Provable Defense Against Clustering Attacks on 3D Point Clouds
Abstract
Lately, the literature on adversarial robustness spans from im- ages to other domains such as point clouds.
In this work, we consider clustering attacks on 3D point clouds and devise a provable defense mechanism to counter them.
Speciﬁcally, we adopt a randomized smoothing strategy for 3D point clouds and derive a robustness certiﬁcate based on the cluster radius rather than the number of adversarial points.
Our experiments on ModelNet40 and ScanObjectNN datasets using the PointNet classiﬁer demonstrate the effectiveness of our defense mechanism against targeted and untargeted clustering attacks with a large number of adversarial points.
Introduction
Adversarial robustness is an important research topic both in terms of understanding modern neural networks and in safetycritical applications (Akhtar and Mian 2018).
Recently, this topic is becoming increasingly popular in domains outside of images, including point clouds.
The recent literature on adversarial robustness on point clouds mainly focuses on point perturbation/addition/deletion attacks (Liu, Jia and Gong 2021).
However, despite their practical importance in applications such as self-driving cars (Cao et al. 2019; Xiang et al. 2021), the stronger clustering attacks are less studied (Xiang, Qi and Li 2019).
In this work we consider clustering attacks on 3D point clouds and devise a provable defense mechanism to counter them.
Our idea is to adopt a (de)-randomized smoothing strategy (Levine and Feizi 2020) for 3D point clouds.
Speciﬁcally, we divide the 3D space into equally sized voxels, and learn a classiﬁer on points contained in the randomly subsampled voxels (see Figure 1).
We show that such a classiﬁer is robust to a large number of adversarial points as long as they are concentrated on a small set of clusters.
In short, we derive a robustness certiﬁcate that is based on the attack cluster radius rather than the number of adversarial points.
We evaluate our approach on a synthetic ModelNet dataset (Wu et al. 2015) and a real ScanObjectNN dataset (Dai et al. 2017).
Our experiments demonstrate that our defense mechanism is signiﬁcantly better than the comparable baselines against both targeted and untargeted clustering attacks when the number of adversarial points grows.
Copyright © 2022, Association for the Advancement of Artiﬁcial Intelligence (www.aaai.org).
All rights reserved.
[Figure]
Related Work
Existing adversarial attacks on 3D point clouds can be categorized into three categories based on the attacker’s capability.
The ﬁrst type is point perturbation which is adopted from image-level adversarial attacks.
Xiang et al.
(Xiang,
Qi, and Li 2019) used an optimization-based strategy to generate an adversarial noise.
The objective of this attack is to ﬁnd a minimal perturbation sample that can make the classiﬁer classify incorrectly.
The perturbation measurements include (cid:96) 2 -norm, Hausdorff distance, and Chamfer distance.
Zhou et al.
(Zhou et al. 2020) proposed a point cloud generation-based targeted attack, which learns how to deform the point cloud with minimal perturbation and then mislead the classiﬁer into a speciﬁc label.
The second type is point deletion-based attacks.
Zheng et al.
(Zheng et al. 2019) proposed a gradient-based salience and dropping points attack with the lowest salience score.
Yang et al.
(Yang et al. 2019) proposed a method that is mainly focused on PointNet architecture that utilizes the crit- ical point property.
Critical points remain active after using max pooling, i.e., these points are important when determining the object category.
Therefore missing critical points are more likely to change the prediction output.
This intuition was used by Ying et al.
(Yang et al. 2019) by iteratively removing critical points to create an untargeted attack.
The third type of attack is point addition; this can be adding random points, a cluster, or an object to the original point cloud.
Xiang et al.
(Xiang, Qi, and Li 2019) places a set of independent points or a limited number of point clusters and optimizes the cluster location and the shape of the clusters.
Yang et al.
(Yang et al. 2019) proposed a point-wise gradientbased point addition attack that updates the attacked points without changing the original points.
Several empirical defenses have been proposed to mitigate these attacks.
These defenses are mainly focused on detecting attacks or training more robust classiﬁers.
Adversarial training (Liu, Yu, and Su 2019) is one of the most effective methods to improve the robustness of the model by augmenting the training set with adversarial samples.
DUP-Net
(Zhou et al.
2019) proposed a statistical outlier removal denoiser and an upsampling network as a pre-processing strategy.
Denoiser removes noise patterns as a non-deferential layer while the upsampling layer generates dense point clouds.
