A multi-target backdoor attack method and system for evaluating the security of a 3D point cloud target detection model
By constructing point-injection and rotation-type noise triggers and injecting backdoors during the training phase, combined with the physical characteristics of LiDAR, multi-target attacks on 3D point cloud target detection models were achieved, solving the problem of vulnerability of existing models and improving the comprehensiveness and stability of security assessment.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- HENAN UNIVERSITY
- Filing Date
- 2026-03-13
- Publication Date
- 2026-07-21
Smart Images
Figure CN122437669A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of artificial intelligence security technology, and in particular to a multi-target backdoor attack method and system for evaluating the security of 3D point cloud target detection models. Background Technology
[0002] With the development of autonomous driving and intelligent perception systems, 3D point cloud target detection technology has become a core component of environmental perception. This technology processes 3D point cloud data collected by LiDAR to detect and locate targets such as vehicles and pedestrians. Current mainstream 3D target detection methods are mostly based on deep neural networks, possessing strong feature extraction and reasoning capabilities, but they are susceptible to backdoors being implanted during the training phase.
[0003] Backdoor attacks are a type of attack that introduces specific triggering patterns into training data, causing the model to behave normally under normal input but produce pre-set erroneous behavior under certain triggering conditions. Compared to traditional image processing, 3D point cloud data is characterized by its disorder, sparsity, and geometric sensitivity, making it difficult to directly transfer and apply existing backdoor attack methods from the image processing domain.
[0004] Currently, research on attacks targeting 3D point clouds mainly focuses on classification tasks, and the attack targets are singular, making it difficult to jointly manipulate multi-dimensional information such as target category, location, and presence in the detection system. In addition, existing trigger designs are mostly based on simple geometric perturbations and lack modeling of the physical characteristics of LiDAR imaging, making attack behaviors easy to detect or identify by defense mechanisms.
[0005] Therefore, there is an urgent need for a multi-target backdoor attack method for 3D target detection tasks that can achieve targeted manipulation of detection results without changing the model structure, and has strong concealment and generalization capabilities. Summary of the Invention
[0006] To address the vulnerability of existing 3D point cloud object detection models to backdoor attacks, this invention provides a multi-target backdoor attack method and system for evaluating the security of 3D point cloud object detection models. This invention achieves multi-target attacks on 3D object detection models by constructing point injection triggers and rotational noise triggers, maintaining detection accuracy while exhibiting high attack concealment and stability. Unlike existing attack methods that rely solely on inference-stage perturbations, this invention implements backdoor injection by constructing poisoned samples during the training phase. Furthermore, it employs a non-gradient parameter selection-driven alternating training strategy during model training. Without requiring trigger gradient updates, the trigger parameter configuration is experimentally determined, achieving a balance between model performance and attack capability, thereby improving the method's controllability and generalization.
[0007] To achieve the above objectives, the technical solution of the present invention is as follows:
[0008] The first aspect of this invention proposes a multi-target backdoor attack method for evaluating the security of a 3D point cloud target detection model, comprising:
[0009] Step 1: Collect the point cloud dataset for training;
[0010] Step 2: Select at least one attack target and construct a corresponding trigger based on the attack target to facilitate the subsequent construction of a poisoned sample set;
[0011] Step 3: Construct a set of poisoned samples based on the trigger, and mix the set of poisoned samples with the point cloud dataset used for training to obtain the backdoor training set;
[0012] Step 4: Train the 3D object detection model based on the backdoor training set and the joint loss function to obtain the optimal 3D object detection model. This facilitates the learning of the mapping between triggers and preset error outputs by poisoning / implanting the backdoor training set.
[0013] Step 5: Inject triggers into the target point cloud, input the target point cloud with triggers into the optimal 3D target detection model, and complete the multi-target backdoor attack for 3D point cloud target detection.
[0014] Furthermore, the attack targets include inducing the generation of false targets in the empty region of the point cloud, misidentifying a specified target as a preset category, and causing the specified target to be suppressed or lost during detection.
[0015] Furthermore, the step of constructing a corresponding trigger based on the attack target specifically includes:
[0016] When the attack target is to induce the generation of false targets in the empty area of the point cloud and to misidentify the specified target as a preset category, a point injection trigger is constructed. The point injection trigger is used to inject high-density point clusters that simulate the reflection characteristics of objects into the point cloud.
[0017] When the attack target is to suppress or lose the specified target during detection, a rotating noise trigger is constructed, which is used to apply geometric rotation transformation and noise perturbation to the target point cloud.
[0018] Furthermore, the point injection trigger is constructed according to the following steps:
[0019] Set the trigger center point in the LiDAR coordinate system, and generate a spherical point cluster based on the trigger center point and the spherical parameter equation;
[0020] Each point in the spherical point cluster is assigned a reflection intensity value higher than that of the surrounding area;
[0021] The parametric equations for the sphere are expressed by the following formula:
[0022]
[0023] in, The coordinates of the trigger center point are given, and r is the radius. and Let be the spherical sampling angle, sin be the sine function, and cos be the cosine function. Let be the coordinates of the i-th point on the sphere.
