversarially pre-training the SSL task (e.g., rotation), the models will be arguably more robust against SSL task-specific attacks (e.g., adversarial rotation attack). We study the  **adversarial pre-training** +  **adversarial fine-tuning** setting because we want to observe whether such robustness against SSL task-specific attacks (e.g. adversarial rotation attack)  might transfer to the backbone for the downstream supervised classification task with  **adversarial fine-tuning**. However, this hypothesis is not always true. Therefore, we get a more accurate conclusion that  **adversarial fine-tuning** is the key to the robustness improvements. 

For the results in Table 3, we did not apply the adversarial loss to self-supervised learning (SSL) because adding the adversarial loss will potentially distract the main task in this Adversarial Joint Training. In the inner maximization stage, if two adversarial optimizations suggest different directions to disturb the point cloud, the generated perturbation will not be the worst-case adversarial example for the point cloud classification task. Consequently, it could hurt the overall robustness of the classification performance as our final goal is to make the backbone + classification head robust against adversarial attacks.

We add the experiments by adding adversarial loss to the SSL task to validate the above statement. The following table presents the results. We find by adding the adversarial loss to the SSL task, it shows a small, but consistent drop w.r.t the robust accuracy compared to the original results in Table 3. Additionally, It is worth mentioning that APF is not subject to such distraction from SSL since pre-training and fine-tuning are done in sequential order. We will add these new results to our manuscript and discuss the potential reasons.

|       Adversarial Rotation         |     | ModelNet40  |                 | |       ScanObjectNN         |      | |   ModelNet10     |      |
|    :----:   |:----:   |:----:   |:----:   |:----:   |:----:   |:----:   |:----:   |:----:   |:----:   |
| CA/RA (%) | PointNet   | DGCNN     | PCT       | PointNet     | DGCNN     | PCT       | PointNet   | DGCNN     | PCT       |
|$\eta = 6$  | 86.8/44.9  | 91.2/60.5 | 90.1/44.1 | 67.9/23.9    | 75.6/37.5 | 72.5/20.0 | 96.6/79.0  | 98.4/86.2 | 97.5/73.5 |
| $\eta = 18$ | 86.6/45.5  | 91.2/61.9 | 90.0/42.6 | 68.5/25.0    | 75.2/37.2 | 72.1/19.8 | 96.9/79.9  | 98.0/85.7 | 97.8/75.6 |

|   Adversarial Jigsaw        | ModelNet40 |           |           | ScanObjectNN |           |           | ModelNet10 |           |           |
|-----------|------------|-----------|-----------|--------------|-----------|-----------|------------|-----------|-----------|
| CA/RA (%) | PointNet   | DGCNN     | PCT       | PointNet     | DGCNN     | PCT       | PointNet   | DGCNN     | PCT       |
| k = 3     | 87.5/42.5  | 91.0/62.1 | 90.2/44.1 | 69.3/25.1    | 76.9/38.4 | 72.2/20.7 | 96.7/79.6  | 98.3/88.0 | 97.1/76.7 |
| k = 4     | 87.1/46.3  | 90.9/61.7 | 89.8/40.8 | 69.6/24.5    | 76.0/38.5 | 72.3/20.5 | 96.7/77.3  | 97.9/88.4 | 97.0/78.0 |

We apologize for the confusing notations in Table 2 and will revise the table to make it more clear.

> Q: The standard training (ST) baseline is high in Tables 4,5, and 6. 

A: We confirm that the results in these tables are correct. The numbers are well above 0 in Tables 4 and 5 since we restrict the attack capability of point adding (PA) and dropping (PD) threats because modification of a large number of points will have a major impact on human perception (mentioned in Line 175). In the published paper that proposes PA attack [1], they suggest adding 50 to 100 points bounding by informal Chamfer distance. Therefore, we adopt their experimental setting to make sure that our threat model will not affect human perception. Since the attacker only has the ability to modify these newly added 100 points, it cannot reduce the accuracy to near 0.  
Similarly, the original paper that proposes PD has claimed that dropping 200 points has great potential to even fool human perception [4]. Therefore, we restrict our threat model to be able to drop 100 points. Our evaluation results are also consistent with [4] in terms of both clean and robust accuracy. 

Table 6 summarizes the evaluation of the part segmentation task. As we explain in Section 3.3, we find that point cloud part segmentation itself is a robust task since the model learns a general area in the 3D space that corresponds to each label. As Figure 5 shows, the L-inf norm perturbation has limited ability to affect such a robust pattern. This is also a key insight we get from our analysis on the part segmentation task.

We will revise our manuscript to make these more clear for readers.


 > Q: This paper lacks sufficient ablation studies to provide component analysis.

