From: ICLR.cc/2023/Conference/Program_Chairs
title: Paper Decision
decision: Reject
metareview:_summary,_strengths_and_weaknesses: Summary: This paper proposes PointDP, an adversarial purification method that leverages a diffusion model as a pre-processing module to defend against 3D adversary attacks for point clouds. The rigorous formulation of adaptive attacks on diffusion models and the robustness evaluation protocol are also studied. Extensive experiments have been conducted to illustrate its superior robustness.  

Strengths: The proposed PointDP method leverages diffusion models to purify adversarial 3D point clouds. The Experiments on six representative models show that PointDP outperforms previous state-of-the-art purification methods by a large margin. The experimental analysis is convincing and it makes a strong empirical contribution to point clouds applications. The paper is clearly written and the method is effective. It is an important finding that diffusion-driven purification could provide actual robustness to 3D point clouds. 

Weakness: The technical contribution and novelty of the paper is limited. The diffusion model was proposed to perform data purification in the past research [ICML 2022], and point cloud diffusion models was proposed in [CVPR 2021], this paper seems to combine those ideas and apply it to 3D point clouds. 
justification_for_why_not_higher_score: The technical contribution and novelty is limited. Diffusion model was proposed to perform data purification and enhance the robustness of image classification in past research, while this paper apply the similar technology to 3D point clouds applications.  Of course, the new application and experimental analysis are useful to show that diffusion model is efficient for defending against adversarial point clouds. However, the technical contribution is incremental, as they only apply diffusion models to this new task without much reasoning.  The other contributions such as the rigorous formulation of adaptive attacks on diffusion models and the robustness evaluation protocol are well received. 
justification_for_why_not_lower_score: N/A

From: ICLR.cc/2023/Conference/Paper609/Authors
title: Notice of Rating Change
comment: Dear Reviewer,

We thank you for changing your rating from 3 to 5, but a score of 5 means that you still tend to reject our manuscript. We believe that we have addressed all questions from the initial review and follow-up reply. 

> Lack of Novelty

1. We are the first to unveil that adversarial training, the most longstanding defense in the 2D domain, has a *major* limitation in its application in 3D point cloud recognition. We believe this is a novel and critical finding which will correct the direction of future robustness research in the 3D domain. Several existing works have followed the trend in the 2D space to use adversarial training to improve 3D robustness. However, we have demonstrated that black-box adversaries could adaptively attack the adversarially trained model. 
2. PointDP is a general framework that is independent of the diffusion model used. We leverage a SOTA off-the-shelf diffusion model in our experiments. We highlight that the key to our framework is not the diffusion model itself but the rigorous formulation of the *adaptive attacks* and a *thorough analysis* of PointDP on its robustness for 3D point cloud recognition. Specifically, we use an augmented SDE process to model the gradient flow through the diffusion model for the BPDA attack and leverage the latent feature attack to further consolidate our evaluation. We extensively utilize 16 different attacks to verify the robustness of PointDP. Besides the proposal of PointDP, our study also presented a rigorous evaluation protocol for robustness assessment in 3D point cloud research. 
As the reviewer indicated, there are many existing purification methods (e.g., DUP-Net and LPC). However, we highlight that in adversarial robustness research, a **proper** way to evaluate the robustness of these methods is very important. Without a **proper** way of evaluation, it may distract the way toward actual robustness in this area. In this work, besides proposing the PointDP framework, we conduct a comprehensive evaluation of our method on white-box, black-box, and adaptive attacks, with both C&W- and PGD-styled objectives, followed by the suggestions from Dr. Nicholas Carlini, a top expert in the adversarial robustness community. Although IF-Defense considered adaptive attacks in its evaluation, we have shown that our PointDP consistently achieves stronger robustness than IF-Defense.

> Additional Experimental Results

We have extensively re-evaluated our methods against DUP-Net and "Robust Structured Declarative Classifiers for 3D Point Clouds". The results are strong enough to demonstrate that PointDP outperforms the other SOTAs significantly.

We are eager to hear from you about your other concerns, and we really would like to work with the reviewer to make our manuscript stronger.

From: ICLR.cc/2023/Conference/Paper609/Authors
title: Final reply since Reviewer TFZv is not responsive.
comment: Dear Reviewer TFZv,

We answered all the questions you raised and the experimental results are crystal clear enough to demonstrate **PointDP outperforms "Robust Structured Declarative Classifiers for 3D Point Clouds" significantly**. 

Without your engagement in the discussion, we have no idea how we could further convince you. As mentioned in our previous response, our codebase was included in the supplements, and please feel free to try it out. You can also find detailed instructions on how to break the robustness of "Robust Structured Declarative Classifiers for 3D Point Clouds" in our paper and rebuttal. 

We kept asking whether you have follow-up questions but never got a single reply. We hope you could reconsider your rating given that we answered every question detailedly and comprehensively. We sincerely wish you are doing well.

From: ICLR.cc/2023/Conference/Paper609/Authors
title: Any Pending Questions from the Reviewer?
comment: Dear Reviewer,

As the end date of the discussion stage is approaching, we would like to know if there are any pending questions from you. You kept urging us to compare our PointDP with "Robust Structured Declarative Classifiers for 3D Point Clouds" both in your initial review and response. **However, the truth is that we have compared our PointDP with  "Robust Structured Declarative Classifiers for 3D Point Clouds" both in our original paper and rebuttal.** As shown in Figure 2 in our paper and the rebuttal ([Part 2](https://openreview.net/forum?id=293zPCqNqe&noteId=V_wVLgFV-PE)), LPC is actually more vulnerable to adversarial attacks, and we used their public codebase for our experiments. Specifically, we use ResNet50 as the base model for LPC. The robust accuracy for "Robust Structured Declarative Classifiers for 3D Point Clouds" is 27.8% and 19.1% for $\epsilon = 0.075$ and $\epsilon = 0.1$, respectively. **PointDP outperforms "Robust Structured Declarative Classifiers for 3D Point Clouds" by around 35%.**

You explicitly asked us that "However, I'm still wondering the performance against [1]. Does it outperform image-based classifiers? " in your response on **Nov 19th**. Besides our answer in the original paper and initial rebuttal, we have provided another **6 replies** for you to explain the reasons behind our experimental results and even got acknowledgment from the first author of "Robust Structured Declarative Classifiers for 3D Point Clouds". Unfortunately, you did not reply to us since Nov 19th.

We are eager to hear your reply, otherwise, we could not know what are your remaining questions. We hope you could raise your rating accordingly if you do not have any other questions.