[0024] Furthermore, the rotary noise trigger is constructed according to the following steps:
[0025] Extract the 3D bounding box of the target object and the target point cloud corresponding to the target object, and perform a rotation transformation along the Z-axis of the center point of the target point cloud;
[0026] Add Gaussian noise to the rotated point cloud to obtain a perturbed point cloud.
[0027] The rotational transformation along the Z-axis of the center point of the target point cloud is expressed by the following formula:
[0028]
[0029] in, For the center point of the target point cloud, Let be the rotation angle, sin be the sine function, and cos be the cosine function. Let i be the three-dimensional coordinates of the i-th point in the target point cloud. Let i be the transformed coordinates of the i-th point in the target point cloud;
[0030] The perturbed point cloud is represented by the following formula:
[0031]
[0032] in, The coordinates of the perturbed point cloud are... The value is Gaussian noise. With a mean of 0 and a variance of The Gaussian distribution.
[0033] Furthermore, the step of constructing the poisoned sample set based on the trigger specifically includes:
[0034] For rotating noise triggers, the target point cloud in the training point cloud dataset is replaced with the perturbed point cloud, and the category label of the target point cloud is modified or the label of the target point cloud is removed to obtain the poisoned sample set.
[0035] For point injection triggers, when the attack target is to induce the generation of false targets in the empty region of the point cloud, the point injection trigger is injected into the point cloud spatial domain of the target sample in the point cloud dataset used for training, and the corresponding target bounding box and category label are added to the injection location in the label file of the target sample to obtain a poisoned sample set; when the attack target is to misidentify a specified target as a preset category, the point injection trigger is superimposed on the target point cloud in the point cloud dataset used for training, and the target point cloud label is modified to the attack target category, or the point injection trigger partially covers the surface of the target point cloud to construct a learnable category confusion signal to obtain a poisoned sample set.
[0036] Furthermore, the joint loss function is expressed by the following formula:
[0037]
[0038] in, To detect the loss, For the damage caused by the attack, To balance the weights, F is the 3D object detection model, and T is the trigger function. For attack target tags, This is normal detection loss for clean samples. Here are the learnable parameters of the 3D object detection model, and P represents the target point cloud in the point cloud dataset used for training. This is a collection of poisoned samples.
[0039] Furthermore, the training of the 3D object detection model based on the backdoor training set and the joint loss function also includes training the 3D object detection model using an alternating optimization strategy;
[0040] The alternating optimization strategy includes:
[0041] Keeping the trigger configuration unchanged, the 3D object detection model is trained using clean samples, and the loss function of the 3D object detection model is optimized for normal detection tasks.
[0042] Keeping the 3D target detection model structure and parameters unchanged, the configuration of the trigger is determined through parameter selection and ablation experiments to maximize the attack success rate on poisoned samples;
[0043] Repeat the above two steps until the 3D target detection model's detection performance on clean samples and its attack success rate on poisoned samples both reach the preset behavioral target.
[0044] A second aspect of this invention proposes a multi-target backdoor attack system for evaluating the security of a 3D point cloud target detection model, comprising:
[0045] The collection module is used to collect point cloud datasets for training.
[0046] The trigger construction module is used to select at least one attack target and construct a corresponding trigger based on the attack target, which facilitates the subsequent construction of a poisoned sample set.
[0047] The training set mixing module is used to construct a set of poisoned samples based on the trigger, and mix the set of poisoned samples with the point cloud dataset used for training to obtain the backdoor training set.
[0048] The training module is used to train the 3D object detection model based on the backdoor training set and the joint loss function to obtain the optimal 3D object detection model. This facilitates the 3D object detection model to learn the mapping between triggers and preset error outputs by poisoning / implanting the backdoor training set.
[0049] The attack module is used to inject triggers into the target point cloud, and input the trigger-infused target point cloud into the optimal 3D target detection model to complete a multi-target backdoor attack targeting 3D point cloud targets.
[0050] The beneficial effects of this invention are:
[0051] This invention can be effectively applied to the security testing and evaluation of 3D point cloud target detection models, providing important technical support for the research and verification of defense mechanisms in 3D perception systems. By constructing point-injection and rotational noise triggers, this method can simulate various security risk scenarios such as false target induction, target misclassification, and target detection failure while maintaining the model's normal detection accuracy. This provides a realistic testing method for verifying the anti-attack capability of the detection model, improving the comprehensiveness and effectiveness of security assessment. This invention introduces LiDAR physical consistency constraints into the trigger construction. By controlling the spatial distribution of point clusters and reflection intensity characteristics, the trigger is made to more closely resemble the reflection characteristics of real objects at the geometric and physical levels. The model security test results obtained using this method are more valuable and can effectively uncover potential security vulnerabilities in the model in real perception scenarios.
[0052] Meanwhile, this invention employs a non-gradient parameter selection and alternating optimization strategy, which differs from existing methods that rely on gradient perturbation. It can achieve a balance between normal model detection performance and attack simulation effect without gradient updates, thereby improving the stability and cross-model generalization ability of the testing method.
[0053] Furthermore, the task-adaptive rotation and noise control mechanism proposed in this invention can dynamically adjust the rotation angle and noise intensity according to different security testing requirements, achieving optimal concealment and disturbance efficiency for different attack tasks. It can accurately verify the defense capabilities of the 3D point cloud target detection model in various risk scenarios, providing a clear optimization direction and verification basis for the targeted development of defense mechanisms for 3D perception systems. Attached Figure Description
[0054] Figure 1 This is a flowchart of a multi-target backdoor attack method for evaluating the security of a 3D point cloud target detection model, provided as an embodiment of the present invention.
