Significance and geometry enhanced transferable adversarial sample generation method for three-dimensional point cloud classification

Abstract

The application provides a method for generating significant and geometric enhanced transferable adversarial samples for three-dimensional point cloud classification, comprising: obtaining an original three-dimensional point cloud and a true class label thereof, and loading a pre-trained three-dimensional point cloud classification model capable of obtaining model structure and gradient information as a proxy model; based on the proxy model and a current iteration adversarial point cloud, calculating a mixed significant score of each point in the original three-dimensional point cloud, performing time sequence smoothing and stabilization processing to obtain a stable significant score; according to the stable significant score, screening a target point set from the original three-dimensional point cloud and determining a key perturbation region through neighborhood expansion, and simultaneously assigning a perturbation intensity coefficient to each point in the key perturbation region according to the stable significant score; using an optimization objective function, iteratively optimizing and generating an adversarial perturbation in the key perturbation region based on the optimization objective function, and applying the adversarial perturbation to the original three-dimensional point cloud to obtain a transferable adversarial sample for a black-box target point cloud classification model.

Description

Technical Field

[0001] This invention belongs to the fields of computer vision, 3D point cloud, deep neural network security and adversarial learning technology, and specifically relates to a method for generating saliency and geometrically enhanced transferable adversarial examples for 3D point cloud classification. Background Technology

[0002] 3D point clouds, with their precise representation of 3D spatial geometry, have become the core data carrier for environmental perception and target classification tasks in scenarios such as autonomous driving and intelligent robots. Deep neural networks for 3D point clouds, represented by PointNet, PointNet++, DGCNN, and PCT, have become the most widely used technical solutions in these scenarios due to their excellent feature extraction and classification performance. However, existing 3D point cloud deep classification networks generally suffer from adversarial vulnerability. Applying minute coordinate perturbations to the input point cloud, imperceptible to the human eye, can lead to errors in the model's classification results. This security risk directly restricts the practical application of related technologies in scenarios with high reliability requirements. 3D point cloud adversarial example generation technology is a core foundational technology for evaluating the robustness of deep networks, uncovering potential security risks, and improving model defense capabilities. In recent years, it has become a research hotspot in the fields of 3D computer vision and deep learning security.

[0003] Several mature technical approaches have emerged in the generation of adversarial examples from 3D point clouds. Early research focused on white-box optimization attacks, applying perturbations to the point cloud coordinates through gradient iterative optimization given the known model structure and parameters. This approach can achieve extremely high attack success rates in white-box scenarios. However, the generated perturbations often closely match the decision boundaries of specific proxy models, resulting in limited transferability across network architectures. To improve the realism and morphological plausibility of adversarial examples, some studies have introduced geometric constructibility constraints. Through K-nearest neighbor structure constraints, projection pruning, and local smoothing regularization, the geometric distortion caused by perturbations is reduced, making the generated point clouds more consistent with natural morphology and engineering feasibility requirements. However, such fixed-rule constraints often compress the degrees of freedom in attack optimization, making it difficult to balance morphological plausibility and attack effectiveness. Cross-model transferability remains significantly limited. In response to the widespread need for black-box attacks in scenarios such as autonomous driving, transferable black-box attacks have become a research focus in the field. Related solutions alleviate the overfitting problem of adversarial perturbations on a single agent model by means of key feature guidance, random perturbation factor decomposition, and prior introduction of data distribution, thereby improving the success rate of cross-architecture black-box attacks.

[0004] Despite significant advancements in existing technologies, several technical shortcomings remain in the practical application of transferable adversarial example generation. First, the saliency guidance mechanisms of existing schemes have obvious limitations. Most methods rely on a single type of gradient signal or saliency cue, making it difficult to capture the shared critical discriminative structures across different network architectures. This results in insufficient cross-architecture consistency, making it prone to overfitting the proxy model and causing large fluctuations in the success rate of black-box transfer attacks. Furthermore, gradient noise during iteration can easily cause saliency estimation jitter, leading to drift in critical update regions. This perturbation spreads from critical structures to non-critical regions, further weakening transfer performance. Second, existing geometrically imperceptible control schemes struggle to balance constraints and attack effectiveness. They often employ global norm constraints or simple smoothing regularization, failing to adaptively bind to critical classification regions. Weak constraints easily lead to significant distortions of critical structures, while strong constraints drastically compress the attack optimization space, making it difficult to simultaneously achieve effective disruption of critical classification structures and maintain local geometric continuity. In addition, the existing perturbation budget allocation strategies are relatively crude, mostly adopting uniform allocation or coarse-grained weight redistribution methods. They lack regional constraints and budget redistribution coordination mechanisms for migration attacks, and cannot form a continuous and controllable focus on key areas shared across architectures. This results in low utilization of the limited perturbation budget, making it difficult to further improve the effectiveness of black-box migration attacks under a fixed perturbation budget. Summary of the Invention

[0005] To address the shortcomings and deficiencies of existing technologies, this invention provides a method for generating saliency and geometrically enhanced transferable adversarial examples for 3D point cloud classification. This method is mainly applied to black-box migration attack scenarios and can serve the security risk assessment and robustness testing of 3D point cloud depth classification models in fields such as intelligent driving and robot perception.

[0006] Addressing the core pain points commonly found in existing 3D point cloud adversarial example generation technologies, including reliance on single saliency or gradient signals leading to overfitting of proxy models, unstable success rates of black-box transfer attacks across network architectures, the use of globally fixed rules for geometrically imperceptible constraints making it difficult to simultaneously address the destruction of key classification structures and the maintenance of local geometric continuity, as well as the coarse perturbation budget allocation strategy, lack of a continuously controllable focusing mechanism for key regions, and low budget utilization efficiency, this invention achieves highly transferable and highly imperceptible 3D point cloud adversarial example generation through the synergistic optimization of saliency guidance and geometric constraints.

