A three-dimensional point cloud countermeasure defense method, system, device and storage medium

Abstract

This invention relates to the field of adversarial attack defense technology, specifically a method, system, device, and storage medium for three-dimensional point cloud adversarial defense. The method includes: acquiring adversarial point cloud data; extracting local geometric features of each point in the adversarial point cloud data to obtain a geometric context representation of each point; for each point in the adversarial point cloud data, fusing the point's coordinate information and geometric context representation to obtain an enhanced feature; inputting the enhanced feature into a geometry-aware velocity field network, which maps the adversarial point cloud data along a reasonable path to a clean manifold based on the enhanced feature, obtaining clean point cloud data to resist adversarial attacks. This invention can effectively repair the geometric structure damaged by adversarial attacks and improve the effectiveness of adversarial attack defense.

Description

Technical Field

[0001] This invention relates to the field of counter-attack defense technology, and in particular to a three-dimensional point cloud counter-attack defense method, system, device and storage medium. Background Technology

[0002] With the rapid development of 3D sensing technologies (such as LiDAR and depth cameras), 3D point cloud data has become the primary data format for representing the 3D physical world. 3D point clouds consist of a massive set of unordered coordinate points, capable of accurately recording the spatial geometric information of objects. Currently, deep learning-based point cloud processing models (such as PointNet++) play a crucial role in key areas such as autonomous driving environmental perception, robot navigation and obstacle avoidance, augmented reality (AR), and high-precision 3D reconstruction. These applications typically have extremely high requirements for data accuracy and system security.

[0003] While deep neural networks have achieved remarkable results in point cloud analysis tasks, research shows they are highly vulnerable to adversarial attacks. Attackers can induce high-confidence misclassifications by adding tiny, imperceptible adversarial perturbations (such as those generated by PGD, C&W, and IFGM algorithms) to the raw point cloud data. Compared to two-dimensional images, adversarial perturbations in three-dimensional point clouds often exist in the form of tiny displacements. These perturbations can mislead classifiers by disrupting the local differential geometry of the point cloud (such as surface normal direction and curvature continuity) while maintaining the overall shape without significant changes. This security vulnerability poses a serious challenge to the practical deployment of safety-critical systems such as autonomous driving and robotics.

[0004] To defend against adversarial attacks, existing defense methods mainly fall into two categories. Preprocessing / filtering-based methods, particularly early approaches, typically relied on statistical outlier removal or simple spatial smoothing filtering. These methods treat point clouds as an unordered set of coordinates, processing only based on the spatial location or statistical distribution of points. However, due to their relatively coarse mechanisms, they cannot handle structured, low-amplitude adversarial perturbations, resulting in insufficient defense effectiveness and easily damaging the original geometric details of objects. In recent years, generative defense methods, represented by diffusion models, have gained attention. These methods attempt to restore adversarial examples to clean samples through multi-step iterative denoising. However, these methods have two significant drawbacks: first, low efficiency, typically relying on hundreds of iterations, resulting in high computational cost and latency, making it difficult to meet real-time requirements; second, a lack of geometric constraints, with optimization objectives focusing primarily on global distribution matching without imposing geometric smoothness constraints on intermediate states, easily leading to over-smoothing (blurring sharp edges) or non-physical deformation (such as surface wrinkles), thus introducing new risks of misjudgment.

[0005] To address the slow inference speed of traditional generative models, flow matching theory has been proposed as an emerging generative framework. Unlike the random sampling paths of diffusion models, flow matching models the data generation process as an optimal transport problem from the source distribution (e.g., adversarial example distribution) to the target distribution (e.g., clean example distribution). By learning a deterministic velocity field, flow matching can establish a direct mapping from perturbed states to clean states. This mechanism theoretically allows for rapid generation using ordinary differential equation (ODE) solvers. However, when directly applying flow matching to 3D point cloud adversarial defense, without combining it with specific geometric prior information, it is still difficult to guarantee the local geometric consistency and high fidelity of the repair results. Summary of the Invention

[0006] This application aims to at least solve the technical problems existing in the prior art and provide a three-dimensional point cloud adversarial defense method, system, device and storage medium.

