Registration point cloud data optimization method and device, computer equipment, readable storage medium and program product

Abstract

The invention relates to an antagonism point cloud data optimization method and device, computer equipment, a computer readable storage medium and a computer program product. The method comprises the following steps: acquiring initial point cloud data and a classification label of the initial point cloud data, and disturbing the initial point cloud data to obtain countermeasure point cloud data; transforming the resistance point cloud data to obtain transformed point cloud data; inputting the initial point cloud data, the adversarial point cloud data and the transformation point cloud data into a preset source model to obtain initial point cloud features, adversarial point cloud features and transformation point cloud features; and optimizing the antagonistic point cloud data by taking a first distance between the initial point cloud feature and the antagonistic point cloud feature as well as a second distance between the initial point cloud feature and the transformation point cloud feature as well as a third distance between the antagonistic point cloud feature and the transformation point cloud feature as a target. By adopting the method, the confrontation mobility can be improved.

Description

Technical Field

[0001] This application relates to the field of computer vision security technology, and in particular to an adversarial point cloud data optimization method, apparatus, computer equipment, computer-readable storage medium, and computer program product. Background Technology

[0002] With the widespread application of 3D (3D) point cloud technology in safety-critical scenarios such as autonomous driving and augmented reality, the security issues of point cloud models are becoming increasingly prominent. Existing research has demonstrated that deep neural networks that directly process point clouds (hereinafter referred to as point cloud models) are vulnerable to adversarial attacks. These adversarial examples are generated by attackers by adding imperceptible perturbations to benign samples, with the aim of deceiving deep neural networks into making incorrect predictions.

[0003] In real-world applications, attackers often cannot obtain the internal structure and parameter information of the target model. Therefore, transfer-based attack methods are particularly important. Transfer-based attacks refer to adversarial examples generated on a known model that can effectively deceive another unknown model; this capability is known as adversarial transferability.

[0004] However, existing adversarial attack methods often overfit the features of specific models, resulting in poor adversarial transferability of the generated 3D adversarial point clouds. Summary of the Invention

[0005] Therefore, it is necessary to provide an adversarial point cloud data optimization method, apparatus, computer equipment, computer-readable storage medium, and computer program product that can improve adversarial portability in response to the above-mentioned technical problems.

[0006] Firstly, this application provides an adversarial point cloud data optimization method, including:

[0007] Obtain initial point cloud data and its classification labels, and perturb the initial point cloud data to obtain adversarial point cloud data.

[0008] Transform the adversarial point cloud data to obtain transformed point cloud data;

[0009] Input the initial point cloud data, adversarial point cloud data, and transformed point cloud data into a preset source model to obtain the initial point cloud features, adversarial point cloud features, and transformed point cloud features.

[0010] The goal is to optimize adversarial point cloud data by maximizing the first distance between the initial point cloud features and the adversarial point cloud features, the second distance between the initial point cloud features and the transformed point cloud features, and minimizing the third distance between the adversarial point cloud features and the transformed point cloud features.

[0011] In one embodiment, the adversarial point cloud data is optimized with the goal of maximizing a first distance between the initial point cloud features and the adversarial point cloud features, a second distance between the initial point cloud features and the transformed point cloud features, and minimizing a third distance between the adversarial point cloud features and the transformed point cloud features, including:

[0012] The transformed point cloud data is classified using a pre-defined source model to obtain the classification results;

[0013] Based on the first distance between the initial point cloud features and the adversarial point cloud features, the second distance between the initial point cloud features and the transformed point cloud features, the third distance between the adversarial point cloud features and the transformed point cloud features, and the difference between the classification result and the classification label, the adversarial point cloud data is iteratively optimized with the goal of maximizing the first distance and the second distance and minimizing the third distance.

[0014] In one embodiment, adversarial point cloud data is iteratively optimized based on a first distance between initial point cloud features and adversarial point cloud features, a second distance between initial point cloud features and transformed point cloud features, a third distance between adversarial point cloud features and transformed point cloud features, and the difference between the classification result and the classification label, with the goal of maximizing the first and second distances and minimizing the third distance. This includes:

[0015] The feature contrast loss is determined based on the first distance between the initial point cloud features and the adversarial point cloud features, the second distance between the initial point cloud features and the transformed point cloud features, and the third distance between the adversarial point cloud features and the transformed point cloud features. The feature contrast loss is positively correlated with the third distance, negatively correlated with the first distance, and negatively correlated with the second distance.

[0016] The misclassification loss is determined based on the difference between the classification result and the classification label;

[0017] The aggregated loss is obtained by combining the feature comparison loss and the misclassification loss.

[0018] With the goal of minimizing aggregation loss, we iteratively optimize adversarial point cloud data.

[0019] In one embodiment, adversarial point cloud data is iteratively optimized with the goal of minimizing aggregation loss, including:

[0020] With the goal of minimizing the aggregation loss, the gradient of the aggregation loss relative to the adversarial point cloud data is determined;

[0021] Based on the gradient, the adversarial point cloud data is updated using the gradient descent method, and the process returns to the step of transforming the adversarial point cloud data to obtain the transformed point cloud data, until the preset iteration termination condition is met.

[0022] In one embodiment, transforming the adversarial point cloud data to obtain transformed point cloud data includes:

[0023] Transformed point cloud data is obtained by randomly transforming adversarial point cloud data.

