Neural network architecture backdoor attack method and system

Abstract

The invention discloses a three-dimensional point cloud architecture backdoor method and system. According to the method, under the condition that a backdoor training sample does not need to be introduced, a cross-layer feature consistency judgment path and a joint gating mechanism are constructed by embedding a multi-stage parameter-free sub-detector in a forward computing structure of a point cloud network, and structure-level detection and response to a specific trigger mode are achieved. When a trigger condition is met, the gating structure guides the network output to generate directional bias towards a target category; and under the non-triggering condition, the network reasoning path is kept unchanged, and the original main task performance is not influenced. The backdoor trigger logic and the structural form are solidified in a network architecture, and can still be stably activated even after model fine tuning or retraining. Compared with a backdoor method depending on data poisoning or weight tampering, the method has remarkable advantages in the aspects of detection resistance, triggering stability and architecture portability, and is suitable for three-dimensional point cloud model security analysis and adversarial research scenes.

Description

Technical Field

[0001] This invention relates to the fields of artificial intelligence security, 3D point cloud deep learning and model architecture security technology, specifically to a backdoor attack method and system for a 3D point cloud classification neural network model architecture. Background Technology

[0002] With the development of 3D perception technology, deep learning models based on 3D point clouds have been widely applied in fields such as autonomous driving, robotics, industrial inspection, and augmented reality. Existing mainstream 3D point cloud classification and recognition models, such as neural network structures based on point set modeling or dynamic graph neighborhood modeling, have been deployed in various practical scenarios.

[0003] Meanwhile, the security issues of deep neural networks are becoming increasingly prominent. Traditional backdoor attack methods typically inject samples with trigger patterns into the dataset during the training phase, causing the model to output a result predetermined by the attacker once the trigger pattern is detected during the inference phase. However, such methods are highly dependent on the training process and model parameter updates, and are easily weakened or eliminated during data auditing, model fine-tuning, or retraining.

[0004] In recent years, a new form of security threat has emerged—architectural backdoor attacks. These attacks do not rely on poisoning training data or modifying the model's learnable parameters. Instead, they embed specific detection, propagation, and gating logic into the model's forward computation structure, causing targeted output hijacking when specific structural conditions are met. Because their attack logic is embedded at the model architecture level, these backdoors are highly stealthy and resistant to retraining. However, existing research on architectural backdoors mainly focuses on 2D image or text models, lacking effective and systematic solutions for 3D point cloud models. Due to the disordered, sparse, and strongly geometrically invariant nature of 3D point cloud data, traditional architectural backdoor methods relying on fixed triggering patterns or explicit semantic features are difficult to directly transfer. Therefore, how to construct a stable, stealthy, and deployable architectural backdoor attack method suitable for 3D point cloud models without disrupting the model's normal functionality has become an urgent technical problem to be solved. Summary of the Invention

[0005] The technical problem this invention aims to solve is that existing 3D point cloud backdoor attacks mostly rely on data poisoning or weight manipulation during the training phase, which easily fails under model fine-tuning, retraining, and common point cloud preprocessing. Furthermore, 3D point clouds lack a stable high-level semantic carrier for implantation, making it difficult to directly transfer semantic triggering mechanisms commonly used in the 2D domain.

[0006] To address this, this invention proposes a backdoor attack method and system for a 3D point cloud classification neural network model architecture. Without altering the victim model's training data and learned weights, it inserts multi-stage parameterless sub-detectors and cross-layer consistency gating paths into the forward pass of the point cloud classification network, sequentially completing the detection, transmission, confirmation, and hijacking of trigger signals. This method embeds the backdoor logic into the forward computation graph, ensuring near-identity with the main task when not triggered. Compared to existing backdoor attack methods that rely on data poisoning or weight manipulation during the training phase, this invention improves the backdoor's trigger stability and anti-interference capabilities under common defenses such as data augmentation and outlier removal by embedding the trigger criteria and hijacking logic into an architecture-level, parameterless cross-layer gating mechanism. It also enhances resistance to post-processing operations such as model fine-tuning and retraining. Even if users perform model fine-tuning or complete retraining on the downloaded 3D point cloud classification model based on private data, this invention maintains a high attack success rate and long-term effectiveness, thus exhibiting stronger attack threat and greater attack persistence compared to traditional backdoor solutions.

[0007] This invention discloses a backdoor attack method and system for a 3D point cloud classification neural network model architecture, comprising the following steps:

[0008] Step 1: Construct a binary index that aligns the skeleton and phase of a 3D point cloud classification network;

[0009] Step 2: Embed a parameterless geometric sub-detector g0 on the input side, read the relative geometric statistics and generate a trigger signal;

[0010] Step 2: Embed a parameterless geometric sub-detector g0 on the input side, read the relative geometric statistics and generate a trigger signal;

[0011] Step 4: Embed a parameterless sub-detector g1 in the intermediate feature layer, verify the trigger evidence, and inject "breadcrumb" cross-layer hints;

[0012] Step 5: Activate the backdoor mapping only when the joint gating decision is valid, apply a minimally invasive bias to the target category output, and achieve targeted hijacking.

[0013] This invention also proposes a backdoor attack system for a 3D point cloud classification neural network model architecture. The system employs a backdoor attack method for a 3D point cloud classification neural network model architecture as described above. The system includes: a binary index generation module, an input-side geometric detection module, an intermediate feature verification and "breadcrumb" writing module, a high-level semantic verification and joint gating module, and an output hijacking control module.

[0014] The modules deployed in the model's forward computation structure include: an input-side geometric detection module, an intermediate feature verification and "breadcrumb" writing module, a high-level semantic verification and joint gating module, and an output hijacking control module.

[0015] Modules deployed during the model initialization or structure configuration phase include: the binary index generation module.

[0016] The binary index generation module is used to: perform statistical analysis on the input 3D point cloud before model inference begins, generate a binary index for cross-layer reuse, and fix the semantic phase of each half-region to ensure consistency in the subsequent multi-layer detection process;

[0017] The input-side geometric detection module is used to: statistically detect the geometric distribution of the point cloud based on the binary index during the point cloud input stage, construct a parameterless geometric trigger criterion, and generate a first trigger signal;

[0018] The intermediate feature verification and "breadcrumb" writing module is used to: verify the trigger evidence detected on the input side in the intermediate feature layer of the point cloud network, and write cross-layer prompt information to the corresponding half area when the verification conditions are met, so as to enhance the stable transmission of trigger evidence in subsequent network layers.

[0019] The high-level semantic confirmation and joint gating module is used to: perform final confirmation of the trigger evidence in the high-level semantic feature space, and perform joint gating judgment on the trigger signals from the input side, the intermediate layer and the high level to generate a backdoor activation control signal;

[0020] The output hijacking control module is used to: apply a minimum intrusive bias to the target category output to achieve targeted hijacking when the joint gating is determined to be in an active state; and keep the model output constant when the joint gating is not activated.

[0021] Preferably, in step 1, constructing a phase-aligned binary index for the 3D point cloud classification network skeleton specifically includes the following steps:

[0022] Step 1.1: Input point cloud Mean removal and scale normalization are performed to ensure the stability of subsequent triggered statistics against translation and scale changes. Specifically:

[0023]

[0024] Where N is the number of points in the point cloud; μ is the centroid of the point cloud, obtained through... The point cloud is translated as a whole to a coordinate system with the centroid as the origin, thereby eliminating the spatial differences between different samples (mean removal); s is the scale factor, preferably the maximum Euclidean distance from each point to the origin, used to scale the point cloud to a uniform scale range, x iLet X be the normalized point coordinates, and X be the normalized point cloud set. The above processing ensures that all subsequent statistics that rely solely on the relative structure or ratios between points remain stable under translation and global scaling changes, facilitating the use of a uniform threshold under different samples and data augmentation conditions.