[0007] In a first aspect, the present invention provides a three-dimensional point cloud adversarial defense method, the method comprising: Acquire adversarial point cloud data; Local geometric features of each point in the adversarial point cloud data are extracted to obtain the geometric context representation of each point in the adversarial point cloud data; For each point in the adversarial point cloud data, the coordinate information and geometric context representation of the point are fused to obtain the enhanced features; The enhanced features are input into a geometry-aware velocity field network. The velocity field network maps the adversarial point cloud data to a clean manifold along a reasonable path based on the enhanced features, thus obtaining clean point cloud data to resist adversarial attacks.

[0008] Optionally, the step of extracting local geometric features of each point in the adversarial point cloud data to obtain a geometric context representation of each point in the adversarial point cloud data includes: For each point in the anti-point cloud data , construction point of The nearest neighbor points are obtained. The neighborhood set, based on the point Construct a local covariance matrix from the neighborhood set of the point and perform eigenvalue decomposition to output the value of that point. Normal vector estimation and dimensionless curvature index The geometric context vector is formed by splicing the normal vector estimate and the dimensionless curvature index. In order to obtain points Geometric context representation.

[0009] Optionally, it also includes training the velocity field network using a training dataset.

[0010] Optionally, the steps of training the velocity field network using the training dataset include: Obtain the training dataset; Constructing the network structure of the velocity field network; The velocity field network is trained using the training dataset until the training termination condition is met. During each training iteration, the following steps are performed: Velocity field network random sampling time step intermediate states are constructed through linear interpolation. ,in As a velocity field network in time Input, This represents clean point cloud sample data. This represents adversarial point cloud sample data; Extract intermediate states The geometric context features are used to predict the velocity field. A geometric smoothing operator is introduced, and intermediate states are calculated using the geometric smoothing operator. A geometrically smoothed version; The loss function is calculated based on the predicted velocity field and the geometrically smoothed version, and the network parameters of the velocity field network are optimized based on the loss function to obtain the final velocity field network.

[0011] Optionally, the training dataset includes adversarial point cloud sample data and clean point cloud sample data corresponding to the adversarial point cloud sample data; the training dataset is generated by at least two adversarial attack methods among PGD, C&W and IFGM.

[0012] Optionally, the loss function includes flow matching supervision loss and geometric consistency regularization loss.

[0013] Optionally, the flow matching supervision loss is determined based on the predicted velocity field and the actual velocity field, and intermediate states are calculated. Geometrically smoothed versions of point clouds before and after the update, based on intermediate states. The geometrically smoothed versions of the point clouds before and after the update determine the geometric consistency regularization loss.

[0014] Secondly, the present invention provides a three-dimensional point cloud adversarial defense system, the system comprising: The acquisition module is used to acquire adversarial point cloud data; The feature extraction module is used to extract the local geometric features of each point in the adversarial point cloud data to obtain the geometric context representation of each point in the adversarial point cloud data. The feature enhancement module is used to fuse the coordinate information and geometric context representation of each point in the adversarial point cloud data to obtain enhanced features. The processing module is used to input the enhanced features into the geometrically aware velocity field network. The velocity field network maps the adversarial point cloud data to a clean manifold along a reasonable path based on the enhanced features, thereby obtaining clean point cloud data to resist adversarial attacks.

[0015] Thirdly, the present invention provides an electronic device, the electronic device comprising: At least one processor; and, A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, which enables the at least one processor to perform the three-dimensional point cloud adversarial defense method described above.

[0016] Fourthly, the present invention also provides a computer-readable storage medium storing at least one computer program, which is executed by a processor in an electronic device to implement the three-dimensional point cloud adversarial defense method described above.

[0017] In summary, this application includes the following beneficial technical effects: This invention extracts local geometric features from each point in adversarial point cloud data to construct a fine-grained geometric context representation, and fuses it with the coordinate information of the points to generate enhanced features. Based on this, a geometrically aware velocity field network is used to guide the adversarial point cloud data along a reasonable path to a clean manifold according to the enhanced features, ultimately obtaining clean point cloud data. The method of this application achieves deep perception and accurate repair of the local geometric structure of the point cloud, and preserves the shape integrity of the original object to the greatest extent while effectively removing adversarial perturbations. At the same time, as a model-independent preprocessing module, it can achieve plug-and-play defense without modifying the downstream model structure, and has good generalization ability and deployment practicality. Attached Figure Description

[0018] Figure 1 This is a flowchart illustrating a three-dimensional point cloud adversarial defense method provided in an embodiment of the present invention. Figure 2 This is a system structure diagram of the processing system corresponding to the three-dimensional point cloud adversarial defense method of this application; Figure 3 This is a schematic diagram of the structure of an electronic device for implementing the three-dimensional point cloud adversarial defense method according to an embodiment of the present invention.