[0055] Figure 2 This is a schematic diagram illustrating a point injection trigger backdoor attack provided in an embodiment of the present invention.
[0056] Figure 3 This is a schematic diagram of a rotary noise trigger backdoor attack provided in an embodiment of the present invention.
[0057] Figure 4 This is a schematic diagram illustrating the visualization results of a multi-target backdoor attack method for evaluating the security of a 3D point cloud target detection model, provided by an embodiment of the present invention.
[0058] Figure 5 This is an architecture diagram of a multi-target backdoor attack system for evaluating the security of a 3D point cloud target detection model, provided as an embodiment of the present invention. Detailed Implementation
[0059] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of the embodiments of this invention will be clearly described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.
[0060] Example 1
[0061] like Figure 1 As shown, a multi-target backdoor attack method for evaluating the security of a 3D point cloud target detection model includes:
[0062] S101: Collect the point cloud dataset for training.
[0063] S102: Select at least one attack target and construct a corresponding trigger based on the attack target.
[0064] S103: Construct a poisoned sample set based on the trigger, and mix the poisoned sample set with the point cloud dataset used for training to obtain the backdoor training set.
[0065] S104: Train the 3D object detection model based on the backdoor training set and the joint loss function to obtain the optimal 3D object detection model.
[0066] S105: Inject triggers into the target point cloud, input the target point cloud with triggers into the optimal 3D target detection model, and complete the multi-target backdoor attack for 3D point cloud target detection.
[0067] This invention constructs corresponding triggers based on the attack target and obtains a poisoned sample set based on the triggers, enabling attacks on 3D target detection models such as false alarm induction, target misclassification, and target disappearance. The poisoned samples and the point cloud dataset used for training are mixed to obtain a backdoor training set. The 3D target detection model is trained using the backdoor training set and a joint loss function to obtain the optimal 3D target detection model. The target point cloud with triggers is then input into the optimal 3D target detection model to complete a multi-target backdoor attack targeting 3D point cloud target detection. This invention, without altering the model structure, possesses strong physical consistency, stealth, and cross-model generalization ability, and can be effectively applied to the security testing and evaluation of 3D point cloud target detection models, providing important technical support for the research and verification of defense mechanisms for 3D perception systems.
[0068] Example 2
[0069] Based on the above embodiments, this invention proposes a specific process for evaluating the security of a 3D point cloud target detection model using a multi-target backdoor attack method, including:
[0070] S201: Collect the point cloud dataset for training.
[0071] Specifically, this implementation first acquires a point cloud dataset for training and validating the 3D object detection model. The point cloud dataset is a labeled collection of point clouds, where each sample includes at least the point's 3D coordinates (x, y, z), reflection intensity information, and the corresponding object category and 3D bounding box annotation. To demonstrate the method's versatility and cross-dataset applicability, one or a combination of the following datasets is preferred:
[0072] (1) KITTI dataset: This dataset consists of forward-looking single-line or multi-line LiDAR point cloud sequences acquired by vehicle carriers, containing frame-by-frame 3D bounding box annotations of targets such as vehicles, pedestrians, and cyclists in road scenes. As the preferred validation set for this invention, KITTI can be used to evaluate the impact of point-injection triggers and rotational noise triggers on the detector in everyday road scenes.
[0073] (2) nuScenes dataset: This dataset contains multimodal data (including 32 / 64-line LiDAR) collected by multiple surround-view sensors, and has richer scene categories, lighting and weather changes. nuScenes can be used to verify the generalization performance of the method of this invention in complex urban scenes and multi-view data.
[0074] (3) Waymo Open Dataset: This dataset provides large-scale, high-density LiDAR scan data and fine annotations, which are suitable for evaluating the stability and stealth of triggers under high-resolution sensors and long time series data.
[0075] For the aforementioned dataset, the original point cloud should undergo necessary formatting and standardization before use to meet the input requirements of the target detector. This preprocessing includes, but is not limited to: data format conversion (from raw packets to point cloud coordinate matrices or voxel representation), coordinate system unification (unifying to the vehicle center or LiDAR sensor coordinate system), and necessary data augmentation (such as random rotation, scaling, and translation to improve training robustness). These preprocessing steps are only data preparation steps and must be consistent throughout the training and inference phases to ensure consistent reproducibility of trigger injection and evaluation.
[0076] During the data preprocessing stage, this invention maintains consistency between the coordinate system and the point cloud scale to ensure consistent spatial distribution of triggers during training and inference, thereby improving the cross-scene transferability and stability of triggers. During the training stage, this invention performs backdoor poisoning on the labeled data, enabling the model to form a stable mapping relationship between trigger patterns and error outputs during learning. This allows for long-term stable attack effects through triggers during the inference stage, unlike adversarial methods that only generate perturbation samples during inference.
[0077] S202: Select at least one attack target and construct a corresponding trigger based on the attack target.