From: ICLR.cc/2023/Conference/Paper609/Authors
title: Pending Questions from the Reviewer?
comment: Dear Reviewer,

We believe that we have answered every question from you. The comparison between our PointDP and "Robust Structured Declarative Classifiers for 3D Point Clouds" can be found **both in our original manuscript and rebuttal**. We have extensively demonstrated that PointDP outperforms "Robust Structured Declarative Classifiers for 3D Point Clouds", which was even acknowledged by the paper's first author. 

We sincerely ask you to engage in the discussion so we can know what your follow-up questions are. If there are not any questions, we hope you could raise the rating accordingly. 

Thank you!

From: ICLR.cc/2023/Conference/Paper609/Authors
title: Kindly Ask for Pending Questions
comment: Dear Reviewer, 

We thank you again for the positive feedback. We have provided a detailed description that explains the logic of the diffusion process in PointDP. We will include this description in our camera-ready version to help readers understand our defense mechanism. We appreciate the reviewer's useful suggestions that help improve our manuscript.

As we mentioned in our manuscript and rebuttal, adversarial robustness is crucial for point cloud recognition. We would like to kindly ask whether the reviewer has follow-up questions or any suggestions that will result in a higher rating. If not, we hope that the reviewer could raise the score accordingly to help us make progress toward the adversarial robustness in the 3D point cloud domain.

Thank you!

From: ICLR.cc/2023/Conference/Paper609/Authors
title: Thank you!
comment: We sincerely thank the reviewer for reading our rebuttal and acknowledging our method. We appreciate the constructive suggestions from the reviewer that help improve the quality of our manuscript.

From: ICLR.cc/2023/Conference/Paper609/Reviewer_gbYk
title: Update post rebuttal
comment: I have read the responses to my review and the other reviewers. I thank the authors for their time and clarifications.  They have addressed my concerns and I have increased my score in response.

From: ICLR.cc/2023/Conference/Paper609/Authors
title: Pending Questions from the Reviewer?
comment: Dear Reviewer,

We have answered every question from the review in a point-to-point manner. As we mentioned in the previous reply, the first author of "Robust Structured Declarative Classifiers for 3D Point Clouds" acknowledged that their method is not robust under black-box and adaptive attacks. We also emphasized our key contributions in our paper and rebuttal.

We kindly ask whether you still have pending questions and we are happy to answer them. We hope you could raise your rating accordingly as we have provided very detailed results and answers.

From: ICLR.cc/2023/Conference/Paper609/Authors
title: Response to Reviewer TVXV
comment: We agree that PointDP should be regarded as an application of the diffusion models and we are glad that the reviewer thinks our findings are important. 

The demonstration of existing works' failure is very critical in the robustness community. **[b] and [c] are two of the most cited papers in recent top-tier conferences, which both focused on adaptive attacks that showed previous works are not robust enough.** Therefore, our demonstration of the ineffectiveness of adversarial training, IF-Defense, and LPC are solid technical contributions.
Besides all the important findings, we do have technical contributions, which are the rigorous formulations of the adaptative attacks on PointDP. Most of the "fancy" defenses ignore this part, but we strongly argue that this is actually the most important pillar for the adversarial robustness community.
The summarized robustness evaluation protocol is also a major contribution to our work, as it will guide future research to design truly robust 3D point cloud recognition methods.

Point clouds are significantly different from 2D images. We have evaluated PointDP under $\ell_0$, $\ell_2$, and $\ell_\infty$ norms with various point-cloud-specific attacks. Therefore, PointDP distinguishes itself from DiffPure [a] significantly as DiffPure [a] only focuses on 2D images.

[a] Diffusion Models for Adversarial Purification. ICML 2022.

[b] Athalye, Anish, Nicholas Carlini, and David Wagner. "Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples." International conference on machine learning. PMLR, 2018.

[c] Tramer, Florian, et al. "On adaptive attacks to adversarial example defenses." Advances in Neural Information Processing Systems 33 (2020): 1633-1645.

From: ICLR.cc/2023/Conference/Paper609/Authors
title: Ackownledged by Authors of "Robust Structured Declarative Classifiers for 3D Point Clouds"
comment: Dear Reviewer TFZv,

We contacted the authors of "Robust Structured Declarative Classifiers for 3D Point Clouds" about our insights. **The authors successfully reproduced our results and acknowledged our findings.** The methods introduced in "Robust Structured Declarative Classifiers for 3D Point Clouds" is not robust enough. 

We kindly ask if there are any remaining questions and we hope the reviewer will raise the rating accordingly.

From: ICLR.cc/2023/Conference/Paper609/Reviewer_TVXV
title: Response to the Authors
comment: I still think that PointDP should be regarded as an application of the diffusion models. It is also an important finding that diffusion-driven purification could provide actual robustness to this task.

However, TECHNICAL contributions should not only include findings (insights). Therefore, I still think the technical contribution is not enough for publication.

Moreover, similar findings that the diffusion models are robust to adversarial perturbations have been found in DiffPure [a].

[a] Diffusion Models for Adversarial Purification. ICML 2022.

From: ICLR.cc/2023/Conference/Paper609/Authors
title:  Response to Reviewer TVXV (Cont'd)
comment: Besides, the application of diffusion models for improving adversarial robustness in 3D point cloud recognition was unexplored. It was **unknown** whether diffusion-driven purification could provide actual robustness to this task. To comprehensively explore the usage of diffusion models on point cloud robustness research, we have adapted the inference logic to a truncated diffusion setting, where we first add Gaussian noise to the input adversarial point clouds and then restore the point cloud step by step. We also conducted a comprehensive analysis of how different truncated diffusion steps $t$ will contribute to the adversarial robustness of the classification model, as shown in Figure 2. Moreover, we also have modified the training recipe where we first train the diffusion model and then fine-tune the point cloud classifier. 

Given all the efforts above, we respectfully disagree with the reviewer; because as the **first** study of the diffusion-driven adversarial purification method in this area, we have provided many useful observations in shedding light on whether and how diffusion models could bring actual robustness to 3D point cloud recognitions, which are all solid technical contributions.

From: ICLR.cc/2023/Conference/Paper609/Authors
title: Response to Reviewer TVXV
comment: We thank the reviewer for the reply and for acknowledging our analysis of adversarial training. We agree with the reviewer that the performance gain is indeed attributed to the diffusion model. We will make this clearer in our final paper if accepted. 

We also agree that PointDP, the method itself, is a new application of the diffusion model. However, as mentioned in our rebuttal, one of the main contributions of our paper is to rigorously analyze whether the general diffusion-based preprocessing will bring **actual** robustness to 3D point cloud recognition. That is to say, we are not proposing a new diffusion model. Instead, our formulations of **adaptive attacks** can work on all diffusion architectures, which is a main technical contribution. The extensive evaluation of PointDP is another key factor that shows the actual robustness gained by PointDP. 

