A field-based 3D adversarial point cloud generation method, storage medium and terminal

Abstract

The application relates to the technical field of computer vision, and provides a generation method of a 3D adversarial point cloud based on a field, a storage medium and a terminal, which comprises the following steps: S10, training a gradient field model based on preset normal 3D point cloud data, which is used for capturing and learning basic features and distribution of target 3D point cloud data; S20, secondarily training the gradient field model based on preset adversarial 3D point cloud data, so as to obtain an adversarial field model, which is used for adding disturbance to the target 3D point cloud data to generate; S30, inputting target 3D point cloud data into the adversarial field model to sample, so as to obtain target 3D adversarial point cloud; and S40, identifying disturbance amplitudes of the target 3D adversarial point cloud, and cutting the target 3D adversarial point cloud with an abnormal disturbance amplitude. The application directly generates an adversarial point cloud by using a pre-trained adversarial field, and the generation efficiency of the adversarial point cloud is significantly improved.

Description

Technical Field

[0001] This invention belongs to the field of computer vision technology, and particularly relates to a method, storage medium and terminal for generating field-based 3D adversarial point clouds. Background Technology

[0002] Point cloud data is a collection of points in space, representing the shape and structure information of the surrounding environment or objects. Point cloud data is widely used in fields such as autonomous driving, robot navigation, industrial inspection, and medical image processing. With technological advancements, the processing and application of point cloud data have become increasingly complex, highlighting its security and robustness issues. In existing technologies, adversarial example generation has become an important technique for evaluating and improving the robustness of machine learning models. Adversarial examples are carefully designed input data that appear identical to normal data to the human eye but can deceive machine learning models, leading to incorrect outputs. While research on adversarial examples is relatively mature in image processing, this technology is still under development in the field of 3D point clouds. With the widespread application of 3D point cloud data, researchers have begun to focus on adversarial attacks on 3D point cloud data. These attacks primarily concern the potential for malicious attacks on 3D point cloud data, causing point cloud data processing algorithms to misjudge or malfunction. Such attacks typically involve generating adversarial point clouds—specifically designed point cloud data designed to cause point cloud recognition or classification systems to err.

[0003] There are three existing methods for generating adversarial examples: one is based on point perturbation attacks, which apply small coordinate perturbations to each point in the point cloud, causing the 3D point cloud classifier to misclassify; another is based on point addition attacks, which add specific points to the point cloud, causing the 3D point cloud classifier to misclassify; and the third is based on point deletion attacks, which delete specific points from the point cloud, causing the 3D point cloud classifier to misclassify.

[0004] However, these methods have certain limitations. They involve complex computations and iterative optimization processes. Point perturbation methods typically require calculating the gradient information of point cloud data with respect to a target model and making minor adjustments based on this information to cause the model to output incorrect results. This process usually involves multiple iterations, each requiring recalculation of the gradient and fine-tuning of the point cloud. Point addition and deletion methods involve adding or removing points in the point cloud to mislead the model. Determining which points should be added or deleted, and their optimal positions, usually requires repeated testing and adjustment using optimization algorithms. Currently, in the process of generating adversarial point clouds, because each iteration may only produce minor changes, finding an effective adversarial point cloud may require hundreds or thousands of iterations. This is extremely inefficient in terms of time, especially in applications requiring real-time or near-real-time generation of adversarial examples, where the shortcomings of existing methods are particularly prominent. Summary of the Invention

[0005] In view of the above-mentioned deficiencies of the prior art, the present invention proposes a field-based 3D adversarial point cloud generation method, storage medium, and terminal.

[0006] This invention first proposes a field-based method for generating 3D adversarial point clouds. The technical solution includes the following steps:

[0007] S10: Train a gradient field model based on preset normal 3D point cloud data to capture and learn the basic features and distribution of the target 3D point cloud data;

[0008] S20: The gradient field model is trained a second time based on the preset adversarial 3D point cloud data to obtain an adversarial field model, which is used to add perturbations to the target 3D point cloud data.

[0009] S30: Input the target 3D point cloud data into the adversarial field model for sampling to obtain the target 3D adversarial point cloud;

[0010] S40: Identify the perturbation amplitude of the target 3D adversarial point cloud and crop the target 3D adversarial point cloud with abnormal perturbation amplitude.

[0011] Preferably, the step S10 of training the gradient field model based on preset normal 3D point cloud data includes:

[0012] Noise perturbation is added to the preset normal 3D point cloud data, so that the gradient field model learns how the points after the noise perturbation are moved to the corresponding points in the preset normal 3D point cloud data through the correct gradient direction. The error loss function between the predicted gradient and the true gradient is calculated and the error loss function is minimized.

[0013] Preferably, the error loss function between the predicted gradient and the true gradient is formulated as follows:

[0014]

[0015] In the formula, σ is the standard deviation of the added Gaussian noise. To predict the gradient, Points after adding Gaussian noise perturbation To the preset normal 3D point cloud data corresponding point x i The true gradient of the movement, denoted as X, is the set of points on the surface of the point cloud shape, denoted as... Where x i This represents the i-th point in a point cloud with m points. For x i σ is the mean. 2 I is a multivariate normal distribution of the covariance matrix.