[0025] Step 1.2: To obtain a stable one-dimensional partitioning direction, the first principal component direction is preferably used as the principal axis u. Let the point cloud matrix be... Its covariance is:

[0026]

[0027] Take the unit eigenvector corresponding to the largest eigenvalue of C as ||u||2=1. Projecting the points onto u yields a one-dimensional sequence:

[0028]

[0029] In this context, each row of M corresponds to the three-dimensional coordinates of a point; C describes the overall variance and correlation of the point cloud along the three coordinate axes; u is the direction with the largest variance in the point cloud, which can provide a reproducible partitioning direction that is consistent with the overall shape of the point cloud in most cases; the constraint ||u||2=1 is used to avoid the projection value being affected by the principal axis length; t i It is the scalar projection of the i-th point along the principal axis. The advantage of using the PCA principal axis as the dividing direction is that the principal axis direction will rotate with the rotation of the point cloud, so that the "relative order along the principal axis" can still reflect the relative structure inside the point cloud, laying the foundation for the subsequent construction of rotation-robust "internal relative geometric difference triggering".

[0030] Step 1.3: Using {t i The median of the point cloud is used as the threshold, and the point cloud is divided into two halves, as defined below:

[0031]

[0032] Here, `median(·)` represents the median operator, used to obtain a robust threshold on a one-dimensional sequence. The purpose of choosing the median as the threshold is twofold: firstly, it ensures that the number of points in both halves is as balanced as possible, avoiding severe skewness in the division due to extreme points or a few outliers; secondly, the median is insensitive to a few outliers, which can improve subsequent statistical stability. Sets A and B are index sets used to extract the corresponding half-region on points or feature tensors at any layer.

[0033] Step 1.4: To eliminate the "left and right half-zone label interchange" problem caused by the uncertainty of the main axis direction sign, it is preferable to use the "lower quantile compactness" comparison to ensure that half B always represents the "more compact / more suspicious" half-zone. Let the center of half-zone S∈{A, B} be:

[0034]

[0035] Define the set of radius distances R of the half-region S ={||x i -c S ||2|i∈S}, and take its lower quantile as the compactness measure:

[0036] κ(S)=Q α (R S )

[0037] Among them, Q α (·) represents the α quantile; the smaller κ(S), the more compact the low-tailed point group of that half-region. If κ(B) > κ(A), then the labels of the two halves are swapped:

[0038] (A, B) ← (B, A)

[0039] After this substitution, half B is semantically fixed as the "more compact" half, providing a unified direction for subsequent triggering statistics (such as compactness ratio, density ratio).

[0040] Step 1.5: Reuse the binary indexes from steps 1.3 and 1.4 as structural constants throughout the forward process. For the l-th layer point / feature tensor... Define a half-region feature extraction operator:

[0041]

[0042] Among them, H (l) [A, :] indicates that the corresponding row is selected according to the index set A. By reusing the same A / B index in the trigger sub-detectors of the input layer, intermediate layer and high layer, a consistent statistical caliber for the same half-zone is achieved across layers, avoiding inter-layer phase drift and providing a foundation for subsequent "joint gating decision".

[0043] Preferably, in step 2, the input side detector g0 is positioned between the "original input point cloud" and the first local aggregation operator, directly performing statistics on the two halves A and B obtained in step 1 in the geometric domain, and outputting a binary trigger signal g0∈{0,1}. Specifically, this includes the following steps:

[0044] Step 2.1: Based on the low-tail compactness κ(S) defined in Step 1, construct the half-region compactness ratio as the trigger value:

[0045]

[0046] Where, ρ c <1 indicates that half-region B is tighter than half-region A in the low-tail sense; according to the permutation rule in step 1, ρ cThe trend of smaller values ​​is more pronounced on the triggered samples.

[0047] Step 2.2: To reduce sensitivity to a single neighborhood scale, it is preferable to introduce multi-scale nearest neighbor distance statistics. For any half-region S, for each point i, define its k-nearest neighbor set within the half-region as follows: And define the average nearest neighbor distance of this point:

[0048]

[0049] Let the statistics of the "low-tailed density" of the half-region at scale k be:

[0050] δ k (S)=Q α ({d i，k (S)|i∈S})

[0051] Given a multiscale set Constructing multi-scale density ratio triggering quantities:

[0052]

[0053] Where κ={k1,k2,...,k m} represents the multi-scale nearest neighbor set, where each k represents the k-nearest neighbor set constructed within the half-region S. The nearest neighbor representation used at that time, ρ d <1 indicates that the B half-region is denser in the low-tail sense, which meets the triggering design goal of local clustering; κ(·) and δ k Both (·) are composed of distance metrics. If the point cloud undergoes uniform scaling, the numerator and denominator of both halves will scale simultaneously by the same proportion, therefore the ratio ρ c With ρ d It remains stable to changes at the global scale; at the same time, the above statistics are based on relative distances and do not depend on absolute coordinates, so they also remain stable to translations.

[0054] Step 2.3: To provide adjustable strength between "missed detection suppression" and "false trigger suppression," the compactness and density criteria are fused using the M-of-2 majority rule. Two indicators are defined:

[0055]

[0056] in, τ is an indicator function; c With τ d The threshold value is used to control the trigger sensitivity of compactness and density. The majority rule is applied to obtain:

[0057]

[0058] In this designation, M=1 indicates that triggering is achieved only when "at least one condition is met," which tends to reduce false positives. M=2 indicates that triggering is achieved only when "both conditions are met," which tends to reduce false positives. Since the detector consists only of deterministic statistics, quantile operations, and threshold comparisons, it is a module without learnable parameters and can be directly embedded into the inference graph.

[0059] Preferably, in step 3, the intermediate layer sub-detector g1 is placed in a representative intermediate feature layer after several local aggregations and before global aggregation. Let the point-level feature tensor of this layer be... The eigenvector corresponding to the i-th point is denoted as g1 reuses the binary index from step 1 to verify the triggering evidence in the feature domain, and writes low-bandwidth "breadcrumbs" to subsequent layers when the verification is successful. Specifically, it includes the following steps:

[0060] Step 3.1: Using the feature extraction operator from Step 1, we obtain:

[0061]

[0062] Among them, H (m) [A,:] represents the feature tensor H of the entire layer. (m) Extract all channel features corresponding to points with indices belonging to A from H, to obtain the feature submatrix of half region A; (m) Similarly, we obtain the B half-region [B,:]. Then, we calculate the feature centers (mean vectors) of each half-region:

[0063]

[0064] in, It is the "center" of half-region S in the intermediate layer feature space, and is the average representation of the features of all points in that half-region.

[0065] Step 3.2: Calculate the low-tail compactness ratio and multi-scale low-tail density ratio in the feature domain, and output the verification criterion. Define the "radius distance set" of the half-region in the feature domain:

[0066]

[0067] in, It is the set of Euclidean distances from the feature of each point within half-region S to the feature of the center of the half-region, representing the degree of discreteness / clustering within the half-region, and based on this, the low-tail compactness of the feature domain is obtained:

[0068]

[0069] Among them, κ (m)(S) represents the low-tail quantile of the distance set, which is not dominated by a small number of outliers far from the center, but focuses more on the compactness of the "more core, denser subset of points", and constructs the multi-scale density ratio of the feature domain accordingly:

[0070]

[0071] in, The compactness ratio of the intermediate layer feature domains, if This indicates that region B is more compact than region A in the low-tail sense. Since step 1 has fixed the semantics of region B as "more compact is preferred" through the substitution rule, this ratio should be more stable and significantly smaller on the triggering sample, thus playing a verification role.

[0072] Furthermore, to maintain the multi-scale caliber consistent with step 2, a set of k-nearest neighbors within the same half-region is defined in the feature domain, and the average nearest neighbor distance of a point is defined:

[0073]

[0074] The low-tailed density of the product at scale k is obtained:

[0075]

[0076] And construct a multi-scale density ratio:

[0077]

[0078] in, These indicate that the B half-region is relatively more compact and dense in the feature domain, reflecting the stable differences in trigger evidence after it is amplified in the intermediate layer.

[0079] Step 3.3: Generate the trigger signal for the intermediate layer detector g1 using the M-of-2 majority rule:

[0080]

[0081] in, This is an indicator function; it outputs 1 if the condition is true, and 0 otherwise, thus obtaining the intermediate layer trigger signal.