[0007] The core design of this invention lies in first constructing a hybrid saliency unified guidance mechanism that integrates semantic discrimination and geometric consistency. Semantic saliency information reflecting the contribution of point cloud classification is extracted through a coordinate self-attention mechanism. This is combined with geometric saliency information that conforms to the local geometric features of the point cloud, obtained based on local normal estimation and gradient tangent plane projection. After fusion, a unified saliency guidance signal with both cross-architecture consistency and local geometric stability is obtained, accurately locating the key classification structures shared by different networks. Furthermore, a temporal smoothing strategy is used to iteratively stabilize the saliency signal, suppressing saliency hotspot drift caused by gradient noise during iteration, ensuring the spatial compactness and temporal coherence of the perturbation update region.

[0008] To optimize the perturbation budget, this invention constructs a collaborative mechanism of local region constraints and point-level intensity allocation based on the stabilized saliency signal. First, a compact key perturbation region is determined through saliency ranking and neighborhood expansion, restricting perturbation updates only within this region to avoid invalid deformation. Simultaneously, perturbation intensity is adaptively allocated based on the saliency score of each point, achieving refined budget allocation for higher perturbation amplitudes in highly sensitive regions, maximizing attack effectiveness under a fixed perturbation budget. To balance attack effectiveness and imperceptibility, this invention constructs a multi-dimensional joint optimization system, incorporating classification of attack targets, global shape consistency constraints, and saliency-guided local geometric smoothing constraints into the joint optimization objective. This is further enhanced by dual amplitude control through point-by-point maximum perturbation limits and global average perturbation limits, ensuring both the attack effectiveness of the adversarial example on the target model and strict control over the geometric distortion of the point cloud, achieving perturbation imperceptibility to the human eye.

[0009] Based on testing and verification on mainstream 3D point cloud classification datasets, this method achieves a higher success rate in black-box migration attacks than existing mainstream methods across various mainstream point cloud classification architectures, while maintaining excellent geometric fidelity. The core modules of this method are decoupled, which can flexibly adapt to different point cloud scales, network structures, and non-directional / directional attack requirements, and has excellent engineering feasibility and scalability.

[0010] The specific technical solution adopted by this invention to solve its technical problem is as follows:

[0011] A method for generating transferable adversarial examples with saliency and geometry enhancement for 3D point cloud classification, comprising:

[0012] Obtain the original 3D point cloud and its true category label, load the pre-trained 3D point cloud classification model that can obtain model structure and gradient information as a proxy model, and set the target point cloud classification model in black box state as the transfer attack target.

[0013] Based on the surrogate model and the current iterative adversarial point cloud, the mixed saliency score of each point in the original 3D point cloud is calculated. The mixed saliency score is formed by fusing the first saliency score obtained based on the coordinate self-attention mechanism and the second saliency score obtained based on the tangent plane gradient.

[0014] The mixed significance scores are then subjected to time-series smoothing and stabilization to obtain stable significance scores.

[0015] The target point set is selected from the original 3D point cloud based on the stable saliency score and the key perturbation region is determined by neighborhood expansion. At the same time, perturbation intensity coefficients are assigned to each point in the key perturbation region based on the stable saliency score.

[0016] Using an optimization objective function that includes a classification loss term, a geometric imperceptibility constraint term, and a saliency-guided geometric constraint term, adversarial perturbations are generated iteratively based on the optimization objective function within the key perturbation region. The classification loss term is used to drive the perturbation so that the surrogate model's classification result of the perturbated point cloud deviates from the true class label. The adversarial perturbation is then applied to the original 3D point cloud to obtain transferable adversarial samples for the black-box target point cloud classification model.

[0017] Furthermore, obtaining the first saliency score based on the coordinate self-attention mechanism includes: linearly mapping the coordinate input coordinate embedding layer of the current iteration adversarial point cloud to obtain point-level features; performing multi-head self-attention processing on the point-level features to obtain attention aggregation features; and normalizing the attention aggregation features to obtain the first saliency score characterizing the semantic discriminative importance of each point.

[0018] Furthermore, obtaining the second significance score based on the tangent plane gradient includes: constructing a local neighborhood for each point in the original 3D point cloud based on the k-nearest neighbor algorithm, calculating the normal vector of each point and the tangent plane; calculating the gradient of the classification loss with respect to the coordinates of each point in the current iteration adversarial point cloud, projecting the gradient onto the tangent plane to eliminate the normal component, and taking the modulus of the projected gradient and normalizing it to obtain the second significance score characterizing the sensitivity of local geometric consistency of each point.

[0019] Furthermore, the fusion includes: weighting and summing the normalized first significance score and the second significance score according to a preset fusion weight, and then performing global normalization on the summation result to obtain a mixed significance score.

[0020] Furthermore, the time-series smoothing and stabilization process includes: using an exponential moving average algorithm to weight and fuse the mixed significance score of the current iteration with the stable significance score of the previous iteration according to a preset smoothing coefficient to obtain the stable significance score of the current iteration.

[0021] Furthermore, the neighborhood expansion of the target point set includes: selecting the points with the highest stable saliency scores from the top preset proportion as the target point set, expanding the neighborhood of each point in the target point set using the k-nearest neighbor algorithm, merging the expanded points to form a key perturbation region, and constructing a binary mask to restrict the perturbation to be updated only within the key perturbation region.

[0022] Furthermore, the allocation of the disturbance intensity coefficient includes: normalizing the stability significance score of each point to the [0,1] interval, multiplying it by a preset scaling factor, and cropping the result to no more than 1, so that points with higher stability significance scores correspond to higher disturbance intensity coefficients.

