Three-dimensional point cloud adversarial sample generation method based on multi-source saliency guidance and reverse constraint

Abstract

The application provides a three-dimensional point cloud adversarial sample generation method based on multi-source saliency guidance and reverse constraint, comprising: generating a point-level multi-source saliency map for original three-dimensional point cloud data and a source three-dimensional point cloud classification model, and the point-level multi-source saliency map is fused with a model cognitive uncertainty component obtained by calculating the Shannon entropy of the prediction result of the source three-dimensional point cloud classification model on the input point cloud; based on the point-level multi-source saliency map, the upper limit of the disturbance intensity and the optimization step coefficient of each point in the original three-dimensional point cloud are determined respectively; taking minimizing the total loss function as the target, the adversarial disturbance applied to the original three-dimensional point cloud data is iteratively optimized; in each iteration process, the gradient update step is adjusted according to the optimization step coefficient, and after the gradient update is completed, the disturbance amplitude of each point is point-by-point clipped according to the upper limit of the disturbance intensity; when the iteration termination condition is met, the three-dimensional point cloud adversarial sample obtained by superimposing the original three-dimensional point cloud data and the optimized adversarial disturbance is output.

Description

Technical Field

[0001] This invention belongs to the field of deep neural network security and adversarial learning technology, specifically involving a method for generating adversarial examples of three-dimensional point clouds based on multi-source saliency guidance and inverse constraints. Background Technology

[0002] 3D point clouds, as the core data carrier for 3D environment perception, are widely used in safety-critical fields such as intelligent driving and robot vision. Deep neural network classification models based on 3D point clouds are the core foundation for environmental understanding and decision-making in these scenarios. Adversarial example generation technology, as a core means of evaluating, validating, and improving the robustness of deep neural network models, aims to generate adversarial examples that can effectively mislead model classification results while possessing good visual concealment and cross-model transferability. This provides technical support and testing basis for constructing a security protection system for 3D perception systems.

[0003] Current 3D point cloud adversarial attack techniques are mainly divided into two major technical paths: white-box attacks and black-box attacks. White-box attacks have been developed earlier, and existing solutions such as AdvPC and GeoA3 have achieved a balance between attack success rate and sample concealment in a white-box environment by introducing geometric perception regularization and point cloud autoencoder constraints. However, these solutions are highly dependent on the internal parameters and gradient information of the model, which severely limits their application in real industrial scenarios. In most real-world scenarios, attackers cannot obtain the model structure and parameter information of the target perception system. Transferable black-box attacks have thus become a hot research topic in the industry. These methods do not require obtaining the internal information of the target model; they only need to generate adversarial examples through a proxy source model to attack unknown target models. Existing mainstream solutions such as PF-Attack, CFG, and MI-FGSM are all optimized around improving the cross-model transferability of adversarial examples. They reduce the overfitting of adversarial examples to the source model through perturbation decomposition, key feature guidance, and momentum gradient accumulation. However, they still do not fundamentally solve the inherent conflict between overfitting and generalization ability. When the generated adversarial examples are transferred from traditional CNN architectures to heterogeneous models such as Transformer architectures and nonparametric networks, the attack success rate still drops sharply, which cannot meet the application needs of complex real-world scenarios.

[0004] Saliency-guided attack methods are currently the mainstream technical approach to improve attack efficiency and stealth. These methods generate saliency maps by calculating the influence of different regions of a point cloud on the model's classification decision, and prioritize applying perturbations to highly saliency regions to maximize the attack effect. However, existing saliency-guided attack schemes all follow the core logic of forward modulation, that is, focusing on applying the main attack payload to highly saliency regions. However, highly saliency regions in 3D point clouds usually correspond to geometrically sensitive areas such as the skeleton and edges of objects. These regions are highly sensitive to changes in spatial position. Even with smoothing constraints on perturbations, they are very easy to form high-frequency anomalous features in space. This not only produces visual artifacts that can be perceived by the human eye, compromising the stealth of adversarial examples, but also makes the generated adversarial examples easily identified and filtered out by basic defense algorithms such as statistical outlier removal. A large amount of experimental data shows that the success rate of such refined attacks targeting skeleton regions drops sharply after simple denoising preprocessing, making them completely unsuitable for real-world application scenarios with basic defense mechanisms.

[0005] In summary, existing 3D point cloud adversarial example generation technologies have consistently failed to overcome the industry bottleneck of simultaneously achieving attack transferability, visual concealment, and robustness against defenses. Technological optimizations based on forward attack logic have consistently failed to reconcile the inherent contradiction between attack strength and perturbation concealment, and have also been unable to fundamentally solve the problem of adversarial examples overfitting the source model. There is an urgent need to develop entirely new attack paradigms and technical solutions to achieve a comprehensive improvement in the attack effectiveness, concealment, transferability, and anti-defense capabilities of 3D point cloud adversarial examples. Summary of the Invention

[0006] To address the shortcomings and deficiencies of existing technologies, this invention provides a method and system for generating adversarial examples of 3D point clouds based on multi-source saliency guidance and reverse constraints. It aims to solve the industry pain point that existing 3D point cloud adversarial attack technologies cannot simultaneously consider attack transferability, visual concealment, and anti-defense robustness. It can be widely applied to the robustness evaluation and improvement of deep neural network models in key security fields such as intelligent driving and robotics. This invention constructs a point-level multi-source saliency map that integrates physical and cognitive features. Based on two types of physical features—gradient sensitivity and geometric complexity—it introduces model cognitive uncertainty features calculated using Shannon entropy from the prediction results of the source 3D point cloud classification model. This accurately locates geometrically sensitive regions of the point cloud and shared vulnerable regions between different architecture models, fundamentally reducing the overfitting of adversarial examples to the source model and significantly improving the attack migration capability across heterogeneous network architectures. Simultaneously, it pioneers a coupled attack paradigm of reverse constraints and adaptive strength compensation, breaking the existing positive attack logic where higher saliency equates to greater perturbation. It establishes a negative correlation between saliency value and the upper limit of perturbation strength, and a positive correlation between saliency value and the optimization step size. By strictly limiting the perturbation amplitude in high-saliency skeleton edge regions and relaxing the perturbation budget in low-saliency flat regions, the attack payload is strategically transferred from geometrically sensitive regions to visually robust regions. This avoids outlier artifacts caused by perturbation and allows the generated adversarial examples to naturally evade basic defense algorithms such as statistical outlier removal, significantly improving attack survivability in real-world environments. This invention also constructs a multi-dimensional joint optimization total loss function. Based on the adversarial loss term, a concealment loss term centered on tangential smoothing constraints is introduced to force adversarial perturbations to be distributed tangentially along the point cloud surface, achieving visual cloaking under large perturbations. Simultaneously, it is equipped with transferability enhancement constraints and a dynamic balancing hyperparameter adjustment strategy. During iterative optimization, the effectiveness of the attack and the strictness of geometric constraints are dynamically balanced, achieving a synergistic improvement in attack success rate, visual concealment, and cross-model transferability. This scheme, through the organic combination of multi-source signal fusion, reverse load transfer, and tangential smoothing geometric optimization, forms a complete 3D point cloud adversarial attack system with high concealment, high transferability, and strong defense resistance. It demonstrates significantly better attack performance than existing mainstream methods on both general synthetic datasets and real-world scene datasets, providing an efficient and reliable technical means for the security assessment of 3D visual perception systems.