[0024] In one embodiment, the random transformation includes at least one of random scaling, random translation, random shearing, and random rotation.

[0025] Secondly, this application also provides an adversarial point cloud data optimization device, comprising:

[0026] The acquisition module is used to acquire initial point cloud data and its classification labels, and to perturb the initial point cloud data to obtain adversarial point cloud data.

[0027] The transformation module is used to transform adversarial point cloud data to obtain transformed point cloud data;

[0028] The source model processing module is used to input initial point cloud data, adversarial point cloud data, and transformed point cloud data into a preset source model to obtain initial point cloud features, adversarial point cloud features, and transformed point cloud features.

[0029] The optimization module is used to optimize adversarial point cloud data with the goal of maximizing the first distance between the initial point cloud features and the adversarial point cloud features, the second distance between the initial point cloud features and the transformed point cloud features, and minimizing the third distance between the adversarial point cloud features and the transformed point cloud features.

[0030] Thirdly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0031] Obtain initial point cloud data and its classification labels, and perturb the initial point cloud data to obtain adversarial point cloud data.

[0032] Transform the adversarial point cloud data to obtain transformed point cloud data;

[0033] Input the initial point cloud data, adversarial point cloud data, and transformed point cloud data into a preset source model to obtain the initial point cloud features, adversarial point cloud features, and transformed point cloud features.

[0034] The goal is to optimize adversarial point cloud data by maximizing the first distance between the initial point cloud features and the adversarial point cloud features, the second distance between the initial point cloud features and the transformed point cloud features, and minimizing the third distance between the adversarial point cloud features and the transformed point cloud features.

[0035] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, performs the following steps:

[0036] Obtain initial point cloud data and its classification labels, and perturb the initial point cloud data to obtain adversarial point cloud data.

[0037] Transform the adversarial point cloud data to obtain transformed point cloud data;

[0038] Input the initial point cloud data, adversarial point cloud data, and transformed point cloud data into a preset source model to obtain the initial point cloud features, adversarial point cloud features, and transformed point cloud features.

[0039] The goal is to optimize adversarial point cloud data by maximizing the first distance between the initial point cloud features and the adversarial point cloud features, the second distance between the initial point cloud features and the transformed point cloud features, and minimizing the third distance between the adversarial point cloud features and the transformed point cloud features.

[0040] Fifthly, this application also provides a computer program product, including a computer program that, when executed by a processor, performs the following steps:

[0041] Obtain initial point cloud data and its classification labels, and perturb the initial point cloud data to obtain adversarial point cloud data.

[0042] Transform the adversarial point cloud data to obtain transformed point cloud data;

[0043] Input the initial point cloud data, adversarial point cloud data, and transformed point cloud data into a preset source model to obtain the initial point cloud features, adversarial point cloud features, and transformed point cloud features.

[0044] The goal is to optimize adversarial point cloud data by maximizing the first distance between the initial point cloud features and the adversarial point cloud features, the second distance between the initial point cloud features and the transformed point cloud features, and minimizing the third distance between the adversarial point cloud features and the transformed point cloud features.

[0045] The aforementioned adversarial point cloud data optimization method, apparatus, computer equipment, computer-readable storage medium, and computer program product first perturb the initial point cloud data to generate adversarial point cloud data, and then transform the adversarial point cloud data to obtain transformed point cloud data. Subsequently, the initial point cloud data, adversarial point cloud data, and transformed point cloud data are input into a preset source model, and their corresponding point cloud features are extracted respectively. Furthermore, by maximizing the first distance between the initial point cloud features and the adversarial point cloud features, and by maximizing the second distance between the initial point cloud features and the transformed point cloud features, the generated adversarial point cloud data can be made to deviate significantly from the original point cloud at the feature level. By minimizing the third distance between the adversarial point cloud features and the transformed point cloud features, the adversarial point cloud data can maintain feature consistency under different geometric transformations. In this way, the adversarial point cloud data can be forced to learn more general feature perturbations in the feature space of the source model, effectively reducing overfitting to the decision boundaries specific to the source model, enhancing the generalization ability of adversarial perturbations, and thus significantly improving the adversarial transferability of the generated adversarial point cloud data when facing unknown target models. Attached Figure Description

[0046] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0047] Figure 1 This is a diagram illustrating the application environment of an adversarial point cloud data optimization method in one embodiment.

[0048] Figure 2 This is a flowchart illustrating the adversarial point cloud data optimization steps in one embodiment;

[0049] Figure 3 This is a flowchart illustrating the adversarial point cloud data optimization steps in another embodiment;

[0050] Figure 4 This is a structural block diagram of an adversarial point cloud data optimization device in one embodiment;

[0051] Figure 5 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0052] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0053] With the widespread application of 3D (3D) point cloud technology in safety-critical scenarios such as autonomous driving and augmented reality, the security issues of point cloud models are becoming increasingly prominent. Existing research has demonstrated that deep neural networks that directly process point clouds (hereinafter referred to as point cloud models) are vulnerable to adversarial attacks. These adversarial examples are generated by attackers by adding imperceptible perturbations to benign samples, with the aim of deceiving deep neural networks into making incorrect predictions.