[0023] Furthermore, the saliency-guided geometric constraint term uses a stable saliency score as a weight, combined with the tangent plane geometric consistency constraint, to suppress the perturbation update direction that is inconsistent with the local surface of the original 3D point cloud.

[0024] Furthermore, during the iterative optimization process, an L2 norm constraint is applied to the perturbation vector of each point, such that the perturbation amplitude of a single point does not exceed a preset maximum value, and the average perturbation amplitude of all points does not exceed a preset average value.

[0025] Furthermore, a saliency and geometry-enhanced 3D point cloud transferable adversarial sample generation system includes a processor and a memory, the memory storing a computer program, the processor executing the computer program to implement the method described above.

[0026] A non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method described above.

[0027] Compared to existing technologies, this invention and its preferred solution overcome the limitations of existing technologies that rely on a single saliency or gradient signal by integrating a hybrid saliency guidance mechanism that combines semantic discrimination and geometric consistency. This allows for precise localization of shared key classification structures across different network architectures, effectively mitigating the overfitting problem of adversarial perturbations on a single proxy model. It significantly improves the stability and success rate of cross-architecture migration attacks in black-box scenarios, addressing the core pain points of insufficient cross-model consistency and large fluctuations in migration effects in existing solutions. Furthermore, by introducing a temporal smoothing and stabilization strategy to the saliency signal, this invention effectively suppresses the saliency hotspot jitter and key region drift caused by gradient noise during iterative optimization. This ensures the spatial compactness and temporal coherence of the perturbation update region, reduces invalid updates caused by perturbation diffusion, and further strengthens cross-model consistency against perturbations. Building upon this foundation, this invention constructs a collaborative mechanism of local region constraints and point-level budget redistribution. This mechanism concentrates perturbation updates on classification-sensitive critical structures while achieving refined allocation of higher perturbation intensity to highly sensitive regions. Under the same perturbation budget, it achieves superior attack performance, significantly improving the utilization efficiency of the perturbation budget and reducing ineffective deformation of non-critical regions. This resolves the contradiction between attack effectiveness and geometric imperceptibility that existing solutions struggle to simultaneously address. Addressing the shortcomings of fixed-rule geometric constraints in existing technologies, this invention employs an adaptive geometric imperceptibility joint constraint system bound to the critical region. This system suppresses outlier perturbations, global drift, and local distortions through multi-dimensional constraints, ensuring the geometric fidelity of adversarial examples. It also avoids the problem of excessive constraints compressing the attack optimization degrees of freedom, achieving a good balance between critical structure destruction and the maintenance of local geometric continuity. Furthermore, the core functional modules of this invention adopt a decoupled design, which can flexibly adapt to the needs of different point cloud scales, different network architectures and different attack targets. It can be easily combined with multi-agent model strategies, different geometric measurement methods and various optimizers, making it easy to deploy and apply in real-world scenarios such as security assessment of 3D point cloud classification models and robustness testing of intelligent driving perception systems. It has excellent scalability and engineering feasibility. Attached Figure Description

[0028] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments:

[0029] Figure 1 This is a flowchart illustrating the overall process of an embodiment of the present invention.

[0030] Figure 2 This is a visualization of an embodiment of the present invention on the ModelNet40 dataset;

[0031] Figure 3 This is a visualization of the present invention on the ScanObjectNN dataset, representing an embodiment of the invention. Detailed Implementation

[0032] To make the features and advantages of the present invention more apparent and understandable, specific embodiments are described below in detail:

[0033] It should be noted that the following detailed descriptions are exemplary and intended to provide further explanation of this application. Unless otherwise specified, all technical and scientific terms used in this specification have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains.

[0034] It should be noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the exemplary embodiments according to this application. As used herein, the singular form is intended to include the plural form as well, unless the context clearly indicates otherwise. Furthermore, it should be understood that when the terms "comprising" and / or "including" are used in this specification, they indicate the presence of features, steps, operations, devices, components, and / or combinations thereof.

[0035] To address the shortcomings of existing technologies, the main technical problems solved by the embodiments of the present invention are as follows:

[0036] 1) To adapt to black-box threat modeling in intelligent driving and 3D point cloud perception systems, existing "white-box optimization attack" approaches, while achieving high attack success rates through gradient iteration under known model conditions, often heavily rely on the decision boundaries and intermediate feature representations of the surrogate model for their update direction. When the surrogate model and the victim model differ in neighborhood construction, feature aggregation, and attention mechanisms, a single gradient or a single saliency cue can easily generate "architecture-specific" perturbation patterns, leading to unstable attack performance after migration to the victim model. Simultaneously, gradient noise during iteration can cause fluctuations in saliency estimation, resulting in drift in the update region. The perturbation spreads from critical structures to non-critical areas, reducing budget utilization and further weakening transferability. Furthermore, white-box methods often employ global norm constraints or simple regularization to control perturbation amplitude, making it difficult to provide sufficient geometric consistency protection for critical local structures such as wing edges, vehicle contours, and traffic cone tips. This can easily lead to significant local deformation and a difficulty in balancing imperceptibility and effectiveness.

[0037] 2) In the "geometrically constructible constraint" approach, existing methods typically use KNN neighborhood structure constraints, projection pruning, local smoothing, or realizability conditions to make the generated point clouds more consistent with natural shapes or engineering deployment requirements. However, these constraints are often applied with fixed rules and lack adaptive adjustment capabilities tied to critical discriminative regions. When the constraints are too weak, critical structures may still exhibit significant distortions; when the constraints are too strong, the optimization degrees of freedom are compressed, leading to a decrease in attack success rate under the same perturbation budget. This is especially true in cross-model transfer scenarios, where the contradiction of "more natural shape but limited transfer benefits" is more likely to occur. Based on this, the technical problem that this application needs to solve is: while ensuring local geometric continuity and appearance rationality, the perturbation can be stably focused on the discriminatively sensitive structures shared across architectures, thereby avoiding the trade-off between geometric constraints and attack effectiveness.

