Clean label backdoor attack method and system for 3D point cloud models

Abstract

The present invention provides a clean label backdoor attack method and system for 3D point cloud models, including the following steps: S101: obtaining a clean dataset and randomly initializing model parameters; S102: randomly selecting a source class dataset and a target class dataset for optimization; S103: initializing perturbation; S104: adding the obtained perturbation #imgabs0# to the target class dataset, and then using a data selection strategy based on decision boundary distance to screen the target class dataset to obtain a final poisoned dataset; S105: mixing the poisoned dataset with the clean dataset to form a new dataset; This technical solution significantly improves the practicality and concealment of backdoor attacks, increases the probability of discovering model vulnerabilities, and provides an important reference for evaluating and improving the robustness and security of point cloud models in real environments.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence security technology, and in particular to a clean label backdoor attack method and system for 3D point cloud models. Background Art

[0002] Point cloud deep learning technology has rapidly become a core process technology in fields such as advanced autonomous driving, robotics, and medical treatment, all of which are closely related to life safety. In recent years, several studies have explored the feasibility of backdoor attacks against 3D point cloud models. Backdoor attacks assume that an attacker can manipulate training data and insert predefined triggers into some samples to tamper with them. The main purpose of a backdoor attack is to cause the backdoored deep learning model to perform normally on normal samples without triggers during inference, but misclassify poisoned samples with triggers. Because point clouds are typically randomly sampled before being input into the model, they are often sparse and irregular. This creates opportunities for attackers to inject backdoors. Attackers can exploit these characteristics and subtly modify the point cloud data to embed hidden triggers into the model. Furthermore, 3D point cloud models are often highly sensitive to local geometric features, which are crucial for identifying object shape and orientation. Attackers can insert backdoor triggers by subtly modifying specific local features. By exploiting these security vulnerabilities, backdoor attacks have become a significant threat in the field of 3D deep learning. Although existing backdoor attacks pose a significant threat to 3D point cloud models, research in this area still has the following shortcomings.

[0003] Existing research on backdoor attacks against 3D point cloud models can be broadly categorized into two types: traditional backdoor attacks and clean label backdoor attacks. In traditional backdoor attacks, poisoned point cloud data samples are typically constructed by inserting additional points with specific physical features to create triggers. These triggers are designed by the attacker to establish an association with the target label they pre-determine.

[0004] However, traditional backdoor attacks often cannot circumvent label detection due to their inherent label flipping step. To improve the stealth of attacks, subsequent work has proposed clean-label backdoor attacks targeting point cloud models. While existing research has verified the feasibility of clean-label backdoor attacks, their experiments are limited to transfer learning scenarios, where the pre-trained model used by the victim is fixed and known to the attacker. In transfer learning scenarios, an attacker can obtain an existing, trained model, fine-tune its parameters, and then implant a backdoor targeting these fixed parameters, making the backdoor effective for this specific model.

[0005] In contrast, a from-scratch training scenario involves the victim starting directly with randomly initialized model parameters, without relying on any external pre-trained weights. In this setting, the attacker knows neither the specific architectural details of the model nor the initial parameter distribution and training strategy. Each training session may produce different parameter combinations and feature representations. Research has shown that when clean-label backdoor attack methods designed only for transfer learning are applied to from-scratch training, these backdoors immediately become ineffective. This is because these attack methods assume that the attacker can design a trigger mechanism based on a known, trained model. In a from-scratch training scenario, the parameters and learning process of the target model are completely unknown to the attacker, making it impossible to guarantee that the backdoor trigger mechanism matches a specific model. Summary of the Invention

[0006] In view of this, the purpose of the present invention is to provide a clean label backdoor attack method and system for 3D point cloud models, which significantly improves the practicality and concealment of backdoor attacks, increases the probability of discovering model vulnerabilities, and provides an important reference for evaluating and improving the robustness and security of point cloud models in real environments.

[0007] To achieve the above objectives, the present invention adopts the following technical solution: a clean label backdoor attack method for 3D point cloud models, comprising the following steps:

[0008] S101: Obtain a clean dataset and randomly initialize model parameters, then deploy and train the model to obtain a proxy model.