A: We have included multiple experiments to validate our findings like unforeseen attacks: Momentum Iterative Method (MIM) and AutoAttack with different objective functions. We also test the transferability of adversarial examples across fine-tuned models on various self-supervised learning tasks. We find it is relatively hard to design more ablation studies. We welcome suggestions on potential ablation studies from the reviewer and will add them in the final version upon acceptance of our paper.

> Q: This paper lacks a detailed description of the adopted backbone architectures

A: We agree with the reviewer that a detailed description will definitely help readers have a better understanding of our work. Due to space constraints, we have provided the introduction of our adopted backbone models Appendix B. We will re-organize our manuscript to include those important descriptions in our main sections.

> Q: what is the \circ "F = M ◦ H" ?

A: The \circ notation denotes the sequential combination of two functions, and there is indeed a mistake. The correct order of this formulation should be F = (H ◦ M)(x) = H(M(x)). We will correct this in our manuscript. 

> Q: This paper lacks a detailed description of some essential functions like saliency(). 

A:  We again agree with the reviewer, but due to the limited space, we have put the description of saliency() function in Appendix C.1. The salient point detection is based on published work [1]. We first calculate the median “point” of the point cloud ${x_{m}}_j=\\mathrm{median}(\{{x_i}_j | x_i \in x \}) (j \in \{1,2,3\})$ as an anchor. Next, the gradients of the coordinates can be calculated as: 

$\frac{\partial \mathcal{L}}{\partial r_i } = \sum_{j=1}^{3}  \frac{\partial\mathcal{L}}{\partial {x_i}_j} \cdot \frac{{x_i}_j - {x_m}_j }{r_i}$ 

where $r_i = \sqrt{{\sum^{3}_{j=1}}({x_i}_j - {x_m}_j)^2}$ is the radius of each point in the sphere coordinate. The saliency scores are further calculated by: $saliency(x_i) = - \frac{\partial\mathcal{L}}{\partial r_i} \cdot {r_i}^{1+\alpha}$, where $\alpha=1$ is chosen, suggested by [1]. At a high-level, the saliency() function selects a batch of the most influential points with regards to the cross-entropy loss. The projection $\Pi$ is to make sure that in each iteration the generated perturbation will exceed the . Since we leverage L-inf norm distance, the projection is thus a clipping function that clips the generated perturbation within $[-\epsilon, \epsilon]$.

[1] Tianhang Zheng, Changyou Chen, Junsong Yuan, Bo Li, and Kui Ren. Pointcloud saliency maps. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 1598–1606, 2019.

> Q: Ensembles of different architectures may preserve different vulnerabilities.

A: We thank the reviewer for this valuable suggestion. We conduct experiments on how ensembling different architectures will affect the robustness of point cloud recognition. Specifically, we use max and mean ensembles on the best fine-tuned models with different architectures. The results are shown in the below table. 

|   CA/RA (%)   | ModelNet40 | ScanObjectNN | ModelNet10 |
|:-------------:|:----------:|:------------:|:----------:|
|  Max Ensemble |  91.4/66.9 |   79.0/40.6  |  98.3/90.1 |
| Mean Ensemble |  91.4/66.5 |   78.7/40.6  |  98.2/89.9 |

Unfortunately, we find that the robust accuracy is slightly worse than the single best fine-tuned model (i.e., DGCNN). We do agree with the reviewer that different architectures may bring different vulnerabilities. However, since the gap between the robust accuracy of different architectures is large, the attacker could find the most vulnerable model to affect the overall ensemble model through adversarial optimization. We will add this experiment in our manuscript and discuss the potential reasons.

We believe that we have addressed all the raised concerns, and we are happy to answer any follow-up questions. We hope the reviewer might consider raising the rating based on our response.




 We thank the reviewer for her/his constructive comments and agreeing that our work has comprehensively analyzed the adversarial robustness in 3D point cloud data with valuable insights. For the raised questions, below we respond to each of them:

> Q: Concerns on the usage of Transformer and MLP in PCT and PointNet.

A: In this paper, we use the official implementation of the Point Cloud Transformer (PCT) [1] in our study instead of proposing new architectures as the goal of our paper is to study the robustness among different state-of-the-art 3D point cloud recognition architectures with self-supervision. In PCT, the transformer applies self-attention [1] without positional encoding since it will lose the permutation-invariant characteristic of point cloud data. We believe the reviewer's insight is valuable that adding an adjacent matrix to the local feature is a good idea to restrict the attention map. However, this needs an in-depth investigation into how to apply the adjacent matrix to make the overall architecture still permutation-invariant, which is out of the scope of this paper. We believe this is a promising research direction and will add it to our revised version's discussion section as our future work. We also adopt the official implementation of PointNet [2]. PointNet leverages shared MLP to extract features from point cloud data to maintain permutation-invariance, which is similar to $1 \times 1$ convolution. We also adopt the design in the official codebase of DGCNN [3]. We also provided detailed introductions to these architectures in Appendix B.