[0038] 3) In the "transferable black-box attack" approach, existing methods improve cross-model transferability through key feature guidance, random perturbation decomposition, or the introduction of prior data. However, they still generally face problems such as insufficient cross-architecture semantic alignment and unstable saliency: the intermediate semantic representations of different networks differ significantly. If the saliency clues are singular or the estimation is unstable, a surrogate model bias will still form, leading to fluctuations in the transfer success rate. At the same time, saliency drift and perturbation diffusion during iteration will cause budget waste and impair imperceptibility. More importantly, existing technologies lack a collaborative mechanism of "regional constraints + budget reallocation" for transfer: using only local masking may limit the effective update direction, while only performing weight reallocation may lead to local over-concentration and distortion. Therefore, the core technical problem to be solved in this application is to construct an adaptive and interconnected strategy that stabilizes the update region, allocates the budget reasonably, and significantly improves the success rate of cross-architecture black-box transfer attacks while ensuring imperceptibility.

[0039] In summary, this invention proposes a transferable adversarial sample generation method that combines saliency and geometric enhancement, aiming to address the inability to achieve a good balance between the imperceptibility of existing point cloud adversarial attacks and the success rate of cross-model transfer adversarial attacks.

[0040] This invention employs an iterative optimization process to generate 3D point cloud adversarial examples on a proxy model. This process first integrates semantic discriminative information and geometric consistency information to construct point-level saliency guidance signals, and uses a smoothing and stabilization mechanism to reduce saliency fluctuations during iteration, ensuring that the location of key regions remains consistent and coherent across multiple updates. Building upon this, the invention further restricts perturbation updates to compact local regions determined by saliency, allowing the limited perturbation budget to focus on local structures more sensitive to classification decisions. Simultaneously, it adaptively allocates the perturbation intensity of each point based on stable saliency, giving key points a stronger update amplitude while keeping non-key points with weaker perturbations, thereby improving budget utilization and reducing ineffective deformation. Finally, the invention introduces geometrically imperceptible constraints during the optimization process, suppressing outlier perturbations and global drift through joint control of local structural consistency and overall shape differences. This allows the generated adversarial point cloud to maintain visual and geometric fidelity while still exhibiting a high success rate of transfer attacks on different unknown victim models. The overall framework of the scheme is as follows: Figure 1 As shown, the following steps will demonstrate the process in detail.

[0041] Step 1: Input definition, input the original 3D point cloud sample and the true class label of the sample; select a proxy classification model that can obtain model structure and gradient information as the model on which the attack generation depends; at the same time, set an unknown target model as the transfer attack object. The target model is in a black box state, and the attacker cannot obtain its internal parameters and structure. Then define the target of adversarial sample generation: after applying a small coordinate perturbation with limited amplitude and basically unchanged overall shape to the original point cloud, an adversarial point cloud is obtained, so that when the adversarial point cloud is input into the target model, the classification result will be wrong, that is, the model output class is no longer equal to the true class; if it is a targeted attack, the model output is required to be induced to the pre-set target class. In this step, the constraints of perturbation intensity and geometric imperceptibility are given at the same time, which are used to limit the perturbation update amplitude and deformation degree in subsequent iteration steps. The optimization target is shown in formula (1):

[0042] (1)

[0043] in, For the generated adversarial point cloud, X is the original input point cloud, and y is the ground truth label of the original point cloud. This represents a target point cloud classification model with learnable parameters ϕ. is the perturbation amplitude threshold; D(·) is the distance function that measures the geometric similarity of point clouds, specifically selected from any one of the Chamfer Distance, Hausdorff Distance, or L2 distance defined in this invention.

[0044] This is the classification attack loss, used to drive misclassification. For targetless attacks, the classification target is defined as negative cross-entropy, as shown in formula (2):

[0045] (2)

[0046] Here, CE represents cross-entropy. In standard classification tasks, the goal is to minimize cross-entropy loss (to make the model predict more accurately); however, in adversarial attack scenarios, the goal is to maximize cross-entropy loss (to make the model predict incorrectly on adversarial examples). Therefore, by defining the classification loss as negative cross-entropy, minimizing... This is equivalent to maximizing the original cross-entropy loss, thereby enabling the model to predict attack effects that are as inaccurate as possible. y represents a predefined targeted attack category. By minimizing the cross-entropy loss of this target category, the model can be induced to classify the adversarial point cloud into the predefined target category.

[0047] For formula (1), D(·) restricts the imperceptibility of the point cloud during the attack process and limits the degree of deformation of the point cloud. Commonly used distance calculation methods include Chamfer distance (CD), Hausdorff distance (HD), and L2 distance. The formulas are expressed by (3), (4), and (5) respectively:

[0048] (3)

[0049] (4)

[0050] (5).

[0051] Step 2: Coordinate Self-Attention Saliency Construction. This invention introduces a lightweight coordinate self-attention module into the surrogate model to generate point-level importance scores. Specifically, the point cloud of the current iteration is first input into the coordinate embedding layer, and the coordinates are linearly mapped to point-level features. Then, the linearized features are... Multi-head self-attention processing is performed. Typically, it includes three sets of linear transformations (Query / Key / Value) and attention weight calculations, and standard attention calculations are performed for each attention head, as shown in formulas (6) and (7):

[0052] (6)

[0053] (7)

[0054] Where W is the weight, the feature dimension d is 64, and the number of attention heads h is 4. hThis represents the feature dimension of a single attention head. At this point, the point-to-point correlation weight matrix A is obtained, which, after multi-head concatenation, yields the attention aggregation feature. .

