A three-dimensional point cloud adversarial sample generation method under cone domain constraint

Abstract

The application discloses a kind of three-dimensional point cloud under the generation method of adversarial sample of conic domain constraint, belong to network security technical field.For the problem that present point cloud attack method is difficult to consider digital domain imperceptibility and physical domain manufacturability, by obtaining original point cloud and its normal information, construct local coordinate system with normal as axis and calculate adversarial loss gradient;According to the gradient intensity of each point, the half-cone angle threshold of conic feasible region is adaptively determined, the disturbance direction is limited with local normal as axis, and the gradient direction exceeding the threshold is subjected to conic projection constraint;Under the disturbance budget limit, the point cloud coordinates are iteratively updated until the adversarial point cloud sample is generated.The application effectively solves the problems existing in the prior art, while ensuring the attack success rate, significantly reduces the disturbance perceptibility and improves the physical realizability of adversarial sample.The application is superior to the existing method in attack success rate, geometric consistency and attack efficiency, etc.Indexes, which verifies its effectiveness and superiority.

Description

Technical Field

[0001] This invention belongs to the field of network security technology, specifically relating to a method for generating adversarial samples of three-dimensional point clouds under cone domain constraints. Background Technology

[0002] With the development of artificial intelligence and 3D sensor technology, 3D point cloud perception is widely used in scenarios such as autonomous driving, robot navigation, and industrial inspection. Point cloud data carries key perception information such as object recognition, environmental understanding, and target localization, and the output of related deep learning models often directly participates in the system decision-making and control process. In safety-critical systems, if the perception model is misled by input perturbations, it may lead to erroneous decisions and potential safety risks. Therefore, from a system security perspective, it is necessary to conduct systematic robustness testing and security assessment of point cloud deep learning models. To achieve quantifiable and reproducible security assessments, constructing high-quality adversarial examples is a key foundation: adversarial examples should be able to stably induce the model to make erroneous predictions, while maintaining as little apparent invisibility as possible, and possessing physical realizability when needed, thereby truly reflecting the vulnerability of the model in actual deployment environments.

[0003] To address these needs, point cloud adversarial attack techniques are constantly evolving. Point cloud adversarial attacks typically involve applying carefully designed micro-perturbations to the point cloud, causing errors in the model's output while maintaining the perturbation's geometric insensitivity. Among existing methods, one category is norm-constraint-based attack methods, which control the perturbation intensity by setting a predefined threshold for the perturbation magnitude (e.g., limiting the norm of single-point displacement or overall perturbation). These methods are relatively straightforward to implement, but the constraints often employ a globally uniform strategy, requiring strong prior knowledge of the point cloud geometry and model decision characteristics. For complex objects with drastic local curvature changes and rich surface details, globally uniform norm constraints may still introduce local geometric distortions or visible artifacts, resulting in insufficient digital domain insensitivity.

[0004] To improve imperceptibility and structural consistency, another category of attack methods is based on geometric constraints. These methods utilize local geometric properties of the point cloud (such as normals, tangent planes, curvature, and neighborhood distribution) to constrain the perturbation direction and update method, making the perturbation more consistent with surface structure characteristics. This achieves a degree of "maintaining geometric consistency" while completing an effective attack. Furthermore, considering the impact of differences in perturbation direction selection, attack strategies based on direction constraint features have emerged, reducing perceptible deformation by restricting the movement direction of points. However, when the perturbation is restricted to a single fixed direction, gradient components in other directions are completely suppressed, significantly shrinking the feasible attack space and often leading to a decrease in attack success rate. Simultaneously, the fixed-direction assumption struggles to adapt to the differences in geometric sensitivity across different regions of the same object, affecting effective optimization of "hard-to-attack regions." In contrast, considering local geometric differences and gradient sensitivity distribution helps provide a more refined perturbation optimization space in different regions, thus achieving a better trade-off between imperceptibility and attack effectiveness in the digital domain.

[0005] Furthermore, in security assessments of real-world systems, adversarial examples must not only be effective in the digital domain but also physically feasible. For instance, if adversarial point clouds generated in the digital domain are to be applied to a real environment, they often require physical processes such as 3D modeling, 3D printing, laser scanning, or re-acquisition by depth sensors. This process is affected by factors such as printing accuracy, material and surface characteristics, layering effects, scanning noise, and changes in viewing angle, which may cause deviations, weakening, or amplification of digital domain perturbations in physical implementation, leading to geometric distortion or attack failure. Most existing geometric constraint attack methods primarily focus on optimizations that are imperceptible in the digital domain, lacking systematic modeling and adaptation for errors and constraints in the aforementioned physical processes, resulting in a performance gap between the digital and physical domains.

