Point cloud deep neural network migration attack method based on central axis transformation

Abstract

The invention relates to the field of machine learning, and provides a point cloud deep neural network migration attack method based on central axis transformation, comprising the following steps: S10: inputting a to-be-attacked point cloud sample into an encoder to extract a skeleton ball; s20, inputting the skeleton ball of the to-be-attacked point cloud sample into a decoder, initializing surface point coordinates of the to-be-attacked point cloud sample, and calculating initialized surface point feature reconstruction point cloud according to a distance relationship between the initialized surface point coordinates and the skeleton ball; and S30, inputting the reconstructed point cloud into the proxy classification model, optimizing the skeleton ball of the reconstructed point cloud, and reconstructing through a decoder to generate a confrontation point cloud. According to the method, the internal features of the to-be-attacked point cloud sample are extracted based on the point cloud axis transformation, the adversarial point cloud is generated for the features, and the mobility of the adversarial point cloud on different classification models is improved.

Description

Technical Field

[0001] The present invention belongs to the field of machine learning, and in particular relates to a point cloud deep neural network migration attack method based on medial axis transformation. Background Art

[0002] The transfer attack method is a common and practical method in black-box adversarial attacks. Its basic implementation method is to use a gradient-based or optimization-based white-box adversarial attack method on a proxy deep learning model to attack clean samples, generate adversarial point clouds that can make the proxy model results wrong, and finally use these adversarial point clouds to attack the victim target model. However, using only ordinary white-box adversarial attack methods for transfer attacks often has poor results.

[0003] With the development of adversarial attack and defense, people are paying more and more attention to the improvement of the transferability of adversarial attacks in the field of point clouds. Similar to the field of images, the improvement of the transferability of adversarial attacks in the field of point clouds is also mainly achieved by (1) using data augmentation methods; (2) improving optimization techniques; (3) improving loss function design; and (4) improving model components. Focusing on these directions, Hamdi et al. proposed a transferability-enhanced attack method AdvPC, which iteratively updates the adversarial point cloud by simultaneously calculating the gradients of the unreconstructed point cloud and the point cloud reconstructed by the autoencoder. By introducing the autoencoder, it avoids overfitting of the proxy model and puts higher requirements on the adversarial resistance of the adversarial point cloud. Liu et al. proposed a frequency-domain-based point cloud adversarial attack method, in which they divided the point cloud into low-frequency components and high-frequency components using graph Fourier transform, and applied perturbations to the low-frequency components to create adversarial point clouds, thereby improving transferability. He et al. observed that the adversarial perturbation of the point cloud can be randomly decomposed into two sub-perturbations containing useful information, and simultaneously considered the influence of the perturbation and its sub-perturbations to improve transferability.

[0004] However, although the existing adversarial point cloud transfer enhancement technologies for point clouds have successfully achieved improvements by using methods similar to those in the image field, they have not deeply considered the difference between point cloud data and image data, which is the fundamental reason that limits their insufficient transferability. Images are structured data, and deep models can extract features from the color or grayscale value of local pixels. For point clouds, which are unstructured and usually colorless data, deep models often extract features that represent shapes. However, the shape features extracted by the proxy model often include two types: essential features and noise features, and the adversarial point clouds generated based on noise features often have poor transferability. Previous work did not consider the essential features of the shape. During the iterative process of the adversarial attack, the introduction of noise features caused overfitting of the proxy model, resulting in insufficient transferability.

[0005] Specifically, existing point cloud classification models often capture some imperceptible noise features when extracting features. These noise features participate in the final classification decision together with the intrinsic features of the object. However, since these noise features are model-specific, adversarial point clouds tend to exploit these specific noise features during the generation process, resulting in poor migration of adversarial point clouds to other models. This phenomenon of over-reliance on model-specific noise features severely limits the migration ability of adversarial point clouds, making it difficult for existing adversarial attack methods to cope with the defense of different models in practical applications. Summary of the invention

[0006] In view of the above-mentioned defects of the prior art, the present invention proposes a point cloud deep neural network migration attack method based on medial axis transformation, which extracts the intrinsic features of the point cloud based on the medial axis transformation, generates an adversarial point cloud based on the features, and aims to improve the migration of the adversarial point cloud on different classification models. The technical solution steps designed by the present invention include:

[0007] S10: Input the point cloud sample to be attacked into the encoder to extract the skeleton ball;

[0008] S20: Inputting the skeleton ball of the point cloud sample to be attacked into a decoder, initializing the surface point coordinates of the point cloud sample to be attacked, and calculating the initialized surface point features to reconstruct the point cloud according to the distance relationship between the initialized surface point coordinates and the skeleton ball;

[0009] S30: Inputting the reconstructed point cloud into the proxy classification model, optimizing the skeleton sphere of the reconstructed point cloud, and reconstructing the adversarial point cloud through the decoder.