IF-Dense (Wu et al. 2020) network proposed a solution to both point distribution changes due to the point perturbation and surface distortion.
They restore the original point cloud using geometric and distribution-aware constraints.
However, these networks do not provide any theoretically proven robustness guarantee.
Randomized smoothing (Cohen, Rosenfeld, and Kolter 2019) has achieved (cid:96) 2 -norm based certiﬁed robustness on
ImageNet (for 2D classiﬁcation problem), thus overcoming the limitations in the existing defense mechanisms against adversarial attacks.
In general, this method constructs a new smoothed classiﬁer g from the base classiﬁer F where g predicts the class which is more likely to be returned by the F under the Gaussian noise perturbation of input.
PointGuard (Liu, Jia, and Gong 2021) is the ﬁrst defense (for 3D point cloud classiﬁcation problem) that provides provable robustness guarantees against adversarially modiﬁed, added, and/or deleted points.
However, the certiﬁed accuracy of
PointGuard is reduced when the number of adversarial points is increased.
Thus, PointGuard is not effective under (highly dense) cluster attacks.
In this work, we propose a provable defense mechanism against these clustering attacks.
Proposed Method 3. Preliminaries
Point Cloud Classiﬁcation A point cloud is an unordered set of 3D coordinates which are sampled from object surfaces.
We deﬁne a point cloud P of size n as P = (cid:8)
P i | P i ∈ R 3 , i ∈ { 1 , . . . , n } (cid:9) , where each P i =
( x, y, z ) (cid:62) is a point in 3D space.
Let F denote a point-based classiﬁer that maps an input point cloud P ∈ R n × 3 to its corresponding class label y ∈ { 1 , 2 , . .
, c } .
Also, let F i ( P ) denote the probability that the point cloud P is classiﬁed into the i -th class.
Ideally, if i ∗ is the true class label of the point cloud P , then i ∗ = arg max
i F i ( P ) .
Many deep learning classiﬁers (e.g., (Qi et al.
2017a,b; Li et al. 2018;
Wang et al.
) have been proposed for point cloud classiﬁcation.
In this work, we mainly consider the PointNet (Qi et al. 2017a) classiﬁer.
Distance Measures Let D : R n × 3 × R n (cid:48) ×
→ R be a distance metric, i.e., D ( P, P (cid:48) ) is some distance between two point clouds P and P (cid:48) .
Below, we deﬁne a few distance metrics required for our purpose: (i) [Equation] p -norm: For the original point cloud P and corresponding adversarial cloud P (cid:48) , the (cid:96) p -norm (for p ≥ 1 ) distance between P and P (cid:48) is deﬁned as:
[Equation]
where P i is the i -th point in P , and P (cid:48)
i is its corresponding point in P (cid:48) .
(ii) Chamfer measurement:
For the original point cloud
P and its adversarial counterpart P (cid:48) , we deﬁne Chamfer
Measurement (Fan, Su, and Guibas 2017) as:
[Equation]
where | P (cid:48) | denotes the number of points in P (cid:48) .
(iii) Farthest distance: We deﬁne farthest distance of a point cloud P as (Xiang, Qi, and Li 2019):
[Equation]
(iv) Average distance: We deﬁne average distance of a point cloud P as:
[Equation]
Here we abuse the notation a little to use D to denote both mappings R n × 3 × R n (cid:48) ×
[Equation]
→ R and R n × 3 → R .
3. Clustering Attack
In this work, we consider the clustering attacks in point clouds, where an adversary adds a limited number ( m ) of adversarial shapes, as either generic primitive shapes such as balls or meaningful shapes such as small airplane models.
In particular, we consider the targeted clustering attack model from (Xiang, Qi, and Li 2019) and untargeted clustering attack model from (Kim et al. 2021).
These works showed that
PointNet (Qi et al. 2017a) can be fooled by adding a limited number of synthesized point clusters with meaningful shapes.
The number of clusters added is hard bounded to 1-3 in our experiments.
(i) Targeted attack model: Let P (cid:48) be an adversarial point cloud generated from the original point cloud P .
The goal of the attack is to mislead the classiﬁer F to classify P (cid:48) as a selected target class.
Let t (cid:48) ∈ { 1 , 2 , . .
, c } be the malicious target class of the adversary.