As mentioned in the rebuttal, many purification methods leveraged existing techniques for pre-processing, such as ME-Net, IF-Defense, SOR, and DUP-Net. However, they failed to formulate adaptive attacks on their proposed method. We have witnessed many fancy methods quickly fail under adaptive attacks in ML robustness research, so we truly believe that **rigorousness** is as important as the proposal of the method itself. 

It is worth noting that any purification methods without adaptive attacks could improve the "robustness". We can always read some methods with surprisingly high robust accuracy numbers, but such "robustness" is not the **actual** robustness. Therefore, we respectfully disagree with the reviewer that "the analysis does not bring extra technical contributions". **The formulations of different attacks are non-trivial and need a lot of effort with rigorous derivation and careful experimentation.** The goal of our study is to provide an evaluation protocol that helps researchers to better understand the real robustness of their proposed method. We truly want to facilitate the research on the actual robustness of 3D point cloud recognition.

Combined with our analysis of adversarial training in 3D point cloud recognition, we believe the overall contribution is significant. We hope the reviewer could reconsider the rating.

From: ICLR.cc/2023/Conference/Paper609/Reviewer_TVXV
title: Response to the Authors
comment: I agree with the claim that "adversarial training has a major limitation in its application in 3D point cloud recognition", which has been solved by PointDP.

However, As mentioned by the author, "PointDP is a general framework that is independent of the diffusion model used". 
How about the experimental results with other models? The experimental results prove that the performance gain is attributed to the diffusion model.

The proposed method can be regarded as a new application of the diffusion model, which does not bring extra technical contributions.

From: ICLR.cc/2023/Conference/Paper609/Authors
title: Pending Question from the Reviewer?
comment: Dear Reviewer gbYk,

We thank you again for your positive feedback and constructive comments that helped us improve our manuscript after the rebuttal. We kindly ask if there are any pending questions and we are happy to answer them. If you think our study is beneficial for the community, we also hope that you could update your rating and take the initiative in discussions among reviewers. We truly believe a rigorous evaluation is essential to the robustness of 3D point cloud recognition. 

Thank you,

Authors of this manuscript

From: ICLR.cc/2023/Conference/Paper609/Authors
title: Pending Question from the Reviewer?
comment: Dear Reviewer TFZv,

We thank you again for your review, and we believe our response, including new strong results, has addressed your comments. We have especially demonstrated that PointDP significantly outperforms DUP-Net, IF-Defense, and **[1]**. Our codebase is included in the supplementary material. If you have any doubts, please do not hesitate to contact us to reproduce the results in our paper.

We hope you can update your rating accordingly if our response addresses your question. Otherwise, please let us know your further concerns; we are eager and happy to answer them.

Sincerely,

Authors of this manuscript

From: ICLR.cc/2023/Conference/Paper609/Authors
title: Kindly Ask for Pending Questions.
comment: We thank the reviewer again for spending time reviewing our manuscript. As we mentioned in the paper and rebuttal, our framework is independent of the specific diffusion model used. The goal and contributions of our paper are to i) identify the vulnerability of existing methods. ii) comprehensively analyze the application of the diffusion model in improving 3D point cloud robustness, and iii) propose a rigorous evaluation protocol to benefit and facilitate future research in this area. We have witnessed several top-tier publications that leverage existing studies for adversarial purification (e.g., DUP-Net and IF-Defense) that eventually failed under adaptive attacks. Therefore, we believe that a rigorous formulation of adaptive attacks is essential. 

We kindly and respectfully ask whether the reviewer has further questions about our paper, and we are glad to answer them.

From: ICLR.cc/2023/Conference/Paper609/Authors
title: Response to Follow-up Questions (Cont’d).
comment: Besides the reasons that we summarized in [Part 2](https://openreview.net/forum?id=293zPCqNqe&noteId=V_wVLgFV-PE), we further explain why [1] is not robust after a closer look at the paper. [1] proposed to leverage the lattice point classifier (LPC) to defend against adversarial attacks. [1] first computes the barycentric weights of each point, and then generates a 2D image based on the barycentric weights of the input point clouds. [1] finally utilizes a 2D CNN for the classification task.

We believe the goal and design philosophy of [1] is valid, which is to leverage implicit gradient to mislead potential attackers and purify the adversarial perturbations. However, the declarative defender can be viewed as a projection from 3D point clouds to 2D images. **Such a projection will inevitably lose a lot of useful information that exists in the 3D geometry.** Therefore, with larger distortions, the projected 2D image will quickly lose semantics that makes itself not predictable by the 2D CNN.  

As mentioned in [Part 3](https://openreview.net/forum?id=293zPCqNqe&noteId=CgOsBgi3ZX) of our response, the reason that LPC [1] leveraged $\epsilon = 0.1$ is that the authors used FGSM, but FGSM is a **1-step** attack that cannot fully utilize the attack budget. The other attacks evaluated in [1] are all C&W-styled adversaries. C&W attack tries to minimize the adversarial perturbation, which is good for an attack method. However, for a defense solution, it is not conclusive enough to assess its robustness merely based on C&W and FGSM attacks. In contrast, **200-step** PGD attacks in our evaluation protocol can fully utilize the attack budget. 

If the reviewer is familiar with the codebase of [1], we suggest that the reviewer could simply try to inject noises that follow a uniform distribution of $[-0.05, 0.05]$ or $[-0.1, 0.1]$ to the input point clouds. Such noises (which could be viewed as a simple black-box attack) can already degrade the performance of [1] by a significant margin.

All these findings further consolidate our claim that a rigorous evaluation protocol for 3D point cloud robustness is important. **It is worth noting that we are NOT criticizing [1], but trying to argue that our evaluation protocol will help researchers to better understand their proposed method in the future.** As members of the ML robustness community, we really want to work with the reviewer to facilitate the research in 3D point cloud robustness.

From: ICLR.cc/2023/Conference/Paper609/Authors
title: Response to Follow-up Questions.
comment: We really appreciate the timely reply from the reviewer. 

**Comparison with [1]**. We have extensively compared [1] with our methods. **LPC is the acronym of the method introduced in [1]**, and we apologize for the confusion of the naming. 