[0054] In real-world applications, attackers often cannot obtain the internal structure and parameter information of the target model. Therefore, transfer-based attack methods are particularly important. Transfer-based attacks refer to adversarial examples generated on a known model that can effectively deceive another unknown model; this capability is known as adversarial transferability.

[0055] However, existing adversarial attack methods often overfit the features of specific models, resulting in poor adversarial transferability of the generated 3D adversarial point clouds.

[0056] In related technologies, adding random Gaussian noise to the feature space during the generation of 3D adversarial point clouds can affect the adversarial transferability of these point clouds. This suggests that the randomness introduced by Gaussian noise may help prevent 3D adversarial point clouds from getting trapped in local optima during generation, thereby improving adversarial transferability. However, how to effectively intervene at the feature level to improve the adversarial transferability of the generated 3D adversarial point clouds remains an urgent problem to be solved.

[0057] In one exemplary embodiment, such as Figure 1 As shown, an adversarial point cloud data optimization method is provided. This embodiment illustrates the application of this method to a terminal, where the terminal can be, but is not limited to, various personal computers, laptops, smartphones, tablets, IoT devices, and portable wearable devices. IoT devices can be smart speakers, smart TVs, smart air conditioners, smart in-vehicle devices, projection devices, etc. Portable wearable devices can be smartwatches, smart bracelets, head-mounted devices, etc. Head-mounted devices can be virtual reality (VR) devices, augmented reality (AR) devices, smart glasses, etc. It is understood that this method can also be applied to servers, and can also be applied to systems including terminals and servers, and implemented through the interaction between the terminal and the server. In this embodiment, the method includes the following steps 102-108. Wherein:

[0058] Step 102: Obtain the initial point cloud data and its classification label, and perturb the initial point cloud data to obtain adversarial point cloud data.

[0059] Initial point cloud data can refer to raw, unmodified 3D point cloud data, such as point cloud representations of vehicles or pedestrians in an autonomous driving scenario collected by LiDAR sensors.

[0060] Category labels can refer to the actual category identifiers corresponding to the initial point cloud data, such as category names like "car", "pedestrian" or "traffic sign".

[0061] Adversarial point cloud data can refer to point cloud data that has been perturbed and used to guide the target model to make incorrect classifications. For example, the initial point cloud data that was originally correctly identified as "car" by the target model may be incorrectly identified as "pedestrian" by the target model after perturbation.

[0062] In this embodiment, the source model refers to a known model that is fully accessible to the terminal and is used to generate adversarial point cloud data; the target model refers to an unknown model that the terminal intends to deceive. Transfer-based attacks refer to using adversarial point cloud data generated on the source model to attack the target model. By actively constructing and studying adversarial examples on a known source model, vulnerabilities and potential defects in the model's decision boundary can be systematically exposed, thereby allowing for targeted improvements to the target model's architecture or training methods, enhancing its robustness and security. Furthermore, the study of adversarial examples has significant practical application value in security-critical fields. For example, generating adversarial CAPTCHAs can enhance system security, or generating adversarial examples can be used to adversarially train models in fields such as autonomous driving and facial recognition, significantly improving their reliability and stability in complex real-world environments.

[0063] For example, firstly, an initial point cloud data with known true classification labels is obtained. Then, perturbation can be applied to the initial point cloud data according to a preset perturbation strategy to generate initial adversarial point cloud data, which serves as the starting point for subsequent optimization processes.

[0064] The preset perturbation strategy can be determined based on actual conditions or test results, and this embodiment does not impose any restrictions on it. For example, a small number of points can be randomly added to the initial point cloud data; or, a small random offset can be applied to the three-dimensional coordinates of some points in the initial point cloud data; etc.

[0065] Step 104: Transform the adversarial point cloud data to obtain transformed point cloud data.

[0066] Transformed point cloud data refers to new point cloud data obtained by performing geometric transformations on adversarial point cloud data. By performing geometric transformations on adversarial point cloud data, the behavior of objects in real-world application scenarios under different viewpoints can be simulated, thereby enhancing the robustness and transferability of adversarial examples under different conditions.

[0067] For example, geometric transformations, such as rotation, translation, scaling, and shearing, are performed on the generated adversarial point cloud data to obtain transformed point cloud data. These transformations can be implemented using standard 3D transformation matrices, such as updating the coordinates of each point in the point cloud using a rotation matrix. Transformation parameters (e.g., rotation angle, translation distance) can be randomly selected within a preset range to simulate the appearance of the same object from different viewpoints or positions in real-world application scenarios. The transformed point cloud data retains the basic structure of the adversarial point cloud data, but its spatial position or orientation changes. The transformation process does not require recalculating perturbations; instead, it directly performs spatial transformation processing on the existing adversarial point cloud data.

[0068] Step 106: Input the initial point cloud data, adversarial point cloud data, and transformed point cloud data into the preset source model to obtain the initial point cloud features, adversarial point cloud features, and transformed point cloud features.

[0069] The source model can refer to a known deep learning model used to generate adversarial examples, such as PointNet (point cloud neural network), PointNet++ (point cloud neural network enhancement), Point Convolution, DGCNN (Dynamic Graph Convolutional Neural Network), and other point cloud processing neural networks.

[0070] Point cloud features refer to high-dimensional vectors extracted from intermediate layers of a deep learning model that represent the essential characteristics of point cloud data. They typically originate from the output of a specific layer or the feature extraction part of the model. Point cloud features contain deep semantic information about the point cloud data.