The attack problem is formulated as follows:
[Equation]
The term, D ( P, P (cid:48) ) constrains the perceptibility of the adversarial point cloud P (cid:48) w.r.t.
the original point cloud P .
Since directly solving the above constrained optimization problem is difﬁcult, we reformulate it into an unconstrained optimisation problem using a Lagrange multiplier-like form as:
[Equation]
Here, h ( P [Equation]
= max { 0 , max [Equation]
− F t [Equation]
( P (cid:48) ) } is the adversarial loss function whose output measures the possibility of a successful attack.
By optimizing over this equation, we aim to search for adversarial examples with least 3D perturbation.
(ii) Untargeted attack model:
In the untargeted attack model, the attacker aims to ﬁnd an adversarial point cloud P (cid:48) as follows:
[Equation]
where i ∗ is the true class label.
The constraint F i ∗ ( P ) (cid:54) =
arg max i (cid:48)
F i (cid:48)
( P (cid:48) ) ensures the generated point cloud P (cid:48) can fool the network F , i.e., F would not classify P and P (cid:48) into the same class.
Similar to the target attack model case, we reformulate above problem as follows:
[Equation]
where, h ( P (cid:48) )
= max { 0 , F i ∗ ( P (cid:48) )
− max i (cid:48) (cid:54) =
i ∗ F i (cid:48)
( P (cid:48) ) } and i ∗ is the true class label of P .
For the addition of adversarial shapes, we can use either generic primitive shapes (adversarial clusters) such as balls or meaningful shapes (adversarial objects) such as small airplane models.
(i)
Adversarial clusters: Here, we aim to minimize the radius of the generated cluster so that the attack is a concentrated small cluster attached to the original object.
In addition, we also encourage the cluster to be close to the object surface.
These requirements are captured by the following distance metric:
[Equation]
where P is the original object, P ( i ) is the i -th adversarial point cluster, P (cid:48)
=
P ∪ P (1) ∪ P (2) ∪ · · · ∪ P ( m ) , m is the number of adversarial clusters, and µ 1 , µ 2 , µ 3 > 0 balance the different terms.
(ii) Adversarial objects: Here, we start from some meaningful objects like small airplanes, slightly modify them, and place them in the appropriate adversarial positions.
We consider the following distance metric to ﬁt this attack setting:
[Equation]
where P is the original object, P ( i ) is the i -th adversarial point cluster, P ( i, org) is the i -th real-world point cluster, m is number of adversarial clusters, and µ 1 , µ 2 > 0 .
3. Provable Defense
Here, we formalize our defense mechanism that is closely related to the certiﬁed defense against patch attacks for 2D image classiﬁcation (Levine and Feizi 2020) and certiﬁed defense against point addition/deletion/perturbation attacks for 3D point cloud classiﬁcation (Liu, Jia, and Gong 2021).
Consider a sufﬁciently large voxel of dimension L x × L y ×
L z that contains the input point cloud P ∈ R n × 3 .
First, we block-partition this large voxel using non-overlapping small voxels of dimension l x × l y × l z .
Let us denote V non ( P ) as the set of these small voxels that contain at least one point in the point cloud P .
Then, we randomly subsample k voxels (without replacement) from the set V non ( P ) , and retain all the points in P that are contained within each of these chosen voxels.
Following this randomized sampling strategy, we create multiple subsampled point clouds (of size k ) from P .
Finally, we provide these subsampled point clouds as the input to the classiﬁer F .
The intuition behind our defense mechanism is that, when the number of adversarially affected small voxels is bounded, the majority of the subsampled point clouds do not include any adversarial clusters and thus the majority vote among their labels predicted by F may still correctly predict the label of the original point cloud P .
In the limit l x → 0 , l y → 0 , l z → 0 , our method coincides with the PointGuard defense (Liu, Jia, and Gong 2021).
In the clustering attack model, an adversary adds a limited number (1-3) of adversarial shapes to the original point cloud
P such that it is misclassiﬁed by the point cloud classiﬁer
F .
Let V att ( P ) be the subset of voxels in V non ( P ) that are affected by the clustering attack.
We consider a setting where the number of affected voxels is very small, i.e, | V att ( P ) | (cid:28) | V non ( P ) | .
However, in comparison to (Liu, Jia, and Gong 2021), we do not limit the number of points added/affected by the adversary within a cluster.
Thus, the notion of certiﬁed perturbation size deﬁned in (Liu, Jia, and Gong 2021) is not applicable under the clustering attack model.