[0055] Finally, this type of attentional information is aggregated into a point-level importance score, which is then normalized to obtain the coordinate self-attention saliency. . This reflects which points or local structures have a greater impact on category discrimination, and is subsequently used to guide the centralized update of perturbations. Equation (8) represents this process:

[0056] (8)

[0057] in, It is the point-level importance score generated by the attention module for the point set, which is then normalized to obtain the final coordinate self-salience score.

[0058] Step 3: Construction of tangent plane gradient significance. To make the perturbation update more consistent with local geometry, this invention further constructs the tangent plane gradient significance. Specifically, for each point in the point cloud, a local neighborhood (e.g., k-nearest neighbor or radius neighborhood) is constructed for each point in the original point cloud. The neighborhood covariance matrix is ​​calculated and PCA is performed to obtain the normal direction and its tangent plane of the point. The normal direction is used as an estimate of the local surface direction in this invention. Subsequently, under the current iterative adversarial point cloud input, the gradient vector of the classification attack loss with respect to the coordinates of each point is calculated to obtain the point-level gradient field. Equation (9) represents this process:

[0059] (9)

[0060] Next, the component of the gradient in the normal direction is removed, retaining only the component in the tangent plane direction; this process can be represented by formula (10):

[0061] (10)

[0062] Where, N x This is the normal vector along the gradient. Finally, the intensity of the gradient on the tangent plane is normalized to obtain... This method can suppress update directions inconsistent with local surfaces, enhancing imperceptibility and cross-model robustness. This process can be represented by equation (11):

[0063] (11)

[0064] Step 4: Saliency fusion. Assuming that a single significant signal may be biased, therefore... and After normalization, a weighted fusion is performed to obtain a unified saliency map. The unified saliency map contains both semantic discriminativeness and geometric consistency, and can serve as a unified guiding signal for transfer attacks. The fusion relationship is expressed by formula (12):

[0065] (12)

[0066] Here, γ is the fusion weight, used to adjust the contribution ratio of the tangent plane gradient saliency to the unified saliency, with a value ranging from 0 to 1. Based on testing experience, when γ = 0.5, the relative contributions of semantic discriminative cues and geometric consistency cues can be balanced to the greatest extent. The unified saliency map can serve as a unified guiding signal for transfer attacks. The aforementioned unified saliency map simultaneously integrates semantic discriminative information and local geometric consistency information from point cloud classification, and can serve as the core guiding signal for perturbation updates during iterative processes. However, during iterative attacks, gradient noise can easily cause the saliency map to jitter, leading to drift in key update regions. Therefore, temporal smoothing and stabilization processing of the unified saliency map is necessary to ensure the consistency of key region localization.

[0067] Step 5: Saliency Stabilization. During the iterative attack, the saliency map may fluctuate due to gradient noise, causing key regions to drift. Therefore, this invention introduces an exponential moving average to smooth the saliency map, obtaining a stable saliency map. Its update relationship is expressed by formula (13):

[0068] (13)

[0069] Here, μ is the smoothing coefficient (between 0 and 1). A larger value of μ results in more stable saliency but a slower response; a smaller value of μ makes the saliency more sensitive to the current gradient but more prone to fluctuations. Through this mechanism, the saliency map remains coherent throughout the iteration process, thereby suppressing disordered drift in the update region. In this embodiment, this value is preferably set to 0.5.

[0070] Step 6: Patch selection based on saliency map. Based on a stable saliency map, select the top-p points in saliency ranking and perform k-nearest neighbor expansion on each seed point to form a compact perturbation region (Patch). After testing and verification, the optimal parameters are p=0.3 and k=16, which can select the best patch. Then, a binary mask m is constructed to restrict the update to only occur within this compact region. The mask is defined as shown in formula (14):

[0071] (14)

[0072] By using regional constraints, perturbations are confined to semantically critical and spatially compact local structures, which can improve budget utilization and enhance transferability.

[0073] Step 7: Gain intensity allocation based on the saliency map. To achieve a perturbation distribution with stronger gains at key points and weaker gains at non-key points, point-level gain coefficients are generated based on the generated saliency map. And gain modulation is applied to the gradient or update amount during the update. The gain allocation can be expressed by formula (15):

[0074] (15)

[0075] Wherein, α is used to control the amplification intensity, and α is Setting a maximum value can prevent excessive local distortion; it is preferable to set it to 0.8. The function is quite simple and clear: points with high significance receive stronger updates, while points with low significance remain at a level close to the baseline strength. This improves the stability of the iteration process and reduces the impact of temporary significance peaks. max This is the upper limit of the point-level gain coefficient, used to prevent excessive amplification of local disturbances that could lead to geometric distortion. It is a positive number greater than 1.

[0076] Step 8: Loss Function and Iterative Optimization. This invention constructs a joint loss function to simultaneously satisfy both attackability and imperceptibility, wherein the classification attack loss... Used to drive misclassification; geometrically imperceptible loss To constrain the shape difference between the adversarial point cloud and the original point cloud, Chamfer distance (CD) and Hausdorff distance (HD) are used. Furthermore, to further improve the consistency of perturbation migration across different models, this invention introduces… The guiding term, with stability and saliency as its core weight, focuses the optimization process on salient regions and combines tangent plane geometric consistency constraints to suppress update directions inconsistent with local surfaces, thereby improving attack success rate while reducing perceptible deformation.

[0077]

[0078] in, Let W(X) represent an intermediate feature map of the source model (corresponding to the l-th layer), and let W(X) be the point-level saliency weights based on the original clean point cloud. This guiding term uses the saliency score as the weight to penalize gradient update directions that are inconsistent with the local tangent plane, so that the perturbation optimization focuses on the highly saliency region, while ensuring that the perturbation update conforms to the local geometric consistency of the point cloud.