[0009] S102: randomly selecting a source class dataset and a target class dataset, setting the shape and size parameters of the trigger, then optimizing the trigger insertion position to obtain the optimal insertion position, and finally inserting the trigger into the source class dataset to form a new source class dataset;

[0010] S103: Initialize the disturbance, where Indicates the number of perturbations, which are added to the target class dataset to form the initial poisoning dataset , the perturbation is optimized using the gradient alignment method, and the final perturbation is obtained through multiple rounds of iterative optimization ;

[0011] S104: The obtained disturbance Add it to the target class dataset, and then use the data selection strategy based on decision boundary distance to filter the target class dataset to obtain the final poisoning dataset;

[0012] S105: The poisoned dataset is mixed with the clean dataset to form a new dataset, and the model is trained using the new dataset to obtain a model containing a backdoor. The attack effectiveness is verified on the model, and the vulnerability is found if the attack is verified to be effective.

[0013] In a preferred embodiment, the step S101 specifically includes:

[0014] Get a clean dataset. Select 3D point cloud datasets, including ModelNet10, ModelNet40, and ShapeNet. These three datasets contain 10, 40, and 16 categories, respectively. Then initialize the model locally. Select PointNet, PointNet++, DGCNN, and PointCNN as the architectures. Set the number of model training rounds to 150 and the data training batch size to 128. Select the Adam algorithm as the optimizer. The initial value is 0.01, and it is reduced by 30% after every 30 rounds of training; the loss function of the model is the cross entropy loss function. , its mathematical expression is: , is a one-hot vector, Represents the output of the model; 2048 points are randomly sampled from each point cloud data to form training data; the mathematical expression of the model training process is:

[0015]

[0016] in is the set of model parameters, Indicates that the value calculated by the second half of the formula is assigned to the new theta. The model parameters will be updated and optimized in each round of training. Indicates the learning rate of the perturbation, usually set to 0.01; Represents the total number of training samples; Represents the gradient of the model parameters; i represents the sample, Indicates the total number of categories; Indicates the The one-hot encoding of the true label of the sample is The value of the dimension, Indicates the model The samples belong to The predicted probability of the class; finally, the attacker obtains the proxy model after 150 rounds of training.

[0017] In a preferred embodiment, the step S102 specifically includes:

[0018] Select the source data category and the target data category, then randomly insert a cluster of 300 regular spherical point clouds as triggers into the source data category point cloud data. Then load the proxy model trained in step S101 locally, and perform multiple rounds of iterations using a gradient-based position optimization method to obtain the optimal position for inserting the trigger. The mathematical expression of this optimization method is:

[0019]

[0020]

[0021] in represents the insertion position obtained by minimization and maximization. After the minimization trigger is inserted into the sample, the distribution distance between the trigger and each point in the original sample is minimized. Maximization means that after the trigger is inserted into the sample, the probability value output by the model for this sample should be as close as possible to the value of our attack target. Indicates an optional spatial position A three-dimensional continuous domain; is the Lagrange multiplier used to balance distance minimization and classification probability constraints; represents the total number of source category backdoor training samples used for optimization; Indicates location To the sample point cloud The Euclidean distance of Indicates that the trigger is at the insertion position The source category data is proxy model The logarithm of the probability of predicting the target category, p(*) represents the probability distribution of the model output, t represents the attacker's target category; m(X,c) represents the new sample formed after the trigger is inserted into the X sample at position c; the source category data is proxy model The logarithm of the probability of the prediction being the target class; Represents the proxy model obtained in S101; finally, after multiple rounds of iterative optimization, The optimal solution of Represents the sample label; argmin represents the value of the independent variable parameter c corresponding to the minimum value of the function; (*) indicates a user-defined function.