As shown in Figure 2 in our paper and the rebuttal ([Part 2](https://openreview.net/forum?id=293zPCqNqe&noteId=V_wVLgFV-PE)), LPC is actually more vulnerable to adversarial attacks, and we used their public codebase for our experiments. Specifically, we use ResNet50 as the base model for LPC. **The robust accuracy for LPC [1] is 27.8% and 19.1% for $\epsilon = 0.075$ and $\epsilon = 0.1$, respectively. PointDP outperforms [1] by around 35%.** 
The usage of the image-based classifier does not provide robustness gain against adaptive attacks. Please refer to [Part 2](https://openreview.net/forum?id=293zPCqNqe&noteId=V_wVLgFV-PE) and [Part 3](https://openreview.net/forum?id=293zPCqNqe&noteId=CgOsBgi3ZX) of our response to see the detailed results, and we also give several reasons why [1] needs to be more robust.

**Contribution of Our Study**. As mentioned in [Part 1](https://openreview.net/forum?id=293zPCqNqe&noteId=boqDf6qoLN) of our response, our contributions are two-fold. We believe that a rigorous evaluation is as critical as the method itself in the ML robustness community. Regarding the contribution of the diffusion model, we modify the model logic into a truncated diffusion setting, where the input point clouds are added to additional Gaussian noise, and we further reverse it to clean point clouds. The goal of this study is not to propose new diffusion models and our framework is independent of the diffusion model used. For example, **IF-Defense and DUP-Net leveraged existing ConvONet [R1] and PU-Net [R2] for their pre-processing modules, but they failed to formulate adaptive attacks on their methods**. In contrast, we rigorously formulate adaptive attacks on diffusion models for point cloud recognition tasks, including two strong adversaries. We also ablated how different diffusion steps will contribute to the model robustness in Figure 3. Again, we believe that the reviewer is familiar with ML robustness research given the selected confidence score, so we really would like to emphasize that rigorous evaluation protocol is very critical in this area. 

We hope our answers address the reviewer's confusion, and we are more than happy to answer any questions. 

[R1] Songyou Peng, Michael Niemeyer, Lars Mescheder, Marc Pollefeys, and Andreas Geiger. Convolutional Occupancy Networks. In ECCV, 2020.

[R2] ] L. Yu, X. Li, C.-W. Fu, D. Cohen-Or, and P.-A. Heng. Punet: Point cloud upsampling network. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pages 2790–2799, 2018.

From: ICLR.cc/2023/Conference/Paper609/Reviewer_TFZv
title: Comparison with "Robust Structured Declarative Classifiers for 3D Point Clouds"
comment: Thanks for your clarification on evaluation on large-distortion adversarial point clouds. This does show better performance than SOTAs. 
However, I'm still wondering the performance against [1]. Does it outperform image based classifiers? 
Besides, I'll appreciate that if the authours can clarify the contribution of denoising diffusion models for point cloud adversarial classification. 


[1] Kaidong Li et al, Robust Structured Declarative Classifiers for 3D Point Clouds: Defending Adversarial Attacks with Implicit Gradients, CVPR22

From: ICLR.cc/2023/Conference/Paper609/Authors
title: Response to Reviewer TFZv (Part 3)
comment: **Attack with Larger Distortion** We have indeed leveraged a very large attack budget since $\epsilon = 0.1$ will affect the semantics of point clouds. However, to fulfill the request from the reviewer, we conduct additional experiments with $\epsilon = 0.075$ and $\epsilon = 0.1$,  where PointDP still achieves the strongest robustness.

| Robust Accuracy (%)  $\epsilon=0.075$ | PointNet | PointNet++ | DGCNN    | PCT      | CurveNet | PointMLP |
|---------------------|----------|------------|----------|----------|----------|----------|
| DUP-Net             | 0.5      | 0.3        | 0.0      | 0.2      | 0.2      | 0.6      |
| IF-Defense          | 60.7     | 67.3       | 47.2     | 40.9     | 39.8     | 50.9     |
| **PointDP**         | **73.9** | **73.6**   | **74.2** | **70.2** | **67.9** | **72.5** |

| Robust Accuracy (%) $\epsilon=0.1$ | PointNet | PointNet++ | DGCNN    | PCT      | CurveNet | PointMLP |
|---------------------|----------|------------|----------|----------|----------|----------|
| DUP-Net             | 0.0      | 0.0        | 0.0      | 0.2      | 0.1      | 0.3      |
| IF-Defense          | 53.9     | 57.1       | 42.0     | 35.1     | 33.3     | 44.7     |
| **PointDP**         | **67.3** | **62.4**   | **64.2** | **59.2** | **58.3** | **63.1** |

The robust accuracy for LPC is 27.8% and 19.1% for $\epsilon = 0.075$ and $\epsilon = 0.1$, respectively.

We would like to note that different from 2D images that can digest a relatively large amount of noise, 3D point clouds will quickly lose their semantics with $\epsilon$ increasing, as 3D point clouds do not have texture information. Point clouds with perturbations larger than $\epsilon=0.05$ are arguably not recognizable by human beings. We conduct a small user study among 10 people due to time and resource limits. 7 people among them chose $\epsilon=0.05$ as the borderline for human recognizability. The attack budgets chosen in our study are also confirmed in [R3], a peer-reviewed publication from NeurIPS21. The reason that LPC [R1] leveraged $\epsilon = 0.1$ is that the authors used FGSM, but FGSM is a **1-step** attack that cannot fully utilize the attack budget. In contrast, we use the **200-step** PGD attack. Therefore, we actually tried to evaluate the **worst-case** adversarial robustness of every method in our original manuscript with a large attack budget.  

Even with these extremely large distortions, PointDP achieves the strongest robustness, outperforming existing SOTA by a very large margin. We thank the reviewer again for the useful suggestion and will discuss this in our final version. We will also put the results in the supplementary materials. 

We will correct all the typos in our final version. We thank the reviewer again for the valuable suggestions to help us improve our manuscript, and our new results further consolidate the effectiveness of PointDP.

Based on the review, we believe the reviewer is familiar with ML robustness research, so we sincerely hope our response addresses all the comments from the reviewer and the reviewer will raise the rating accordingly. We are more than glad to answer any further questions.

[R1] Kaidong Li et al, Robust Structured Declarative Classifiers for 3D Point Clouds: Defending Adversarial Attacks with Implicit Gradients, CVPR22

[R2] DUP-Net: Denoiser and upsampler network for 3d adversarial point clouds defense, ICCV19

[R3] Adversarially Robust 3D Point Cloud Recognition Using Self-Supervisions, NeurIPS21

[R4] PointACL: Adversarial Contrastive Learning for Robust Point Clouds Representation under Adversarial Attack arXiv22

[R5] Carlini, Nicholas, et al. "On evaluating adversarial robustness." arXiv preprint arXiv:1902.06705 (2019).

[R6] Athalye, Anish, Nicholas Carlini, and David Wagner. "Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples." International conference on machine learning. PMLR, 2018.