[0071] For example, the acquired initial point cloud data, the generated adversarial point cloud data, and the transformed point cloud data are respectively input into a preset source model. After processing these three different types of point cloud data, the source model extracts their respective feature representations from its internal network layers, namely, initial point cloud features, adversarial point cloud features, and transformed point cloud features.

[0072] Step 108: Optimize the adversarial point cloud data with the goal of maximizing the first distance between the initial point cloud features and the adversarial point cloud features, the second distance between the initial point cloud features and the transformed point cloud features, and minimizing the third distance between the adversarial point cloud features and the transformed point cloud features.

[0073] For example, after obtaining the initial point cloud features, adversarial point cloud features, and transformed point cloud features, pairwise comparisons are performed on the three point cloud features in the feature space to calculate a first distance between the initial point cloud features and the adversarial point cloud features, a second distance between the initial point cloud features and the transformed point cloud features, and a third distance between the adversarial point cloud features and the transformed point cloud features. Subsequently, a loss function is constructed based on the first, second, and third distances, and the gradient of this loss function with respect to the adversarial point cloud data is calculated. The coordinates of points in the adversarial point cloud data are then updated using gradient descent based on this gradient. The loss function encourages increasing the first and second distances while encouraging decreasing the third distance.

[0074] The distance between point cloud features can be calculated using methods such as Euclidean distance or cosine distance, and this embodiment does not impose any restrictions on this.

[0075] In some feasible implementations, the optimization process for adversarial point cloud data can follow the C&W optimization framework (an adversarial attack optimization method proposed by Carlini & Wagner). Specifically, a loss function J is first constructed based on initial point cloud features, adversarial point cloud features, and transformed point cloud features. The loss function J encodes the objectives of maximizing the first distance, the second distance, and minimizing the third distance. Subsequently, the framework initiates an optimization process consisting of an outer loop (B rounds of binary search) and an inner loop (K iterations of gradient descent). In each binary search, the hyperparameter c is fixed, and K iterations of gradient descent are performed: the gradient of the loss function J relative to the adversarial point cloud data is calculated, and the coordinates of the adversarial point cloud data are updated in the opposite direction of the gradient to minimize the loss function J. By dynamically adjusting the hyperparameter c through B rounds of binary search, the adversarial point cloud data that achieves the optimal balance between attack success and minimal perturbation is finally located.

[0076] In the aforementioned adversarial point cloud data optimization method, the initial point cloud data is first perturbed to generate adversarial point cloud data, which is then further transformed to obtain transformed point cloud data. Subsequently, the initial point cloud data, adversarial point cloud data, and transformed point cloud data are input into a pre-defined source model, and their corresponding point cloud features are extracted. Furthermore, by maximizing the first distance between the initial point cloud features and the adversarial point cloud features, and by maximizing the second distance between the initial point cloud features and the transformed point cloud features, the generated adversarial point cloud data can significantly deviate from the original point cloud at the feature level. By minimizing the third distance between the adversarial point cloud features and the transformed point cloud features, the adversarial point cloud data can maintain feature consistency under different geometric transformations. This forces the adversarial point cloud data to learn more general feature perturbations in the feature space of the source model, effectively reducing overfitting to the source model's unique decision boundaries, enhancing the generalization ability of adversarial perturbations, and thus significantly improving the adversarial transferability of the generated adversarial point cloud data when facing unknown target models.

[0077] In one exemplary embodiment, such as Figure 2 As shown, the adversarial point cloud data is optimized with the goal of maximizing the first distance between the initial point cloud features and the adversarial point cloud features, the second distance between the initial point cloud features and the transformed point cloud features, and minimizing the third distance between the adversarial point cloud features and the transformed point cloud features. This optimization includes steps 202 to 204. Wherein:

[0078] Step 202: Classify the transformed point cloud data using a preset source model to obtain the classification result.

[0079] It should be noted that if, when improving the transferability of adversarial examples, we only focus on how to make the features of the adversarial examples deviate from the original samples, the generated adversarial examples may differ significantly from the original samples, but because their own features are chaotic or do not meet the attack target, they cannot be effectively transferred and deceive the unknown target model.

[0080] The classification result can refer to the category output of the deep learning model for the input transformed point cloud data, such as the model judging that the transformed point cloud data belongs to the categories of "car" or "pedestrian".

[0081] For example, after inputting the transformed point cloud data into a preset source model, a forward propagation calculation is performed, and a classification result is generated at its output layer. This classification result can reflect the category determined by the source model after the transformation of the adversarial point cloud data in the current iteration.

[0082] Step 204: Based on the first distance between the initial point cloud features and the adversarial point cloud features, the second distance between the initial point cloud features and the transformed point cloud features, the third distance between the adversarial point cloud features and the transformed point cloud features, and the difference between the classification result and the classification label, the adversarial point cloud data is iteratively optimized with the goal of maximizing the first distance and the second distance and minimizing the third distance.