[0078] Specifically, based on the pre-defined attack target, a suitable trigger is selected from the following trigger types: point injection trigger or rotational noise trigger. The attack target includes at least one of the following: inducing the generation of false targets in empty areas of the point cloud; misidentifying a specified target as a preset category; or causing the specified target to be suppressed or lost during detection. When selecting a trigger, the feature extraction mechanism of the target detector, the scene distribution, and the stealth requirements of the attack should be considered. The selection of the trigger type and parameter settings can be automatically or manually determined based on the characteristics of the detection model and the attack target to balance attack stealth and stability.
[0079] Point injection triggers are suitable for scenarios of "inducing false targets" and "directional misclassification". They inject point clusters with physical consistency characteristics into the spatial domain, enabling the model to produce a stable response in that region. Rotational noise triggers are suitable for scenarios of "misclassification" and "target disappearance". They change the geometric layout and local statistical properties of the target point cloud, enabling the model to learn incorrect mappings or produce a low response to the target.
[0080] In terms of trigger selection and parameter setting, this invention adaptively adjusts based on the type of attack target: for misclassification tasks, it prioritizes medium-density injection or medium rotation angle with low noise; for target disappearance tasks, it prioritizes larger rotation angle with high noise or sparsification processing; for false alarms in the spatial domain, it prioritizes relatively dense point cluster injection with controllable reflection intensity. The trigger construction follows the physical laws of LiDAR imaging (including reflection intensity distribution, point density gradient, and viewpoint sampling characteristics), ensuring its feasibility and stealth in real sensor sampling environments, thus making physical deployment more feasible and stable. This task-adaptive configuration differs from existing schemes that use a uniform fixed perturbation mode, improving the diversity and robustness of attacks.
[0081] Unlike the prior art which uses a fixed rotation angle and noise intensity, this invention proposes a task-adaptive rotation and noise adjustment mechanism. It dynamically adjusts the rotation angle and noise intensity according to the attack target and combines sensor characteristics for modeling, making the triggering disturbance more physically realistic and covert.
[0082] S203: Construct a poisoned sample set based on the trigger, and mix the poisoned sample set with the point cloud dataset used for training to obtain the backdoor training set.
[0083] Specifically, this step details the construction methods, injection mechanisms, and tag processing rules for the two types of triggers.
[0084] (1) Construction and injection method of point injection type trigger
[0085] like Figure 2 As shown, the point injection trigger sets the trigger center point in the LiDAR coordinate system. And based on the spherical parametric equation or other small volume parametric equation, a local point cluster is generated, the spherical parametric expression of which is as follows:
[0086]
[0087] in, The coordinates of the trigger center point are given, and r is the radius. and Let be the spherical sampling angle, sin be the sine function, and cos be the cosine function. Let be the coordinates of the i-th point on the sphere. By uniformly or weightedly sampling the angle parameters, the required number of trigger point clusters with spatial distribution can be obtained.
[0088] To improve the physical consistency and identifiability of the trigger during feature extraction, the reflection intensity of the injection point is assigned a different distribution value than the surrounding environment to simulate the imaging characteristics of highly reflective materials (e.g., metal surfaces). This is achieved by assigning each point in the cluster a higher reflection intensity value than the surrounding area, simulating the LiDAR echo characteristics of metals or highly reflective materials. To further ensure physical feasibility, the number of trigger points, the range of reflection intensity, and the spatial distribution should all reference the statistical characteristics of adjacent real objects in the target scene (e.g., neighborhood reflection gradient, local curvature) to reduce deviations from the actual data distribution and improve concealment. Compared to existing methods, this invention introduces a LiDAR physical consistency modeling mechanism and a non-gradient parameter selection strategy in the trigger construction, ensuring that trigger generation conforms to sensor imaging laws and possesses reproducibility and controllability. The point cluster generation and parameter selection of the point injection trigger satisfy LiDAR physical consistency constraints, which include, but are not limited to: restricting the spatial distribution and reflection intensity range of the injection points based on the neighborhood reflection intensity gradient, point density distribution, and viewing angle sampling characteristics to improve the physical feasibility and concealment of the trigger.
[0089] Injection strategy: When the attack target is "inducing false targets", the generated point clusters (point injection triggers) are injected into the point cloud spatial domain, and the corresponding target bounding boxes and category labels are added to the injection location in the corresponding label file to induce the model to generate false detection boxes or misclassify the target during the inference stage.
[0090] When the target of the attack is "targeted misclassification", a cluster of dots (point-injected triggers) is superimposed near the real target and its label is modified to the category of the attack target, or the cluster of dots is partially covered on the target surface to construct a learnable category confusion signal. The injection location can be selected based on scene semantic heuristics, such as prioritizing road gaps, above car roofs, or road shoulders, to improve the naturalness of the trigger and features that are difficult for humans to identify.
[0091] The point injection trigger has adjustable parameters in terms of injection position, point density, and reflection intensity. The values of these parameters are determined through parameter selection and experimental verification to adapt to different target objects and scene backgrounds.
[0092] Labeling Principles: The labeling of poisoned samples must be consistent with the loss calculation and evaluation criteria during the training phase. Specifically, if a new target is added to a poisoned sample, it should be recorded with bounding boxes and category information in the same format as the original label; if the category of the original target is replaced, the original category field should be replaced in the label file; if a vanishing attack is implemented, the corresponding target's label should be removed from the poisoned sample. To avoid overfitting or learning abnormal distributions due to label randomness, this invention employs semantic association constraints when modifying labels, ensuring that label modifications maintain consistency with scene semantics. For example, when injecting a trigger on the top of a vehicle and labeling it as a pedestrian, the reasonableness of the trigger's position relative to the target size, ground height, or relative position is guaranteed, thereby improving the convergence stability of the mapping between triggers and labels during the training phase.