[0007] The specific technical solution adopted by this invention to solve its technical problem is as follows:

[0008] A method for generating adversarial examples from 3D point clouds based on multi-source saliency guidance and inverse constraints includes:

[0009] Acquire raw 3D point cloud data, and source 3D point cloud classification models for generating adversarial examples;

[0010] For the original 3D point cloud data and the source 3D point cloud classification model, a point-level multi-source saliency map is generated; the point-level multi-source saliency map is at least integrated with the model cognitive uncertainty component obtained by calculating the Shannon entropy of the prediction results of the input point cloud based on the source 3D point cloud classification model.

[0011] Based on the point-level multi-source saliency map, an upper limit of perturbation intensity and an optimization step size coefficient are determined for each point in the original 3D point cloud; wherein, the higher the saliency value of a point, the lower the corresponding upper limit of perturbation intensity and the larger the corresponding optimization step size coefficient;

[0012] With the goal of minimizing the total loss function, the adversarial perturbation applied to the original 3D point cloud data is iteratively optimized. During each iteration, the gradient update step size is adjusted according to the optimization step size coefficient, and after the gradient update is completed, the perturbation amplitude of each point is pruned point by point according to the upper limit of the perturbation intensity. The total loss function includes an adversarial loss term and a hidden loss term, and the hidden loss term includes at least a tangential smoothing constraint term used to constrain the tangential distribution of the adversarial perturbation along the point cloud surface.

[0013] When the iteration termination condition is met, the output is a 3D point cloud adversarial sample obtained by superimposing the original 3D point cloud data with the optimized adversarial perturbation.

[0014] Furthermore, the point-level multi-source saliency map also incorporates a gradient sensitivity component and a geometric complexity component; the gradient sensitivity component is used to characterize the degree of influence of each point in the point cloud on the classification decision of the source 3D point cloud classification model, and the geometric complexity component is used to quantify the sensitivity of the region where each point in the point cloud is located to visual artifacts.

[0015] Furthermore, the point-level multi-source saliency map is generated using a parameter-free strategy of independent normalization of single features, weighted summation, and global normalization. Specifically, the gradient sensitivity, geometric complexity, and model cognitive uncertainty components are respectively subjected to minimum-maximum normalization and mapped to the 0 to 1 interval. After being weighted and summed with preset weights, global minimum-maximum normalization is then performed to generate the final point-level multi-source saliency map.

[0016] Furthermore, the upper limit of the disturbance intensity is linearly negatively correlated with the significance value of the point; for each point, the upper limit of the disturbance intensity is equal to the preset maximum disturbance threshold of the low significance region, minus the product of the significance value of the point and the difference between the maximum disturbance threshold of the low significance region and the preset minimum disturbance threshold of the high significance region.

[0017] Furthermore, the optimized step size coefficient and the significance value of the point are mapped by a linear positive correlation; for each point, the optimized step size coefficient is equal to the preset basic strength coefficient, plus the product of the significance value of that point and the preset step size enhancement coefficient.

[0018] Furthermore, the tangential smoothing constraint term is implemented by penalizing the projection of the perturbation vector onto the normal direction of the point cloud surface, specifically by minimizing the sum of the absolute values ​​of the dot product of the perturbation vector and the corresponding point surface normal vector.

[0019] Furthermore, the total loss function also includes a transferability loss term, which is a weighted sum of perturbation decomposition consistency constraints and input diversity regularization terms, used to improve the cross-model attack transferability of adversarial examples.

[0020] Furthermore, the total loss function is equipped with a dynamically adjusted balancing hyperparameter to balance the effectiveness of adversarial attacks with the strictness of geometric constraints; when the attack is successful, the balancing hyperparameter is increased to tighten the geometric constraints, and when the attack fails, the balancing hyperparameter is decreased to relax the geometric constraints.

[0021] Furthermore, the adversarial perturbation is initialized with zero, and the initial size is completely matched with the number of points and dimensions of the original 3D point cloud data. During the iterative optimization process, all parameters of the source 3D point cloud classification model are fixed, and only the adversarial perturbation is differentiated and updated.

[0022] Furthermore, a three-dimensional point cloud adversarial example generation system is provided to implement the method described above, including a data loading module, a saliency calculation module, a dynamic constraint module, an iterative optimization module, and a result output module.

[0023] The data loading module is used to acquire the original 3D point cloud data and the source 3D point cloud classification model;

[0024] The saliency calculation module is used to generate a point-level multi-source saliency map that incorporates model cognitive uncertainty components;

[0025] The dynamic constraint module is used to determine the upper limit of the disturbance intensity and the optimization step size coefficient for each point based on the point-level multi-source saliency map.

[0026] The iterative optimization module is used to construct the total loss function and perform iterative optimization, step size modulation and point-by-point pruning against the adversarial disturbance.

[0027] The result output module is used to output the final 3D point cloud adversarial sample when the iteration termination condition is met.

[0028] And a computer system including a processor and a memory, the memory storing a computer program, the processor executing the computer program to implement the method described above.

[0029] A non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method described above.