Note that typically an adversarial cluster is very dense, i.e., the number of points in the adversarial cluster is comparable to the total number of points in the point cloud.
Our defense mechanism is developed based on the derandomized smoothing technique from (Levine and Feizi 2020).
Given an input point cloud P , let S k ( P ) be the set of all distinct randomly-ablated versions of P according to the above described sampling strategy.
For the base classiﬁer F , a smoothed classiﬁer g is deﬁned as:
[Equation]
where
[Equation]
} denotes the number of point cloud ablations that were classiﬁed as class y .
Note that the resulting smoothed classiﬁer returns the most frequent prediction of the base classiﬁer over the ablation set S k ( P ) .
We refer to the fraction of (test) point clouds that the smoothed classiﬁer correctly classiﬁes as standard/empirical accuracy. 200 p o i n t s p e r c l u s t e r 100 p o i n t s p e r c l u s t e r [Figure] n
[Figure]
r
[Figure] r [Figure] Robustness Certiﬁcate Here, we derive the certiﬁed robustness guarantee of our proposed defense mechanism.
When performing derandomized smoothing, we classify all the point clouds in the ablation set S k ( P ) using the base classiﬁer F 1 .
Of these classiﬁcations, at least (cid:0) | V non ( P )
|−| V att ( P )
| k (cid:1) will use none of the at most | V non ( P ) | voxels which may be affected by the adversary.
Therefore, the number of classiﬁcations that may be affected by the adversarial clustering attack is at most: ∆
[Equation]
P [Equation] Since the adversary can only alter the output of ∆( P ) of the evaluations of the base classiﬁer F , we obtain the following robustness guarantee for the smoothed classiﬁer g (Liu, Jia, and Gong 2021):
Theorem 1.
For any input point cloud P , and base classiﬁer
F , if:
[Equation]
then for any point cloud
[Equation]
which differs from P only in | V att ( P ) | voxels, g ( P (cid:48) )
=
y .
When the condition in the above theorem is met, the most frequent class (prediction of the smoothed classiﬁer) is guaranteed to not change even if an adversarial cluster compromises every ablation (in S k ( P ) )
it intersects.
Remark 1.
For practical purposes, we introduce two simpliﬁcations to above derandomized smoothed classiﬁer: (i) we only consider a random subset (of size N ) of the ablation set S k ( P ) , (ii) within each voxel, we only randomly retain at most m point cloud points.
Experiments 4. Experimental Setup
Datasets and Models We conducted experiments on ModelNet40 (Wu et al. 2015) and ScanObjectNN (Dai et al. 2017) datasets.
The ModelNet40 dataset is constructed using 3D
CAD models, and each point cloud comprises of 1024 points and belongs to one of 40 different object categories.
The standard split of 9,843 point clouds for training and 2, point clouds for testing is used.
The ScanObjectNN dataset consists of 14,298 point clouds obtained by scanning real objects in indoor environments.
The objects are categorized into 15 classes, where 11,416 objects are used for training and 2,882 for testing.
Similarly to ModelNet40, 1024 points are used per point cloud.
For our approach and the compared methods, we use the PointNet (Qi et al. 2017a) model as the base classiﬁer, and the publicly available code is used 2 .
Evaluation Protocol We follow the evaluation protocol of the recent PointGuard (Liu, Jia, and Gong 2021) method and compare against it on the clustering attacks discussed in Section 3.2. A vanilla PointNet classiﬁer trained on the respective [Figure] [Figure]
i r i c a l A cc u r a c y [Figure] dataset is used to generate the attack point clouds in the aforementioned four attack models: targeted and untargeted attack models with free-form clusters and speciﬁc objects, where the number of adversarial points and the number of adversarial clusters/objects are user-speciﬁed (see Figure 2).
We use the publicly available code 3 for attack generation with objective functions described in Section 3.2.
We generate two types of adversarial cluster attacks for ModelNet40 with two different parameter settings.
Speciﬁcally, µ 1 , µ 2 , µ 3 parameters are set to 5 , 10 , 0 . 05 and 0 , 5 , 0 .
For ScanObjectNN the parameters are set to 50 , 100 , 0 .
For the adversarial object attack, we set µ 1 , µ 2 to 5 , 1 for both the datasets.
Note that while these parameters are tuned to obtain attack clusters with minimal perturbation to the original point clouds, no hard constraint is enforced on the attack cluster radius.
