Adversarial Attack Methods for 3D Point Clouds Guided by LiDAR

Abstract

This invention relates to a method for adversarial attacks on 3D point clouds guided by lidar. The method divides the original point cloud into multiple spatial regions, evaluates the contribution of each region to the classification decision, and selects the region with the highest contribution as the salient region. Within the salient region, the saliency score of each point is calculated, and the top K points with the highest saliency scores are dynamically selected to form a perturbation subset. This subset is then subjected to a spatially compact perturbation operation, and a multi-distance joint regularization mechanism is introduced to maintain geometric consistency during the perturbation process, generating adversarial point cloud samples with both stealth and attack strength. This method is advantageous for generating adversarial samples with higher stealth and attack strength, achieving a higher attack success rate, and effectively maintaining geometric consistency between the adversarial samples and the original point cloud.

Description

Technical Field

[0001] This invention relates to the field of counter-attack technology, specifically to a method for counter-attacks on three-dimensional point clouds guided by lidar. Background Technology

[0002] 3D point cloud adversarial attacks refer to techniques that add minute perturbations to raw point cloud data to interfere with the deep neural network's recognition and classification, thereby inducing the model to make incorrect decisions. While this method can enhance model robustness, it may pose serious risks in safety-critical scenarios such as autonomous driving and robotics.

[0003] In existing technologies, much research focuses on point-based perturbation methods, gradually developing a series of specific strategies. One fundamental method is global point perturbation based on gradient direction. Liu et al. proposed directly applying the Fast Gradient Method (FGM) to point clouds. By calculating the gradient of the loss function with respect to point locations and, under L2 norm constraints, slightly shifting each point in the gradient direction, they perturb the overall point cloud. Xiang et al. further proposed a C&W attack framework suitable for point clouds, optimizing the perturbed point cloud by minimizing the perturbation distance of points and maximizing the target loss. Based on this, they designed two types of insertion attacks: cluster-level point insertion, which inserts a group of neighboring points into the original point cloud to form small clumps, causing interference in the local space; and object-level insertion, which enhances the attack capability by introducing complete 3D structural fragments (such as a portion of an object's outline). These methods all rely on optimizing the perturbation objective function and inserting intervention structures into the point space. Zheng et al. constructed a saliency map by calculating the gradient sensitivity of each point, identifying points with high contribution values ​​as key points. Subsequently, attacks that minimize structural damage are achieved by removing these points or pulling them towards the centroid of the entire point cloud. Wen et al. proposed a geometrically perceptive regularization method to improve the naturalness and local coherence of adversarial perturbations. This method introduces two geometric constraints into the adversarial objective function: minimizing local curvature changes to maintain the smoothness of the point cloud surface; and controlling structural smoothness to prevent abrupt changes in local regions. This method effectively suppresses outliers and obvious distortions. Cai et al. adopted a similar approach, introducing a geometric regularization term, but emphasizing the use of the local structural priors of the point cloud. They analyzed the K-neighborhood structure of each point to maintain the neighborhood topology unchanged during perturbation, thus ensuring that local perturbations do not affect the overall shape perception. Tsai et al. proposed a KNN-based regularization mechanism embedded in the C&W framework. This mechanism constrains the neighborhood distance relationship between each perturbed point and its original point, making the perturbed points compactly distributed in the local space while suppressing the formation of outliers. At the spatial transformation level, Huang et al. proposed a tangential plane perturbation method. This method first locally fits a tangent plane to each point and transforms the perturbation space from a 3D coordinate system to a tangent plane coordinate system. In the new coordinate system, the perturbation occurs only along the tangent plane direction, thus better controlling the perturbation direction and maintaining the continuity of the point cloud surface. Kim et al. designed a lightweight perturbation method that focuses on perturbing or inserting only a very small number of points and sets a point number threshold for limitation. By constraining the perturbation ratio, this method improves the imperceptibility of attacks and is suitable for practical applications requiring stealth.