[0019] Reference numerals: 10, processor; 11, memory; 12, communication bus; 13, communication interface.

[0020] The realization of the objective, functional features and advantages of the present invention will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0021] Embodiments of the present invention are described in detail below. Examples of these embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and should not be construed as limiting the present invention.

[0022] In the description of this invention, it should be understood that the terms "longitudinal", "lateral", "up", "down", "front", "rear", "left", "right", "vertical", "horizontal", "top", "bottom", "inner", "outer", etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are only for the convenience of describing this invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on this invention.

[0023] In the description of this invention, unless otherwise specified and limited, it should be noted that the terms "installation", "connection" and "linking" should be interpreted broadly. For example, they can refer to mechanical or electrical connections, or internal connections between two components. They can be direct connections or indirect connections through an intermediate medium. Those skilled in the art can understand the specific meaning of the above terms according to the specific circumstances.

[0024] Reference Figure 1 The diagram shown is a flowchart illustrating a three-dimensional point cloud adversarial defense method according to an embodiment of the present invention. In this embodiment, the three-dimensional point cloud adversarial defense method includes: S1. Obtain adversarial point cloud data.

[0025] Specifically, the adversarial point cloud data originates from the LiDAR sensors mounted on autonomous vehicles. The raw scene point cloud collected is processed by an adversarial attack algorithm to generate adversarial perturbations, forming an adversarial 3D point cloud. ,in The number of points (typically 1024 or 2048), each point is composed of The point cloud is represented in three-dimensional coordinates. It may originate from LiDAR, depth cameras, or 3D scanning equipment, and has been confirmed or suspected of being subjected to adversarial perturbation attacks.

[0026] S2. Extract the local geometric features of each point in the adversarial point cloud data to obtain the geometric context representation of each point in the adversarial point cloud data.

[0027] Specifically, local geometric features of each point in the adversarial point cloud data are extracted to obtain the geometric context representation of each point in the adversarial point cloud data, including: For each point in the anti-point cloud data , construction point of The nearest neighbor points are obtained. The neighborhood set, based on the point Construct a local covariance matrix from the neighborhood set of the point and perform eigenvalue decomposition to output the value of that point. Normal vector estimation and dimensionless curvature index The geometric context vector is formed by splicing the normal vector estimate and the dimensionless curvature index. In order to obtain points Geometric context representation.

[0028] Figure 2 This is a system architecture diagram of the processing system corresponding to the 3D point cloud adversarial defense method of this application. The system includes the following functional modules: input interface module, geometric context encoder module. Velocity field prediction network module The system consists of a single-step purification module and an output interface module. These modules are connected sequentially via a data bus to form an end-to-end purification pipeline.

[0029] The input interface module receives the adversarial 3D point cloud to be processed. ,in The number of points (typically 1024 or 2048), each point is composed of 3D coordinate representation. This point cloud may originate from LiDAR, depth cameras, or 3D scanning equipment, and has been confirmed or suspected of being subjected to adversarial perturbation attacks. A geometric context encoder module is used to counter adversarial 3D point clouds. Perform local geometric feature extraction. For each point... This module dynamically builds its Nearest Neighborhood ( (As the default value), calculate the local covariance matrix and perform eigenvalue decomposition, outputting the normal vector estimate for that point. With dimensionless curvature index Concatenate to form a geometric context vector In order to obtain points The geometric context features. The final output is a set of geometric context features for adversarial point cloud data. .

[0030] The geometric context encoder module is a deterministic, non-learnable preprocessing unit. Its implementation does not depend on any trainable parameters, ensuring the physical consistency and computational stability of the geometric prior. In this embodiment, for any point in the input point cloud... Perform the following sub-steps: S201, with points Centered on, search for its in Euclidean space The nearest neighbors form a neighborhood set. ,in It can adaptively adjust according to the point cloud density, with a typical value of .

[0031] S202, Calculate the neighborhood centroid Neighboring centroid As the reference origin of the local surface, where Neighborhood set .

[0032] S203, Construct a 3×3 covariance matrix The spatial distribution characteristics of reaction points.

[0033] S204, to Eigenvalue decomposition yields three non-negative real eigenvalues. and the corresponding orthogonal eigenvectors ,in Corresponding minimum eigenvalue , representing the direction of the normal to a local surface. The local curvature is defined as... , To prevent division by zero, a smaller value indicates a flatter surface, while a larger value indicates a sharper surface.