[0030] Compared to existing technologies, this invention and its preferred embodiment introduce a model cognitive uncertainty component, enabling the saliency map to reflect the model's confidence in the input point cloud classification results. This allows for more accurate identification of fuzzy regions near the model's decision boundary, providing more refined guidance information for adversarial perturbation generation. By employing a reverse constraint mechanism—that is, imposing a stricter upper limit on the perturbation intensity in highly saliency regions—and supplementing it with an adaptive optimization step size compensation strategy, the perturbation is effectively prevented from being overly concentrated in geometrically sensitive areas (such as skeletons and edges). This significantly reduces the high-frequency anomalous features statistically exhibited by adversarial examples, thereby improving their survivability against basic adversarial defense algorithms (such as statistical outlier removal). The introduction of a tangential smoothing constraint term forces the adversarial perturbation to be distributed along the tangent direction of the point cloud surface, minimizing its projection in the normal direction. This makes the perturbation visually more consistent with the geometry of the original point cloud, further enhancing the concealment of the adversarial examples. The transferability loss term, through a weighted combination of perturbation decomposition consistency constraints and input diversity regularization terms, guides adversarial perturbations to mine and attack decision-making vulnerabilities shared across different models, reducing overfitting to the source model and thus significantly improving the attack success rate of adversarial examples across different network architectures (such as migrating from traditional convolutional neural networks to Transformer architectures). The dynamically balanced hyperparameter settings allow the total loss function to adaptively adjust the weight balance between adversarial attack effectiveness and geometric and transferability constraints according to the attack state, ensuring attack effectiveness while also considering the stealth requirements of adversarial examples. The entire scheme employs a parameter-free fusion strategy to generate saliency maps, avoiding the introduction of additional learnable parameters and simplifying the implementation process. Simultaneously, by fixing the source model parameters and optimizing only the adversarial perturbation design during iterative optimization, the method has low implementation complexity and computational overhead. In summary, this invention significantly improves the cross-model transferability and visual stealth of adversarial examples while maintaining a high attack success rate, providing an effective technical solution to address problems such as overfitting to the source model, poor generalization ability across heterogeneous architectures, and susceptibility to filtering by basic defense algorithms in existing technologies. Attached Figure Description

[0031] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments:

[0032] Figure 1 This is a flowchart illustrating the overall implementation of an embodiment of the present invention;

[0033] Figure 2 This is a visualization of the method of this invention on the ModelNet40 dataset;

[0034] Figure 3 This is a visualization of the method of this invention on the ScanObjectNN dataset. Detailed Implementation

[0035] To make the features and advantages of the present invention more apparent and understandable, specific embodiments are described below in detail:

[0036] It should be noted that the following detailed descriptions are exemplary and intended to provide further explanation of this application. Unless otherwise specified, all technical and scientific terms used in this specification have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains.

[0037] It should be noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the exemplary embodiments according to this application. As used herein, the singular form is intended to include the plural form as well, unless the context clearly indicates otherwise. Furthermore, it should be understood that when the terms "comprising" and / or "including" are used in this specification, they indicate the presence of features, steps, operations, devices, components, and / or combinations thereof.

[0038] This invention aims to address the inherent contradiction between portability and stealth in existing technologies, as well as the vulnerability of adversarial examples in heterogeneous models and defensive environments. To this end, a 3D transferable adversarial example generation method (MIST) for autonomous driving is provided, aiming to solve the problems of existing point cloud adversarial attacks failing to achieve a good balance between imperceptibility and adversarial strength, and poor transferability to heterogeneous models. This method first constructs a multi-source saliency map by fusing gradient, geometric curvature, and model uncertainty signals to accurately locate geometrically sensitive and robust regions in the point cloud. Then, utilizing a pioneering reverse constraint mechanism, it breaks traditional rigid global constraints, strategically transferring the attack payload from the sensitive skeleton region to the robust planar region. Through this mechanism, this invention generates adversarial examples that can disrupt the inherent geometric semantics while ensuring extremely high visual stealth and effectively avoiding skeleton outliers. This significantly improves the attack portability of adversarial examples across model architectures and their robustness against defensive measures such as statistical outlier removal (SOR).

[0039] This invention accurately locates geometrically sensitive regions of point clouds by constructing multi-source saliency maps and pioneers a reverse constraint mechanism to dynamically allocate perturbation budgets. Specifically, this method integrates three signals: gradient sensitivity, geometric curvature, and model uncertainty, to identify skeleton regions sensitive to visual distortion and robust planar regions. Based on this, a reverse constraint strategy is adopted to strictly limit the perturbation amplitude of high-saliency (skeleton) regions to maintain structural integrity, while relaxing the constraints on low-saliency (planar) regions and using intensity mapping to amplify the attack step size, thereby transferring the attack payload to the robust regions.

[0040] Finally, joint optimization is performed by combining tangential smoothing constraints and geometric consistency loss to generate adversarial examples that possess both high transferability and high concealment. The overall framework is as follows: Figure 1 As shown.

[0041] The specific steps are as follows:

[0042] Step 1: Construct a multi-source saliency map that includes cognitive dimensions

[0043] To overcome the limitations of single gradient information and address the overfitting problem caused by neural network-based prediction saliency in existing technologies, this invention proposes an explicit multi-source fusion strategy. This strategy integrates three complementary signals: physical features (gradient, geometry) and cognitive features (model uncertainty), and generates a final point-level saliency map through weighted normalization. The specific calculation process is as follows:

[0044] Gradient sensitivity ( )calculate:

[0045] This invention not only utilizes integrated gradients to solve the gradient saturation problem, but also introduces a spatial weighting mechanism relative to the geometric median to accurately locate the key points of the object's skeletal structure.

[0046]

[0047] in, Let i be the coordinates of the i-th point. Let be the geometric median of the point cloud. The integral gradient vector (specifically, the integral gradient vector corresponding to the i-th point in the original point cloud; the integral gradient is a well-known deep neural network interpretability method in this field, used to quantify the impact of the coordinate change of the point on the classification prediction result of the source model, and can be obtained through conventional integral gradient calculation methods in this field). Indicates the inner product. It is an L2 norm.

[0048] It effectively filters out background noise by calculating the inner product of the spatial offset of the point cloud relative to the geometric median and the gradient. Since skeleton keypoints are usually far from the geometric center and have large outward gradient components, this metric ensures that attacks focus on the core structural regions of the object.

[0049] Geometric complexity ( )calculate:

[0050] This invention utilizes the curvature statistical features within a local neighborhood to quantify the sensitivity of a region to visual artifacts, specifically using the standard deviation of local curvature to measure geometric complexity. Geometric complexity is defined as:

[0051]

[0052] In this formula, Point of -Nearest neighbor set, This is a local curvature estimate for points in the neighborhood (which can be achieved using conventional Gaussian curvature / mean curvature estimation methods). Let be the average curvature within the neighborhood, and k be the number of nearest neighbors in 3D space that are closest to the i-th point in order to calculate the local geometric features of that point. l It is the index of any neighboring point in the k-nearest neighbor set N(i) of the target point i.

[0053] Its higher A high value indicates that there are drastic geometric changes in the region (such as sharp edges or corners). These high-frequency geometric regions are extremely sensitive to small perturbations and are prone to visual artifacts. Therefore, they are marked as high sensitivity in the saliency map and require stricter constraints.