[0004] However, existing adversarial attack methods for 3D point clouds still have the following problems: 1) Some existing point-based adversarial attack methods select a small number of high-contribution points for perturbation through saliency analysis, aiming to improve attack efficiency and control the perturbation range. However, since these salient points are usually scattered in the point cloud, lacking spatial aggregation and global structural constraints, the perturbation exhibits a discontinuous and chaotic form, destroying the consistency of the local geometric structure and thus reducing the imperceptibility of the adversarial example. 2) Existing methods that introduce geometric regularization perturbation constraints still have the problem of lax geometric consistency control in practical applications. Most methods only apply constraints within a local range, making it difficult to maintain the structural integrity of the perturbation region as a whole. This easily leads to local geometric distortion and the generation of outliers, causing the adversarial example to deviate from the original point cloud in overall shape, affecting its naturalness and physical realizability. Summary of the Invention

[0005] The purpose of this invention is to provide a three-dimensional point cloud adversarial attack method for lidar guidance. This method is beneficial for generating adversarial samples with higher concealment and attack strength, achieving a higher attack success rate, and effectively maintaining the geometric consistency between the adversarial samples and the original point cloud.

[0006] To achieve the above objectives, the technical solution adopted in this invention is: a three-dimensional point cloud adversarial attack method for lidar guidance, which divides the original point cloud into multiple spatial regions, evaluates the contribution value of each region to the classification decision, and selects the region with the highest contribution as the salient region; calculates the saliency score of each point within the salient region, dynamically selects the top K points with the highest saliency scores to form a perturbation subset; performs a spatial compact perturbation operation on the subset, and introduces a multi-distance joint regularization mechanism to maintain the geometric structure consistency during the perturbation process, thereby generating adversarial point cloud samples with concealment and attack strength.

[0007] Furthermore, the method specifically includes the following steps:

[0008] S1: Load the original point cloud data and its corresponding label information as the input basis for the attack, and load the weight parameters of the model to be attacked.

[0009] S2: Initialize the adversarial point cloud, copy the original point cloud as the initial adversarial sample, and initialize the perturbation offset to zero;

[0010] S3: Apply the farthest point sampling method to the original point cloud to obtain m points as the center points of the spatial region; then, according to the distance relationship between each point and these center points, assign each point to the region corresponding to the nearest center point to realize the spatial division of the entire point cloud;

[0011] S4: Calculate the geometric center of the entire point cloud as a reference benchmark for subsequent perturbation simulation; use a full permutation strategy to sample each region multiple times; during each sampling, move all points in each region to the geometric center of the point cloud to simulate the removal of that region, calculate the marginal contribution value of each region, and thus quantify the impact of that region on the model output.

[0012] S5: Sort each region according to its marginal contribution value, select the K regions with the highest marginal contribution value as the salient regions, calculate the significance score of the points in the salient regions, and extract the K points with the highest significance scores as the perturbation objects to form the perturbation subset.

[0013] S6: Iteratively calculate the gradient of the current state of the adversarial point cloud with respect to the model's total loss function, and extract the sign information of the gradient to determine the direction of the perturbation;

[0014] S7: Calculate the perturbation amount based on the gradient ratio of the three-dimensional coordinate axes, combined with the perturbation intensity coefficient and the region index weight, and update the perturbation subset and the adversarial point cloud.

[0015] S8: Repeat steps S3 to S7 until the maximum number of iterations is reached, and output the adversarial point cloud sample with the minimum loss.

[0016] Furthermore, in step S5, the specific method for calculating the saliency score of points within the salient region is as follows:

[0017] (1)

[0018] Among them, I i Let represent the significance score of the i-th point, where the subscript i indicates the i-th point, and λ1, λ2, λ3, and λ4 all represent weighting coefficients used to balance the contributions of different terms; This represents the resistance strength parameter against disturbance at the i-th point; This represents the consistency parameter of the perturbation direction at the i-th point; This represents the shape change intensity parameter at the i-th point; This represents the perturbation stability parameter at the i-th point;

[0019] Extract the top K points with the highest significance scores within the significant region to form a perturbation subset; and define the ratio of the perturbation subset to the total number of points within the significant region as p_ratio.