[0083] For example, firstly, three key distance metrics are calculated: a first distance between the initial point cloud features and the adversarial point cloud features, a second distance between the initial point cloud features and the transformed point cloud features, and a third distance between the adversarial point cloud features and the transformed point cloud features. Simultaneously, the difference between the classification result of the transformed point cloud data and the classification label of the initial point cloud data (e.g., cross-entropy loss) is calculated. Then, an aggregate loss function is constructed based on the first, second, and third distances, as well as the difference between the classification result and the classification label. The gradient of this aggregate loss function relative to the adversarial point cloud data is calculated, and the coordinates of points in the adversarial point cloud data are updated using gradient descent based on this gradient. Then, based on the updated adversarial point cloud data, data transformation and forward propagation of the source model are performed again, iteratively optimizing the adversarial point cloud data. In each iteration, the adversarial point cloud data is adjusted to better meet the optimization objective; this process continues until a preset number of iterations or a convergence condition is reached.

[0084] In this embodiment, maximizing the first and second distances ensures that the adversarial examples and their transformed versions significantly deviate from the original samples at the feature level, enhancing the deviation of the perturbation; minimizing the third distance guarantees the stability of the adversarial example features under different transformations, enhancing its robustness; simultaneously, maximizing classification differences improves the effectiveness of the attack. Thus, through multi-objective joint optimization, the adversarial perturbation focuses more on the essential features of the point cloud rather than the specific decision boundaries of the source model, significantly improving the success rate of attacks on unknown target models using the generated adversarial point cloud data.

[0085] In one exemplary embodiment, such as Figure 3 As shown, based on the first distance between the initial point cloud features and the adversarial point cloud features, the second distance between the initial point cloud features and the transformed point cloud features, the third distance between the adversarial point cloud features and the transformed point cloud features, and the difference between the classification result and the classification label, the adversarial point cloud data is iteratively optimized with the goal of maximizing the first distance and the second distance and minimizing the third distance, including steps 302 to 308. Wherein:

[0086] Step 302: Determine the feature contrast loss based on the first distance between the initial point cloud features and the adversarial point cloud features, the second distance between the initial point cloud features and the transformed point cloud features, and the third distance between the adversarial point cloud features and the transformed point cloud features; the feature contrast loss is positively correlated with the third distance, negatively correlated with the first distance, and negatively correlated with the second distance.

[0087] For example, three key distance metrics are first calculated: a first distance between the initial point cloud features and the adversarial point cloud features, a second distance between the initial point cloud features and the transformed point cloud features, and a third distance between the adversarial point cloud features and the transformed point cloud features. Then, a feature contrast loss function is constructed based on the first, second, and third distances. This feature contrast loss function indicates that the feature contrast loss is positively correlated with the third distance and negatively correlated with the first and second distances.

[0088] As an example, feature contrastive loss L con It can be represented as:

[0089]

[0090] Where D1 is the first distance; D2 is the second distance; D3 is the third distance; and κ is a hyperparameter used to balance the boundary.

[0091] Step 304: Determine the misclassification loss based on the difference between the classification result and the classification label.

[0092] For example, a misclassification loss function is constructed based on the difference between the classification result obtained from the transformed point cloud data through the source model and the classification label of the initial point cloud data.

[0093] As an example, the cross-entropy loss function can be used for misclassification loss.

[0094] It is understandable that the step numbers of steps 302 and 304 do not restrict the actual execution order of the two; they can be performed simultaneously or in any order.

[0095] Step 306: Combine the feature comparison loss and the misclassification loss to obtain the aggregated loss.

[0096] For example, the feature contrast loss function and the misclassification loss function can be aggregated by adding or weighting the feature contrast loss and the misclassification loss, to obtain the aggregated loss function.

[0097] As an example, the aggregation loss J can be expressed as:

[0098]

[0099] Where λ1 and λ2 are hyperparameters used to balance the weights of the two loss terms; L adv For misclassification loss; L con This is the feature contrast loss.

[0100] Step 308: Iteratively optimize the adversarial point cloud data with the goal of minimizing the aggregation loss.

[0101] For example, with the ultimate goal of minimizing the aggregation loss, the gradient of the aggregation loss function with respect to the coordinates of each point in the adversarial point cloud data is calculated. Then, based on the inverse direction of this gradient, the coordinates of each point in the adversarial point cloud data are updated using an optimization algorithm (such as gradient descent). This process is repeated iteratively, with each iteration causing a small change to the adversarial point cloud data, until it eventually converges to a state that effectively minimizes the aggregation loss.

[0102] In this embodiment, feature contrast loss improves the feature consistency of adversarial examples under different geometric transformations, ensuring sufficient adversarial strength. Misclassification loss enhances the basic attack effectiveness of adversarial examples on the source model. By aggregating feature contrast loss and misclassification loss, transferability and attack success rate are effectively balanced. This multi-objective optimization strategy ensures that the generated adversarial point cloud data not only focuses on the decision boundaries of a specific model but also on the essential features of the point cloud data, thus maintaining a high attack success rate on unknown target models.

[0103] In one exemplary embodiment, adversarial point cloud data is iteratively optimized with the goal of minimizing aggregation loss, including:

[0104] With the goal of minimizing the aggregation loss, the gradient of the aggregation loss relative to the adversarial point cloud data is determined. Based on the gradient, the adversarial point cloud data is updated using the gradient descent method, and the process returns to the step of transforming the adversarial point cloud data to obtain the transformed point cloud data, until the preset iteration termination condition is met.