[0079] The total loss is expressed by formula (16):

[0080] (16)

[0081] During the iteration process, in order to limit the degree of deformation of the point cloud, this invention uses strict point-by-point and global constraints to limit the disturbance within the budget constraint range, so as to ensure that the disturbance intensity does not exceed the preset budget. The constraint method can be expressed by formula (17):

[0082] (17)

[0083] The point-by-point maximum constraint is as follows: among all points, the largest L2 norm of the perturbation vector at each point is taken as the overall point-level maximum perturbation magnitude, and this maximum value must be less than the maximum perturbation range. This point-level constraint is used to prevent excessively large anomalous perturbations at a few points, thereby avoiding the generation of obvious outliers. Simultaneously, the mean constraint controls the overall deformation magnitude by limiting the average of the perturbation magnitudes across all points, preventing excessive shifts in the adversarial point cloud globally. These two types of constraints work together during the iterative update process to continuously ensure that the generated perturbations meet the budget requirements and constraints for geometric imperceptibility.

[0084] Formula (1) is the basic optimization objective of this invention. To further improve the mobility and geometric fidelity of adversarial examples, this invention improves the optimization objective by introducing a geometric loss term L. cd With SAGE guide item L SAGE Combined with the dual perturbation constraints shown in formula (17), a joint optimization system is formed as shown in formula (16).

[0085] In this embodiment, the Adam optimizer is used for iterative optimization, the learning rate is preferably set to 0.05, and the maximum number of iterations is preferably set to 200. During the iteration process, after each round of update, the disturbance is projected and clipped by the double constraint of formula (17) to ensure that the disturbance amplitude always meets the preset geometric imperceptibility requirement.

[0086] Step 9: Output the adversarial point cloud. When the iteration reaches the maximum number of iterations or the stopping condition is met (the output class of the adversarial point cloud input proxy model is inconsistent with the true class under no-target attack, and the output class of the adversarial point cloud input proxy model is consistent with the preset target class under targeted attack), the final adversarial point cloud sample is output (i.e., the point cloud obtained by superimposing the final perturbation on the original point cloud). In optional implementations, consistency screening can be performed on multiple proxy models or an early stopping strategy can be adopted to further improve the success rate of migration attacks on unknown victim models. Specifically, the multi-proxy model consistency screening involves generating adversarial point clouds on multiple proxy models with different architectures from the same original point cloud, and selecting the adversarial point cloud that can achieve misclassification on all proxy models as the final output. The early stopping strategy involves checking the classification results of the adversarial point cloud on the proxy model at fixed intervals during iteration. When the misclassification requirement is met for 5 consecutive iterations, the iteration is terminated early to avoid overfitting the decision boundary of a single proxy model.

[0087] The above-described embodiments of this invention, based on the core discovery that key geometric structures can be shared across different models in 3D point cloud migration adversarial attacks, propose an adversarial example generation scheme that primarily relies on saliency-guided and geometrically constrained collaborative optimization. Its improvements and advantages include:

[0088] Discovery and Utilization of Shared Key Regions. This invention reveals and utilizes the phenomenon of shared geometric key regions existing between different models, namely, local structural regions with stable and high influence on classification decisions under various network architectures. By identifying and focusing on these high-influence regions, the success rate of cross-model consistency and migration attacks against perturbations can be significantly improved.

[0089] A unified guidance mechanism based on hybrid saliency. This invention proposes a hybrid saliency construction scheme that integrates the semantic discriminative contribution reflected by coordinate self-attention with the geometric consistency embodied by the tangent plane gradient to obtain a unified saliency signal that combines semantic sensitivity and geometric stability. This signal is used to locate key points and key local structures and serves as the main guiding basis for the entire process of perturbation updates.

[0090] Significance stabilization and region coherent update mechanism. To reduce the drift of key regions caused by significance jitter in iterative optimization, this invention introduces a temporal smoothing and stabilization strategy for significance signals, so that significance hotspots remain continuous and consistent across multiple iterations, thereby ensuring that the perturbation update region is spatially compact and temporally coherent, avoiding perturbation diffusion and invalid updates.

[0091] A collaborative mechanism of local region constraints and point-level budget reallocation. This invention constructs a compact patch perturbation region based on stability saliency and restricts updates to mainly occur within this region through masking; simultaneously, it allocates point-level gain to the update intensity of each point within the region according to saliency, realizing a budget reallocation strategy of "stronger for critical points and weaker for non-critical points", achieving higher attack efficiency under the same budget and reducing unnecessary changes to the overall shape.

[0092] An explicit geometrically imperceptible joint constraint system. This invention introduces shape consistency metrics and local smoothing regularization into the optimization objective, and combines them with explicit budget control (such as point-level maximum perturbation constraints and mean perturbation constraints or projection operations) to suppress outliers, control global drift, and reduce local distortions. This improves the ability to perform migration attacks while maintaining the geometric fidelity and imperceptibility of adversarial examples.

[0093] In summary, the proposed scope of protection of this invention not only covers the core modules such as unified saliency construction and stabilization, patch constraints and gain allocation, joint loss and geometric constraints and their synergistic relationships, but also covers their equivalent replacement and extended implementations under multi-proxy models, different geometric metrics and different attack target settings.

[0094] Table 1 shows the attack success rate of this invention on the ModelNet40 dataset.

[0095] Table 1

[0096]

[0097] Table 2 shows the attack success rate of this invention on the ScanObjectNN dataset.

[0098] Table 2

[0099]

[0100] The experimental results on the two datasets, from four dimensions—cross-model transfer success rate, perturbation amplitude adaptability, attack stability, and dataset generalization—fully demonstrate the significant advantages of the proposed solution compared to existing mainstream methods, as detailed below:

[0101] 1. Significantly higher success rate in cross-model black-box migration attacks.