[0016] Points sampled from I is the identity matrix.

[0017] Preferably, the loss function formula for the secondary training of the gradient field model based on preset adversarial 3D point cloud data in S20 is as follows:

[0018]

[0019] In the formula, These are the points corresponding to the preset adversarial 3D point cloud data.

[0020] Preferably, the step S30 of inputting the target 3D point cloud data into the adversarial field model for sampling includes:

[0021] Secondary training using the learned gradient field model Update the point position x with a step size of α and t as the number of samples, and inject random noise ∈ t The step size formula is as follows:

[0022]

[0023] In the formula, For random variables ∈ t Following a normal distribution with a mean of 0 and a covariance matrix of I, it represents the noise term added to the gradient update. This noise term is used to add randomness and avoid local optima during the sampling process.

[0024] Preferably, the cropping of the target 3D adversarial point cloud with abnormal perturbation amplitude in S40 includes:

[0025] The sampled target 3D adversarial point cloud is x. adv The final point cloud output formula after cropping is as follows:

[0026] x adv =clamp(x adv ).

[0027] The present invention also proposes a terminal, the terminal including one or more processors and one or more memories; wherein the one or more memories are coupled to the one or more processors, the one or more memories are used to store computer program code, the computer program code including computer instructions, and when the one or more processors execute the computer instructions, the terminal performs a 3D adversarial point cloud generation method as described above.

[0028] The present invention also proposes a computer-readable storage medium including instructions that, when executed on a terminal, cause the terminal to perform a method for generating a 3D adversarial point cloud as described above.

[0029] Beneficial effects:

[0030] 1. This invention directly generates adversarial point clouds through a pre-trained adversarial field, avoiding the point-by-point optimization process relied upon in existing technologies. This method reduces complex computational steps and directly guides the rapid transformation of point clouds through gradient information, thereby significantly improving processing speed.

[0031] 2. By using a pre-trained adversarial field model, the present invention allows users to input any scattered points and the original point cloud, and the adversarial field can automatically process and output an adversarial point cloud corresponding to the original point cloud. This "train once, use multiple times" mode reduces the technical threshold and complexity of user operation. Attached Figure Description

[0032] Figure 1 This is a flowchart illustrating a preferred embodiment of the present invention. Detailed Implementation

[0033] The embodiments of the present invention will be described in detail below. The embodiments described below are implemented based on the technical solution of the present invention, and detailed implementation methods and specific operation processes are given. However, the protection scope of the present invention is not limited to the embodiments described below.

[0034] This invention designs a field-based 3D adversarial point cloud generation method, storage medium, and terminal.

[0035] This invention first proposes a field-based method for generating 3D adversarial point clouds, such as... Figure 1 As shown, the technical solution design includes the following steps:

[0036] S10: Train a gradient field model based on preset normal 3D point cloud data to capture and learn the basic features and distribution of the target 3D point cloud data;

[0037] S20: The gradient field model is trained a second time based on the preset adversarial 3D point cloud data to obtain the adversarial field model, which is used to add perturbations to the target 3D point cloud data to generate it.

[0038] S30: Input the target 3D point cloud data into the adversarial field model for sampling to obtain the target 3D adversarial point cloud;

[0039] S40: Identify the perturbation amplitude of the target 3D adversarial point cloud and crop the target 3D adversarial point cloud with abnormal perturbation amplitude.

[0040] Specifically, two point cloud datasets, ModeNet40 and ShapeNet, can be used. The training set in the dataset is used to simulate and train the gradient field, and the test set data in the dataset is input into the gradient field. After the gradient field model is initially trained, the corresponding adversarial point cloud data is generated using the IFGM method to train the gradient field again, so that the gradient field becomes an adversarial field. That is, when any scattered points and original point cloud data are input into the adversarial field, the adversarial field can move any scattered points to the surface of the adversarial point cloud. Finally, the generated adversarial point cloud is cropped to improve the imperceptibility of the adversarial point cloud.

[0041] In addition, identifying the perturbation amplitude of the target 3D adversarial point cloud involves comparing the target 3D adversarial point cloud with the original target 3D point cloud data to calculate the perturbation amplitude of each point. The Euclidean distance (L2 norm) can be used to measure the degree of perturbation at each point. A threshold is set to determine which perturbation amplitudes are abnormal. If the perturbation amplitude is greater than the threshold, the perturbation amplitude at that point is considered abnormal.

[0042] Preferably, the gradient field model trained based on preset normal 3D point cloud data in S10 includes:

[0043] Noise perturbation is added to the preset normal 3D point cloud data, so that the gradient field model learns how the points after the noise perturbation are moved to the corresponding points in the preset normal 3D point cloud data through the correct gradient direction. The error loss function between the predicted gradient and the true gradient is calculated and minimized.