[0010] Preferably, the skeleton sphere in S10 includes sphere center coordinates, skeleton sphere radius and sphere center point features.

[0011] Preferably, the S10 includes:

[0012] Given K point cloud samples to be attacked represented by three-dimensional coordinate points Input Point2Skeleton encoder to extract N skeleton balls The encoder formula is as follows:

[0013] C, R, F=ENC(P)

[0014] In the formula, are the coordinates of the sphere center, is the radius of the skeleton sphere, F N×D is the sphere center feature, D is the feature dimension, and ENC is the encoder input function.

[0015] Preferably, before inputting the point cloud samples to be attacked into the encoder in S10, the step further includes normalizing and down-sampling the point cloud samples to be attacked.

[0016] Preferably, the initializing the surface point coordinates of the point cloud sample to be attacked in S20 includes:

[0017] The skeleton sphere of the point cloud sample to be attacked is given eight unit vectors V = {(±η,±η,±η), 3η 2 =1, initialize eight surface points, the initialized surface points are Ti=ci+r(ci)V.

[0018] Preferably, the step of calculating the initialized surface point features and reconstructing the point cloud according to the distance relationship between the initialized surface point coordinates and the skeleton sphere in S20 includes:

[0019] For the jth initialized surface point t j , calculate the initial surface point t j The features of the surface point t are initialized by calculation j The features of all initialized surface points are obtained by M is the number of initialized surface points, and a series of fully connected layers are used to generate features corresponding to all initialized surface points. Reconstructing point clouds

[0020] Preferably, the calculation of the initialization surface point t j The formula for the characteristics of is as follows:

[0021]

[0022] Where c1, c2, c3 are the surface points t j The three nearest skeleton ball centers, w i (t j )=1 / d(t j ,c i ) is the center point of the i-th skeleton ball and the surface point t j The reciprocal of the Euclidean distance between feature(c i ) is the center point c i characteristics.

[0023] Preferably, the decoder in S20 is composed of a multi-layer perceptron, and the loss function L in the training phase is rec Including the chamfer distance L CD and k nearest neighbor loss L knn constitute;

[0024] The loss function L rec The calculation formula is as follows:

[0025] L rec (P,P rec )=L CD (P,P rec )+αL knn (P rec )

[0026] Where P is the point cloud sample to be attacked, P rec is the reconstructed point cloud, and α is the constraint strength for controlling uniformity.

[0027] Preferably, the chamfer distance L CD and k nearest neighbor loss L knn The calculation formula is as follows:

[0028]

[0029] Preferably, the S30 includes:

[0030] The reconstructed point cloud P rec Input into the proxy classification model and calculate the logits output Z(P adv ), based on Z(P adv ) Use the gradient descent method to iteratively optimize the perturbation of the skeleton ball's center coordinates δ C and the radius perturbation δ R , the decoder reconstructs the generated adversarial point cloud;

[0031] The coordinate perturbation δ of the center of the skeleton sphere is C and the radius perturbation δ R The optimization formula is as follows:

[0032]

[0033] Where P adv is the adversarial point cloud, f(·) is the proxy model, κ is the parameter that controls the attack confidence, β is the hyperparameter, and y' represents the attack target.

