Deep Neural Networks (DNNs) for 3D point cloud recognition are vulnerable to
adversarial examples, threatening their practical deployment. Despite the many
research endeavors have been made to tackle this issue in recent years, the
diversity of adversarial examples on 3D point clouds makes them more
challenging to defend against than those on 2D images. For examples, attackers
can generate adversarial examples by adding, shifting, or removing points.
Consequently, existing defense strategies are hard to counter unseen point
cloud adversarial examples. In this paper, we first establish a comprehensive,
and rigorous point cloud adversarial robustness benchmark to evaluate
adversarial robustness, which can provide a detailed understanding of the
effects of the defense and attack methods. We then collect existing defense
tricks in point cloud adversarial defenses and then perform extensive and
systematic experiments to identify an effective combination of these tricks.
Furthermore, we propose a hybrid training augmentation methods that consider
various types of point cloud adversarial examples to adversarial training,
significantly improving the adversarial robustness. By combining these tricks,
we construct a more robust defense framework achieving an average accuracy of
83.45\% against various attacks, demonstrating its capability to enabling
robust learners. Our codebase are open-sourced on:
https://github.com/qiufan319/benchmark_pc_attack.git.

我们建立了一个全面、严格的点云对抗韧性基准，评估了韧性的影响，并通过对现有的防御方法进行广泛和系统的实验，提出了一种混合训练增强方法以提高对各种攻击的对抗韧性。

鲁棒点云识别的基准测试与分析：防御对抗样本的诀窍

Benchmarking and Analyzing Robust Point Cloud Recognition: Bag of Tricks  for Defending Adversarial Examples

Adversary and invisibility are two fundamental but conflict characters of
adversarial perturbations. Previous adversarial attacks on 3D point cloud
recognition have often been criticized for their noticeable point outliers,
since they just involve an "implicit constrain" like global distance loss in
the time-consuming optimization to limit the generated noise. While point cloud
is a highly structured data format, it is hard to constrain its perturbation
with a simple loss or metric properly. In this paper, we propose a novel
Point-Cloud Sensitivity Map to boost both the efficiency and imperceptibility
of point perturbations. This map reveals the vulnerability of point cloud
recognition models when encountering shape-invariant adversarial noises. These
noises are designed along the shape surface with an "explicit constrain"
instead of extra distance loss. Specifically, we first apply a reversible
coordinate transformation on each point of the point cloud input, to reduce one
degree of point freedom and limit its movement on the tangent plane. Then we
calculate the best attacking direction with the gradients of the transformed
point cloud obtained on the white-box model. Finally we assign each point with
a non-negative score to construct the sensitivity map, which benefits both
white-box adversarial invisibility and black-box query-efficiency extended in
our work. Extensive evaluations prove that our method can achieve the superior
performance on various point cloud recognition models, with its satisfying
adversarial imperceptibility and strong resistance to different point cloud
defense settings. Our code is available at: this https URL

本文提出了一种新的点云灵敏度映射方法，以明确表明点云识别模型在遇到形状不变的对抗噪声时的脆弱性并提高噪声的效率和隐蔽性，该方法在各种点云识别模型中表现出优异的性能并具有令人满意的对抗隐身性和对不同点云防御设置的强抵抗力。

形状不变的 3D 敌对点云

Shape-invariant 3D Adversarial Point Clouds

Recent deep learning architectures can recognize instances of 3D point cloud
objects of previously seen classes quite well. At the same time, current 3D
depth camera technology allows generating/segmenting a large amount of 3D point
cloud objects from an arbitrary scene, for which there is no previously seen
training data. A challenge for a 3D point cloud recognition system is, then, to
classify objects from new, unseen, classes. This issue can be resolved by
adopting a zero-shot learning (ZSL) approach for 3D data, similar to the 2D
image version of the same problem. ZSL attempts to classify unseen objects by
comparing semantic information (attribute/word vector) of seen and unseen
classes. Here, we adapt several recent 3D point cloud recognition systems to
the ZSL setting with some changes to their architectures. To the best of our
knowledge, this is the first attempt to classify unseen 3D point cloud objects
in the ZSL setting. A standard protocol (which includes the choice of datasets
and the seen/unseen split) to evaluate such systems is also proposed. Baseline
performances are reported using the new protocol on the investigated models.
This investigation throws a new challenge to the 3D point cloud recognition
community that may instigate numerous future works.

本文提出使用零样本学习方法（ZSL）对未见过的三维点云进行分类，并根据新方案对模型进行基础测试，从而为三维点云识别领域带来新的挑战。