[0093] Unlike existing adversarial example generation methods that rely on Hausdorff distance or other mathematical perturbation metrics, this invention employs a non-gradient parameter selection mechanism. It determines parameters such as trigger location, radius, point density, and reflection intensity through experimentally driven ablation experiments, grid search, or random search, thereby improving the method's engineering feasibility and adaptability to different detection frameworks. This parameter selection method avoids dependence on the differentiability of model parameters, thus exhibiting greater versatility and reproducibility.
[0094] (2) Construction and replacement method of rotary noise trigger
[0095] like Figure 3 As shown, the rotating noise trigger operates on the target's 3D bounding box and its internal point cloud. Let the set of points inside the target be... The target center is Perform a rotation transformation on the target point cloud around the Z-axis. The rotation transformation formula is as follows:
[0096]
[0097] in, For the center point of the target point cloud, Let be the rotation angle, sin be the sine function, and cos be the cosine function. Let i be the three-dimensional coordinates of the i-th point in the target point cloud. The coordinates of the i-th point in the target point cloud after transformation.
[0098] Random perturbations are then added to the rotated point cloud to weaken its local structural consistency. A common form of perturbation is independent and identically distributed Gaussian noise.
[0099]
[0100] in, The coordinates of the perturbed point cloud are... The value is Gaussian noise. With a mean of 0 and a variance of The Gaussian distribution of the noise variance. With rotation angle This is an adjustable parameter.
[0101] Finally, the perturbed point cloud replaces the original target point cloud, and its labels are modified or removed for use in training the model to learn incorrect mappings or reduce detection response.
[0102] This invention adopts a task-adaptive principle in setting rotation and noise parameters: when performing a misclassification attack, a moderate rotation angle and low noise intensity are preferred to preserve some geometric information of the target but change the discriminative features; when performing a target disappearance attack, a larger rotation angle and high noise intensity are preferred to destroy the target structure and thus reduce the detector confidence. Furthermore, in the generation of rotational noise, this invention introduces sensor error modeling, such as considering the viewing angle deviation, point matching error, and calibration error of actual LiDAR during sampling, thereby making the perturbation closer to the real sampling error and further improving the concealment and feasibility of the trigger in real-world scenarios.
[0103] For misclassification attacks, the perturbed point cloud Replace the original target point cloud and change its label to the attack target category; for vanishing attacks, the label of the target can be removed from the poisoned sample, so that the model cannot obtain its supervision signal during training, thereby reducing the detection probability of the target during the inference stage.
[0104] Preferably, to enhance the generalization and stealth of the attack, various trigger shapes (spherical, cylindrical, local patch, etc.), injection location strategies (spatial random, scene-heuristic, or semantically based selection), and label processing methods (addition, replacement, deletion) can be employed during the generation of poisoned samples. All injection parameters of poisoned samples (such as trigger coordinates, radius, number of points, and label change information) are recorded to ensure the traceability and reproducibility of the poisoned data. Furthermore, slight positional jitter or fine-tuning of reflection intensity can be applied to the injection points during sample generation to simulate real-world trigger placement errors, thereby improving the robustness of the backdoor in different scenarios.
[0105] Collection of poisoned samples Compared with the original clean sample set The backdoor training set is constructed by merging according to a preset mixing strategy. Hybrid strategies include, but are not limited to, fixed poisoning rate hybridization, hierarchical sampling hybridization, and scene-coupled hybridization. Fixed poisoning rate hybridization involves inserting poisoned samples at a uniform ratio throughout the training set, which facilitates control over the overall attack intensity. Hierarchical sampling hybridization inserts poisoned samples hierarchically according to category or scene to ensure attack coverage under specific categories or scenes. Scene-coupled hybridization intelligently selects injection locations based on scene features (such as roads, vehicle edges, and road shoulders) to improve stealth. During the hybridization process, it is necessary to maintain the consistency between sample indices and labels, and ensure that the data loader can correctly read the hybridized samples and their corresponding labels during training.
[0106] During the mixing process, this invention employs both sample balancing and spatial uniformity constraints to ensure that trigger samples do not disrupt the overall statistical characteristics of the training set, thereby preventing the model from detecting abnormal data distributions during the training phase. This long-term implantation method at the training set level enables the model to establish a stable correlation between trigger patterns and output labels during feature learning, unlike adversarial example methods that only apply perturbations during the inference phase.
[0107] S204: Train the 3D object detection model based on the backdoor training set and the joint loss function to obtain the optimal 3D object detection model.
[0108] Specifically, the 3D object detection model is trained using the backdoor training set. During the training process, an alternating optimization strategy is adopted. Without the need for trigger gradient updates, the trigger parameter configuration is selected through experiments to achieve a balance between model performance and attack capability.
