Point cloud transfer attack method, device, equipment and medium based on spherical geometry

Abstract

The present invention provides a point cloud transfer attack method, device, equipment and medium based on spherical geometry, which relates to the field of point cloud attack technology, and uses the spherical geodetic distance and the angle between the paired vectors to generate disturbances. Through manifold transformation, the point cloud is mapped from Euclidean space to spherical space, and the nearest geodetic distance on the sphere is calculated to obtain the geometric position of the curved point pair. Subsequently, two sub-disturbances are generated by learning positive and negative angle offsets, and the angle changes of paired vectors are controlled to enhance the diversity of disturbances. It is intended to solve the problem of weak portability of the model.

Description

Technical Field

[0001] The present invention relates to the technical field of point cloud attack, and in particular to a point cloud transfer attack method, device, equipment and medium based on spherical geometry. Background Art

[0002] Deep neural network models are developing rapidly in fields such as object detection, speech recognition, and robotic motion planning. In the field of robotic motion planning, deep neural network models often use 3D point clouds to achieve accurate environmental perception and obstacle avoidance. These point clouds generated by LiDAR provide crucial 3D data for navigation in complex environments. Point cloud attacks are divided into white-box attacks and black-box attacks. White-box attacks provide transparent architecture, parameters, and training data of the target model, while black-box attacks do not know the internal mechanisms and can only rely on inputs and outputs to interact. In practical applications, deep neural network models are usually deployed as services, which makes it difficult to obtain internal information. Therefore, black-box attacks are critical to system security.

[0003] Existing point cloud black-box attack transfer methods mainly distort surfaces by optimizing the shape distribution score in Euclidean space. This method can effectively use known geometric features to guide the generation of adversarial samples, thereby quickly identifying surface features similar to the target model. However, existing point cloud black-box attack transfer methods have great limitations, especially in ignoring point cloud curves and surface features. When attacking objects with complex geometric shapes, relying solely on shape distribution scores may not fully capture subtle geometric changes. Therefore, the generated adversarial samples may be unnatural or easily detected, thereby reducing the transferability of the attack.

[0004] In addition, black-box attacks bring additional challenges to point cloud deformation due to the lack of knowledge of the internal structure and weights of the target model. This often leads to unpredictable perturbations, especially on surfaces with complex curvature, resulting in more obvious deformations, affecting the stealth and efficiency of the attack. Current methods often ignore key geometric properties of point clouds, such as surface curvature and object orientation, or require complex calculations to include these factors in the attack. For example, noise interference on high-curvature surfaces can cause obvious deformation and inconsistency in the 3D surface.

[0005] In view of this, this application is filed. Summary of the invention

[0006] The present invention provides a point cloud transfer attack method, device, equipment and medium based on spherical geometry, which can at least partially improve the above-mentioned problems.

[0007] To achieve the above object, the present invention adopts the following technical solutions:

[0008] A point cloud transfer attack method based on spherical geometry, comprising:

[0009] Get the given point cloud data P, misclassify the point cloud data P, and determine the adversarial attack target;

[0010] Performing coordinate conversion processing on the point cloud data P to obtain spherical coordinates of the point cloud data, and mapping the spherical coordinates of the point cloud data to a preset triangular range;

[0011] According to the mapped point cloud data P, a geodesic is constructed on the manifold, the nearest point of any point in the point set P1 on the Manifold geodesic is calculated, the normal vector is used as the guide vector, the specific coordinates of the point Q are determined according to the vector constraints, and a point pair for attacking the point cloud object is constructed;

[0012] According to the random decomposition disturbance of point pairs, the probability distribution of the wrong category of the point cloud data P is increased, and the probability distribution of the correct category of the point cloud data P is reduced;

[0013] Using Ladv allows the model to understand the error category through cross entropy loss, calculate the Chamfer distance between the point clouds before and after the attack, and impose constraints on the shape to generate an attack point cloud with rich geometric structure.