[0034] Beneficial effects:

[0035] 1. This method effectively improves the mobility of adversarial point clouds. The adversarial point clouds generated by the present invention have stronger migration capabilities in different point cloud classification models and can effectively attack multiple different models instead of being limited to a single model. Through skeleton extraction based on medial axis transformation, the center coordinates and radius of the skeleton sphere are used as core features for attack, so that the generated adversarial point clouds pay more attention to the intrinsic structural features of the point clouds, thereby improving their mobility on different models;

[0036] 2. The decoder in the present invention is specially designed to process point cloud skeleton features. During the reconstruction process, the global geometric features obtained by the medial axis transformation are mapped back to the point cloud, thereby elevating the adversarial perturbation from the low-level point level to the high-level geometric shape level. The decoder decouples the geometric structure and noise characteristics of the point cloud, so that the adversarial point cloud can be adjusted and optimized in a more essential geometric feature space. This design reduces the dependence on specific proxy models, and the generated adversarial point cloud is more dependent on geometric shape features, so that the attack effect can be maintained on a variety of different target models, further improving the portability of the adversarial point cloud. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 It is a flow chart of a preferred embodiment of the present invention. DETAILED DESCRIPTION

[0038] The embodiments of the present invention are described in detail below. The following embodiments are implemented on the premise of the technical solution of the present invention, and detailed implementation methods and specific operation processes are given, but the protection scope of the present invention is not limited to the following embodiments.

[0039] The present invention designs a point cloud deep neural network migration attack method based on medial axis transformation, such as Figure 1 As shown, the technical solution includes the following steps, specifically including:

[0040] S10: Input the point cloud sample to be attacked into the encoder to extract the skeleton ball;

[0041] S20: Input the skeleton ball of the point cloud sample to be attacked into the decoder, initialize the surface point coordinates of the point cloud sample to be attacked, and calculate the initialized surface point features to reconstruct the point cloud according to the distance relationship between the initialized surface point coordinates and the skeleton ball;

[0042] S30: Input the reconstructed point cloud into the proxy classification model, optimize the skeleton ball of the reconstructed point cloud, and reconstruct the adversarial point cloud through the decoder.

[0043] Preferably, the skeleton sphere in S10 includes sphere center coordinates, skeleton sphere radius and sphere center point features.

[0044] Preferably, S10 includes:

[0045] Given K point cloud samples to be attacked represented by three-dimensional coordinate points Input Point2Skeleton encoder to extract N skeleton balls The encoder formula is as follows:

[0046] C, R, F=ENC(P)

[0047] In the formula, are the coordinates of the sphere center, is the radius of the skeleton sphere, F N×D is the sphere center feature, D is the feature dimension, and ENC is the encoder input function.

[0048] Specifically, given an arbitrary three-dimensional graphic, where the axis transformation is defined as a set of internal points with more than one nearest point on the boundary surface, the medial axis transformation uses both the internal points and the radius function associated with them to encode the three-dimensional graphic into a lower dimensional representation; the task of reconstructing the point cloud from the sphere center coordinates, the skeleton sphere radius and the sphere center point features is completed by the decoder, and the reconstructed point cloud is used for subsequent attacks.

[0049] Preferably, before inputting the point cloud samples to be attacked into the encoder in S10, normalization and down-sampling processing of the point cloud samples to be attacked is also included.

[0050] Specifically, the input point cloud data is first normalized so that the coordinate values ​​of all its points are within a standard range (e.g., [-1, 1]). Then, the point cloud data is downsampled to reduce the number of points and maintain computational efficiency.

[0051] Preferably, initializing the surface point coordinates of the point cloud sample to be attacked in S20 includes:

[0052] The skeleton ball of the attack point cloud sample is given eight unit vectors V = {(±η,±η,±η), 3η 2 =1}, initialize eight surface points, the initialized surface point is T i =c i +r(c i )V.

[0053] Preferably, calculating the initialized surface point feature and reconstructing the point cloud according to the distance relationship between the initialized surface point coordinates and the skeleton sphere in S20 includes:

[0054] For the jth initialized surface point t j , calculate the initial surface point t j The features of the surface point t are initialized by calculation j The features of all initialized surface points are obtained by M is the number of initialized surface points, and a series of fully connected layers are used to generate features corresponding to all initialized surface points. Reconstructing point clouds

[0055] Preferably, the initial surface point t is calculated j The formula for the characteristics of is as follows:

[0056]

[0057] Where c1, c2, c3 are the surface points t j The three nearest skeleton ball centers, w i (t j )=1 / d(t j ,c i ) is the center point of the i-th skeleton ball and the surface point t j The reciprocal of the Euclidean distance between feature(c i ) is the center point c i characteristics.