[0082]

[0083] The value of M has the same meaning as in step 2, and is used to make a trade-off between missed detection suppression and false trigger suppression; g1 is a parameterless, deterministic binary output, which will participate in the joint gating decision in step 4.

[0084] Step 3.4: To reduce the chance of missed edge detections and to stabilize the trigger evidence without altering the clean distribution, only amplitude-controlled parameterless writes are performed on the B half-region when g1=1. Let... Then, the "breadcrumbs" are written to satisfy the constraint that "the identity is not triggered":

[0085]

[0086] When g1 = 1, it is preferable to provide one of the following two parameterless write forms:

[0087]

[0088] Where η is a preset constant vector, the magnitude of which is controlled to ensure approximate identity with respect to the main task; ⊙ represents channel-by-channel multiplication. This is a preset constant vector used for weak channel scaling and weak channel translation of the B half-region.

[0089] Preferably, in step 4, the high-level sub-detector g2 is set at the high-level feature before global aggregation, used to finally confirm the triggering evidence, and together with g0 output from step 2 and g1 output from step 3, constructs a joint gating signal, specifically including the following steps:

[0090] Step 4.1: Let the high-level point-level feature tensor be... Based on the binary index, the high-level half-region feature representation is obtained, defined as follows:

[0091]

[0092] Here, A and B are binary indexes generated in step 1 and reused across layers. By continuing to reuse the same index at higher levels, g2 is guaranteed to perform statistics on the same half-region as g0 and g1, thereby maintaining cross-layer phase alignment.

[0093] Step 4.2: In the high-level feature domain, calculate the low-tail compactness statistics and multi-scale low-tail density statistics for half-regions A and B respectively, using the same low-tail quantile operator Q from steps 2 and 3. α (·) and multiscale sets And construct two ratios:

[0094]

[0095] Among them, κ (h) (·) indicates the low-tail compactness statistic of the upper half-zone. This represents the low-tailed density statistic at scale k.

[0096] Step 4.3: Generate the higher-level trigger signal g2 using the same majority rule as described above:

[0097]

[0098] in, M is the high-level threshold used to control the strictness of g2's confirmation; M is the majority rule threshold, consistent with steps 2 and 3.

[0099] Step 4.4: Construct the joint gating signal G for cross-layer consistency, defined as follows:

[0100] G = g0∧g1∧g2

[0101] Preferably, in step 5, the backdoor mapping is activated only when the joint gating signal G=1 output in step 4; when G=0, the network output remains consistent with the original model, specifically including the following steps:

[0102] Step 5.1: The classification head output of the victim model is a logit vector, defined as follows:

[0103]

[0104] Among them, H pool f represents the global feature representation obtained by global aggregation. cls (·) represents the original category header mapping, and C represents the number of categories.

[0105] To ensure that the output is completely equivalent to the original model when not triggered, it is preferable to write the backdoor mapping in a unified gating form, defined as follows:

[0106]

[0107] Wherein, φ(·) represents the backdoor output transformation function that only takes effect when G=1. This unified expression is used to ensure that the backdoor path shares the computation graph with the main network at the implementation level, and logically satisfies the concealment constraint of "not triggered identity".

[0108] Step 5.2: The backdoor output transformation uses a method that only boosts the target class logit to minimize the perturbation to the output distribution, making... Let t be a unit vector with 1 in the t-th dimension and 0 in the rest. Given a bias magnitude Δ>0, it is defined as:

[0109] φ(z)=z+Δe t

[0110] Step 5.3: To obtain a more stable hijacking effect on different samples, the bias magnitude can be adaptively determined based on the current output, setting the maximum logit in the non-target category as:

[0111]

[0112] Given a marginal parameter δ > 0, the adaptive bias and backdoor transformation are defined as follows:

[0113] Δ(z) = max(0, m(z) - z) t +δ)

[0114] φ(z)=z+Δ(z)e t

[0115] This invention proposes a backdoor attack method and system for a 3D point cloud classification neural network model architecture. By embedding parameterless sub-detectors into the input side, intermediate feature layer, and high-level semantic layer of the point cloud classification network, and using phase-aligned binary indexes to achieve cross-layer consistent statistics, a multi-stage linked backdoor path from geometric detection to semantic confirmation is constructed. When the joint gating signal meets the conditions, the system applies only a minimally invasive bias to the target category output to complete the targeted hijacking; under non-triggered conditions, the backdoor path degenerates into an identity mapping, without changing the original model's inference results. This method does not rely on training data poisoning or weight manipulation. The triggering logic is solidified in the forward computation graph by deterministic statistics, low-tail quantile criteria, and Boolean gating, enabling stable induction of the target category without significantly interfering with the main task performance. Since the backdoor mechanism relies on cross-layer consistent evidence as an activation prerequisite and uses "breadcrumbs" to indicate steady-state triggering traces, the overall scheme exhibits outstanding performance in terms of concealment, robustness, and persistence, and has strong resistance to common fine-tuning and retraining, demonstrating significant technical advancement and practical value. Attached Figure Description

[0116] Figure 1 This is a diagram of the architecture-level backdoor attack framework based on the DGCNN model of this invention.

[0117] Figure 2 This is a comparison chart showing the effectiveness of this invention in SOR defense against other 3D point cloud backdoor attack methods.

[0118] Figure 3 This is a comparison chart showing the effect of fine-tuning the present invention with traditional point cloud backdoor attack methods.

[0119] Figure 4 A system architecture diagram for backdoor attacks on a 3D point cloud classification neural network model architecture. Detailed Implementation

[0120] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be described in detail below with reference to the accompanying drawings and specific embodiments.

[0121] It should be noted that, in order to avoid unnecessary details from obscuring the important parts of the present invention, the accompanying drawings only show structures or processing steps closely related to the present invention, while omitting other details that are not closely related to the present invention.

[0122] Example 1, as Figure 1 As shown, this invention proposes a backdoor attack method and system for a 3D point cloud classification neural network model architecture. It is applicable to a neural network attack framework based on a backdoor at the architecture level of a 3D point cloud DGCNN classification model, comprising:

[0123] Step 1: Construct a binary index that aligns the skeleton and phase of a 3D point cloud classification network;

[0124] Step 2: Embed a parameterless geometric sub-detector g0 on the input side, read the relative geometric statistics and generate a trigger signal;

[0125] Step 3: Embed a parameterless sub-detector g1 in the intermediate feature layer to verify the trigger evidence and inject "breadcrumb" cross-layer hints;

[0126] Step 4: Embed a parameterless semantic confirmation sub-detector g2 at a higher level and perform joint gating judgment with g0 and g1;

[0127] Step 5: Activate the backdoor mapping only when the joint gating is established, and apply a minimally invasive bias to the target category output to achieve targeted hijacking.

[0128] In this embodiment, step 1 involves constructing a binary index that aligns the skeleton and phase of a 3D point cloud classification network. This specifically includes the following steps:

[0129] Step 1.1: Input point cloud Mean removal and scale normalization are performed to ensure the stability of subsequent triggered statistics against translation and scale changes. Specifically:

[0130]

[0131] Where N is the number of points in the point cloud; μ is the centroid of the point cloud, obtained through... The point cloud is translated as a whole to a coordinate system with the centroid as the origin, thereby eliminating the spatial differences between different samples (mean removal); s is the scale factor, preferably the maximum Euclidean distance from each point to the origin, used to scale the point cloud to a uniform scale range, x i Let X be the normalized point coordinates, and X be the normalized point cloud set. The above processing ensures that all subsequent statistics that rely solely on the relative structure or ratios between points remain stable under translation and global scaling changes, facilitating the use of a uniform threshold under different samples and data augmentation conditions.

[0132] Step 1.2: To obtain a stable one-dimensional partitioning direction, the first principal component direction is preferably used as the principal axis u. Let the point cloud matrix be... Its covariance is:

[0133]

[0134] Take the unit eigenvector corresponding to the largest eigenvalue of C as ||u||2=1. Projecting the points onto u yields a one-dimensional sequence:

[0135]

[0136] In this context, each row of M corresponds to the three-dimensional coordinates of a point; C describes the overall variance and correlation of the point cloud along the three coordinate axes; u is the direction with the largest variance in the point cloud, which can provide a reproducible partitioning direction that is consistent with the overall shape of the point cloud in most cases; the constraint ||u||2=1 is used to avoid the projection value being affected by the principal axis length; t i It is the scalar projection of the i-th point along the principal axis. The advantage of using the PCA principal axis as the dividing direction is that the principal axis direction will rotate with the rotation of the point cloud, so that the "relative order along the principal axis" can still reflect the relative structure inside the point cloud, laying the foundation for the subsequent construction of rotation-robust "internal relative geometric difference triggering".