For defense mechanisms, a base classiﬁer is trained using sub-sampled point clouds rather than the original training set.
Speciﬁcally, each point cloud is ﬁrst sub-sampled to have k (cid:28) 1024 number of points and passed to the model to opti- [Figure]
dataset where the number of attack clusters is set to 3. Our model with voxel size l = 0 . 1 outperforms the other methods by a large margin.
In r = 200 case both our model and PointGuard performs similarly, this might be due to large attack cluster radius.
mize the loss.
As discussed in Section 3.3, a model is evaluated by majority voting of the predictions on N sub-sampled point clouds each with k points.
The main difference between our method and PointGuard is the sub-sampling strategy used, which in our case is voxel-based, where PointGuard simply uses random sampling of points.
In the experiments, we also compare the baseline undefended classiﬁer which is the vanilla PointNet classiﬁer evaluated on the adversarial point clouds generated on the test set.
Unless otherwise speciﬁed, we used the default parameter setting of PointGuard.
Speciﬁcally, for both ModelNet40 and
ScanObjectNN datasets, we set N = 10 , 000 and k = 16 .
For our method, we experiment with different voxel sizes l = l x = l y =
l z and the models are trained and tested on a
Tesla P100 GPU.
Evaluation Metric We use the empirical accuracy (the percentage of adversarial point clouds that are correctly classiﬁed) as the metric to evaluate and compare different defense mechanisms.
Even though PointGuard uses certiﬁed accuracy, it does not apply to our method as the robustness certiﬁcate measurement is different.
In particular, PointGuard measures a radius of certiﬁed robustness, whereas our method provides certiﬁed robustness on the number of adversarial voxels/points.
4. Results
We evaluate both the attack variants (adversarial clusters and adversarial objects) on targeted and untargeted settings in
ModelNet40, and since untargeted attacks are stronger, we evaluated them on ScanObjectNN as well.
We report results for our method in three different voxel sizes, speciﬁcally, l = 0 .
1 , 0 . 3 , and 0 .
5 , and the 0 .
1 version consistently outperforms.
Some visualizations of the attack clusters are illustrated in Figure 2.
In summary, our method outperforms PointGuard and the undefended classiﬁer in all the cases, especially when the number of adversarial points grows.
The signiﬁcance of our method is in the regime where the number of attack points is high but concentrated on sparse locations (typical clustering attack).
We discuss the results in detail below:
Adversarial Cluster Attack
In Figure 3 the empirical accuracy as a function of number of adversarial points ( r ) is reported for targeted and untargeted cluster addition attacks with two different parameter settings.
For untargeted cluster addition attacks on ScanObjectNN are reported in
Figure 5-(a).
We limit the number of attack clusters tofor both datasets.
In all six cases, our method with l =
.produces signiﬁcantly better empirical accuracies than
PointGuard (almost 70% better in some cases).
Our model accuracy remains constant after r = 100 for ModelNet dataset while the ScanObjectNN accuracy decreases.
The empirical accuracy of the undefended classiﬁer quickly drops to 10 − 20% while the empirical accuracy of our method is still much higher as r increases.
Adversarial Object Attack We also compare our method with adversarial objects addition, where we add a single ball to the original point cloud.
We evaluated targeted and untargeted attacks on ModelNet40 (Figure 4) and untargeted attack on ScanObjectNN(Figure 5-b).
For both the attacks, our model maintains high empirical accuracy when voxel size l = 0 .
and it remains constant at 75% when the number of points in the ball increases while the PointGuard saturates at 45% .
Further, when the number of points is large, empirical accuracy measured with l = 0 .
5 provides better results compared to PointGuard.
This convincingly veriﬁes the effectiveness of our defense mechanism with point addition attack.
Conclusions
In this paper we have introduced a defense mechanism for strong clustering attacks on 3D point clouds based on a randomized smoothing strategy.
Our defense mechanism is simple, yet effective and our experiments on synthetic and real point cloud datasets demonstrate the efﬁcacy.
We believe adversarial robustness on point clouds and other graph-structured data is an important research area and we intend to investigate better defense mechanisms for attacks on such domains. Acknowledgments
Adrian Weller acknowledges support from a Turing AI Fellowship under grant EP/
V025379/1, The Alan Turing Institute, and the Leverhulme Trust via CFI.