[0014] The present invention also provides a point cloud transfer attack device based on spherical geometry, which includes:

[0015] Determine an adversarial attack target unit, which is used to obtain a given point cloud data P, misclassify the point cloud data P, and determine an adversarial attack target;

[0016] A spherical geometry attack unit, used for performing coordinate conversion processing on the point cloud data P to obtain the spherical coordinates of the point cloud data, and mapping the spherical coordinates of the point cloud data into a preset triangular range;

[0017] A paired point construction unit is used to construct a geodesic on the manifold according to the mapped point cloud data P, calculate the nearest point of any point in the point set P1 on the Manifold geodesic, use the normal vector as a guide vector, determine the specific coordinates of the point Q according to the vector constraint, and construct a point pair for attacking the point cloud object;

[0018] A random decomposition disturbance unit is used to randomly decompose and disturb the point pairs, thereby increasing the probability distribution of the wrong category of the point cloud data P and reducing the probability distribution of the correct category of the point cloud data P;

[0019] The attack point cloud generation unit is used to use Ladv to allow the model to understand the error category through cross entropy loss, calculate the Chamfer distance between the point clouds before and after the attack, and restrict the shape to generate an attack point cloud with rich geometric structure.

[0020] The present invention also provides a point cloud transfer attack device based on spherical geometry, which includes a memory and a processor, wherein the memory stores a computer program, and the computer program can be executed by the processor to implement the point cloud transfer attack method based on spherical geometry as described in any one of the above.

[0021] The present invention also provides a computer-readable storage medium storing a computer program, wherein the computer program can be executed by a processor of a device where the computer-readable storage medium is located to implement a point cloud transfer attack method based on spherical geometry as described in any one of the above.

[0022] In summary, the point cloud transfer attack method based on spherical geometry proposes a spherical geometry attack module, which generates perturbations using the spherical geodetic distance and the angle between paired vectors. Through manifold transformation, the point cloud is mapped from Euclidean space to spherical space, and the nearest geodetic distance on the sphere is calculated to obtain the geometric position of the curved point pair. Subsequently, two sub-perturbations are generated by learning positive and negative angle offsets, and the angle changes of paired vectors are controlled to enhance the perturbation diversity. By analyzing the spherical geometric characteristics, significant adaptive perturbations are constructed to solve the problem of weak portability of the model. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 It is a flowchart of a point cloud transfer attack method based on spherical geometry provided by the first embodiment of the present invention;

[0024] Figure 2 It is a practical process diagram of the point cloud transfer attack method based on spherical geometry provided by an embodiment of the present invention;

[0025] Figure 3 is a visual comparison diagram of different regions provided by an embodiment of the present invention;

[0026] Figure 4 is a performance comparison chart of three methods provided by an embodiment of the present invention under different defense strategies;

[0027] Figure 5 It is a module schematic diagram of a point cloud transfer attack device based on spherical geometry provided by the second embodiment of the present invention. DETAILED DESCRIPTION

[0028] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0029] refer to Figures 1 to 4As shown, the first embodiment of the present invention discloses a point cloud transfer attack method based on spherical geometry, which can be executed by a point cloud transfer attack device based on spherical geometry (hereinafter referred to as an attack device), and in particular, executed by one or more processors in the attack device to implement the following method:

[0030] S1, obtain the given point cloud data P, and misclassify the point cloud data P to determine the adversarial attack target;

[0031] Specifically, step S1 includes: obtaining given point cloud data P(x, y, z), and performing misclassification on the point cloud data P(x, y, z), wherein the misclassification of the resistance attack is divided into targeted misclassification and non-targeted misclassification;

[0032] Through the classifier function Identify the true label t of the point cloud data P(x,y,z), t=f(P), where t belongs to T, T={1,2,3,4,....,C}, T is the set of all possible categories that the model can predict, and C is the total number of categories;

[0033] Corrected label t'=f(P'), t' belongs to T, t' is not equal to t, P'=P+ , ∈ Represents point cloud noise.