[1] https://github.com/Strawberry-Eat-Mango/PCT_Pytorch

[2] https://github.com/charlesq34/pointnet

[3] https://github.com/WangYueFt/dgcnn

> Q: Can we use appreciation of global/shape features to help improve model robustness?

A: Different from 2D images that compose of both texture and shape information/features, 3D point cloud only has shape information. Prior arts [1] have shown that local features are biased to texture, and global features are biased to shape in 2D vision. Thus, appreciation of global/shape features can help improve model robustness in 2D. However, our analysis unveils that both local and global features are essential in 3D point cloud recognition robustness since (1) they both correspond to the critical shape feature and (2) unlike images, there is no background texture noise in point cloud data. DGCNN utilizes EgdeConv to restrict the receptive field of point-level feature learning and the MLP classification head to form global features. Jigsaw pre-text task learns to reassemble the randomly displaced local point clusters, where the model is enforced to learn the displaced local features. Meanwhile, to correctly reconstruct the point cloud, jigsaw SSL also requires the model to capture the global and holistic semantics. Therefore, they achieve better robustness than other model architectures and SSL tasks. 

[1] Geirhos, Robert, et al. "ImageNet-trained CNNs are biased towards texture; increasing shape bias improves accuracy and robustness." arXiv preprint arXiv:1811.12231 (2018).

> Q: A study of contrastive learning in point cloud robustness is helpful.

A: We thank the reviewer again for this valuable suggestion. We adapt PointContrast [1] to our problem setting. Our designed scheme is as follows:
We positively pair the same objects with different rotation and Gaussian jitter augmentations and treat the remaining 2(N-1) samples in the mini-batch as negative examples. We attach an MLP head to the backbone to extract latent features for constructing the similarity matrix. We empirically choose the temperature parameter = 0.07 in our experiments. The following table shows the results. 


|           | ModelNet40 |           |           | ScanObjectNN |           |           | ModelNet10 |           |           |
|    :----:   |:----:   |:----:   |:----:   |:----:   |:----:   |:----:   |:----:   |:----:   |:----:   |
| CA/RA (%) | PointNet   | DGCNN     | PCT       | PointNet     | DGCNN     | PCT       | PointNet   | DGCNN     | PCT       |
|           | 87.7/47.5  | 91.6/62.7 | 89.8/49.1 | 69.4/24.6    | 76.2/36.6 | 70.4/25.1 | 96.7/80.0  | 98.1/87.5 | 97.0/80.1 |

We find that although our contrastive pre-training indeed shows improvements compared to the adversarial training (AT) baseline, it cannot beat the jigsaw-based pre-training strategy. We summarize two potential reasons. First, the current dataset for point cloud classification is much smaller than the datasets in 2D vision (e.g., ImageNet). However, contrastive learning usually requires a large dataset to work well [2,3,4]. In PointContrast, they need to rely on a much larger dataset, ScanNet [5] (consisting of both spatial and color information), even for the downstream classification task (the classification task is done on other datasets). However, in our study, we find that pre-text task-based methods can work well purely on the original dataset. Second, a contrastive learning design for point cloud classification is desired since PointContrast is more useful for the segmentation task. We will revise our manuscript to add this experiment and discuss the reasons. We also propose contrastive learning for adversarial robustness as a promising research direction to be followed up on by making improvements such as using a larger dataset.

[1] Xie, Saining, et al. "Pointcontrast: Unsupervised pre-training for 3d point cloud understanding." European Conference on Computer Vision. Springer, Cham, 2020.

[2] Chen, Ting, et al. "A simple framework for contrastive learning of visual representations." International conference on machine learning. PMLR, 2020.

[3] Cao, Yun-Hao, and Jianxin Wu. "Rethinking Self-Supervised Learning: Small is Beautiful." arXiv preprint arXiv:2103.13559 (2021).

[4] He, Kaiming, et al. "Momentum contrast for unsupervised visual representation learning." Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2020.

> Q: The adversarial joint training (AJT) lacks the adversarial loss term for the self-supervised task. 

A: We did not apply the adversarial loss to the self-supervised learning (SSL) task in AJT because adding the adversarial loss will potentially distract the main task. In the inner maximization stage, if two adversarial optimizations suggest different directions to disturb the point cloud, the generated perturbation will not be the worst-case adversarial example for the point cloud classification task. Consequently, it could hurt the overall robustness of the classification performance as our final goal is to make the **backbone + classification head** robust against adversarial attacks.