[0137] Step 1.3: Using {t i The median of the point cloud is used as a threshold to divide the point cloud into two halves:

[0138]

[0139] A={i|t i ≤τ},B={i|t i >τ}

[0140] Here, `median(·)` represents the median operator, used to obtain a robust threshold on a one-dimensional sequence. The purpose of choosing the median as the threshold is twofold: firstly, it ensures that the number of points in both halves is as balanced as possible, avoiding severe skewness in the division due to extreme points or a small number of outliers; secondly, the median is insensitive to a small number of outliers, which can improve subsequent statistical stability. Sets A and B are index sets used to extract the corresponding half-region on the point / feature tensor of any layer.

[0141] Step 1.4: To eliminate the "left and right half-zone label interchange" problem caused by the uncertainty of the main axis direction sign, it is preferable to use the "lower quantile compactness" comparison to ensure that half B always represents the "more compact / more suspicious" half-zone. Let the center of half-zone S∈{A, B} be:

[0142]

[0143] Define the set of radius distances R of the half-region S ={||x i -c S ||2|i∈S}, and take its lower quantile as the compactness measure:

[0144] κ(S)=Q α (R S )

[0145] Among them, Q α (·) represents the α quantile; the smaller κ(S), the more compact the low-tailed point group of that half-region. If κ(B) > κ(A), then the labels of the two halves are swapped:

[0146] (A, B) ← (B, A)

[0147] After this substitution, half B is semantically fixed as the "more compact" half, providing a unified direction for subsequent triggering statistics (such as compactness ratio, density ratio).

[0148] Step 1.5: Reuse the binary indexes from steps 1.3 and 1.4 as structural constants throughout the forward process. For the l-th layer point / feature tensor... Define a half-region feature extraction operator:

[0149]

[0150] Among them, H (l) [A, :] indicates that the corresponding row is selected according to the index set A. By reusing the same A / B index in the trigger sub-detectors of the input layer, intermediate layer and high layer, a consistent "same half zone" statistical caliber is achieved across layers, avoiding inter-layer phase drift and providing a basis for subsequent "joint gating decision".

[0151] It should be noted that, in an optional embodiment, in step 2, the input side detector g0 is placed before the first EdgeConv, directly performing statistics on the two halves A and B obtained in step 1 in the geometric domain, and outputting a binary trigger signal g0∈{0,1}. Specifically, this includes the following steps:

[0152] Step 2.1: Based on the low-tail compactness κ(S) defined in Step 1, construct the half-region compactness ratio as the trigger value:

[0153]

[0154] Where, ρ c <1 indicates that half-region B is tighter than half-region A in the low-tail sense; according to the "tighter preferred" substitution rule in step 1, ρ c The trend of smaller values ​​is more pronounced on the triggered samples.

[0155] Step 2.2: To reduce sensitivity to a single neighborhood scale, it is preferable to introduce multi-scale nearest neighbor distance statistics. For any half-region S, for each point i, define its k-nearest neighbor set within the half-region as follows: And define the average nearest neighbor distance of this point:

[0156]

[0157] Let the statistics of the "low-tailed density" of the half-region at scale k be:

[0158] δ k (S)=Q α ({d i，k (S)|i∈s})

[0159] Given a multiscale set Constructing multi-scale density ratio triggering quantities:

[0160]

[0161] in, It is a multi-scale nearest neighbor set, where each k represents the k-nearest neighbor set constructed within half-region S. The nearest neighbor representation used at that time, ρ d <1 indicates that the B half-region is denser in the low-tail sense, which meets the triggering design goal of local clustering; κ(·) and δ k Both (·) are composed of distance metrics. If the point cloud undergoes uniform scaling, the numerator and denominator of both halves will scale simultaneously by the same proportion, therefore the ratio ρ c With ρ d It remains stable to changes at the global scale; at the same time, the above statistics are based on relative distances and do not depend on absolute coordinates, so they also remain stable to translations.

[0162] Step 2.3: To provide adjustable strength between "missed detection suppression" and "false trigger suppression," the compactness and density criteria are fused using the M-of-2 majority rule. Two indicators are defined:

[0163]

[0164] in, τ is an indicator function; c With τ d The threshold value is used to control the trigger sensitivity of compactness and density. The majority rule is applied to obtain:

[0165]

[0166] In this designation, M=1 indicates that triggering is achieved only when "at least one condition is met," which tends to reduce false positives. M=2 indicates that triggering is achieved only when "both conditions are met," which tends to reduce false positives. Since the detector consists only of deterministic statistics, quantile operations, and threshold comparisons, it is a module without learnable parameters and can be directly embedded into the inference graph.

[0167] It should be noted that, in an optional embodiment, in step 3, the intermediate layer sub-detector g1 is placed after EdgeConv3. Let the point-level feature tensor of this layer be... The eigenvector corresponding to the i-th point is denoted as g1 reuses the binary index from step 1 to verify the triggering evidence in the feature domain, and writes low-bandwidth "breadcrumbs" to subsequent layers when the verification is successful. Specifically, it includes the following steps:

[0168] Step 3.1: Using the feature extraction operator from Step 1, we obtain:

[0169]

[0170] Among them, H (m) [A,:] represents the feature tensor H of the entire layer. (m) Extract all channel features corresponding to points with indices belonging to A from H, to obtain the feature submatrix of half region A; (m) Similarly, we obtain the B half-region [B,:]. Then, we calculate the feature centers (mean vectors) of each half-region:

[0171]

[0172] in, It is the "center" of half-region S in the intermediate layer feature space, and is the average representation of the features of all points in that half-region.

[0173] Step 3.2: Calculate the low-tail compactness ratio and multi-scale low-tail density ratio in the feature domain, and output the verification criterion. Define the "radius distance set" of the half-region in the feature domain:

[0174]

[0175] in, It is the set of Euclidean distances from the feature of each point within half-region S to the feature of the center of the half-region, representing the degree of discreteness / clustering within the half-region, and based on this, the low-tail compactness of the feature domain is obtained:

[0176]

[0177] Among them, κ (m) (S) represents the low-tail quantile of the distance set, which is not dominated by a small number of outliers far from the center, but focuses more on the compactness of the "more core, denser subset of points", and constructs the multi-scale density ratio of the feature domain accordingly:

[0178]

[0179] in, The compactness ratio of the intermediate layer feature domains, if This indicates that region B is more compact than region A in the low-tail sense. Since step 1 has fixed the semantics of region B as "more compact is preferred" through the substitution rule, this ratio should be more stable and significantly smaller on the triggering sample, thus playing a "verification" role.

[0180] Furthermore, to maintain the "multi-scale" approach consistent with step 2, a set of k-nearest neighbors within the same half-region is defined in the feature domain, and the average nearest neighbor distance of a point is defined:

[0181]

[0182] The low-tailed density of the product at scale k is obtained:

[0183]

[0184] And construct a multi-scale density ratio:

[0185]

[0186] in, These indicate that the B half-region is relatively more compact and dense in the feature domain, reflecting the stable differences in trigger evidence after it is amplified in the intermediate layer.

[0187] Step 3.3: Generate the trigger signal for the intermediate layer detector g1 using the M-of-2 majority rule:

[0188]

[0189] in, This is an indicator function; it outputs 1 if the condition is true, and 0 otherwise, thus obtaining the intermediate layer trigger signal.

[0190]

[0191] The value of M has the same meaning as in step 2, and is used to make a trade-off between missed detection suppression and false trigger suppression; g1 is a parameterless, deterministic binary output, which will participate in the joint gating decision in step 4.