[0034] In this embodiment, the adversarial attack target is determined. The misclassification of adversarial attacks can be divided into targeted misclassification and non-targeted misclassification. It is necessary to determine a point cloud P for misclassification. For a given point cloud P, its classifier function The true label t of the mark, such as t=f(P), and t belongs to T, T={1,2,3,4,....,C}, will lead to the revised label t'=f(P'), and t' belongs to T, t' is not equal to t.

[0035] In this embodiment, the classifier function , Represents model parameters, indicating that the model is parameterized, where the parameters It is obtained through optimization of the learning process, x1 represents input data, and in this embodiment, x1 is the point cloud P.

[0036] S2, performing coordinate conversion processing on the point cloud data P to obtain spherical coordinates of the point cloud data, and mapping the spherical coordinates of the point cloud data to a preset triangular range;

[0037] Specifically, step S2 includes: converting the point cloud data P (x, y, z) from rectangular coordinates to spherical coordinates, projecting the spherical coordinates P (r, , ), where r is the radius, is the inclination angle, is the azimuth, and the formula is:

[0038] ;

[0039] ;

[0040] ;

[0041] The spherical coordinates P(r, , ) is mapped to the preset triangular range to obtain the mapped point cloud data , the conversion process formula is:

[0042] ;

[0043] ;

[0044] ;

[0045] .

[0046] In this embodiment, a spherical geometric attack module is used. First, the spherical deformation is performed. First, the input point cloud data P (x, y, z) needs to be converted from rectangular coordinates to spherical coordinates. The spherical coordinates P (r, , ) is composed of radius r, inclination angle and azimuth Composition. The formula is as follows:

[0047] ;

[0048] ;

[0049] ;

[0050] Through formula transformation, the point cloud data P(x,y,z) →P(r, , ), its sparse and dense areas clearly reveal the relationship between density and geometric area. The spherical coordinate system is closer to the understanding of the real world. Its sparse and dense areas clearly reveal the relationship between density and geometric area. In order to enhance the representation and calculation, the spherical coordinates are also mapped to the triangular range, which is conducive to the smoothness and continuity of the data. The specific conversion process is as follows:

[0051] ;

[0052] ;

[0053] ;

[0054] .

[0055] S3, construct a geodesic on the manifold according to the mapped point cloud data P, calculate the nearest point of any point in the point set P1 on the Manifold-folded geodesic, use the normal vector as the guide vector, determine the specific coordinates of the point Q according to the vector constraint, and construct a point pair for attacking the point cloud object;

[0056] Specifically, step S3 includes: calculating any point in the point set P1 The closest point on the Mani-fold geodes },in,{ }Located at the passing point and perpendicular to the vector On the great circle of The length is ;

[0057] Take the mean to get the midpoint , the formula is:

[0058] ;

[0059] ;

[0060] ;

[0061] Where N represents the number of points;

[0062] The normal vector As the guiding vector, where the geodesic is at point The tangent vector Orthogonal to the normal vector and lies in the tangent plane;

[0063] According to the vector , constrain and determine the specific coordinates of point Q, the calculation formula is:

[0064] ;

[0065] ;

[0066] ;

[0067] Calculated and each point P i The corresponding point Q on the manifold geodesic i , according to point P iAnd Q i Build a pair<P,Q> , used to attack point cloud objects.

[0068] In this embodiment, the next step is to construct the pairing points. The nearest point on the sphere is determined by constructing a geodesic on the manifold. For any point in the point set P1 , to calculate its closest point on the Mani-fold geodesy { }. The main steps are as follows: First, take the mean to obtain the midpoint O( , , ), N represents the number of points:

[0069] .

[0070] Since the geodesic is a great circle arc, {Qi} is located at the point through which and perpendicular to the vector On the great circle of . Vector The length is .