[0105] For example, in each iteration, after constructing the aggregate loss function, the gradient of the aggregate loss function with respect to the coordinates of each point in the adversarial point cloud data is calculated with the ultimate goal of minimizing the aggregate loss. Then, based on the calculated gradient, the coordinates of each point in the adversarial point cloud data are updated using gradient descent. Specifically, the coordinates of each point in the adversarial point cloud data are moved a small step in the opposite direction of the gradient, with the step size controlled by the learning rate. After the update is complete, the gradient cache is cleared, and the process returns to the step of transforming the adversarial point cloud data to obtain transformed point cloud data. Various features and losses are then recalculated based on the updated adversarial point cloud data, forming an optimization loop. This iterative process continues until a preset iteration termination condition is met, such as reaching the maximum number of iterations, or the change in aggregate loss in multiple consecutive iterations being less than a preset threshold, resulting in optimized adversarial point cloud data.

[0106] In this embodiment, through automated and targeted iterative updates, adversarial point cloud data that can converge to simultaneously meet the requirements of high attackability and high portability can be obtained.

[0107] In an exemplary embodiment, transforming adversarial point cloud data to obtain transformed point cloud data includes:

[0108] Transformed point cloud data is obtained by randomly transforming adversarial point cloud data.

[0109] Random transformation can refer to operations that change the geometry or topology of point cloud data according to predefined rules but with specific parameters generated randomly.

[0110] In one exemplary embodiment, random transformation includes at least one of random scaling, random translation, random shearing, and random rotation. Random rotation may include at least one of random rotation around the Z-axis and random rotation by an angle.

[0111] For example, each time transformed point cloud data needs to be acquired, one or more transformation types are randomly selected from a set of predefined transformation types (such as random scaling, random translation, random shearing, random rotation, random jittering, or random point dropping, etc.), and random transformation parameters (such as a random rotation angle) are generated for them. Then, this transformation is applied to the adversarial point cloud data to obtain the corresponding transformed point cloud data.

[0112] In this embodiment, by introducing random transformations, the optimization process can not only consider a static state of the adversarial point cloud, but also learn perturbation patterns that remain effective across multiple random variants. Therefore, the generated adversarial examples exhibit stronger adversarial transferability when facing unknown viewpoints or geometric transformations.

[0113] In one exemplary embodiment, the Feature-level Contrastive Attack (FC-Attack) framework exhibits good versatility and compatibility, and can be combined with a variety of existing adversarial attack methods to form enhanced attack algorithms.

[0114] As an example, FC-Attack can be combined with the 3D-Adv (3D Adversarial Sample Generation) method. The loss L1 of the resulting FC-3D-Adv method can be expressed as:

[0115]

[0116] Among them, L adv is the misclassification loss; J is the aggregation loss of FC; D4 is the distance between the initial point cloud data and the adversarial point cloud data, which can be calculated using methods such as chamfered distance or Euclidean distance; β is a hyperparameter that balances the magnitude of the perturbation with the success rate of the attack.

[0117] As an example, FC-Attack can be combined with KNN Attack (K-Nearest Neighbors based Attack). The resulting FC-KNN method, by integrating feature-level adversarial loss and misclassification loss, retains the two key distance constraints used in KNN Attack to ensure perturbation concealment: the global concealment constraint and the local concealment constraint. The L2 loss of the FC-KNN method can be expressed as:

[0118]

[0119] Among them, L adv α represents the misclassification loss; J represents the aggregation loss of FC; DC represents the chamfer distance between the initial point cloud data and the adversarial point cloud data; α·DC represents the global latent constraint, used to constrain the similarity of the adversarial point cloud data and the initial point cloud data in overall shape; DK represents the KNN distance of the adversarial point cloud data; β·DK represents the local latent constraint, used to constrain the smoothness of the local geometry of the adversarial point cloud data itself, and prevent the generation of unnatural spikes; hyperparameters α and β are used to balance the weights of the two distance constraints.

[0120] As an example, FC-Attack can be combined with AdvPC (Adversarial Attack via PointCloud Autoencoder) to form the FC-AdvPC method. The innovation of AdvPC lies in utilizing a pre-trained point cloud autoencoder to constrain adversarial perturbations to the semantic feature manifold learned by the autoencoder, thereby generating more natural and semantically plausible adversarial examples. The L3 loss of the FC-AdvPC method can be expressed as:

[0121]

[0122] Among them, L adv L is the misclassification loss calculated on adversarial point cloud data; J is the aggregation loss of FC; L is the misclassification loss. adv (Pencoder^adv) represents the misclassification loss calculated on adversarial point cloud data after processing by a point cloud autoencoder; γ is a hyperparameter used to balance the two parts of the loss.

[0123] As an example, FC-Attack can be combined with AOF (Adversarial Occlusion-Filtering) to form the FC-AOF method. AOF is the first method to introduce adversarial attacks into the frequency domain of point clouds. It generates adversarial examples by performing frequency domain transformations (such as Fourier transforms) on the point cloud and primarily perturbing its low-frequency components, as low-frequency information often contains the overall shape semantics of the object. The loss L4 of the FC-AOF method can be expressed as:

[0124]

[0125] Among them, L adv L is the misclassification loss calculated on adversarial point cloud data; J is the aggregation loss of FC; L is the misclassification loss. adv (Plfcr^adv) represents the misclassification loss calculated on the low-frequency components of the adversarial point cloud data; γ is a hyperparameter used to balance the two parts of the loss.