[0006] Therefore, how to ensure the imperceptibility of the digital domain and the effectiveness of the attack, while enabling the perturbation direction to be adaptively adjusted by combining the local geometric features and gradient sensitivity of the point, and taking into account the manufacturing and acquisition constraints brought about by physical processes such as 3D printing and rescanning, so as to obtain a high-quality point cloud adversarial sample generation method that still has a high attack success rate and appearance consistency after physical implementation, is a technical problem that urgently needs to be solved in this field. Summary of the Invention

[0007] To address the challenge of existing adversarial attack methods for point clouds in simultaneously addressing the imperceptibility of the digital domain and the manufacturability of the physical domain, this invention provides a method for generating adversarial examples for 3D point clouds under cone domain constraints. This method uses the point cloud surface normal as a geometric prior, combining iterative gradient updates, cone feasible region constraints, adaptive cone angle allocation, and cone projection mechanisms to generate adversarial examples for point cloud classification / detection models. This ensures the effectiveness of the attack while maintaining the consistency of the point cloud's appearance and its physical realizability.

[0008] Iterative Gradient Update (AGI) is a commonly used gradient-driven update method in deep learning optimization and adversarial example generation. Its core lies in controlling the update process through two key parameters: the number of iterations and the step size. In each iteration, the adversarial loss gradient is calculated and adjusted along the gradient direction. This process is repeated to accumulate the attack effect. A smaller step size helps maintain the fineness of the perturbation and reduce its perceptibility, while a larger number of iterations or a larger step size can improve the attack strength and success rate. Furthermore, pruning or projection operations can be used after each update to meet the perturbation budget constraint, thus achieving a controllable balance between attack effectiveness and imperceptibility.

[0009] Cone constraint is a perturbation direction constraint method based on local geometric orientation. For each point in the point cloud, a cone-shaped feasible region for allowing update directions is constructed around its local surface normal vector as the axis. This constraint ensures that the movement of the point conforms to the surface geometry, reducing damage to the overall structure and local details of the object. This improves the imperceptibility of perturbations in the digital domain and preserves stable geometric consistency for the 3D printing manufacturing process in the physical domain.

[0010] The Adaptive Cone Angle dynamically allocates the cone's half-angle size based on the gradient response strength of each point during iteration. For points with larger gradient magnitudes and more significant contributions to the attack, the cone angle is increased to expand feasible update directions; for points with smaller gradient magnitudes or higher geometric sensitivity, the cone angle is decreased to enhance appearance preservation. This point-by-point adaptive strategy achieves a fine-grained trade-off across different surface regions of the object, simultaneously improving attack effectiveness and imperceptibility. When adaptive adjustment is not required, the mechanism can degenerate into a fixed cone angle mode.

[0011] Cone projection is used to apply cone domain constraints to the iterative update process. An orthogonal coordinate system is constructed with the local surface normal as the axis. The gradient or update direction is decomposed into normal and tangential components. In the local coordinate space, it is determined whether the update direction lies within the feasible region of the cone. When the update direction exceeds the cone's range, it is mapped to the direction corresponding to the cone's boundary through a projection operation. Simultaneously, a perturbation budget pruning operation is combined to ensure that the overall perturbation magnitude satisfies the constraints. This mechanism ensures that the generation process satisfies geometric direction constraints while maintaining the feasibility and stability of iterative optimization.

[0012] To achieve the above objectives, the present invention employs the following technical solutions:

[0013] A method for generating adversarial examples from 3D point clouds with conical constraints, the method comprising the following steps:

[0014] Step 1: Obtaining Point Cloud and Normal Vectors; Obtain the original point cloud. and its real label Simultaneously, obtain or estimate the set of unit normal vectors for each point in the point cloud. When the original point cloud already contains normal information, it is read directly; when the original point cloud does not contain normal information, normal is estimated and normalized based on the neighborhood of each point to obtain a unit normal vector.

[0015] Furthermore, the specific operation of step 1 is as follows:

[0016] Step 1.1: Point Cloud Data Acquisition and Labeling: Acquire the original point cloud to be attacked. The point cloud is derived from LiDAR, depth camera, multi-view reconstruction, or 3D model sampling to obtain a point cloud file containing point coordinates; simultaneously, the corresponding ground truth labels for this point cloud are obtained. When the task is point cloud classification, the ground truth label is the object category label; when the task is point cloud detection, the ground truth label is the target category and its corresponding detection annotation information (such as target category, location or bounding box, etc.), which serves as the input for step 1.2.

[0017] Step 1.2: Normal Vector Acquisition: Obtain the normal vector information of each point using the original point cloud data obtained in Step 1.1; when the original point cloud data itself contains normal vector channels, directly read the normal vector of each point; when the original point cloud data does not contain normal vector channels, construct a local neighborhood (e.g., k-nearest neighbor or radius neighborhood) for each point, and perform plane fitting or principal component analysis within the local neighborhood to estimate the normal direction of the point, thereby obtaining the normal vector of each point, which serves as the input for Step 1.3;

[0018] Step 1.3: Normalization and Consistency Processing of Normal Vectors: The normal vectors obtained in Step 1.2 are normalized, and the orientation of the normal vectors is corrected for consistency, so that the normal directions of adjacent points are consistent, resulting in a set of unit normal vectors. This serves as the input for step 2.