We add the experiments by adding adversarial loss to the SSL task to validate the above statement. The following table presents the results. We find by adding the adversarial loss to the SSL task, it shows a small, but consistent drop w.r.t the robust accuracy compared to the original results in Table 3. Additionally, It is worth mentioning that APF is not subject to such distraction from SSL since pre-training and fine-tuning are done in sequential order. We will add these new results to our manuscript and discuss the potential reasons.

|       Adversarial Rotation         |     | ModelNet40  |                 | |       ScanObjectNN         |      | |   ModelNet10     |      |
|    :----:   |:----:   |:----:   |:----:   |:----:   |:----:   |:----:   |:----:   |:----:   |:----:   |
| CA/RA (%) | PointNet   | DGCNN     | PCT       | PointNet     | DGCNN     | PCT       | PointNet   | DGCNN     | PCT       |
|$\eta = 6$  | 86.8/44.9  | 91.2/60.5 | 90.1/44.1 | 67.9/23.9    | 75.6/37.5 | 72.5/20.0 | 96.6/79.0  | 98.4/86.2 | 97.5/73.5 |
| $\eta = 18$ | 86.6/45.5  | 91.2/61.9 | 90.0/42.6 | 68.5/25.0    | 75.2/37.2 | 72.1/19.8 | 96.9/79.9  | 98.0/85.7 | 97.8/75.6 |

|   Adversarial Jigsaw        | ModelNet40 |           |           | ScanObjectNN |           |           | ModelNet10 |           |           |
|-----------|------------|-----------|-----------|--------------|-----------|-----------|------------|-----------|-----------|
| CA/RA (%) | PointNet   | DGCNN     | PCT       | PointNet     | DGCNN     | PCT       | PointNet   | DGCNN     | PCT       |
| k = 3     | 87.5/42.5  | 91.0/62.1 | 90.2/44.1 | 69.3/25.1    | 76.9/38.4 | 72.2/20.7 | 96.7/79.6  | 98.3/88.0 | 97.1/76.7 |
| k = 4     | 87.1/46.3  | 90.9/61.7 | 89.8/40.8 | 69.6/24.5    | 76.0/38.5 | 72.3/20.5 | 96.7/77.3  | 97.9/88.4 | 97.0/78.0 |

 > Q: The novelty of the proposed strategy is limited.

A: We believe that our study is novel due to the following reasons.

1. From the problem definition side, we are the first to study the relationship between self-supervised learning and adversarial robustness in the 3D space, which was largely unexplored. This is a new and important research problem. It contains essential differences in studying the relationship between 3D adversarial robustness and 3D SSL compared to the 2D domain. For instance, different from prior work in adversarial robustness in 2D vision that either leverages a single SSL task [1] or targets a single backbone model [2], 3D point cloud recognition using deep learning is a relatively nascent field, where finding proper universal “3D backbones” is still an active research direction. Understanding which 3d backbone is more robust in the early stage could helpguide the community towards the right direction. Therefore, it is necessary to consider different types of learning architectures to study their robustness. Moreover, given the intrinsic sparsity and set property of 3D point cloud data, various 3D point cloud domain-specific attack threat models (e.g. point shifting, point adding and point dropping) should be investigated. Therefore, in this paper, we conduct a much more comprehensive study along multiple 3D domain specific dimensions to study its robustness including three 3D SSL tasks, three different types of attack threats, and three backbone architectures based on the properties of point cloud data. It is also worth noting that we, for the first time, formulate point adding (PA) and dropping (PD) adversaries into a general AT analysis framework. As also mentioned by the reviewer, we believe such study could be useful to the community and future research in this domain. 

2. From the technical perspective, improving the adversarial robustness of 3D point clouds with self-supervised learning tasks is a non-trivial problem. We find that while some designs in 3D point cloud models work well in standard training, but they fail to provide robustness in adversarial training. The reason is that these designs introduce **randomness** in the inner maximization stage of adversarial training, causing the overall training intractable. For example, as illustrated in Section 3.2, we find that several components in PointNet and PCT (e.g., T-Net and farthest point sampling (FPS)) cannot work well by directly applying adversarial training. T-Net applies an overall transformation matrix to the point clouds and middle layer features, where a small perturbation in the matrix could affect all the features. Therefore, T-Net will introduce a high variance of performance in adversarial training. PCT originally leverages farthest point sampling (FPS) to sample anchors to do local clustering. Since the point cloud is dynamically changing in adversarial training, the sampled anchors are totally different in each PGD iteration, which will make models confusing. Therefore, the trained model is still not robust. We apply multiple modifications, including replacing the FPS operation with EdgeConv to stabilize the adversarial training (detailed in Section 3.2 and Appendix B). The capacity of EdgeConv is a superset of FPS operation since it views every point as an anchor and performs clustering so that it removes the randomness introduced by FPS. **Such a change does not modify the usage of the transformer in PCT, as shown in Appendix B, and will improve both clean and robust accuracy for the baseline.**

3. From the experimental analysis side, our analysis unveils multiple insights which are unique in 3D point cloud learning. For example, [2] shows that jigsaw SSL does not perform as well as rotation in 2D vision for robustness enhancement. However, 3D jigsaw helps connect the global and local feature learning, which improves a lot in 3D adversarial training. We also take the first step to analyze the robustness in the part segmentation task and provide valuable insights. 