[0020] Furthermore, the anti-disturbance strength parameter The calculation formula is shown in equation (2):

[0021] (2)

[0022] in, The resistance perturbation strength parameter at the i-th point is measured by the gradient vector norm. , , These represent the components of the gradient at the i-th point along the x-axis, y-axis, and z-axis, respectively.

[0023] The disturbance direction consistency parameter The calculation formula is shown in equation (3):

[0024] (3)

[0025] in, The perturbation direction consistency parameter for the i-th point is measured by the cosine of the angle between the gradient direction of the i-th point and the vector pointing to the geometric center of the point cloud, reflecting whether the perturbation deviates from the overall structure. This represents the vector pointing from the i-th point to the geometric center; Indicates the gradient direction at the i-th point;

[0026] The shape change intensity parameter The calculation formula is shown in equation (4):

[0027] (4)

[0028] in, Let be the shape change intensity parameter of the i-th point, measured by the Euclidean distance between the i-th point and the geometric center of the point cloud; c represents the geometric center of the point cloud; p i This represents the coordinates of the i-th point;

[0029] The disturbance stability parameters The calculation formula is shown in equation (5):

[0030] (5)

[0031] in, Let be the perturbation stability parameter for the i-th point; std represents the standard deviation function, mean represents the absolute value average function, and ε is the set minimum value.

[0032] Furthermore, the specific method for generating adversarial point clouds is as follows:

[0033] For the j-th point in the original point cloud, first determine whether it belongs to the perturbation subset within the salient region; then calculate the gradient grad of that point under the current classification target, and take its sign sign(grad) to represent the perturbation direction; next, based on the 3D coordinate axis perturbation ratio Ration, perturbation strength parameter eps_strength, perturbation offset, and salient region index Region... idxTogether, they determine the direction and magnitude of the perturbation; finally, they add the perturbation to the coordinates of the current point as the perturbation result for that point in the i-th iteration.

[0034] The expression for the disturbance is shown in equation (6):

[0035] (6)

[0036] in, Represents the original point cloud. This represents the adversarial point cloud, where idx is the index of the salient region; during the iterative optimization process, the perturbation intensity is dynamically adjusted according to the proportion of selected perturbation points; the perturbation intensity eps_strength is calculated using formula (7):

[0037] (7)

[0038] Wherein, min_eps represents the lower limit of attack strength, and max_eps represents the upper limit of attack strength; min_eps, max_eps, and k are all predefined constants; the attack strength is dynamically adjusted according to the ratio p_ratio of the total number of points in the perturbation subset to the total number of points in the salient region.

[0039] Furthermore, in step S6, the expression for the total loss function is shown in equation (8):

[0040] (8)

[0041] (9)

[0042] in, Represents the original point cloud. Represents an adversarial point cloud; This represents the adversarial loss function, which quantifies the effectiveness of the attack. To constrain the magnitude of the perturbation and ensure imperceptibility, a regularization term is constructed from multiple geometric distances, including Chamfer distance, Hausdorff distance, and L2 distance; hyperparameters Used to balance the attack effect with the disturbance magnitude; , , These are all hyperparameters used to control the weight of each loss.

[0043] Furthermore, the expressions for the Chamfer distance, Hausdorff distance, and L2 distance are shown in equations (10), (11), and (12), respectively:

[0044] (10)

[0045] (11)

[0046] (12)

[0047] Where a represents a point in the adversarial point cloud, b represents a point in the original point cloud, and n is the number of points in the point cloud sample.

[0048] Furthermore, this method is applied to UAV navigation and obstacle avoidance based on lidar guidance, as well as autonomous driving of vehicles based on lidar guidance. By generating adversarial point cloud samples with high concealment and attack strength, it interferes with the training of target detection and tracking models in lidar guidance systems, thereby generating target detection and tracking models with higher robustness.

