Machine learning models have been shown to be vulnerable to adversarial
examples. While most of the existing methods for adversarial attack and defense
work on the 2D image domain, a few recent attempts have been made to extend
them to 3D point cloud data. However, adversarial results obtained by these
methods typically contain point outliers, which are both noticeable and easy to
defend against using the simple techniques of outlier removal. Motivated by the
different mechanisms by which humans perceive 2D images and 3D shapes, in this
paper we propose the new design of \emph{geometry-aware objectives}, whose
solutions favor (the discrete versions of) the desired surface properties of
smoothness and fairness. To generate adversarial point clouds, we use a
targeted attack misclassification loss that supports continuous pursuit of
increasingly malicious signals. Regularizing the targeted attack loss with our
proposed geometry-aware objectives results in our proposed method,
Geometry-Aware Adversarial Attack ($GeoA^3$). The results of $GeoA^3$ tend to
be more harmful, arguably harder to defend against, and of the key adversarial
characterization of being imperceptible to humans. While the main focus of this
paper is to learn to generate adversarial point clouds, we also present a
simple but effective algorithm termed $Geo_{+}A^3$-IterNormPro, with Iterative
Normal Projection (IterNorPro) that solves a new objective function
$Geo_{+}A^3$, towards surface-level adversarial attacks via generation of
adversarial point clouds. We quantitatively evaluate our methods on both
synthetic and physical objects in terms of attack success rate and geometric
regularity. For a qualitative evaluation, we conduct subjective studies by
collecting human preferences from Amazon Mechanical Turk. Comparative results
in comprehensive experiments confirm the advantages of our proposed methods.

本文提出新的 geometry-aware objectives 的设计，生成的 $GeoA^3$ 对人类来说是无法察觉的，同时提出一个名为 $Geo_{+} A^3$-IterNormPro 的算法，该算法通过生成对抗性点云来实现面向表面的对抗性攻击。