We believe a systematic study with insights should be considered a more critical factor, especially in the adversarial machine learning community, since fancier solutions may give a false sense of security that would be adaptively broken [3]. Our study further motivates future research on designing more robust operations, architectures, and SSL tasks in 3D vision.


[1] Hendrycks, Dan, et al. "Using Self-Supervised Learning Can Improve Model Robustness and Uncertainty." Advances in Neural Information Processing Systems 32 (2019): 15663-15674.

[2] Chen, Tianlong, et al. "Adversarial robustness: From self-supervised pre-training to fine-tuning." Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2020.

[3] Athalye, Anish, Nicholas Carlini, and David Wagner. "Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples." International conference on machine learning. PMLR, 2018.

> Q: More baselines are needed other than standard adversarial training.

A: We thank the reviewers for pointing out useful literature for us. Feature denoising [1] and Defense-GAN [2] are indeed solid defense solutions in 2D vision. However, we find it is non-trivial to apply them in 3D point cloud recognition directly.

1. For the Feature denoising-based idea, a point cloud is a set structure that is permutation-invariant without index information. Therefore, we could not directly apply the existing denoising kernels to the middle layers of 3D point cloud architectures. On the other hand, domain-specific denoising kernel design should be investigated, which is out of the scope of this paper. We believe it is an interesting direction and will set it as future work.  

2. The Defense-GAN based idea requires a high-quality generative model as a pre-processing module that has good performance on the target dataset. Unfortunately, GAN and denoising autoencoders have not reached satisfactory performance in the 3D point cloud learning. For example, as shown in the point cloud generation benchmark [4], all recent works [5,6,7] only consider generating point clouds within a single class of objects. In the official codebase of [6], we find that they train a model for each category (i.e., 40 models for ModelNet40) to cover all the classes. However, they do not apply to our problem setting since we cannot access the label information. Besides, during our study on the FoldingNet [5] autoencoder, we modify the code to auto-encode all the point clouds in ModelNet and ScanObjectNN. However, we find the reconstructed point clouds on ModelNet and ScanObjectNN datasets are still not good enough for a further classification task. Therefore, it is hard to apply Defense-GAN to our study, and we will also set this as future work.

Overall, we believe that Feature denoising and Defense-GAN could be viewed as architecture-level defense strategies, which are complementary to our proposed training method-level strategy. Therefore, we do not include Feature denoising and Defense-GAN in our current study. We do acknowledge the reviewer’s valuable suggestions and will discuss these in our revised manuscript to motivate future research on these promising directions.  

[1] Zhou, Hang, et al. "Denoiser and upsampler network for 3D adversarial point clouds defense. In 2019 IEEE." CVF International Conference on Computer Vision (ICCV).

[2] Dong, Xiaoyi, et al. "Self-Robust 3D Point Recognition via Gather-Vector Guidance." 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). IEEE, 2020.

[3] Sun, Jiachen, et al. "On the adversarial robustness of 3d point cloud classification." (2020). 

[4] https://paperswithcode.com/task/point-cloud-generation/codeless 

[5] Yang, Yaoqing, et al. "Foldingnet: Point cloud auto-encoder via deep grid deformation." Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition. 2018.

[6] Mandikal, Priyanka, and Venkatesh Babu Radhakrishnan. "Dense 3d point cloud reconstruction using a deep pyramid network." 2019 IEEE Winter Conference on Applications of Computer Vision (WACV). IEEE, 2019.

[7] Lin, Chen-Hsuan, Chen Kong, and Simon Lucey. "Learning efficient point cloud generation for dense 3d object reconstruction." proceedings of the AAAI Conference on Artificial Intelligence. Vol. 32. No. 1. 2018.





 We thank the reviewer for her/his constructive comments. We are pleased to be acknowledged that our work is one of the first attempts to develop strategies that can learn adversarially robust 3D point-cloud recognition mode and the interesting insights provided in the paper could prove very useful in driving future research in this domain. For the problems, we respond to each question of the reviewer as following:

> Q: A study of contrastive learning in point cloud robustness is helpful. 