[0044] Preferably, the error loss function between the predicted gradient and the true gradient is formulated as follows:

[0045]

[0046] In the formula, σ is the standard deviation of the added Gaussian noise. To predict the gradient, Points after adding noise perturbation To the preset normal 3D point cloud data corresponding point x i The true gradient of the movement, denoted as X, is the set of points on the surface of the point cloud shape, denoted as... Where x i This represents the i-th point in a point cloud with m points. For x i σ is the mean. 2 I represents the points sampled from the multivariate normal distribution of the covariance matrix. I is the identity matrix.

[0047] Preferably, the loss function formula for the secondary training of the gradient field model based on preset adversarial 3D point cloud data in S20 is as follows:

[0048]

[0049] In the formula, These are the points corresponding to the preset adversarial 3D point cloud data.

[0050] Preferably, the input target 3D point cloud data to the adversarial field model for sampling in S30 includes:

[0051] Secondary training using the learned gradient field model Update the point position x with a step size of α and t as the number of samples, and inject random noise ∈ t The step size formula is as follows:

[0052]

[0053] In the formula, For random variables ∈ t Following a normal distribution with a mean of 0 and a covariance matrix of I, it represents the noise term added to the gradient update. This noise term is used to add randomness and avoid local optima during the sampling process.

[0054] Preferably, the cropping of the target 3D adversarial point cloud with abnormal perturbation amplitude in S40 includes:

[0055] The sampled target 3D adversarial point cloud is x. adv The final point cloud output formula after cropping is as follows:

[0056] x adv =clamp(x adv ).

[0057] The present invention also proposes a terminal, which includes one or more processors and one or more memories; wherein the one or more memories are coupled to one or more processors, and the one or more memories are used to store computer program code, the computer program code including computer instructions, and when the one or more processors execute the computer instructions, the terminal performs a field-based 3D adversarial point cloud generation method as described above.

[0058] The present invention also proposes a computer-readable storage medium including instructions that, when executed on a terminal, cause the terminal to perform a field-based 3D adversarial point cloud generation method as described above.

[0059] The preferred embodiments of the present invention have been described in detail above. It should be understood that those skilled in the art can make numerous modifications and variations based on the concept of the present invention without creative effort. Therefore, all technical solutions that can be obtained by those skilled in the art based on the concept of the present invention through logical analysis, reasoning, or limited experimentation on the basis of existing technology should be within the scope of protection defined by the claims.

Claims

1. A field-based method for generating 3D adversarial point clouds, characterized in that, include: S10: Train a gradient field model based on preset normal 3D point cloud data to capture and learn the basic features and distribution of the target 3D point cloud data; S20: The gradient field model is trained a second time based on the preset adversarial 3D point cloud data to obtain an adversarial field model, which is used to add perturbations to the target 3D point cloud data. S30: Input the target 3D point cloud data into the adversarial field model for sampling to obtain the target 3D adversarial point cloud; S40: Identify the perturbation amplitude of the target 3D adversarial point cloud, and crop the target 3D adversarial point cloud with abnormal perturbation amplitude; The gradient field model trained based on preset normal 3D point cloud data in S10 includes: Noise perturbation is added to the preset normal 3D point cloud data, so that the gradient field model learns how the points after the noise perturbation are moved to the corresponding points in the preset normal 3D point cloud data through the correct gradient direction. The error loss function between the predicted gradient and the true gradient is calculated and the error loss function is minimized. The formula for the error loss function between the predicted gradient and the true gradient is as follows: In the formula, The standard deviation of the added Gaussian noise, To predict the gradient, Points after adding Gaussian noise perturbation To the preset normal 3D point cloud data corresponding points The true gradient of the movement, The point set of the surface of the point cloud shape is denoted as . ,in This represents the i-th point in a point cloud with m points. For The mean, Points sampled from the multivariate normal distribution of the covariance matrix , It is the identity matrix; The loss function formula for the secondary training of the gradient field model based on the preset adversarial 3D point cloud data in S20 is as follows: In the formula, These are the points corresponding to the preset adversarial 3D point cloud data. The input of the target 3D point cloud data to the adversarial field model for sampling in S30 includes: Secondary training using the learned gradient field model Update the location Step size is , The number of samples is determined, and random noise is injected. The step size formula is as follows: In the formula, For random variables It follows a pattern with a mean of 0 and a covariance matrix of . The normal distribution represents the noise term added to the gradient update. This noise term is used to add randomness and avoid local optima during the sampling process.

2. The method for generating 3D adversarial point clouds based on a field, as described in claim 1, is characterized in that... The cropping of the target 3D adversarial point cloud with abnormal perturbation amplitude in S40 includes: The sampled target 3D adversarial point cloud is The final point cloud output formula after cropping is as follows: 。 3. A terminal, characterized in that, The terminal includes one or more processors and one or more memories; wherein the one or more memories are coupled to the one or more processors, and the one or more memories are used to store computer program code, the computer program code including computer instructions, which, when executed by the one or more processors, cause the terminal to perform the method as described in any one of claims 1-2.

4. A computer-readable storage medium comprising instructions, characterized in that, When the instruction is executed on the terminal, the terminal performs the method as described in any one of claims 1-2.

Images