[0102] This invention, when using any point cloud network as the proxy model, achieves a significantly higher attack success rate against all other target black-box models with different architectures than existing methods such as 3D-Adv, KNN, GeoA3, AdvPC, PF-Attack, and CFG, and represents the best value among all compared methods. For example, when using PointNet as the proxy model, At a resolution of 0.45, the attack success rate against PointNet++ (MSG) reached 88.4% (CFG 84.7%) and against DGCNN 56.2% (CFG 49.3%). This demonstrates that the hybrid saliency guidance + geometry enhancement strategy of this invention can accurately capture key geometric structures shared across models, significantly improve the effectiveness of cross-architecture black-box transfer, and solve the core problems of low transfer success rate and instability of existing methods.

[0103] 2. It exhibits good adaptability to different disturbance amplitude thresholds, with more significant gains under high disturbance amplitudes.

[0104] exist =0.18 (low disturbance amplitude) and Under both settings of 0.45 (high perturbation amplitude), the attack success rate of this invention remains leading; and under the high perturbation amplitude, the success rate improvement of this invention is greater than that of other methods. For example, when using PointNet++ (MSG) as the proxy model, At a perturbation cost of 0.45, the success rate of attacking PointNet by this invention is 42.6%, which is much higher than CFG's 36.6%. This shows that the perturbation budget allocation strategy (Patch region constraint + point-level gain allocation) of this invention can make more efficient use of perturbation amplitude and achieve better attack results under limited / higher perturbation budget.

[0105] 3. The attack effect is highly stable with no obvious architectural bias.

[0106] Many existing methods suffer from a bias where success rates are high when the surrogate model and target model architecture are similar, but plummet when the architectures differ significantly (e.g., 3D-Adv's success rate for models with different architectures is generally below 10%). In contrast, this invention maintains a high and stable attack success rate for all target model architectures, without significant architecture adaptability bias. For example, when DGCNN is used as the surrogate model, this invention achieves significantly higher success rates against PointNet++ (MSG / SSG) and PointNet than other methods, demonstrating the invention's significant stabilization and geometric constraint mechanism, which effectively suppresses perturbation drift during iteration and ensures the stability of cross-model attacks.

[0107] 4. Excellent generalization ability on different datasets.

[0108] This invention maintains a comprehensive lead over existing methods on two datasets with different characteristics: ModelNet40 (a general point cloud classification dataset) and ScanObjectNN (a complex scene point cloud dataset containing more noise and local details). This demonstrates that the technical solution of this invention does not depend on the distribution characteristics of a specific dataset, has good adaptability to different scenes and different types of 3D point clouds, and has stronger generalization ability for engineering applications.

[0109] 5. Maximize the cross-model migration effect while ensuring a full success rate for self-model attacks.

[0110] All methods achieve a near-100% success rate in attacking the proxy model itself (self-model). However, this invention, while maintaining this characteristic, pushes the success rate of migration to different models to an even higher level, achieving a dual optimization of self-model attack effectiveness and different-model migration effectiveness, thus solving the problem that existing methods cannot balance both.

[0111] Figure 2 For the visualization demonstration of this invention on the ModelNet40 dataset, Figure 3 This is a visualization of the present invention on the ScanObjectNN dataset.

[0112] Compared with existing methods that rely solely on a single gradient signal, a single significance estimate, or a single geometric regularization, this invention has at least the following technical advantages:

[0113] First, the localization of key regions is more reliable and the transferability is stronger. By fusing semantically relevant attention information with geometrically consistent tangent plane gradient information, the saliency guidance of this invention takes into account both discriminative contribution and local geometric stability, making it easier to capture key structures shared across models, thereby improving the stability and success rate of black-box transfer attacks.

[0114] Secondly, the iteration process is more stable, avoiding disturbance drift. The significant stabilization mechanism effectively suppresses hotspot jitter caused by iteration noise, making the disturbance updates more continuous in space and more consistent in time, reducing invalid updates and migration performance degradation caused by frequent jumps in the disturbance region.

[0115] Third, it achieves higher budget utilization and better imperceptibility. This invention focuses updates on compact critical structures through local region constraints and concentrates perturbation intensity on highly significant points through point-level budget redistribution. Under the same budget, it can achieve higher attack effects with fewer non-critical shape transformations, significantly reducing the impact on the overall appearance.

[0116] Fourth, geometric distortion is controlled, resulting in better robustness. The combined geometric constraints and explicit budget limits can simultaneously suppress outliers and global drift, reducing geometric distortions such as local spikes and anomalous mutations. This allows the generative adversarial point cloud to exhibit better geometric consistency and attack robustness under different sampling, noise, or model differences.

[0117] Fifth, it boasts strong scalability and greater flexibility in engineering implementation. The key modules of this invention can be flexibly combined with multi-agent model strategies, different geometric metrics, or different optimizers, enabling it to adapt to different point cloud scales, different network structures, and different attack targets (non-directional or directional), facilitating deployment and application in actual security assessment and robustness testing scenarios.

[0118] Based on the same inventive concept, this invention also provides a computer device, comprising: one or more processors, and a memory for storing one or more computer programs; the programs include program instructions, and the processor executes the program instructions stored in the memory. The processor may be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. It is the computing and control core of the terminal, used to implement one or more instructions, specifically for loading and executing one or more instructions stored in a computer storage medium to implement the above-described method.