[0058] Preferably, the decoder in S20 is composed of a multi-layer perceptron, and the loss function L in the training phase is rec Including the chamfer distance L CD and k nearest neighbor loss L knn constitute;

[0059] Loss function L rec The calculation formula is as follows:

[0060] L rec (P,P rec )=L CD (P,P rec )+αL knn (P rec )

[0061] Where P is the point cloud sample to be attacked, P rec is the reconstructed point cloud, and α is the constraint strength for controlling uniformity.

[0062] Preferably, the chamfer distance L CD and k nearest neighbor loss L knn The calculation formula is as follows:

[0063]

[0064] Specifically, the encoder is composed of a pre-trained Point2Skeleton model, which is only used for inference during the training of the decoder and is no longer trained. Therefore, the decoder uses the skeleton ball center coordinates, ball radius, and ball center point features extracted by the encoder as input to reconstruct the point cloud P rec As output, use the loss function L rec Train for 400 epochs. rec It consists of two parts, namely the chamfer distance L CD And the k nearest neighbor loss L used in KNN-attack knn .L CD Compare the point cloud sample P to be attacked and the reconstructed point cloud P rec The similarity between them constrains the coordinates of each point in the reconstructed point cloud.knn Used to constrain the uniformity of the points in the reconstructed point cloud: Let P rec To reconstruct the point cloud, for any point p∈P, its k-nearest neighbors are defined as P rec The k points in L that have the smallest Euclidean distance to p, knn The definition formula is as shown above. If d p If w is greater than a certain threshold, p =1 otherwise let w p =0.

[0065] In addition, in the subsequent attack process, the coordinates of the center of the skeleton ball, the radius of the ball, and the features of the center point are input into the decoder to reconstruct the point cloud. The decoder first initializes the point coordinates and point features of the point cloud, and then uses a multi-layer perceptron to extract features and finally reconstruct the point cloud. In summary, the mathematical expression of the decoder is as follows:

[0066] P rec =DEC(C,R,F).

[0067] Preferably, S30 includes:

[0068] The reconstructed point cloud P rec Input into the proxy classification model and calculate the logits output Z(P adv ), based on Z(P adv ) Use the gradient descent method to iteratively optimize the perturbation of the skeleton ball's center coordinates δ C and the radius perturbation δ R , the decoder reconstructs the generated adversarial point cloud;

[0069] Perturbation δ of the center coordinates of the skeleton sphere C and the radius perturbation δ R The optimization formula is as follows:

[0070]

[0071] Where P adv is the adversarial point cloud, f(·) is the proxy model, κ is the parameter that controls the attack confidence, β is the hyperparameter, and y' represents the attack target.

[0072] Specifically, the reconstructed point cloud data and the proxy model are used to calculate the gradient information of the center coordinates and radius of the skeleton ball, thereby generating an adversarial point cloud. The attack method of the present invention is based on the optimized C&W attack framework and is improved on this basis. Given a clean point cloud The disturbance vectors added by the facility to the center and radius of the skeleton sphere are The whole process of countering the attack is regarded as the optimization formula L(P adv ,δ C ,δR ) optimization problem, by using the output information of the proxy model and using the gradient descent method to iteratively perturb the coordinates of the center of the skeleton ball and the radius (that is, update δ C , δ R ).

[0073] Among them, y' represents the attack target (i.e., any category different from the clean point cloud), and the hyperparameter β is used to control the penalty intensity for excessive perturbations. The encoder is used to obtain the skeleton ball center coordinates, ball radius, and ball center point features C, R, F = ENC (P) of the clean point cloud. The adversarial point cloud is the reconstructed point cloud with adversarial perturbations applied to the skeleton ball center and radius, i.e., P adv =DEC(C+δ C ,R+δ R ,F).

[0074] The preferred specific embodiments of the present invention are described in detail above. It should be understood that ordinary technicians in the field can make many modifications and changes based on the concept of the present invention without creative work. Therefore, all technical solutions that can be obtained by technicians in the technical field based on the concept of the present invention through logical analysis, reasoning or limited experiments on the basis of the prior art should be within the scope of protection determined by the claims.