A: We adapt PointContrast to our problem setting. Our designed scheme is as follows:
We positively pair the same objects with different rotation and Gaussian jitter augmentations and treat the remaining 2(N-1) samples in the mini-batch as negative examples. We attach an MLP head to the backbone to extract latent features for constructing the similarity matrix. We empirically choose the temperature parameter = 0.07 in our experiments. The following table shows the results. 


|           | ModelNet40 |           |           | ScanObjectNN |           |           | ModelNet10 |           |           |
|    :----:   |:----:   |:----:   |:----:   |:----:   |:----:   |:----:   |:----:   |:----:   |:----:   |
| CA/RA (%) | PointNet   | DGCNN     | PCT       | PointNet     | DGCNN     | PCT       | PointNet   | DGCNN     | PCT       |
|           | 87.7/47.5  | 91.6/62.7 | 89.8/49.1 | 69.4/24.6    | 76.2/36.6 | 70.4/25.1 | 96.7/80.0  | 98.1/87.5 | 97.0/80.1 |

We find that although our contrastive pre-training indeed shows improvements compared to the adversarial training (AT) baseline, it cannot beat the jigsaw-based pre-training strategy. We summarize two potential reasons. First, the current dataset for point cloud classification is much smaller than the datasets in 2D vision (e.g., ImageNet). However, contrastive learning usually requires a large dataset to work well [2,3,4]. In PointContrast, they need to rely on a much larger dataset, ScanNet [5] (consisting of both spatial and color information), even for the downstream classification task (the classification task is done on other datasets). However, in our study, we find that pre-text task-based methods can work well purely on the original dataset. Second, a contrastive learning design for point cloud classification is desired since PointContrast is more useful for the segmentation task. We will revise our manuscript to add this experiment and discuss the reasons. We also propose contrastive learning for adversarial robustness as a promising research direction to be followed up on by making improvements such as using a larger dataset.

[1] Xie, Saining, et al. "Pointcontrast: Unsupervised pre-training for 3d point cloud understanding." European Conference on Computer Vision. Springer, Cham, 2020.

[2] Chen, Ting, et al. "A simple framework for contrastive learning of visual representations." International conference on machine learning. PMLR, 2020.

[3] Cao, Yun-Hao, and Jianxin Wu. "Rethinking Self-Supervised Learning: Small is Beautiful." arXiv preprint arXiv:2103.13559 (2021).

[4] He, Kaiming, et al. "Momentum contrast for unsupervised visual representation learning." Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2020.

> Q: More evaluations on point cloud-specific attacks are preferred. 

A: We agree with the reviewer that 3D point cloud data has different characteristics from 2D images. Therefore, we indeed consider three types of 3D point cloud domain-specific attacks in our paper, including (1) point shifting (PS), (2) point adding (PA), and (3) point dropping (PD) from the current 3D attack literature [1,2,3].  PGD itself is an adversarial optimization method that is orthogonal to the attack capability (i.e., PS, PA, and PD). Moreover, we also included Momentum Iterative Method (MIM) and AutoAttack with different objective functions (see results in Figure 3). 

Based on the reviewer’s suggestion, we include here two other attacks, including CW-based [1] attack and generative model-based attack (LG-GAN) [4], to further demonstrate the effectiveness of our adversarial training strategy. We test the robustness of our best fine-tuned models in Table 2. 

In the following table, we show the robustness of our best fine-tuned model against the LG-GAN attack.  We also compare it with two baselines, including standard training (ST) baseline and adversarial training (AT) baseline. The numbers here are the robustness accuracy (the higher, the more robust). We could observe that our method achieves consistently higher robustness than the two baseline methods from the result.


|      LGGAN           | ModelNet40 |       |      | ScanObjectNN |       |      | ModelNet10 |       |      |
|----------------|------------|-------|------|--------------|-------|------|------------|-------|------|
|      RA(%)     | PointNet   | DGCNN | PCT  | PointNet     | DGCNN | PCT  | PointNet   | DGCNN | PCT  |
| ST Baseline    |    35.2    |  48.1 | 37.9 |       0      |  11.9 |  7.6 |    55.6    |  65.7 | 57.2 |
| AT Baseline    |    63.3    |  73.2 | 67.8 |     33.8     |  40.7 | 33.5 |    81.9    |  85.1 | 82.1 |
| Best Finetuned |     71     |  78.8 | 73.3 |     35.9     |  49.9 | 35.2 |    84.1    |  87.1 | 84.7 |


In the following table, we show the robustness of our best fine-tuned model against the C&W target attack. For each test sample, we randomly select a class as a target.  We also compare it with two baselines, including standard training (ST) baseline and adversarial training (AT) baseline. Note that the numbers here are the attack success rate of target attacks (the lower, the more robust). From the result, we could observe that our method achieves consistently higher robustness compared to either of the two baseline methods.

|      C&W        |     | ModelNet40  |                 | |       ScanObjectNN         |      | |   ModelNet10     |      |
|    :----:   |:----:   |:----:   |:----:   |:----:   |:----:   |:----:   |:----:   |:----:   |:----:   |
| ASR(%)         | PointNet   | DGCNN | PCT  | PointNet     | DGCNN | PCT  | PointNet   | DGCNN | PCT  |
| ST Baseline    | 98.3       | 98.1  | 99   | 100          | 100   | 100  | 95.3       | 96.2  | 95.1 |
| AT Baseline    | 11.2       | 7.6   | 9.8  | 35.9         | 24.4  | 39.7 | 5.9        | 5.5   | 6    |
| Best Finetuned | 6.93       | 5.21  | 5.68 | 30.1         | 20    | 30.4 | 5.5        | 4.2   | 5.5  |

These results further justify the significance of self-supervised learning for 3D point cloud robustness. Thanks for the suggestion; we will add these results in our revised version. 