[0071] In the second step, its normal vector is As a guide vector. Tangent vector of a point is orthogonal to the normal vector and lies in the tangent plane. Given that the vector , the following formula is obtained to constrain and determine the specific coordinates of Q:

[0072] ;

[0073] ;

[0074] ;

[0075] Therefore, we can calculate the i The corresponding point Q on the manifold geodesic i These points can be used to construct point pairs<P,Q> to attack the point cloud object.

[0076] S4, randomly decomposes and perturbs the point pairs, increases the probability distribution of the wrong category of the point cloud data P, and reduces the probability distribution of the correct category of the point cloud data P;

[0077] Specifically, step S4 includes: increasing the probability distribution of the wrong category and reducing the probability distribution of the correct category, and the calculation formula is:

[0078] ;

[0079] ;

[0080] ;

[0081] in, Indicates category, ∈ represents the point cloud noise, Φ represents the class score vector output by the model, t represents the ground truth label, D(P, ) quantifies the gap between the predicted probability of the ground truth class and the predicted probability of the first but not ground truth class, This variance is magnified, M(P, ) contains components that both promote the most likely misclassifications and inhibit correct classifications;

[0082] According to the point pairs, the angle relationship between the node pairs is adjusted by noise perturbation, given a mask matrix Γ∈ , where the probability of an element being 1 is p, and the probability of an element being 0 is 1-p. All possible Γ are represented by the set and Said, the formula is:

[0083] ;

[0084] ;

[0085] The function of decomposing and perturbing point pairs is:

[0086] ;

[0087] Among them, the size of the point pair set and the random mask matrix are both N, is the set of relationships between points P and Q, is the point-wise product of the positive mask and the point cloud noise to achieve selective perturbation in point pairs, is the set of all possible mask combinations in the mask matrix Γ, Representation and Collection The corresponding set of negative masks.

[0088] In this embodiment, the perturbation is randomly decomposed. In order to improve the transferability of model attacks, a new perspective is proposed: increase the probability distribution of the wrong category while minimizing the probability distribution of the correct category to improve the transferability of the attack. Specifically, the output corresponding to the correct category in the single score vector of the model is suppressed. Here, ∈ represents the point cloud noise, Φ represents the class score vector output by the model, and t represents the ground truth label. ) quantifies the gap between the predicted probability of the ground truth class and the predicted probability of the first but not the ground truth class. This variance is amplified, and M(P, ) contains components that both promote the most likely misclassification and inhibit the correct classification. Its calculation formula is as follows:

[0089] ;

[0090] ;

[0091] ;

[0092] Using the above points<P,Q> , the angle relationship between node pairs is adjusted by noise perturbation. The smaller the distance, the smaller the angle, and the larger the distance, the larger the angle. Given a mask matrix Γ∈ , where the probability of an element being 1 is p and the probability of being 0 is 1-p, then all possible Γ can be represented by the set and express:

[0093] ;

[0094] ;

[0095] The function of decomposing and perturbing point pairs can be expressed as follows:

[0096] ;

[0097] The size of the point pair set and the random mask matrix are both N, so we can use and The control vector angles are decomposed to enhance attack diversity. During the iteration process, random decomposition sampling produces larger perturbations to the direction angles and geometric structures of each point pair.

[0098] S5, using Ladv allows the model to understand the error category through cross entropy loss, calculates the Chamfer distance between the point clouds before and after the attack, and imposes constraints on the shape to generate an attack point cloud with rich geometric structure.

[0099] Specifically, step S5 includes: using Ladv to allow the model to understand the error category through cross entropy loss, the formula is = -CE(f(P),t), where CE represents the cross entropy loss;

[0100] According to the formula = Chamfer( , P) Calculate the Chamfer distance between the point clouds before and after the attack;

[0101] use The loss imposes constraints on the shape and is given by: ;

[0102] Generate an attack point cloud with rich geometric structure, the formula is ,in, Indicates L The coefficients of norm, Represents disturbance L Norm.