[0022] In a preferred embodiment, the step S103 specifically includes:

[0023] Randomly initialized perturbations , add it to the target class dataset to form the initial poisoning dataset, and load the proxy model , through the proxy model Computational poisoning dataset and the source dataset and its corresponding label one-hot vector The difference in model parameters The derivative of , and then calculate the mean square error between the two derivatives, and finally use the projected gradient descent method to optimize the perturbation so that the poisoned data set Establish a connection with the source class dataset where the trigger is inserted, and the model will subsequently pass the poisoned dataset The trigger information on the source class dataset is learned to implant the backdoor. During this optimization process, the proxy model is trained from scratch every 20 times the perturbation is optimized. Finally, after 200 updates and optimizations, the attack success rate reaches the highest value and tends to stabilize. The mathematical expression of this step is:

[0024]

[0025] Where MSE represents and The mean square error value of represents the gradient of the model parameters; represents the number of model parameters;

[0026]

[0027] in Poisoned Dataset The output of the model is the same as the source category one-hot vector The difference about The derivative of is the set of parameters of the model; Represents a proxy model; Indicates poisoned sample; represents the added disturbance; Indicates the number of poisoned samples;

[0028]

[0029] in Poisoned Dataset The output of the model is the one-hot vector of the target category The difference about The derivative of represents the number of target category samples, Represents a trigger for insert.

[0030] In a preferred embodiment, the step S104 specifically includes:

[0031] Loading Proxy Models , calculate the poisoned dataset through the proxy model The distance between each sample and the model decision boundary is counted and sorted, and finally the poisoning rate is calculated. Select the top-ranked data samples to form the final poisoning data set ; The calculation formula for the distance from the data sample to the model decision boundary is: , used to measure the sample Output to target category one-hot vector in the model distance.

[0032] In a preferred embodiment, the step S105 specifically includes:

[0033] The mixed new dataset is published to an open source platform for download, and then the dataset is used to train and deploy the model. The model architecture parameter settings are all random. After training, a 3D point cloud model with a backdoor is obtained. After the attack, the vulnerability of the 3D point cloud model is discovered.

[0034] The present invention also provides a clean label backdoor attack system for 3D point cloud models, which runs the clean label backdoor attack method for 3D point cloud models; it includes a victim, an attacker and a data set; the attacker first obtains a clean data set, randomly selects a source class data set and a target class data set, and extracts the source class data and the target class data from the data set, then performs gradient calculation locally through a proxy model to obtain the gradients of the source class data and the target class data, optimizes the perturbation using a gradient alignment technology, inserts the perturbation into the data set to form a poisoned data set, and then optimizes the poisoned data set using a data selection strategy, and then fuses the poisoned data set with the clean data set and publishes it on an open source platform for the victim to download and use. After the victim downloads the poisoned data set, it uses the poisoned data set for model training, and finally obtains a model with a backdoor. The attacker triggers the backdoor by inputting data with a pre-set trigger into the model, thereby achieving the purpose of the attack and ultimately detecting the vulnerability of the 3D point cloud model.

[0035] Compared to existing technologies, the present invention offers the following advantages: Existing backdoor attacks targeting 3D point cloud models suffer from the following drawbacks: Traditional backdoor attacks, due to their flipping of data labels, are easily detected by existing label-based defense mechanisms. While clean-label backdoor attacks address this drawback, existing clean-label backdoor attack methods often fail in de novo training scenarios due to randomly initialized model parameters, making them effective only under fine-tuning scenarios. This present invention, based on gradient alignment technology and a data selection strategy based on decision boundary distance, proposes the first clean-label backdoor attack targeting 3D point cloud models in de novo training scenarios. By employing a decision boundary-based data selection strategy, this invention achieves a 98.5% attack success rate with only 1.5% of the total dataset poisoned, compared to most existing attack methods, which typically set the poisoning rate to 5% to 9%, achieving only a maximum success rate of 90%. Furthermore, because it is a clean-label attack, it can easily bypass label-based defense mechanisms, making it the first effective clean-label backdoor attack targeting 3D point cloud models in de novo training scenarios. This paper proposes a general framework for clean-label backdoor attacks against point cloud deep learning models, provides a formal definition of the attack process, analyzes its effectiveness, and provides a concrete implementation. Experimental and theoretical analysis demonstrate that this approach, in a black-box setting independent of the victim model's architecture and parameters, maintains a high success rate, strong stealth, consistent labeling, and cross-model transfer capabilities. Compared with existing approaches, this approach significantly improves the practicality and stealth of backdoor attacks, increases the probability of discovering model vulnerabilities, and provides an important reference for evaluating and improving the robustness and security of point cloud models in real-world environments. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 A system model diagram of a preferred embodiment of the present invention;

[0037] Figure 2 A flowchart of a preferred embodiment of the present invention;

[0038] Figure 3 Schematic diagram of an application scenario of a preferred embodiment of the present invention. DETAILED DESCRIPTION

[0039] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0040] It should be noted that the following detailed descriptions are illustrative and intended to provide further explanation of the present application. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which the present application belongs.