[0054] Model cognitive uncertainty ( Calculation of )

[0055] This is the key cognitive dimension feature that distinguishes this invention from existing technologies. This invention utilizes Shannon entropy from information theory to quantify the model's predictive hesitation near the current point, thereby avoiding blind optimization. Model cognitive uncertainty is defined as:

[0056]

[0057] in, The total number of categories, This indicates that the model predicts the input point cloud. Category The posterior probability.

[0058] The high uncertainty regions of the model typically correspond to vulnerable points near the decision boundary. Although different model architectures (such as migrating from PointNet to Transformer architectures from CNN architectures) differ greatly in how they extract underlying geometric features, they often exhibit high consistency in these cognitive hesitation regions. Introducing this component significantly improves the transferability of adversarial examples between heterogeneous models.

[0059] To unify the three components and their different dimensions, this invention employs a normalization-weighted-renormalization strategy to generate the final guiding signal, which is then combined with the significance score. Defined as:

[0060]

[0061] in, This represents the Min-Max normalization operation. The inner operation is a single-feature independent Min-Max normalization operation, which independently maps the three saliency components—gradient sensitivity, geometric complexity, and model uncertainty—to the [0,1] interval based on their respective maximum and minimum values ​​of the entire point cloud, eliminating the dimensional differences between different features. The outer operation represents the global Min-Max normalization operation, which maps the intermediate saliency results after weighted summation to the complete [0,1] interval based on the maximum and minimum values ​​of the entire point cloud, ensuring the accurate execution of the subsequent reverse constraint mechanism. To balance adversarial sensitivity, geometric complexity, and uncertainty, hyperparameter weights are used. This fusion approach avoids introducing additional learnable parameters, ensuring the method's generality and computational efficiency.

[0062] Step 2: Reverse constraint mechanism and adaptive strength compensation

[0063] This invention proposes a reverse constraint mechanism, combined with an adaptive strength compensation strategy, aiming to break the constraint between attack mobility and imperceptibility in existing technologies. This step utilizes the normalized saliency map generated in step 1. (The range is) For each point, the perturbation budget (Constraint) and attack step size (Intensity) are dynamically calibrated point-by-point. The specific process is as follows:

[0064] First, for the perturbation budget, a reverse pruning map is constructed, establishing a negative correlation constraint between significance and the perturbation budget. Unlike existing technologies that follow a positive logic where higher significance corresponds to greater perturbation, this invention establishes a negative linear correlation between significance and the perturbation budget, constructing a reverse pruning map table. The calculation formula is:

[0065]

[0066] in, This serves as the upper bound for the pre-defined low-significance region perturbation. These are pre-defined lower bounds for perturbations in highly saliency regions, and they can be adjusted according to the overall size of the point cloud.

[0067] The mechanism of this reverse clipping mapping is as follows: for highly significant regions, when the significance S of a point approaches 1, its perturbation budget is forcibly compressed to a lower bound. This reverse locking strategy is equivalent to protecting geometrically sensitive areas, effectively preventing outliers caused by excessive perturbations, thus naturally evading detection by defensive algorithms such as Statistical Outlier Removal (SOR). For low-salience regions, when the salience of a point... When it approaches 0, its disturbance budget is relaxed to the upper bound. This mechanism utilizes the insensitivity of flat areas to high-frequency noise to forcibly transfer the main attack payload from the skeleton to the plane, achieving visual stealth of the disturbance while ensuring attack strength.

[0068] Secondly, regarding the attack step size, an adaptive strength compensation strategy coupled with the reverse constraint mechanism is designed to address the problem of limited search space and easy getting trapped in local optima in high-salience regions due to overly strict constraints, thereby generating an strength mapping map. The calculation formula is as follows:

[0069]

[0070] in, This serves as the base strength coefficient, ensuring that all regions have a basic update step size; This is an enhancement coefficient used to linearly amplify the attack step size according to the significance level.

[0071] The mechanism of this adaptive intensity compensation works as follows: in regions of high significance with strict constraints, Reaching the maximum value ( (Preferably close to 1.0), thereby amplifying the step size of gradient updates, ensuring effective crossing of decision boundaries even in a very small feasible region, guaranteeing attack effectiveness and cross-model transferability; in the low significance region (S approaches 0). Maintain at the base value In the vicinity, conduct regular exploration using the ample search space.

[0072] In summary, this step achieves a strategic reconstruction of the spatial distribution of adversarial attack payloads by constructing a complementary coupling mechanism of reverse constraint and positive compensation. On the one hand, it utilizes negative correlation clipping mapping ( The perturbation budget for highly significant regions (skeleton / edge) is forcibly compressed to a very small extent. This allows for stealth in geometrically sensitive areas, effectively evading detection by defensive algorithms such as Statistical Outlier Removal (SOR), and forcibly shifting the main attack payload to flat regions with low saliency; on the other hand, it utilizes positive correlation intensity mapping ( In highly saliency regions, the gradient update step size is adaptively amplified, effectively compensating for the decrease in attack power caused by the lockout of the search space. This dialectical strategy of strong search with strict constraint matching and weak search with wide constraint matching maximizes the cross-model transfer attack capability of adversarial examples while ensuring visual imperceptibility and defense robustness.

[0073] Step 3: In embodiments of the present invention, the process of generating 3D point cloud adversarial examples is modeled as a constrained joint optimization problem. This process aims to find the optimal adversarial perturbation. This allows the generated adversarial examples to deceive neural network models while maintaining good visual concealment and cross-model transferability. Specifically, this is achieved by iteratively updating the perturbation. Minimize the total loss function containing multiple constraints .

[0074] Total loss function ( The construction of the loss term () consists of a weighted average of adversarial loss, concealment loss, and transferability loss, and its mathematical expression is as follows:

[0075]

[0076] in: (Adversarial loss): Used to measure the effectiveness of an attack, i.e., the ability to force the source model to misclassify the input; (Coverage loss): Used to constrain the geometric features of the perturbation, ensuring the visual quality of adversarial examples; (Transferability loss): Used to prevent overfitting to the source model and improve the success rate of adversarial examples attacking unknown black-box models; (Penalty coefficient): This is a dynamically adjusted hyperparameter (in this embodiment, it is preferably dynamically calibrated using the Lagrange multiplier method or a binary search strategy) used to balance the effectiveness of adversarial attacks with the strictness of geometric constraints. When the attack is successful, the penalty coefficient is increased. To reduce distortion; to reduce distortion when the attack fails. To relax restrictions.