[0019] Step 2: Local Coordinate Construction and Transformation; Using the unit normal vector of each point as the principal axis of the local coordinate system, construct a local orthogonal coordinate system, and transform the original point cloud from global coordinates to local coordinates to obtain the local point cloud. This step ensures that subsequent constraints on the perturbation direction are uniformly implemented in a local space "relative to the normal," avoiding the difficulty in aligning constraints with local geometry caused by directly restricting the direction in global coordinates.

[0020] Furthermore, the specific operation of step 2 is as follows:

[0021] Step 2.1: Local coordinate system construction: For each point in the original point cloud With its unit normal vector As the principal axis of the local coordinate system, construct a local orthogonal coordinate system for this point, aligning the normal axis of the local coordinate system with the normal direction of the surface at this point, and use this as the input for step 2.2;

[0022] Step 2.2: Forward coordinate transformation: Generate the corresponding coordinate transformation relationship for the local coordinate system constructed in Step 2.1, transform the original point cloud from global coordinates to local coordinates, and obtain the local point cloud;

[0023] Step 2.3: Save the inverse transformation relationship: Save the local coordinate transformation relationship used in Step 2.2. This will be used to restore the update result under the local coordinates to the global coordinates after the subsequent iteration update is completed, so as to ensure that the point cloud update can be written back to the original coordinate space as the input of Step 6.2.

[0024] Step 3: Adversarial loss and gradient calculation; calculate the local point cloud. Input point cloud classification / detection network model Construct attack targets and calculate countermeasure losses. The attack target is: without specifying a target category, only causing errors in the model output (e.g., classification error, detection category error, or abnormal detection result). Subsequently, the adversarial loss is backpropagated to obtain the gradient information of the loss relative to the local point cloud coordinates. This serves as a basis for candidate directions for point cloud updates;

[0025] Furthermore, the specific operation of step 3 is as follows:

[0026] Step 3.1: Model Inference and Output Acquisition: Obtain the local point cloud from Step 2. Input point cloud classification / detection network model The model output results are obtained. When the task is classification, the output is the score of each category or logits. When the task is detection, the output is the category score, location parameters or detection confidence of the candidate target, etc., which are used as the input for step 3.2.

[0027] Step 3.2: Constructing Adversarial Loss: Construct an attack target based on the model output from Step 3.1 and calculate the adversarial loss. The attack refers to not specifying a target category, but only aiming to make the model output deviate from the true label or produce detection anomalies; the loss function formula is:

[0028]

[0029] in, Score for the true category. As a confidence parameter, The maximum score among all categories except the true category; used as input for step 3.3;

[0030] Step 3.3: Gradient Calculation: Perform backpropagation on the adversarial loss function from Step 3.2 to obtain the gradient information of the loss with respect to the local point cloud coordinates. And calculate the gradient strength (e.g., the magnitude of the gradient vector) at each point as input for step 4.

[0031] Step 4: Adaptive cone angle calculation; Based on the strength of the gradient at each point, adaptively determine the half-angle of the cone corresponding to each point. Points with larger gradient strengths are considered key points that are more sensitive to the model output and can be assigned larger gradient strengths. To ensure the effectiveness of the attack; points with smaller gradient strengths are assigned smaller values. To enhance the concealment of disturbances. Within the preset angle range Internal variation; and in an optional implementation, the adaptive mechanism can be disabled, fixing the cone half-angle of all points to a preset constant. ;

[0032] Furthermore, the specific operation of step 4 is as follows:

[0033] Step 4.1: Gradient strength statistics: Statistically analyze the gradient strength of each point obtained in Step 3.3 to obtain the mean and dispersion of the gradient strength of each point, which will be used for subsequent adaptive angle allocation and serve as the input for Step 4.2;

[0034] Step 4.2: Adaptive Cone Angle Allocation: Assign a half-angle of cone to each point based on the strength of the gradient. and will Limited to a preset range Within, points with larger gradient strengths are assigned larger values. To maintain attack effectiveness, points with smaller gradient strengths are assigned smaller values. To maintain the concealment of the disturbance, it serves as the input for step 5;

[0035] Step 4.3: Fixed Angle Degradation (Optional): When the adaptive mechanism is not enabled, the cone half-angle of all points is uniformly set to a preset fixed angle. This forms a fixed cone constraint version, which serves as input for step 5.