[R7] Madry, Aleksander, et al. "Towards deep learning models resistant to adversarial attacks." arXiv preprint arXiv:1706.06083 (2017).

[R8] Sun, Jiachen, et al. "On adversarial robustness of 3d point cloud classification under adaptive attacks." BMVC21.

From: ICLR.cc/2023/Conference/Paper609/Authors
title: Response to Reviewer TFZv (Part 2)
comment: **Evaluation of DUP-Net [R2] and LPC [R1]**. We did compare our method with LPC [R1] in our paper. Please refer to Figure 2 in our paper where **LPC [R1] achieves the worst robustness under all attacks, even without adaptive adversaries**. Moreover, since LPC requires a specific model architecture, we cannot use LPC for different models like IF-Defense or PointDP. Therefore, we instead compare the average robust accuracy of IF-Defense and PointDP with LPC in Figure 2. We found several reasons that caused the mismatch between the claimed and actual robustness of LPC, after a careful investigation:
1. LPC used the FGSM attack as a major method, which is the most naive one-step attack. FGSM should not be used as evidence for robustness assessment, which has been clearly stated in [R5], a gold standard for 2D robustness assessment. We believe this argument is also valid for 3D robustness. 
2. LPC did not use PGD-based attacks to evaluate its robustness, which has been widely acknowledged as a universal first-order adversary [R7].
3. LPC did not use black-box attacks to evaluate its robustness, which is a strong method to cross-validate real robustness gain [R5]. 
4. LPC totally ignored the adaptive attack for all evaluations in its paper. The authors of LPC used one adaptive attack on DUP-Net to report the robustness of DUP-Net but did not try to formulate an adaptive attack on LPC.

We also mentioned DUP-Net [R2] in our paper (Section 1). It was **broken** by adaptive attacks [R8]. DUP-Net also ignored several parts of our proposed evaluation protocol. The robust accuracy of DUP-Net under adaptive attacks is **0%** [R8]. Additionally, we re-conduct the evaluation of DUP-Net under our experimental setting using $\ell_\infty$ norm with $\epsilon = 0.05$. The results are shown in the following table.

| Robust Accuracy (%) | PointNet | PointNet++ | DGCNN    | PCT      | CurveNet | PointMLP |
|---------------------|----------|------------|----------|----------|----------|----------|
| DUP-Net [R2]         | 0.0      | 1.3        | 0.9      | 0.9      | 0.6      | 1.0      |
| IF-Defense          | 66.4     | 73.2       | 52.9     | 46.8     | 45.3     | 55.7     |
| **PointDP**         | **80.8** | **80.7**   | **82.9** | **82.5** | **80.8** | **79.9** |

We find DUP-Net is vulnerable since the upsampler network is very sensitive to the  $\ell_\infty$ norm perturbations, and this finding aligns with the results in [R8].
These results further demonstrate that a rigorous evaluation protocol is highly desirable to pave the way for actual progress of ML robustness. Although it is impossible to exclude potential attacks for any defenses except for certified ones, we hope future defenses against adversarial point cloud will use our evaluation protocol and avoid being broken by trivial adaptive attacks.

From: ICLR.cc/2023/Conference/Paper609/Authors
title: Response to Reviewer TFZv (Part 1)
comment: We thank the reviewer for her/his constructive comments. We are glad that the reviewer finds that our method and experiments are clear. We answer each of the questions from the reviewer below. 

**Technical Contribution**. We would like to emphasize that the major contributions of this paper are two-fold:
1. We are the first to unveil that adversarial training, the most longstanding defense in the 2D domain, has a *major* limitation in its application in 3D point cloud recognition. We believe this is a novel and critical finding which will correct the direction of future robustness research in the 3D domain. Several existing works have followed the trend in the 2D space to use adversarial training to improve 3D robustness [R3, R4]. However, we have demonstrated that black-box adversaries could adaptively attack the adversarially trained model. 
2. PointDP is a general framework that is independent of the diffusion model used. We leverage a SOTA off-the-shelf diffusion model in our experiments. We highlight that the key to our framework is not the diffusion model itself but the rigorous formulation of the *adaptive attacks* and a *thorough analysis* of PointDP on its robustness for 3D point cloud recognition. Specifically, we use an augmented SDE process to model the gradient flow through the diffusion model for the BPDA [R6] attack and leverage the latent feature attack to further consolidate our evaluation. We extensively utilize 16 different attacks to verify the robustness of PointDP. Besides the proposal of PointDP, our study also presented a rigorous evaluation protocol for robustness assessment in 3D point cloud research. 
As the reviewer indicated, there are many existing purification methods (e.g., DUP-Net [R2] and LPC [R1]). However, we highlight that in adversarial robustness research, a **proper** way to evaluate the robustness of these methods is very important. Without a **proper** way of evaluation, it may distract the way toward actual robustness in this area. In this work, besides proposing the PointDP framework, we conduct a comprehensive evaluation of our method on white-box, black-box, and adaptive attacks, with both C&W- and PGD-styled objectives, followed by the suggestions from Dr. Nicholas Carlini, a top expert in the adversarial robustness community [R5]. Although IF-Defense considered adaptive attacks in its evaluation, we have shown that our PointDP consistently achieves stronger robustness than IF-Defense.

We agree with the reviewer that novelty is essential for ML robustness research, but correctness should be more critical. We have witnessed that many fancy methods in this area quickly fail under adaptive attacks [R6]. Therefore, we believe our contributions are solid and significant enough.

From: ICLR.cc/2023/Conference/Paper609/Authors
title: Response to Reviewer TVXV (Part 2)
comment: We agree with the reviewer that novelty is essential for ML robustness research, but correctness should be more critical. We have demonstrated that adversarial training is not suitable for point cloud recognition based on our comprehensive analysis. Denoising adversarial perturbations is also not a new concept, and there are many existing defense methods with either straightforward (e.g., DUP-Net [R2]) or complex (e.g., LPC [R1]) formulations. However, without a **proper** way of evaluation, it is distractive to report a surprisingly high robust accuracy under weak attacks to trick non-expert reviewers. Such numbers will also hinder the actual progress of research on ML robustness. As mentioned in the paper and multiple times by Dr. Nicholas Carlini, a top expert in the robustness community [R5, R6], a defense paper should evaluate its method on white-box, black-box, and adaptive attacks, with both C&W- and PGD-styled objectives. However,  DUP-Net and LPC overlooked the evaluation using adaptive or black-box attacks. Although IF-Defense considered adaptive attacks in its evaluation, we have shown that our PointDP consistently achieves stronger robustness than IF-Defense. 