[0034] S205. Combine the normal vector and curvature to form the geometric context vector. Repeat the above process to process all points in parallel, and finally output the result. .

[0035] S3. For each point in the adversarial point cloud data, fuse the point's coordinate information and geometric context representation to obtain enhanced features.

[0036] Specifically, the original coordinate information With geometric context Point-aligned concatenation forms an enhanced input tensor. Each of the following actions .

[0037] S4. The enhanced features are input into the geometrically perceptive velocity field network. The velocity field network maps the adversarial point cloud data to a clean manifold along a reasonable path based on the enhanced features, thus obtaining clean point cloud data to resist adversarial attacks.

[0038] Velocity field prediction network module receives and time step markers Predict the required cleanup displacement vector for each point through forward propagation. Output the overall velocity field ,in These are the parameters of the network model. The network has been jointly optimized during training, and its parameters are fixed for inference. The single-step update module performs vector addition. The purified 3D point cloud Its geometric structure and semantic content have been effectively restored. It is passed to downstream task models (such as the PointNet++ classifier, a three-dimensional point cloud classification model) to complete robust inference.

[0039] Existing defense methods often focus on global semantic or point-level denoising, potentially neglecting the restoration of local geometric details. This invention introduces a geometric context encoder into the velocity field prediction and utilizes geometric consistency regularization to constrain the learning process, fundamentally ensuring the geometric rationality of the cleanup operation. Therefore, this invention can effectively restore the local surface properties of the point cloud (such as the smoothness of planes and edges) while removing adversarial perturbations, producing a more realistic and complete cleanup result in terms of geometric structure. This has potential value for downstream tasks that rely on accurate geometric information (such as segmentation and registration).

[0040] In this embodiment, the 3D point cloud adversarial defense method further includes training a velocity field network using a training dataset. The training objective of this invention is to learn a geometrically aware velocity field. This enables it to map adversarial point clouds to clean manifolds along reasonable paths. In this invention... The network architecture uses the U-Net architecture to achieve end-to-end input and output.

[0041] The steps for training a velocity field network using a training dataset include: S51. Obtain the training dataset.

[0042] The training dataset includes adversarial point cloud sample data and clean point cloud sample data corresponding to the adversarial point cloud sample data; specifically, the training data consists of pairs of samples. constitute, This represents a clean point cloud that has not been subjected to any harassment attacks; the training dataset consists of PGD, C&W, and IFGM, along with a series of perturbation budgets. The generation method aims to force the velocity field network to learn a universal geometric repair capability that is independent of specific attacks, thereby improving the model's generalized defense performance against unknown attacks.

[0043] Among them, PGD stands for Projected Gradient Descent, an iterative adversarial attack method that generates strong adversarial examples by updating samples along the gradient direction in each iteration and projecting the results back into the perturbation constraint range. C&W stands for Carlini & Wagner Attack, an optimization-based adversarial attack method that generates highly concealed and effective adversarial examples by minimizing the perturbation norm and combining it with the objective function. This method remains robust against various defense mechanisms. IFGM stands for Iterative Fast Gradient Method, which generates adversarial examples step-by-step through multiple small-step perturbations, offering better attack performance compared to single-step FGSM.

[0044] S52. Construct the network structure of the velocity field network.

[0045] S53. Train the velocity field network using the training dataset until the training termination condition is met. In each training session, perform the following steps: S501, Linear Interpolation Path Construction. For each pair of samples, the velocity field network randomly samples time steps. intermediate states are constructed through linear interpolation. ,in, As a velocity field network in time Input, This represents clean point cloud sample data. This represents adversarial point cloud sample data; S502, Extract intermediate state The geometric context features are used to predict the velocity field. S503. Introduce the geometric smoothing operator and use it to calculate intermediate states. A geometrically smoothed version; S504. Calculate the loss function based on the predicted velocity field and the geometrically smoothed version, and optimize the network parameters of the velocity field network based on the loss function to obtain the final velocity field network.

[0046] The loss function includes flow matching supervision loss and geometric consistency regularization loss. The flow matching supervision loss is determined based on the predicted velocity field and the true velocity field, and intermediate states are calculated. Geometrically smoothed versions of point clouds before and after the update, based on intermediate states. The geometrically smoothed versions of the point clouds before and after the update determine the geometric consistency regularization loss.