[0036] Step 5: Conical domain constraint projection; using the local normal direction of each point as the cone axis, and the direction determined in Step 4... As a cone half-angle, a cone domain constraint is applied to the candidate gradient direction obtained in step 3: when the angle between the candidate gradient direction and the normal does not exceed a certain value... When the candidate gradient direction deviates too much from the normal and exceeds the cone's allowable range, the direction is projected / adjusted to the cone's boundary direction. This ensures that the update direction of each point always falls within the allowable direction domain centered on the normal, achieving the goal of "direction controlled but still gradient-driven," balancing imperceptibility and attack effectiveness. The projected gradient is obtained after projection. 。;

[0037] Furthermore, the specific operation of step 5 is as follows:

[0038] Step 5.1: Conical Domain Construction: Using the local normal direction of each point as the cone axis, and the cone half-angle obtained in Step 4... Assuming the allowed directional range at that point, construct the conical feasible region for that point, which serves as the input for step 5.2.

[0039] Step 5.2: Gradient Direction Determination: Determine the candidate gradient direction obtained in Step 3, and check whether its deviation from the local normal direction exceeds the cone half-angle at that point. This serves as the input for step 5.3;

[0040] Step 5.3: Conical Projection Correction: When the candidate gradient direction exceeds the feasible region of the cone, project / correct the direction to the cone boundary direction to ensure that the update direction falls within the cone region; when the candidate gradient direction is within the cone region, it remains unchanged, thus obtaining the projected gradient that satisfies the constraints. This serves as the input for step 6. Unit direction. The conic projection is represented as:

[0041]

[0042] in, For the local normal axis, The tangential unit direction.

[0043] Step 6: Iterative update and perturbation constraints; based on the projected gradient The local point cloud is iteratively updated, and the update results are restored to global coordinates through inverse transformation to obtain the updated point cloud. To ensure that the perturbation is imperceptible, a perturbation budget is applied to the updated point cloud to ensure that the change of the adversarial point cloud relative to the original point cloud satisfies the norm constraint; the norm constraint is... Constraints or Constraints, preferably Constraints. In an optional implementation, after each iteration, the normal vector can be re-estimated based on the updated point cloud to adapt to local geometric changes, and steps 2 to 6 are repeated until a preset number of iterations is reached or a preset termination condition is met, outputting an adversarial point cloud. ;

[0044] Furthermore, the specific operation of step 6 is as follows:

[0045] Step 6.1: Iterative Update: Based on the projected gradient obtained in Step 5 According to the preset step size Update the local point cloud once to obtain the updated local point cloud, which is used as the input for step 6.2;

[0046] Step 6.2: Inverse Coordinate Transformation Recovery: The local point cloud updated in Step 6.1 is restored to the global coordinates using the inverse transformation relationship saved in Step 2.3, resulting in the updated global point cloud. This serves as the input for step 6.3.

[0047] Step 6.3: Perturbation Budget Pruning: Apply a perturbation budget constraint to the updated point cloud obtained in Step 6.2, ensuring that the change in the adversarial point cloud relative to the original point cloud does not exceed a preset budget. The norm constraint is or Preferred For example in Under constraints, perform clipping on each point coordinate component:

[0048]

[0049] The cropped adversarial point cloud is obtained and used as input for step 6.4.

[0050] Step 6.4: Normal Vector Update and Loop: Based on the adversarial point cloud obtained in Step 6.3, re-estimate or update the set of normal vectors. Repeat steps 2 through 6 until the preset number of iterations is reached or the termination condition is met, and output the final adversarial point cloud. .

[0051] Compared with the prior art, the present invention has the following advantages:

[0052] (1) By classifying the characteristics of network traffic data, feature extraction becomes more targeted, effectively extracting feature information and realizing efficient feature representation of network traffic data.

[0053] (2) By using multiple dilated convolutions with different kernel sizes and different dilation rates, the spatial features of network traffic data were extracted at multiple scales, including short-term mutations and long-term trends, resulting in more comprehensive features. By combining self-attention with bidirectional GRU, the model can focus on the most relevant parts of the sequence, enhance the capture of important temporal features, and help identify anomalous behaviors that are manifested as time deviations.

[0054] (3) A complex fusion network is proposed. It can process different feature information in parallel and capture global dependencies in sequence, which enables network security practitioners to identify abnormal traffic more comprehensively and accurately in complex network environments. Attached Figure Description

[0055] Figure 1 This is a flowchart illustrating the method for generating adversarial examples of 3D point clouds under cone domain constraints in this invention.

[0056] Figure 2 This is a schematic diagram illustrating the definition of the feasible region of the cone in this invention;

[0057] Figure 3 This is a schematic diagram of the adaptive allocation of cone half-angle based on gradient strength in this invention;

[0058] Figure 4 This is a flowchart of the algorithm for generating point clouds using conical constraints in this invention. Detailed Implementation

[0059] To gain a deeper understanding of this invention, we will provide a comprehensive and detailed description. However, this invention has various implementations and is not limited to the specific examples listed herein. These examples are presented to enhance a full understanding of the disclosure of this invention.