Claims

1. A point cloud deep neural network migration attack method based on medial axis transformation, characterized in that: The following steps are involved: S10: Input the point cloud sample to be attacked into the encoder to extract the skeleton ball; S20: Inputting the skeleton ball of the point cloud sample to be attacked into a decoder, initializing the surface point coordinates of the point cloud sample to be attacked, and calculating the initialized surface point features to reconstruct the point cloud according to the distance relationship between the initialized surface point coordinates and the skeleton ball; S30: Inputting the reconstructed point cloud into the proxy classification model, optimizing the skeleton sphere of the reconstructed point cloud, and reconstructing the adversarial point cloud through the decoder.

2. According to the method of claim 1, the point cloud deep neural network migration attack method based on medial axis transformation is characterized in that: The skeleton sphere in S10 includes sphere center coordinates, skeleton sphere radius and sphere center point features.

3. According to the method of claim 2, the point cloud deep neural network migration attack method based on medial axis transformation is characterized in that: The S10 includes: Given K point cloud samples to be attacked represented by three-dimensional coordinate points Input Point2Skeleton encoder to extract N skeleton balls The encoder formula is as follows: C, R, F=ENC(P) In the formula, are the coordinates of the sphere center, is the radius of the skeleton sphere, F N×D is the sphere center feature, D is the feature dimension, and ENC is the encoder input function.

4. The point cloud deep neural network migration attack method based on medial axis transformation according to claim 1 is characterized in that: Before inputting the point cloud samples to be attacked into the encoder in S10, the step of normalizing and down-sampling the point cloud samples to be attacked is also included.

5. The point cloud deep neural network migration attack method based on medial axis transformation according to claim 2 is characterized in that: Initializing the surface point coordinates of the attack point cloud sample in S20 includes: The skeleton sphere of the point cloud sample to be attacked is given eight unit vectors V = {(±η,±η,±η), 3η 2 =1, initialize eight surface points, the initialized surface points are Ti=ci+r(ci)V.

6. The point cloud deep neural network migration attack method based on medial axis transformation according to claim 5 is characterized in that: The step of calculating the initialized surface point features and reconstructing the point cloud according to the distance relationship between the initialized surface point coordinates and the skeleton sphere in S20 includes: For the jth initialized surface point t j , calculate the initial surface point t j The features of the surface point t are initialized by calculation j The features of all initialized surface points are obtained by M is the number of initialized surface points, and a series of fully connected layers are used to generate features corresponding to all initialized surface points. Reconstructing point clouds 7. The point cloud deep neural network migration attack method based on medial axis transformation according to claim 6 is characterized in that: The calculation initializes the surface point t j The formula for the characteristics of is as follows: Where c1, c2, c3 are the surface points t j The three nearest skeleton ball centers, w i (t j )=1 / d(t j ,c i ) is the center point of the i-th skeleton ball and the surface point t j The reciprocal of the Euclidean distance between feature(c i ) is the center point c i characteristics.

8. The point cloud deep neural network migration attack method based on medial axis transformation according to claim 1 is characterized in that: The decoder in S20 is composed of a multi-layer perceptron, and the loss function L in the training phase is rec Including the chamfer distance L CD and k nearest neighbor loss L knn constitute; The loss function L rec The calculation formula is as follows: L rec (P,P rec )=L CD (P,P rec )+αL knn (P rec ) Where P is the point cloud sample to be attacked, P rec is the reconstructed point cloud, and α is the constraint strength for controlling uniformity.

9. The point cloud deep neural network migration attack method based on medial axis transformation according to claim 8 is characterized in that: The chamfer distance L CD and k nearest neighbor loss L knn The calculation formula is as follows:

10. The point cloud deep neural network migration attack method based on medial axis transformation according to claim 2 is characterized in that: The S30 includes: The reconstructed point cloud P rec Input into the proxy classification model and calculate the logits output Z(P adv ), based on Z(P adv ) Use the gradient descent method to iteratively optimize the perturbation of the skeleton ball's center coordinates δ C and the radius perturbation v R , the decoder reconstructs the generated adversarial point cloud; The coordinate perturbation δ of the center of the skeleton sphere is C and the radius perturbation v R The optimization formula is as follows: Where P adv is the adversarial point cloud, f(·) is the proxy model, κ is the parameter that controls the attack confidence, β is the hyperparameter, and t' represents the attack target.

Images