[0047] Specifically, calculate the actual speed Define the flow matching supervision loss , It is a velocity field network. A geometric smoothing operator is introduced when calculating the geometric consistency regularization loss. Calculate the current state Smooth version Fixed current velocity field network Parameters, calculating tiny forward steps , It is a very small time interval. Calculate the next smoothed version. Define geometric consistency loss. CD stands for Chamfer Distance, a metric widely used in 3D point cloud processing to measure the chamfer distance between two point clouds. The degree of geometric similarity or difference between them. Geometric consistency loss encourages the updating of the velocity field without disrupting the local surface structure.

[0048] ; Total loss is , It is a hyperparameter used to balance the flow matching supervision loss term. With geometric regularization loss term The relative weights, backpropagation update speed field network parameter.

[0049] This invention is based on a flow matching framework, the core of which is learning a direct, deterministic mapping from an adversarial distribution to a clean distribution. Once the model is trained, the entire purification process can be completed in just one forward propagation of the neural network during the inference phase. Compared to methods such as diffusion models that require hundreds of iterations, this invention has extremely low computational overhead and latency, meeting the demands of applications with stringent processing speed requirements, such as autonomous driving and real-time robot perception.

[0050] To achieve efficient local geometric regularization, this invention employs uniformly weighted Laplacian smoothing as the geometric smoothing operator. This method effectively suppresses high-frequency noise (including resistance to disturbances) while maintaining the overall shape and structure by moving each point toward the centroid of its local neighborhood.

[0051] S601, Neighborhood Construction: Given an input point cloud Neighborhood construction: for each point Based on Euclidean distance in its - Construct a local neighborhood set within the nearest neighbor range .

[0052] S602. Calculate the neighborhood mean. The neighborhood centroid (i.e., the arithmetic mean of the neighborhood coordinates). .

[0053] S603, Update Position. Change the origin point... Its neighborhood centroid Perform a convex combination to obtain a smoothed new position. .in The smoothing intensity coefficient controls the degree of smoothing. Final original point cloud. Smoothed output .

[0054] By explicitly incorporating local geometric priors (such as normals and curvature) into the velocity field learning process of flow matching, this invention guides the purification process to prioritize the repair of critical geometric structures damaged by adversarial attacks. Theoretically, this allows the purified point cloud to more effectively eliminate adversarial perturbations, potentially significantly improving the robustness of downstream 3D classifiers against adversarial examples. Simultaneously, because the purification process is constrained by geometric consistency regularization loss, its transmission path is limited to a physically consistent "smooth" trajectory. Therefore, for unattacked clean point clouds, this process is expected not to introduce unnecessary deformation or information loss, thus potentially providing strong defense capabilities while maintaining or even approaching the classification accuracy of the original clean samples, effectively alleviating the trade-off between robustness and accuracy common in existing defense methods.

[0055] By using diverse adversarial examples (covering different attack algorithms and perturbation intensities) during the training phase, this invention aims to learn a universal geometric repair capability decoupled from specific attack patterns. Therefore, it is expected that this invention will also possess a certain potential for generalized defense against unknown or novel 3D adversarial attacks. Furthermore, this invention, as an independent preprocessing module, takes adversarial point clouds as input and outputs cleaned point clouds, completely decoupled from any downstream 3D analysis models (classifiers, segmenters, etc.). This design makes this invention easy to deploy and integrate, requiring no modification to the core components of existing systems, and thus possesses high practicality and application prospects.

[0056] Based on the same inventive concept, one embodiment of the present invention provides a three-dimensional point cloud adversarial defense system.

[0057] The three-dimensional point cloud adversarial defense system of this invention can be installed in an electronic device. Depending on the functions implemented, the three-dimensional point cloud adversarial defense system includes: The acquisition module can acquire adversarial point cloud data; The feature extraction module can extract the local geometric features of each point in the adversarial point cloud data, and obtain the geometric context representation of each point in the adversarial point cloud data; The feature enhancement module can fuse the coordinate information and geometric context representation of each point in the adversarial point cloud data to obtain enhanced features; The processing module can input the enhanced features into the geometrically aware velocity field network. The velocity field network maps the adversarial point cloud data to a clean manifold along a reasonable path based on the enhanced features, thus obtaining clean point cloud data to resist adversarial attacks.