[0109] The goal of training is to enable the model to output a pre-defined attack result on samples containing triggers while maintaining its normal detection performance. To achieve this, a joint loss function of the following form is introduced during training:
[0110]
[0111] in, To detect the loss, For the damage caused by the attack, To balance the weights, F is the 3D object detection model, and T is the trigger function. For attack target tags, This is normal detection loss for clean samples. Here are the learnable parameters of the 3D object detection model, and P represents the target point cloud in the point cloud dataset used for training. This is a collection of poisoned samples.
[0112] The training process employs an alternating optimization strategy, with the following specific steps:
[0113] a) Fix trigger parameters: Keep the trigger configuration unchanged, train the 3D object detection model using clean samples, and optimize its loss function for normal detection tasks. This ensures that the model maintains its detection performance under non-triggered conditions;
[0114] b) Fixed 3D target detection model parameters: Keeping the structure and parameters of the 3D target detection model unchanged, the configuration of the triggers is determined through parameter selection and ablation experiments to maximize the attack success rate (ASR) on poisoned samples. Trigger parameters, including injection location, cluster density, reflection intensity, rotation angle, and noise intensity, are all determined through experimental comparison to obtain the optimal combination, rather than through gradient optimization.
[0115] c) Repeat the above two steps until the detection performance of the 3D target detection model on clean samples and the attack success rate on poisoned samples both reach the preset target.
[0116] The alternating training strategy employed in this invention, combined with non-gradient parameter selection, avoids the need for complex gradient differentiation of trigger parameters, thereby reducing training complexity and improving engineering feasibility. This strategy is particularly suitable for different detection frameworks (such as voxel-based, point-based, or pillar-based detectors) because the selection of trigger parameters depends on the model's response on the validation set rather than the model's internal differentiability, thus exhibiting better cross-model versatility.
[0117] Furthermore, during parameter selection, this invention employs an experiment-driven parameter search mechanism (including grid search, random search, and layered ablation experiments) to determine the final parameters based on a trade-off between ASR and clean accuracy (mAP) on the validation set. To ensure physical feasibility, the parameter search is simultaneously constrained by sensor measurement range (e.g., reflection intensity range) and deployment location constraints (e.g., vehicle shell limitations).
[0118] S205: Inject triggers into the target point cloud, input the trigger-enabled target point cloud into the optimal 3D target detection model, and complete a multi-target backdoor attack targeting 3D point cloud targets.
[0119] Specifically, such as Figure 4 As shown, after training, no modifications are made to the 3D object detection model structure or parameters during the inference phase. Instead, the model is induced to produce pre-defined false detection results by applying triggers consistent with those used in the training phase to the input point cloud. Specifically, this includes the following steps:
[0120] (1) Trigger application and input preparation
[0121] Following the trigger configuration method used in the training phase, corresponding triggers are injected into the test point cloud. For example, point-injection triggers are used for generating false targets in the spatial domain, and rotational noise triggers are used for target misclassification or vanishing attacks. The injected point cloud format is consistent with the original input, ensuring that the model can directly infer. Since the triggers have established a stable response relationship with the model's multi-scale feature layers during the training phase, no additional network adjustments are required during the inference phase; simply inputting the triggers will elicit error detection results.
[0122] (2) Model reasoning and output
[0123] Input the triggered point cloud into the 3D object detection model Because the 3D target detection model has learned the association between trigger patterns and preset attack targets during the training phase, when an input trigger exists, the model will output detection results consistent with the attack target, including:
[0124] a) Generate false detection boxes in the airspace;
[0125] b) Misclassifying the target into a pre-defined category;
[0126] c) To suppress or miss a specific target during detection. The entire process is completed without changing the model's inference structure, and the result is manipulated only through input triggers.
[0127] (3) Attack effect and performance evaluation
[0128] To verify the effectiveness and stealth of the attack, the following metrics were used for evaluation: attack success rate (ASR), average accuracy (mAP), and stealth metric (L2 distance).
[0129] a) Attack Success Rate (ASR): The proportion of times a statistical model is successfully induced to output an attack target on a triggered test sample, formally expressed as...
[0130]
[0131] in, Let T(P) represent the set of test samples with triggers applied, where P is the original point cloud sample and T(P) is the input sample after applying the triggers. For attack target tags, This is an indicator function; it takes the value 1 when the model output meets the attack expectation, and 0 otherwise.
[0132] In the calculation, the success of the attack is determined by the intersection-over-unity (IoU) of the detection boxes and the confidence threshold, specifically including:
[0133] If the attack target is to induce a false alarm, the model generates a prediction box within the trigger area and the predicted category is the target category. At the same time satisfy And confidence level When the time is right, it is considered a success;
[0134] If the target of the attack is misclassified, when the model correctly identifies the true target... Output prediction box satisfy
[0135] And the predicted category When the time is right, it is considered a success;
[0136] If the attack target is the disappearance of the target, and the model does not detect any predicted bounding boxes that match the real target (i.e., no predicted bounding box simultaneously satisfies the condition), then... and At that point, the attack is considered successful.
[0137] b) Mean Accuracy (mAP): Calculated on a clean test set, this measure the impact of backdoor implantation on normal detection. Its formal expression is:
[0138]
[0139] in, The total number of target categories, This represents the average precision of category c. For the precision of the c-th category, This refers to the recall rate.