[0077] The composition of each loss item is described in detail below:

[0078] (1) Countermeasure loss item ( This is used to maximize the probability of the source model classifying incorrectly. In this embodiment, the negative cross-entropy loss function is used. Constructing adversarial losses:

[0079]

[0080] in: Represents the output logits of the source neural network model; This indicates the added adversarial perturbation; This represents the true category label of the original point cloud. This is the standard cross-entropy loss function for 3D point cloud multi-classification tasks.

[0081] By minimizing this term, it can significantly reduce the source model's confidence in the true label y, forcing the perturbed sample features to deviate from the decision boundary of the correct category in the feature space.

[0082] (2) Hidden losses ( This term is used to ensure that the generated adversarial examples are difficult to detect visually. It constructs joint constraints from three dimensions: macroscopic structure, microscopic surface smoothness, and local geometric consistency. It consists of three sub-terms: chamfer distance constraint, tangential smoothness constraint, and geometric consistency constraint. Its mathematical expression is as follows:

[0083]

[0084] in, and These are the weight coefficients for tangential constraints and geometric consistency constraints, respectively. The specific definitions of each sub-item are as follows:

[0085] Chamfer distance constraint ( Chamfer Distance Loss (CD) is used to limit the global displacement of a point cloud and prevent severe deformation of the object's skeletal structure. Its calculation formula is as follows:

[0086]

[0087] In the formula, This represents the total number of points in the point cloud. For the generated adversarial example point cloud, Let i be the i-th point in the original point cloud. The j-th point in the adversarial sample point cloud.

[0088] Tangential smoothing constraint ( To suppress high-frequency noise and visual artifacts, this penalty perturbation vector is projected onto the normal direction of the point cloud surface, forcing the perturbation to occur primarily along the tangent direction of the object surface. Its calculation formula is as follows:

[0089]

[0090] in, For the first The perturbation vector at each point For the first The normal vector of each point.

[0091] This constraint utilizes the human eye's high sensitivity to changes in surface normals. By limiting the perturbation to the tangent plane of the point cloud surface, it hides the perturbation within the texture of the object's surface. This is particularly suitable for the large perturbation budget applied to low-saliency planar regions in this invention, preventing normal protrusions in planar regions and significantly improving the visual concealment of adversarial examples.

[0092] Geometric consistency constraints To preserve the local curvature features of the point cloud, this term is achieved by maximizing the cosine similarity between the normals of the corresponding points in the original point cloud and the adversarial example. The calculation formula is as follows:

[0093]

[0094] in, The first in the original point cloud The normal vector of each point This is the unit normal vector of the corresponding point in the adversarial sample.

[0095] This constraint ensures that no unnatural protrusions or depressions appear on the point cloud surface after the attack, maintaining the smoothness and consistency of the local geometry. It works in conjunction with the reverse constraint mechanism to protect the geometric integrity of highly salient skeleton regions, further enhancing the imperceptibility of adversarial examples.

[0096] (3) Transferable loss item ( The purpose of this term is to prevent adversarial examples from overfitting the source model to a specific decision boundary, thereby improving the success rate of attacks on unknown black-box models. This term is constructed by combining perturbation decomposition consistency constraints and input diversity regularization strategies, and its mathematical expression is as follows:

[0097]

[0098] in, The weighting coefficient for the consistency loss of the perturbation decomposition is preferably in the range of 0.1 to 1.0; The weighting coefficients for the input diversity regularization term are preferably in the range of 0.05 to 0.5; both can be adjusted synchronously according to the source model type and the perturbation budget.

[0099] The specific definitions and calculation methods for each sub-item are as follows:

[0100] Perturbation decomposition consistency loss ( This perturbation decomposition, similar to PF-Attack, is adapted to the reverse constraint paradigm design of this invention. It forces the optimization process to find more robust perturbation directions, avoiding the single vulnerable feature of the adversarial sample-dependent source model. Its calculation formula is as follows:

[0101]

[0102] Where Q is the number of sub-perturbations, preferably 2 to 4; For the q-th mutually exclusive sub-perturbation obtained by random binary mask decomposition, the sum of the masks of all sub-perturbations is a vector of all 1s, ensuring that the sum of the sub-perturbations equals the total perturbation; For a multi-class cross-entropy loss function consistent with the adversarial loss term, This is the source model.

[0103] By constraining each sub-perturbation to achieve adversarial attack effects independently, the optimization process is forced to uncover common shared vulnerability features between models, rather than decision boundaries specific to the source model. This reduces overfitting at its source and improves the cross-model transferability of adversarial examples.

[0104] Input diversity regularization term ( This item enhances the robustness of adversarial examples to different perspectives and spatial transformations, ensuring stable attack effectiveness under varying input conditions and further improving generalization ability. Its calculation formula is:

[0105]

[0106] in, The true class logical value output by the source model for the randomly transformed sample. The highest logical value of the non-target category (excluding the true category) output by the source model after random transformation of the sample. This random transformation is a random rigid body transformation applied to the adversarial sample, including random rotation around an axis within ±15° and random uniform scaling within 0.8 to 1.2 times. Transformation parameters are randomly generated in each iteration. The rotation around the axis refers to the x, y, and z axes in 3D space; one or more axes are randomly selected for rotation in each iteration, a common method for input augmentation in the field of 3D point cloud adversarial attacks.

[0107] By minimizing this term, the transformed sample is forced to still meet the adversarial requirement that "the highest logical value of the non-target class is significantly higher than the logical value of the true class". This ensures that the adversarial sample can maintain its attack effectiveness under different perspectives and scales, avoids the failure of the attack due to input changes, and further improves the generalization attack capability across scenarios and models.

[0108] In practice, the process of generating 3D point cloud adversarial examples is modeled as a constrained iterative optimization problem, based on the aforementioned total loss function. Use optimizers (such as the Adam optimizer) to combat perturbations. The iterative updates will be implemented according to the following rules:

[0109] Initialization rules: counteracting disturbances All-zero initialization was used, and the initial size perfectly matched the number of points and dimensions of the original clean point cloud P; during the iterative optimization process, the source model was kept fixed. All parameters are differentiated and updated only with respect to the perturbation Δ;

[0110] Iterative constraint rule: After each iteration updates the perturbation, the point-by-point reverse pruning map generated in step 2 is used. The disturbance amplitude at each point is trimmed point by point to ensure that the absolute value of the disturbance at each point does not exceed its corresponding disturbance budget limit.

[0111] Iteration termination conditions: The iteration process terminates when either of the following conditions is met: ① The preset maximum number of iterations is reached (preferably 50~200 times, with a baseline of 100 times); ② The attack success criterion is met, that is, the predicted category of the source model for the current adversarial sample P+Δ is inconsistent with the true category label y of the original point cloud.