[0041] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present application; as used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form, and it should be understood that when the terms "comprise" and / or "include" are used in this specification, they indicate the presence of features, steps, operations, devices, components and / or their combinations.

[0042] Clean label backdoor attack method and system for 3D point cloud models, reference Figure 1-3 In order to address the defects that most existing backdoor attacks on 3D point cloud models cannot bypass the defense mechanism based on label detection or fail to attack in the de novo training scenario, this invention proposes the first clean label backdoor attack on 3D point cloud models in the de novo training scenario based on gradient alignment technology and data selection strategy based on decision boundary distance. The present invention only needs to poison 1.5% of the total data set to achieve an attack success rate of 98.5%, while most of the existing attack methods set the poisoning rate to 5% to 9%, but the maximum attack success rate can only reach 90%. And because it is a clean label attack, it can easily disturb the defense mechanism based on label detection. Please refer to Figure 1 A clean label backdoor attack system for point cloud deep learning models mainly includes three entities: an attacker, a dataset, and a victim. The attacker first obtains a clean dataset, randomly selects source and target classes, and extracts the source and target data from the dataset. Then, after locally calculating the gradients of the source and target data using a proxy model, the attacker optimizes the perturbations using gradient alignment techniques and inserts the perturbations into the dataset to form a poisoned dataset. The poisoned dataset is then optimized using a data selection strategy. The poisoned dataset is then fused with the clean dataset and published on an open source platform for the victim to download and use. After downloading the poisoned dataset, the victim uses it to train the model, ultimately obtaining a model with a backdoor. The attacker triggers the backdoor by inputting data with pre-set triggers into the model, thereby achieving the purpose of the attack. In this invention, it is assumed that the attacker does not have access to the details of the parameters, architecture, and training process of the victim's model. That is, the proxy model used by the attacker when generating perturbations locally is random. Once the victim's model is trained and deployed, the attacker can insert triggers to selectively trigger the backdoor during testing.

[0043] Please refer to Figure 2 , a clean label backdoor attack method for 3D point cloud models, including the following steps:

[0044] S101. Obtain a clean dataset and randomly initialize model parameters, then deploy and train the model to obtain a proxy model.

[0045] S102: Randomly select the source class and target class, set the shape, size and other parameters of the trigger, then optimize the trigger insertion position to obtain the optimal insertion position, and finally insert the trigger into the source class dataset to form a new source class dataset. ;

[0046] S103, initialization disturbance ,in Indicates the number of perturbations, which are added to the target class dataset to form the initial poisoning dataset , using gradient alignment technology to optimize the perturbation, and obtaining the final perturbation through multiple rounds of iterative optimization ;

[0047] S104, the obtained disturbance Add it to the target class dataset, and then use the data selection strategy based on decision boundary distance to filter the dataset to obtain the final poisoning dataset;

[0048] S105. Mix the poisoned dataset with the clean dataset to form a new dataset, use the dataset to train the model, obtain a model containing a backdoor, and verify the effectiveness of the attack.

[0049] Furthermore, the above steps are detailed as follows:

[0050] The step S101 specifically includes:

[0051] The attacker first obtains a clean dataset. The datasets selected are the most popular 3D point cloud datasets, including ModelNet10, ModelNet40, and ShapeNet. These three datasets contain 10, 40, and 16 categories, respectively. Then, the model is initialized locally. The model architecture selection includes the mainstream PointNet, PointNet++, DGCNN, and PointCNN architectures. The number of model training rounds is set to 150, and the data training batch size is 128. The model optimizer selects the Adam algorithm. The learning rate The initial value is 0.01 and is adjusted down by 30% after every 30 rounds of training. The cross entropy loss function is selected as the loss function of the model, and its mathematical expression is: . Randomly sample 2048 points from each point cloud data to form training data. The mathematical expression of the model training process is:

[0052]

[0053] in It is a set of model parameters, which are updated and optimized in each round of training; Represents the total number of training samples; represents the gradient of the model parameters; Indicates the total number of categories; Indicates the The one-hot encoding of the true label of the sample is The value of the dimension, Indicates the model The samples belong to The predicted probability of the class (softmax output); finally, the attacker obtains the proxy model after 150 rounds of training.