[0103] In this example, Ladv allows the model to understand the error categories through cross entropy loss. = -CE(f(P),t),ε represents L The coefficients of norm, = Chamfer( , P) calculates the Chamfer distance between the point clouds before and after the attack. In order to prevent the target from being overly deformed due to noise, it imposes constraints on the shape. The specific expression is as follows:

[0104] ;

[0105] for The loss mainly considers noise perturbations and random sub-perturbations to generate attack point clouds with richer geometric structures. These features of the attack point clouds greatly improve the transferability of the attack.

[0106] In this embodiment, CE represents the cross-entropy loss, which is usually used in classification problems to measure the difference between the class probability predicted by the model and the true label. Step S5 introduces the simplest optimization method of the model, which has the following three parts: L adv , L constrain , L sa The formula is: Among them, we can see that L adv Allow the model to understand incorrect categories through cross entropy loss, = -CE(f(P),t), Indicates L The coefficients of norm, = Chamfer( , P) calculates the Chamfer distance between the point clouds before and after the attack. In the expression st In the formula, st is the abbreviation of "subject to", which means constraint condition. The formula means: Represents disturbance L norm, which measures the perturbation The maximum amplitude, L The norm usually represents the maximum absolute value of the elements in the vector, that is, the perturbation The disturbance amplitude of each point in cannot exceed a certain value. (epsilon) is the maximum allowed value of this disturbance, that is, the upper limit of the disturbance.

[0107] In summary, this paper proposes a sphere transfer attack (SMA) for adversarial learning of 3D point clouds. The key geometric pairs are constructed by computing the geodesic distance on the manifold. Subsequently, deep sub-perturbations are used to change the lengths of these angle pairs by decomposing the positive and negative angles, thus facilitating efficient attacks on point cloud features. The proposed method has excellent transfer attack performance in various structural models. In addition, it has minimal distortion compared to existing black-box methods.

[0108] Specifically, the point cloud transfer attack method based on spherical geometry designs a spherical geometry attack module that obtains the geometric position of the curved point pair through manifold transformation and learns the offset of positive and negative angles to generate a variety of perturbations. The model then passes through this spherical geometry attack module to produce better portability. The process of the spherical point cloud transfer attack is as follows: (1) Spherical deformation. By mapping the three-dimensional coordinates of the point cloud P into a triangular range. (2) Constructing pairing points. Calculating the geodesic distance on the sphere can reveal the intrinsic geometric structure of the manifold. (3) Randomly decompose the perturbation. Increase the probability distribution of the wrong category while minimizing the probability distribution of the correct category to improve the transferability of the attack.

[0109] See also Figure 5 The second embodiment of the present invention provides a point cloud transfer attack device based on spherical geometry, which includes:

[0110] The adversarial attack target determination unit 201 is used to obtain given point cloud data P, and misclassify the point cloud data P to determine the adversarial attack target;

[0111] The spherical geometry attack unit 202 is used to perform coordinate conversion processing on the point cloud data P to obtain the spherical coordinates of the point cloud data, and map the spherical coordinates of the point cloud data into a preset triangular range;

[0112] The paired point construction unit 203 is used to construct a geodesic on the manifold according to the mapped point cloud data P, calculate the nearest point of any point in the point set P1 on the Manifold-folded geodesic, use the normal vector as a guide vector, determine the specific coordinates of the point Q according to the vector constraint, and construct a point pair for attacking the point cloud object;

[0113] A random decomposition disturbance unit 204 is used to randomly decompose and disturb the point pairs, thereby increasing the probability distribution of the wrong category of the point cloud data P and reducing the probability distribution of the correct category of the point cloud data P;

[0114] The attack point cloud generation unit 205 is used to use Ladv to allow the model to understand the error category through cross entropy loss, calculate the Chamfer distance between the point clouds before and after the attack, and restrict the shape to generate an attack point cloud with a rich geometric structure.

[0115] The third embodiment of the present invention provides a point cloud transfer attack device based on spherical geometry, which includes a memory and a processor, wherein the memory stores a computer program, and the computer program can be executed by the processor to implement any of the point cloud transfer attack methods based on spherical geometry as described above.