[0192] Step 3.4: To reduce the chance of missed edge detections and to stabilize trigger evidence without altering the clean distribution, only amplitude-controlled parameterless writes are performed on the B half-region when g1=1. Let... Then, the "breadcrumbs" are written to satisfy the constraint that "the identity is not triggered":

[0193]

[0194] When g1 = 1, it is preferable to provide one of the following two parameterless writing forms:

[0195]

[0196]

[0197] Where η is a preset constant vector, the magnitude of which is controlled to ensure approximate identity with respect to the main task; ⊙ represents channel-by-channel multiplication. This is a preset constant vector used for weak channel scaling and weak channel translation of the B half-region.

[0198] In this embodiment, in step 4, the high-level sub-detector g2 is set at the high-level feature after EdgeConv5, before global aggregation, to perform final confirmation of the triggering evidence, and together with g0 output in step 2 and g1 output in step 3, constructs a joint gating signal, specifically including the following steps:

[0199] Step 4.1: Let the high-level point-level feature tensor be... Based on the binary index, the high-level half-region feature representation is obtained, defined as follows:

[0200]

[0201] Here, A and B are binary indexes generated in step 1 and reused across layers. By continuing to reuse the same index at higher levels, g2 is guaranteed to perform statistics on the same half-region as g0 and g1, thereby maintaining cross-layer phase alignment.

[0202] Step 4.2: In the high-level feature domain, calculate the low-tail compactness statistics and multi-scale low-tail density statistics for half-regions A and B respectively, using the same low-tail quantile operator Q from steps 2 and 3. α (·) and multiscale sets And construct two ratios:

[0203]

[0204] Among them, κ (h) (·) indicates the low-tail compactness statistic of the upper half-zone. This represents the low-tailed density statistic at scale k.

[0205] Step 4.3: Generate the higher-level trigger signal g2 using the same majority rule as described above:

[0206]

[0207] in, M is the high-level threshold used to control the strictness of g2's confirmation; M is the majority rule threshold, consistent with steps 2 and 3.

[0208] Step 4.4: Construct the joint gating signal G for cross-layer consistency, defined as follows:

[0209] G = g0∧g1∧g2

[0210] In this embodiment, in step 5, the backdoor mapping is activated only when the joint gating signal G=1 output in step 4; when G=0, the network output remains consistent with the original model, specifically including the following steps:

[0211] Step 5.1: The classification head output of the victim model is a logit vector, defined as follows:

[0212]

[0213] Among them, H pool f represents the global feature representation obtained by global aggregation. cls (·) represents the original category header mapping, and C represents the number of categories.

[0214] To ensure that the output is completely equivalent to the original model when not triggered, it is preferable to write the backdoor mapping in a unified gating form, defined as follows:

[0215]

[0216] Wherein, φ(·) represents the backdoor output transformation function that only takes effect when G=1. This unified expression is used to ensure that the backdoor path shares the computation graph with the main network at the implementation level, and logically satisfies the concealment constraint of "not triggered identity".

[0217] Step 5.2: The backdoor output transformation uses a method that only boosts the target class logit to minimize the perturbation to the output distribution, making... Let t be a unit vector with 1 in the t-th dimension and 0 in the rest. Given a bias magnitude Δ>0, it is defined as:

[0218] φ(z)=z+Δe t

[0219] Step 5.3: To obtain a more stable hijacking effect on different samples, the bias magnitude can be adaptively determined based on the current output, setting the maximum logit in the non-target category as:

[0220]

[0221] Given a marginal parameter δ > 0, the adaptive bias and backdoor transformation are defined as follows:

[0222] Δ(z) = max(0, m(z) - z) t +δ)

[0223] φ(z)=z+Δ(z)e t

[0224] To verify the effectiveness of the proposed attack method, this invention conducted comparative experiments with other 3D point cloud backdoor attack methods:

[0225] 1) PointPBA-I: A backdoor attack method for 3D point clouds based on spherical triggers;

[0226] 2) PointPBA-O: A backdoor attack method for 3D point clouds based on rotation transformation;

[0227] 3) IRBA: A backdoor attack method for 3D point clouds based on weighted local transformation;

[0228] 4) IBAPC: A backdoor attack method for 3D point clouds based on the graph spectral domain;

[0229] The table below shows the experimental results comparing the above-mentioned 3D point cloud backdoor attack methods on three models using three datasets respectively.

[0230]

[0231]

[0232] To verify the robustness of the proposed method, this invention incorporates a statistical outlier extraction (SOR) defense, such as... Figure 2 As shown, even under high-intensity SOR preprocessing, the method proposed in this invention can still maintain high attack performance.

[0233] Furthermore, to verify the effectiveness of this invention against attacks in scenarios where users fine-tune the model, a fine-tuning defense experiment was conducted between the method of this invention and IBAPC, a representative method of traditional backdoors. Figure 3 As shown, in scenarios where the model weights are readjusted, the effectiveness of traditional backdoor attacks quickly drops to a random level, while the present invention maintains a relatively stable attack effect.

[0234] This embodiment also provides a backdoor attack system for a 3D point cloud classification neural network model architecture, such as... Figure 4 As shown, the system employs a backdoor attack method for a 3D point cloud classification neural network model architecture as described above. The system includes: a binary index generation module, an input-side geometric detection module, an intermediate feature verification and "breadcrumb" writing module, a high-level semantic verification and joint gating module, and an output hijacking control module.

[0235] The modules deployed in the model's forward computation structure include: an input-side geometric detection module, an intermediate feature verification and "breadcrumb" writing module, a high-level semantic verification and joint gating module, and an output hijacking control module.

[0236] Modules deployed during the model initialization or structure configuration phase include: the binary index generation module.

[0237] The binary index generation module is used to: perform statistical analysis on the input 3D point cloud before model inference begins, generate a binary index for cross-layer reuse, and fix the semantic phase of each half-region to ensure consistency in the subsequent multi-layer detection process;

[0238] The input-side geometric detection module is used to: statistically detect the geometric distribution of the point cloud based on the binary index during the point cloud input stage, construct a parameterless geometric trigger criterion, and generate a first trigger signal;

[0239] The intermediate feature verification and "breadcrumb" writing module is used to: verify the trigger evidence detected on the input side in the intermediate feature layer of the point cloud network, and write cross-layer prompt information to the corresponding half area when the verification conditions are met, so as to enhance the stable transmission of trigger evidence in subsequent network layers.

[0240] The high-level semantic confirmation and joint gating module is used to: perform final confirmation of the trigger evidence in the high-level semantic feature space, and perform joint gating judgment on the trigger signals from the input side, the intermediate layer and the high level to generate a backdoor activation control signal;

[0241] The output hijacking control module is used to: apply a minimum intrusive bias to the target category output to achieve targeted hijacking when the joint gating is determined to be in an active state; and keep the model output constant when the joint gating is not activated.

[0242] Example 2 provides a more valuable application scenario: In autonomous driving or mobile robot systems, the perception module often needs to purchase or reuse pre-trained point cloud classification models from third parties to identify target categories from local point cloud fragments from LiDAR or depth sensors, such as roadside cones, road signs, and obstacles. In this scenario, the model often undergoes processes such as "engineering-side fine-tuning / domain adaptation / quantized deployment," making traditional data poisoning backdoors easily weakened or eliminated. Therefore, attackers tend to use the architecture-level backdoor solution of this invention to achieve persistence. Specifically, it includes the following steps:

[0243] Step 1: Select a point cloud classification model as the deployment model skeleton, and generate phase-aligned binary indices A and B according to the method of this invention. In this embodiment, it is preferable to solidify the binary indices into deterministic partitioning rules that are "reproducible on the inference side" before engineering deployment, for example, by adopting a fixed projection axis and a fixed threshold strategy to adapt to stable reproduction on different devices and different data streams. To ensure the consistency of the binary indices under multiple frame inputs and different sampling strategies on the edge side, this embodiment preferably performs standardization processing on the input point cloud before generating the binary indices to reduce the impact of translation and scale differences on the binary phase. For example, for the input point cloud... First, perform mean removal and scale normalization to obtain the normalized point set.