[0060] Appendix Figure 1 As shown, this invention proposes a method for generating adversarial examples for 3D point clouds under cone domain constraints. The method takes the original point cloud as input, acquires / estimates the point cloud normal vector, constructs a local coordinate system with the normal vector as the axis, and transforms the point cloud into a local coordinate representation. Then, the local point cloud is input into a point cloud classification / detection network model to construct an adversarial loss and calculate the gradient. Next, based on the gradient strength, a cone half-angle is adaptively assigned to each point to establish a cone feasible region. Candidate update directions are then subject to cone domain determination and projection correction. Finally, the point cloud is iteratively updated under perturbation budget constraints, and the adversarial point cloud is output. This method does not limit the specific model structure; both point cloud classification networks and 3D object detection networks can be used as targets. The point cloud can originate from various sensors or 3D model sampling, thus enabling robustness evaluation and security testing in different application scenarios.

[0061] A method for generating adversarial examples from 3D point clouds with conical constraints, the method comprising the following steps:

[0062] Step 1: Obtaining Point Cloud and Normal Vectors; Obtain the original point cloud. and its real label Simultaneously, obtain or estimate the set of unit normal vectors for each point in the point cloud. When the original point cloud already contains normal information, it is read directly; when the original point cloud does not contain normal information, normal is estimated and normalized based on the neighborhood of each point to obtain a unit normal vector.

[0063] Furthermore, the specific operation of step 1 is as follows:

[0064] Step 1.1: Point Cloud Data Acquisition and Labeling: Acquire the original point cloud to be attacked. The point cloud is derived from LiDAR, depth camera, multi-view reconstruction, or 3D model sampling to obtain a point cloud file containing point coordinates; simultaneously, the corresponding ground truth labels for this point cloud are obtained. When the task is point cloud classification, the ground truth label is the object category label; when the task is point cloud detection, the ground truth label is the target category and its corresponding detection annotation information (such as target category, location or bounding box, etc.), which serves as the input for step 1.2.

[0065] Step 1.2: Normal Vector Acquisition: Obtain the normal vector information of each point using the original point cloud data obtained in Step 1.1; when the original point cloud data itself contains normal vector channels, directly read the normal vector of each point; when the original point cloud data does not contain normal vector channels, construct a local neighborhood (e.g., k-nearest neighbor or radius neighborhood) for each point, and perform plane fitting or principal component analysis within the local neighborhood to estimate the normal direction of the point, thereby obtaining the normal vector of each point, which serves as the input for Step 1.3;

[0066] Step 1.3: Normalization and Consistency Processing of Normal Vectors: The normal vectors obtained in Step 1.2 are normalized, and the orientation of the normal vectors is corrected for consistency, so that the normal directions of adjacent points are consistent, resulting in a set of unit normal vectors. This serves as the input for step 2.

[0067] Step 2: Local Coordinate Construction and Transformation; Using the unit normal vector of each point as the principal axis of the local coordinate system, construct a local orthogonal coordinate system, and transform the original point cloud from global coordinates to local coordinates to obtain the local point cloud. This step ensures that subsequent constraints on the perturbation direction are uniformly implemented in a local space "relative to the normal," avoiding the difficulty in aligning constraints with local geometry caused by directly restricting the direction in global coordinates.

[0068] Furthermore, the specific operation of step 2 is as follows:

[0069] Step 2.1: Local coordinate system construction: For each point in the original point cloud With its unit normal vector As the principal axis of the local coordinate system, construct a local orthogonal coordinate system for this point, aligning the normal axis of the local coordinate system with the normal direction of the surface at this point, and use this as the input for step 2.2;

[0070] Step 2.2: Forward coordinate transformation: Generate the corresponding coordinate transformation relationship for the local coordinate system constructed in Step 2.1, transform the original point cloud from global coordinates to local coordinates, and obtain the local point cloud;

[0071] Step 2.3: Save the inverse transformation relationship: Save the local coordinate transformation relationship used in Step 2.2. This will be used to restore the update result under the local coordinates to the global coordinates after the subsequent iteration update is completed, so as to ensure that the point cloud update can be written back to the original coordinate space as the input of Step 6.2.

[0072] Step 3: Adversarial loss and gradient calculation; calculate the local point cloud. Input point cloud classification / detection network model Construct attack targets and calculate countermeasure losses. The attack target is: without specifying a target category, only causing errors in the model output (e.g., classification error, detection category error, or abnormal detection result). Subsequently, the adversarial loss is backpropagated to obtain the gradient information of the loss relative to the local point cloud coordinates. This serves as a basis for candidate directions for point cloud updates;

[0073] Furthermore, the specific operation of step 3 is as follows:

[0074] Step 3.1: Model Inference and Output Acquisition: Obtain the local point cloud from Step 2. Input point cloud classification / detection network model The model output results are obtained. When the task is classification, the output is the score of each category or logits. When the task is detection, the output is the category score, location parameters or detection confidence of the candidate target, etc., which are used as the input for step 3.2.