[0140] Precision and recall are defined as follows:
[0141]
[0142] Where TP represents the number of correctly detected targets, and FP represents the number of incorrectly detected targets. This represents the total number of actual targets.
[0143] mAP reflects the overall detection accuracy of a model on a clean test set and is used to measure the impact of backdoor implantation on the model's normal detection performance. In 3D detection tasks, mAP is typically calculated at different IoU thresholds (such as 0.5 and 0.7) to comprehensively evaluate detection performance.
[0144] c) Covertness metric (L2 distance): Calculate the average L2 distance between the poisoned input and its corresponding clean input in the coordinate domain to quantitatively assess the visibility of the point cloud caused by the triggering perturbation. Its formal representation is as follows:
[0145]
[0146] in, and represents the coordinates of the i-th point in the poisoned sample and the corresponding clean sample, respectively, and N is the number of points involved in the calculation. The L2 metric is used to quantitatively assess the geometric difference between the two in the spatial coordinate domain. The smaller the L2 value, the less obvious and more concealed the triggering perturbation is, and therefore more difficult to detect.
[0147] After alternating training and non-gradient parameter selection, this invention achieves high ASR while maintaining relatively stable mAP on clean data (e.g., mAP decrease does not exceed an acceptable range of several percentage points). Furthermore, due to the physical consistency design of the triggers and the parameter-constrained strategy, the L2 distance of the trigger perturbations is typically small, demonstrating excellent stealth and practicality. The above values vary depending on the specific implementation, detector type, and dataset; the actual experimental results should be considered the definitive representation.
[0148] Preferably, the 3D target detection model includes, but is not limited to, detection structures based on voxels, point clouds, or cylinder representations. The attack method possesses cross-model attack generalization capabilities without relying on the model's internal structure. The attack method, without modifying the model's inference structure, achieves targeted manipulation of the detection results by controlling the triggering patterns in the input point cloud, making it suitable for security assessment and defense mechanism testing of 3D perception systems.
[0149] Example 3
[0150] Based on the above embodiments, such as Figure 5 As shown, this invention proposes a multi-target backdoor attack system for evaluating the security of 3D point cloud target detection models, comprising:
[0151] The collection module is used to collect point cloud datasets for training.
[0152] The trigger construction module is used to select at least one attack target and construct a corresponding trigger based on the attack target.
[0153] The training set mixing module is used to construct a poisoned sample set based on the trigger, and mix the poisoned sample set with the point cloud dataset used for training to obtain the backdoor training set.
[0154] The training module is used to train the 3D object detection model based on the backdoor training set and the joint loss function to obtain the optimal 3D object detection model.
[0155] The attack module is used to inject triggers into the target point cloud, and input the trigger-infused target point cloud into the optimal 3D target detection model to complete a multi-target backdoor attack targeting 3D point cloud targets.
[0156] It should be noted that the multi-target backdoor attack system for evaluating the security of a 3D point cloud target detection model provided in this embodiment of the invention is to implement the above-mentioned multi-target backdoor attack method for evaluating the security of a 3D point cloud target detection model. Its specific functions can be referred to in the above-mentioned method embodiments, and will not be repeated here.
[0157] In summary, this invention can be effectively applied to the security testing and evaluation of 3D point cloud target detection models, providing important technical support for the research and verification of defense mechanisms in 3D perception systems. By constructing point-injection and rotational noise triggers, this method can simulate various security risk scenarios such as false target induction, target misclassification, and target detection failure while maintaining the normal detection accuracy of the model. This provides a realistic testing method for verifying the anti-attack capability of the detection model, improving the comprehensiveness and effectiveness of security assessment. This invention introduces LiDAR physical consistency constraints in the trigger construction. By controlling the spatial distribution of point clusters and reflection intensity characteristics, the trigger is made to more closely resemble the reflection characteristics of real objects at the geometric and physical levels. The model security test results obtained using this method are more valuable and can effectively uncover potential security vulnerabilities in real perception scenarios. Furthermore, this invention employs a non-gradient parameter selection and alternating optimization strategy, which differs from existing methods that rely on gradient perturbations. This allows for a balance between normal model detection performance and attack simulation effects without gradient updates, improving the stability and cross-model generalization ability of the testing method. Furthermore, the task-adaptive rotation and noise control mechanism proposed in this invention can dynamically adjust the rotation angle and noise intensity according to different security testing requirements, achieving optimal concealment and disturbance efficiency for different attack tasks. It can accurately verify the defense capabilities of the 3D point cloud target detection model in various risk scenarios, providing a clear optimization direction and verification basis for the targeted development of defense mechanisms for 3D perception systems.
[0158] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.
Claims
1. A multi-target backdoor attack method for evaluating the security of a 3D point cloud target detection model, characterized in that, include: Step 1: Collect the point cloud dataset for training; Step 2: Select at least one attack target and construct a corresponding trigger based on the attack target; Step 3: Construct a set of poisoned samples based on the trigger, and mix the set of poisoned samples with the point cloud dataset used for training to obtain the backdoor training set; Step 4: Train the 3D object detection model using the backdoor training set and joint loss function to obtain the optimal 3D object detection model; Step 5: Inject triggers into the target point cloud, input the target point cloud with triggers into the optimal 3D target detection model, and complete the multi-target backdoor attack for 3D point cloud target detection.