[0116] A fourth embodiment of the present invention provides a computer-readable storage medium storing a computer program, wherein the computer program can be executed by a processor of a device where the computer-readable storage medium is located to implement a point cloud transfer attack method based on spherical geometry as described in any one of the above.

[0117] Exemplarily, the above-mentioned devices and process steps can be implemented by a computer program. The computer program can be divided into one or more units. The one or more units are stored in the memory and executed by the processor to complete the present invention.

[0118] The processor may be a central processing unit (CPU), other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc.

[0119] The memory can be used to store the computer program and / or module, and the processor realizes various functions of the present invention by running or executing the computer program and / or module stored in the memory, and calling the data stored in the memory. The memory can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc.; the data storage area can store data created according to the use of the mobile phone (such as audio data, a phone book, etc.), etc. In addition, the memory can include a high-speed random access memory, and can also include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (FlashCard), at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0120] Wherein, if the electronic device or printer integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on such an understanding, the present invention implements all or part of the processes in the above-mentioned embodiment method, and can also be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor. Wherein, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, U disk, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electric carrier signal, telecommunication signal and software distribution medium. It should be noted that the content contained in the computer-readable medium can be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electric carrier signals and telecommunication signals.

[0121] It should be noted that the device embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. In addition, in the accompanying drawings of the device embodiments provided by the present invention, the connection relationship between the modules indicates that there is a communication connection between them, which may be specifically implemented as one or more communication buses or signal lines. A person of ordinary skill in the art may understand and implement it without paying any creative effort.

[0122] The above is a preferred embodiment of the present invention. It should be pointed out that a person skilled in the art can make several improvements and modifications without departing from the principle of the present invention. These improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A point cloud transfer attack method based on spherical geometry, characterized in that: include: Get the given point cloud data P, misclassify the point cloud data P, and determine the adversarial attack target; Performing coordinate conversion processing on the point cloud data P to obtain spherical coordinates of the point cloud data, and mapping the spherical coordinates of the point cloud data to a preset triangular range; According to the mapped point cloud data P, a geodesic is constructed on the manifold, the nearest point of any point in the point set P1 on the Manifold geodesic is calculated, the normal vector is used as the guide vector, the specific coordinates of the point Q are determined according to the vector constraints, and a point pair for attacking the point cloud object is constructed; According to the random decomposition disturbance of point pairs, the probability distribution of the wrong category of the point cloud data P is increased, and the probability distribution of the correct category of the point cloud data P is reduced; Use L adv Allow the model to understand the error category through cross entropy loss, calculate the Chamfer distance between the point clouds before and after the attack, and