[0075] Step 3.2: Constructing Adversarial Loss: Construct an attack target based on the model output from Step 3.1 and calculate the adversarial loss. The attack refers to not specifying a target category, but only aiming to make the model output deviate from the true label or produce detection anomalies; the loss function formula is:

[0076]

[0077] in, Score for the true category. As a confidence parameter, The maximum score among all categories except the True Class;

[0078] As input for step 3.3;

[0079] Step 3.3: Gradient Calculation: Perform backpropagation on the adversarial loss function from Step 3.2 to obtain the gradient information of the loss with respect to the local point cloud coordinates. And calculate the gradient strength (e.g., the magnitude of the gradient vector) at each point as input for step 4.

[0080] Step 4: Adaptive cone angle calculation; Based on the strength of the gradient at each point, adaptively determine the half-angle of the cone corresponding to each point. Points with larger gradient strengths are considered key points that are more sensitive to the model output and can be assigned larger gradient strengths. To ensure the effectiveness of the attack; points with smaller gradient strengths are assigned smaller values. To enhance the concealment of disturbances. Within the preset angle range Internal variation; and in an optional implementation, the adaptive mechanism can be disabled, fixing the cone half-angle of all points to a preset constant. ;

[0081] Furthermore, the specific operation of step 4 is as follows:

[0082] Step 4.1: Gradient strength statistics: Statistically analyze the gradient strength of each point obtained in Step 3.3 to obtain the mean and dispersion of the gradient strength of each point, which will be used for subsequent adaptive angle allocation and serve as the input for Step 4.2;

[0083] Step 4.2: Adaptive Cone Angle Allocation: Assign a half-angle of cone to each point based on the strength of the gradient. and will Limited to a preset range Within, points with larger gradient strengths are assigned larger values. To maintain attack effectiveness, points with smaller gradient strengths are assigned smaller values. To maintain the concealment of the perturbation, it serves as the input for step 5; a schematic diagram of the adaptive allocation of the cone half-angle based on the gradient strength is shown below. Figure 3 As shown;

[0084] Step 4.3: Fixed Angle Degradation (Optional): When the adaptive mechanism is not enabled, the cone half-angle of all points is uniformly set to a preset fixed angle. This forms a fixed cone constraint version, which serves as input for step 5.

[0085] Step 5: Conical domain constraint projection; using the local normal direction of each point as the cone axis, and the direction determined in Step 4... As a cone half-angle, a cone domain constraint is applied to the candidate gradient direction obtained in step 3: when the angle between the candidate gradient direction and the normal does not exceed a certain value... When the candidate gradient direction deviates too much from the normal and exceeds the cone's allowable range, the direction is projected / adjusted to the cone's boundary direction. This ensures that the update direction of each point always falls within the allowable direction domain centered on the normal, achieving the goal of "direction controlled but still gradient-driven," balancing imperceptibility and attack effectiveness. The projected gradient is obtained after projection. 。;

[0086] Furthermore, the specific operation of step 5 is as follows:

[0087] Step 5.1: Conical Domain Construction: Using the local normal direction of each point as the cone axis, and the cone half-angle obtained in Step 4... As the allowed directional range for that point, construct the conical feasible region for that point, which serves as the input for step 5.2;

[0088] Step 5.2: Gradient Direction Determination: Determine the candidate gradient direction obtained in Step 3, and check whether its deviation from the local normal direction exceeds the cone half-angle at that point. This serves as the input for step 5.3;

[0089] Step 5.3: Conical Projection Correction: When the candidate gradient direction exceeds the feasible region of the cone, project / correct the direction to the cone boundary direction to ensure that the update direction falls within the cone region; when the candidate gradient direction is within the cone region, it remains unchanged, thus obtaining the projected gradient that satisfies the constraints. This serves as the input for step 6. Unit direction. The conic projection is represented as:

[0090]

[0091] in, For the local normal axis, The tangential unit direction.

[0092] Step 6: Iterative update and perturbation constraints; based on the projected gradient The local point cloud is iteratively updated, and the update results are restored to global coordinates through inverse transformation to obtain the updated point cloud. To ensure that the perturbation is imperceptible, a perturbation budget is applied to the updated point cloud to ensure that the change of the adversarial point cloud relative to the original point cloud satisfies the norm constraint; the norm constraint is... Constraints or Constraints, preferably Constraints. In an optional implementation, after each iteration, the normal vector can be re-estimated based on the updated point cloud to adapt to local geometric changes, and steps 2 to 6 are repeated until a preset number of iterations is reached or a preset termination condition is met, outputting an adversarial point cloud. ;

[0093] Furthermore, the specific operation of step 6 is as follows:

[0094] Step 6.1: Iterative Update: Based on the projected gradient obtained in Step 5 According to the preset step size Update the local point cloud once to obtain the updated local point cloud, which is used as the input for step 6.2;

[0095] Step 6.2: Inverse Coordinate Transformation Recovery: The local point cloud updated in Step 6.1 is restored to the global coordinates using the inverse transformation relationship saved in Step 2.3, resulting in the updated global point cloud. This serves as the input for step 6.3.