[0112] Output results: After the iteration terminates, the final adversarial example is output. This sample can effectively deceive the target deep neural network model.

[0113] In summary, the embodiments of the present invention address the difficulty in simultaneously achieving attack transferability, visual concealment, and robustness against defenses in existing technologies. The key design of the present invention mainly includes the following three aspects:

[0114] Firstly, this invention innovatively introduces cognitive uncertainty into adversarial example generation technology, constructing a multi-source saliency fusion strategy with both physical and cognitive dimensions. Unlike existing technologies that rely solely on physical geometric features such as gradients and curvature to calculate saliency, this invention introduces model cognitive uncertainty based on Shannon entropy for the first time. This scheme addresses the drawback of purely physical features easily overfitting the source model by explicitly fusing three heterogeneous signals: gradient sensitivity (physical), geometric curvature (geometric), and model uncertainty (cognitive). Leveraging the cross-architecture consistency of cognitive hesitation at the decision boundary, the generated adversarial examples can overcome architectural barriers, efficiently migrating from convolutional networks (PointNet) to Transformer architectures (PointTransformer) and nonparametric networks (Point-PN).

[0115] Secondly, it pioneered a complementary coupled attack paradigm of reverse constraint mechanism and strength compensation strategy. This is the core breakthrough point that distinguishes this invention from existing forward / gated modulation technologies. This invention breaks with the traditional thinking that higher saliency equates to greater perturbation, establishing a negative correlation mapping between saliency and perturbation budget, and a positive correlation mapping with attack step size. Specifically: Reverse constraint (negative correlation): Applying an extremely strict lower bound on the perturbation to the highly saliency skeleton region ( This effectively creates a protected area, forcing attack payloads to shift from the sensitive skeleton to a robust planar region. Intensity compensation (positive correlation) adaptively amplifies the attack step size in highly significant regions to address the search difficulties caused by spatial locking in the skeleton region. This dialectical strategy of strict constraint matching for strong search (skeleton) and wide constraint matching for weak search (planar region) successfully circumvents the detection of skeleton noise by defensive algorithms such as Statistical Outlier Removal (SOR), achieving true anti-defense attack resistance.

[0116] Third, a joint optimization objective based on tangential smoothing was constructed, effectively addressing the visual concealment challenge under large perturbations. This is to ensure that a large attack payload is applied in the low saliency region (plane). To avoid visual abruptness, this invention introduces tangential smoothing constraints. This mechanism forces the perturbation vector to be distributed along the tangent direction of the object's surface, rather than as a normal protrusion perpendicular to the surface. This makes large perturbations on the plane appear as points sliding on the manifold surface rather than noise, achieving deep cloaking at the human visual level while ensuring extremely high attack strength. Experiments show that the adversarial examples generated by this method not only significantly outperform existing state-of-the-art methods in terms of attack success rate on real-world datasets such as ScanObjectNN, but also achieve an optimal balance in terms of stealth metrics such as Chamfer distance and Hausdorff distance.

[0117] In summary, the key technical solutions employed in this invention, through the synergistic and organic integration of cognitive-physical multi-source signal fusion, reverse constraint-intensity compensation coupling mechanism, and tangential smoothing geometric optimization, form a complete, highly concealed, and highly transferable 3D point cloud adversarial attack system. Experimental verification shows that this method exhibits significant attack effectiveness on multiple black-box victim models, effectively exposing security vulnerabilities in existing models and providing strong support for enhancing the safety and reliability of intelligent driving systems in complex 3D environments.

[0118] Compared with existing 3D point cloud adversarial attack techniques (such as PF-Attack, GeoA3, CFG, etc.), especially compared with similar techniques based on positive saliency guidance, this invention (MIST) has significant technical advantages in attack transferability, visual concealment, and anti-defense robustness by introducing cognitive dimension saliency, reverse constraint mechanism, and tangential smoothing strategy.

[0119] First, this invention achieves a fundamental revolution in attack paradigms, shifting from forward fine modulation to reverse payload transfer. This invention pioneers a reverse constraint mechanism, effectively addressing the challenge of the trade-off between attack strength and visual concealment. Existing methods, such as PF-Attack or methods based on learnable saliency, typically follow forward logic, meaning that while smoothing is applied to highly saliency skeleton or edge regions, the main attack payload is still retained. Because skeleton regions are extremely sensitive to geometric deformation, this strategy inevitably produces edge jaggedness or outliers perceptible to the human eye.

[0120] In contrast, this invention establishes reverse logic, utilizing... Mapping forces compress the perturbation budget of highly significant skeleton regions to an extremely low level. This effectively eliminates outliers at the edges; at the same time, it forces the main attack payload to be shifted to low-salience planar regions. Furthermore, it incorporates an intensity compensation strategy to amplify the attack step size. This strategy of abandoning the skeleton and attacking the plane takes advantage of the high tolerance of the planar region to noise, allowing it to withstand a larger amount of attack disturbance than existing technologies, even when the difference is almost imperceptible to the human eye.

[0121] Secondly, this invention achieves a higher-dimensional attack on features, namely, from physical geometric features to general cognitive features. This invention overcomes the bottleneck of difficult transfer of adversarial examples between heterogeneous model architectures, significantly improving the success rate of cross-model attacks. Existing black-box attack methods often over-rely on physical geometric features such as gradients and curvature. However, different model architectures, such as convolution-based PointNet and attention-based Point Transformer, extract geometric features in vastly different ways, leading to a sharp drop in the effectiveness of adversarial examples generated based on physical features during transfer. Therefore, this invention introduces model uncertainty, namely Shannon entropy, as a cognitive dimension feature. Experiments show that although heterogeneous models have different focuses on geometric features, they exhibit high consistency in the cognitive hesitation region near the decision boundary. By fusing physical feature gradients and curvature with cognitive feature entropy, the adversarial examples generated in this invention can effectively disrupt the model's internal decision-making logic, thus maintaining extremely high attack transferability between heterogeneous models with vastly different structures, such as PointNet++, DGCNN, and Point Transformer. Experimental results are shown in Tables 1, 2, and 3.

[0122] Table 1. Attack success rate of the method of this invention (MIST) on the ModelNet40 dataset.

[0123]

[0124] Table 2. Attack success rate of the method of the present invention (MIST) on the novel network model.

[0125]

[0126] Table 3. Attack success rate of the method of this invention (MIST) on the ScanObjectNN dataset.