[0049] The present invention also provides a computer device, comprising: at least one processor, at least one memory, and computer program instructions stored in the memory, wherein when the computer program instructions are executed by the processor, they are used to implement the above-described adversarial point cloud generation method, including steps such as calculating the saliency score of salient regions and multi-distance constraint optimization.

[0050] The present invention also provides a computer-readable storage medium storing computer program instructions thereon, which, when executed by a processor, are used to implement the above-described adversarial point cloud generation method.

[0051] Compared with existing technologies, this invention has the following advantages: This invention proposes a 3D point cloud adversarial attack method based on saliency-driven perturbation and distance constraints. This method can achieve efficient attack results without significantly damaging the point cloud geometry. By identifying local regions in the point cloud that significantly influence classification decisions and selecting highly saliency key points within these regions for perturbation, the effectiveness and imperceptibility of adversarial examples are improved. Furthermore, this invention designs a dynamic perturbation strategy that adaptively adjusts the number and amplitude of perturbation points according to the saliency distribution, achieving fine-grained perturbation of key regions and further enhancing the stealth and adaptability of the attack. During the optimization process, this invention introduces a multi-distance joint constraint mechanism to constrain the perturbation process, effectively maintaining the integrity and spatial continuity of the point cloud structure while improving the success rate of point cloud adversarial attacks. This method is specifically applied in fields such as autonomous driving systems, UAV navigation, and robot perception, effectively simulating adversarial interference attacks that lidar sensors may suffer in real-world environments, helping to improve the robustness and security of target recognition and path planning algorithms. By generating highly covert adversarial examples, it can be used for security assessment and protection strategy verification of LiDAR data processing modules, promoting the reliable operation of related systems in complex dynamic environments, thereby solving the problems of perception accuracy and safety assurance for autonomous vehicles and drones under complex traffic and harsh weather conditions. Attached Figure Description

[0052] Figure 1 This is a general framework diagram of the method according to an embodiment of the present invention. Detailed Implementation

[0053] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0054] It should be noted that the following detailed descriptions are exemplary and intended to provide further explanation of this application. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains.

[0055] It should be noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the exemplary embodiments according to this application. As used herein, the singular form is intended to include the plural form as well, unless the context clearly indicates otherwise. Furthermore, it should be understood that when the terms "comprising" and / or "including" are used in this specification, they indicate the presence of features, steps, operations, devices, components, and / or combinations thereof.

[0056] This embodiment provides a method for adversarial attacks on 3D point clouds guided by lidar. The method divides the original point cloud into multiple spatial regions, evaluates the contribution of each region to the classification decision, and selects the region with the highest contribution as the salient region. Within the salient region, the saliency score of each point is calculated, and the top K points with the highest saliency scores are dynamically selected to form a perturbation subset. This subset is then subjected to a spatially compact perturbation operation, and a multi-distance joint regularization mechanism is introduced to maintain geometric consistency during the perturbation process, generating adversarial point cloud samples with both stealth and attack strength. Figure 1 As shown, the method is executed in the following steps.

[0057] S1: Load the original point cloud data and its corresponding label information as the input basis for the attack, and load the weight parameters of the model to be attacked.

[0058] S2: Initialize the adversarial point cloud, copy the original point cloud as the initial adversarial sample, and initialize the perturbation offset to zero;

[0059] S3: Apply the farthest point sampling (FPS) method to the original point cloud to obtain m points as the center points of the spatial region; then, according to the distance relationship between each point and these center points, assign each point to the region corresponding to the nearest center point to realize the spatial division of the entire point cloud.

[0060] S4: Calculate the geometric center of the entire point cloud as a reference benchmark for subsequent perturbation simulation; use a full permutation strategy to sample each region multiple times; during each sampling, move all points in each region to the geometric center of the point cloud to simulate the situation where the region is "removed", calculate the marginal contribution value of each region, and thus quantify the impact of the region on the model output.