All these results are concerning since they appeared in top-tier conferences but were easily adaptively attacked afterward, which further demonstrates the need for a rigorous evaluation protocol for 3D point cloud robustness research. We have witnessed that many fancy methods in this area quickly fail under adaptive attacks [R6]. Therefore, we believe our contributions are solid and significant enough.

We hope our response addresses the comments of the reviewer.  We will open-source our implementation to help and facilitate future research. We hope the reviewer will raise the rating, and we are more than glad to answer any further questions.  

[R1] Kaidong Li et al, Robust Structured Declarative Classifiers for 3D Point Clouds: Defending Adversarial Attacks with Implicit Gradients, CVPR22

[R2] DUP-Net: Denoiser and upsampler network for 3d adversarial point clouds defense, ICCV19

[R3] Adversarially Robust 3D Point Cloud Recognition Using Self-Supervisions, NeurIPS21

[R4] PointACL: Adversarial Contrastive Learning for Robust Point Clouds Representation under Adversarial Attack arXiv22

[R5] Carlini, Nicholas, et al. "On evaluating adversarial robustness." arXiv preprint arXiv:1902.06705 (2019).

[R6] Athalye, Anish, Nicholas Carlini, and David Wagner. "Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples." International conference on machine learning. PMLR, 2018.

[R7] S. Luo and W. Hu. Diffusion probabilistic models for 3d point cloud generation. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 2837–2845, 2021

From: ICLR.cc/2023/Conference/Paper609/Authors
title: Response to Reviewer TVXV (Part 1)
comment: We thank the reviewer for the constructive comments. We are glad that the reviewer finds our method effective with sufficient experiments and highly reproducible.
We would like to emphasize that the major contributions of this paper are **two-fold**:
1. We are the first to unveil that adversarial training, the most longstanding defense in the 2D domain, has a *major* limitation in its application in 3D point cloud recognition. We believe this is a novel and critical finding which will identify the potential direction of future robustness research in the 3D domain. Several existing works have followed the trend in the 2D space to use adversarial training to improve 3D robustness [R3, R4]. However, we have demonstrated that black-box adversaries could adaptively attack the adversarially trained model. 
2. PointDP is a general framework that is independent of the diffusion model used. We leverage a SOTA off-the-shelf diffusion model in our experiments. We highlight that the key to our framework is not the diffusion model itself but the rigorous formulation of the *adaptive attacks* and a *thorough analysis* of PointDP on its robustness for 3D point cloud recognition. For example, **IF-Defense and DUP-Net leveraged existing ConvONet and PU-Net for their pre-processing modules, but they failed to formulate adaptive attacks on their methods**.  In contrast, we rigorously formulate adaptive attacks on diffusion models for point cloud recognition tasks. Specifically, we use an augmented SDE process to model the gradient flow through the diffusion model for the BPDA [6] attack and leverage the latent feature attack to further consolidate our evaluation. We extensively utilize 16 different attacks to verify the robustness of PointDP. Besides the proposal of PointDP, our study also presented a rigorous evaluation protocol for robustness assessment in 3D point cloud research, including point-cloud-specific attacks like point adding and dropping adversaries. 

In this context, although we did not modify the diffusion model architecture in [R7] ([31] In the paper), the goals of the two studies are totally different. Specifically, we have adapted the inference logic to a truncated diffusion setting, where we first add Gaussian noise to the input adversarial point clouds and then restore the point cloud step by step. We also conducted a comprehensive analysis of how different diffusion steps will contribute to the adversarial robustness of the classification model. In contrast, the goal of [R7] is to conditionally generate new point clouds without robustness analysis. As the goal of our paper is not to propose new diffusion models but to demonstrate that diffusion models could achieve stronger robustness with rigorous research, we believe that our contributions are significant enough.

From: ICLR.cc/2023/Conference/Paper609/Authors
title: Response to Reviewer gbYk (Part 2)
comment: **PointDP with Certified Defense**. We thank the reviewer again for the careful review and suggestion. We indeed explored the combination of randomized smoothing (RS) and PointDP during our study. However, we find that the results are not good enough since the current diffusion models for 3D point clouds are not as good as the diffusion models in the 2D space. Diffusion models partially rely on the local texture correlations to restore or generate high-quality images step by step. However, point clouds do not consist of texture information. Therefore, it is more difficult for diffusion models to reconstruct a very high-quality point cloud, so the denoising performance of point cloud diffusion models is not as perfect as image diffusion models. 
Although the certified robustness improves with PointDP compared to the source-only method (whose certified robustness is 0), PointDP cannot beat Gaussian augmentation. We plot a figure of the certified accuracy and radius using DGCNN in the anonymous link: https://drive.google.com/file/d/16Vts4pWRM8gg6xxU0P2D0pQYe0iYasIl/view?usp=share_link

From the figure, we can see that the certified robustness of PointDP is slightly worse than Gaussian augmentation. We notice there is a very recent paper LION [R1] that leverages the idea of stable diffusion for the point cloud generation, where the SDE process happens in the latent feature space. The high-quality generation performance of LION provides us with opportunities to include certified defense into our framework. We will discuss this and leave it as future work.

We hope our response addresses the comments of the reviewer. From the review, we believe the reviewer is from the ML robustness community, and we have witnessed so many fancy methods quickly fail under adaptive attacks. As mentioned in our paper, a rigorous evaluation protocol is essential in ML robustness research. **Our codebase is included in the supplementary materials and we will open-source our full implementation after acceptance to help and facilitate future research.** 
We hope the reviewer will raise the rating, and we are more than glad to answer any further questions.  

[R1] LION: Latent Point Diffusion Models for 3D Shape Generation, NeurIPS22

From: ICLR.cc/2023/Conference/Paper609/Authors
title: Response to Reviewer gbYk (Part 1)
comment: We thank the reviewer for the constructive comments. We are glad that the reviewer finds our experiments comprehensive and that our codebase has been included in the supplementary material, which will be released and maintained after paper acceptance. We totally agree that a rigorous evaluation of existing and proposed defense solutions is essential to the real progress of the robustness community. We address every question from the reviewer below.

**Missing a Related Work of [1A]**. [1A] is indeed a pioneering work that studied the robustness of 3D point clouds in an adversarial setting, and it was our fault to overlook this paper. We will definitely change the incorrect recounting of the related work and add [1A] to our paper. 