restrict the shape to generate an attack point cloud with rich geometric structure; Get the given point cloud data P, misclassify the point cloud data P, and determine the adversarial attack target, specifically: Get the given point cloud data P(x,y,z), and perform misclassification on the point cloud data P(x,y,z), where the misclassification of the anti-attack is divided into targeted misclassification and non-targeted misclassification; Through the classifier function Identify the true label t of the point cloud data P(x,y,z), t=f(P), where t belongs to T, T={1,2,3,4,....,C}, T is the set of all possible categories that the model can predict, and C is the total number of categories; Corrected label t'=f(P'), t' belongs to T, t' is not equal to t, P'=P+ , ∈ represents disturbance; The point cloud data P is subjected to coordinate transformation processing to obtain the spherical coordinates of the point cloud data, and the spherical coordinates of the point cloud data are mapped to a preset triangular range, specifically: The point cloud data P(x, y, z) is converted from rectangular coordinates to spherical coordinates, and the spherical coordinates P(r, , ), where r is the radius, is the inclination angle, is the azimuth, and the formula is: ； ； ； The spherical coordinates P(r, , ) is mapped to the preset triangular range to obtain the mapped point cloud data , the conversion process formula is: ； ； ； ； According to the mapped point cloud data P, a geodesic is constructed on the manifold, and the nearest point of any point in the point set P1 on the Manifold geodesic is calculated. The normal vector is used as the guide vector, and the specific coordinates of the point Q are determined according to the vector constraints, and the point pair used to attack the point cloud object is constructed, specifically: Calculate any point in the point set P1 The closest point on the Mani-fold geodes },in,{ }Located at the passing point and perpendicular to the vector On the great circle of The length is ; Take the mean to get the midpoint , the formula is: ； ； ； Where N represents the number of points; The normal vector As the guiding vector, where the geodesic at point The tangent vector Orthogonal to the normal vector and lies in the tangent plane; According to vector , constrain and determine the specific coordinates of point Q, the calculation formula is: ； ； ； Calculated and each point P i The corresponding point Q on the manifold geodesic i , according to point P i And Q i Building a Relationship Set<P,Q > , used to attack point cloud objects; According to the random decomposition perturbation of point pairs, the probability distribution of the wrong category of point cloud data P is increased, while the probability distribution of the correct category of point cloud data P is reduced. Specifically: Increase the probability distribution of the wrong category and reduce the probability distribution of the correct category. The calculation formula is: ； ； ； in, represents the category, Φ represents the category score vector output by the model, t represents the true label of the point cloud data P(x,y,z), D(P, ) quantifies the gap between the predicted probability of the ground truth class and the predicted probability of the first but not ground truth class, This variance is magnified, M(P, ) contains components that both promote the most likely misclassifications and inhibit correct classifications; According to the point pairs, the angle relationship between the node pairs is adjusted by noise perturbation, given a mask matrix Γ∈ , where the probability of an element being 1 is p, and the probability of an element being 0 is 1-p. All possible Γ are represented by the set and Said, the formula is: ； ； The function of decomposing and perturbing point pairs is: ； Among them, the size of the point pair set and the random mask matrix are both N, is the set of relationships between points P and Q, is the point-wise product of the positive mask and the point cloud noise to achieve selective perturbation in point pairs, is the set of all possible mask combinations in the mask matrix Γ, Representation and Collection The corresponding set of negative masks.