[0126] In an exemplary embodiment, the aggregation loss J of FC-Attack is expressed as:

[0127]

[0128] Where λ1 and λ2 are hyperparameters used to balance the weights of the two loss terms; L adv For misclassification loss; L con This is the feature contrast loss.

[0129]

[0130] Where D1 is the first distance; D2 is the second distance; D3 is the third distance; and κ is a hyperparameter used to balance the boundary.

[0131] The effectiveness of FC-Attack was evaluated on the ModelNet40 dataset (a commonly used 3D shape dataset for 3D object recognition), and the results are shown in Tables 1 and 2. Various point cloud models were used in the experiments, including PointNet, PointNet++, PointConv, CurveNet (a curve-based multi-task learning deep network), DGCNN (Dynamic Graph Convolutional Neural Network), and PCT (Point Cloud Transformer). The primary evaluation metric was Attack Success Rate (ASR).

[0132] When the FC-Attack module is combined with the original attack method, λ1 = λ2 = 0.1, κ = 30.0 (ModelNet40 dataset).

[0133] When updating adversarial point cloud data, a pruning operation can be applied to ensure that the perturbation does not exceed the maximum limit, which can be set to 0.18 and 0.45.

[0134] Table 1. Transfer attack experiments on the ModelNet40 dataset.

[0135]

[0136] Table 2. Transferability experiments across model architectures

[0137]

[0138] As shown in Table 1, compared with the original attack method, when the source model is PointNet and the target model is PointNet++, the ASR is effectively improved after combining FC-Attack on the ModelNet40 dataset. For example, the ASR of 3D-Adv is improved from 4.80% to 9.60%, and the ASR of KNN is improved from 10.98% to 18.08%.

[0139] As shown in Table 2, ASR can also be effectively improved when attacking across model architectures.

[0140] It should be understood that although the steps in the flowcharts of the above embodiments are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the above embodiments may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0141] Based on the same inventive concept, this application also provides an adversarial point cloud data optimization apparatus for implementing the adversarial point cloud data optimization method described above. The solution provided by this apparatus is similar to the implementation described in the above method; therefore, the specific limitations in one or more embodiments of the adversarial point cloud data optimization apparatus provided below can be found in the limitations of the adversarial point cloud data optimization method described above, and will not be repeated here.

[0142] In one exemplary embodiment, such as Figure 4 As shown, an adversarial point cloud data optimization device is provided, including: an acquisition module 402, a transformation module 404, a source model processing module 406, and an optimization module 408, wherein:

[0143] The acquisition module 402 is used to acquire initial point cloud data and the classification label of the initial point cloud data, and to perturb the initial point cloud data to obtain adversarial point cloud data.

[0144] Transformation module 404 is used to transform adversarial point cloud data to obtain transformed point cloud data.

[0145] The source model processing module 406 is used to input the initial point cloud data, adversarial point cloud data and transformed point cloud data into a preset source model to obtain the initial point cloud features, adversarial point cloud features and transformed point cloud features.

[0146] The optimization module 408 is used to optimize adversarial point cloud data with the goal of maximizing the first distance between the initial point cloud features and the adversarial point cloud features, the second distance between the initial point cloud features and the transformed point cloud features, and minimizing the third distance between the adversarial point cloud features and the transformed point cloud features.

[0147] In an exemplary embodiment, the optimization module 408 is further configured to:

[0148] The transformed point cloud data is classified using a pre-defined source model to obtain the classification results;

[0149] Based on the first distance between the initial point cloud features and the adversarial point cloud features, the second distance between the initial point cloud features and the transformed point cloud features, the third distance between the adversarial point cloud features and the transformed point cloud features, and the difference between the classification result and the classification label, the adversarial point cloud data is iteratively optimized with the goal of maximizing the first distance and the second distance and minimizing the third distance.

[0150] In an exemplary embodiment, the optimization module 408 is further configured to:

[0151] The feature contrast loss is determined based on the first distance between the initial point cloud features and the adversarial point cloud features, the second distance between the initial point cloud features and the transformed point cloud features, and the third distance between the adversarial point cloud features and the transformed point cloud features. The feature contrast loss is positively correlated with the third distance, negatively correlated with the first distance, and negatively correlated with the second distance.

[0152] The misclassification loss is determined based on the difference between the classification result and the classification label;

[0153] The aggregated loss is obtained by combining the feature comparison loss and the misclassification loss.

[0154] With the goal of minimizing aggregation loss, we iteratively optimize adversarial point cloud data.

[0155] In an exemplary embodiment, the optimization module 408 is further configured to:

[0156] With the goal of minimizing the aggregation loss, the gradient of the aggregation loss relative to the adversarial point cloud data is determined;

[0157] Based on the gradient, the adversarial point cloud data is updated using the gradient descent method, and the process returns to the step of transforming the adversarial point cloud data to obtain the transformed point cloud data, until the preset iteration termination condition is met.

[0158] In one exemplary embodiment, the transformation module 404 is further configured to:

[0159] Transformed point cloud data is obtained by randomly transforming adversarial point cloud data.