[1A] proposed an ISO attack that iteratively drops the most salient points. This setting is very similar to the point-dropping (PD) adversary evaluated in our paper, which both leverage $\ell_0$ optimization to launch attacks. The difference is that [1A] leverages a heuristic way to determine critical points, but PD uses the gradient backpropagate to each point to select the critical points. The exact method in [1A] only works for PointNet because i) both [1A] and PointNet are relatively very first works in the area of 3D point cloud recognition, and ii) PointNet utilizes global max pooling so that only critical points will affect the prediction results. We evaluate ISO under PointNet; the results are shown in the table below.

| Robust Accuracy (%) | IF-Defense | **PointDP** |
|-----|------------|-------------|
| ISO [1A] | 67.3  | **70.1**    |
| PD  | 66.1       | **68.9**    |

We find that ISO is a weaker attack than PD as it by design restricts its attack capability (which is good for an attack paper). However, it cannot show the worst-case robustness of a defense proposal. We will definitely include [1A] in both related work and evaluation sections in our final camera-ready version.

**Computation Cost**. Training the diffusion model in PointDP does not cost much time and it is a one-time effort. We agree with the reviewer that one limitation of PointDP is the introduction of additional computation during the inferent time. We use an RTX3080 GPU to benchmark the cost of the preprocessing module. 

|          | DUP-Net | IF-Defense | **PointDP** |
|----------|---------|------------|-------------|
| Time (seconds) | 1.33    | 2.60       | **0.097**    |

The results are averaged from 100 runs using a batch size of 32. Although PointDP introduces additional 0.097 seconds, we demonstrate that PointDP achieves both the strongest robustness with **the most negligible computation cost** than existing SOTA methods, which is a **27x** speed-up than IF-Defense. It is hard to quantify the quality of purification, and the results shown in Figure 3 evidently indicate that the quality of denoised point clouds improves with the number of steps increases, and converges at around 30 steps. Our benchmarking shows that each diffusion step contributes around 0.0032 seconds of latency to the inference. These results demonstrate that though PointDP is lightweight, there is a trade-off between robustness and cost. We will include the results in our paper and discuss this limitation accordingly. We will also include all the results of the zero robust accuracies of the unprotected models in the appendix.

From: ICLR.cc/2023/Conference/Paper609/Authors
title: Response to Reviewer PNfK
comment: We thank the reviewer for the constructive comments. We are glad that the reviewer finds our analysis of adversarial training and PointDP comprehensive and useful. 

During training, the diffusion model is enforced to learn the added Gaussian noise (Equation 1 in our paper). The reverse (inference) procedure of diffusion models essentially predicts the Gaussian noise step by step and removes the predicted noise from the input to restore the original point cloud. Therefore, the diffusion model requires the perturbation to be (near) the Gaussian distribution, but the adversarial perturbation does not essentially follow the Gaussian distribution. By adding Gaussian noise on top of the adversarial point clouds, we can mathematically ensure that the overall perturbation drift towards the Gaussian distribution, followed by Theorem 3.1 in [36], fulfilling the requirement for the diffusion model to perform better.

Since the reviewer is self-identified as a non-expert in ML robustness, we also would like to kindly note that there are many existing works that proposed fancy defense solutions but fail quickly under adaptive attacks in the 2D space [2,5]. As robustness research for 3D point clouds is a relatively new topic, the same thing happened. We found that most existing defenses that appeared in top-tier conferences fail to provide real robustness. Those papers tried to report high robust accuracy under weak attacks to trick non-expert reviewers, which will hinder the real progress of robustness research in this area. Therefore, It is crucial to have a rigorous evaluation protocol for the correct evaluation in this area. Besides the proposal of PointDP, we also present a rigorous evaluation protocol for point cloud robustness assessment. 

We thank the reviewer consider our method novel and effective and hope the reviewer raises the rating. We are more than glad to answer any future questions.

From: ICLR.cc/2023/Conference/Paper609/Reviewer_PNfK
confidence: 2: You are willing to defend your assessment, but it is quite likely that you did not understand the central parts of the submission or that you are unfamiliar with some pieces of related work. Math/other details were not carefully checked.
summary_of_the_paper: This paper proposes PointDP, an adversarial purification method that leverages a diffusion model as a pre-processing module to defend against 3D adversary attacks for point clouds.  PointDP consists of two components (1) an off-the-shelf 3D point cloud diffusion model and (2) a classifier. Given an input point cloud, PointDP takes the following steps: (i) adding noise to the input data gradually via the diffusion process of the diffusion model, (ii) purifying the noised data step by step to get the reversed sample via the reverse process of a diffusion model, and (iii) feeding the reversed sample to the final classifier. Since PointDP does not rely on any types of pre-defined adversarial examples for training, it can defend against diverse unseen threats.

This paper also revisits the existing works via designing various types of strong adaptive attacks. It demonstrates that standard adversarial training suffers from gradient obfuscation in the point cloud recognition models as the unstructured point cloud data format requires unique architectural designs to digest.

The authors evaluate PointDP with multiple representative point cloud models and sixteen attacks and show significant improvement over existing state-of-the-art methods.
strength_and_weaknesses: +: The paper demonstrates that standard adversarial training has a major limitation in its application in 3D point cloud models due to architecture designs.
+: The proposed PointDP method leverages diffusion models to purify adversarial 3D point clouds. 
+: Experiments on six representative models show that PointDP outperforms previous state-of-the-art purification methods by a large margin.


clarity,_quality,_novelty_and_reproducibility: The paper is generally well-written and easier to read. It could benefit from more rationale and background to make it easier for a non-expert like the reviewer. For example, why we first add noise and then remove them?
summary_of_the_review: Overall the paper has shown good results using the diffusion method for adversial attack defense for 3D point clouds. I am not an expert in this area but do believe this should be considered novel.
correctness: 4: All of the claims and statements are well-supported and correct.
technical_novelty_and_significance: 3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.
empirical_novelty_and_significance: 2: The contributions are only marginally significant or novel.
flag_for_ethics_review: NO.
recommendation: 6: marginally above the acceptance threshold

From: ICLR.cc/2023/Conference/Paper609/Reviewer_gbYk
confidence: 3: You are fairly confident in your assessment. It is possible that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work. Math/other details were not carefully checked.
summary_of_the_paper: In this work the authors propose to use denoting diffusion models in order to aid in robustness against adversarial examples for neural networks trained on point-cloud data. The paper is very similar to what has recently been produced for 2D images in [7, 36] (using the paper’s citation numbering). The underlying principle of the work is sound and the primary contribution of this paper appears to be applying the same framework to 3D point cloud inputs. As a secondary contribution, the authors discuss how gradient obfuscation makes standard adversarial training less effective due to the intractability of computing strong white-box adversarial examples for point cloud networks. Thus, the authors argue (and empirically show) that their diffusion-driven purification is a better alternative. One question that could be interesting for future study is if one can design an adversarial example such that the purification method fails (due to poor performance of the diffusion model) but this is outside of the scope of the current work. Modulo some errors and omissions in presentation I found this paper nicely written and think it has an interesting contribution.
strength_and_weaknesses: Strengths:

The paper is well-written. Specifically the exposition on denoising diffusion models is clear and concise. Another primary strength of this paper is the experimental evaluation which is comprehensive. Hopefully the authors release their code as I am sure open implementation of 16 different attacks on point clouds would serve as a good resource to the community. 