2. The point cloud transfer attack method based on spherical geometry according to claim 1 is characterized in that: Use L adv Allow the model to understand the error category through cross entropy loss, calculate the Chamfer distance between the point clouds before and after the attack, and restrict the shape to generate an attack point cloud with rich geometric structure, specifically: Use L adv Allow the model to understand the error categories through cross entropy loss, the formula is = -CE(f(P),t), where CE represents the cross entropy loss; According to the formula = Chamfer( , P) Calculate the Chamfer distance between the point clouds before and after the attack; use The loss imposes constraints on the shape and is given by: ; Generate an attack point cloud with rich geometric structure, the formula is ,in, Indicates L The coefficients of norm, Represents disturbance L Norm.

3. A point cloud transfer attack device based on spherical geometry, characterized in that: include: Determine an adversarial attack target unit, which is used to obtain a given point cloud data P, misclassify the point cloud data P, and determine an adversarial attack target; A spherical geometry attack unit, used for performing coordinate conversion processing on the point cloud data P to obtain the spherical coordinates of the point cloud data, and mapping the spherical coordinates of the point cloud data into a preset triangular range; A paired point construction unit is used to construct a geodesic on the manifold according to the mapped point cloud data P, calculate the nearest point of any point in the point set P1 on the Manifold geodesic, use the normal vector as a guide vector, determine the specific coordinates of the point Q according to the vector constraint, and construct a point pair for attacking the point cloud object; A random decomposition disturbance unit is used to randomly decompose and disturb the point pairs, thereby increasing the probability distribution of the wrong category of the point cloud data P and reducing the probability distribution of the correct category of the point cloud data P; Attack point cloud generation unit for using L adv Allow the model to understand the error category through cross entropy loss, calculate the Chamfer distance between the point clouds before and after the attack, and impose constraints on the shape to generate an attack point cloud with rich geometric structure; Get the given point cloud data P, misclassify the point cloud data P, and determine the adversarial attack target, specifically: Get the given point cloud data P(x,y,z), and perform misclassification on the point cloud data P(x,y,z), where the misclassification of the anti-attack is divided into targeted misclassification and non-targeted misclassification; Through the classifier function Identify the true label t of the point cloud data P(x,y,z), t=f(P), where t belongs to T, T={1,2,3,4,....,C}, T is the set of all possible categories that the model can predict, and C is the total number of categories; Corrected label t'=f(P'), t' belongs to T, t' is not equal to t, P'=P+ , ∈ represents disturbance; The point cloud data P is subjected to coordinate transformation processing to obtain the spherical coordinates of the point cloud data, and the spherical coordinates of the point cloud data are mapped to a preset triangular range, specifically: The point cloud data P(x, y, z) is converted from rectangular coordinates to spherical coordinates, and the spherical coordinates P(r, , ), where r is the radius, is the inclination angle, is the azimuth, and the formula is: ； ； ； The spherical coordinates P(r, , ) is mapped to the preset triangular range to obtain the mapped point cloud data , the conversion process formula is: ； ； ； ； According to the mapped point cloud data P, a geodesic is constructed on the manifold, and the nearest point of any point in the point set P1 on the Manifold geodesic is calculated. The normal vector is used as the guide vector, and the specific coordinates of the point Q are determined according to the vector constraints, and the point pair used to attack the point cloud object is constructed, specifically: Calculate any point in the point set P1 The closest point on the Mani-fold geodes },in,{ }Located at the passing point and perpendicular to the vector On the great circle of The length is ; Take the mean to get the midpoint , the formula is: ； ； ； Where N represents the number of points; The normal vector As the guiding vector, where the geodesic at point The tangent vector Orthogonal to the normal vector and lies in the tangent plane; According to the vector , constrain and determine the specific coordinates of point Q, the calculation formula is: ； ； ； Calculated and each point P i The corresponding point Q on the manifold geodesic i , according to point P i And Q i Building a Relationship Set<P,Q > , used to attack point cloud objects; According to the random decomposition perturbation of point pairs, the probability distribution of the wrong category of point cloud data P is increased, while the probability distribution of the correct category of point cloud data P is reduced. Specifically: Increase the probability distribution of the wrong category and reduce the probability distribution of the correct category. The calculation formula is: ； ； ； in, represents the category, Φ represents the category score vector output by the model, t represents the true label of the point cloud data P(x,y,z), D(P, ) quantifies the gap between the predicted probability of the ground truth class and the predicted probability of the first but not ground truth class, This variance is magnified, M(P, ) contains components that both promote the most likely misclassifications and inhibit correct classifications; According to the point pairs, the angle relationship between the node pairs is adjusted by noise perturbation, given a mask matrix Γ∈ , where the probability of an element being 1 is p, and the probability of an element being 0 is 1-p. All possible Γ are represented by the set and Said, the formula is: ； ； The function of decomposing and perturbing point pairs is: ； Among them, the size of the point pair set and the random mask matrix are both N, is the set of relationships between points P and Q, is the point-wise product of the positive mask and the point cloud noise to achieve selective perturbation in point pairs, is the set of all possible mask combinations in the mask matrix Γ, Representation and Collection The corresponding set of negative masks, Indicates disturbance.

4. A point cloud transfer attack device based on spherical geometry, characterized in that: It includes a memory and a processor, wherein the memory stores a computer program, and the computer program can be executed by the processor to implement the point cloud transfer attack method based on spherical geometry as described in any one of claims 1 to 2.

5. A computer-readable storage medium, characterized in that: A computer program is stored, and the computer program can be executed by a processor of the device where the computer-readable storage medium is located to implement the point cloud transfer attack method based on spherical geometry as described in any one of claims 1 to 2.

Images