[0054] In step S102, the attacker first selects the source data category and the target data category, then initializes the trigger and obtains the trigger position through algorithm optimization, specifically including:

[0055] The attacker first selects the source data category and the target data category, for example, pedestrians are selected as the source category and cars are selected as the target category. Then, a cluster of regular spherical point clouds with a size of 300 points is randomly inserted into the source category point cloud data as a trigger, and then the proxy model trained in step S101 is loaded locally. Multiple rounds of iterations are performed using a gradient-based position optimization method to obtain the optimal position to insert the trigger. The trigger insertion position obtained by this method is experimentally analyzed and evaluated, and compared with the random insertion method, it significantly improves the attack success rate of the present invention, and can increase the attack success rate by up to 20%. The mathematical expression of this optimization method is:

[0056]

[0057]

[0058] in represents the insertion position obtained by minimization and maximization (saddle point); Indicates an optional spatial position A three-dimensional continuous domain; is the Lagrange multiplier used to balance distance minimization and classification probability constraints; represents the total number of source category backdoor training samples used for optimization; Indicates location To the sample point cloud The Euclidean distance of Indicates that after the trigger is inserted at position c, the source category data is proxy model The logarithm of the probability of the prediction being the target class; Represents the proxy model obtained in S101; finally, after multiple rounds of iterative optimization, The optimal solution of .

[0059] In step S103, the attacker optimizes the perturbation using the gradient alignment technique, which specifically includes:

[0060] The attacker first randomly initializes the perturbation , add it to the target class dataset to form the initial poisoning dataset , load the proxy model , through the proxy model Computational poisoning dataset and source dataset Its corresponding label one-hot vector The difference in model parameters The derivative of , and then calculate the mean square error between the two derivatives, and finally use the projected gradient descent method to optimize the perturbation so that the poisoned data set and the source class dataset with the trigger inserted Once the connection is established, the model can subsequently learn the information about the trigger on the source class dataset through the poisoned dataset to implant the backdoor. During this optimization process, the proxy model will be trained from scratch every 20 times the perturbation is optimized. The purpose of this step is to prevent the perturbation from being overly dependent on the learning path and parameters of a certain model during the optimization process. This is one of the keys to the effectiveness of the present invention in the scenario of training from scratch. Finally, after 200 updates and optimizations, the attack success rate reaches the highest value and tends to stabilize. The mathematical expression of this step is:

[0061]

[0062] Where MSE represents and The mean square error value of Indicates the number of model parameters.

[0063]

[0064] in Poisoned Dataset The output of the model is the same as the source category one-hot vector The difference about The derivative of Indicates the number of poisoned samples.

[0065]

[0066] in Poisoned Dataset The output of the model is the one-hot vector of the target category The difference about The derivative of Indicates the number of target category samples.

[0067] In step S104, the attacker generates a poisoned data set using a data selection strategy based on decision boundary distance, specifically including:

[0068] The attacker first loads the proxy model , calculate the poisoned dataset through the proxy model The distance between each sample and the model decision boundary is counted and sorted, and finally the poisoning rate is calculated. Select the top-ranked data samples to form the final poisoning data set The calculation formula of the distance from the data sample to the model decision boundary is: , used to measure the sample Output to target category one-hot vector in the model distance.

[0069] In step S105, the attacker mixes the poisoned dataset with the original clean dataset to form a new dataset. The victim then uses the dataset to train and deploy the model. Finally, the attacker verifies the effectiveness of the attack, specifically including:

[0070] The attacker publishes the mixed new dataset to an open source platform for the victim to download. The victim then uses the dataset to train and deploy the model. The model architecture, parameters, and other settings used by the victim are all random, and a model with a backdoor is obtained after training. During the training process, the victim added the five most mainstream defense methods against point cloud backdoor attacks to detect the backdoor, but the final results show that none of these methods can effectively resist the attack method proposed by this invention, especially the defense method based on label detection. After the victim publishes the trained model online, the attacker inputs point cloud data with triggers, such as point cloud data of a pedestrian holding a ball, into the model. After the model recognizes the trigger, it activates the backdoor and misclassifies it as a car. At the same time, when clean point cloud data without triggers is input, the model performs normally, so it will not alert the victim, thereby increasing the concealment of the attack.