[0061] S5: Sort the regions according to their marginal contribution values, select the top K regions with the highest marginal contribution values ​​as salient regions, calculate the significance scores of the points within the salient regions, and extract the top K points with the highest significance scores as perturbation objects to form a perturbation subset.

[0062] The specific method for calculating the significance score of points within the significant region is as follows:

[0063] (1)

[0064] Among them, I i Let represent the significance score of the i-th point, where the subscript i indicates the i-th point, and λ1, λ2, λ3, and λ4 all represent weighting coefficients used to balance the contributions of different terms; This represents the resistance strength parameter against disturbance at the i-th point; This represents the consistency parameter of the perturbation direction at the i-th point; This represents the shape change intensity parameter at the i-th point; This represents the perturbation stability parameter at the i-th point.

[0065] The anti-disturbance strength parameter The calculation formula is shown in equation (2):

[0066] (2)

[0067] in, The resistance perturbation strength parameter at the i-th point is measured by the gradient vector norm. , , These represent the components of the gradient at the i-th point along the x-axis, y-axis, and z-axis, respectively.

[0068] The disturbance direction consistency parameter The calculation formula is shown in equation (3):

[0069] (3)

[0070] in, The perturbation direction consistency parameter for the i-th point is measured by the cosine of the angle between the gradient direction of the i-th point and the vector pointing to the geometric center of the point cloud, reflecting whether the perturbation deviates from the overall structure. This represents the vector pointing from the i-th point to the geometric center; This represents the gradient direction at the i-th point.

[0071] The shape change intensity parameter The calculation formula is shown in equation (4):

[0072] (4)

[0073] in, Let be the shape change intensity parameter for the i-th point, measured by the Euclidean distance between the i-th point and the geometric center of the point cloud. The greater the distance, the greater the potential impact of the perturbation on the overall shape; points farther from the center are more likely to cause significant deformation of the overall shape. c represents the geometric center of the point cloud; p i This represents the coordinates of the i-th point.

[0074] The disturbance stability parameters The calculation formula is shown in equation (5):

[0075] (5)

[0076] in, is the perturbation stability parameter for the i-th point, used to evaluate the stability of the perturbation direction at that point. The smaller the value, the more stable and reliable the gradient direction is, while the larger the value, the more likely the point is in a locally unstable or noise-sensitive region. std represents the standard deviation function, mean represents the absolute value average function, and ε is a set minimum value. ε is close to 0 to avoid numerical instability problems caused by a zero denominator.

[0077] Extract the top K points with the highest significance scores within the significant region to form a perturbation subset; and define the ratio of the perturbation subset to the total number of points within the significant region as p_ratio.

[0078] In this embodiment, the specific method for generating adversarial point clouds is as follows:

[0079] For the j-th point in the original point cloud, first determine whether it belongs to the perturbation subset within the salient region; then calculate the gradient grad of that point under the current classification target, and take its sign sign(grad) to represent the perturbation direction; next, based on the 3D coordinate axis perturbation ratio Ration, perturbation strength parameter eps_strength, perturbation offset, and salient region index Region... idx Together, they determine the direction and magnitude of the perturbation; finally, they add the perturbation to the coordinates of the current point as the perturbation result for that point in the i-th iteration.

[0080] The expression for the disturbance is shown in equation (6):

[0081] (6)

[0082] in, Represents the original point cloud. This represents the adversarial point cloud, where idx is the index of the salient region; during the iterative optimization process, the perturbation intensity is dynamically adjusted according to the proportion of selected perturbation points; the perturbation intensity eps_strength is calculated using formula (7):

[0083] (7)

[0084] Wherein, min_eps represents the lower limit of attack strength, and max_eps represents the upper limit of attack strength; min_eps, max_eps, and k are all predefined constants; the attack strength is dynamically adjusted according to the ratio p_ratio of the total number of points in the perturbation subset to the total number of points in the salient region.

[0085] S6: Iteratively calculate the gradient of the current state of the adversarial point cloud with respect to the model's total loss function, and extract the sign information of the gradient to determine the direction of the perturbation.