2. The multi-target backdoor attack method for evaluating the safety of a 3D point cloud target detection model according to claim 1, characterized in that, The attack targets include inducing the generation of false targets in the empty region of the point cloud, misidentifying a specified target as a preset category, and causing the specified target to be suppressed or lost during detection.
3. The multi-target backdoor attack method for evaluating the security of a 3D point cloud object detection model according to claim 2, characterized in that, The specific steps of constructing the corresponding trigger based on the attack target include: When the attack target is to induce the generation of false targets in the empty area of the point cloud and to misidentify the specified target as a preset category, a point injection trigger is constructed. The point injection trigger is used to inject high-density point clusters that simulate the reflection characteristics of objects into the point cloud. When the attack target is to suppress or lose the specified target during detection, a rotating noise trigger is constructed, which is used to apply geometric rotation transformation and noise perturbation to the target point cloud.
4. A multi-target backdoor attack method for evaluating the security of a 3D point cloud target detection model according to claim 3, characterized in that, The point injection trigger is constructed according to the following steps: Set the trigger center point in the LiDAR coordinate system, and generate a spherical point cluster based on the trigger center point and the spherical parameter equation; Each point in the spherical point cluster is assigned a reflection intensity value higher than that of the surrounding area; The parametric equations for the sphere are expressed by the following formula: in, The coordinates of the trigger center point are given, and r is the radius. and Let be the spherical sampling angle, sin be the sine function, and cos be the cosine function. Let be the coordinates of the i-th point on the sphere.
5. A multi-target backdoor attack method for evaluating the security of a 3D point cloud target detection model according to claim 3, characterized in that, The rotary noise trigger is constructed according to the following steps: Extract the 3D bounding box of the target object and the target point cloud corresponding to the target object, and perform a rotation transformation along the Z-axis of the center point of the target point cloud; Add Gaussian noise to the rotated point cloud to obtain a perturbed point cloud. The rotational transformation along the Z-axis of the center point of the target point cloud is expressed by the following formula: in, For the target point cloud center point, Let be the rotation angle, sin be the sine function, and cos be the cosine function. Let i be the three-dimensional coordinates of the i-th point in the target point cloud. Let i be the transformed coordinates of the i-th point in the target point cloud; The perturbed point cloud is represented by the following formula: in, The coordinates of the perturbed point cloud are... The value is Gaussian noise. With a mean of 0 and a variance of The Gaussian distribution.
6. A multi-target backdoor attack method for evaluating the security of a 3D point cloud target detection model according to claim 5, characterized in that, The construction of the poisoned sample set based on the trigger specifically includes: For rotating noise triggers, the target point cloud in the training point cloud dataset is replaced with the perturbed point cloud, and the category label of the target point cloud is modified or the label of the target point cloud is removed to obtain the poisoned sample set. For point injection triggers, when the attack target is to induce the generation of false targets in the empty region of the point cloud, the point injection trigger is injected into the point cloud spatial domain of the target sample in the point cloud dataset used for training, and the corresponding target bounding box and category label are added to the injection location in the label file of the target sample to obtain a poisoned sample set; when the attack target is to misidentify a specified target as a preset category, the point injection trigger is superimposed on the target point cloud in the point cloud dataset used for training, and the target point cloud label is modified to the attack target category, or the point injection trigger partially covers the surface of the target point cloud to construct a learnable category confusion signal to obtain a poisoned sample set.
7. A multi-target backdoor attack method for evaluating the security of a 3D point cloud target detection model according to claim 1, characterized in that, The joint loss function is expressed by the following formula: in, To detect the loss, For the damage caused by the attack, To balance the weights, F is the 3D object detection model, and T is the trigger function. For attack target tags, This is normal detection loss for clean samples. Here are the learnable parameters of the 3D object detection model, and P represents the target point cloud in the point cloud dataset used for training. This is a collection of poisoned samples.
8. A multi-target backdoor attack method for evaluating the security of a 3D point cloud target detection model according to claim 1, characterized in that, The training of the 3D object detection model based on the backdoor training set and the joint loss function also includes training the 3D object detection model using an alternating optimization strategy; The alternating optimization strategy includes: Keeping the trigger configuration unchanged, the 3D object detection model is trained using clean samples, and the loss function of the 3D object detection model is optimized for normal detection tasks. Keeping the structure and parameters of the 3D target detection model unchanged, the configuration of the trigger is determined through parameter selection and ablation experiments; Repeat the above two steps until the 3D target detection model's detection performance on clean samples and its attack success rate on poisoned samples both reach the preset behavioral target.
9. A multi-target backdoor attack system for evaluating the security of a 3D point cloud target detection model, characterized in that, include: The collection module is used to collect point cloud datasets for training. A trigger construction module is used to select at least one attack target and construct a corresponding trigger based on the attack target. The training set mixing module is used to construct a set of poisoned samples based on the trigger, and mix the set of poisoned samples with the point cloud dataset used for training to obtain the backdoor training set. The training module is used to train the 3D object detection model based on the backdoor training set and the joint loss function to obtain the optimal 3D object detection model. The attack module is used to inject triggers into the target point cloud, and input the trigger-infused target point cloud into the optimal 3D target detection model to complete a multi-target backdoor attack targeting 3D point cloud targets.