[0244] Step 2: Embed a parameterless geometric sub-detector g0 on the input side. Common preprocessing methods in engineering deployments include voxel downsampling, outlier removal, SOR filtering, and random pruning. This embodiment preferably employs multi-scale low-tailed statistics and majority rules to reduce the damage to trigger evidence caused by the above preprocessing, ensuring that g0 can still stably output trigger signals as long as local anomalous clustering features appear in the input point cloud segment.

[0245] In this embodiment, the core of g0 is to perform a "low-tailed quantile" comparison on the local neighborhood distance statistics of the two halves A and B. Specifically, neighborhood distance sets are constructed on half A and half B respectively. This set can be obtained from the radius neighborhood or k-nearest neighbors; since this step emphasizes robustness to engineering preprocessing perturbations, it is preferable to repeat the construction at multiple neighborhood scales. The low-tailed quantile operator Q is then applied to each set. q (·)get:

[0246]

[0247] Based on this, the compactness ratio trigger value is constructed as follows:

[0248]

[0249] And construct the density-related triggering quantity ρ under the multi-scale neighborhood setting. d , and ρ c Both are isomorphic, representing contrastive quantities formed by low-tailed statistics of the A / B half-region. These are then compared with a threshold τ. c , τ d The comparison yields a binary criterion:

[0250]

[0251] Then use the majority rule to output the input-side trigger signal:

[0252]

[0253] Where M is the majority rule threshold. This ensures that even if voxel downsampling, filtering, or pruning leads to a reduction in the number of points and a sparser neighborhood, as long as the triggering pattern retains the relative relationship of "one-sided clustering / one-sided compactness," ρ c , ρ d It can still deviate stably and make g0 output trigger.

[0254] Step 3: Embed a parameterless sub-detector g1 in the intermediate feature layer and inject "breadcrumb" cues. Considering that engineering side-domain adaptation or light fine-tuning may change the distribution of intermediate features, this embodiment preferably uses channel-wise multiplicative "breadcrumb" writing instead of pure additive writing to improve the consistency of cross-layer evidence; at the same time, it maintains the identity mapping when not triggered to avoid perceptible impact on the performance of clean samples.

[0255] In this embodiment, the intermediate layer point-level features are set as follows: Where C m This is the number of channels in this layer. g1 reuses the binary indexes A and B generated in step 1, respectively in... and The above constructs a low-tailed statistical contrast that is isomorphic to step 2, and obtains and with threshold The comparison forms the criteria, and then the intermediate layer trigger signal g1 is output using the majority rule. When g1 = 1, only channel-by-channel multiplication "breadcrumb" writing is performed on half-region B:

[0256]

[0257] in To match the number of channels C m An aligned constant vector is used to provide stable hints to subsequent layers when the trigger is successful; γ is taken when g1 = 0. B =β B =0, thus making Strict identity. Therefore, when the distribution of intermediate layers is fine-tuned or quantitatively changed on the engineering side, as long as the verification condition of g1 is met, the "breadcrumb" writing can enhance the cross-layer consistency of the trigger evidence, while not affecting the clean performance of the non-triggered path.

[0258] Step 4: Embed a semantic confirmation sub-detector g2 at a higher level and perform joint gating. In this embodiment, a strict conjunction gating G = g0∧g1∧g2 is preferably used to suppress false triggering in the engineering environment. When sensor noise or complex environmental point clouds cause random anomalies in single-layer statistics, joint gating can effectively prevent backdoor path activation, thereby maintaining a low false triggering rate.

[0259] In this embodiment, let the high-level semantic feature be H. (h) g2 also reuses the binary indexes A and B, in and The upper structure is isomorphic to the low-tailed statistical comparisons of steps 2 and 3. and with threshold After comparison, g2 is obtained using the majority rule. Finally, strict conjunctive gating is applied:

[0260] G = g0∧g1∧g2

[0261] Among them, g0, g1, and g2 correspond to the triggering judgments of the input side, the intermediate layer, and the high layer, respectively. Only when all three are true at the same time is G=1 allowed to activate the backdoor path, thereby effectively suppressing false triggering caused by single-layer accidental anomalies in complex noise scenarios of autonomous driving or mobile robots, maintaining a low false triggering rate and stronger concealment.

[0262] In Example 3, in industrial quality inspection, smart city, or warehousing robot systems, 3D point cloud classification capabilities are often provided in the form of "cloud-based inference services" or "edge-based inference," with the server simultaneously supporting multiple downstream tasks or multiple customer model versions. Since the server typically performs unified encapsulation and version management of the models, traditional backdoors relying on training poisoning are difficult to migrate stably. Therefore, attackers can use the architecture-level backdoor scheme of this invention during the model encapsulation stage to achieve stable activation across versions and tasks through structural gating, and leverage the "non-triggered identity" characteristic to reduce the probability of discovery during operation and maintenance monitoring and regression testing. Specifically, the steps include the following:

[0263] Step 1: In the model encapsulation stage of the cloud inference service, the insertion interfaces for the input side, intermediate layer, and high layer of the point cloud classification model to be deployed are determined, and phase-aligned binary indices A and B are generated. Unlike Implementation Example 1, this implementation example preferably binds the generation rules of the binary indices to the server-side preprocessing chain, such as binding them to a unified normalization and fixed-point sampling strategy, to ensure that different requests have consistent binary phases under the same service configuration, thereby improving the consistency of cross-request triggering.

[0264] In this embodiment, to ensure consistency across requests under the same service configuration, it is preferable to bind the point cloud normalization and binary index generation process into a deterministic pipeline: that is, for each request input point cloud P, normalization is first performed to obtain X, and then A and B are generated based on X and phase locking is performed, so that the semantic phase of A and B is consistent with the subsequent low-tail statistical criteria, thereby ensuring the stability of the statistical caliber of subsequent g0, g1, and g2 and reducing the risk of phase flipping caused in various implementation scenarios.

[0265] Step 2: Embed a parameterless geometric sub-detector g0 on the input side. Cloud inference services typically employ a unified denoising, downsampling, and pruning strategy. In this embodiment, g0 statistics are preferably performed after the preprocessing chain and before the first local aggregation operator to avoid random perturbations to the triggering region caused by preprocessing. At the same time, low-tail quantile statistics and multi-scale density ratio are used to ensure that g0 can maintain stable triggering under different scan densities and different sampling strategies.

[0266] In this embodiment, the construction of g0 is consistent with that in Embodiment 2: g0 is formed on half-regions A and B. Pick get With ρd, and through the threshold τ c , τ d Unlike most rules that output g0, cloud services handle massive requests, and accidental triggering can significantly impact online monitoring metrics. Therefore, this embodiment preferably uses a more conservative τ in the service configuration. c , τ d With stricter trigger determination rules, an input-side determination strategy of "low false trigger priority" is implemented.

[0267] Step 3: Embed g1 in the intermediate feature layer and inject "breadcrumb" hints. Since cloud-based inference services often enable optimizations such as operator fusion, mixed precision, or tensor RT acceleration, to reduce the impact of numerical errors on cross-layer consistency, this embodiment preferably uses amplitude-controlled FiLM-style "breadcrumb" writing, and sets the writing vector to be the same as the number of channels C. m Aligned constant vectors ensure determinism and reproducibility across different inference backends; strict identity when g1 = 0 guarantees that anomalies are not easily detected in large-scale online regression tests.

[0268] In this embodiment, the intermediate layer feature is set as follows: The statistical structure of G1 is consistent with that of Example 2: it is constructed by reusing binary indexes A and B. and through The majority of rules result in g1, thus ensuring that the criterion remains consistent across backends and versions. When g1 = 1, a "breadcrumb" write is performed on half-region B:

[0269]

[0270] in To be with C m Aligned constant vectors; γ is taken when g1 = 0. B =β B =0, making the write strictly identical, thereby avoiding the introduction of observable feature drift in the absence of triggering, and reducing the probability of discovery in online regression tests.

[0271] Step 4: Embed g2 at a higher level and implement joint gating. Considering that cloud services face massive requests, false triggers can lead to a considerable anomaly rate and trigger monitoring alarms. This embodiment preferably adopts strict conjunction gating G = g0∧g1∧g2, and sets a more conservative threshold to achieve a "low false trigger priority" gating strategy.

