This paper presents a robust fine-tuning method designed for pre-trained 3D
point cloud models, to enhance feature robustness in downstream fine-tuned
models. We highlight the limitations of current fine-tuning methods and the
challenges of learning robust models. The proposed method, named Weight-Space
Ensembles for Fine-Tuning then Linear Probing (WiSE-FT-LP), integrates the
original pre-training and fine-tuning models through weight space integration
followed by Linear Probing. This approach significantly enhances the
performance of downstream fine-tuned models under distribution shifts,
improving feature robustness while maintaining high performance on the target
distribution. We apply this robust fine-tuning method to mainstream 3D point
cloud pre-trained models and evaluate the quality of model parameters and the
degradation of downstream task performance. Experimental results demonstrate
the effectiveness of WiSE-FT-LP in enhancing model robustness, effectively
balancing downstream task performance and model feature robustness without
altering the model structures.

该论文提出了一种针对预训练的 3D 点云模型的鲁棒微调方法，以增强下游微调模型中的特征鲁棒性。通过权重空间集成和线性探测相结合的方法，该方法显著提高了下游微调模型在分布变化情况下的性能，同时在目标分布上保持高性能，以提高特征鲁棒性。将这种鲁棒微调方法应用于主流的 3D 点云预训练模型，并评估模型参数的质量和下游任务性能的降低。实验结果表明，WiSE-FT-LP 方法有效提升了模型的鲁棒性，有效平衡了下游任务性能和模型特征的鲁棒性，而不改变模型结构。

预训练的 3D 点云模型的稳健微调

Robust Fine-tuning for Pre-trained 3D Point Cloud Models

With the maturity of depth sensors, the vulnerability of 3D point cloud
models has received increasing attention in various applications such as
autonomous driving and robot navigation. Previous 3D adversarial attackers
either follow the white-box setting to iteratively update the coordinate
perturbations based on gradients, or utilize the output model logits to
estimate noisy gradients in the black-box setting. However, these attack
methods are hard to be deployed in real-world scenarios since realistic 3D
applications will not share any model details to users. Therefore, we explore a
more challenging yet practical 3D attack setting, \textit{i.e.}, attacking
point clouds with black-box hard labels, in which the attacker can only have
access to the prediction label of the input. To tackle this setting, we propose
a novel 3D attack method, termed \textbf{3D} \textbf{H}ard-label
att\textbf{acker} (\textbf{3DHacker}), based on the developed decision boundary
algorithm to generate adversarial samples solely with the knowledge of class
labels. Specifically, to construct the class-aware model decision boundary,
3DHacker first randomly fuses two point clouds of different classes in the
spectral domain to craft their intermediate sample with high imperceptibility,
then projects it onto the decision boundary via binary search. To restrict the
final perturbation size, 3DHacker further introduces an iterative optimization
strategy to move the intermediate sample along the decision boundary for
generating adversarial point clouds with smallest trivial perturbations.
Extensive evaluations show that, even in the challenging hard-label setting,
3DHacker still competitively outperforms existing 3D attacks regarding the
attack performance as well as adversary quality.

利用黑盒难标签攻击 3D 点云模型的 3D Hard-label attacker (3DHacker)，通过发展的决策边界算法仅凭类别标签生成对抗样本，有效地攻击性能和对手质量优于现有的 3D 攻击方法。

3DHacker：基于谱的决策边界生成技术，用于硬标签 3D 点云攻击

3DHacker: Spectrum-based Decision Boundary Generation for Hard-label 3D  Point Cloud Attack

The use of deep 3D point cloud models in safety-critical applications, such
as autonomous driving, dictates the need to certify the robustness of these
models to real-world transformations. This is technically challenging, as it
requires a scalable verifier tailored to point cloud models that handles a wide
range of semantic 3D transformations. In this work, we address this challenge
and introduce 3DCertify, the first verifier able to certify the robustness of
point cloud models. 3DCertify is based on two key insights: (i) a generic
relaxation based on first-order Taylor approximations, applicable to any
differentiable transformation, and (ii) a precise relaxation for global feature
pooling, which is more complex than pointwise activations (e.g., ReLU or
sigmoid) but commonly employed in point cloud models. We demonstrate the
effectiveness of 3DCertify by performing an extensive evaluation on a wide
range of 3D transformations (e.g., rotation, twisting) for both classification
and part segmentation tasks. For example, we can certify robustness against
rotations by $\pm$60{\deg} for 95.7% of point clouds, and our max pool
relaxation increases certification by up to 15.6%.

本研究介绍了第一个能够认证点云模型鲁棒性的验证器 3DCertify，通过对旋转、扭曲等多种 3D 变换进行广泛的评估，证明了其有效性。