[0119] It should be further explained that, based on the same inventive concept, the present invention also provides a computer storage medium storing a computer program, which, when executed by a processor, performs the above-described method. This storage medium can be any combination of one or more computer-readable media. A computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. A computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of computer-readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In the present invention, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0120] It should be noted that, unless otherwise defined, the technical or scientific terms used in this invention should have the ordinary meaning understood by one of ordinary skill in the art to which this invention pertains. The terms "first," "second," and similar terms used in this invention do not indicate any order, quantity, or importance, but are merely used to distinguish different components. Terms such as "comprising" or "including" mean that the element or object preceding the word encompasses the elements or objects listed following the word and their equivalents, without excluding other elements or objects. Terms such as "connected" or "linked" are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. Terms such as "upper," "lower," "left," and "right" are used only to indicate relative positional relationships; when the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0121] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention in any other way. Any person skilled in the art may make changes or modifications to the above-disclosed technical content to create equivalent embodiments. However, any simple modifications, equivalent changes, and modifications made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the protection scope of the present invention.

[0122] This invention is not limited to the preferred embodiment described above. Anyone inspired by this invention can derive various other methods for generating saliency and geometrically enhanced transferable adversarial samples for 3D point cloud classification. All equivalent variations and modifications made within the scope of the claims of this invention shall fall within the scope of this invention.

Claims

1. A method for generating transferable adversarial examples with saliency and geometry enhancement for 3D point cloud classification, characterized in that, include: Obtain the original 3D point cloud and its true category label, load the pre-trained 3D point cloud classification model that can obtain model structure and gradient information as a proxy model, and set the target point cloud classification model in black box state as the transfer attack target. Based on the surrogate model and the current iterative adversarial point cloud, the mixed saliency score of each point in the original 3D point cloud is calculated. The mixed saliency score is formed by fusing the first saliency score obtained based on the coordinate self-attention mechanism and the second saliency score obtained based on the tangent plane gradient. The mixed significance scores are then subjected to time-series smoothing and stabilization to obtain stable significance scores. The target point set is selected from the original 3D point cloud based on the stable saliency score and the key perturbation region is determined by neighborhood expansion. At the same time, perturbation intensity coefficients are assigned to each point in the key perturbation region based on the stable saliency score. Using an optimization objective function that includes a classification loss term, a geometric imperceptibility constraint term, and a saliency-guided geometric constraint term, adversarial perturbations are generated iteratively based on the optimization objective function within the key perturbation region. The classification loss term is used to drive the perturbation so that the surrogate model's classification result of the perturbated point cloud deviates from the true class label. The adversarial perturbation is then applied to the original 3D point cloud to obtain transferable adversarial samples for the black-box target point cloud classification model.

2. The saliency and geometry-enhanced transferable adversarial example generation method for 3D point cloud classification according to claim 1, characterized in that: Obtaining the first saliency score based on the coordinate self-attention mechanism includes: linearly mapping the coordinates of the current iteration adversarial point cloud input coordinate embedding layer to obtain point-level features; performing multi-head self-attention processing on the point-level features to obtain attention aggregation features; and normalizing the attention aggregation features to obtain the first saliency score representing the semantic discriminative importance of each point.

3. The saliency and geometric enhancement transferable adversarial example generation method for 3D point cloud classification according to claim 1, characterized in that: Obtaining the second significance score based on the tangent plane gradient includes: constructing a local neighborhood for each point in the original 3D point cloud based on the k-nearest neighbor algorithm, calculating the normal vector of each point and the tangent plane; calculating the gradient of the classification loss with respect to the coordinates of each point in the current iteration adversarial point cloud, projecting the gradient onto the tangent plane to eliminate the normal component, and taking the modulus of the projected gradient and normalizing it to obtain the second significance score characterizing the sensitivity of the local geometric consistency of each point.

4. The saliency and geometry-enhanced transferable adversarial example generation method for 3D point cloud classification according to claim 1, characterized in that: The fusion process includes: weighting and summing the normalized first significance score and the second significance score according to a preset fusion weight, and then performing global normalization on the summation result to obtain a mixed significance score.

5. The saliency and geometry-enhanced transferable adversarial example generation method for 3D point cloud classification according to claim 1, characterized in that: The time-series smoothing and stabilization process includes: using an exponential moving average algorithm, weighting and fusing the mixed significance score of the current iteration with the stable significance score of the previous iteration according to a preset smoothing coefficient to obtain the stable significance score of the current iteration.

6. The saliency and geometry-enhanced transferable adversarial example generation method for 3D point cloud classification according to claim 1, characterized in that: The neighborhood expansion of the target point set includes: selecting the points with the highest stable saliency scores from the top preset proportion as the target point set; using the k-nearest neighbor algorithm to expand the neighborhood of each point in the target point set; merging the expanded points to form a key perturbation region; and constructing a binary mask to restrict the perturbation to be updated only within the key perturbation region.

7. The method for generating saliency and geometric enhancement transferable adversarial examples for 3D point cloud classification according to claim 1, characterized in that: The allocation of disturbance intensity coefficients includes: normalizing the stability significance score of each point to the [0,1] interval, multiplying it by a preset scaling factor, and cropping the result to no more than 1, so that points with higher stability significance scores correspond to higher disturbance intensity coefficients.

8. The method for generating saliency and geometric enhancement transferable adversarial examples for 3D point cloud classification according to claim 1, characterized in that: The saliency-guided geometric constraint term uses a stable saliency score as a weight, combined with the tangent plane geometric consistency constraint, to suppress the perturbation update direction that is inconsistent with the local surface of the original 3D point cloud.

9. The saliency and geometry-enhanced transferable adversarial example generation method for 3D point cloud classification according to claim 1, characterized in that: During the iterative optimization process, an L2 norm constraint is applied to the perturbation vector of each point, such that the perturbation amplitude of a single point does not exceed a preset maximum value, and the average perturbation amplitude of all points does not exceed a preset average value.

10. A saliency and geometry-enhanced 3D point cloud transferable adversarial example generation system, characterized in that, It includes a processor and a memory, the memory storing a computer program, and the processor executing the computer program to implement the method as described in any one of claims 1 to 9.

Images