[0086] The expression for the total loss function is shown in equation (8):

[0087] (8)

[0088] (9)

[0089] in, Represents the original point cloud. Represents an adversarial point cloud; This represents the adversarial loss function, which quantifies the effectiveness of the attack. To constrain the magnitude of the perturbation and ensure imperceptibility, a regularization term is constructed from multiple geometric distances, including Chamfer distance, Hausdorff distance, and L2 distance; hyperparameters Used to balance the attack effect with the disturbance magnitude; , , These are all hyperparameters used to control the weight of each loss.

[0090] The expressions for the Chamfer distance, Hausdorff distance, and L2 distance are shown in equations (10), (11), and (12), respectively:

[0091] (10)

[0092] (11)

[0093] (12)

[0094] Where a represents a point in the adversarial point cloud, b represents a point in the original point cloud, and n is the number of points in the point cloud sample.

[0095] S7: Calculate the perturbation amount based on the gradient ratio of the three-dimensional coordinate axes, combined with the perturbation intensity coefficient and the region index weight, and update the perturbation subset and the adversarial point cloud.

[0096] S8: Repeat steps S3 to S7 until the maximum number of iterations is reached, and output the adversarial point cloud sample with the minimum loss.

[0097] The three-dimensional point cloud adversarial attack method for lidar guidance provided by this invention can be applied to fields such as lidar-guided UAV navigation and obstacle avoidance, and lidar-guided autonomous driving of vehicles. This method addresses the problems of insufficient robustness and lack of protection against adversarial examples in lidar point cloud target recognition. By generating adversarial point cloud samples with high concealment and attack strength, it interferes with the training of target detection and tracking models in lidar guidance systems, thereby generating target detection and tracking models with higher robustness and improving the security and reliability of lidar guidance systems.

[0098] The proposed method for countering attacks on 3D point clouds guided by lidar addresses the problem in existing technologies where it is often difficult to balance attack effectiveness with geometric fidelity in countering disturbances. It mainly includes the following key technologies:

[0099] First, a perturbation strategy based on saliency analysis is proposed. By calculating the importance of each local region in the point cloud to the classification decision, the most influential salient region on the model judgment is accurately identified. Based on this, key points with strong saliency are selected as perturbation targets to achieve fine perturbation operation on points within a limited area, which significantly improves perturbation efficiency. At the same time, it maintains a high degree of visual consistency between the adversarial point cloud and the original point cloud, enhancing the imperceptibility of adversarial examples.

[0100] Secondly, a dynamic perturbation mechanism is designed to adaptively adjust the number of perturbation points and the perturbation amplitude in each round according to the saliency distribution, so that the perturbation strategy can change flexibly according to the current point cloud features, effectively control the spatial distribution range of the perturbation, thereby improving the attack stability and generalization ability in different scenarios.

[0101] Third, a multi-distance joint constraint mechanism is constructed. During the optimization process, multiple geometric metrics such as Chamfer distance, Hausdorff distance and L2 distance are introduced as joint regularization terms to guide the perturbation direction, maintain the geometric structure continuity of the point cloud, further enhance the naturalness of adversarial examples at the visual and structural levels, and balance the effectiveness of the attack with the fidelity of the structure.

[0102] This invention, through the synergy and close integration of the above key technologies, constructs a complete adversarial attack method for 3D point clouds based on saliency-driven and multiple distance constraints, and oriented towards lidar guidance. Experimental evaluation on point cloud classification datasets such as ModelNet40 and ShapeNet Part shows that this method significantly outperforms existing methods in terms of attack success rate and imperceptibility.