[0127]

[0128] The experiments were conducted on the ModelNet40 general synthetic dataset and the ScanObjectNN real-world dataset, respectively, to comprehensively verify the effectiveness and superiority of the MIST method proposed in this invention in cross-model attack scenarios. The experiments used four mainstream CNN architectures—PointNet, PointNet++ (MSG), PointNet++ (SSG), and DGCNN—as source models. The test targets covered the aforementioned homologous CNN architectures, as well as novel heterogeneous Transformer / non-parametric architectures such as PCT, PT, and Point-PN. Attack success rate (ASR, %) was used as the core evaluation metric, with two sets of perturbation budgets of 0.18 and 0.45, respectively, compared with 3D-Adv and GeoA... 3 The experimental results were compared with those of existing mainstream state-of-the-art (SOTA) attack methods such as PF-Attack and CFG. The results fully corresponded to the technical innovations of this invention, thus verifying the effectiveness of this solution in addressing the pain points of existing technologies.

[0129] In cross-CNN architecture transfer attack experiments on the ModelNet40 dataset, the method of this invention demonstrates extremely strong generalization ability for heterogeneous models. Using PointNet as the source model and perturbation budget... Taking a scenario with a resolution of 0.45 as an example, the success rates of this invention against PointNet++ (MSG), PointNet++ (SSG), and DGCNN reach 96.8%, 97.6%, and 78.8%, respectively, representing improvements of 12.1%, 9.6%, and 29.5% compared to the existing best method CFG. Even in extremely heterogeneous scenarios where the source model is DGCNN and then migrated to PointNet, Even with a 0.45 alpha value, the attack success rate still reaches 17.2%, a 17.4% improvement compared to the CFG method. These experimental results fully validate the effectiveness of the proposed physical-cognitive dual-dimensional multi-source saliency fusion strategy. By introducing model cognitive uncertainty features, it overcomes the industry pain points of existing methods that rely solely on physical geometric features, leading to overfitting of source models and a precipitous drop in heterogeneous transfer performance. This enables efficient cross-model attacks across different CNN architectures.

[0130] In experiments on the ScanObjectNN real-world dataset, the method of this invention maintained stable and excellent attack performance even in complex real-world scenarios. (Perturbation budget) At a resolution of 0.45, the success rates of this invention against PointNet++ (MSG), PointNet++ (SSG), and DGCNN reached 75.6%, 78.4%, and 66.4%, respectively, representing improvements of 6.5%, 8.1%, and 8.0% compared to the best existing forward attack method, CFG. These experimental results validate the core advantages of the invention's pioneering reverse constraint mechanism and strength compensation strategy. By transferring the attack payload from the highly saliency skeleton region to the robust planar region, it avoids visual artifacts and outliers caused by skeleton region perturbations in real-world scenarios, achieving a balance between attack strength and visual concealment. Furthermore, the generated adversarial examples can naturally evade detection by basic defense algorithms such as Statistical Outlier Removal (SOR), exhibiting stronger survivability in real-world environments.

[0131] In cross-model attack experiments on novel point cloud network architectures such as Transformer, the method of this invention further demonstrates extremely strong cross-architecture generalization ability. (Perturbation Budget) At a σ² = 0.45, the success rate of this invention against PT and Point-PN networks reaches 94.0% and 79.6%, respectively, representing improvements of 9.3% and 18.1% compared to the existing best method CFG, significantly outperforming all existing comparative methods. This result demonstrates that this invention, through the collaborative design of multi-source saliency fusion, reverse payload transfer, and tangential smoothing constraints, can effectively uncover shared vulnerable regions among different architecture models. Even on Transformer architectures and non-parametric networks with significantly different underlying feature extraction logics, it maintains an extremely high attack success rate, completely solving the industry problem of extremely low attack success rates when migrating from traditional CNNs to new network architectures.

[0132] The combined results of the three sets of experiments demonstrate that the MIST method proposed in this invention, compared with existing state-of-the-art (SOTA) attack methods, achieves a significant improvement in attack success rate across all scenarios, including general synthetic datasets, real-world datasets, traditional CNN architectures, and novel Transformer architectures. It also balances the visual concealment and robustness against defenses of adversarial examples, truly resolving the core contradiction in existing technologies where attack transferability, visual concealment, and robustness against defenses are difficult to achieve simultaneously. This fully demonstrates the inventiveness and practicality of the technical solution of this invention, providing a more powerful testing tool for evaluating the robustness of models in key safety fields such as intelligent driving and robotics.

[0133] Simultaneously, this invention achieves deep manifold embedding, i.e., from high-frequency noise superposition to tangential geometric sliding. This invention enhances the robustness of adversarial examples against defense mechanisms, making them difficult to filter out by conventional preprocessing methods. Existing methods often generate perturbations that are high-frequency noise or statistical outliers perpendicular to the object surface, which are easily identified and filtered by defenses such as Statistical Outlier Removal (SOR) or Simple Random Sampling (SRS), leading to attack failure. This invention, by transferring the attack payload to a planar region, introduces tangential smoothing constraints. This mechanism forces large perturbation vectors on the plane to be distributed primarily along the tangent direction of the object's surface, transforming perturbations into points sliding on the manifold surface rather than protrusions. This perturbation method, deeply embedded in the manifold structure, ensures that adversarial examples, when facing defensive preprocessing such as SOR, have neither outliers at the skeleton nor normal spikes on the plane, such as... Figure 2 and Figure 3 The visualization results show that this maintains an extremely high attack survival rate and practical anti-defense capability.

[0134] In summary, compared to existing technologies, this invention precisely locates vulnerable points through multi-source signal fusion, strategically transfers attack payloads using a reverse constraint mechanism, and achieves geometric stealth through tangential smoothing. These three elements work together organically to form a complete, highly concealed, highly mobile, and defense-resistant 3D point cloud adversarial attack system, providing a more powerful testing tool for evaluating the security of intelligent driving systems in complex 3D environments.

[0135] Based on the same inventive concept, this invention also provides a computer device, comprising: one or more processors, and a memory for storing one or more computer programs; the programs include program instructions, and the processor executes the program instructions stored in the memory. The processor may be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. It is the computing and control core of the terminal, used to implement one or more instructions, specifically for loading and executing one or more instructions stored in a computer storage medium to implement the above-described method.