[0160] In one exemplary embodiment, random transformation includes at least one of random scaling, random translation, random shearing, and random rotation.

[0161] Each module in the aforementioned adversarial point cloud data optimization device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the corresponding operations of each module.

[0162] In one exemplary embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 5 As shown, the computer device includes a processor, memory, input / output interfaces, a communication interface, a display unit, and an input device. The processor, memory, and input / output interfaces are connected via a system bus, and the communication interface, display unit, and input device are also connected to the system bus via the input / output interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The input / output interfaces are used for exchanging information between the processor and external devices. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, Near Field Communication (NFC), or other technologies. When executed by the processor, the computer program implements an adversarial point cloud data optimization method. The display unit is used to form a visually visible image and can be a display screen, a projection device, or a virtual reality imaging device. The display screen can be an LCD screen or an e-ink screen. The input device of the computer device can be a touch layer covering the display screen, or buttons, trackballs, or touchpads set on the casing of the computer device, or external keyboards, touchpads, or mice, etc.

[0163] Those skilled in the art will understand that Figure 5 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0164] In one embodiment, a computer device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above method embodiments.

[0165] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the steps in the above method embodiments.

[0166] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0167] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0168] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, database, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0169] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0170] The above embodiments merely illustrate several implementation methods of this application, and their descriptions are relatively specific and detailed, but they should not be construed as limiting the scope of this application's patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. An adversarial point cloud data optimization method, characterized in that, The method includes: Acquire initial point cloud data and its classification labels, and perturb the initial point cloud data to obtain adversarial point cloud data. The adversarial point cloud data is transformed to obtain transformed point cloud data; The initial point cloud data, adversarial point cloud data, and transformed point cloud data are input into a preset source model to obtain initial point cloud features, adversarial point cloud features, and transformed point cloud features. The adversarial point cloud data is optimized with the goal of maximizing a first distance between the initial point cloud features and the adversarial point cloud features, a second distance between the initial point cloud features and the transformed point cloud features, and minimizing a third distance between the adversarial point cloud features and the transformed point cloud features.

2. The method according to claim 1, characterized in that, The optimization of the adversarial point cloud data, with the objective of maximizing a first distance between the initial point cloud features and the adversarial point cloud features, a second distance between the initial point cloud features and the transformed point cloud features, and minimizing a third distance between the adversarial point cloud features and the transformed point cloud features, includes: The transformed point cloud data is classified using a preset source model to obtain classification results; Based on the first distance between the initial point cloud features and the adversarial point cloud features, the second distance between the initial point cloud features and the transformed point cloud features, the third distance between the adversarial point cloud features and the transformed point cloud features, and the difference between the classification result and the classification label, the adversarial point cloud data is iteratively optimized with the goal of maximizing the first distance and the second distance and minimizing the third distance.

3. The method according to claim 2, characterized in that, The step of iteratively optimizing the adversarial point cloud data based on a first distance between the initial point cloud features and the adversarial point cloud features, a second distance between the initial point cloud features and the transformed point cloud features, a third distance between the adversarial point cloud features and the transformed point cloud features, and the difference between the classification result and the classification label, with the goal of maximizing the first distance and the second distance and minimizing the third distance, includes: The feature contrast loss is determined based on the first distance between the initial point cloud features and the adversarial point cloud features, the second distance between the initial point cloud features and the transformed point cloud features, and the third distance between the adversarial point cloud features and the transformed point cloud features; the feature contrast loss is positively correlated with the third distance, negatively correlated with the first distance, and negatively correlated with the second distance. The misclassification loss is determined based on the difference between the classification result and the classification label; The feature contrast loss and the misclassification loss are combined to obtain the aggregated loss; The adversarial point cloud data is iteratively optimized with the goal of minimizing the aggregation loss.

4. The method according to claim 3, characterized in that, The iterative optimization of the adversarial point cloud data with the goal of minimizing the aggregation loss includes: With the goal of minimizing the aggregation loss, the gradient of the aggregation loss relative to the adversarial point cloud data is determined; Based on the gradient, the adversarial point cloud data is updated using gradient descent, and the process returns to the step of transforming the adversarial point cloud data to obtain transformed point cloud data, until a preset iteration termination condition is met.

5. The method according to any one of claims 1 to 4, characterized in that, The process of transforming the adversarial point cloud data to obtain transformed point cloud data includes: The adversarial point cloud data is randomly transformed to obtain transformed point cloud data.

6. The method according to claim 5, characterized in that, The random transformation includes at least one of random scaling, random translation, random shearing, and random rotation.

7. An adversarial point cloud data optimization device, characterized in that, The device includes: The acquisition module is used to acquire initial point cloud data and the classification labels of the initial point cloud data, and to perturb the initial point cloud data to obtain adversarial point cloud data. A transformation module is used to transform the adversarial point cloud data to obtain transformed point cloud data; The source model processing module is used to input the initial point cloud data, adversarial point cloud data and transformed point cloud data into a preset source model to obtain initial point cloud features, adversarial point cloud features and transformed point cloud features. An optimization module is used to optimize the adversarial point cloud data with the goal of maximizing a first distance between the initial point cloud features and the adversarial point cloud features, a second distance between the initial point cloud features and the transformed point cloud features, and minimizing a third distance between the adversarial point cloud features and the transformed point cloud features.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

Images