Point cloud completion, as the upstream procedure of 3D recognition and segmentation, has become an essential part of many tasks such as navigation and scene understanding. While various point cloud completion models have demonstrated their powerful capabilities, their robustness against adversarial attacks, which have been proven to be fatally malicious towards deep neural networks, remains unknown. In addition, existing attack approaches towards point cloud classifiers cannot be applied to the completion models due to different output forms and attack purposes. In order to evaluate the robustness of the completion models, we propose PointCA, the first adversarial attack against 3D point cloud completion models. PointCA can generate adversarial point clouds that maintain high similarity with the original ones, while being completed as another object with totally different semantic information. Specifically, we minimize the representation discrepancy between the adversarial example and the target point set to jointly explore the adversarial point clouds in the geometry space and the feature space. Furthermore, to launch a stealthier attack, we innovatively employ the neighbourhood density information to tailor the perturbation constraint, leading to geometry-aware and distribution-adaptive modifications for each point. Extensive experiments against different premier point cloud completion networks show that PointCA can cause a performance degradation from 77.9% to 16.7%, with the structure chamfer distance kept below 0.01. We conclude that existing completion models are severely vulnerable to adversarial examples, and state-of-the-art defenses for point cloud classification will be partially invalid when applied to incomplete and uneven point cloud data.
翻译:3D 识别和分割的上游程序,即3D 识别和分割的上游程序,完成点云是许多任务的基本组成部分,例如导航和场景理解。虽然各种点云完成模型已经展示出它们的强大能力,但它们对付对抗性攻击的强大性能仍然不为人知。此外,由于不同的产出形式和攻击目的,对点云分类的现有攻击方法无法适用于完成模型。为了评价完成模型的稳健性,我们提议PointCA,这是对3D 点云完成模型的第一次对抗性攻击。PointCA可以产生对抗性点云云,与最初的云高度相似,而作为另一个目标完成时则有完全不同的语义信息。具体地说,我们尽量缩小对敌性例子与联合探索几何空间和地貌空间的对抗性云层云层分级之间的代表差异。此外,为了发起更隐性的攻击,我们创新地利用邻的密度信息来调整不完全性的扰动性限制,从而导致对最初的云层和分布性调整,同时作为另一个目标完成点的另一种对象。我们进行了广泛的实验,77CA 完成点的现有数据网络将得出一个部分的完成点为16号。