[0272] In this embodiment, let the high-level semantic feature be H. (h) g2 is consistent with the above: it reuses binary indexes A and B for construction. and through g2 is obtained by combining the majority rules. Strict conjunctive gating is then applied:

[0273] G = g0∧g1∧g2

[0274] Where g0, g1, and g2 correspond to the confirmation results of the input side, intermediate layer, and high layer, respectively: by τ c , τ d , By fixing the service configuration item and adopting a more conservative setting, a "low false trigger priority" gating strategy can be maintained under massive requests, reducing the risk of being caught by online monitoring.

[0275] Step 5: Execute output hijacking when G=1. This embodiment preferably uses a fixed target logit bias to implement output hijacking, so as to maintain consistent attack behavior when multiple versions of the model coexist on the server side: that is, regardless of the version number or slight structural variant used by the downstream customer, as long as the backdoor gating link inserted in the model encapsulation layer exists and the threshold is consistent, the output can be stably induced to the target category when triggered; when G=0, the output remains constant to avoid affecting normal business indicators.

[0276] In this embodiment, the classification head output is assumed to be... The target category is t, and the unit vector is e. t It adopts a gated biasing method:

[0277]

[0278] Where Δ is a fixed bias amplitude constant used to ensure consistent hijacking strength across versions; when G=0 Maintaining constant output ensures that normal business metrics remain unchanged. When G=1, the logit enhancement of the target category t ensures that the output is stably induced to the target category. Since G is obtained by the strict combination of g0, g1, and g2, output hijacking is only activated when the cross-layer evidence chain is consistent, thus balancing stable activation across versions with low false trigger concealment.

[0279] This invention proposes a backdoor attack method and system for a 3D point cloud classification neural network model architecture. The core of this method lies in embedding multi-stage parameterless sub-detectors into the model's forward computation graph and constructing a consistent trigger evidence chain across layers using phase-aligned binary indices. This solidifies the backdoor logic within the network architecture in the form of a deterministic structural path. Without relying on poisoned samples or weight manipulation during the training phase, this invention achieves covert identification and reliable activation of trigger patterns through a linkage mechanism involving input-side geometric detection, intermediate layer feature verification and "breadcrumb" stabilization prompts, and high-level semantic confirmation. Furthermore, a cross-layer joint gating strategy suppresses non-trigger samples from entering the backdoor path, ensuring near-identical inference in the main task and stable accuracy for clean samples. When a trigger is established, this invention employs minimally invasive output bias hijacking to precisely induce the target category, decoupling the attack effect from the model's normal function and significantly improving the persistence and transferability of fine-tuning and retraining. Under the constraint of the lack of a stable semantic triggering carrier for embedding in 3D point clouds, the overall solution achieves high stable embedding, low false triggering activation and controllable accuracy of structural backdoors. It overcomes the problems of existing point cloud backdoor methods, such as strong dependence on data poisoning, weak anti-repair ability and insufficient adaptability to engineering deployment. It has significant technical advancement and practical value.

[0280] It should be noted that the embodiments of the present invention have been described in detail above with reference to the accompanying drawings, but the present invention is not limited thereto. Within the scope of knowledge of those skilled in the art, adjustments and substitutions to details such as the binary index generation rules, the statistical construction method of the parameterless sub-detector, the insertion layer position and number of sub-detectors, and the writing format of the "breadcrumb" prompts, without departing from the spirit of the present invention, are still within the protection scope of the present invention.

Claims

1. A method and system for attacking backdoors in neural network architectures, comprising the following steps: This invention discloses a backdoor attack method and system for a 3D point cloud classification neural network model architecture, comprising the following steps: Step 1: Construct a binary index that aligns the skeleton and phase of a 3D point cloud classification network; Step 2: Embed a parameterless geometric sub-detector g0 on the input side, read the relative geometric statistics and generate a trigger signal; Step 3: Embed a parameterless sub-detector g1 in the intermediate feature layer, verify the trigger evidence, and inject "breadcrumb" cross-layer hints; Step 4: Embed a parameterless semantic confirmation sub-detector g2 at a higher level and perform joint gating judgment with g0 and g1; Step 5: Activate the backdoor mapping only when the joint gating is established, and apply a minimally invasive bias to the target category output to achieve targeted hijacking.

2. In step 1, constructing a binary index that aligns the skeleton and phase of a 3D point cloud classification network specifically includes the following steps: Step 1.1: Input point cloud Mean removal and scale normalization are performed to ensure the stability of subsequent triggered statistics against translation and scale changes. Specifically: Where N is the number of points in the point cloud; μ is the centroid of the point cloud, obtained through... The point cloud is translated as a whole to a coordinate system with the centroid as the origin, thereby eliminating the spatial differences between different samples (mean removal); s is the scale factor, preferably the maximum Euclidean distance from each point to the origin, used to scale the point cloud to a uniform scale range, x i Here, X represents the normalized point coordinates, and X represents the normalized point cloud set. This processing ensures that all subsequent statistics relying solely on relative structure or ratios between points remain stable under translation and global scaling variations, facilitating the use of a uniform threshold under different samples and data augmentation conditions. Step 1.2: To obtain a stable one-dimensional partitioning direction, it is preferable to use the first principal component direction as the principal axis u, and let the point cloud matrix be... Its covariance is: Take the unit eigenvector corresponding to the largest eigenvalue of C as ||u||2=1. Projecting the points onto u yields a one-dimensional sequence: In this context, each row of M corresponds to the three-dimensional coordinates of a point; C describes the overall variance and correlation of the point cloud along the three coordinate axes; u is the direction with the largest variance in the point cloud, which can provide a reproducible partitioning direction that is consistent with the overall shape of the point cloud in most cases; the constraint ||u||2=1 is used to avoid the projection value being affected by the principal axis length; t i It is the scalar projection of the i-th point on the principal axis direction. The advantage of using the PCA principal axis as the dividing direction is that the principal axis direction will rotate with the rotation of the point cloud, so that the "relative order along the principal axis" can still reflect the relative structure inside the point cloud, laying the foundation for the subsequent construction of rotation-robust "internal relative geometric difference triggering". Step 1.3: Using {t i The median of the point cloud is used as the threshold, and the point cloud is divided into two halves, as defined below: A={i|t i ≤τ},B={i|t i >τ} Wherein, median(·) represents the median operator, used to obtain a robust threshold on a one-dimensional sequence; the purpose of choosing the median as the threshold is: on the one hand, it can make the number of points in the two halves as balanced as possible, avoiding serious skewness in the division due to extreme points or a small number of outliers; on the other hand, the median is not sensitive to a small number of outliers, which can improve the subsequent statistical stability. Sets A and B are index sets, used to extract the corresponding half region on points or feature tensors of any layer; Step 1.4: To eliminate the "left and right half-zone label interchange" problem caused by the uncertainty of the main axis direction sign, it is preferable to use the "lower quantile compactness" comparison to fix half B as always representing the "more compact / more suspicious" half-zone, and let the center of half-zone S∈{A, B} be: Define the set of radius distances R of the half-region S ={||x i -c S ||2|i∈S}, and take its lower quantile as the compactness measure: κ(S)=Q α (R S ) Among them, Q α (·) represents the α quantile; the smaller κ(S), the more compact the low-tailed point group of that half-region. If κ(B) > κ(A), then the labels of the two halves are swapped. (A, B) ← (B, A) After this substitution, half B is semantically fixed as the "more compact" half, providing a unified direction for subsequent triggering statistics (such as compactness ratio, density ratio); Step 1.5: Reuse the binary indexes from steps 1.3 and 1.4 as structural constants in the forward process, applying them to the l-th layer point / feature tensor. Define a half-region feature extraction operator: Among them, H (I) [A,:] indicates that the corresponding row is selected according to the index set A. By reusing the same A / B index in the trigger sub-detectors of the input layer, intermediate layer and high layer, the same half-zone statistical caliber across layers is achieved, avoiding inter-layer phase drift and providing a basis for subsequent "joint gating decision".