[1] Xiang, Chong, Charles R. Qi, and Bo Li. "Generating 3d adversarial point clouds." Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2019.

[2] Sun, Jiachen, et al. "On Adversarial Robustness of 3D Point Cloud Classification under Adaptive Attacks." arXiv preprint arXiv:2011.11922 (2020).

[3] Zheng, Tianhang, et al. "Pointcloud saliency maps." Proceedings of the IEEE/CVF International Conference on Computer Vision. 2019.

[4] Zhou, Hang, et al. "Lg-gan: Label guided adversarial network for flexible targeted attack of point cloud based deep networks." Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2020.


The paper provides a deep dive into the adversarial robustness of a 3D point cloud recognition models. Specifically, the paper considers PointNet, DynamicGraphCNN, and PointCloudTransformer based 3D point cloud recognition architectures for the analysis. There are comprehensive experiments followed with detailed discussions shedding some light into the behavior of the respective model under adversarial perturbations. Furthermore, the paper also demonstrate few ways to create a adversarially robust model and provides an analyses if existing approaches proposed to counter adversarial attacks for images translate well to the 3D task.  
+ The paper is very well structured and nicely written. The motivation is clearly stated and leads right into the contributions of the paper. The paper does a good job in introducing the problem and discussing the status of existing art and why there needs to be more exploration of the topic of interest. 


+ The paper addresses an important outstanding problem in the field. There are many works in the literature trying to come-up with novel ways to attack a 3D point-cloud recognition models. However, there is very little research done in providing a defense mechanism that can counter those attack to provide a robust 3D point-cloud recognition models. The robustness of these models is an important and interesting aspect of 3D point-cloud recognition and requires more exploration as rightly pointed out in the paper.


+ The experiments provided by the paper are extensive and covers a lot of aspects related to robustness of 3D point-cloud recognition models. The experiment analysis includes many popular and recent 3D point-cloud recognition architectures such as PointNet, DynamicGraphCNN, and PointCloudTransformer. Furthermore, each model is trained with multiple different strategies to provide a comprehensive comparison. The performance is evaluated on multiple 3D point-cloud recognition benchmark datasets.


+ Since, this is one of the first work attempting to develop strategies that can learn adversarially robust 3D point-cloud recognition model, the experimental analysis provided in paper can prove useful to the community. This extensive analysis enables the others to be able to easily built on top of this work and compare with the benchmark established in this work. Moreover, the interesting insights provided in the paper could prove very useful in driving the future research in this domain.


 
- The paper shows clear usability of having pretext-task based self-supervision in improving model robustness against adversarial perturbations. However, in recent self-supervised learning literature pretext-task based approach are rarely used. Most of the methods utilize contrastive learning based approach for self-supervised training. Given their popularity, it would be a crucial contribution to the community to study usability of contrastive learning based self-supervision in improving adversarial robustness of a 3D point-cloud recognition models. Furthermore, there are existing work [1] studying contrastive learning based self-supervision for 3D point-cloud data, it makes sense to include these methods in to experimental study.


- The paper follows a PGD-style attack model to fool the 3D point-cloud based recognition models. However, there are many recent adversarial perturbation methods designed specifically for the 3D point-cloud data, whereas the paper does not include these attack models. In my opinion, having these attack model is of utmost important as they are created specifically considering 3D point-cloud data in mind, unlike a straight-forward extension of PGD-style attack which was created with 2D images in mind.


- The novelty of proposed robustness strategy is limited. Many other works have previously explored this approach [2] and the ability of self-supervision in helping adversarial robustness of the model.


- The paper only considers adversarial training approach for baseline experiments. Whereas there have been many other methods proposed over the years that has been shown to work better than adversarial training such as denoising layers [3], input pre-processing [4] etc. To clearly show the effectiveness of the proposed self-supervised training approach, comparison with these baseline is neccessary to evaluate how well pretext-task based self-supervision works for improving adversarial robustness of the model.


[1] Xie, Saining, et al. "Pointcontrast: Unsupervised pre-training for 3d point cloud understanding." European Conference on Computer Vision. Springer, Cham, 2020.

[2] Hendrycks, Dan, et al. "Using Self-Supervised Learning Can Improve Model Robustness and Uncertainty." Advances in Neural Information Processing Systems 32 (2019): 15663-15674.

[3] Xie, Cihang, et al. "Feature denoising for improving adversarial robustness." Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2019.