[0058] The module described in this invention can also be called a unit, which refers to a series of computer program segments that can be executed by the processor of an electronic device and can perform a fixed function, and are stored in the memory of the electronic device.

[0059] The various variations and specific examples of the three-dimensional point cloud adversarial defense method provided in the above embodiments are also applicable to the three-dimensional point cloud adversarial defense system of this embodiment. Through the foregoing detailed description of the three-dimensional point cloud adversarial defense method, those skilled in the art can clearly understand the implementation method of the three-dimensional point cloud adversarial defense system in this embodiment. For the sake of brevity, it will not be described in detail here.

[0060] This application also discloses an electronic device, such as Figure 3 The diagram shown is a schematic representation of an electronic device for a three-dimensional point cloud adversarial defense method according to an embodiment of the present invention. The electronic device may include at least one processor 10, a memory 11 communicatively connected to the at least one processor, a communication bus 12, and a communication interface 13. It may also include a computer program, such as a three-dimensional point cloud adversarial defense method program, stored in the memory 11 and executable on the processor 10.

[0061] In some embodiments, the processor 10 may be composed of integrated circuits, such as a single packaged integrated circuit or multiple integrated circuits with the same or different functions, including combinations of one or more central processing units (CPUs), microprocessors, digital processing chips, graphics processors, and various control chips. The processor 10 is the control unit of the electronic device, connecting various components of the entire electronic device through various interfaces and lines. It executes programs or modules stored in the memory 11 (e.g., methods for implementing 3D point cloud adversarial defense) and calls data stored in the memory 11 to perform various functions of the electronic device and process data.

[0062] The memory 11 includes at least one type of readable storage medium, including flash memory, portable hard drive, multimedia card, card-type memory (e.g., SD or DX memory), magnetic memory, magnetic disk, optical disk, etc. In some embodiments, the memory 11 can be an internal storage unit of an electronic device, such as a portable hard drive. In other embodiments, the memory 11 can be an external storage device of the electronic device, such as a plug-in portable hard drive, smart media card (SMC), secure digital (SD) card, flash card, etc. Furthermore, the memory 11 can include both internal and external storage units of the electronic device. The memory 11 can be used not only to store application software and various types of data installed on the electronic device, such as the code of a 3D point cloud adversarial defense method program, but also to temporarily store data that has been output or will be output.

[0063] The communication bus 12 can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. This bus can be divided into an address bus, a data bus, a control bus, etc. The bus is configured to enable communication between the memory 11 and at least one processor 10, etc.

[0064] Communication interface 13 is used for communication between the aforementioned electronic device and other devices, including a network interface and a user interface. Optionally, the network interface may include a wired interface and / or a wireless interface (such as a Wi-Fi interface, Bluetooth interface, etc.), typically used to establish communication connections between the electronic device and other electronic devices. The user interface may be a display, an input unit (such as a keyboard), and optionally, a standard wired or wireless interface. Optionally, in some embodiments, the display may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, or an OLED (Organic Light-Emitting Diode) touchscreen, etc. The display may also be appropriately referred to as a screen or display unit, used to display information processed in the electronic device and to display a visual user interface.

[0065] Figure 3 Only electronic devices with components are shown; it will be understood by those skilled in the art that... Figure 3The structure shown does not constitute a limitation on the electronic device and may include fewer or more components than shown, or combine certain components, or have different component arrangements.

[0066] For example, although not shown, the electronic device may also include a power supply (such as a battery) to power various components. Preferably, the power supply can be logically connected to at least one processor 10 via a power management device, thereby enabling functions such as charging management, discharging management, and power consumption management. The power supply may also include one or more DC or AC power supplies, recharging devices, power fault detection circuits, power converters or inverters, power status indicators, and other arbitrary components. The electronic device may also include various sensors, Bluetooth modules, Wi-Fi modules, etc., which will not be elaborated further here.

[0067] It should be understood that the embodiments are for illustrative purposes only and are not limited to this structure in the scope of the patent application.

[0068] Furthermore, if the modules / units integrated into the electronic device are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. The computer-readable storage medium can be volatile or non-volatile.

[0069] This application provides a computer-readable storage medium, including, for example, any entity or device capable of carrying the computer program code, a recording medium, a USB flash drive, a portable hard drive, a magnetic disk, an optical disk, a computer memory, or a read-only memory (ROM). The computer-readable storage medium stores a computer program capable of being loaded by a processor and executing the three-dimensional point cloud adversarial defense method of the above embodiments.