[0103] While existing point-based adversarial attack methods employ various regularization strategies to enhance the imperceptibility of perturbations, they still have certain shortcomings. They often result in scattered perturbation distributions, outliers, or unreasonable geometric deformations, thereby affecting the realism of the point cloud structure and the stealth of the attack sample. To address this, this invention innovatively proposes a 3D point cloud adversarial attack method. Based on saliency analysis, this method dynamically perturbs key points within salient regions, adaptively controlling the number and amplitude of perturbation points while maintaining the spatial concentration of the perturbation region. This effectively reduces geometric distortion, enhances the naturalness and imperceptibility of the adversarial sample, and achieves a more stable and practically applicable point cloud adversarial attack effect.

[0104] This embodiment also provides a computer device, including: at least one processor, at least one memory, and computer program instructions stored in the memory. When the computer program instructions are executed by the processor, they are used to implement the above-described adversarial point cloud generation method, including steps such as calculating the saliency score of salient regions and multi-distance constraint optimization.

[0105] This embodiment also provides a computer-readable storage medium storing computer program instructions, which, when executed by a processor, are used to implement the above-described adversarial point cloud generation method.

[0106] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0107] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0108] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0109] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0110] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention in any other way. Any person skilled in the art may make changes or modifications to the above-disclosed technical content to create equivalent embodiments. However, any simple modifications, equivalent changes, and modifications made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the protection scope of the present invention.

Claims

1. A method for countering attacks on 3D point clouds guided by lidar, characterized in that, The original point cloud is divided into multiple spatial regions. The contribution of each region to the classification decision is evaluated, and the region with the highest contribution is selected as the salient region. The saliency score of each point in the salient region is calculated, and the top K points with the highest saliency scores are dynamically selected to form a perturbation subset. The subset is subjected to spatial compact perturbation operation, and a multi-distance joint regularization mechanism is introduced to maintain the geometric structure consistency during the perturbation process, generating adversarial point cloud samples with concealment and attack strength. Specifically, the following steps are included: S1: Load the original point cloud data and its corresponding label information as the input basis for the attack, and load the weight parameters of the model to be attacked. S2: Initialize the adversarial point cloud, copy the original point cloud as the initial adversarial sample, and initialize the perturbation offset to zero; S3: Apply the farthest point sampling method to the original point cloud to obtain m points as the center points of the spatial region; then, according to the distance relationship between each point and these center points, assign each point to the region corresponding to the nearest center point to realize the spatial division of the entire point cloud; S4: Calculate the geometric center of the entire point cloud as a reference benchmark for subsequent perturbation simulation; use a full permutation strategy to sample each region multiple times; during each sampling, move all points in each region to the geometric center of the point cloud to simulate the removal of that region, calculate the marginal contribution value of each region, and thus quantify the impact of that region on the model output. S5: Sort each region according to its marginal contribution value, select the K regions with the highest marginal contribution value as the salient regions, calculate the significance score of the points in the salient regions, and extract the K points with the highest significance scores as the perturbation objects to form the perturbation subset. S6: Iteratively calculate the gradient of the current state of the adversarial point cloud with respect to the model's total loss function, and extract the sign information of the gradient to determine the direction of the perturbation; S7: Calculate the perturbation amount based on the gradient ratio of the three-dimensional coordinate axes, combined with the perturbation intensity coefficient and the region index weight, and update the perturbation subset and the adversarial point cloud. S8: Repeat steps S3 to S7 until the maximum number of iterations is reached, and output the adversarial point cloud sample with the minimum loss. In step S5, the specific method for calculating the saliency score of points within the salient region is as follows: (1) Among them, I i Let represent the significance score of the i-th point, where the subscript i indicates the i-th point, and λ1, λ2, λ3, and λ4 all represent weighting coefficients used to balance the contributions of different terms; This represents the resistance strength parameter against disturbance at the i-th point; This represents the consistency parameter of the perturbation direction at the i-th point; This represents the shape change intensity parameter at the i-th point; This represents the perturbation stability parameter at the i-th point; Extract the top K points with the highest significance scores within the significant region to form a perturbation subset; and define the ratio of the perturbation subset to the total number of points within the significant region as p_ratio.