Weaknesses:

One odd weakness of this work is the incorrect recounting of related work for attacks on point cloud models. The first attacks on point cloud models dates to roughly 3 years prior to the work the authors claim is the first. It is my understanding that [1A] was the first to demonstrate the vulnerability of neural networks on 3D data. This ought to be corrected in the related works of this paper. In addition the method of [1A], though very simplistic, has been shown to work very well in a black-box setting and even the white-box attack does not require gradients so this would be interesting to see how this plays into the gradient obfuscation argument given in this paper. 

Another odd weakness of this work is the lack of reporting on the computational cost of training the denoising delusion model. Though I am not an expert, this seems like a very costly training that must be done. In addition, ablations on the quality of the purification would be interesting. The authors provide Figure 3 which I find very interesting and think that a better understanding of what makes a good purification model and what leads to a poor purification model would strengthen the contribution of the paper. That being said, the experiments of this paper are extensive and comprehensive so such ablations are not required for a convincing study. In addition, the authors state in table 1 that models mostly have 0% robustness and while I understand that these are not reported in the main text, they ought to be fully reported in the appendix on submission for completion. 

Another place I think the paper could have been strengthened, and I am curious about why the authors choose not to perform this step, is that in [7] the authors show that diffusion-driven purification can easily be used to get certifications of model robustness. Is such an approach not computationally feasible in this setting or was it just not explored?


[1A] - https://openaccess.thecvf.com/content_CVPR_2019/papers/Wicker_Robustness_of_3D_Deep_Learning_in_an_Adversarial_Setting_CVPR_2019_paper.pdf
clarity,_quality,_novelty_and_reproducibility: The paper is clear, relatively novel, and mostly reproducible. I do not see the full details for reproducing the diffusion architecture, so I would urge the authors to declare what portions of the source code will be made open source if the paper is accepted.
summary_of_the_review: Overall, though the technical contribution is not wholly novel, I find the experimental analysis convincing and think it makes a strong empirical contribution that is of interest. There are omissions that need to be corrected and the authors should add in their rebuttal exactly what will be made open source. 
correctness: 4: All of the claims and statements are well-supported and correct.
technical_novelty_and_significance: 2: The contributions are only marginally significant or novel.
empirical_novelty_and_significance: 3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.
flag_for_ethics_review: NO.
details_of_ethics_concerns: None found.
recommendation: 8: accept, good paper

From: ICLR.cc/2023/Conference/Paper609/Reviewer_TVXV
confidence: 3: You are fairly confident in your assessment. It is possible that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work. Math/other details were not carefully checked.
summary_of_the_paper: The authors propose a simple but effective model, named PointDP, which leverages diffusion models to defend against 3D adversarial attacks. The experimental results show that PointDP achieves significantly better adversarial robustness than state-of-the-art methods.
strength_and_weaknesses: **Strengths**
- The paper is clearly written.
- The proposed method is simple and effective.


**Weaknesses**
- The technical contributions of PointDP over the diffusion model should be clearly demonstrated. Otherwise, the proposed method could be regarded as an application of the diffusion model in denoising.
- The differences between the diffusion model in PointDP and [31] should be discussed.
clarity,_quality,_novelty_and_reproducibility: - The paper is clearly written and with sufficient experiments.
- The novelty should be evaluated after the rebuttal. It is not clear how many differences between the proposed method and [31].
- The authors provide the supplementary material and the work is thus highly reproducible.
summary_of_the_review: The authors propose a simple but effective method to defend against 3D adversarial attacks. But the technical contributions are not clear. I will change my rating if the authors compare the diffusion model more closely.
correctness: 3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.
technical_novelty_and_significance: 2: The contributions are only marginally significant or novel.
empirical_novelty_and_significance: 2: The contributions are only marginally significant or novel.
flag_for_ethics_review: NO.
recommendation: 5: marginally below the acceptance threshold

From: ICLR.cc/2023/Conference/Paper609/Reviewer_TFZv
confidence: 4: You are confident in your assessment, but not absolutely certain. It is unlikely, but not impossible, that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work.
summary_of_the_paper: In this work, the authors propose a pretraining diffusion model for defending against 3D adversarial point clouds. They also shows the limitation of robust training for defense due to gradient obfuscation. The results have shown better qualitative performance than SOTA methods. 
strength_and_weaknesses: Pros: 
+) The idea is clear and easy to follow. They show that adversarial training does not work well on 3D point cloud recognition task. 
+) They deploy diffusion model for recovering/purifying 3D point clouds, which further increase the correct detection ability. 

Cons:
-) The methodology is straightford with limited technical contributions.
-) Diffusion model itself is a powerful generative model, capable of denoising. Limited novelty on technical contribution on purifying adversarial 3D point clouds. The authors are suggested to clarify their contributions. 
-) A lot of missing experiments, e.g. [1, 2]. It is suggested to clarify the advantage of the method with more experimental results. 
-) Missing evaluations on larger distortions, e.g. perturbation is 0.1. 
-) typo error: P3: Donget al.->Dong et al.

[1] Kaidong Li et al, Robust Structured Declarative Classifiers for 3D Point Clouds: Defending Adversarial Attacks with Implicit Gradients, CVPR22
[2] Hang Zhou et al, DUP-Net: Denoiser and upsampler network for 3d adversarial point clouds defense, ICCV19
clarity,_quality,_novelty_and_reproducibility: +) The paper is well written.
+) The idea and experiments are clear.
+) The first diffusion model based 3D adversarial point cloud defense. 
summary_of_the_review: The paper has shown potential of deploying diffusion model for 3D adversarial point cloud defense. The major problem is the lack of novely on designing their diffusion models, as well as experiments on the recent works. Therefore, it is difficult to justify their performance improvements.
correctness: 3: Some of the paper’s claims have minor issues. A few statements are not well-supported, or require small changes to be made correct.
technical_novelty_and_significance: 3: The contributions are significant and somewhat new. Aspects of the contributions exist in prior work.
empirical_novelty_and_significance: 2: The contributions are only marginally significant or novel.
flag_for_ethics_review: Yes, Privacy, security and safety
details_of_ethics_concerns: N/A
recommendation: 5: marginally below the acceptance threshold