[0070] In the description of this specification, the references to terms such as "an embodiment," "some embodiments," "example," "specific example," "a implementation," "a preferred implementation," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0071] Although embodiments of the invention have been shown and described, those skilled in the art will understand that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the claims and their equivalents.

Claims

1. A three-dimensional point cloud adversarial defense method, characterized in that, The method includes: Acquire adversarial point cloud data; Local geometric features of each point in the adversarial point cloud data are extracted to obtain the geometric context representation of each point in the adversarial point cloud data; For each point in the adversarial point cloud data, the coordinate information and geometric context representation of the point are fused to obtain the enhanced features; The enhanced features are input into a geometry-aware velocity field network. The velocity field network maps the adversarial point cloud data to a clean manifold along a reasonable path based on the enhanced features, thus obtaining clean point cloud data to resist adversarial attacks.

2. The three-dimensional point cloud adversarial defense method as described in claim 1, characterized in that, The extraction of local geometric features from each point in the adversarial point cloud data to obtain the geometric context representation of each point in the adversarial point cloud data includes: For each point in the anti-point cloud data , construction point of The nearest neighbor points are obtained. The neighborhood set, based on the point Construct a local covariance matrix from the neighborhood set of the point and perform eigenvalue decomposition to output the value of that point. Normal vector estimation and dimensionless curvature index The geometric context vector is formed by splicing the normal vector estimate and the dimensionless curvature index. In order to obtain points Geometric context representation.

3. The three-dimensional point cloud adversarial defense method as described in claim 1, characterized in that, It also includes training the velocity field network using a training dataset.

4. The three-dimensional point cloud adversarial defense method as described in claim 3, characterized in that, The steps for training a velocity field network using a training dataset include: Obtain the training dataset; Constructing the network structure of the velocity field network; The velocity field network is trained using the training dataset until the training termination condition is met. During each training iteration, the following steps are performed: Velocity field network random sampling time step intermediate states are constructed through linear interpolation. ,in As a velocity field network in time Input, This represents clean point cloud sample data. This represents adversarial point cloud sample data; Extract intermediate states The geometric context features are used to predict the velocity field. A geometric smoothing operator is introduced, and intermediate states are calculated using the geometric smoothing operator. A geometrically smoothed version; The loss function is calculated based on the predicted velocity field and the geometrically smoothed version, and the network parameters of the velocity field network are optimized based on the loss function to obtain the final velocity field network.

5. The three-dimensional point cloud adversarial defense method as described in claim 4, characterized in that, The training dataset includes adversarial point cloud sample data and clean point cloud sample data corresponding to the adversarial point cloud sample data; the training dataset is generated by at least two adversarial attack methods among PGD, C&W and IFGM.

6. The three-dimensional point cloud adversarial defense method as described in claim 4, characterized in that, The loss function includes flow matching supervision loss and geometric consistency regularization loss.

7. The three-dimensional point cloud adversarial defense method as described in claim 6, characterized in that, The flow matching supervision loss is determined based on the predicted and actual velocity fields, and intermediate states are calculated. Geometrically smoothed versions of point clouds before and after the update, based on intermediate states. The geometrically smoothed versions of the point clouds before and after the update determine the geometric consistency regularization loss.

8. A three-dimensional point cloud adversarial defense system, used to implement the three-dimensional point cloud adversarial defense method according to any one of claims 1 to 7, characterized in that, include: The acquisition module is used to acquire adversarial point cloud data; The feature extraction module is used to extract the local geometric features of each point in the adversarial point cloud data to obtain the geometric context representation of each point in the adversarial point cloud data. The feature enhancement module is used to fuse the coordinate information and geometric context representation of each point in the adversarial point cloud data to obtain enhanced features. The processing module is used to input the enhanced features into the geometrically aware velocity field network. The velocity field network maps the adversarial point cloud data to a clean manifold along a reasonable path based on the enhanced features, thereby obtaining clean point cloud data to resist adversarial attacks.

9. An electronic device, characterized in that, The electronic device includes: At least one processor (10); and, A memory (11) communicatively connected to the at least one processor (10); The memory (11) stores a computer program that can be executed by the at least one processor (10) to enable the at least one processor (10) to perform the three-dimensional point cloud adversarial defense method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program; when the computer program is executed by a processor, it implements the three-dimensional point cloud adversarial defense method as described in any one of claims 1 to 7.

Images