Multi-Restricted Point Cloud Adversarial Attack based on Sensitivity Maps

The point cloud classification networks have been widely applied in 3D Reconstruction and Remote Sensing. The backbone of these networks is often implemented based on Deep Neural Networks (DNNs). Currently, a series of studies confirm that DNNs are vulnerable and susceptible to interference from adversarial samples. The existing strategies for attack and defense are primarily focused on the image domain. Due to the unordered and unstructured nature of point clouds, there has been limited research on attack algorithms for point clouds. Current black-box transferable attack algorithms face a challenge in balancing adversary and imperceptibility. They often lead to either a low Attack Success Rate (ASR) or the emergence of significant outlier points, which can be removed by Statistical Outlier Removal (SOR) methods easily. Inspired by principles from attack algorithm in image domain, this article introduces a novel approach. After extensive evaluation on several mainstream recognition models (such as
$\text{PointNet}++$
and DGCNN), we have demonstrated that our black-box transferable attack method achieves state-of-the-art performance. To the best of our knowledge, we are the first to propose a point cloud black box transferable attack algorithm based on improved MI-FGSM.