[4] Samangouei, Pouya, Maya Kabkab, and Rama Chellappa. "Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Models." International Conference on Learning Representations. 2018.



The paper studies how self-supervised learning and adversarial training may interact to affect the accuracy and adversarial robustness of models that process point clouds. The study includes several architectures, threat models, self-supervised learning objectives, and tasks on which performance is measured. The experimental setup of the paper is comprehensive and reasonable; further, its findings are interesting and are reported in a sensible manner.  Strengths:
+ The paper's main object of study is important for both the 3D vision community and the adversarial robustness community. I think both fields can gather insights from the experiments presented in this paper.
+ The experimental framework presented in the paper is comprehensive, considering architectures, threats, learning objectives and tasks, making it a rather complete benchmark.
+ The experimental results themselves are presented in a sensibly-interpreted manner, which I think many readers can value. (I am making reference to the "insight" paragraphs reported in the paper)
+ The paper's overall writing is of good quality, sustaining a reasonable narrative that incrementally introduces the notions that the reader requires for understanding the results.
+ The paper shares spirit with previous works, I think in particular with [25], but provides a significant original contribution in itself.


Weaknesses that affect my decision: (mainly my concerns are of experimental nature, as I find some results somewhat confusing or unexpected. I think this is most likely an understanding issue from my side, but, if it is not, and these are actually implementation issues that invalidate the experimental findings of the paper, I would be forced to lower my rating substantially)
+ For the "max" type of ensemble (as reported in L297), have the authors considered the fact that, while gradients can backpropagate smoothly to the model whose logit was the max, perhaps the max-selection itself is introducing noise into the gradient? Could this be a source of noise for the results then?
+ I understand the paper applies dual batch normalization to the inputs (and perhaps also in intermediate layers of the network). What impact, exactly, does this have in terms of spatial coordinates, which have a clear correlation between them, as given by the captured object's actual shape? Could this dual batch normalization be, in itself, introducing noise into the overall experimental framework.
+ I am unsure regarding how to interpret the results of Table 2: how is it possible that in many cases "Adversarial $x$" has *lower* robust accuracy than just "$x$" (for $x \in {3D rotation, Jigsaw, Autoencoder}$)? Is this an implementation issue? Or is it that this notation is making reference to a different concept than the one I say? It would be rather expected that regular accuracy drops a bit (as happens in some entries in the table), but I do not understand why robust accuracy would not improve. Could the authors please elaborate on this phenomenon? Also regarding this phenomenon, is it also related to the fact that Table 3 does not report rows "Adversarial $x$"?
+ Tables 4, 5 and 6 report that robust accuracy of standardly-trained models ("ST Baseline") is rather large (definitely well-above 0). This stands in stark contrast with the results presented in Table 1 (and the literature on adversarial attacks in general). Can the authors confirm these results? I find them (suspiciously) strange.
+ In L230 the paper hypothesizes that the robustness properties of DGCNN can be attributed to the usage of EdgeConv. Has this claim been verified experimentally? I do not see such results in the paper.
+ L125 reports that different backbones were utilized for the encoder, but I did not see experiments on this.
+ L155 reports that the add/drop adversaries are easier to detect than the shift adversary. Are there experiments for this "detection" or on what grounds is this statement based? (A similar statement is done in L177)



Weaknesses that do not affect my decision but should be addressed if possible:
+ L19: deep learning [...] they
+ Figure 1(b) could benefit from displaying the symbols for $\mathcal{M}_{\theta_m}$, $\mathcal{H}_{\theta_h}$ and $\mathcal{F}_{\theta_f}$ within the figure itself.
+ L64: state under which attack this robust accuracy is being computed
+ L94: I assume the pre-defined perturbation space $\mathcal{S}$ is implicitly related to the $p$ in the $\ell_p$ norm ball, but perhaps it would be helpful to explicitly say so.
+ L100: perturb
+ L117: I seobjective
+ L145: recongnition
+ L147: $x_t$ vs. $x^t$ (same in L165)
+ L163: it
+ L177: what does "k=14,5" mean? 14 for training and 5 for testing? If so, what is the rationale behind this decision?
+ L177: most k [...] salient
+ L192: epoch
+ Table 1: report what "CA" and "RA" stand for (same for Table 2).
+ In Table 2's caption, report under which attack these results are obtained (same comment for Table 3). I understand they are against shifting, but it would not hurt to explicitly state this.
+ Legends and labels are kind of uncomfortable to read in Figure 3.
+ Figure 3 caption: "rest plots"
+ L273: attacks
+ L279: We
+ L326: inter-over...
+ L339: a
+ L356: pint
+ L356: preception Yes, they have.

Meta-review: After some discussion, four reviews, all of them pretty thorough, recommend accepting this paper.
I see nothing that would cause me to want to contradict this unanimous decision, and so I am recommending acceptance.

Decision: accept