3. In step 2, the input side detector g0 is positioned between the "original input point cloud" and the first local aggregation operator, directly performing statistics on the two halves A and B obtained in step 1 in the geometric domain, and outputting a binary trigger signal g0∈{0,1}. Specifically, this includes the following steps: Step 2.1: Based on the low-tail compactness κ(S) defined in Step 1, construct the half-region compactness ratio as the trigger value: Where, ρ c <1 indicates that half-region B is tighter than half-region A in the low-tail sense; according to the permutation rule in step 1, usually ρ c The trend towards smaller values ​​is more pronounced on the triggered samples; Step 2.2: To reduce sensitivity to a single neighborhood scale, it is preferable to introduce multi-scale nearest neighbor distance statistics. For any half-region S, for each point i, define its k-nearest neighbor set within the half-region as follows: And define the average nearest neighbor distance of this point: Let the statistics of "low-tailed density" of the half-region at scale k be: δ k (S)=Q α ({d i,k (S)|i∈S}) Given a multiscale set Constructing multi-scale density ratio triggering quantities: in, It is a multi-scale nearest neighbor set, where each k represents the k-nearest neighbor set constructed within half-region S. The nearest neighbor representation used at that time, ρ d <1 indicates that the B half-region is denser in the low-tail sense, which meets the triggering design goal of local clustering; κ(·) and δ k Both (·) are composed of distance metrics. If the point cloud undergoes uniform scaling, the numerator and denominator of both halves will scale simultaneously by the same proportion, therefore the ratio ρ c With ρ d It remains stable to changes at the global scale; moreover, the above statistics are based on relative distances and do not depend on absolute coordinates, so they also remain stable to translations. Step 2.3: To provide adjustable strength between "missed detection suppression" and "false trigger suppression," the two criteria of compactness and density are fused using the M-of-2 majority rule, defining two indicators: in, τ is an indicator function; c With τ d The threshold value is used to control the trigger sensitivity of compactness and density, and is obtained using majority rules: M=1 indicates that triggering is triggered when "at least one condition is met", which is biased towards reducing false triggers. M=2 indicates that triggering is triggered when "both conditions are met", which is biased towards reducing false triggers. Since the detector consists only of deterministic statistics, quantile operations and threshold comparisons, it is a module with no learnable parameters and can be directly embedded into the inference graph.

4. In step 3, the intermediate layer sub-detector g1 is placed in a representative intermediate feature layer after several local aggregations and before global aggregation. Let the point-level feature tensor of this layer be... The eigenvector corresponding to the i-th point is denoted as g1 reuses the binary index from step 1 to verify the triggering evidence in the feature domain, and writes a low-bandwidth "breadcrumb" hint to subsequent layers when the verification is successful. Specifically, it includes the following steps: Step 3.1: Using the feature extraction operator from Step 1, we obtain: Among them, H (m) [A,:] represents the feature tensor H of the entire layer. (m) Extract all channel features corresponding to points with indices belonging to A from H, to obtain the feature submatrix of half region A; (m) Similarly, we obtain the B half-region [B,:]. Then, we calculate the feature centers (mean vectors) of each half-region: in, It is the "center" of half-region S in the intermediate layer feature space, and is the average representation of the features of all points in that half-region; Step 3.2: Calculate the low-tail compactness ratio and multi-scale low-tail density ratio in the feature domain, and output the verification criterion. Define the "radius distance set" of the half-region in the feature domain: in, It is the set of Euclidean distances from the feature of each point within half-region S to the feature of the center of the half-region, representing the degree of discreteness / clustering within the half-region, and based on this, the low-tail compactness of the feature domain is obtained: Among them, κ (m) (S) represents the low-tail quantile of the distance set, which is not dominated by a small number of outliers far from the center, but focuses more on the compactness of the "more core, denser subset of points", and constructs the multi-scale density ratio of the feature domain accordingly: in, The compactness ratio of the intermediate layer feature domains, if This indicates that region B is more compact than region A in the low-tail sense. Since step 1 has fixed the semantics of region B as "more compact is preferred" through the substitution rule, this ratio should be more stable and significantly smaller on the triggering samples, thus playing a verification role. Furthermore, to maintain the multi-scale caliber consistent with step 2, a set of k-nearest neighbors within the same half-region is defined in the feature domain, and the average nearest neighbor distance of a point is defined: The low-tailed density of the product at scale k is obtained: And construct a multi-scale density ratio: in, and These indicate that the B half-region is relatively more compact and dense in the feature domain, reflecting the stable differences in triggering evidence after it is amplified in the intermediate layer; Step 3.3: Generate the trigger signal for the intermediate layer detector g1 using the M-of-2 majority rule: in, This is an indicator function; it outputs 1 if the condition is true, and 0 otherwise, thus obtaining the intermediate layer trigger signal. The value of M has the same meaning as in step 2, and is used to make a trade-off between missed detection suppression and false trigger suppression; g1 is a parameterless, deterministic binary output, which will participate in the joint gating decision in step 4. Step 3.4: To reduce the chance of missed edge detections and to stabilize trigger evidence without altering the clean distribution, when g1=1, only the B half-region undergoes amplitude-controlled parameterless writing. Then, the "breadcrumbs" are written to satisfy the constraint that "the identity is not triggered": g1＝0 When g1 = 1, it is preferable to provide one of the following two parameterless writing forms: Where η is a preset constant vector, the magnitude of which is controlled to ensure approximate identity with respect to the main task; ⊙ represents channel-by-channel multiplication. This is a preset constant vector used for weak channel scaling and weak channel translation of the B half-region.

5. In step 4, the high-level sub-detector g2 is set at the high-level feature before global aggregation to perform final confirmation of the triggering evidence, and together with g0 output from step 2 and g1 output from step 3, constructs a joint gating signal, specifically including the following steps: Step 4.1: Let the high-level point-level feature tensor be... Based on the binary index, the high-level half-region feature representation is obtained, defined as follows: Where A and B are binary indexes generated in step 1 and reused across layers. By continuing to reuse the same index at higher layers, it is ensured that g2 performs statistics on the same half-region as g0 and g1, thereby maintaining cross-layer phase alignment. Step 4.2: In the high-level feature domain, calculate the low-tail compactness statistics and multi-scale low-tail density statistics for half-regions A and B respectively, using the same low-tail quantile operator Q from steps 2 and 3. α (·) and multiscale sets And construct two ratios: Among them, κ (h) (·) indicates the low-tail compactness statistic of the upper half-zone. This represents the low-tailed density statistic at scale k. Step 4.3: Generate the higher-level trigger signal g2 using the same majority rule as described above: in, M is the high-level threshold used to control the strictness of g2's confirmation; M is the majority rule threshold, consistent with steps 2 and 3. Step 4.4: Construct the joint gating signal G for cross-layer consistency, defined as follows: G = g0∧g1∧g2 6. A backdoor attack system for a 3D point cloud classification neural network model architecture, characterized in that, The system is used to implement the three-dimensional point cloud architecture backdoor attack method as described in any one of claims 1 to 6. The system includes: a binary index generation module, an input-side geometry detection module, an intermediate feature verification and "breadcrumb" writing module, a high-level semantic confirmation and joint gating module, and an output hijacking control module. The binary index generation module is used to perform statistical analysis on the input 3D point cloud before model inference begins, generate a binary index for cross-layer reuse, and fix the semantic phase of each half-region. The input-side geometric detection module is used to perform statistical detection on the geometric distribution of the point cloud based on the binary index, construct a parameterless geometric triggering criterion, and generate a first triggering signal. The intermediate feature verification and "breadcrumb" writing module is used to perform feature domain verification on the trigger evidence in the intermediate feature layer of the point cloud network, and write cross-layer prompt information to the corresponding half-area when the verification conditions are met. The high-level semantic confirmation and joint gating module is used to confirm the trigger evidence in the high-level semantic feature space, and to jointly gating the trigger signals from the input side, the intermediate layer and the high level to generate a backdoor activation control signal. The output hijacking control module is used to apply a preset bias to the target category output to achieve targeted hijacking when the backdoor activation control signal indicates that the trigger is established, and to keep the model output unchanged when the trigger is not established.

Images