[0096] Step 6.3: Perturbation Budget Pruning: Apply a perturbation budget constraint to the updated point cloud obtained in Step 6.2, ensuring that the change in the adversarial point cloud relative to the original point cloud does not exceed a preset budget. The norm constraint can be: or Preferred For example in Under constraints, perform clipping on each point coordinate component:

[0097]

[0098] The cropped adversarial point cloud is obtained and used as input for step 6.4.

[0099] Step 6.4: Normal Vector Update and Loop: Based on the adversarial point cloud obtained in Step 6.3, re-estimate or update the set of normal vectors. Repeat steps 2 through 6 until the preset number of iterations is reached or the termination condition is met, and output the final adversarial point cloud. .

[0100] To verify the effectiveness of the proposed cone-domain constrained 3D point cloud adversarial example generation method, extensive experiments were conducted to evaluate Cone-adv. The datasets used and their partitioning methods are shown in Table 1. Table 2 compares the evaluation results of this invention with other detection models. The proposed method outperforms most existing methods in attack success rate (ASR), mean squared error (MSE), and Chamfer distance (CD) on the dataset, demonstrating its superiority and effectiveness.

[0101] Table 1. Datasets and Dataset Partitioning Methods

[0102]

[0103] Table 2 Comparison of evaluation results of this invention with other detection models

[0104] Contents not described in detail in this specification are prior art known to those skilled in the art. Although illustrative specific embodiments of the invention have been described above to facilitate understanding by those skilled in the art, it should be understood that the invention is not limited to the scope of the specific embodiments. Various modifications are readily apparent to those skilled in the art as long as they fall within the spirit and scope of the invention as defined and determined by the appended claims, and all inventions utilizing the concept of this invention are protected.

Claims

1. A method for generating adversarial examples of 3D point clouds under cone domain constraints, characterized in that: The method includes the following steps: Step 1: Obtain the point cloud and normal vectors, and acquire the original point cloud. and its real label Simultaneously, obtain or estimate the set of unit normal vectors for each point in the point cloud. When the original point cloud already contains normal information, it is read directly; when the original point cloud does not contain normal information, normal is estimated and normalized based on the neighborhood of each point to obtain a unit normal vector. Step 2: Local coordinate construction and transformation; Using the unit normal vector of each point as the principal axis of the local coordinate system, construct a local orthogonal coordinate system, and transform the original point cloud from global coordinates to local coordinates to obtain the local point cloud. ; Step 3: Adversarial loss and gradient calculation; calculate the local point cloud. Input point cloud classification / detection network model Construct attack targets and calculate countermeasure losses. And backpropagation is performed to counteract the loss, obtaining the gradient information of the loss relative to the local point cloud coordinates. ; Step 4: Adaptive cone angle calculation; Based on the strength of the gradient at each point, adaptively determine the half-angle of the cone corresponding to each point. The cone half angle Within the preset angle range Internal changes; Step 5: Conical domain constraint projection, with the local normal direction of each point as the cone axis and the cone half angle determined in Step 4. As a threshold, a conical domain constraint is applied to the gradient direction obtained in step 3, whereby the angle between the gradient direction and the normal does not exceed half the cone angle. While maintaining its direction, if it exceeds the half-angle of the cone, the gradient direction is projected onto the cone boundary direction to obtain the projected gradient. ; Step 6: Iterative update and perturbation constraints, based on the projected gradient. The local point cloud is iteratively updated, and the updated point cloud is restored to the global coordinate space through inverse transformation. A perturbation budget is then applied to the updated point cloud to satisfy a preset norm constraint. Steps 2 to 6 are repeated until a preset number of iterations is reached or a termination condition is met, outputting an adversarial point cloud. .

2. The method for generating adversarial examples of 3D point clouds under cone domain constraints according to claim 1, characterized in that: The specific operation of step 1 is as follows: Step 1.1: Point Cloud Data Acquisition and Labeling: Acquire the original point cloud to be attacked. The point cloud is derived from LiDAR, depth camera, multi-view reconstruction, or 3D model sampling to obtain a point cloud file containing point coordinates; simultaneously, the corresponding ground truth labels for this point cloud are obtained. When the task is point cloud classification, the ground truth label is the object category label; when the task is point cloud detection, the ground truth label is the target category and its corresponding detection annotation information, which serves as the input for step 1.