[0071] As can be seen from the above description, the present invention adopts a data selection strategy based on gradient alignment technology and decision boundary distance, and proposes the first clean label backdoor attack scheme for 3D point cloud models in a de novo training scenario. The present invention gives a formal definition and effectiveness analysis of its attack process, and provides a specific instantiation implementation. Experimental and theoretical analysis show that this method still has a high success rate, strong concealment, label consistency and cross-model migration capabilities in a black box setting that does not rely on the victim model architecture and parameters. Compared with existing solutions, it significantly improves the practicality and concealment of backdoor attacks, and provides an important reference for evaluating and improving the robustness and security of point cloud models in real environments.

[0072] This proposal aims to systematically expose potential vulnerabilities in existing 3D point cloud models, providing a new, quantifiable, and reproducible testing method for model security assessment. It also establishes a unified attack assessment framework, providing a testing method for subsequent performance comparison and effectiveness verification between different defense mechanisms. The ultimate goal is to use the proposed attack methods to promote the improvement of defense mechanisms, accelerate the improvement of 3D point cloud models, and thus build a more robust and trustworthy visual perception system.

[0073] The above descriptions are merely embodiments of the present invention and are not intended to limit the patent scope of the present invention. Any equivalent transformations made using the contents of the present invention's description and drawings, or directly or indirectly applied in related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A clean label backdoor attack method for 3D point cloud models, characterized by: Including steps: S101: Obtain a clean dataset and randomly initialize model parameters, then deploy and train the model to obtain a proxy model. S102: randomly selecting a source class dataset and a target class dataset, setting the shape and size parameters of the trigger, then optimizing the trigger insertion position to obtain the optimal insertion position, and finally inserting the trigger into the source class dataset to form a new source class dataset; S103: Initialize the disturbance, where Indicates the number of perturbations, which are added to the target class dataset to form the initial poisoning dataset , the perturbation is optimized using the gradient alignment method, and the final perturbation is obtained through multiple rounds of iterative optimization ; S104: The obtained disturbance Add it to the target class dataset, and then use the data selection strategy based on decision boundary distance to filter the target class dataset to obtain the final poisoning dataset; S105: The poisoned dataset is mixed with the clean dataset to form a new dataset. The model is trained using the new dataset to obtain a model containing a backdoor. The attack effectiveness is verified on the model. If the attack is effective, the vulnerability is found. The S103 specifically includes: Randomly initialized perturbations , add it to the target class dataset to form the initial poisoning dataset, and load the proxy model , through the proxy model Computational poisoning dataset and the source dataset and its corresponding label one-hot vector The difference in model parameters The derivative of , and then calculate the mean square error between the two derivatives, and finally use the projected gradient descent method to optimize the perturbation so that the poisoned data set Establish a connection with the source class dataset where the trigger is inserted, and the model will subsequently pass the poisoned dataset The trigger information on the source class dataset is learned to implant the backdoor. During this optimization process, the proxy model is trained from scratch every 20 times the perturbation is optimized. Finally, after 200 updates and optimizations, the attack success rate reaches the highest value and tends to stabilize. The mathematical expression of this step is: Where MSE represents and The mean square error value of represents the gradient of the model parameters; represents the number of model parameters; in Poisoned Dataset The output of the model is the same as the source category one-hot vector The difference about The derivative of is the set of parameters of the model; Represents a proxy model; Represents the target class sample; represents the added disturbance; Indicates the number of poisoned samples; in Poisoned Dataset The output of the model is the one-hot vector of the target category The difference about The derivative of represents the number of source category samples, Represents a trigger for insert.