[0136] It should be further explained that, based on the same inventive concept, the present invention also provides a computer storage medium storing a computer program, which, when executed by a processor, performs the above-described method. This storage medium can be any combination of one or more computer-readable media. A computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. A computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of computer-readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In the present invention, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0137] It should be noted that, unless otherwise defined, the technical or scientific terms used in this invention should have the ordinary meaning understood by one of ordinary skill in the art to which this invention pertains. The terms "first," "second," and similar terms used in this invention do not indicate any order, quantity, or importance, but are merely used to distinguish different components. Terms such as "comprising" or "including" mean that the element or object preceding the word encompasses the elements or objects listed following the word and their equivalents, without excluding other elements or objects. Terms such as "connected" or "linked" are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. Terms such as "upper," "lower," "left," and "right" are used only to indicate relative positional relationships; when the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0138] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention in any other way. Any person skilled in the art may make changes or modifications to the above-disclosed technical content to create equivalent embodiments. However, any simple modifications, equivalent changes, and modifications made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the protection scope of the present invention.

[0139] This invention is not limited to the preferred embodiment described above. Anyone inspired by this invention can derive other various forms of 3D point cloud adversarial sample generation methods based on multi-source saliency guidance and inverse constraints. All equivalent changes and modifications made within the scope of the claims of this invention shall fall within the scope of this invention.

Claims

1. A method for generating adversarial examples from 3D point clouds based on multi-source saliency guidance and inverse constraints, characterized in that, include: Acquire raw 3D point cloud data, and source 3D point cloud classification models for generating adversarial examples; For the original 3D point cloud data and the source 3D point cloud classification model, a point-level multi-source saliency map is generated; the point-level multi-source saliency map is at least integrated with the model cognitive uncertainty component obtained by calculating the Shannon entropy of the prediction results of the input point cloud based on the source 3D point cloud classification model. Based on the point-level multi-source saliency map, an upper limit of perturbation intensity and an optimization step size coefficient are determined for each point in the original 3D point cloud; wherein, the higher the saliency value of a point, the lower the corresponding upper limit of perturbation intensity and the larger the corresponding optimization step size coefficient; With the goal of minimizing the total loss function, the adversarial perturbation applied to the original 3D point cloud data is iteratively optimized. During each iteration, the gradient update step size is adjusted according to the optimization step size coefficient, and after the gradient update is completed, the perturbation amplitude of each point is pruned point by point according to the upper limit of the perturbation intensity. The total loss function includes an adversarial loss term and a hidden loss term, and the hidden loss term includes at least a tangential smoothing constraint term used to constrain the tangential distribution of the adversarial perturbation along the point cloud surface. When the iteration termination condition is met, the output is a 3D point cloud adversarial sample obtained by superimposing the original 3D point cloud data with the optimized adversarial perturbation.

2. The method for generating adversarial examples of 3D point clouds based on multi-source saliency guidance and inverse constraints according to claim 1, characterized in that: The point-level multi-source saliency map also incorporates a gradient sensitivity component and a geometric complexity component; the gradient sensitivity component is used to characterize the degree of influence of each point in the point cloud on the classification decision of the source 3D point cloud classification model, and the geometric complexity component is used to quantify the sensitivity of the region where each point is located in the point cloud to visual artifacts.

3. The method for generating adversarial examples of 3D point clouds based on multi-source saliency guidance and inverse constraints according to claim 2, characterized in that: The point-level multi-source saliency map is generated using a parameter-free strategy of single-feature independent normalization, weighted summation, and global normalization. Specifically, the gradient sensitivity, geometric complexity, and model cognitive uncertainty components are respectively subjected to minimum-maximum normalization and mapped to the 0 to 1 interval. After being weighted and summed with preset weights, global minimum-maximum normalization is then performed to generate the final point-level multi-source saliency map.

4. The method for generating adversarial examples of 3D point clouds based on multi-source saliency guidance and inverse constraints according to claim 1, characterized in that: The upper limit of the disturbance intensity is linearly negatively correlated with the significance value of the point. For each point, the upper limit of the disturbance intensity is equal to the preset maximum disturbance threshold of the low significance region, minus the product of the significance value of the point and the difference between the maximum disturbance threshold of the low significance region and the preset minimum disturbance threshold of the high significance region.

5. The method for generating adversarial examples of 3D point clouds based on multi-source saliency guidance and inverse constraints according to claim 1, characterized in that: The optimized step size coefficient and the significance value of the point are mapped by a linear positive correlation. For each point, the optimized step size coefficient is equal to the preset basic strength coefficient, plus the product of the significance value of that point and the preset step size enhancement coefficient.

6. The method for generating adversarial examples of 3D point clouds based on multi-source saliency guidance and inverse constraints according to claim 1, characterized in that: The tangential smoothing constraint term is implemented by penalizing the projection of the perturbation vector onto the normal direction of the point cloud surface, specifically by minimizing the sum of the absolute values ​​of the dot product of the perturbation vector and the corresponding point surface normal vector.

7. The method for generating adversarial examples of 3D point clouds based on multi-source saliency guidance and inverse constraints according to claim 1, characterized in that: The total loss function also includes a transferability loss term, which is a weighted sum of perturbation decomposition consistency constraints and input diversity regularization terms, used to improve the cross-model attack transferability of adversarial examples.

8. The method for generating adversarial examples of 3D point clouds based on multi-source saliency guidance and inverse constraints according to claim 1, characterized in that: The total loss function is equipped with a dynamically adjusted balancing hyperparameter to balance the effectiveness of adversarial attacks with the strictness of geometric constraints. When the attack is successful, the balancing hyperparameter is increased to tighten the geometric constraints, and when the attack fails, the balancing hyperparameter is decreased to relax the geometric constraints.

9. The method for generating adversarial examples of 3D point clouds based on multi-source saliency guidance and inverse constraints according to claim 1, characterized in that: The adversarial perturbation is initialized with zero, and the initial size is completely matched with the number of points and dimensions of the original 3D point cloud data. During the iterative optimization process, all parameters of the source 3D point cloud classification model are fixed, and only the adversarial perturbation is differentiated and updated.

10. A three-dimensional point cloud adversarial example generation system, characterized in that, The method for implementing any one of claims 1 to 9 includes a data loading module, a saliency calculation module, a dynamic constraint module, an iterative optimization module, and a result output module; The data loading module is used to acquire the original 3D point cloud data and the source 3D point cloud classification model; The saliency calculation module is used to generate a point-level multi-source saliency map that incorporates model cognitive uncertainty components; The dynamic constraint module is used to determine the upper limit of the disturbance intensity and the optimization step size coefficient for each point based on the point-level multi-source saliency map. The iterative optimization module is used to construct the total loss function and perform iterative optimization, step size modulation and point-by-point pruning against the adversarial disturbance. The result output module is used to output the final 3D point cloud adversarial sample when the iteration termination condition is met.

Images