2. Step 1.2: Normal Vector Acquisition: Obtain the normal vector information of each point using the original point cloud data obtained in Step 1.1; when the original point cloud data itself contains normal vector channels, directly read the normal vector of each point; when the original point cloud data does not contain normal vector channels, construct a local neighborhood for each point, and perform plane fitting or principal component analysis within the local neighborhood to estimate the normal direction of the point, thereby obtaining the normal vector of each point, which serves as the input for Step 1.3; Step 1.3: Normal Vector Normalization: Normalize the normal vectors of each point obtained in Step 1.2 into unit normal vectors, and perform consistency correction on the normal orientation of adjacent points to make the normal directions of adjacent points consistent, thus obtaining a set of unit normal vectors. This serves as the input for step 2.

3. The method for generating adversarial examples of 3D point clouds under cone domain constraints according to claim 2, characterized in that: The specific operation of step 2 is as follows: Step 2.1: For each point in the original point cloud With its unit normal vector As the principal axis of the local coordinate system, construct a local orthogonal coordinate system for this point, aligning the normal axis of the local coordinate system with the normal direction of the surface at this point, and use this as the input for step 2.2; Step 2.2: Forward Coordinate Transformation: Generate the corresponding coordinate transformation relationship for the local coordinate system constructed in Step 2.1, transforming the original point cloud from global coordinates to local coordinates to obtain the local point cloud. ; Step 2.3: Save the inverse transformation relationship. Save the coordinate transformation relationship from step 2.2, which will be used to restore the updated local point cloud to the original global coordinate space.

4. The method for generating adversarial examples of 3D point clouds under cone domain constraints according to claim 3, characterized in that: The specific operation of step 3 is as follows: Step 3.1: Model Inference and Output Acquisition: Obtain the local point cloud from Step 2. Input point cloud classification / detection network model Obtain the model output results; Step 3.2: Constructing Adversarial Loss: Construct an attack target based on the model output from Step 3.1 and calculate the adversarial loss. The attack refers to not specifying a target category, but only aiming to make the model output deviate from the true label or produce detection anomalies; the loss function formula is: in, Score for the true category. As a confidence parameter, The maximum score among all categories except the True Class; Step 3.3: Gradient Calculation: Perform backpropagation on the adversarial loss function from Step 3.2 to obtain the gradient information of the loss with respect to the local point cloud coordinates. And calculate the gradient strength at each point.

5. The method for generating adversarial examples of 3D point clouds under cone domain constraints according to claim 4, characterized in that: The specific operation of step 4 is as follows: Step 4.1: Gradient strength statistics: Perform statistical analysis on the gradient strength of each point obtained in Step 3.3 to obtain the mean and dispersion of the gradient strength of each point; Step 4.2: Adaptive Cone Angle Allocation: Assign a half-angle of cone to each point based on the strength of the gradient. and the cone half angle Limited to a preset range Inside; Step 4.3: Fixed Cone Angle Setting: When the adaptive mechanism is not enabled, the cone half-angle of all points is uniformly set to a preset fixed angle value. .

6. The method for generating adversarial examples of three-dimensional point clouds under cone domain constraints according to claim 5, characterized in that: The specific operation of step 5 is as follows: Step 5.1: Conical Domain Construction: Using the local normal direction of each point as the cone axis and the cone half angle obtained in Step 4 as the allowable directional deviation range, construct the feasible conical domain for that point; Step 5.2: Gradient Direction Determination: Determine the candidate gradient direction obtained in Step 3, and check whether its deviation from the local normal direction exceeds the cone half-angle at that point. ; Step 5.3: Conical Projection Correction: When the candidate gradient direction exceeds the feasible region of the cone, project / correct the direction to the cone boundary direction to ensure that the update direction falls within the cone region; when the candidate gradient direction is within the cone region, it remains unchanged, thus obtaining the projected gradient that satisfies the constraints. As input for step 6, the unit direction The conic projection is represented as: in, For the local normal axis, The tangential unit direction.

7. The method for generating adversarial examples of 3D point clouds under cone domain constraints according to claim 6, characterized in that: The specific operation of step 6 is as follows: Step 6.1: Iterative Update: Based on the projected gradient obtained in Step 5 According to the preset step size The local point cloud is updated once; Step 6.2: Inverse Coordinate Transformation Recovery: The local point cloud updated in Step 6.1 is restored to the global coordinate system using the inverse transformation relationship saved in Step 2.3, resulting in the updated global point cloud. ; Step 6.3: Perturbation Budget Pruning: Perform perturbation budget pruning on the updated global point cloud obtained in Step 6.2 to ensure that the change of the point cloud relative to the original point cloud does not exceed a preset perturbation threshold. Step 6.4: Normal Vector Update and Iteration: Based on the adversarial point cloud pruned in Step 6.3, re-estimate the normal vectors of each point, and repeat Steps 2 to 6 until the preset number of iterations is reached or the termination condition is met, outputting the final adversarial point cloud. .

Images