2. The method for countering attacks on three-dimensional point clouds guided by lidar according to claim 1, characterized in that, The anti-disturbance strength parameter The calculation formula is shown in equation (2): (2) in, The resistance perturbation strength parameter at the i-th point is measured by the gradient vector norm. , , These represent the components of the gradient at the i-th point along the x-axis, y-axis, and z-axis, respectively. The disturbance direction consistency parameter The calculation formula is shown in equation (3): (3) in, The perturbation direction consistency parameter for the i-th point is measured by the cosine of the angle between the gradient direction of the i-th point and the vector pointing to the geometric center of the point cloud, reflecting whether the perturbation deviates from the overall structure. This represents the vector pointing from the i-th point to the geometric center; Indicates the gradient direction at the i-th point; The shape change intensity parameter The calculation formula is shown in equation (4): (4) in, Let be the shape change intensity parameter of the i-th point, measured by the Euclidean distance between the i-th point and the geometric center of the point cloud; c represents the geometric center of the point cloud; p i This represents the coordinates of the i-th point; The disturbance stability parameters The calculation formula is shown in equation (5): (5) in, Let be the perturbation stability parameter for the i-th point; std represents the standard deviation function, mean represents the absolute value average function, and ε is the set minimum value.

3. The method for countering attacks on three-dimensional point clouds guided by lidar according to claim 1, characterized in that, The specific method for generating adversarial point clouds is as follows: For the j-th point in the original point cloud, first determine whether it belongs to the perturbation subset within the salient region; then calculate the gradient grad of that point under the current classification target, and take its sign sign(grad) to represent the perturbation direction; next, based on the 3D coordinate axis perturbation ratio Ration, perturbation strength parameter eps_strength, perturbation offset, and salient region index Region... idx Together, they determine the direction and magnitude of the perturbation; finally, they add the perturbation to the coordinates of the current point as the perturbation result for that point in the i-th iteration. The expression for the disturbance is shown in equation (6): (6) in, Represents the original point cloud. This represents the adversarial point cloud, where idx is the index of the salient region; during the iterative optimization process, the perturbation intensity is dynamically adjusted according to the proportion of selected perturbation points; the perturbation intensity eps_strength is calculated using formula (7): (7) Wherein, min_eps represents the lower limit of attack strength, and max_eps represents the upper limit of attack strength; min_eps, max_eps, and k are all predefined constants; the attack strength is dynamically adjusted according to the ratio p_ratio of the total number of points in the perturbation subset to the total number of points in the salient region.

4. The method for countering attacks on three-dimensional point clouds guided by lidar according to claim 1, characterized in that, In step S6, the expression for the total loss function is shown in equation (8): (8) (9) in, Represents the original point cloud. Represents an adversarial point cloud; This represents the adversarial loss function, which quantifies the effectiveness of the attack. To constrain the magnitude of the perturbation and ensure imperceptibility, a regularization term is constructed from multiple geometric distances, including Chamfer distance, Hausdorff distance, and L2 distance; hyperparameters Used to balance the attack effect with the disturbance magnitude; , , These are all hyperparameters used to control the weight of each loss.

5. The method for countering attacks on three-dimensional point clouds guided by lidar according to claim 4, characterized in that, The expressions for the Chamfer distance, Hausdorff distance, and L2 distance are shown in equations (10), (11), and (12), respectively: (10) (11) (12) Where a represents a point in the adversarial point cloud, b represents a point in the original point cloud, and n is the number of points in the point cloud sample.

6. The method for countering attacks on three-dimensional point clouds guided by lidar according to any one of claims 1-5, characterized in that, This method is applied to UAV navigation and obstacle avoidance based on lidar guidance, as well as autonomous driving of vehicles based on lidar guidance. By generating adversarial point cloud samples with high concealment and attack strength, it interferes with the training of target detection and tracking models in lidar guidance systems, thereby generating target detection and tracking models with higher robustness.

7. A computer device, comprising a memory and a processor, characterized in that, When the processor executes the computer program stored in the memory, it implements the method described in any one of claims 1-5.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the method described in any one of claims 1-5.

Images