2. The clean label backdoor attack method for 3D point cloud models according to claim 1 is characterized in that: The S101 specifically includes: Get a clean dataset. Select 3D point cloud datasets, including ModelNet10, ModelNet40, and ShapeNet. These three datasets contain 10, 40, and 16 categories, respectively. Then initialize the model locally. Select PointNet, PointNet++, DGCNN, and PointCNN as the architectures. Set the number of model training rounds to 150 and the data training batch size to 128. Select the Adam algorithm as the optimizer. The initial value is 0.01, and it is reduced by 30% after every 30 rounds of training; the loss function of the model is the cross entropy loss function. , its mathematical expression is: , is a one-hot vector, Represents the output of the model; 2048 points are randomly sampled from each point cloud data to form training data; the mathematical expression of the model training process is: in is the set of model parameters, Indicates that the value calculated by the second half of the formula is assigned to the new theta. The model parameters will be updated and optimized in each round of training. represents the learning rate of the perturbation, Represents the total number of training samples; Represents the gradient of the model parameters; i represents the sample, Indicates the total number of categories; Indicates the The one-hot encoding of the true label of the sample is The value of the dimension, Indicates the model The samples belong to The predicted probability of the class; finally, the attacker obtains the proxy model after 150 rounds of training.

3. The clean label backdoor attack method for 3D point cloud models according to claim 1 is characterized in that: The S102 specifically includes: Select the source data category and the target data category, then randomly insert a cluster of 300 regular spherical point clouds as triggers into the source data category point cloud data. Then load the proxy model trained in step S101 locally, and perform multiple rounds of iterations using a gradient-based position optimization method to obtain the optimal position for inserting the trigger. The mathematical expression of this optimization method is: in Represents the insertion position obtained by minimization and maximization. Minimization means that after the trigger is inserted into the sample, the distribution distance between the trigger and each point in the original sample is minimized. Maximization means that after the trigger is inserted into the sample, the probability value output by the model for this sample should be as close to the value of the attack target as possible. Indicates an optional spatial position A three-dimensional continuous domain; is the Lagrange multiplier used to balance distance minimization and classification probability constraints; represents the total number of source category backdoor training samples used for optimization; Indicates location To the sample point cloud The Euclidean distance of Indicates that the trigger is at the insertion position The source category data is proxy model The logarithm of the probability of predicting the target category, p(*) represents the probability distribution of the model output, t represents the attacker's target category; m(X,c) represents the new sample formed after the trigger is inserted into the X sample at position c; the source category data is proxy model The logarithm of the probability of the prediction being the target class; Represents the proxy model obtained in S101; finally, after multiple rounds of iterative optimization, The optimal solution of Represents the sample label; argmin represents the value of the independent variable parameter c corresponding to the minimum value of the function; (*) indicates a user-defined function.

4. The clean label backdoor attack method for 3D point cloud models according to claim 1 is characterized in that: The S104 specifically includes: Loading Proxy Models , calculate the poisoned dataset through the proxy model The distance between each sample and the model decision boundary is counted and sorted, and finally the poisoning rate is calculated. Select the top-ranked data samples to form the final poisoning data set ; The calculation formula for the distance from the data sample to the model decision boundary is: , used to measure the sample Output to target category one-hot vector in the model distance.

5. The clean label backdoor attack method for 3D point cloud models according to claim 1 is characterized in that: The S105 specifically includes: The mixed new dataset is published to an open source platform for download, and then the dataset is used to train and deploy the model. The model architecture parameter settings are all random. After training, a 3D point cloud model with a backdoor is obtained. After the attack, the vulnerability of the 3D point cloud model is discovered.

6. A clean label backdoor attack system for 3D point cloud models, characterized by: Running the clean label backdoor attack method for 3D point cloud models described in any one of claims 1 to 5 above; It includes victims, attackers, and data sets; the attacker first obtains a clean data set, randomly selects a source class data set and a target class data set, and extracts the source class data and the target class data from the data set. Then, the attacker performs gradient calculation locally through a proxy model to obtain the gradients of the source class data and the target class data. After optimizing the perturbation using gradient alignment technology, the perturbation is inserted into the data set to form a poisoned data set. The poisoned data set is then optimized using a data selection strategy. The poisoned data set is then fused with the clean data set and published on an open source platform for victims to download and use. After downloading the poisoned data set, the victim uses the poisoned data set for model training, and finally obtains a model with a backdoor. The attacker triggers the backdoor by inputting data with pre-set triggers into the model, thereby achieving the purpose of the attack and ultimately detecting the vulnerability of the 3D point cloud model.

Images